May 2018 - Release-announce - lists.openstack.org

magnum 6.1.1 (queens)
by no-reply＠openstack.org 15 May '18

15 May '18

We are glad to announce the release of: magnum 6.1.1: Container Management project for OpenStack This release is part of the queens stable release series. The source is available from: ** http://git.openstack.org/cgit/openstack/magnum Download the package from: https://tarballs.openstack.org/magnum/ Please report issues through launchpad: ** http://bugs.launchpad.net/magnum For more details, please see below. 6.1.1 ^^^^^ New Features ************ * k8s_fedora_atomic clusters are deployed with RBAC support. Along with RBAC Node authorization is added so the appropriate certificates are generated. Known Issues ************ * Currently, the replicas of coreDNS pod is hardcoded as 1. It's not a reasonable number for such a critical service. Without DNS, probably all workloads running on the k8s cluster will be broken. Now Magnum is making the coreDNS pod autoscaling based on the nodes and cores number. Upgrade Notes ************* * Using the queens (>=2.9.0) python-magnumclient, when a user executes openstack coe cluster config, the client certificate has admin as Common Name (CN) and system:masters for Organization which are required for authorization with RBAC enabled clusters. This change in the client is backwards compatible, so old clusters (without RBAC enabled) can be reached with certificates generated by the new client. However, old magnum clients will generate certificates that will not be able to contact RBAC enabled clusters. This issue affects only k8s_fedora_atomic clusters and clients <=2.8.0, note that 2.8.0 is still a queens release but only 2.9.0 includes the relevant patch. Finally, users can always generate and sign the certificates using this [0] procedure even with old clients since only the cluster config command is affected. [0] https://docs.openstack.org/magnum/latest/user/index.html #interfacing-with-a-secure-cluster Security Issues *************** * k8s_fedora Remove cluster role from the kubernetes-dashboard account. When accessing the dashboard and skip authentication, users login with the kunernetes-dashboard service account, if that service account has the cluster role, users have admin access without authentication. Create an admin service account for this use case and others. Bug Fixes ********* * Fix etcd configuration in k8s_fedora_atomic driver. Explicitly enable client and peer authentication and set trusted CA (ETCD_TRUSTED_CA_FILE, ETCD_PEER_TRUSTED_CA_FILE, ETCD_CLIENT_CERT_AUTH, ETCD_PEER_CLIENT_CERT_AUTH). Only new clusters will benefit from the fix. * Fix bug #1758672 [1] to protect kubelet in the k8s_fedora_atomic driver. Before this patch kubelet was listening to 0.0.0.0 and for clusters with floating IPs the kubelet was exposed. Also, even on clusters without fips the kubelet was exposed inside the cluster. This patch allows access to the kubelet only over https and with the appropriate roles. The apiserver and heapster have the appropriate roles to access it. Finally, all read-only ports have been closed to not expose any cluster data. The only remaining open ports without authentication are for healthz. [1] https://bugs.launchpad.net/magnum/+bug/1758672 Changes in magnum 6.1.0..6.1.1 ------------------------------ b8f6261 k8s_fedora: Add admin user 2fc72e9 Make DNS pod autoscale 1e2774f Add calico-node on k8s master node 363095b Stop using slave_scripts/install-distro-packages.sh 1382e6f k8s_fedora: Add flannel to master nodes fca7f0c Add missing RBAC config for Prometheus beb124e k8s_fedora: Explicitly set etcd authentication dba9203 k8s_fedora: Add kubelet authentication/authorization f735c8a Add service account to daemonset in traefik 23bc667 Add reno for RBAC and client incompatibility 058d982 Check CERT_MANAGER_API if True or False 0b31332 Change swarm ClusterTemplate coe to swarm-mode Diffstat (except docs and test files) ------------------------------------- .../kubernetes/fragments/calico-service.sh | 12 ++- .../kubernetes/fragments/configure-etcd.sh | 4 + .../fragments/configure-kubernetes-master.sh | 77 ++++++++++++++++- .../fragments/configure-kubernetes-minion.sh | 19 ++++- .../kubernetes/fragments/core-dns-service.sh | 96 +++++++++++++++++++++- .../kubernetes/fragments/enable-ingress-traefik | 1 + .../fragments/enable-prometheus-monitoring | 67 ++++++++++++--- .../kubernetes/fragments/enable-services-master.sh | 6 ++ .../fragments/kube-apiserver-to-kubelet-role.sh | 28 +++++++ .../kubernetes/fragments/kube-dashboard-service.sh | 53 ++++++++---- .../kubernetes/fragments/make-cert-client.sh | 8 +- .../templates/kubernetes/fragments/make-cert.sh | 94 +++++++++++++-------- .../kubernetes/fragments/network-config-service.sh | 4 + .../fragments/write-heat-params-master.yaml | 1 + .../templates/kubecluster.yaml | 4 + .../k8s_fedora_atomic_v1/templates/kubemaster.yaml | 5 ++ playbooks/pre/prepare-workspace-images.yaml | 8 +- ...nd-client-incompatibility-fdfeab326dfda3bf.yaml | 20 +++++ ...284-k8s-fedora-admin-user-e760f9b0edf49391.yaml | 8 ++ ...ure-etcd-auth-bug-1759813-baac5e0fe8a2e97f.yaml | 7 ++ .../notes/dns-autoscale-90b63e3d71d7794e.yaml | 8 ++ ...8s_fedora_protect_kubelet-8468ddcb92c2a624.yaml | 12 +++ 24 files changed, 485 insertions(+), 80 deletions(-)

