October 2017 - Release-announce - lists.openstack.org

[openstackansible] openstack-ansible-memcached_server 14.2.9 (newton)
by no-reply＠openstack.org 06 Oct '17

06 Oct '17

We are pumped to announce the release of: openstack-ansible-memcached_server 14.2.9: memcached_server for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-memcached_server/ For more details, please see below. Changes in openstack-ansible-memcached_server 14.2.8..14.2.9 ------------------------------------------------------------ 0afdcad Add automatic restart for memcached Diffstat (except docs and test files) ------------------------------------- tasks/memcached_config.yml | 8 ++++++++ templates/systemd-restart-on-failure.conf.j2 | 4 ++++ 2 files changed, 12 insertions(+)

1 0

[openstackansible] openstack-ansible-haproxy_server 14.2.9 (newton)
by no-reply＠openstack.org 06 Oct '17

06 Oct '17

We are pumped to announce the release of: openstack-ansible-haproxy_server 14.2.9: haproxy_server role for OpenStack-Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-haproxy_server/ For more details, please see below. Changes in openstack-ansible-haproxy_server 14.2.8..14.2.9 ---------------------------------------------------------- 179975e Optimise task execution 7bffdd5 Allow HAproxy repo/gpg overrides without extra-vars Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +-- tasks/haproxy_add_ppa_repo.yml | 80 +++++++++++++++++++++++++++--------------- tasks/haproxy_install.yml | 7 +--- vars/ubuntu-14.04.yml | 5 +-- 4 files changed, 57 insertions(+), 39 deletions(-)

1 0

[openstackansible] openstack-ansible-galera_server 14.2.9 (newton)
by no-reply＠openstack.org 06 Oct '17

06 Oct '17

We are pleased to announce the release of: openstack-ansible-galera_server 14.2.9: Galera Server role for OpenStack-Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-galera_server/ For more details, please see below. 14.2.9 ^^^^^^ Bug Fixes * MariaDB 10.0.32 released on Aug 17 which, when configured to use xtrabackup for the SST, requires percona xtrabackup version 2.3.5 or higher. As xtrabackup is the default SST mechanism in the "galera_server" role, the version used has been updated from 2.2.13 to 2.3.5 for the x86_64 hardware architecture. See the percona release notes for 2.3.2 (https://www.percona.com/doc/percona- xtrabackup/LATEST/release-notes/2.3/2.3.2.html#new-features) for more details of what was included in the fix. Changes in openstack-ansible-galera_server 14.2.7..14.2.9 --------------------------------------------------------- 8bb3464 Fix MariaDB apt package pinning 3ed010a Update percona xtrabackup to 2.3.5 2a14d3b Toggle percona repo without extra-vars 9106e4f Use block/rescue for error handling d9f8113 Allow MariaDB repo overrides without extra-vars Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 20 ++++++++ .../notes/xtrabackup-update-0aedcb9baa88ce35.yaml | 10 ++++ tasks/galera_install_apt.yml | 60 +++++++++++----------- tasks/galera_install_yum.yml | 49 +++++++++--------- vars/redhat-7.yml | 16 +++--- vars/ubuntu-14.04.yml | 20 ++++---- vars/ubuntu-16.04.yml | 20 ++++---- 7 files changed, 112 insertions(+), 83 deletions(-)

1 0

[openstackansible] ansible-hardening 14.2.9 (newton)
by no-reply＠openstack.org 06 Oct '17

06 Oct '17

We are ecstatic to announce the release of: ansible-hardening 14.2.9: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 14.2.9 ^^^^^^ Security Issues * "PermitRootLogin" in the ssh configuration has changed from "yes" to "without-password". This will only allow ssh to be used to authenticate root via a key. Changes in ansible-hardening 14.2.3..14.2.9 ------------------------------------------- 31bfec7 Change default prohibit root sshd password auth d12b33b Updated from OpenStack Ansible Tests 436b6b6 [Docs] Replace security role references 62d5932 Fix ansible-hardening references in tox/playbook 6bbc4e9 Do not update grub if grub not used c339fcf Fix .gitreview for older branches 5ee3c4e Don't install python-ndg_httpsclient Diffstat (except docs and test files) ------------------------------------- .gitignore | 7 +- .gitreview | 2 +- README.md | 6 +- README.rst | 4 +- Vagrantfile | 72 ++++++----------- bindep.txt | 22 ++++-- defaults/main.yml | 16 ++-- files/V-38682-modprobe.conf | 2 +- handlers/main.yml | 4 + ...ot-login-without-password-948ec79c6508c19b.yaml | 6 ++ ...support-for-centos-xenial-2b89c318cc3df4b0.yaml | 2 +- setup.cfg | 2 +- tasks/main.yml | 7 ++ tasks/sshd.yml | 28 +++---- tox.ini | 2 +- vars/main.yml | 2 +- vars/redhat.yml | 2 +- vars/ubuntu.yml | 2 +- 29 files changed, 174 insertions(+), 163 deletions(-)

