- OpenStack-announce - lists.openstack.org

[release][ironic] python-ironicclient release 0.9.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are content to announce the release of: python-ironicclient 0.9.0: OpenStack Bare Metal Provisioning API Client Library This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-ironicclient With package available at: https://pypi.python.org/pypi/python-ironicclient For more details, please see the git log history below and: http://launchpad.net/python-ironicclient/+milestone/0.9.0 Please report issues through launchpad: http://bugs.launchpad.net/python-ironicclient Changes in python-ironicclient 0.8.1..0.9.0 ------------------------------------------- 824025b Use doc8 style checker 9aa761f Fix the bug of incorrect spelling 07fc85c Replace six.iteritems() with .items() f672ac3 Allow 'abort' verb for node-set-provision-state 5afd483 Set a default endpoint value of None 6618390 Updated from global requirements ec7b3b1 Added unit test cases for command-line shell a5a15e4 Introduce openstackclient plugin b8691d0 Updated from global requirements 1338cd3 Remove unneeded param['detail'] setting Diffstat (except docs and test files) ------------------------------------- ironicclient/common/http.py | 4 +- ironicclient/osc/__init__.py | 0 ironicclient/osc/client.py | 51 +++ ironicclient/osc/plugin.py | 70 +++ ironicclient/osc/v1/__init__.py | 0 ironicclient/osc/v1/baremetal.py | 319 ++++++++++++++ ironicclient/v1/node_shell.py | 17 +- requirements.txt | 4 +- setup.cfg | 11 + setup.py | 2 +- test-requirements.txt | 1 + tox.ini | 1 + 22 files changed, 1456 insertions(+), 18 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7203d39..d0236f7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr<2.0,>=1.6 +pbr>=1.6 @@ -7,0 +8 @@ dogpile.cache>=0.5.4 +cliff>=1.14.0 # Apache-2.0 @@ -13,0 +15 @@ python-keystoneclient>=1.6.0 +python-openstackclient>=1.5.0 diff --git a/test-requirements.txt b/test-requirements.txt index 169c959..67223b4 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6,0 +7 @@ discover +doc8 # Apache-2.0

1 0

[release][openstack] os-client-config release 1.8.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are content to announce the release of: os-client-config 1.8.0: OpenStack Client Configuation Library This release is part of the mitaka release series. With package available at: https://pypi.python.org/pypi/os-client-config For more details, please see the git log history below. Notable changes ---------------- Bugfixes. Added SWITCHengines to vendor list. Properly handle OS_CLOUD and OS_REGION_NAME when mixing ansible and openstackclient. Changes in os-client-config 1.7.5..1.8.0 ---------------------------------------- d3c82ab Fix two typos 21ff307 Put in override for Rackspace broken neutron 7d84f10 Support passing force_ipv4 to the constructor 733c04f identity version is 2.0 723b893 Handle OS_CLOUD and OS_REGION_NAME friendly-like 79637b1 Added SWITCHengines vendor file 988e305 update RST for readme so pypi looks pretty 75954fa Add support for Catalyst as vendor Diffstat (except docs and test files) ------------------------------------- README.rst | 30 +++++++++++------- os_client_config/cloud_config.py | 10 ++++-- os_client_config/config.py | 47 +++++++++++++++++++++++------ os_client_config/defaults.yaml | 2 +- os_client_config/vendors/catalyst.yaml | 10 ++++++ os_client_config/vendors/rackspace.yaml | 1 + os_client_config/vendors/switchengines.yaml | 9 ++++++ 11 files changed, 132 insertions(+), 31 deletions(-)

