December 2017 - Release-announce - lists.openstack.org

[openstackansible] openstack-ansible-os_ceilometer 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are delighted to announce the release of: openstack-ansible-os_ceilometer 16.0.5: os_ceilometer role for OpenStack-Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ceilometer/ For more details, please see below. Changes in openstack-ansible-os_ceilometer 16.0.3..16.0.5 --------------------------------------------------------- 4b3e058 Initial OSA zuul v3 role jobs Diffstat (except docs and test files) ------------------------------------- releasenotes/source/conf.py | 4 ++- tox.ini | 12 ------- zuul.d/project.yaml | 27 ++++++++++++++++ 9 files changed, 61 insertions(+), 140 deletions(-)

1 0

[openstackansible] openstack-ansible-ironic 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are amped to announce the release of: openstack-ansible-ironic 16.0.5: Ironic Role for OpenStack Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_ironic/ For more details, please see below. Changes in openstack-ansible-ironic 16.0.4..16.0.5 -------------------------------------------------- 34205b6 Resolve ansible-lint test failures Diffstat (except docs and test files) ------------------------------------- 2 files changed, 34 insertions(+)

1 0

[openstackansible] openstack-ansible-galera_server 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We contentedly announce the release of: openstack-ansible-galera_server 16.0.5: Galera Server role for OpenStack-Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-galera_server/ For more details, please see below. Changes in openstack-ansible-galera_server 16.0.4..16.0.5 --------------------------------------------------------- b124e06 SUSE: Apply workaround for mariadb-10.2 Diffstat (except docs and test files) ------------------------------------- tasks/galera_post_install.yml | 10 ++++++++++ templates/systemd.environment.conf.j2 | 5 +++++ vars/main.yml | 2 ++ vars/suse-42.yml | 7 ++++++- 5 files changed, 26 insertions(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_neutron 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are chuffed to announce the release of: openstack-ansible-os_neutron 16.0.5: os_neutron role for OpenStack- Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_neutron/ For more details, please see below. 16.0.5 ^^^^^^ New Features * FWaaS V2 has been added to neutron. To enable this service simply add "firewall_v2" to the "neutron_plugin_base" list. Changes in openstack-ansible-os_neutron 16.0.4..16.0.5 ------------------------------------------------------ af50d97 Change deprecated nova_metadata_ip option ab817f6 Remove send_arp_for_ha option efa1d27 Remove jinja2 delimiters from when clause 50380f1 Resolve ansible-lint test failures f16fbb9 Add support for Neutron FWaaS v2 9df3bcf Set enable_dvr when router_distributed is enabled 6cafccf Add defaults for nova metadata settings Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 9 ++++- meta/main.yml | 7 ++-- .../notes/fwaasv2-added-ab9ba18c8b98a83e.yaml | 4 +++ tasks/main.yml | 3 ++ tasks/neutron_check.yml | 23 +++++++++++++ templates/l3_agent.ini.j2 | 23 ++++++++++++- templates/metadata_agent.ini.j2 | 2 +- templates/neutron.conf.j2 | 9 +---- vars/main.yml | 3 +- 12 files changed, 123 insertions(+), 16 deletions(-)

1 0

[openstackansible] openstack-ansible-os_nova 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are pleased to announce the release of: openstack-ansible-os_nova 16.0.5: os_nova for OpenStack Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_nova/ For more details, please see below. Changes in openstack-ansible-os_nova 16.0.4..16.0.5 --------------------------------------------------- 80e0d04 Do not implement reload for novnc/spice service b1066d2 Update filters to support over-commit e74d33b Set the nova-lxd lib to use PIKE Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 19 +++++++++++++++++-- templates/nova-systemd-init.j2 | 2 ++ 2 files changed, 19 insertions(+), 2 deletions(-)