1 0

python-vitrageclient 2.1.0 (queens)
by no-reply＠openstack.org 15 May '18

15 May '18

We contentedly announce the release of: python-vitrageclient 2.1.0: Vitrage Client API Library This release is part of the queens stable release series. Download the package from: https://pypi.org/project/python-vitrageclient For more details, please see below. Changes in python-vitrageclient 2.0.0..2.1.0 -------------------------------------------- d6bd2be Updated from global requirements 5149db3 Update UPPER_CONSTRAINTS_FILE for stable/queens 114dbdb Update .gitreview for stable/queens Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + test-requirements.txt | 2 +- tox.ini | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index b21ca83..e1445bf 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10 +10 @@ sphinx!=1.6.6,>=1.6.2 # BSD -openstackdocstheme>=1.17.0 # Apache-2.0 +openstackdocstheme>=1.18.1 # Apache-2.0

1 0

vitrage 2.3.0 (queens)
by no-reply＠openstack.org 15 May '18

15 May '18

We are satisfied to announce the release of: vitrage 2.3.0: The OpenStack RCA Service This release is part of the queens stable release series. The source is available from: https://git.openstack.org/cgit/openstack/vitrage Download the package from: https://tarballs.openstack.org/vitrage/ For more details, please see below. Changes in vitrage 2.2.0..2.3.0 ------------------------------- 8c6c6e3 stop api_handler at exit e00fc07 change default number of workers to 1 65f9614 call to nova client deprecated hosts list was replaced with services list 981d218 bugfix: update a placeholder vertex can add properties to a real vertex d485c61 handle severe memory problem with get_topology c0d203a do evaluation during init ebebc14 Bug fix: filter topology by project_id also when there is a query c3d733c add project id to header in keycloak e340c80 catch uncaught exceptions e17cccc use vitrage-tempest-plugin version 1.0.0 6700dbe bugfix for log warnings 4055dfa Updated from global requirements ea1515f make sure to use queens in vitrage client Diffstat (except docs and test files) ------------------------------------- devstack/post_test_hook.sh | 10 ++++-- devstack/settings | 2 ++ requirements.txt | 2 +- vitrage/api/controllers/v1/topology.py | 2 +- vitrage/api_handler/apis/base.py | 28 ++++++++++++++--- vitrage/api_handler/apis/rca.py | 5 +-- vitrage/api_handler/apis/topology.py | 17 ++++++---- vitrage/api_handler/service.py | 31 ++++++++++++++----- vitrage/cli/graph.py | 7 +++-- vitrage/datasources/nova/host/driver.py | 12 ++------ vitrage/datasources/nova/host/transformer.py | 10 ++---- vitrage/entity_graph/graph_clone/base.py | 13 +++----- vitrage/entity_graph/processor/processor.py | 11 +++---- vitrage/entity_graph/processor/processor_utils.py | 16 +++------- vitrage/entity_graph/service.py | 9 +++++- vitrage/evaluator/__init__.py | 6 ++-- vitrage/evaluator/evaluator_service.py | 6 ++-- vitrage/graph/algo_driver/networkx_algorithm.py | 36 ++++++++-------------- vitrage/graph/driver/graph.py | 11 +++++-- vitrage/graph/driver/networkx_graph.py | 20 +++++++++--- vitrage/middleware/keycloak.py | 1 + .../driver/driver_host_snapshot_dynamic.json | 2 +- .../datasources/nova/test_nova_host_transformer.py | 4 +-- 26 files changed, 149 insertions(+), 119 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 72483f8..fed505d 100644 --- a/requirements.txt +++ b/requirements.txt @@ -17 +17 @@ python-heatclient>=1.10.0 # Apache-2.0 -python-mistralclient>=3.1.0 # Apache-2.0 +python-mistralclient!=3.2.0,>=3.1.0 # Apache-2.0

