March 2018 - Release-announce - lists.openstack.org

[tripleo] tripleo-puppet-elements 7.0.7 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are delighted to announce the release of: tripleo-puppet-elements 7.0.7: Puppet building rules for OpenStack images. This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/tripleo-puppet-elements/ For more details, please see below. Changes in tripleo-puppet-elements 7.0.6..7.0.7 ----------------------------------------------- 1ab2813 Create element to purge resolv.conf Diffstat (except docs and test files) ------------------------------------- elements/remove-resolvconf/README.md | 7 +++++++ elements/remove-resolvconf/cleanup.d/90-remove-resolvconf | 14 ++++++++++++++ 2 files changed, 21 insertions(+)

1 0

[tripleo] tripleo-heat-templates 5.3.11 (newton)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are delighted to announce the release of: tripleo-heat-templates 5.3.11: Heat templates for deploying OpenStack with OpenStack. This release is part of the newton release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-heat-templates Download the package from: https://tarballs.openstack.org/tripleo-heat-templates/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo For more details, please see below. 5.3.11 ^^^^^^ Security Issues *************** * Restrict memcached service to TCP and internal_api network (CVE-2018-1000115). Bug Fixes ********* * As documented in launchpad bug 1708680 the templates for manila with the "generic" back end do not yield a successful manila deployment even if they do not cause the overall overcloud deployment to fail, so we are dropping these faulty and unmaintained manila "generic" back end templates. * Fix Heat condition for RHEL registration yum update There were 2 problems with this condition making the rhel-registration.yaml template broken: "conditions" should be "condition" and the condition should refer to just a condition name defined in the "conditions:" section of the template. See https://bugs.launchpad.net/tripleo/+bug/1709916 Changes in tripleo-heat-templates 5.3.10..5.3.11 ------------------------------------------------ 067941d [CVE-2018-1000115] memcached: restrict to TCP & internal_api network 979143f Add reno for manila generic driver removal f2be057 Fix networking settings for ObjectStorage role pt 2 0b256bc Removes manila-generic-config from TripleO 2735cfc Fix Heat condition for RHEL registration yum update 1fb9f1a Zuul: Remove project name b7fa0d3 Optimize kernel neighbour table for large scale environments Diffstat (except docs and test files) ------------------------------------- capabilities-map.yaml | 8 -- environments/manila-generic-config.yaml | 25 ------ environments/network-isolation-no-tunneling.yaml | 9 ++- environments/network-isolation-v6.yaml | 6 +- environments/network-isolation.yaml | 12 +-- .../rhel-registration/rhel-registration.yaml | 9 ++- overcloud-resource-registry-puppet.j2.yaml | 1 - puppet/objectstorage-role.yaml | 12 +-- puppet/services/kernel.yaml | 29 +++++++ puppet/services/manila-backend-generic.yaml | 93 ---------------------- puppet/services/memcached.yaml | 31 +++++++- ...-generic-driver-templates-b33e8966c263a1fd.yaml | 7 ++ ...at-condition-for-rhel-reg-311a3dce76cc0ec1.yaml | 9 +++ .../memcached_hardening-2529734099da27f4.yaml | 4 + roles_data.yaml | 1 - zuul.d/layout.yaml | 2 - 16 files changed, 107 insertions(+), 151 deletions(-)

1 0

[tripleo] tripleo-heat-templates 7.0.11 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are glad to announce the release of: tripleo-heat-templates 7.0.11: Heat templates for deploying OpenStack with OpenStack. This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-heat-templates Download the package from: https://tarballs.openstack.org/tripleo-heat-templates/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo For more details, please see below. 7.0.11 ^^^^^^ Security Issues * Restrict memcached service to TCP and internal_api network (CVE-2018-1000115). Changes in tripleo-heat-templates 7.0.10..7.0.11 ------------------------------------------------ 187dba2 Fix gnocchi-upgrade Table <..> already exists errors 2b37b72 [CVE-2018-1000115] memcached: restrict to TCP & internal_api network d3cb3c3 Make the minor update for docker idempotent 387a87b Improve the minor update of the docker service 32627f8 Add --live-restore to the docker_options in puppet/services/docker.yaml 0d40487 [pike] Handle update path for swift log directories 65f25ea Allows Configuration of Additional of Lbaas and Neutron 737bbcb Set rgw_keystone_revocation_interval to 0 for ceph-ansible 96aa7fd Remove redundant action key on NetworkDeployment 09d0558 Zuul: Remove project name e7fba84 Update default value for derive params workflow inputs Diffstat (except docs and test files) ------------------------------------- environments/services/neutron-lbaasv2.yaml | 2 +- plan-samples/plan-environment-derived-params.yaml | 4 +- puppet/role.role.j2.yaml | 1 - puppet/services/docker.yaml | 45 +++++++++++++++++++++- puppet/services/memcached.yaml | 29 ++++++++++++++ puppet/services/neutron-api.yaml | 11 +++++- puppet/services/neutron-lbaas.yaml | 5 +++ .../memcached_hardening-2529734099da27f4.yaml | 4 ++ zuul.d/layout.yaml | 2 - 13 files changed, 115 insertions(+), 9 deletions(-)

