- OpenStack-announce - lists.openstack.org

[new][nova] nova 12.0.5 release (liberty)
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are ecstatic to announce the release of: nova 12.0.5: Cloud computing fabric controller This release is part of the liberty stable release series. For more details, please see below. 12.0.5 ^^^^^^ Security Issues * The qemu-img tool now has resource limits applied which prevent it from using more than 1GB of address space or more than 2 seconds of CPU time. This provides protection against denial of service attacks from maliciously crafted or corrupted disk images. oslo.concurrency>=2.6.1 is required for this fix. Changes in nova 12.0.4..12.0.5 ------------------------------ 6bc37dc virt: set address space & CPU time limits when running qemu-img 15cfd03 Refresh info_cache after deleting floating IP bedee79 Updated from global requirements 9ab10b8 Fix booting fail when unlimited project quota 53fffe0 Update instance host in post live migration even when exception occurs 3e1a0db Updated from global requirements 0e1bb7e Fix duplicate lines in policy.json Diffstat (except docs and test files) ------------------------------------- etc/nova/policy.json | 3 - nova/compute/manager.py | 40 ++++--- nova/db/sqlalchemy/api.py | 11 +- nova/network/neutronv2/api.py | 14 ++- nova/virt/images.py | 16 ++- .../apply-limits-to-qemu-img-8813f7a333ebdf69.yaml | 8 ++ requirements.txt | 4 +- test-requirements.txt | 2 +- 15 files changed, 242 insertions(+), 126 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 050091e..c1fd413 100644 --- a/requirements.txt +++ b/requirements.txt @@ -35 +35 @@ stevedore>=1.5.0 # Apache-2.0 -setuptools>=16.0 +setuptools!=24.0.0,>=16.0 @@ -54 +54 @@ alembic>=0.8.0 -os-brick>=0.4.0 # Apache-2.0 +os-brick!=1.4.0,>=0.4.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 074337d..4e33195 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -11 +11 @@ psycopg2>=2.5 -PyMySQL>=0.6.2 # MIT License +PyMySQL!=0.7.7,>=0.6.2 # MIT License

1 0

[new][openstackansible] openstack-ansible 12.2.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are glad to announce the release of: openstack-ansible 12.2.4: Ansible playbooks for deploying OpenStack With source available at: http://git.openstack.org/cgit/openstack/openstack-ansible For more details, please see below. 12.2.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * The upgrade playbook *nova-flavor-migration.yml* will perform a migration of nova flavor data. This will need to be completed prior to upgrading to Liberty. It is recommended that Kilo be deployed from the *eol-kilo* tag prior to upgrading to Liberty to ensure that this task is completed successfully. This upgrade task is related to bug 1594584 (https://bugs.launchpad.net/openstack-ansible/+bug/1594584) * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no * New overrides are provided to allow for better customization around logfile retention and rate limiting for UDP/TCP sockets. "rsyslog_server_logrotation_window" defaults to 14 days "rsyslog_server_ratelimit_interval" defaults to 0 seconds "rsyslog_server_ratelimit_burst" defaults to 10000 * The rsyslog.conf is now using v7+ style configuration settings Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible 12.2.3..12.2.4 ------------------------------------------- 5cbbe80 Add upgrade playbook to force nova flavor migrate 2d9cd36 Separate remote rsyslog stream from local f1536d8 Update all SHAs for 12.2.4 296a89a Point auditor service at the replicator config 555d506 Add collect_statistics_interval, rates_mode in rabbitmq.config template Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 2 +- global-requirement-pins.txt | 2 +- .../defaults/repo_packages/openstack_services.yml | 26 +++++----- playbooks/inventory/group_vars/all.yml | 2 +- playbooks/inventory/group_vars/hosts.yml | 2 +- .../os_swift/tasks/swift_storage_hosts_account.yml | 29 ++++++++--- .../tasks/swift_storage_hosts_container.yml | 29 ++++++++--- .../os_swift/tasks/swift_storage_hosts_object.yml | 29 ++++++++--- .../templates/account-server-replicator.conf.j2 | 3 ++ .../os_swift/templates/account-server.conf.j2 | 2 +- .../templates/container-server-replicator.conf.j2 | 3 ++ .../os_swift/templates/container-server.conf.j2 | 6 +-- .../templates/object-server-replicator.conf.j2 | 3 ++ .../roles/os_swift/templates/object-server.conf.j2 | 6 +-- playbooks/roles/rabbitmq_server/defaults/main.yml | 6 +++ .../rabbitmq_server/templates/rabbitmq.config.j2 | 4 +- playbooks/roles/rsyslog_server/defaults/main.yml | 7 +++ .../templates/os_aggregate_storage.j2 | 2 +- .../roles/rsyslog_server/templates/rsyslog.conf.j2 | 59 ++++++++++------------ .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 +++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 +++++ ...grade-nova-flavor-migrate-05402ab6faf1df1c.yaml | 11 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++++ ...log-remote-log-separation-76de4b64f0c18edb.yaml | 8 +++ scripts/run-upgrade.sh | 1 + scripts/scripts-library.sh | 2 +- .../playbooks/nova-flavor-migration.yml | 30 +++++++++++ 29 files changed, 270 insertions(+), 76 deletions(-)

1 0

[new][openstackansible] openstack-ansible-security 12.2.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are glad to announce the release of: openstack-ansible-security 12.2.4: Security hardening role for openstack-ansible For more details, please see below. 12.2.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 12.2.3..12.2.4 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

