October 2017 - Release-announce - lists.openstack.org

[openstackansible] openstack-ansible-os_sahara 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We jubilantly announce the release of: openstack-ansible-os_sahara 15.1.9: os_sahara for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_sahara/ For more details, please see below. Changes in openstack-ansible-os_sahara 15.1.4..15.1.9 ----------------------------------------------------- 4a224f8 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/sahara_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-rabbitmq_server 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are glad to announce the release of: openstack-ansible-rabbitmq_server 15.1.9: rabbitmq_server for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-rabbitmq_server/ For more details, please see below. Changes in openstack-ansible-rabbitmq_server 15.1.8..15.1.9 ----------------------------------------------------------- d075b30 Remove update_cache for yum 6701fba Add automatic restart for RabbitMQ 8aadc97 Allow RabbitMQ/Erlang repo overrides without extra-vars 2f1cbee Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- bindep.txt | 34 ++++++++++++++++++++-------- defaults/main.yml | 10 ++++++++ tasks/install_yum.yml | 1 - tasks/rabbitmq_post_install.yml | 15 ++++++++++-- templates/systemd-restart-on-failure.conf.j2 | 4 ++++ vars/debian.yml | 4 ++-- vars/redhat.yml | 4 ++-- 7 files changed, 56 insertions(+), 16 deletions(-)

1 0

[openstackansible] openstack-ansible-plugins 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are psyched to announce the release of: openstack-ansible-plugins 15.1.9: plugins for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-plugins/ For more details, please see below. 15.1.9 ^^^^^^ New Features * The config_template template module now supports writing out valueless INI options without suffixing them with '=' or ':'. This is done via the 'ignore_none_type' attribute. If ignore_none_type is set to true, these key/value entries will be ignored, if it's set to false, then ConfigTemplateParser will write out only the option name without the '=' or ':' suffix. The default is true. Changes in openstack-ansible-plugins 15.1.8..15.1.9 --------------------------------------------------- b4a5996 Add ignore_none_type to config template aa0e9aa Backport pyOpenSSL bindep change from master Diffstat (except docs and test files) ------------------------------------- action/_v2_config_template.py | 53 ++++++++++++++++++---- bindep.txt | 2 +- library/config_template | 10 ++++ ...template-ignore-none-type-9387c236853f061b.yaml | 9 ++++ 6 files changed, 92 insertions(+), 11 deletions(-)

1 0

[openstackansible] openstack-ansible-os_swift 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are thrilled to announce the release of: openstack-ansible-os_swift 15.1.9: os_swift for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_swift/ For more details, please see below. Changes in openstack-ansible-os_swift 15.1.8..15.1.9 ---------------------------------------------------- 0946e99 Fix ordering of swift3 in middleware pipeline f558191 Updated from OpenStack Ansible Tests 8107f5f Optimize swift gate Diffstat (except docs and test files) ------------------------------------- bindep.txt | 34 +++++++++++++++++++++++++--------- defaults/main.yml | 4 ++-- tasks/swift_install.yml | 3 +-- 11 files changed, 46 insertions(+), 27 deletions(-)

1 0

[openstackansible] openstack-ansible-os_trove 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are happy to announce the release of: openstack-ansible-os_trove 15.1.9: os_trove role for OpenStack-Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_trove/ For more details, please see below. Changes in openstack-ansible-os_trove 15.1.4..15.1.9 ---------------------------------------------------- 93913b6 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/trove_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-os_neutron 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are stoked to announce the release of: openstack-ansible-os_neutron 15.1.9: os_neutron role for OpenStack- Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_neutron/ For more details, please see below. Changes in openstack-ansible-os_neutron 15.1.8..15.1.9 ------------------------------------------------------ 1608c0a Simplify the string check for offline db migrations af945d5 Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 50 +++++++++++++------------- bindep.txt | 36 +++++++++++++------ tasks/neutron_db_setup.yml | 4 +-- 4 files changed, 98 insertions(+), 79 deletions(-)

1 0

[openstackansible] openstack-ansible-os_horizon 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We jubilantly announce the release of: openstack-ansible-os_horizon 15.1.9: OpenStack Horizon role for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_horizon/ For more details, please see below. Changes in openstack-ansible-os_horizon 15.1.7..15.1.9 ------------------------------------------------------ e4ff13c Optimise the role execution Diffstat (except docs and test files) ------------------------------------- handlers/main.yml | 2 ++ tasks/horizon_apache.yml | 14 ++++---------- tasks/main.yml | 9 +++++---- 3 files changed, 11 insertions(+), 14 deletions(-)

1 0

[openstackansible] openstack-ansible-os_glance 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We enthusiastically announce the release of: openstack-ansible-os_glance 15.1.9: os_glance for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_glance/ For more details, please see below. Changes in openstack-ansible-os_glance 15.1.6..15.1.9 ----------------------------------------------------- 802c3dc Include ceph_client role if needed 5368d71 Revert "Only sync glance database on major versions" d98041c Switch from run_once back to inventory scoping 20f7450 Hedge upgrade process against no software change 8426b52 Use listen instead of chained notifiers 6e2d506 Ensure that services restart in a particular order 8a5fb5d Only sync glance database on major versions 13cdc93 Pass packages to install as a list Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 2 ++ handlers/main.yml | 20 +++++++------------- tasks/glance_init_systemd.yml | 27 +++++++++++---------------- tasks/glance_install.yml | 17 +++++++++++++++-- tasks/main.yml | 22 ++++++++++++++++++++-- templates/glance-systemd-init.j2 | 4 ++-- templates/glance-systemd-tmpfiles.j2 | 4 ++-- vars/main.yml | 31 +++++++++++++++++++++++++++++++ 9 files changed, 94 insertions(+), 37 deletions(-)

