May 2017 - Release-announce - lists.openstack.org

openstack-ansible-security 12.2.5
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 12.2.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.2.5 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 12.2.3..12.2.5 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 12.2.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 12.2.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.6 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.0.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.0.0: Security hardening role for openstack-ansible This is the first release of openstack-ansible-security. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.16
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.0.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.16 ^^^^^^^ New Features ************ * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. Bug Fixes ********* * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run.

1 0

[cinder] python-cinderclient 2.1.0 (pike)
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: python-cinderclient 2.1.0: OpenStack Block Storage API Client Library This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/python-cinderclient Download the package from: https://pypi.python.org/pypi/python-cinderclient Please report issues through launchpad: https://bugs.launchpad.net/python-cinderclient For more details, please see below. 2.1.0 ^^^^^ New Features ************ * Use 'cinder reset-state' as generic resource reset state command for resource 'volume', 'snapshot', 'backup' 'group' and 'group- snapshot'. Also change volume's default status from 'available' to none when no status is specified. * Cinderclient now supports noauth mode using *--os-auth-type noauth* param. Also python-cinderclient now supports keystoneauth1 plugins. Deprecation Notes ***************** * --bypass-url param is now deprecated. Please use --os-endpoint instead of it. --os-auth-system param is now deprecated. Please --os-auth-type instead of it. Bug Fixes ********* * The mountpoint argument was ignored when creating an attachment and now has been fixed. [Bug 1675973 (https://bugs.launchpad.net/bugs/1675973) * The 'tenant' argument was ignored when listing attachments, and now has been fixed. [Bug 1675974 (https://bugs.launchpad.net/bugs/1675974) * The 'server_id' is now a required parameter when creating an attachment, that means we should create an attachment with a command like, 'cinder attachment-create <volume> <server_id>'. [Bug 1675975 (https://bugs.launchpad.net/bugs/1675975) Changes in python-cinderclient 2.0.1..2.1.0 ------------------------------------------- 5075eb2 support global_request_id in constructor 8471c6c Eliminate function redefined pylint error 2bfd512 Updated from global requirements 69f0090 Handle dashes in encryption-type-create arguments da4e810 Add doc for noauth usage 3a62acc Updated from global requirements af921bb Cinder client reset-state improvements 990527e Fix the wrong help message of marker 16af9f7 Pretty print 'extra_specs' and 'group_specs' 85b56e1 Fix client `retries` default value. 371831a Tests: Add info to assert_called failure message 650dc13 Replace http with https c384975 Remove direct dependency on requests 51f6668 Updated from global requirements ae7ab7d [BugFix] Make 'instance_id' required in attachment-create CLI. 4ed7118 [BugFix] Add 'all_tenants', 'project_id' in attachment-list 273c724 [BugFix] 'Mountpoint' is missing in attachment CLIs. 60f92db Fix noauth support 7b213a9 Remove log translations bb912de Remove duplicate do_upload_to_image() method def 31a7ba7 Update README.rst to remain consistent with python-cinderclient. c022b73 Fix pep8 errors 25ba0fb Add cinder tests for cinder snapshot create commands with parameters 7b5a91a Update tox to delete py34 Diffstat (except docs and test files) ------------------------------------- README.rst | 315 +++++++++++++---- cinderclient/__init__.py | 5 +- cinderclient/_i18n.py | 10 - cinderclient/auth_plugin.py | 141 -------- cinderclient/client.py | 40 ++- cinderclient/contrib/__init__.py | 0 cinderclient/contrib/noauth.py | 77 ++++ cinderclient/shell.py | 116 +++--- cinderclient/utils.py | 12 +- cinderclient/v1/client.py | 2 +- cinderclient/v2/client.py | 2 +- cinderclient/v2/shell.py | 66 +--- cinderclient/v2/volume_backups.py | 3 +- cinderclient/v3/client.py | 2 +- cinderclient/v3/group_snapshots.py | 15 + cinderclient/v3/groups.py | 15 + cinderclient/v3/shell.py | 125 +++++-- cinderclient/v3/volume_snapshots.py | 3 +- ...neric-reset-state-command-d83v1f3accbf5807.yaml | 7 + .../notes/bug-1675973-ad91a7a9f50e658a.yaml | 5 + .../notes/bug-1675974-34edd5g9870e65b2.yaml | 5 + .../notes/bug-1675975-ad91a7a34e0esywc.yaml | 6 + releasenotes/notes/noauth-7d95e5af31a00e96.yaml | 11 + requirements.txt | 9 +- setup.cfg | 6 +- test-requirements.txt | 4 +- tox.ini | 2 +- 40 files changed, 1054 insertions(+), 813 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 35e2989..d453c69 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 @@ -6,2 +6 @@ PrettyTable<0.8,>=0.7.1 # BSD -keystoneauth1>=2.18.0 # Apache-2.0 -requests!=2.12.2,!=2.13.0,>=2.10.0 # Apache-2.0 +keystoneauth1>=2.20.0 # Apache-2.0 @@ -9 +8 @@ simplejson>=2.2.0 # MIT -Babel>=2.3.4 # BSD +Babel!=2.4.0,>=2.3.4 # BSD @@ -11 +10 @@ six>=1.9.0 # MIT -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 8f2783a..c2d1d5b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -14 +14 @@ requests-mock>=1.1 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

ldappool 2.1.0
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: ldappool 2.1.0: A simple connector pool for python-ldap. Download the package from: https://pypi.python.org/pypi/ldappool For more details, please see below.