[new][openstackansible] openstack-ansible-os_neutron 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are thrilled to announce the release of: openstack-ansible-os_neutron 13.3.4: os_neutron role for OpenStack- Ansible For more details, please see below. Changes in openstack-ansible-os_neutron 13.3.1..13.3.4 ------------------------------------------------------ f8b0389 Update plumgrid plugin installation from pip to deb 5a53856 Disable stderr logging Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 3 -- tasks/plumgrid_config.yml | 88 ++++++++++------------------------------------- templates/neutron.conf.j2 | 2 ++ 3 files changed, 20 insertions(+), 73 deletions(-)

1 0

[new][openstackansible] openstack-ansible-rabbitmq_server 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are overjoyed to announce the release of: openstack-ansible-rabbitmq_server 13.3.4: rabbitmq_server for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-rabbitmq_server 13.3.3..13.3.4 ----------------------------------------------------------- 7ac8e58 Add collect_statistics_interval, rates_mode in rabbitmq.config template Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 6 ++++++ templates/rabbitmq.config.j2 | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[new][openstackansible] openstack-ansible-os_swift 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are exuberant to announce the release of: openstack-ansible-os_swift 13.3.4: os_swift for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_swift 13.3.3..13.3.4 ---------------------------------------------------- c4c8a9c Point auditor service at the replicator config Diffstat (except docs and test files) ------------------------------------- tasks/swift_storage_hosts_account.yml | 29 ++++++++++++++++++----- tasks/swift_storage_hosts_container.yml | 33 ++++++++++++++++++++------- tasks/swift_storage_hosts_object.yml | 29 ++++++++++++++++++----- templates/account-server-replicator.conf.j2 | 3 +++ templates/account-server.conf.j2 | 2 +- templates/container-server-replicator.conf.j2 | 3 +++ templates/container-server.conf.j2 | 6 ++--- templates/object-server-replicator.conf.j2 | 3 +++ templates/object-server.conf.j2 | 6 ++--- 9 files changed, 87 insertions(+), 27 deletions(-)

1 0

[new][openstackansible] openstack-ansible-os_nova 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are content to announce the release of: openstack-ansible-os_nova 13.3.4: os_nova for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_nova 13.3.1..13.3.4 --------------------------------------------------- 3444608 Fix race condition when configuring the qemu save directory bd83209 Disable stderr logging Diffstat (except docs and test files) ------------------------------------- tasks/nova_compute_kvm_install.yml | 3 +++ templates/nova.conf.j2 | 2 ++ 2 files changed, 5 insertions(+)

1 0

[new][openstackansible] openstack-ansible-rsyslog_server 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are stoked to announce the release of: openstack-ansible-rsyslog_server 13.3.4: rsyslog_server for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-rsyslog_server 13.2.0..13.3.4 ---------------------------------------------------------- da10c8b Update tox configuration Diffstat (except docs and test files) ------------------------------------- tasks/install-yum.yml | 1 + test-requirements.txt | 2 - tox.ini | 124 +++++++++++++++++++++++++++++++++++--------------- 3 files changed, 89 insertions(+), 38 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index a45faa5..22c7bbe 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,2 +0,0 @@ -ansible-lint<=2.3.9 -ansible>=1.9.1,<2.0.0,!=1.9.6

1 0

[new][openstackansible] openstack-ansible-os_glance 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are eager to announce the release of: openstack-ansible-os_glance 13.3.4: os_glance for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_glance 13.3.1..13.3.4 ----------------------------------------------------- ec9ae09 Disable stderr logging Diffstat (except docs and test files) ------------------------------------- templates/glance-api.conf.j2 | 2 ++ templates/glance-cache.conf.j2 | 2 ++ templates/glance-manage.conf.j2 | 2 ++ templates/glance-registry.conf.j2 | 2 ++ templates/glance-scrubber.conf.j2 | 2 ++ 5 files changed, 10 insertions(+)

1 0

[new][openstackansible] openstack-ansible-plugins 13.3.4 release
by no-reply＠openstack.org 29 Sep '16

29 Sep '16

We are psyched to announce the release of: openstack-ansible-plugins 13.3.4: plugins for OpenStack Ansible For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * The ability to support login user domain and login project domain has been added to the keystone module. # Example usage - keystone: command: ensure_user endpoint: "{{ keystone_admin_endpoint }}" login_user: admin login_password: admin login_project_name: admin login_user_domain_name: custom login_project_domain_name: custom user_name: demo password: demo project_name: demo domain_name: custom Bug Fixes ********* * The ability to support login user domain and login project domain has been added to the keystone module. This resolves https://bugs.launchpad.net/openstack-ansible/+bug/1574000 # Example usage - keystone: command: ensure_user endpoint: "{{ keystone_admin_endpoint }}" login_user: admin login_password: admin login_project_name: admin login_user_domain_name: custom login_project_domain_name: custom user_name: demo password: demo project_name: demo domain_name: custom Changes in openstack-ansible-plugins 13.3.2..13.3.4 --------------------------------------------------- 620c64e Add user and project login domains to keystone Diffstat (except docs and test files) ------------------------------------- library/keystone | 26 +++++++++++++- ..._user_and_project_support-e35b0b335b6522e9.yaml | 42 ++++++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-)

1 0