1 0

[release][ironic] ironic-lib release 0.2.0 (mitaka)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are amped to announce the release of: ironic-lib 0.2.0: Ironic common library This release is part of the mitaka release series. With package available at: https://pypi.python.org/pypi/ironic-lib For more details, please see the git log history below. Changes in ironic-lib 0.1.0..0.2.0 ---------------------------------- cf73a8f Move to oslo.i18n 63f83cc Put py34 first in the env order of tox a66db84 Remove README.md and update README.rst 467c10d Update link for where to report bugs f163009 Remove execute permission from exception.py d7d3d03 Add a cover target to tox eb1277c Better optimize test runs fb520b1 Move tests/ under ironic_lib/, use ostestr 46a29ec Remove TODO 854ece3 Update setup.cfg 618ab03 Use standard locale when executing 'dd' command 3bb86b2 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- CONTRIBUTING.rst | 2 +- README.md | 2 - README.rst | 5 + TODO.rst | 23 -- ironic_lib/common/__init__.py | 0 ironic_lib/common/i18n.py | 31 ++ ironic_lib/disk_partitioner.py | 4 +- ironic_lib/disk_utils.py | 15 +- ironic_lib/exception.py | 4 +- ironic_lib/utils.py | 6 +- requirements.txt | 3 +- setup.cfg | 3 +- setup.py | 2 +- test-requirements.txt | 2 +- tox.ini | 16 +- 24 files changed, 1052 insertions(+), 1030 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 2b1fb18..b21a88b 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=1.6 +pbr>=1.6 @@ -11,0 +12 @@ oslo.config>=2.3.0 # Apache-2.0 +oslo.i18n>=1.5.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index e42aa2c..392154f 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -13 +12,0 @@ sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 -testrepository>=0.0.18 @@ -16,0 +16 @@ mox3>=0.7.0 +os-testr>=0.1.0

1 0

[release][stable][openstack] python-openstackclient release 1.7.1 (liberty)
by doug＠doughellmann.com 01 Oct '15

01 Oct '15

We are overjoyed to announce the release of: python-openstackclient 1.7.1: OpenStack Command-line Client This release is part of the liberty stable release series. With source available at: https://git.openstack.org/cgit/openstack/python-openstackclient With package available at: https://pypi.python.org/pypi/python-openstackclient For more details, please see the git log history below and: https://launchpad.net/python-openstackclient/+milestone/1.7.1 Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient Changes in python-openstackclient 1.7.0..1.7.1 ---------------------------------------------- 599905e Release notes 1.7.1 0e89d08 docs: pip install -e needs an argument 8faabb3 Glance `image set` Resolve Fracturing 9e6f99e Use `discover_extensions` for novaclient 00eebaf Override the debug default and help text Diffstat (except docs and test files) ------------------------------------- openstackclient/compute/client.py | 10 ++--- openstackclient/image/v2/image.py | 64 +++++++++++++++++++++++++--- openstackclient/shell.py | 4 ++ 7 files changed, 132 insertions(+), 17 deletions(-)

1 0

[release][nova] python-novaclient release 2.31.0 (mitaka)
by davanum＠gmail.com 01 Oct '15

01 Oct '15

We are thrilled to announce the release of: python-novaclient 2.31.0: Client library for OpenStack Compute API This release is part of the mitaka release series. With source available at: http://git.openstack.org/cgit/openstack/python-novaclient With package available at: https://pypi.python.org/pypi/python-novaclient For more details, please see the git log history below and: http://launchpad.net/python-novaclient/+milestone/2.31.0 Please report issues through launchpad: http://bugs.launchpad.net/python-novaclient Changes in python-novaclient 2.30.0..2.31.0 ------------------------------------------- abd0630 Always send volume_id when booting with legacy bdm 3350a57 Change default service_type for volumes managers 0455932 Split functional tests for legacy(V2.1) and microversions 2793331 Specify api_version for functional tests 3e99d3f Improve help strings Diffstat (except docs and test files) ------------------------------------- novaclient/base.py | 17 +- novaclient/shell.py | 16 +- .../functional/v2/legacy/test_readonly_nova.py | 191 ++++++++++++++++++++ novaclient/v2/shell.py | 200 +++++++++++---------- novaclient/v2/volume_snapshots.py | 13 +- novaclient/v2/volume_types.py | 12 +- novaclient/v2/volumes.py | 12 +- 32 files changed, 1060 insertions(+), 844 deletions(-)

1 0

[release][stable][nova] python-novaclient release 2.30.1 (liberty)
by davanum＠gmail.com 01 Oct '15

01 Oct '15

We are eager to announce the release of: python-novaclient 2.30.1: Client library for OpenStack Compute API This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/python-novaclient With package available at: https://pypi.python.org/pypi/python-novaclient For more details, please see the git log history below and: http://launchpad.net/python-novaclient/+milestone/2.30.1 Please report issues through launchpad: http://bugs.launchpad.net/python-novaclient Changes in python-novaclient 2.30.0..2.30.1 ------------------------------------------- 3424bc6 Always send volume_id when booting with legacy bdm 0afb131 Update .gitreview for stable/liberty Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + novaclient/base.py | 4 +++- 3 files changed, 24 insertions(+), 4 deletions(-)

