May 2017 - Release-announce - lists.openstack.org

[oslo] debtcollector 1.14.0 (pike)
by no-reply＠openstack.org 30 May '17

30 May '17

We are stoked to announce the release of: debtcollector 1.14.0: A collection of Python deprecation patterns and strategies that help you collect your technical debt in a non- destructive manner. This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/debtcollector Download the package from: https://pypi.python.org/pypi/debtcollector Please report issues through launchpad: http://bugs.launchpad.net/debtcollector For more details, please see below. Changes in debtcollector 1.13.0..1.14.0 --------------------------------------- da416d6 Do not require oslotest for testing fba977e Updated from global requirements 6b273fb Updated from global requirements Diffstat (except docs and test files) ------------------------------------- requirements.txt | 2 +- test-requirements.txt | 5 ++--- 3 files changed, 5 insertions(+), 6 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index a22e829..0070b8d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 71fb72a..8ea24fc 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ hacking<0.11,>=0.10.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -9 +9 @@ python-subunit>=0.0.18 # Apache-2.0/BSD -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD @@ -11 +10,0 @@ oslosphinx>=4.7.0 # Apache-2.0 -oslotest>=1.10.0 # Apache-2.0

1 0

[oslo] oslosphinx 4.13.0 (pike)
by no-reply＠openstack.org 30 May '17

30 May '17

We are chuffed to announce the release of: oslosphinx 4.13.0: OpenStack Sphinx Extensions and Theme This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/oslosphinx Download the package from: https://pypi.python.org/pypi/oslosphinx Please report issues through launchpad: http://bugs.launchpad.net/oslosphinx For more details, please see below. Changes in oslosphinx 4.12.0..4.13.0 ------------------------------------ ef759e9 Fix doc build from tarball using eventlet>0.19.0 82420fe Updated from global requirements Diffstat (except docs and test files) ------------------------------------- oslosphinx/__init__.py | 2 +- test-requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 212ef58..2716d92 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[oslo] oslo.db 4.22.0 (pike)
by no-reply＠openstack.org 30 May '17

30 May '17

We are overjoyed to announce the release of: oslo.db 4.22.0: Oslo Database library This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/oslo.db Download the package from: https://pypi.python.org/pypi/oslo.db Please report issues through launchpad: http://bugs.launchpad.net/oslo.db For more details, please see below. 4.22.0 ^^^^^^ Upgrade Notes * oslo.db now logs a warning when the connection URL does not explicitly mention a driver. The default driver is still used, but in some cases, such as MySQL, the default is incompatible with the concurrency library eventlet. * It is strongly recommended to use the PyMySQL driver when connecting to a MySQL-compatible database to ensure the best compatibility with the concurrency library eventlet. To use PyMySQL, ensure the connection URL is specified with "mysql+pymysql://" as the scheme. Changes in oslo.db 4.21.1..4.22.0 --------------------------------- 9523255 Updated from global requirements 1821897 add release note for new warning about missing driver 2166490 Warn on URL without a drivername c23e571 Updated from global requirements 2c53ccd Move oslo.context to test-requirements Diffstat (except docs and test files) ------------------------------------- oslo_db/sqlalchemy/engines.py | 20 ++++++++++ .../warn-incomplete-url-c44cd03baf630c7c.yaml | 14 +++++++ requirements.txt | 5 +-- setup.cfg | 1 + 5 files changed, 83 insertions(+), 3 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d868a68..f60d6aa 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ debtcollector>=1.2.0 # Apache-2.0 -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 @@ -10 +9,0 @@ oslo.config>=3.22.0 # Apache-2.0 -oslo.context>=2.12.0 # Apache-2.0 @@ -13 +12 @@ SQLAlchemy!=1.1.5,!=1.1.6,!=1.1.7,!=1.1.8,>=1.0.10 # MIT -sqlalchemy-migrate>=0.9.6 # Apache-2.0 +sqlalchemy-migrate>=0.11.0 # Apache-2.0

1 0

[packaging-rpm] renderspec 1.6.1
by no-reply＠openstack.org 30 May '17

30 May '17

We enthusiastically announce the release of: renderspec 1.6.1: Jinja2 template renderer for generating .spec files Download the package from: https://tarballs.openstack.org/renderspec/ For more details, please see below. Changes in renderspec 1.6.0..1.6.1 ---------------------------------- a97ffcf Sort found archives by mtime for version detection fbef878 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- renderspec/utils.py | 8 +++++--- test-requirements.txt | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 491d0a9..702d9ee 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -11 +11 @@ mock>=2.0 # BSD -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[ironic] ironic-python-agent 2.1.0 (pike)
by no-reply＠openstack.org 30 May '17