1 0

[openstackansible] openstack-ansible-ironic 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are tickled pink to announce the release of: openstack-ansible-ironic 15.1.9: Ironic Role for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ironic/ For more details, please see below. Changes in openstack-ansible-ironic 15.1.4..15.1.9 -------------------------------------------------- b217195 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/ironic_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-os_magnum 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are happy to announce the release of: openstack-ansible-os_magnum 15.1.9: os_magnum for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_magnum/ For more details, please see below. 15.1.9 ^^^^^^ Upgrade Notes ************* * The magnum client interaction will now make use of the public endpoints by default. Previously this was set to use internal endpoints. * The keystone endpoints for instances spawned by magnum will now be provided with the public endpoints by default. Previously this was set to use internal endpoints. Security Issues *************** * The magnum client interaction will now make use of the public endpoints by default. Previously this was set to use internal endpoints. * The keystone endpoints for instances spawned by magnum will now be provided with the public endpoints by default. Previously this was set to use internal endpoints. Changes in openstack-ansible-os_magnum 15.1.4..15.1.9 ----------------------------------------------------- dfb3838 Add venv_tag local fact 9aea803 Enable custom keystone endpoint_type in templates 0bed75d Update paste, policy and rootwrap configurations 2017-05-15 Diffstat (except docs and test files) ------------------------------------- releasenotes/notes/magnum-client-urls-64af5efc9ece6680.yaml | 13 +++++++++++++ tasks/magnum_install.yml | 7 +++++++ templates/magnum.conf.j2 | 3 ++- templates/policy.json.j2 | 4 ++-- 4 files changed, 24 insertions(+), 3 deletions(-)

1 0

[openstackansible] openstack-ansible-os_cinder 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: openstack-ansible-os_cinder 15.1.9: os_cinder role for OpenStack- Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_cinder/ For more details, please see below. Changes in openstack-ansible-os_cinder 15.1.8..15.1.9 ----------------------------------------------------- efda077 Correct cinder online migrations command dda49aa Ensure online migrations can run 9f775c1 Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 - Vagrantfile | 31 +++++++++++++---- bindep.txt | 38 ++++++++++++++------- tasks/cinder_db_setup.yml | 3 +- 5 files changed, 98 insertions(+), 62 deletions(-)

1 0

[openstackansible] openstack-ansible-os_heat 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: openstack-ansible-os_heat 15.1.9: os_heat for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_heat/ For more details, please see below. Changes in openstack-ansible-os_heat 15.1.7..15.1.9 --------------------------------------------------- 87582ad Optimise role execution Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 ++++ handlers/main.yml | 9 +++++---- tasks/heat_init_common.yml | 27 --------------------------- tasks/heat_init_systemd.yml | 29 +++++++++++++---------------- tasks/main.yml | 14 ++++++++++---- templates/heat-systemd-init.j2 | 4 ++-- templates/heat-systemd-tmpfiles.j2 | 4 ++-- vars/main.yml | 31 +++++++++++++++++++++++++++++++ 8 files changed, 67 insertions(+), 55 deletions(-)

1 0

[openstackansible] openstack-ansible-os_ceilometer 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: openstack-ansible-os_ceilometer 15.1.9: os_ceilometer role for OpenStack-Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ceilometer/ For more details, please see below. 15.1.9 ^^^^^^ New Features * The "os_ceilometer" role now includes a facility where you can place your own templates in "/etc/openstack_deploy/ceilometer" (by default) and it will be deployed to the target host after being interpreted by the template engine. If no file is found there, the fallback of the git sourced template is used. Changes in openstack-ansible-os_ceilometer 15.1.3..15.1.9 --------------------------------------------------------- b4fa7cf Source template files from git or deploy host 983f2fa Add venv_tag local fact 9641155 Fix for lookup and get_url occuring in different places 7c9ab5d Perform an atomic policy file change Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 42 ++++++++-- handlers/main.yml | 57 +++++++++++-- .../deploy-node-config-files-1b272a3ec7ed71b8.yaml | 7 ++ tasks/ceilometer_apache.yml | 14 ++-- tasks/ceilometer_init_common.yml | 29 ------- tasks/ceilometer_init_systemd.yml | 2 + tasks/ceilometer_install.yml | 16 +++- tasks/ceilometer_post_install.yml | 93 +++++++++++----------- tasks/main.yml | 2 +- templates/rootwrap.conf.j2 | 27 +++++++ vars/main.yml | 42 ++++++++++ 11 files changed, 232 insertions(+), 99 deletions(-)

1 0

[openstackansible] openstack-ansible-os_gnocchi 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: openstack-ansible-os_gnocchi 15.1.9: os_gnocchi for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_gnocchi/ For more details, please see below. Changes in openstack-ansible-os_gnocchi 15.1.5..15.1.9 ------------------------------------------------------ 715d2bd Ensure that policy file has correct group/mode Diffstat (except docs and test files) ------------------------------------- handlers/main.yml | 3 +++ 1 file changed, 3 insertions(+)

1 0

[openstackansible] openstack-ansible-os_barbican 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are psyched to announce the release of: openstack-ansible-os_barbican 15.1.9: os_barbican for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_barbican/ For more details, please see below. Changes in openstack-ansible-os_barbican 15.1.4..15.1.9 ------------------------------------------------------- 91c62d5 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/barbican_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-os_aodh 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are psyched to announce the release of: openstack-ansible-os_aodh 15.1.9: os_aodh for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_aodh/ For more details, please see below. Changes in openstack-ansible-os_aodh 15.1.5..15.1.9 --------------------------------------------------- 96b86fa Ensure that policy file has correct group/mode Diffstat (except docs and test files) ------------------------------------- handlers/main.yml | 3 +++ 1 file changed, 3 insertions(+)

