- OpenStack-announce - lists.openstack.org

[new][openstackansible] openstack-ansible-plugins 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are psyched to announce the release of: openstack-ansible-plugins 13.3.4: plugins for OpenStack Ansible For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * The ability to support login user domain and login project domain has been added to the keystone module. # Example usage - keystone: command: ensure_user endpoint: "{{ keystone_admin_endpoint }}" login_user: admin login_password: admin login_project_name: admin login_user_domain_name: custom login_project_domain_name: custom user_name: demo password: demo project_name: demo domain_name: custom Bug Fixes ********* * The ability to support login user domain and login project domain has been added to the keystone module. This resolves https://bugs.launchpad.net/openstack-ansible/+bug/1574000 # Example usage - keystone: command: ensure_user endpoint: "{{ keystone_admin_endpoint }}" login_user: admin login_password: admin login_project_name: admin login_user_domain_name: custom login_project_domain_name: custom user_name: demo password: demo project_name: demo domain_name: custom Changes in openstack-ansible-plugins 13.3.2..13.3.4 --------------------------------------------------- 620c64e Add user and project login domains to keystone Diffstat (except docs and test files) ------------------------------------- library/keystone | 26 +++++++++++++- ..._user_and_project_support-e35b0b335b6522e9.yaml | 42 ++++++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-)

1 0

[new][openstackansible] openstack-ansible-ironic 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are glowing to announce the release of: openstack-ansible-ironic 13.3.4: Ironic Role for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-ironic 13.3.1..13.3.4 -------------------------------------------------- 03443e4 Disable stderr logging Diffstat (except docs and test files) ------------------------------------- templates/ironic.conf.j2 | 2 ++ 1 file changed, 2 insertions(+)

1 0

[new][openstackansible] openstack-ansible-os_heat 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are overjoyed to announce the release of: openstack-ansible-os_heat 13.3.4: os_heat for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_heat 13.3.1..13.3.4 --------------------------------------------------- dcff3d0 Disable stderr logging f102338 Use keystone library for heat_stack_domain_admin Diffstat (except docs and test files) ------------------------------------- tasks/heat_domain_setup.yml | 63 +++++++++++++++++++++------------------------ templates/heat.conf.j2 | 2 ++ 2 files changed, 31 insertions(+), 34 deletions(-)

1 0

[new][openstackansible] openstack-ansible-os_horizon 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are gleeful to announce the release of: openstack-ansible-os_horizon 13.3.4: OpenStack Horizon role for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_horizon 13.3.3..13.3.4 ------------------------------------------------------ b585f3e Simplify bool check for LBaaSv2/Horizon Diffstat (except docs and test files) ------------------------------------- tasks/horizon_post_install.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[new][openstackansible] openstack-ansible-os_keystone 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are exuberant to announce the release of: openstack-ansible-os_keystone 13.3.4: os_keystone for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_keystone 13.3.1..13.3.4 ------------------------------------------------------- 4f30d3a Force a restart of all the apache nodes during upgrade 1432dea Disable stderr logging Diffstat (except docs and test files) ------------------------------------- tasks/keystone_service_setup.yml | 9 --------- tasks/main.yml | 3 +++ templates/keystone.conf.j2 | 2 ++ 3 files changed, 5 insertions(+), 9 deletions(-)

1 0

[new][openstackansible] openstack-ansible-os_cinder 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are ecstatic to announce the release of: openstack-ansible-os_cinder 13.3.4: os_cinder role for OpenStack- Ansible For more details, please see below. Changes in openstack-ansible-os_cinder 13.3.1..13.3.4 ----------------------------------------------------- de29bf7 Fix cinder role condition when no cinder_volumes 77f138e Disable stderr logging c4eae35 Update paste, policy and rootwrap configurations 2016-08-01 Diffstat (except docs and test files) ------------------------------------- tasks/main.yml | 15 +++++++++------ templates/api-paste.ini.j2 | 23 +++++++++++++---------- templates/cinder.conf.j2 | 2 ++ 3 files changed, 24 insertions(+), 16 deletions(-)

1 0

[new][openstackansible] openstack-ansible 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are happy to announce the release of: openstack-ansible 13.3.4: Ansible playbooks for deploying OpenStack With source available at: http://git.openstack.org/cgit/openstack/openstack-ansible For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible 13.3.3..13.3.4 ------------------------------------------- e3e60b1 Fix link for lxc-openstack.apparmor.j2 d97b0d1 Docs: Fixed double "that" in docs ac86e5b Retain apt sources options during host bootstrap 42b2a79 load variables as a simple var for upgrades 731164f Restart OS services when symlinks are created 98eef32 Update SHA for openstack_openrc role c665a0e Reduce minimum data disk size for the AIO to 55GB 622fc94 Use correct version when creating backup dir de1a22b Make the file name for user_secrets a variable 777d5bf Update all SHAs for 13.3.4 98c7625 glance_api_servers must contain a valid url with protocol d3262bb Fix ml2 ports after an upgrade Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 10 +++---- global-requirement-pins.txt | 2 +- .../defaults/repo_packages/openstack_services.yml | 32 +++++++++++----------- playbooks/inventory/group_vars/all.yml | 2 +- playbooks/inventory/group_vars/hosts.yml | 6 ++-- .../ceph_client/tasks/ceph_install_python_libs.yml | 4 +++ .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 ++++++++++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 +++++++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++++++++++++ scripts/scripts-library.sh | 2 +- .../playbooks/deploy-config-changes.yml | 4 +-- .../playbooks/rfc1034_1035-cleanup.yml | 20 ++++++++++++++ .../playbooks/user-secrets-adjustment.yml | 9 +++--- .../scripts/migrate_openstack_vars.py | 2 +- .../templates/user_variables.aio.yml.j2 | 4 +-- 22 files changed, 132 insertions(+), 44 deletions(-)

1 0

[new][openstackansible] openstack-ansible-security 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are exuberant to announce the release of: openstack-ansible-security 13.3.4: Security hardening role for openstack-ansible For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 13.3.3..13.3.4 ---------------------------------------------------- ca9b7de Disable DAC change auditing 775f641 Disable martian logging by default a329034 Exclude /run from AIDE checks c16d117 Ensure AIDE initializes on subsequent runs e0d0e36 Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

[new][openstackansible] openstack-ansible-os_aodh 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are chuffed to announce the release of: openstack-ansible-os_aodh 13.3.4: os_aodh for OpenStack Ansible For more details, please see below. Changes in openstack-ansible-os_aodh 13.3.1..13.3.4 --------------------------------------------------- 0c80b7c Disable stderr logging Diffstat (except docs and test files) ------------------------------------- templates/aodh.conf.j2 | 2 ++ 1 file changed, 2 insertions(+)

1 0

[new][openstackansible] openstack-ansible-os_ceilometer 13.3.4 release
by no-reply＠openstack.org 30 Sep '16

30 Sep '16

We are pumped to announce the release of: openstack-ansible-os_ceilometer 13.3.4: os_ceilometer role for OpenStack-Ansible For more details, please see below. Changes in openstack-ansible-os_ceilometer 13.3.1..13.3.4 --------------------------------------------------------- 3a24b01 Disable stderr logging Diffstat (except docs and test files) ------------------------------------- templates/ceilometer.conf.j2 | 2 ++ 1 file changed, 2 insertions(+)

1 0