30 May '17

We are thrilled to announce the release of: ironic-python-agent 2.1.0: Ironic Python Agent Ramdisk This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/ironic-python-agent/ For more details, please see below. 2.1.0 ^^^^^ New Features ************ * Adds an extra field "biosdevname" (BIOS given NICs name) to network interface inventory collected by "default" collector of ironic- python-agent. Biosdevname utility is used for collecting bios given NICs name. * Adds new optional NUMA topology collector named "numa_topology". It collects NUMA specific RAM, CPU and NIC information. Known Issues ************ * Collecting the 'biosdevname' field on network interfaces is impossible on any Debian-based images due to the missing 'biosdevname' utility. This includes the CoreOS image, as the CoreOS image utilizes a Debian-based chroot. Bug Fixes ********* * Correct message output when failed to download image. * JSON serialization of logs collected for ironic-python-agent. In python3 logs were encoded as byte strings, which can't be serialized. Make sure that logs are encoded as text for both py2.7 and py3. See https://bugs.launchpad.net/ironic-python- agent/+bug/1668533 for details. Changes in ironic-python-agent 2.0.0..2.1.0 ------------------------------------------- 35ea727 Add a new location of isolinux.bin for Ubuntu 16.04 40ddf86 Fix compatibility with Pint 0.5 efe739f Replace assertRaisesRegexp with assertRaisesRegex fdcb092 Collect NIC name given by BIOS 50f914d Add missing description for params of 'start_iscsi_target'. 116ddde Updated from global requirements cc9e05d NUMA-topology collector fbefa53 Updated from global requirements f57cbcc Prevent tests' unmocked access to utils.execute() 85869a1 Remove unused function _configdrive_location 32ed014 Set valid inspection_dhcp_wait_timeout value in tests 92c33a0 Updated from global requirements 393d686 Add a debug tox environment 819eaf8 Updated from global requirements 1695cb1 Add missing 'autospec' argument to mock.patch e934407 flake8: Specify 'ironic_python_agent' as name of app 000eaa3 Fix logs encoding in py3 b9afdba Updated from global requirements 9c2d0cd Correct failure message output when downloading a07c855 Python 3.4 (py34) is removed from tox envlist 4f938e8 imagebuild: coreos: Build sha256 checksum files 8e1226e Updated from global requirements ec7990b Updated from global requirements 3c27726 imagebuild: tinyipa: Build sha256 checksum files 975f4c7 Use specific end version since liberty is EOL 949f4f5 Use flake8-import-order a2a0db7 Clean up release notes post-ocata release 43b23ac Updated from global requirements Diffstat (except docs and test files) ------------------------------------- imagebuild/coreos/full_trusty_build.sh | 12 + imagebuild/coreos/iso-image-create | 7 +- imagebuild/tinyipa/Makefile | 1 + imagebuild/tinyipa/README.rst | 10 + imagebuild/tinyipa/build-tinyipa.sh | 14 +- imagebuild/tinyipa/build_files/buildreqs.lst | 2 + imagebuild/tinyipa/build_files/finalreqs.lst | 1 + imagebuild/tinyipa/finalise-tinyipa.sh | 15 + ironic_python_agent/agent.py | 2 +- ironic_python_agent/errors.py | 7 + ironic_python_agent/extensions/iscsi.py | 3 + ironic_python_agent/extensions/standby.py | 26 +- ironic_python_agent/hardware.py | 38 ++- ironic_python_agent/hardware_managers/mlnx.py | 3 +- ironic_python_agent/numa_inspector.py | 255 +++++++++++++++ ironic_python_agent/utils.py | 2 +- ...ct_NIC_name_given_by_BIOS-657c68c0ae16365b.yaml | 11 + .../add-numa-topology-info-8c253fd9e56169f1.yaml | 4 + ...ut-when-downloading-image-39f93838d1ed2928.yaml | 3 + ...rializable-collected-logs-ad61022b287dc3e2.yaml | 6 + releasenotes/source/current-series.rst | 5 - releasenotes/source/index.rst | 9 +- releasenotes/source/liberty.rst | 6 +- releasenotes/source/mitaka.rst | 6 +- releasenotes/source/newton.rst | 6 +- releasenotes/source/ocata.rst | 6 + releasenotes/source/unreleased.rst | 5 + requirements.txt | 16 +- setup.cfg | 1 + setup.py | 2 +- test-requirements.txt | 6 +- tox.ini | 8 +- 53 files changed, 1343 insertions(+), 385 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 9972014..9e1106f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,2 +4,2 @@ -pbr>=1.8 # Apache-2.0 -eventlet!=0.18.3,>=0.18.2 # MIT +pbr!=2.1.0,>=2.0.0 # Apache-2.0 +eventlet!=0.18.3,<0.21.0,>=0.18.2 # MIT @@ -9 +9 @@ netifaces>=0.10.4 # MIT -oslo.config!=3.18.0,>=3.14.0 # Apache-2.0 +oslo.config>=3.22.0 # Apache-2.0 @@ -11 +11 @@ oslo.concurrency>=3.8.0 # Apache-2.0 -oslo.log>=3.11.0 # Apache-2.0 +oslo.log>=3.22.0 # Apache-2.0 @@ -14 +14 @@ oslo.service>=1.10.0 # Apache-2.0 -oslo.utils>=3.18.0 # Apache-2.0 +oslo.utils>=3.20.0 # Apache-2.0 @@ -17 +17 @@ Pint>=0.5 # BSD -psutil>=3.0.1 # BSD +psutil>=3.2.2 # BSD @@ -19 +19 @@ pyudev # LGPLv2.1+ -requests!=2.12.2,>=2.10.0 # Apache-2.0 +requests!=2.12.2,!=2.13.0,>=2.10.0 # Apache-2.0 @@ -22 +22 @@ six>=1.9.0 # MIT -stevedore>=1.17.1 # Apache-2.0 +stevedore>=1.20.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index d204b3a..2afc89d 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ hacking<0.13,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -11,0 +12,2 @@ bashate>=0.2 # Apache-2.0 +flake8-import-order==0.11 # LGPLv3 + @@ -14 +16 @@ doc8 # Apache-2.0 -sphinx!=1.3b1,<1.4,>=1.2.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[neutron] python-neutronclient 6.3.0 (pike)
by no-reply＠openstack.org 30 May '17