1 0

[openstackansible] openstack-ansible-memcached_server 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are happy to announce the release of: openstack-ansible-memcached_server 15.1.9: memcached_server for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-memcached_server/ For more details, please see below. Changes in openstack-ansible-memcached_server 15.1.8..15.1.9 ------------------------------------------------------------ 53e845e Add automatic restart for memcached 8a644cd Backport pyOpenSSL bindep change Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 +- tasks/memcached_config.yml | 8 ++++++++ templates/systemd-restart-on-failure.conf.j2 | 4 ++++ 3 files changed, 13 insertions(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_keystone 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: openstack-ansible-os_keystone 15.1.9: os_keystone for OpenStack Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_keystone/ For more details, please see below. Changes in openstack-ansible-os_keystone 15.1.8..15.1.9 ------------------------------------------------------- dfb6fa3 Ensure online migrations can run ba3e033 Updated from OpenStack Ansible Tests cffbd21 Update paste, policy and rootwrap configurations 2017-07-27 Diffstat (except docs and test files) ------------------------------------- .gitignore | 2 -- Vagrantfile | 31 ++++++++++++---- bindep.txt | 36 +++++++++++++------ tasks/keystone_db_setup.yml | 12 +++++-- templates/policy.json.j2 | 2 +- 6 files changed, 106 insertions(+), 64 deletions(-)

1 0

[openstackansible] openstack-ansible-rabbitmq_server 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are chuffed to announce the release of: openstack-ansible-rabbitmq_server 14.2.9: rabbitmq_server for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-rabbitmq_server/ For more details, please see below. 14.2.9 ^^^^^^ New Features ************ * A new repository for installing modern erlang from ESL (erlang solutions) has been added giving us the ability to install and support modern stable erlang over numerous operating systems. * The ability to set the RabbitMQ repo URL for both erlang and RabbitMQ itself has been added. This has been done to allow deployers to define the location of a given repo without having to fully redefine the entire set of definitions for a specific repository. The default variables *rabbitmq_gpg_keys*, *rabbitmq_repo_url*, and *rabbitmq_erlang_repo_url* have been created to facilitate this capability. * The default ulimit for RabbitMQ is now 65536. Deployers can still adjust this limit using the "rabbitmq_ulimit" Ansible variable. Upgrade Notes ************* * Changing to the ESL repos has no upgrade impact. The version of erlang provided by ESL is newer than that what is found in the distro repos. Furthermore, a pin has been added to ensure that APT always uses the ESL repos as it's preferred source which has been done to simply ensure APT is always pointed at ESL. Bug Fixes ********* * Based on documentation from RabbitMQ [ https://www.rabbitmq.com /which-erlang.html ] this change ensures the version of erlang we're using across distros is consistent and supported by RabbitMQ. Changes in openstack-ansible-rabbitmq_server 14.2.8..14.2.9 ----------------------------------------------------------- f2d110a Add release note for RabbitMQ ulimit 8cb5624 Increase RabbitMQ's ulimit to 65536 b8f4fe9 Pin erlang packages to version 19.3 4eb83b1 Install specific version of Erlang from ESL fd17f99 Updated from OpenStack Ansible Tests c64f313 Updated from OpenStack Ansible Tests 2a3d2fe Remove update_cache for yum 2e3d34b Add automatic restart for RabbitMQ 6546786 Allow RabbitMQ/Erlang repo overrides without extra-vars Diffstat (except docs and test files) ------------------------------------- .gitignore | 6 +- Vagrantfile | 34 ++++-- bindep.txt | 15 ++- defaults/main.yml | 16 ++- meta/main.yml | 8 ++ releasenotes/notes/esl-repo-6ff0c7f24ad2a043.yaml | 25 ++++ .../ulimit-increased-65536-50b418d8e8ca4eef.yaml | 5 + tasks/install_apt.yml | 119 ++++++++++--------- tasks/install_yum.yml | 126 +++++++++++++-------- tasks/rabbitmq_post_install.yml | 15 ++- templates/systemd-restart-on-failure.conf.j2 | 4 + vars/debian.yml | 34 ++++-- vars/redhat.yml | 42 ++++--- 14 files changed, 356 insertions(+), 184 deletions(-)

1 0

[openstackansible] openstack-ansible-rsyslog_server 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We high-spiritedly announce the release of: openstack-ansible-rsyslog_server 14.2.9: rsyslog_server for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-rsyslog_server/ For more details, please see below. Changes in openstack-ansible-rsyslog_server 14.1.1..14.2.9 ---------------------------------------------------------- 27e47df Install python2-pyOpenSSL package on CentOS Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-haproxy_server 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We enthusiastically announce the release of: openstack-ansible-haproxy_server 15.1.9: haproxy_server role for OpenStack-Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-haproxy_server/ For more details, please see below. 15.1.9 ^^^^^^ Upgrade Notes * The following variables have been removed from the "haproxy_server" role as they are no longer necessary or used. - haproxy_repo - haproxy_gpg_keys - haproxy_required_distro_packages Changes in openstack-ansible-haproxy_server 15.1.8..15.1.9 ---------------------------------------------------------- 749d22f Remove unused/unnecessary haproxy_server vars/files 0942aab Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- bindep.txt | 35 +++++++++++++++------- defaults/main.yml | 6 ---- meta/main.yml | 9 +----- .../remove-haproxy-repo-vars-051a47bbfaf6d1da.yaml | 8 +++++ tasks/haproxy_pre_install.yml | 9 ++++++ vars/ubuntu-16.04.yml | 19 ++++++++---- 6 files changed, 57 insertions(+), 29 deletions(-)

1 0

[openstackansible] openstack-ansible-galera_server 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: openstack-ansible-galera_server 15.1.9: Galera Server role for OpenStack-Ansible This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-galera_server/ For more details, please see below. 15.1.9 ^^^^^^ Bug Fixes * Mysql cnf files can now be properly overridden. The config_template module has been extended to support valueless options, such as those that are found in the my.cnf file(i.e. *quick* under the *mysqldump* section). To use valueless options, use the *ignore_none_type* attribute of the config_template module. Changes in openstack-ansible-galera_server 15.1.8..15.1.9 --------------------------------------------------------- 21aed2d Fix MariaDB apt package pinning 0211193 Add ignore_none_type to config_template b043c21 Toggle percona repo without extra-vars 5b84291 Use block/rescue for error handling 8f5a4d0 Allow MariaDB repo overrides without extra-vars a3c9610 Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- bindep.txt | 46 +++++++++++------ defaults/main.yml | 19 +++++++ .../fix-mysql-overrides-e5362ae15c657214.yaml | 8 +++ tasks/galera_install_apt.yml | 60 +++++++++++----------- tasks/galera_install_yum.yml | 49 +++++++++--------- tasks/galera_post_install.yml | 1 + vars/redhat-7.yml | 8 +-- vars/ubuntu-16.04.yml | 12 ++--- 9 files changed, 128 insertions(+), 80 deletions(-)