1 0

[openstackansible] openstack-ansible 14.2.9 (newton)
by no-reply＠openstack.org 06 Oct '17

06 Oct '17

We are pleased to announce the release of: openstack-ansible 14.2.9: Ansible playbooks for deploying OpenStack This release is part of the newton stable release series. The source is available from: http://git.openstack.org/cgit/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ For more details, please see below. 14.2.9 ^^^^^^ New Features ************ * Tags have been added to all of the common tags with the prefix "common-". This has been done to allow a deployer to rapidly run any of the common on a need basis without having to rerun an entire playbook. * Extra headers can be added to Keystone responses by adding items to "keystone_extra_headers". Example: keystone_extra_headers: - parameter: "Access-Control-Expose-Headers" value: "X-Subject-Token" - parameter: "Access-Control-Allow-Headers" value: "Content-Type, X-Auth-Token" - parameter: "Access-Control-Allow-Origin" value: "*" Upgrade Notes ************* * The openstack-ansible-security role is now retired and the ansible- hardening role replaces it. The ansible-hardening role provides the same functionality and will be the maintained hardening role going forward. Bug Fixes ********* * In Ubuntu the "dnsmasq" package actually includes init scripts and service configuration which conflict with LXC and are best not included. The actual dependent package is "dnsmasq-base". The package list has been adjusted and a task added to remove the "dnsmasq" package and purge the related configuration files from all LXC hosts. Changes in openstack-ansible 14.2.8..14.2.9 ------------------------------------------- b057986 Update SHA for os_ironic 0d16b03 Update rabbitmq_server role SHA 9b8f3ff Update SHA for os_tempest dff42ad Switch to use ansible-hardening c351cdb Suppress curl warning w/shell module 6d10e57 Fix LXC container start order fb05ea0 Update role SHA's for online migration fixes 2ac2b48 Added a common tag to the common tasks 01b0f6b Remove cinder online_data_migrations-related play 47ec935 migrate_openstack_vars.py: Correct folder name 566bdb5 Set serial to 100% for nova_compute 71f2a24 Remove global pin for ldappool 838771f Update all SHAs for 14.2.9 Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 36 ++++++++--------- .../source/app-advanced-config-security.rst | 6 +-- deploy-guide/source/app-security.rst | 2 +- global-requirement-pins.txt | 6 --- playbooks/common-playbooks/cinder.yml | 2 +- playbooks/common-playbooks/neutron.yml | 2 +- playbooks/common-playbooks/nova.yml | 2 +- playbooks/common-tasks/dynamic-address-fact.yml | 2 + playbooks/common-tasks/dynamic-grouping.yml | 2 + playbooks/common-tasks/mysql-db-user.yml | 4 ++ playbooks/common-tasks/os-log-dir-setup.yml | 4 ++ playbooks/common-tasks/os-lxc-container-setup.yml | 18 ++++++++- playbooks/common-tasks/package-cache-proxy.yml | 11 +++++- playbooks/common-tasks/rabbitmq-vhost-user.yml | 5 +++ playbooks/common-tasks/set-pip-upstream-url.yml | 4 ++ playbooks/common-tasks/set-upper-constraints.yml | 10 +++++ playbooks/defaults/repo_packages/gnocchi.yml | 2 +- .../defaults/repo_packages/openstack_services.yml | 46 +++++++++++----------- playbooks/galera-install.yml | 2 +- playbooks/inventory/group_vars/all.yml | 6 +-- playbooks/inventory/group_vars/nova_all.yml | 1 + playbooks/os-cinder-install.yml | 30 -------------- playbooks/os-keystone-install.yml | 2 +- playbooks/os-nova-install.yml | 2 +- playbooks/os-swift-install.yml | 2 +- playbooks/rabbitmq-install.yml | 2 +- playbooks/rsyslog-install.yml | 2 +- playbooks/security-hardening.yml | 2 +- playbooks/utility-install.yml | 2 + .../notes/common-tags-9763f578ea5fe5b6.yaml | 5 +++ .../dnsmasq-lxc-conflict-fix-c8968f6a16d033c6.yaml | 10 +++++ .../notes/extra-headers-e54a672d3a78dd89.yaml | 15 +++++++ releasenotes/notes/ldappool-e79455337a02b05d.yaml | 4 +- ...itch-to-ansible-hardening-2e59a2ce26db7bbb.yaml | 7 ++++ .../scripts/migrate_openstack_vars.py | 2 +- 35 files changed, 159 insertions(+), 101 deletions(-)