1 0

[release][stable][sahara] python-saharaclient release 0.11.1 (liberty)
by Sergey Lukjanov 29 Sep '15

29 Sep '15

We are eager to announce the release of: python-saharaclient 0.11.1: Client library for Sahara API This release is part of the liberty stable release series. With source available at: http://git.openstack.org/cgit/openstack/python-saharaclient With package available at: https://pypi.python.org/pypi/python-saharaclient For more details, please see the git log history below and: http://launchpad.net/python-saharaclient/+milestone/0.11.1 Please report issues through launchpad: http://bugs.launchpad.net/python-saharaclient Changes in python-saharaclient 0.11.0..0.11.1 --------------------------------------------- 52b1c1d Updating saharaclient api docs 7240b0e Updated from global requirements 2646595 Change ignore-errors to ignore_errors 660dc7b Fixing cluster and node group template updates da1d4cb Remove `data source update` from setup.cfg bd35e41 Adding missed public/protected support for jobs creation cc9123d Fix functional tests in saharaclient 1421609 Update .gitreview for stable/liberty Diffstat (except docs and test files) ------------------------------------- .coveragerc | 2 +- .gitreview | 1 + requirements.txt | 2 +- saharaclient/api/cluster_templates.py | 51 ++++++------ saharaclient/api/jobs.py | 7 +- saharaclient/api/node_group_templates.py | 72 +++++++---------- setup.cfg | 1 - setup.py | 2 +- test-requirements.txt | 6 +- 12 files changed, 115 insertions(+), 125 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index dd734cb..d6629e9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr<2.0,>=1.6 +pbr>=1.6 diff --git a/test-requirements.txt b/test-requirements.txt index 0158543..1f0b3da 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -12,2 +12,2 @@ oslosphinx>=2.5.0 # Apache-2.0 -python-neutronclient<3,>=2.6.0 -python-novaclient>=2.26.0 +python-neutronclient>=2.6.0 +python-novaclient>=2.28.1 @@ -17 +17 @@ sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 -tempest-lib>=0.6.1 +tempest-lib>=0.8.0

1 0

[release] [ironic] [inspector] ironic-inspector release 2.2.0 (liberty)
by Dmitry Tantsur 28 Sep '15