1 0

[openstackansible] ansible-hardening 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are gleeful to announce the release of: ansible-hardening 15.1.9: OpenStack-Ansible: Host security hardening This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 15.1.9 ^^^^^^ Security Issues * "PermitRootLogin" in the ssh configuration has changed from "yes" to "without-password". This will only allow ssh to be used to authenticate root via a key. Changes in ansible-hardening 15.1.3..15.1.9 ------------------------------------------- 957c0bc Change default prohibit root sshd password auth 2802c55 Backport bindep change from master 4638a9e Add equalto Jinja2 test for EL7 a2782dd tasks: rhel7stig: aide: Fix conditionals for Ubuntu exclusions 248640b tasks: rhel7stig: aide: Use 'aide -i' if 'aideinit' is not available f9299c5 tasks: rhel7stig: sshd: Avoid using with_fileglob for remote hosts dfaf108 [Docs] Replace security role references d2de624 Fix ansible-hardening references in tox/playbook 49ab633 Remove 'physical_host' from inventory f215c22 Fix .gitreview for older branches 4b6a43d Don't install python-ndg_httpsclient 1dd16ea [Docs] Fix deprecation docs for RHEL 6 content 7db180f Configure AIDE before initial run 1260f81 Check for grub2 defaults file 3a2486f Fix security role gate ae2ea66 Do not update grub if grub not used Diffstat (except docs and test files) ------------------------------------- .gitreview | 2 +- README.md | 23 +++++----- README.rst | 6 +-- bindep.txt | 4 +- defaults/main.yml | 20 ++++---- files/V-38682-modprobe.conf | 2 +- files/aide_extra.conf | 14 ------ handlers/main.yml | 2 + ...ot-login-without-password-948ec79c6508c19b.yaml | 6 +++ setup.cfg | 2 +- tasks/main.yml | 9 +++- tasks/rhel6stig/sshd.yml | 28 ++++++------ tasks/rhel7stig/aide.yml | 53 ++++++++++++++-------- tasks/rhel7stig/auth.yml | 15 +++++- tasks/rhel7stig/kernel.yml | 2 +- tasks/rhel7stig/misc.yml | 3 +- tasks/rhel7stig/sshd.yml | 24 ++++++++-- templates/osas-auditd-rhel7.j2 | 4 +- tox.ini | 15 +----- vars/redhat.yml | 2 +- vars/ubuntu.yml | 2 +- 34 files changed, 212 insertions(+), 168 deletions(-)

1 0

[openstackansible] openstack-ansible 15.1.9 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are tickled pink to announce the release of: openstack-ansible 15.1.9: Ansible playbooks for deploying OpenStack This release is part of the ocata stable release series. The source is available from: http://git.openstack.org/cgit/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ For more details, please see below. 15.1.9 ^^^^^^ New Features ************ * The config_template template module now supports writing out valueless INI options without suffixing them with '=' or ':'. This is done via the 'ignore_none_type' attribute. If ignore_none_type is set to true, these key/value entries will be ignored, if it's set to false, then ConfigTemplateParser will write out only the option name without the '=' or ':' suffix. The default is true. Upgrade Notes ************* * The following variables have been removed from the "haproxy_server" role as they are no longer necessary or used. - haproxy_repo - haproxy_gpg_keys - haproxy_required_distro_packages Security Issues *************** * "PermitRootLogin" in the ssh configuration has changed from "yes" to "without-password". This will only allow ssh to be used to authenticate root via a key. Bug Fixes ********* * In Ubuntu the "dnsmasq" package actually includes init scripts and service configuration which conflict with LXC and are best not included. The actual dependent package is "dnsmasq-base". The package list has been adjusted and a task added to remove the "dnsmasq" package and purge the related configuration files from all LXC hosts. * Mysql cnf files can now be properly overridden. The config_template module has been extended to support valueless options, such as those that are found in the my.cnf file(i.e. *quick* under the *mysqldump* section). To use valueless options, use the *ignore_none_type* attribute of the config_template module. Changes in openstack-ansible 15.1.8..15.1.9 ------------------------------------------- 031317a Fix Barbican's health checks 27fbd63 Include db migration fix for next release c6fa7d8 Remove urllib3/requests from requirements 417406b Suppress curl warning w/shell module a996464 Pin Shade to last known version 1c580c3 Bump ceph-ansible to 2.2.11 tag bc2b1eb Fix LXC container start order aac4e02 Update role SHA's for online migration fixes d5048ca Correct cinder online migrations command 9cb4ecc Update documentation redirects f2c5e89 Remove global pin for ldappool d27e24c Set serial to 100% for nova_compute add34f5 Update all SHAs for 15.1.9 4d3ea00 Improve proxy vars in user_variables.yml Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 42 +++++++-------- deploy-guide/source/conf.py | 4 +- etc/openstack_deploy/user_variables.yml | 10 ++-- global-requirement-pins.txt | 9 +--- playbooks/common-playbooks/cinder.yml | 2 +- playbooks/common-playbooks/neutron.yml | 2 +- playbooks/common-playbooks/nova.yml | 2 +- playbooks/common-tasks/os-lxc-container-setup.yml | 2 +- playbooks/defaults/repo_packages/gnocchi.yml | 2 +- .../defaults/repo_packages/openstack_services.yml | 60 +++++++++++----------- playbooks/galera-install.yml | 2 +- playbooks/inventory/group_vars/all.yml | 2 +- playbooks/os-cinder-install.yml | 2 +- playbooks/os-keystone-install.yml | 2 +- playbooks/os-nova-install.yml | 2 +- playbooks/os-swift-install.yml | 2 +- playbooks/rabbitmq-install.yml | 2 +- playbooks/rsyslog-install.yml | 2 +- playbooks/utility-install.yml | 2 + playbooks/vars/configs/haproxy_config.yml | 4 +- ...template-ignore-none-type-9387c236853f061b.yaml | 9 ++++ .../dnsmasq-lxc-conflict-fix-c8968f6a16d033c6.yaml | 10 ++++ .../fix-mysql-overrides-e5362ae15c657214.yaml | 8 +++ releasenotes/notes/ldappool-65dcc48c12d28d07.yaml | 4 +- .../remove-haproxy-repo-vars-051a47bbfaf6d1da.yaml | 8 +++ ...ot-login-without-password-948ec79c6508c19b.yaml | 6 +++ requirements.txt | 2 - 27 files changed, 119 insertions(+), 85 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index c6fb0f1..d98ec30 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +8,0 @@ pyOpenSSL>=0.14 # Apache-2.0 -requests!=2.12.2,>=2.10.0 # Apache-2.0 @@ -16 +14,0 @@ PyYAML>=3.10.0 # MIT -urllib3>=1.15.1 # MIT