1 0

[oslo] oslo.middleware 3.27.0 (pike)
by no-reply＠openstack.org 25 May '17

25 May '17

We are pumped to announce the release of: oslo.middleware 3.27.0: Oslo Middleware library This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.middleware Download the package from: https://pypi.python.org/pypi/oslo.middleware Please report issues through launchpad: https://bugs.launchpad.net/oslo.middleware For more details, please see below. 3.27.0 ^^^^^^ New Features * This adds a new "compat_headers" class attribute to the "RequestId" middleware. That allows projects like Nova that have API contracts on alternative request-id headers to adopt the oslo "RequestId" middleware but still retain their API contract. * This adds support for "global_request_id" to the "RequestId" middleware. An inbound header of "X-OpenStack-Request-ID" is accepted as long as it is of the format "req-$uuid", and made available to oslo.context. This will allow for cross project request id tracking. Changes in oslo.middleware 3.26.0..3.27.0 ----------------------------------------- 0e3dbba Set global_request_id if passed in as X-OpenStack-Request-ID. 9b94bae Allow compatibility headers for request_id c45f9a2 Updated from global requirements e4bf01a Updated from global requirements 2eaf1eb Updated from global requirements 93a07b7 Optimize the link address Diffstat (except docs and test files) ------------------------------------- CONTRIBUTING.rst | 4 +- README.rst | 6 +- oslo_middleware/request_id.py | 30 +++++++++- .../notes/compat_headers-55a635b8ec01b6f1.yaml | 7 +++ .../notes/global_request_id-a8ec7260fbd76444.yaml | 8 +++ requirements.txt | 2 +- test-requirements.txt | 4 +- 8 files changed, 118 insertions(+), 10 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 344c088..39cda6a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +9 @@ oslo.context>=2.12.0 # Apache-2.0 -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 6462cd9..7f665ad 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10 +10 @@ oslotest>=1.10.0 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD @@ -12 +12 @@ testtools>=1.4.0 # MIT -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0

1 0

[oslo] oslo.context 2.14.0 (pike)
by no-reply＠openstack.org 25 May '17

25 May '17

We exuberantly announce the release of: oslo.context 2.14.0: Oslo Context library This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/oslo.context Download the package from: https://pypi.python.org/pypi/oslo.context Please report issues through launchpad: http://bugs.launchpad.net/oslo.context For more details, please see below. Changes in oslo.context 2.13.0..2.14.0 -------------------------------------- cce83ad Provide unified calling interface for global_id ec7cdc4 Add global_request_id to context f147f09 Updated from global requirements a6f994b Updated from global requirements 68b0476 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- oslo_context/context.py | 17 ++++++++++++++++- requirements.txt | 2 +- test-requirements.txt | 4 ++-- 5 files changed, 39 insertions(+), 7 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8366c07..42d89c8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 5a52edd..bb821ca 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ oslotest>=1.10.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -12 +12 @@ oslosphinx>=4.7.0 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[cinder] os-brick 1.13.1 (pike)
by no-reply＠openstack.org 25 May '17

25 May '17

We are stoked to announce the release of: os-brick 1.13.1: OpenStack Cinder brick library for managing local volume attaches This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.python.org/pypi/os-brick Please report issues through launchpad: http://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 1.13.0..1.13.1 ---------------------------------- 32b4b24 Stop ignoring E123 and E125 pycodestyle rules 4e17533 Update hacking version to align with Cinder 06e9d9c Fixed the veritas connector path Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/connectors/scaleio.py | 2 +- os_brick/initiator/connectors/vrtshyperscale.py | 2 +- test-requirements.txt | 2 +- tox.ini | 3 +-- 6 files changed, 8 insertions(+), 9 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 5c550ae..eef55e9 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking<0.11,>=0.10.0 +hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0

1 0

[ironic] sushy 0.2.0 (pike)
by no-reply＠openstack.org 24 May '17

24 May '17

We are jazzed to announce the release of: sushy 0.2.0: Sushy is a small Python library to communicate with Redfish based systems This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/sushy Download the package from: https://tarballs.openstack.org/sushy/ Please report issues through launchpad: http://bugs.launchpad.net/sushy For more details, please see below. Changes in sushy 0.1.0..0.2.0 ----------------------------- 0c3ebfb Declarative approach to parsing JSON fields ee0925e Updated from global requirements a279b3d Updated from global requirements 11ec354 Fix working with requests Session object fe07266 Improve logging and error handling in base code 18febd0 Add System Processor/Memory info 3a6e665 Properly support upper-constraints d616dc0 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- requirements.txt | 2 +- sushy/connector.py | 73 +++---- sushy/exceptions.py | 82 +++++++- sushy/resources/base.py | 195 ++++++++++++++++--- sushy/resources/system/constants.py | 12 ++ sushy/resources/system/mappings.py | 11 ++ sushy/resources/system/processor.py | 131 +++++++++++++ sushy/resources/system/system.py | 173 ++++++++++------- .../unit/json_samples/processor_collection.json | 16 ++ test-requirements.txt | 4 +- tools/tox_install.sh | 55 ++++++ tox.ini | 3 +- 21 files changed, 1228 insertions(+), 260 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b358c17..ab2bdb0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 3f920d2..44d6906 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -9 +9 @@ python-subunit>=0.0.18 # Apache-2.0/BSD -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0