28 Sep '15

We are content to announce the release of: ironic-inspector 2.2.0: Hardware introspection for OpenStack Bare Metal With source available at: http://git.openstack.org/cgit/openstack/ironic-inspector This release introduced database migrations, be sure to initialize the database schema version: https://github.com/openstack/ironic-inspector#managing-the-ironic-inspector… Highlights of the release: * Hook interface changed to move away from returning patches to just calling ironic to apply changes * API to expose introspection data * User-settable introspection rules * Root device hints * Support for ironic-python-agent * Support for Alembic and rootwrap For more details, please see the git log history below and: http://launchpad.net/ironic-inspector/+milestone/2.2.0 Please report issues through launchpad: http://bugs.launchpad.net/ironic-inspector Changes in ironic-inspector 2.1.0..2.2.0 ---------------------------------------- b57cf89 Add troubleshooting section for Ubuntu DNS issues 7b7130a Add a warning about sudoers file 92a8550 Add explicit dependencies on Alembic and SA 5552d0d Update README with extra_hardware plugin changes bef7617 Don't rely on dict ordering in test_plugins_standard 8d0a04d Fix rootwrap configuration documentation 6a2bd8e devstack: allow nodes to be already MANAGEABLE in exercise db7865a Updated from global requirements aa3b8ba Add alembic migrations for the inspector database 52ef561 Use rootwrap to execute iptables instead of requiring root dc8d2fa Support IPA in raid_device plugin 973dd16 Convert eDeploy data so that rules can process it ad788cf Stop recommending using DIB from source 8f7f889 Allow empty lookup attributes if node_not_found_hook is provided de2108d Switch to using CLI for introspection rules 6c686e8 Add missing plugins for introspection rules 6d06f09 Ignore IPMI Address for IPMI Bridged nodes 0defa89 Updated from global requirements 8fc9f7a Replace glance and keystone commands with OSC equivalents 13b11c8 Smart root disk selection including support for root device hints d5f0817 Add API Discovery to Ironic Inspector 9d95e05 Add mock for check_call to all firewall tests b338739 Updated from global requirements 105aa64 Deprecate returning patches from plugins eb9b3da Add introspection rules support 1bdf87c Add instructions how to try IPA as a ramdisk f21eb0a Stop using configuration options in top level code 7b3ed65 Split standard plugin tests from other processing tests 5b02639 Move update functions to NodeInfo object 4aedc45 Enable colorized logging in devstack plugin 676a581 Revisit required provision states 22c670a Updated from global requirements d7447b3 Add logging to introspection data storage 5831723 Make list of ipmi_address-alike driver fields configurable f02540a Fix logic for internal server error 3f7054e Pass -w flag to iptables to make it wait for xtables lock 6eb9f58 Store and expose introspection data c0ffce0 Updated from global requirements 7343cad Rename plugin root_device_hint -> raid_device 2ab0770 Clean up README 0d11309 Fail introspection early if no lookup attributes can be detected d456bbb Updated from global requirements 535d1d1 Mock socket in test_bad_hostname_errors 61b78a8 Copy gitignore from ironic 661e818 Updated from global requirements 38ee234 Add func3 tox environment for functional testing with Python 3. Diffstat (except docs and test