1 0

[openstackansible] openstack-ansible-os_swift 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are excited to announce the release of: openstack-ansible-os_swift 14.2.9: os_swift for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_swift/ For more details, please see below. Changes in openstack-ansible-os_swift 14.2.7..14.2.9 ---------------------------------------------------- ff2c096 Optimise the execution of the role 3921327 Filter services dictionary per host Diffstat (except docs and test files) ------------------------------------- handlers/main.yml | 6 ++-- tasks/main.yml | 66 ++++++++++++++++----------------------- tasks/swift_init_common.yml | 35 --------------------- tasks/swift_init_systemd.yml | 12 +++---- tasks/swift_init_upstart.yml | 3 +- tasks/swift_sync_post_install.yml | 24 -------------- vars/main.yml | 24 ++++++++++++++ 7 files changed, 58 insertions(+), 112 deletions(-)

1 0

[openstackansible] openstack-ansible-os_heat 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We enthusiastically announce the release of: openstack-ansible-os_heat 14.2.9: os_heat for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_heat/ For more details, please see below. Changes in openstack-ansible-os_heat 14.2.6..14.2.9 --------------------------------------------------- 6054607 Add missing functional test script to tox b554bfe Correct heat developer mode constraint Diffstat (except docs and test files) ------------------------------------- tasks/heat_install.yml | 2 +- tox.ini | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_nova 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are tickled pink to announce the release of: openstack-ansible-os_nova 14.2.9: os_nova for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_nova/ For more details, please see below. Changes in openstack-ansible-os_nova 14.2.8..14.2.9 --------------------------------------------------- 9167787 Ensure online migrations can run ba256e3 Updated from OpenStack Ansible Tests 2091c57 Updated from OpenStack Ansible Tests 688aa8b Fail if TLS + TCP are enabled for libvirtd Diffstat (except docs and test files) ------------------------------------- .gitignore | 5 ++- Vagrantfile | 36 +++++++++++++++---- bindep.txt | 15 +++++++- tasks/main.yml | 20 +++++++++++ tasks/nova_db_setup.yml | 1 + 6 files changed, 119 insertions(+), 49 deletions(-)

1 0

[openstackansible] openstack-ansible-ironic 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: openstack-ansible-ironic 14.2.9: Ironic Role for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ironic/ For more details, please see below. Changes in openstack-ansible-ironic 14.2.8..14.2.9 -------------------------------------------------- 8b1e856 Fix typo in timeout 7d81c6b Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 7 +--- Vagrantfile | 36 +++++++++++++--- bindep.txt | 12 ++++++ templates/ironic-upstart-init.j2 | 2 +- 5 files changed, 97 insertions(+), 51 deletions(-)

1 0

[openstackansible] openstack-ansible-plugins 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are overjoyed to announce the release of: openstack-ansible-plugins 14.2.9: plugins for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-plugins/ For more details, please see below. Changes in openstack-ansible-plugins 14.2.8..14.2.9 --------------------------------------------------- d966941 Revert unicode parsing changes to config-template Diffstat (except docs and test files) ------------------------------------- action/_v2_config_template.py | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-)

1 0

[openstackansible] openstack-ansible-os_cinder 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are tickled pink to announce the release of: openstack-ansible-os_cinder 14.2.9: os_cinder role for OpenStack- Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_cinder/ For more details, please see below. Changes in openstack-ansible-os_cinder 14.2.8..14.2.9 ----------------------------------------------------- 480bc09 Remove online_data_migrations-related tasks 7a2ecc0 Ensure online migrations can run ab9e791 Updated from OpenStack Ansible Tests fdd6fa7 Updated from OpenStack Ansible Tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 7 +-- Vagrantfile | 36 ++++++++++++--- bindep.txt | 17 +++++-- tasks/cinder_cleanup_old_facts.yml | 7 ++- tasks/cinder_db_setup.yml | 19 -------- tasks/cinder_install.yml | 6 +-- tasks/main.yml | 3 +- 8 files changed, 106 insertions(+), 80 deletions(-)