1 0

[tripleo] tripleo-common 7.6.11 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are satisfied to announce the release of: tripleo-common 7.6.11: A common library for TripleO workflows. This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-common Download the package from: https://tarballs.openstack.org/tripleo-common/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo-common For more details, please see below. Changes in tripleo-common 7.6.10..7.6.11 ---------------------------------------- ce2db3d Increase the image size for security hardened images to 23G 8d38280 Include active nodes when matching nodes by profile 1bf6763 Removed incorrect user input comments ab8e88c Purge resolv.conf from the overcloud images 6bae05d Fix overcloud node delete after an upgrade 51f8515 OvsDpdkSocketMemory MTU Roundup in bytes 43aba5e Retry the check_default_nodes_count workflow for 2 minutes ead9d5d DPDK derive params network config validation 27d36df Derive Params failure message format change 3dce514 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- image-yaml/overcloud-hardened-images.yaml | 3 ++- image-yaml/overcloud-images.yaml | 1 + requirements.txt | 2 +- tripleo_common/actions/derive_params.py | 12 ++++++++++-- tripleo_common/actions/parameters.py | 16 +++++++++++++--- tripleo_common/actions/scale.py | 5 +++++ workbooks/baremetal.yaml | 13 ++++++++++++- workbooks/derive_params.yaml | 9 ++++++++- workbooks/derive_params_formulas.yaml | 2 +- workbooks/validations.yaml | 2 ++ 13 files changed, 77 insertions(+), 19 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7f4cf5b..c017433 100644 --- a/requirements.txt +++ b/requirements.txt @@ -27 +27 @@ netaddr!=0.7.16,>=0.7.13 # BSD -python-zaqarclient>=1.0.0 # Apache-2.0 +python-zaqarclient>=1.0.0 # Apache-2.0

1 0

[tripleo] instack-undercloud 7.4.11 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are excited to announce the release of: instack-undercloud 7.4.11: instack-undercloud This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/instack-undercloud Download the package from: https://tarballs.openstack.org/instack-undercloud/ Please report issues through launchpad: https://bugs.launchpad.net/tripleo For more details, please see below. 7.4.11 ^^^^^^ Security Issues * Restrict memcached service to TCP and localhost network (CVE-2018-1000115). Changes in instack-undercloud 7.4.10..7.4.11 -------------------------------------------- c952542 Remove cloud-init and disable os-collect-config eff22b4 [CVE-2018-1000115] memcached: restrict to TCP & localhost 04540ab Increase size of Heat max_template_size Diffstat (except docs and test files) ------------------------------------- elements/puppet-stack-config/puppet-stack-config.pp | 9 +++++++++ elements/puppet-stack-config/puppet-stack-config.yaml.template | 6 +++++- releasenotes/notes/memcached_hardening-3d6984c9b6e5f3f3.yaml | 4 ++++ 3 files changed, 18 insertions(+), 1 deletion(-)

1 0

[tripleo] tripleo-heat-templates 6.2.12 (ocata)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We exuberantly announce the release of: tripleo-heat-templates 6.2.12: Heat templates for deploying OpenStack with OpenStack. This release is part of the ocata release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-heat-templates Download the package from: https://tarballs.openstack.org/tripleo-heat-templates/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo For more details, please see below. 6.2.12 ^^^^^^ Security Issues * Restrict memcached service to TCP and internal_api network (CVE-2018-1000115). Changes in tripleo-heat-templates 6.2.11..6.2.12 ------------------------------------------------ d373df5 [CVE-2018-1000115] memcached: restrict to TCP & internal_api network c23eb80 Fix networking settings for ObjectStorage role pt 2 20ba83a Optimize kernel neighbour table for large scale environments Diffstat (except docs and test files) ------------------------------------- environments/network-isolation-no-tunneling.yaml | 12 ++++----- environments/network-isolation-v6.yaml | 6 ++--- environments/network-isolation.yaml | 12 ++++----- puppet/objectstorage-role.yaml | 12 ++++----- puppet/services/kernel.yaml | 29 ++++++++++++++++++++++ puppet/services/memcached.yaml | 29 ++++++++++++++++++++++ .../memcached_hardening-2529734099da27f4.yaml | 4 +++ 7 files changed, 83 insertions(+), 21 deletions(-)