30 May '17

We are thrilled to announce the release of: python-neutronclient 6.3.0: CLI and Client Library for OpenStack Networking This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/python-neutronclient Download the package from: https://pypi.python.org/pypi/python-neutronclient Please report issues through launchpad: https://bugs.launchpad.net/python-neutronclient For more details, please see below. 6.3.0 ^^^^^ New Features * Adds a new "global_request_id" parameter to the Client constructors, which will pass that id on all requests as the "X -OpenStack-Request- ID" header. * Tag operation for subnet, port, subnetpool and router resources are now supported. Changes in python-neutronclient 6.2.0..6.3.0 -------------------------------------------- af869a4 Allow global_request_id in Client constructor d632743 Updated from global requirements 030b8ad Updated from global requirements e406692 Machine-readable output for JSON/YAML format 632671e FWaaS UT: Fake rule should return value returned from API c66f972 Drop deprecated neutronclient.i18n wrapper 5a7e65d Updated from global requirements 235c4e6 Now empty tags are not added to Networks 2e60acd Be explicit about the identity plugin required in unit tests fbef092 Supports adding tags for port, router, subnet, subnetpool 4295dfb Add optional_keys and required_keys to --subport argument ef69c72 Updated from global requirements 4d4e4de Fix using wrong status code in some tests db37751 Updated from global requirements a905f75 Do not append .json to sending URL 6df0b27 Handle log message interpolation by the logger f801289 Revert "HAProxy uses milliseconds for its timeout values." c91f9f2 Don't decode empty response body Diffstat (except docs and test files) ------------------------------------- neutronclient/client.py | 18 ++- neutronclient/i18n.py | 23 ---- neutronclient/neutron/v2_0/__init__.py | 2 +- neutronclient/neutron/v2_0/lb/healthmonitor.py | 7 +- neutronclient/neutron/v2_0/lb/v2/loadbalancer.py | 1 - neutronclient/neutron/v2_0/rbac.py | 1 - neutronclient/neutron/v2_0/tag.py | 5 +- neutronclient/osc/v2/fwaas/firewallgroup.py | 6 +- neutronclient/osc/v2/fwaas/firewallpolicy.py | 4 +- neutronclient/osc/v2/fwaas/firewallrule.py | 13 ++- neutronclient/osc/v2/networking_bgpvpn/bgpvpn.py | 13 ++- neutronclient/osc/v2/trunk/network_trunk.py | 13 ++- neutronclient/osc/v2/utils.py | 7 +- .../unit/osc/v2/networking_bgpvpn/test_bgpvpn.py | 31 ++--- neutronclient/v2_0/client.py | 4 +- .../notes/global_request_id-56856a93b982a6b3.yaml | 6 + ...et-port-subnetpool-router-6250ec4714ee8690.yaml | 4 + requirements.txt | 12 +- test-requirements.txt | 6 +- tox.ini | 2 + 34 files changed, 327 insertions(+), 157 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index db647de..1e6bdaf 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4,2 +4,2 @@ -pbr>=2.0.0 # Apache-2.0 -cliff>=2.3.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 +cliff>=2.6.0 # Apache-2.0 @@ -9 +9 @@ netaddr!=0.7.16,>=0.7.13 # BSD -osc-lib>=1.2.0 # Apache-2.0 +osc-lib>=1.5.1 # Apache-2.0 @@ -13,2 +13,2 @@ oslo.utils>=3.20.0 # Apache-2.0 -os-client-config>=1.22.0 # Apache-2.0 -keystoneauth1>=2.18.0 # Apache-2.0 +os-client-config>=1.27.0 # Apache-2.0 +keystoneauth1>=2.20.0 # Apache-2.0 @@ -21 +21 @@ six>=1.9.0 # MIT -Babel>=2.3.4 # BSD +Babel!=2.4.0,>=2.3.4 # BSD diff --git a/test-requirements.txt b/test-requirements.txt index b4efe10..f8a0c38 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -13 +13 @@ osprofiler>=1.4.0 # Apache-2.0 -python-openstackclient>=3.3.0 # Apache-2.0 +python-openstackclient!=3.10.0,>=3.3.0 # Apache-2.0 @@ -17 +17 @@ requests-mock>=1.1 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[horizon] horizon 11.0.2 (ocata)