files) ------------------------------------- .gitignore | 40 +- CONTRIBUTING.rst | 92 ++++- HTTP-API.rst | 120 ++++++ README.rst | 331 ++++++++++++---- devstack/exercise.sh | 78 +++- devstack/plugin.sh | 39 +- example.conf | 32 +- ironic_inspector/alembic.ini | 38 ++ ironic_inspector/common/swift.py | 54 +++ ironic_inspector/conf.py | 29 +- ironic_inspector/db.py | 55 ++- ironic_inspector/dbsync.py | 90 +++++ ironic_inspector/firewall.py | 23 +- ironic_inspector/introspect.py | 24 +- ironic_inspector/main.py | 132 ++++++- ironic_inspector/migrations/env.py | 82 ++++ ironic_inspector/migrations/script.py.mako | 36 ++ .../versions/578f84f38d_inital_db_schema.py | 63 ++++ .../migrations/versions/d588418040d_add_rules.py | 64 ++++ ironic_inspector/node_cache.py | 154 +++++++- ironic_inspector/plugins/base.py | 137 +++++-- ironic_inspector/plugins/example.py | 11 +- ironic_inspector/plugins/extra_hardware.py | 52 ++- ironic_inspector/plugins/raid_device.py | 100 +++++ ironic_inspector/plugins/root_device_hint.py | 94 ----- ironic_inspector/plugins/rules.py | 140 +++++++ ironic_inspector/plugins/standard.py | 89 ++++- ironic_inspector/process.py | 63 ++-- ironic_inspector/rules.py | 381 +++++++++++++++++++ ironic_inspector/test/base.py | 15 + ironic_inspector/test/functional.py | 212 ++++++++++- ironic_inspector/test/test_firewall.py | 47 ++- ironic_inspector/test/test_introspect.py | 115 +++++- ironic_inspector/test/test_main.py | 196 +++++++++- ironic_inspector/test/test_node_cache.py | 158 +++++++- ironic_inspector/test/test_plugins_base.py | 44 +++ .../test/test_plugins_extra_hardware.py | 79 ++-- ironic_inspector/test/test_plugins_raid_device.py | 132 +++++++ .../test/test_plugins_root_device_hint.py | 103 ----- ironic_inspector/test/test_plugins_rules.py | 216 +++++++++++ ironic_inspector/test/test_plugins_standard.py | 284 ++++++++++++++ ironic_inspector/test/test_process.py | 244 +++--------- ironic_inspector/test/test_rules.py | 420 +++++++++++++++++++++ ironic_inspector/test/test_swift.py | 78 +++- ironic_inspector/test/test_utils.py | 37 +- ironic_inspector/utils.py | 41 +- plugin-requirements.txt | 2 - requirements.txt | 17 +- rootwrap.conf | 27 ++ rootwrap.d/ironic-inspector-firewall.filters | 6 + setup.cfg | 23 +- setup.py | 2 +- tox.ini | 5 + 53 files changed, 4408 insertions(+), 738 deletions(-) Requirements updates -------------------- diff --git a/plugin-requirements.txt b/plugin-requirements.txt index 9dc610c..e69de29 100644 --- a/plugin-requirements.txt +++ b/plugin-requirements.txt @@ -1,2 +0,0 @@ -# required for extra_hardware plugin -python-swiftclient>=2.2.0 diff --git a/requirements.txt b/requirements.txt index eac89f8..18d7b2a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -3,0 +4 @@ +alembic>=0.8.0 @@ -6,0 +8,2 @@ Flask<1.0,>=0.10 +jsonpath-rw<2.0,>=1.2.0 +jsonschema!=2.5.0,<3.0.0,>=2.0.0 @@ -8,2 +11,3 @@ keystonemiddleware>=2.0.0 -pbr<2.0,>=1.4 -python-ironicclient>=0.6.0 +netaddr!=0.7.16,>=0.7.12 +pbr>=1.6 +python-ironicclient>=0.8.0 @@ -11,2 +15,3 @@ python-keystoneclient>=1.6.0 -oslo.config>=1.11.0 # Apache-2.0 -oslo.db>=2.0 # Apache-2.0 +python-swiftclient>=2.2.0 +oslo.config>=2.3.0 # Apache-2.0 +oslo.db>=2.4.1 # Apache-2.0 @@ -15 +20,2 @@ oslo.log>=1.8.0 # Apache-2.0 -oslo.utils>=1.9.0 # Apache-2.0 +oslo.rootwrap>=2.0.0 # Apache-2.0 +oslo.utils>=2.0.0 # Apache-2.0 @@ -17,0 +24 @@ stevedore>=1.5.0 # Apache-2.0 +SQLAlchemy>=0.9.9,<1.1.0