1 0

[openstackansible] openstack-ansible-os_magnum 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are gleeful to announce the release of: openstack-ansible-os_magnum 14.2.9: os_magnum for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_magnum/ For more details, please see below. Changes in openstack-ansible-os_magnum 14.2.4..14.2.9 ----------------------------------------------------- 8acd821 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-os_sahara 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We joyfully announce the release of: openstack-ansible-os_sahara 14.2.9: os_sahara for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_sahara/ For more details, please see below. Changes in openstack-ansible-os_sahara 14.1.1..14.2.9 ----------------------------------------------------- aeb5cdc Install python2-pyOpenSSL package on CentOS Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_glance 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We joyfully announce the release of: openstack-ansible-os_glance 14.2.9: os_glance for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_glance/ For more details, please see below. Changes in openstack-ansible-os_glance 14.2.6..14.2.9 ----------------------------------------------------- 849f8df Revert "Only sync glance database on major versions" fa093ba Switch from run_once back to inventory scoping 8abdf4d Hedge upgrade process against no software change cbe355d Ensure that services restart in a particular order 5568c4d Perform an atomic policy file change 86ad493 Only sync glance database on major versions Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 2 ++ handlers/main.yml | 48 ++++++++++++++++++++++++++++++++---- tasks/glance_init_common.yml | 31 ----------------------- tasks/glance_init_systemd.yml | 33 +++++++++++++++---------- tasks/glance_init_upstart.yml | 5 ++-- tasks/glance_install.yml | 14 +++++++++++ tasks/glance_post_install.yml | 2 +- tasks/main.yml | 10 +++++--- templates/glance-systemd-init.j2 | 4 +-- templates/glance-systemd-tmpfiles.j2 | 4 +-- templates/glance-upstart-init.j2 | 18 +++++++------- vars/main.yml | 31 +++++++++++++++++++++++ 12 files changed, 133 insertions(+), 69 deletions(-)

1 0

[openstackansible] openstack-ansible-os_rally 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: openstack-ansible-os_rally 14.2.9: os_rally for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_rally/ For more details, please see below. Changes in openstack-ansible-os_rally 14.2.8..14.2.9 ---------------------------------------------------- b6377ae Correct the search message in Create/upgrade Rally DB schema task Diffstat (except docs and test files) ------------------------------------- tasks/database-setup.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[openstackansible] openstack-ansible-os_neutron 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are glad to announce the release of: openstack-ansible-os_neutron 14.2.9: os_neutron role for OpenStack- Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_neutron/ For more details, please see below. Changes in openstack-ansible-os_neutron 14.2.8..14.2.9 ------------------------------------------------------ b15cc7f Simplify the string check for offline db migrations Diffstat (except docs and test files) ------------------------------------- tasks/neutron_db_setup.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[openstackansible] openstack-ansible-os_horizon 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We enthusiastically announce the release of: openstack-ansible-os_horizon 14.2.9: OpenStack Horizon role for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_horizon/ For more details, please see below. 14.2.9 ^^^^^^ New Features * It's now possible to disable heat stack password field in horizon. "horizon_enable_heatstack_user_pass" variable has been added and default to True. Changes in openstack-ansible-os_horizon 14.2.6..14.2.9 ------------------------------------------------------ 36a1acb Allow possibility to disable heatstack password Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 1 + releasenotes/notes/heatstack_password-25956b6143577735.yaml | 5 +++++ templates/horizon_local_settings.py.j2 | 2 +- 3 files changed, 7 insertions(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_gnocchi 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are chuffed to announce the release of: openstack-ansible-os_gnocchi 14.2.9: os_gnocchi for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_gnocchi/ For more details, please see below. Changes in openstack-ansible-os_gnocchi 14.2.4..14.2.9 ------------------------------------------------------ 4372bcf Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/gnocchi_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-os_ceilometer 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We high-spiritedly announce the release of: openstack-ansible-os_ceilometer 14.2.9: os_ceilometer role for OpenStack-Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ceilometer/ For more details, please see below. Changes in openstack-ansible-os_ceilometer 14.2.4..14.2.9 --------------------------------------------------------- ee6257f Add venv_tag local fact 0034239 Revert "Pin gnocchiclient to comply with optional deps" Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 6 +----- tasks/ceilometer_install.yml | 7 +++++++ 2 files changed, 8 insertions(+), 5 deletions(-)

1 0

[openstackansible] openstack-ansible-os_keystone 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are gleeful to announce the release of: openstack-ansible-os_keystone 14.2.9: os_keystone for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_keystone/ For more details, please see below. 14.2.9 ^^^^^^ New Features * Extra headers can be added to Keystone responses by adding items to "keystone_extra_headers". Example: keystone_extra_headers: - parameter: "Access-Control-Expose-Headers" value: "X-Subject-Token" - parameter: "Access-Control-Allow-Headers" value: "Content-Type, X-Auth-Token" - parameter: "Access-Control-Allow-Origin" value: "*" Changes in openstack-ansible-os_keystone 14.2.8..14.2.9 ------------------------------------------------------- 566c3e8 Ensure online migrations can run c0fb47b Updated from OpenStack Ansible Tests 953e3cc Remove Developer Tools package group d4f547e Add extra headers for Keystone 8ab5dec Update paste, policy and rootwrap configurations 2017-07-27 Diffstat (except docs and test files) ------------------------------------- .gitignore | 7 +- Vagrantfile | 36 +++++++-- bindep.txt | 15 +++- defaults/main.yml | 14 ++++ .../notes/extra-headers-e54a672d3a78dd89.yaml | 15 ++++ tasks/keystone_db_setup.yml | 12 ++- templates/keystone_nginx.conf.j2 | 3 + templates/policy.json.j2 | 2 +- vars/redhat-7.yml | 2 +- 10 files changed, 141 insertions(+), 56 deletions(-)

1 0

[openstackansible] openstack-ansible-os_aodh 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are gleeful to announce the release of: openstack-ansible-os_aodh 14.2.9: os_aodh for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_aodh/ For more details, please see below. Changes in openstack-ansible-os_aodh 14.2.4..14.2.9 --------------------------------------------------- ac0a498 Add venv_tag local fact Diffstat (except docs and test files) ------------------------------------- tasks/aodh_install.yml | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[openstackansible] openstack-ansible-memcached_server 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pumped to announce the release of: openstack-ansible-memcached_server 14.2.9: memcached_server for OpenStack Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-memcached_server/ For more details, please see below. Changes in openstack-ansible-memcached_server 14.2.8..14.2.9 ------------------------------------------------------------ 0afdcad Add automatic restart for memcached Diffstat (except docs and test files) ------------------------------------- tasks/memcached_config.yml | 8 ++++++++ templates/systemd-restart-on-failure.conf.j2 | 4 ++++ 2 files changed, 12 insertions(+)