by no-reply＠openstack.org 30 May '17

30 May '17

We enthusiastically announce the release of: horizon 11.0.2: OpenStack Dashboard This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/horizon/ For more details, please see below. Changes in horizon 11.0.1..11.0.2 --------------------------------- a7ec524 Use BooleanField for admin_state_up form 4bcbd2c Update documentation for Theme Preview panel 9a9dc36 Updated from global requirements aab378b Image list function should normalize owner filter 2684552 Remove the invalid example of floating IPs tab from doc 2bf9872 Enable breadcrumbs for AngularIndexView 03aec78 operation_log: Honor settings parameters 7d6d606 Update the access_and_security url 1f2e5a8 Clarify message if key file has wrong permissions cfdaa2e Imported Translations from Zanata 3fac233 Fix issues with updating project/domain members 600d3a9 Softreboot can be done when the instance not in active status 0d0a872 Remove link for user id field on project action log 7603ae6 Use correct policy name for "Edit Network" form setup d6d6032 Remove non-existent "test" target from Make help bc8fa9b Instance snapshots shown in 'boot from image' list 09417eb Define profiler constant to fix /jasmine test run 8ce86d4 Do not try to show L3 agent action when enable_router is False 2366fd7 Populate device_id/owner fields in Admin Edit Port form 45fe2b4 Imported Translations from Zanata b7c8fc2 Imported Translations from Zanata 7fd7439 Updated from global requirements 4d0b785 Correct error in policy action name Diffstat (except docs and test files) ------------------------------------- Makefile | 1 - horizon/browsers/views.py | 16 ++ horizon/locale/pt_BR/LC_MESSAGES/django.po | 17 ++- horizon/locale/pt_BR/LC_MESSAGES/djangojs.po | 14 +- horizon/middleware/operation_log.py | 4 +- horizon/static/horizon/js/horizon.membership.js | 21 ++- horizon/utils/secret_key.py | 4 +- openstack_dashboard/api/glance.py | 24 ++- .../developer/profiler/profiler.module.js | 12 +- .../dashboards/admin/info/tables.py | 4 + .../dashboards/admin/instances/tables.py | 16 ++ .../dashboards/admin/instances/tabs.py | 30 ++++ .../dashboards/admin/instances/views.py | 2 + .../dashboards/admin/networks/forms.py | 16 +- .../dashboards/admin/networks/ports/forms.py | 3 +- .../dashboards/admin/networks/ports/views.py | 2 + .../dashboards/project/firewalls/forms.py | 6 +- .../dashboards/project/firewalls/workflows.py | 11 +- .../dashboards/project/instances/audit_tables.py | 9 +- .../dashboards/project/instances/tables.py | 6 + .../project/instances/workflows/create_instance.py | 18 ++- .../key_pairs/templates/key_pairs/create.html | 2 +- .../key_pairs/templates/key_pairs/import.html | 2 +- .../dashboards/project/networks/forms.py | 11 +- .../dashboards/project/networks/ports/forms.py | 7 +- .../dashboards/project/networks/workflows.py | 12 +- .../dashboards/project/routers/forms.py | 14 +- .../templates/security_groups/create.html | 2 +- .../dashboards/project/security_groups/views.py | 2 +- .../dashboards/project/stacks/mappings.py | 4 +- .../dashboards/project/stacks/tabs.py | 2 +- .../dashboards/project/vpn/forms.py | 14 +- .../vpn/templates/vpn/_add_vpn_service_help.html | 4 +- .../dashboards/project/vpn/workflows.py | 22 +-- .../locale/ja/LC_MESSAGES/django.po | 12 +- .../locale/pt_BR/LC_MESSAGES/django.po | 164 ++++++++++++++++++++- .../locale/pt_BR/LC_MESSAGES/djangojs.po | 139 ++++++++++++++++- openstack_dashboard/templates/angular.html | 2 - 42 files changed, 547 insertions(+), 155 deletions(-)