1 0

OpenStack Weekly Community Newsletter (Sept.,19 – 25)
by Jay Fankhauser 25 Sep '15

25 Sep '15

Register for OpenStack Summit Tokyo 2015 <https://www.eventbrite.com/e/openstack-summit-october-2015-tokyo-tickets-17…> Full access registration prices increase on 9/29 at 11:59pm PT This trove of user stories highlights what people want in OpenStack <http://superuser.openstack.org/articles/this-trove-of-user-stories-highligh…> The Product Working Group recently launched a Git repository to collect requirements ranging from encrypted storage to rolling upgrades. How storage works in containers <http://superuser.openstack.org/articles/how-storage-works-in-containers> Nick Gerasimatos, senior director of cloud services engineering at FICO, dives into the lack of persistent storage with containers and how Docker volumes and data containers provide a fix. The Road to Tokyo Get your OpenStack Summit Tokyo visa in five steps: Deadline for Visa invitation requests is 10/1 <http://superuser.openstack.org/articles/get-your-openstack-summit-tokyo-vis…> The schedule and mobile app for the OpenStack Summit in Tokyo are now available <https://www.openstack.org/summit/tokyo-2015/schedule/> Community feedback OpenStack is always interested in feedback and community contributions, if you would like to see a new section in the OpenStack Weekly Community Newsletter or have ideas on how to present content please get in touch: community(a)openstack.org <mailto:community@openstack.org>. Reports from Previous Events OpenStack Heats Up Silicon Valley <https://developer.ibm.com/opentech/2015/09/20/openstack-heats-up-silicon-va…> OpenStack Day Benelux 2015 <http://superuser.openstack.org/articles/openstack-day-benelux-2015> Deadlines and Contributors Notifications Liberty Release Oct., 15, 2015 <https://wiki.openstack.org/wiki/Liberty_Release_Schedule> Security Advisories and Notices [openstack-announce] [OSSA 2015-019] Glance image status manipulation (CVE-2015-5251) <http://lists.openstack.org/pipermail/openstack-announce/2015-September/0006…> Tips ‘n Tricks By Swapnil Kulkarni <http://blog.coolsvap.net/>: [OpenStack][RDO] Liberty Test-Day <http://blog.coolsvap.net/2015/09/24/openstackrdo-test-day-liberty/> Upcoming Events <https://www.openstack.org/community/events> Sep 28, 2015 – Jan 3, 2016 Presenting At PyCon (call for papers) Portland,OR, US <https://us.pycon.org/2016/speaking/> Sep 29 – 30, 2015 Cloud Storage in OpenStack <https://groups.openstack.org/groups/frederick-md/cloud-storage-openstack> Oct 01, 2015 OpenStack Meetup Cluj Cluj-Napoc, Cluj, RO <http://www.meetup.com/OpenStackRomania/events/222910344/> Oct 01, 2015 South Bay OpenStack Meetup, Beginner track San Francisco, CA, US <http://www.meetup.com/openstack/events/221806052/> Oct 01 – 02, 2015 October OpenStack Meetup – SDN and Containers Chicago, IL, US <http://www.meetup.com/meetup-group-NjZdcegA/events/225081881/> Oct 04 – 08, 2015 Gartner SymposiumITxpo Orlando, FL, US <http://www.gartner.com/events/na/orlando-symposium> Oct 06, 2015 October Sydney Meetup <http://www.meetup.com/Australian-OpenStack-User-Group/events/220202327/> Oct 07, 2015 Houston OpenStack Meetup Houston, TX, US <http://www.meetup.com/openstackhoustonmeetup/events/224870393/?eventId=2248…> Oct 07 – 08, 2015 OpenStack Liberty Release Richardson, TX, US <http://www.meetup.com/OpenStack-DFW/events/225014699/> Oct 07 – 08, 2015 OpenStack 101 Houston, TX, US <http://www.meetup.com/openstackhoustonmeetup/events/224870393/>What you need to know from the developer’s list Handling Projects with no PTL candidates <http://lists.openstack.org/pipermail/openstack-dev/2015-September/075227.ht…> The technical committee will appoint a PTL [1] if there is no identified eligible candidate. Appointed PTLs: Robert Clark nominated security PTL Serg Melikyan nominated Murano PTL Douglas Mendizabal nominated Barbican PTL Election for Magnum PTL between Adrian Otto and Hongbin Lu MagnetoDB being abandoned, not PTL was chosen. Instead, it will be fast tracked for removal [2] from the official list of OpenStack projects. Release help needed - we are incompatible with ourselves <http://lists.openstack.org/pipermail/openstack-dev/2015-September/075075.ht…> Robert Collins raises that while the constraints system in place for how we recognize incompatible components in our release is working, the release team needs help from the community to fix the incompatibility that exists so we can cut the full Liberty release. Issues that exist: OpenStack client not able to create an image. Fix is merged [3]. Semver and dependency changes <http://lists.openstack.org/pipermail/openstack-dev/2015-September/075107.ht…> Robert Collins says currently we don’t provide guidance on what happens when the only changes in a project are dependency changes and a release is made. Today the release team treats dependency changes as a “feature” rather than a bug fix. (e.g. if the previous release 1.2.3, requirement sync happens, the next version is 1.3.0.) Reasons behind this are complex, some guidance is needed to answer the questions: Is this requirements change an API break? Is this requirements change feature work? Is this requirements change a bug fix? All of these questions can be true. Some examples: If library X exposes library Y as part of its API, and library Y’s dependency changes from Y>=1 to Y>=2. X does this because it needs a feature from Y==2. Library Y is not exposed in library X’s API, however, a change in Y’s dependencies for X will impact users who independently use Y. (ignoring intricacies surrounding PIP here.) Proposal: nothing -> a requirement -> major version change 1.x.y -> 2.0.0 -> major version change 1.2.y -> 1.3.0 -> minor version change 1.2.3. -> 1.2.4 -> patch version change Thierry Carrez is ok with the last two proposals. Defaulting to a major version bump sounds a bit overkill. Doug Hellmann reminds that we can’t assume the dependency is using semver itself. We would need something other than the version number to determine from the outside whether the API is in fact breaking. Due this problem being so complicated, Doug would rather over-simplify the analysis of requirements updates until we’re better at identifying our own API breaking changes and differentiating between features and bug fixes. This will allow us to be consistent, if not 100% correct. Criteria for applying vulnerability:managed tag <http://lists.openstack.org/pipermail/openstack-dev/2015-September/073435.ht…> The vulnerability management processes were brought to the big tent a couple of months ago [4]. Initially we listed what repos the Vulnerability Manage Team (VMT) tracks for vulnerabilities. TC decided to change this from repos to deliverables as per-repo tags were decided against. Jeremy Stanley provides transparency for how deliverables can qualify for this tag: All repos in a given deliverable must qualify. If one repo doesn’t, they all don’t in a given deliverable. Points of contact: Deliverable must have a dedicated point of contact. The VMT will engage with this contact to triage reports. A group of core reviewers should be part of the <project>-corsec team and will: Confirm whether a bug is accurate/applicable. Provide pre-approval of patches attached to reports. The PTLs for the deliverable should agree to act as (or delegate) a vulnerability management liaison to escalate for the VMT. The bug tracker for the repos within a deliverable should have a bug tracker configured to initially provide access to privately reported vulnerabilities initially to the VMT. The VMT will determine if the vulnerability is reported against the correct deliverable and redirect when possible. The deliverable repos should undergo a third-party review/audit looking for obvious signs of insecure design or risky implementation. This aims to keep the VMT’s workload down. It has not been identified who will perform this review. Maybe the OpenStack Security project team? Review of this proposal is posted [5]. Consistent support for SSL termination proxies across all APIs <http://lists.openstack.org/pipermail/openstack-dev/2015-September/074871.ht…> While a bug [6] was being debugged, an issue was identified where an API sitting behind a proxy performing SSL termination would not generate the right redirection (http instead of https). A review [7] has been given to have a config option ‘secure_proxy_ssl_header’ which allows the API service to detect ssl termination based on the header X-Forwarded-Proto. Another bug back in 2014 was open with the same issue [8]. Several projects applied patches to fix this issue, but are inconsistent: Glance added public_endpoint config Cinder added public_endpoint config Heat added secure_proxy_ssl_header config (through heat.api.openstack:sslmiddleware_filter) Nova added secure_proxy_ssl_header config Manila added secure_proxy_ssl_header config (through oslo_middleware.ssl:SSLMiddleware.factory) Ironic added public_endpoint config Keystone added secure_proxy_ssl_header config Ben Nemec comments that solving this at the service level is the wrong place, due to this requiring changes in a bunch of different API services. Instead it should be fixed in the proxy that’s converting the traffic to http. Sean Dague notes that this should be done in the service catalog. Service discovery is a base thing that all services should use in talking to each other. There’s an OpenStack spec [9] in an attempt to get a handle on this Mathieu Gagné notes that this won’t work. There is a “split view” in the service catalog where internal management nodes have a specific catalog and public nodes (for users) have a different one. Suggestion to use oslo middleware SSL for supporting the ‘secure_proxy_ssl_header’ config to fix the problem with little code. Sean agrees the split view needs to be considered, however, another layer of work shouldn’t decide if the service catalog is a good way to keep track of what our service urls are. We shouldn’t push a model where Keystone is optional. Sean notes that while the ‘secure_proxy_ssl_header’ config solution supports the cases where there’s a 1 HA proxy with SSL termination to 1 API service, it may not work in the cases where there’s a 1 API service to N HA Proxies for: Clients needing to understand the “Location:” headers correctly. Libraries like request/phatomjs can follow the links provided in REST documents, and they’re correct. The minority of services that “operate without keystone” as an option are able to function. ZZelle mentions this solution does not work in the cases when the service itself acts as a proxy (e.g. nova image-list). Would this solution work in the HA Proxy case where there is one terminating address for multiple backend servers? Yes, by honoring the headers X-Forwarded-Host and X-Forwarded-Port which are set by HTTP proxies, making WSGI applications unaware of the fact that there is a request in front of them. Jamie Lennox says this same topic came up as a block in a Devstack patch to get TLS testing in the gate with HA Proxy. Longer term solution, transition services to use relative links. This is a pretty serious change. We’ve been returning absolute URLs forever, so assuming that all client code out there would with relative code is a big assumption. That’s a major version for sure. Sean agrees that we have enough pieces to get something better with proxy headers for Mitaka. We can do the remaining edge cases if clean up the service catalog use. [1] - http://governance.openstack.org/resolutions/20141128-elections-process-for-… <http://governance.openstack.org/resolutions/20141128-elections-process-for-…> [2] - https://review.openstack.org/#/c/224743/ <https://review.openstack.org/#/c/224743/> [3] - https://review.openstack.org/#/c/225443/ <https://review.openstack.org/#/c/225443/> [4] - http://governance.openstack.org/reference/tags/vulnerability_managed.html <http://governance.openstack.org/reference/tags/vulnerability_managed.html> [5] - https://review.openstack.org/#/c/226869/ <https://review.openstack.org/#/c/226869/> [6] - https://bugs.launchpad.net/python-novaclient/+bug/1491579 <https://bugs.launchpad.net/python-novaclient/+bug/1491579> [7] - https://review.openstack.org/#/c/206479/ <https://review.openstack.org/#/c/206479/> [8] - https://bugs.launchpad.net/glance/+bug/1384379 <https://bugs.launchpad.net/glance/+bug/1384379> [9] - https://review.openstack.org/#/c/181393/ <https://review.openstack.org/#/c/181393/> The weekly newsletter is a way for the community to learn about all the various activities in the OpenStack world._______________________________________________ Community mailing list Community(a)lists.openstack.org <mailto:Community@lists.openstack.org> http://lists.openstack.org/cgi-bin/mailman/listinfo/community <http://lists.openstack.org/cgi-bin/mailman/listinfo/community>