1 0

[openstackansible] openstack-ansible-haproxy_server 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pumped to announce the release of: openstack-ansible-haproxy_server 14.2.9: haproxy_server role for OpenStack-Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-haproxy_server/ For more details, please see below. Changes in openstack-ansible-haproxy_server 14.2.8..14.2.9 ---------------------------------------------------------- 179975e Optimise task execution 7bffdd5 Allow HAproxy repo/gpg overrides without extra-vars Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +-- tasks/haproxy_add_ppa_repo.yml | 80 +++++++++++++++++++++++++++--------------- tasks/haproxy_install.yml | 7 +--- vars/ubuntu-14.04.yml | 5 +-- 4 files changed, 57 insertions(+), 39 deletions(-)

1 0

[openstackansible] openstack-ansible-galera_server 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pleased to announce the release of: openstack-ansible-galera_server 14.2.9: Galera Server role for OpenStack-Ansible This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-galera_server/ For more details, please see below. 14.2.9 ^^^^^^ Bug Fixes * MariaDB 10.0.32 released on Aug 17 which, when configured to use xtrabackup for the SST, requires percona xtrabackup version 2.3.5 or higher. As xtrabackup is the default SST mechanism in the "galera_server" role, the version used has been updated from 2.2.13 to 2.3.5 for the x86_64 hardware architecture. See the percona release notes for 2.3.2 (https://www.percona.com/doc/percona- xtrabackup/LATEST/release-notes/2.3/2.3.2.html#new-features) for more details of what was included in the fix. Changes in openstack-ansible-galera_server 14.2.7..14.2.9 --------------------------------------------------------- 8bb3464 Fix MariaDB apt package pinning 3ed010a Update percona xtrabackup to 2.3.5 2a14d3b Toggle percona repo without extra-vars 9106e4f Use block/rescue for error handling d9f8113 Allow MariaDB repo overrides without extra-vars Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 20 ++++++++ .../notes/xtrabackup-update-0aedcb9baa88ce35.yaml | 10 ++++ tasks/galera_install_apt.yml | 60 +++++++++++----------- tasks/galera_install_yum.yml | 49 +++++++++--------- vars/redhat-7.yml | 16 +++--- vars/ubuntu-14.04.yml | 20 ++++---- vars/ubuntu-16.04.yml | 20 ++++---- 7 files changed, 112 insertions(+), 83 deletions(-)

1 0

[openstackansible] ansible-hardening 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are ecstatic to announce the release of: ansible-hardening 14.2.9: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 14.2.9 ^^^^^^ Security Issues * "PermitRootLogin" in the ssh configuration has changed from "yes" to "without-password". This will only allow ssh to be used to authenticate root via a key. Changes in ansible-hardening 14.2.3..14.2.9 ------------------------------------------- 31bfec7 Change default prohibit root sshd password auth d12b33b Updated from OpenStack Ansible Tests 436b6b6 [Docs] Replace security role references 62d5932 Fix ansible-hardening references in tox/playbook 6bbc4e9 Do not update grub if grub not used c339fcf Fix .gitreview for older branches 5ee3c4e Don't install python-ndg_httpsclient Diffstat (except docs and test files) ------------------------------------- .gitignore | 7 +- .gitreview | 2 +- README.md | 6 +- README.rst | 4 +- Vagrantfile | 72 ++++++----------- bindep.txt | 22 ++++-- defaults/main.yml | 16 ++-- files/V-38682-modprobe.conf | 2 +- handlers/main.yml | 4 + ...ot-login-without-password-948ec79c6508c19b.yaml | 6 ++ ...support-for-centos-xenial-2b89c318cc3df4b0.yaml | 2 +- setup.cfg | 2 +- tasks/main.yml | 7 ++ tasks/sshd.yml | 28 +++---- tox.ini | 2 +- vars/main.yml | 2 +- vars/redhat.yml | 2 +- vars/ubuntu.yml | 2 +- 29 files changed, 174 insertions(+), 163 deletions(-)

1 0

[openstackansible] openstack-ansible 14.2.9 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pleased to announce the release of: openstack-ansible 14.2.9: Ansible playbooks for deploying OpenStack This release is part of the newton stable release series. The source is available from: http://git.openstack.org/cgit/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ For more details, please see below. 14.2.9 ^^^^^^ New Features ************ * Tags have been added to all of the common tags with the prefix "common-". This has been done to allow a deployer to rapidly run any of the common on a need basis without having to rerun an entire playbook. * Extra headers can be added to Keystone responses by adding items to "keystone_extra_headers". Example: keystone_extra_headers: - parameter: "Access-Control-Expose-Headers" value: "X-Subject-Token" - parameter: "Access-Control-Allow-Headers" value: "Content-Type, X-Auth-Token" - parameter: "Access-Control-Allow-Origin" value: "*" Upgrade Notes ************* * The openstack-ansible-security role is now retired and the ansible- hardening role replaces it. The ansible-hardening role provides the same functionality and will be the maintained hardening role going forward. Bug Fixes ********* * In Ubuntu the "dnsmasq" package actually includes init scripts and service configuration which conflict with LXC and are best not included. The actual dependent package is "dnsmasq-base". The package list has been adjusted and a task added to remove the "dnsmasq" package and purge the related configuration files from all LXC hosts. Changes in openstack-ansible 14.2.8..14.2.9 ------------------------------------------- b057986 Update SHA for os_ironic 0d16b03 Update rabbitmq_server role SHA 9b8f3ff Update SHA for os_tempest dff42ad Switch to use ansible-hardening c351cdb Suppress curl warning w/shell module 6d10e57 Fix LXC container start order fb05ea0 Update role SHA's for online migration fixes 2ac2b48 Added a common tag to the common tasks 01b0f6b Remove cinder online_data_migrations-related play 47ec935 migrate_openstack_vars.py: Correct folder name 566bdb5 Set serial to 100% for nova_compute 71f2a24 Remove global pin for ldappool 838771f Update all SHAs for 14.2.9 Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 36 ++++++++--------- .../source/app-advanced-config-security.rst | 6 +-- deploy-guide/source/app-security.rst | 2 +- global-requirement-pins.txt | 6 --- playbooks/common-playbooks/cinder.yml | 2 +- playbooks/common-playbooks/neutron.yml | 2 +- playbooks/common-playbooks/nova.yml | 2 +- playbooks/common-tasks/dynamic-address-fact.yml | 2 + playbooks/common-tasks/dynamic-grouping.yml | 2 + playbooks/common-tasks/mysql-db-user.yml | 4 ++ playbooks/common-tasks/os-log-dir-setup.yml | 4 ++ playbooks/common-tasks/os-lxc-container-setup.yml | 18 ++++++++- playbooks/common-tasks/package-cache-proxy.yml | 11 +++++- playbooks/common-tasks/rabbitmq-vhost-user.yml | 5 +++ playbooks/common-tasks/set-pip-upstream-url.yml | 4 ++ playbooks/common-tasks/set-upper-constraints.yml | 10 +++++ playbooks/defaults/repo_packages/gnocchi.yml | 2 +- .../defaults/repo_packages/openstack_services.yml | 46 +++++++++++----------- playbooks/galera-install.yml | 2 +- playbooks/inventory/group_vars/all.yml | 6 +-- playbooks/inventory/group_vars/nova_all.yml | 1 + playbooks/os-cinder-install.yml | 30 -------------- playbooks/os-keystone-install.yml | 2 +- playbooks/os-nova-install.yml | 2 +- playbooks/os-swift-install.yml | 2 +- playbooks/rabbitmq-install.yml | 2 +- playbooks/rsyslog-install.yml | 2 +- playbooks/security-hardening.yml | 2 +- playbooks/utility-install.yml | 2 + .../notes/common-tags-9763f578ea5fe5b6.yaml | 5 +++ .../dnsmasq-lxc-conflict-fix-c8968f6a16d033c6.yaml | 10 +++++ .../notes/extra-headers-e54a672d3a78dd89.yaml | 15 +++++++ releasenotes/notes/ldappool-e79455337a02b05d.yaml | 4 +- ...itch-to-ansible-hardening-2e59a2ce26db7bbb.yaml | 7 ++++ .../scripts/migrate_openstack_vars.py | 2 +- 35 files changed, 159 insertions(+), 101 deletions(-)