1 0

openstack-ansible-security 15.1.3 (ocata)
by no-reply＠openstack.org 26 May '17

26 May '17

We eagerly announce the release of: openstack-ansible-security 15.1.3: OpenStack-Ansible: Host security hardening This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 15.1.1..15.1.3 ---------------------------------------------------- c58c839 Fix path to daemon init params file Diffstat (except docs and test files) ------------------------------------- tasks/rhel6stig/file_perms.yml | 4 ++-- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 15.1.2 (ocata)
by no-reply＠openstack.org 26 May '17

26 May '17

We are glad to announce the release of: openstack-ansible-security 15.1.2: OpenStack-Ansible: Host security hardening This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 15.1.1..15.1.2 ---------------------------------------------------- c58c839 Fix path to daemon init params file Diffstat (except docs and test files) ------------------------------------- tasks/rhel6stig/file_perms.yml | 4 ++-- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 3 files changed, 4 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 14.0.6 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 14.0.6: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.5..14.0.6 ---------------------------------------------------- bf463a0 Add libxslt headers to bindep 2d07959 Fix issues from new CentOS 7 release Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 ++ tasks/auditd.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-)

1 0

openstack-ansible-security 15.1.1 (ocata)
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 15.1.1: OpenStack-Ansible: Host security hardening This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 15.1.0..15.1.1 ---------------------------------------------------- 77aec08 Change PASS_WARN_DAYS --> PASS_WARN_AGE Diffstat (except docs and test files) ------------------------------------- tasks/rhel6stig/auth.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 14.1.1 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are ecstatic to announce the release of: openstack-ansible-security 14.1.1: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.0..14.1.1 ---------------------------------------------------- 83e3c20 Fix issues from new CentOS 7 release 86cc144 Unblock security role gate 4702320 Enable ntp client functionality with chronyd Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 11 +++++++++++ tasks/file_perms.yml | 4 ++++ templates/chrony.conf.j2 | 5 +++-- templates/osas-auditd.j2 | 6 ++++++ 5 files changed, 25 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 15.1.0 (ocata)
by no-reply＠openstack.org 26 May '17