1 0

[openstackansible] openstack-ansible-os_designate 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are overjoyed to announce the release of: openstack-ansible-os_designate 16.0.5: os_designate for OpenStack Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_designate/ For more details, please see below. Changes in openstack-ansible-os_designate 16.0.4..16.0.5 -------------------------------------------------------- eac6d3c Fix ansible-lint test failures Diffstat (except docs and test files) ------------------------------------- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[openstackansible] openstack-ansible-os_glance 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are chuffed to announce the release of: openstack-ansible-os_glance 16.0.5: os_glance for OpenStack Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-os_glance/ For more details, please see below. 16.0.5 ^^^^^^ Upgrade Notes ************* * The glance registry service for the v2 API is now disabled by default as it is not required and is scheduled to be removed in the future. The service can be enabled by setting "glance_enable_v2_registry" to "True". As the glance v1 API is still enabled by default, and it requires the registry service, the glance-registry service will still remain running and operational as before. If the variable "glance_enable_v1_api" is set to "False" then both the v1 API and the registry service will be disabled and removed. Deprecation Notes ***************** * The "glance_enable_v1_registry" variable has been removed. When using the glance v1 API the registry service is required, so having a variable to disable it makes little sense. The service is now enabled/disabled for the v1 API using the "glance_enable_v1_api" variable. Bug Fixes ********* * When the "glance_enable_v2_registry" variable is set to "True" the corresponding "data_api" setting is now correctly set. Previously it was not set and therefore the API service was not correctly informed that the registry was operating. Changes in openstack-ansible-os_glance 16.0.4..16.0.5 ----------------------------------------------------- 4708091 Remove jinja2 delimiters from when 6590581 Template api/registry enablement settings properly 2820908 Disable glance-registry for the v2 API by default f3ec687 Allow deployment without glance-registry Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 9 ++-- handlers/main.yml | 50 ++++++++++++++++++++++ .../notes/glance-v2-api-only-0d4a61b0d4dade18.yaml | 23 ++++++++++ tasks/glance_init_systemd.yml | 9 ---- tasks/glance_post_install.yml | 5 ++- templates/glance-api.conf.j2 | 12 ++++-- templates/glance-registry.conf.j2 | 5 +++ tox.ini | 24 ++++++++++- zuul.d/jobs.yaml | 28 ++++++++++++ zuul.d/project.yaml | 5 +++ 11 files changed, 154 insertions(+), 18 deletions(-)

1 0

[openstackansible] openstack-ansible-memcached_server 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are satisfied to announce the release of: openstack-ansible-memcached_server 16.0.5: memcached_server for OpenStack Ansible This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/openstack-ansible-memcached_server/ For more details, please see below. Changes in openstack-ansible-memcached_server 16.0.3..16.0.5 ------------------------------------------------------------ 08c483f Updated from OpenStack Ansible Tests eb7b5ff Initial OSA zuul v3 role jobs Diffstat (except docs and test files) ------------------------------------- zuul.d/project.yaml | 29 +++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+), 20 deletions(-)

1 0

[openstackansible] ansible-hardening 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are gleeful to announce the release of: ansible-hardening 16.0.5: OpenStack-Ansible: Host security hardening This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 16.0.5 ^^^^^^ New Features * The "security_sshd_permit_root_login" setting can now be set to change the "PermitRootLogin" setting in "/etc/ssh/sshd_config" to any of the possible options. Set "security_sshd_permit_root_login" to one of "without-password", "prohibit-password", "forced-commands- only", "yes" or "no". * Searching for world-writable files is now disabled by default. The search causes delays in playbook runs and it can consume a significant amount of CPU and I/O resources. Deployers can re-enable the search by setting "security_find_world_writable_dirs" to "yes". Changes in ansible-hardening 16.0.4..16.0.5 ------------------------------------------- c05e36f Change PermitRootLogin to allow alternate options a8afdd1 Fix logic error 5543b54 Fix filesystem permission masks 3360e06 Always search for ssh keys cfeb649 Always quote the filesystem permissions 8248f89 Optionally search for world-writable files 7364491 rhel7stig: sshd.yml: Respect the STIG sshd configuration Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +++- handlers/main.yml | 2 +- .../permitrootlogin_options-a62e33ccc4a69657.yaml | 8 +++++++ ...able-file-search-optional-7420269230a0e22f.yaml | 7 ++++++ tasks/rhel7stig/file_perms.yml | 6 +++++- tasks/rhel7stig/sshd.yml | 25 +++++++--------------- templates/sshd_config_block.j2 | 9 ++++++-- 10 files changed, 55 insertions(+), 24 deletions(-)

1 0

[openstackansible] openstack-ansible 16.0.5 (pike)
by no-reply＠openstack.org 08 Dec '17