1 0

[release][ironic] Ironic 4.2.0 release
by Jim Rollenhagen 25 Sep '15

25 Sep '15

Hi all, I'm proud to announce the release of Ironic 4.2.0! This follows quickly on our 4.1.0 release with 21 bug fixes, and marks the completion of four blueprints. It is also the basis for our stable/Liberty branch, and will be included in the coordinated OpenStack Liberty release. Major changes are listed below and at http://docs.openstack.org/developer/ironic/releasenotes/ and full release details are available on Launchpad: https://launchpad.net/ironic/liberty/4.2.0 * Deprecated the bash ramdisk The older bash ramdisk built by diskimage-builder is now deprecated and support will be removed at the beginning of the "N" development cycle. Users should migrate to a ramdisk running ironic-python-agent, which now also supports the pxe_* drivers that the bash ramdisk was responsible for. For more info on building an ironic-python-agent ramdisk, see: http://docs.openstack.org/developer/ironic/deploy/install-guide.html#buildi… * Raised API version to 1.14 * 1.12 allows setting RAID properties for a node; however support for putting this configuration on a node is not yet implemented for in-tree drivers; this will be added in a future release. * 1.13 adds a new 'abort' verb to the provision state API. This may be used to abort cleaning for nodes in the CLEANWAIT state. * 1.14 makes the following endpoints discoverable in the API: * /v1/nodes/<UUID or logical name>/states * /v1/drivers/<driver name>/properties * Implemented a new Boot interface for drivers This change enhances the driver interface for driver authors, and should not affect users of Ironic, by splitting control of booting a server from the DeployInterface. The BootInterface is responsible for booting an image on a server, while the DeployInterface is responsible for deploying a tenant image to a server. This has been implemented in most in-tree drivers, and is a backwards-compatible change for out-of-tree drivers. The following in-tree drivers will be updated in a forth-coming release: * agent_ilo * agent_irmc * iscsi_ilo * iscsi_irmc * Implemented a new RAID interface for drivers This change enhances the driver interface for driver authors. Drivers may begin implementing this interface to support RAID configuration for nodes. This is not yet implemented for any in-tree drivers. * Image size is now checked before deployment with agent drivers The agent must download the tenant image in full before writing it to disk. As such, the server being deployed must have enough RAM for running the agent and storing the image. This is now checked before Ironic tells the agent to deploy an image. An optional config [agent]memory_consumed_by_agent is provided. When Ironic does this check, this config option may be set to factor in the amount of RAM to reserve for running the agent. * Added Cisco IMC driver This driver supports managing Cisco UCS C-series servers through the CIMC API, rather than IPMI. Documentation is available at: http://docs.openstack.org/developer/ironic/drivers/cimc.html * iLO virtual media drivers can work without Swift iLO virtual media drivers (iscsi_ilo and agent_ilo) can work standalone without Swift, by configuring an HTTP(S) server for hosting the deploy/boot images. A web server needs to be running on every conductor node and needs to be configured in ironic.conf. iLO driver documentation is available at: http://docs.openstack.org/developer/ironic/drivers/ilo.html // jim + deva

1 0