1 0

[tripleo] puppet-tripleo 6.5.11 (ocata)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are chuffed to announce the release of: puppet-tripleo 6.5.11: Puppet module for OpenStack TripleO This release is part of the ocata release series. Download the package from: https://tarballs.openstack.org/puppet-tripleo/ For more details, please see below. 6.5.11 ^^^^^^ New Features ************ * Adds composable service interface for Neutron LBaaSv2 service. Security Issues *************** * TLS v1.0 connections are no longer accepted by our HAProxy configuration. Changes in puppet-tripleo 6.5.10..6.5.11 ---------------------------------------- 4cfd3bb Release 6.5.11 (ocata) fef73cc Extract local CA if it expired 30c7009 Disallow TLS v1.0 from HAProxy 3d3201f firewall: don't reload IPtables after cleanup 598c712 Pin puppet-systemd 14bdcfb Fix ipv6 horizon haproxy endpoint 8396e8b Set rgw_keystone_revocation_interval to 0 for ceph::rgw::keystone 7f54e79 Composable Role for Neutron LBaaS 5ca2ec8 Use rabbitmq ipv6 flag Diffstat (except docs and test files) ------------------------------------- Puppetfile_extras | 3 +- manifests/certmonger/ca/local.pp | 2 +- manifests/firewall.pp | 35 ++++++----------- manifests/haproxy.pp | 9 +++-- manifests/profile/base/ceph/rgw.pp | 22 ++++++----- manifests/profile/base/neutron/lbaas.pp | 44 ++++++++++++++++++++++ manifests/profile/base/rabbitmq.pp | 15 ++------ manifests/profile/pacemaker/neutron/lbaas.pp | 44 ++++++++++++++++++++++ metadata.json | 2 +- ...le_role_for_neutron_lbaas-acdf08f1a9dfd3fe.yaml | 3 ++ .../notes/No-TLS-v1.0-0edeac680bb51f94.yaml | 4 ++ spec/classes/tripleo_profile_base_ceph_rgw_spec.rb | 16 ++++---- 12 files changed, 142 insertions(+), 57 deletions(-)

1 0

[monasca] monasca-agent 2.2.3 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are jazzed to announce the release of: monasca-agent 2.2.3: Monitoring agent for gathering metrics and sending them to the Monasca API. This release is part of the pike release series. Download the package from: https://tarballs.openstack.org/monasca-agent/ For more details, please see below. Changes in monasca-agent 2.2.2..2.2.3 ------------------------------------- 11cf014 Fix libvirt plugin to handle FQDN of compute node a9a9574 Update supervisor version lower bound Diffstat (except docs and test files) ------------------------------------- monasca_agent/collector/checks_d/libvirt.py | 27 ++++++++++++++++++++++++++- requirements.txt | 2 +- 2 files changed, 27 insertions(+), 2 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index f26ad21..fa494e8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -22 +22 @@ six>=1.9.0 # MIT -supervisor>=3.1.3,<3.4 +supervisor>=3.3.3,<3.4 # BSD-derived

1 0

[tripleo] tripleo-validations 7.4.8 (pike)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are tickled pink to announce the release of: tripleo-validations 7.4.8: A collection of Ansible playbooks to detect and report potential issues during TripleO deployments This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/tripleo-validations Download the package from: https://tarballs.openstack.org/tripleo-validations/ Please report issues through launchpad: https://bugs.launchpad.net/tripleo/+bugs?field.tag=validations For more details, please see below. Changes in tripleo-validations 7.4.7..7.4.8 ------------------------------------------- 4c7e5b1 Unit testing for ini Diffstat (except docs and test files) ------------------------------------- validations/library/ini.py | 97 ++++++++++++++++++-------- 2 files changed, 197 insertions(+), 27 deletions(-)

1 0

[tripleo] instack-undercloud 6.1.6 (ocata)
by no-reply＠openstack.org 26 Mar '18

26 Mar '18

We are gleeful to announce the release of: instack-undercloud 6.1.6: instack-undercloud This release is part of the ocata release series. The source is available from: http://git.openstack.org/cgit/openstack/instack-undercloud Download the package from: https://tarballs.openstack.org/instack-undercloud/ Please report issues through launchpad: http://bugs.launchpad.net/tripleo For more details, please see below. 6.1.6 ^^^^^ Security Issues * Restrict memcached service to TCP and localhost network (CVE-2018-1000115). Changes in instack-undercloud 6.1.5..6.1.6 ------------------------------------------ 5a8cf39 [CVE-2018-1000115] memcached: restrict to TCP & localhost 256fecb Fix bootstrap NAT cb1091a Zuul: Remove project name Diffstat (except docs and test files) ------------------------------------- elements/puppet-stack-config/puppet-stack-config.pp | 11 +++++++++++ .../puppet-stack-config/puppet-stack-config.yaml.template | 13 ++++++++++++- .../os-refresh-config/post-configure.d/98-undercloud-setup | 5 ----- .../notes/memcached_hardening-3d6984c9b6e5f3f3.yaml | 4 ++++ zuul.d/layout.yaml | 2 -- 5 files changed, 27 insertions(+), 8 deletions(-)

1 0