08 Dec '17

We are excited to announce the release of: openstack-ansible 16.0.5: Ansible playbooks for deploying OpenStack This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ For more details, please see below. 16.0.5 ^^^^^^ New Features ************ * FWaaS V2 has been added to neutron. To enable this service simply add "firewall_v2" to the "neutron_plugin_base" list. * The maximum amount of time to wait until forcibly failing the LXC cache preparation process is now configurable using the "lxc_cache_prep_timeout" variable. The value is specified in seconds, with the default being 10 minutes. * A new LXC container template has been added which will allow us to better manage containers on the host machines we support. The new template uses the *machinectl* command to create container rootfs using the existing cache. This in-turn will provide easier management of container images, faster build times, and the ability to instantly clone a container (or a given variant) without impacting a containers state. This new lxc container create template, and the features it provides, will only impact new containers created allowing deployers to safely adopt this change in any existing environment. * The tag options when creating an LXC container have been simplified. The two tags now supported by the *lxc_container_create* role are **lxc-{create,config}**. * The "security_sshd_permit_root_login" setting can now be set to change the "PermitRootLogin" setting in "/etc/ssh/sshd_config" to any of the possible options. Set "security_sshd_permit_root_login" to one of "without-password", "prohibit-password", "forced-commands- only", "yes" or "no". * Searching for world-writable files is now disabled by default. The search causes delays in playbook runs and it can consume a significant amount of CPU and I/O resources. Deployers can re-enable the search by setting "security_find_world_writable_dirs" to "yes". Upgrade Notes ************* * The glance registry service for the v2 API is now disabled by default as it is not required and is scheduled to be removed in the future. The service can be enabled by setting "glance_enable_v2_registry" to "True". As the glance v1 API is still enabled by default, and it requires the registry service, the glance-registry service will still remain running and operational as before. If the variable "glance_enable_v1_api" is set to "False" then both the v1 API and the registry service will be disabled and removed. * The LXC container create option *lxc_container_backing_store* is now defined by default and has a value of "dir". Prior to this release the backend store option was using several auto-detection methods to try and guess the store type based on facts fed into the role and derived from the physical host. While the auto-detection methods worked, they created a cumbersome set of conditionals and limited our ability to leverage additional container stores. Having this option be a default allows deployers to mix and match container stores to suit the needs of the deployment. Existing deployments should set this option within group or user variables to ensure there's no change in the backend store when new container be provisioned. Deprecation Notes ***************** * The "glance_enable_v1_registry" variable has been removed. When using the glance v1 API the registry service is required, so having a variable to disable it makes little sense. The service is now enabled/disabled for the v1 API using the "glance_enable_v1_api" variable. Bug Fixes ********* * When the "glance_enable_v2_registry" variable is set to "True" the corresponding "data_api" setting is now correctly set. Previously it was not set and therefore the API service was not correctly informed that the registry was operating. Other Notes *********** * The LXC container create role will now check for the LXC volume group if the option *lxc_container_backing_store* is set to "lvm". If this volume group is not found, the role will halt and instruct the deployer to update their configuration options and inspect their host setup. Changes in openstack-ansible 16.0.4..16.0.5 ------------------------------------------- fa2ddbb Do not source openstack-ansible.rc when pulling roles 6836c7f Bump roles SHA dcf6443 Use 'PermitRootLogin 'without-password'' 5fb6357 Update all SHAs for 16.0.5 f3a5d6e scripts: scripts-library.sh: Use pgrep -f to find the dstat process 527cbf7 Use tests repo for all lint tests e113e19 Do not force using the remote "origin" when testing upgrades 6e917e4 Do not implement reload for novnc/spice service Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 46 ++++---- group_vars/all/all.yml | 2 +- group_vars/hosts.yml | 2 +- playbooks/defaults/repo_packages/gnocchi.yml | 2 +- .../defaults/repo_packages/openstack_services.yml | 66 ++++++------ playbooks/os-nova-install.yml | 23 ++-- .../notes/fwaasv2-added-ab9ba18c8b98a83e.yaml | 4 + .../notes/glance-v2-api-only-0d4a61b0d4dade18.yaml | 23 ++++ .../lxc-cache-prep-timeout-97dc18882f7b1e76.yaml | 7 ++ .../lxc-machinectl-template-9e65779a94cb767f.yaml | 11 ++ ...c_container_backing_store-e0a77c48da3a57b2.yaml | 21 ++++ .../permitrootlogin_options-a62e33ccc4a69657.yaml | 8 ++ ...able-file-search-optional-7420269230a0e22f.yaml | 7 ++ scripts/bootstrap-ansible.sh | 2 +- scripts/gate-check-commit.sh | 2 +- scripts/scripts-library.sh | 2 +- tox.ini | 110 ++++++++----------- 18 files changed, 317 insertions(+), 138 deletions(-)

1 0