1 0

[tripleo] tripleo-ui 3.2.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are satisfied to announce the release of: tripleo-ui 3.2.2: tripleo-ui This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/tripleo-ui/ For more details, please see below. Changes in tripleo-ui 3.2.1..3.2.2 ---------------------------------- 0bc29b0 Release 3.2.2 Diffstat (except docs and test files) ------------------------------------- npm-shrinkwrap.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[tripleo] tripleo-ui 1.2.1 (newton)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are pleased to announce the release of: tripleo-ui 1.2.1 This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/tripleo-ui/ For more details, please see below. Changes in tripleo-ui 1.2.0..1.2.1 ---------------------------------- 468faee Release 1.2.1 Diffstat (except docs and test files) ------------------------------------- npm-shrinkwrap.json | 2 +- package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0

[tripleo] tripleo-common 6.1.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are ecstatic to announce the release of: tripleo-common 6.1.2: A common library for TripleO workflows. This release is part of the ocata stable release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-common Download the package from: https://tarballs.openstack.org/tripleo-common/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo-common For more details, please see below. Changes in tripleo-common 6.1.1..6.1.2 -------------------------------------- a96721a Remove machine-id from image Diffstat (except docs and test files) ------------------------------------- image-yaml/overcloud-images.yaml | 1 + 1 file changed, 1 insertion(+)

1 0

[tripleo] tripleo-puppet-elements 6.2.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are delighted to announce the release of: tripleo-puppet-elements 6.2.2: Puppet building rules for OpenStack images. This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/tripleo-puppet-elements/ For more details, please see below. Changes in tripleo-puppet-elements 6.2.1..6.2.2 ----------------------------------------------- c95399a Add remove-machine-id element Diffstat (except docs and test files) ------------------------------------- elements/remove-machine-id/README.md | 9 +++++++++ elements/remove-machine-id/post-install.d/70-remove-machine-id | 8 ++++++++ 2 files changed, 17 insertions(+)

1 0

[tripleo] puppet-tripleo 6.5.2 (ocata)
by no-reply＠openstack.org 05 Oct '17

05 Oct '17

We are thrilled to announce the release of: puppet-tripleo 6.5.2: Puppet module for OpenStack TripleO This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/puppet-tripleo/ For more details, please see below. 6.5.2 ^^^^^ New Features ************ * Enable innodb_flush_log_at_trx_commit configuration for Galera only. Upgrade Notes ************* * Setting the innodb_flush_log_at_trx_commit flag to the value of "2" instead of its default value of "1" means that the underlying MySQL/MariaDB engine will no longer flush transactions to disk on a per-transaction basis; instead, flushes occur once per second. This leads to far fewer disk writes and can dramatically improve write performance, at the cost of durability (e.g. will lose the last second's worth of transactions) if the database engine is ungracefully shut down. The clustered nature of Galera mitigates this risk in that transactions are replicated to other nodes before completion, and the setting of "2" is considered to be generally safe for a Galera cluster, with the exception case of simultaneous power loss for all nodes. Changes in puppet-tripleo 6.5.1..6.5.2 -------------------------------------- 3ecd35c Release 6.5.2 05d31f7 Add option for innodb_flush_log_at_trx_commit = 2 for Galera only 0848990 firewall: generally accept "jump" param and use tripleo:firewall for log rule 0694a3d Use resource collector for the fencing -> stonith ordering Diffstat (except docs and test files) ------------------------------------- manifests/firewall/post.pp | 2 +- manifests/firewall/rule.pp | 16 ++++- manifests/profile/base/pacemaker.pp | 2 +- manifests/profile/pacemaker/database/mysql.pp | 73 ++++++++++++---------- metadata.json | 2 +- ...b_flush_log_at_trx_commit-eb7d99749ca3c911.yaml | 17 +++++ 6 files changed, 76 insertions(+), 36 deletions(-)

1 0