26 May '17

We are stoked to announce the release of: openstack-ansible-security 15.1.0: OpenStack-Ansible: Host security hardening This release is part of the ocata stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 15.1.0 ^^^^^^ Security Issues * The security role will no longer fix file permissions and ownership based on the contents of the RPM database by default. Deployers can opt in for these changes by setting "security_reset_perm_ownership" to "yes". * The tasks that search for ".shosts" and "shosts.equiv" files (STIG ID: RHEL-07-040330) are now skipped by default. The search takes a long time to complete on systems with lots of files and it also causes a significant amount of disk I/O while it runs. Changes in openstack-ansible-security 15.0.0..15.1.0 ---------------------------------------------------- 032d98f Rename vars/common.yml to vars/main.yml e7dc4ee Enable ntp client functionality with chronyd 160cb80 Make .shosts search/removal opt in 3bc5432 Disable file perm/ownership reset Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +- ...-rpm-perms-fix-by-default-b164e39717f0ada7.yaml | 6 + ...shosts-file-search-opt-in-887f600a79eef07e.yaml | 7 + tasks/main.yml | 5 - templates/chrony.conf.j2 | 5 +- vars/common.yml | 337 --------------------- vars/main.yml | 331 +++++++++++++++++++- 10 files changed, 354 insertions(+), 364 deletions(-)

1 0

openstack-ansible-security 13.3.7
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 13.3.7: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.7 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 14.0.8 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are chuffed to announce the release of: openstack-ansible-security 14.0.8: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.5..14.0.8 ---------------------------------------------------- bf463a0 Add libxslt headers to bindep 2d07959 Fix issues from new CentOS 7 release Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 ++ tasks/auditd.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-)

1 0

openstack-ansible-security 13.3.16
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.3.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.16 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 13.3.18
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 13.3.18: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.18 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 14.0.3 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 14.0.3: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.1..14.0.3 ---------------------------------------------------- 5e8714c Replace github with git.o.o Diffstat (except docs and test files) ------------------------------------- README.md | 2 +- bindep.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

openstack-ansible-security 14.0.4 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We joyfully announce the release of: openstack-ansible-security 14.0.4: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.3..14.0.4 ---------------------------------------------------- 4251bc5 Backport of package optimization Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +- .../chrony-config-variable-7a1a7862c05c9675.yaml | 5 + tasks/aide.yml | 23 ---- tasks/apt.yml | 32 +++++ tasks/auditd.yml | 32 ----- tasks/auth.yml | 75 ----------- tasks/lsm.yml | 31 ----- tasks/mail.yml | 20 --- tasks/misc.yml | 48 +------ tasks/rpm.yml | 41 ++++-- tasks/services.yml | 145 --------------------- tox.ini | 2 +- vars/redhat.yml | 55 ++++++++ vars/ubuntu.yml | 56 ++++++++ 15 files changed, 196 insertions(+), 380 deletions(-)

1 0

openstack-ansible-security 14.0.7 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 14.0.7: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.5..14.0.7 ---------------------------------------------------- bf463a0 Add libxslt headers to bindep 2d07959 Fix issues from new CentOS 7 release Diffstat (except docs and test files) ------------------------------------- bindep.txt | 2 ++ tasks/auditd.yml | 2 +- 3 files changed, 9 insertions(+), 3 deletions(-)

1 0

openstack-ansible-security 13.3.9
by no-reply＠openstack.org 26 May '17

26 May '17

We are ecstatic to announce the release of: openstack-ansible-security 13.3.9: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.9 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 14.0.1 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We jubilantly announce the release of: openstack-ansible-security 14.0.1: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.0..14.0.1 ---------------------------------------------------- af2226f Use centralised Ansible test scripts Diffstat (except docs and test files) ------------------------------------- tasks/apt.yml | 1 + tox.ini | 67 ++++++++++------------------------------------------ 4 files changed, 29 insertions(+), 78 deletions(-)

1 0

openstack-ansible-security 13.3.4
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 13.3.4: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.3.4 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 13.3.3..13.3.4 ---------------------------------------------------- ca9b7de Disable DAC change auditing 775f641 Disable martian logging by default a329034 Exclude /run from AIDE checks c16d117 Ensure AIDE initializes on subsequent runs e0d0e36 Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 13.1.3
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 13.1.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.3 ^^^^^^ Bug Fixes * The security role previously set the permissions on all audit log files in "/var/log/audit" to "0400", but this prevents the audit daemon from writing to the active log file. This will prevent "auditd" from starting or restarting cleanly. The task now removes any permissions that are not allowed by the STIG. Any log files that meet or exceed the STIG requirements will not be modified.

1 0

openstack-ansible-security 13.3.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 13.3.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.6 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0