1 0

[tripleo] tripleo-ui 3.2.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: tripleo-ui 3.2.2: tripleo-ui This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/tripleo-ui/ For more details, please see below. Changes in tripleo-ui 3.2.1..3.2.2 ---------------------------------- 0bc29b0 Release 3.2.2 Diffstat (except docs and test files) ------------------------------------- npm-shrinkwrap.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[tripleo] tripleo-ui 1.2.1 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pleased to announce the release of: tripleo-ui 1.2.1 This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/tripleo-ui/ For more details, please see below. Changes in tripleo-ui 1.2.0..1.2.1 ---------------------------------- 468faee Release 1.2.1 Diffstat (except docs and test files) ------------------------------------- npm-shrinkwrap.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[tripleo] tripleo-common 6.1.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are ecstatic to announce the release of: tripleo-common 6.1.2: A common library for TripleO workflows. This release is part of the ocata stable release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-common Download the package from: https://tarballs.openstack.org/tripleo-common/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo-common For more details, please see below. Changes in tripleo-common 6.1.1..6.1.2 -------------------------------------- a96721a Remove machine-id from image Diffstat (except docs and test files) ------------------------------------- image-yaml/overcloud-images.yaml | 1 + 1 file changed, 1 insertion(+)

1 0

[tripleo] tripleo-puppet-elements 6.2.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: tripleo-puppet-elements 6.2.2: Puppet building rules for OpenStack images. This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/tripleo-puppet-elements/ For more details, please see below. Changes in tripleo-puppet-elements 6.2.1..6.2.2 ----------------------------------------------- c95399a Add remove-machine-id element Diffstat (except docs and test files) ------------------------------------- elements/remove-machine-id/README.md | 9 +++++++++ elements/remove-machine-id/post-install.d/70-remove-machine-id | 8 ++++++++ 2 files changed, 17 insertions(+)

1 0

[tripleo] puppet-tripleo 6.5.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are thrilled to announce the release of: puppet-tripleo 6.5.2: Puppet module for OpenStack TripleO This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/puppet-tripleo/ For more details, please see below. 6.5.2 ^^^^^ New Features ************ * Enable innodb_flush_log_at_trx_commit configuration for Galera only. Upgrade Notes ************* * Setting the innodb_flush_log_at_trx_commit flag to the value of "2" instead of its default value of "1" means that the underlying MySQL/MariaDB engine will no longer flush transactions to disk on a per-transaction basis; instead, flushes occur once per second. This leads to far fewer disk writes and can dramatically improve write performance, at the cost of durability (e.g. will lose the last second's worth of transactions) if the database engine is ungracefully shut down. The clustered nature of Galera mitigates this risk in that transactions are replicated to other nodes before completion, and the setting of "2" is considered to be generally safe for a Galera cluster, with the exception case of simultaneous power loss for all nodes. Changes in puppet-tripleo 6.5.1..6.5.2 -------------------------------------- 3ecd35c Release 6.5.2 05d31f7 Add option for innodb_flush_log_at_trx_commit = 2 for Galera only 0848990 firewall: generally accept "jump" param and use tripleo:firewall for log rule 0694a3d Use resource collector for the fencing -> stonith ordering Diffstat (except docs and test files) ------------------------------------- manifests/firewall/post.pp | 2 +- manifests/firewall/rule.pp | 16 ++++- manifests/profile/base/pacemaker.pp | 2 +- manifests/profile/pacemaker/database/mysql.pp | 73 ++++++++++++---------- metadata.json | 2 +- ...b_flush_log_at_trx_commit-eb7d99749ca3c911.yaml | 17 +++++ 6 files changed, 76 insertions(+), 36 deletions(-)

1 0