1 0

python-mistralclient 3.5.0 (rocky)
by no-reply＠openstack.org 15 May '18

15 May '18

We contentedly announce the release of: python-mistralclient 3.5.0: Mistral Client Library This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/python-mistralclient Download the package from: https://pypi.org/project/python-mistralclient Please report issues through launchpad: https://bugs.launchpad.net/python-mistralclient For more details, please see below. 3.5.0 ^^^^^ New Features * Adding a --force optional parameter to delete excetutions. Without it only finished executions can be deleted. If --force is passed the execution will be deleted but mistral will generate some errors as expected objects in memory no longer exist Changes in python-mistralclient 3.4.0..3.5.0 -------------------------------------------- a946891 Trivial: Update pypi url to new url 3f0255f Do not let keystoneauth mask the errors e400bed Add the force parameter to delete executions Diffstat (except docs and test files) ------------------------------------- README.rst | 6 ++-- .../fix-cli-error-messages-2f59329557a5734f.yaml | 8 +++++ mistralclient/api/v2/action_executions.py | 10 ++---- mistralclient/api/v2/actions.py | 40 ++++++++++++++-------- mistralclient/api/v2/executions.py | 10 ++++-- mistralclient/api/v2/workbooks.py | 40 ++++++++++++++-------- mistralclient/api/v2/workflows.py | 40 ++++++++++++++-------- mistralclient/commands/v2/executions.py | 12 +++++-- .../force-delete-executions-d08ce88a5deb3291.yaml | 7 ++++ 11 files changed, 133 insertions(+), 61 deletions(-)

1 0

castellan 0.18.0 (rocky)
by no-reply＠openstack.org 14 May '18

14 May '18

We are satisfied to announce the release of: castellan 0.18.0: Generic Key Manager interface for OpenStack This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/castellan Download the package from: https://tarballs.openstack.org/castellan/ Please report issues through launchpad: https://bugs.launchpad.net/castellan For more details, please see below. Changes in castellan 0.17.0..0.18.0 ----------------------------------- 777b1cc Add config option for Barbican endpoint type a752ab7 Promote castellan's barbican-tempest-plugin job 27ed9c6 pypy is not checked at gate e9ea252 fix list of default virtualenvs 837fc4c set default python to python3 4c18818 Updated from global requirements 630746a Add barbican-tempest experimental job 18068e1 add lower-constraints job a651d07 Updated from global requirements 97c904d Update links in README 7d51c7c Updated from global requirements 81d3c2d Updated from global requirements 27588c3 Update unreachable links in contributor document a822abc Zuul: Remove project name ece2d0e Update reno for stable/queens 73f0ddd Updated from global requirements e587bf6 Updated from global requirements ae208c1 Use Zuul v3 fetch-subunit-output Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 31 ++++++----- README.rst | 4 +- castellan/key_manager/barbican_key_manager.py | 13 +++-- castellan/options.py | 8 ++- lower-constraints.txt | 75 +++++++++++++++++++++++++++ playbooks/devstack/post.yaml | 2 +- releasenotes/source/index.rst | 1 + releasenotes/source/queens.rst | 6 +++ requirements.txt | 10 ++-- test-requirements.txt | 8 +-- tox.ini | 12 ++++- 13 files changed, 147 insertions(+), 34 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 15c81d7..a6020f7 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,3 +7,3 @@ Babel!=2.4.0,>=2.3.4 # BSD -cryptography!=2.0,>=1.9 # BSD/Apache-2.0 -python-barbicanclient!=4.5.0,!=4.5.1,>=4.0.0 # Apache-2.0 -oslo.config>=5.1.0 # Apache-2.0 +cryptography>=2.1 # BSD/Apache-2.0 +python-barbicanclient>=4.5.2 # Apache-2.0 +oslo.config>=5.2.0 # Apache-2.0 @@ -12 +12 @@ oslo.i18n>=3.15.3 # Apache-2.0 -oslo.log>=3.30.0 # Apache-2.0 +oslo.log>=3.36.0 # Apache-2.0 @@ -15 +15 @@ stevedore>=1.20.0 # Apache-2.0 -keystoneauth1>=3.3.0 # Apache-2.0 +keystoneauth1>=3.4.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 3dba5b5..be3f6f7 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ coverage!=4.4,>=4.0 # Apache-2.0 -python-barbicanclient!=4.5.0,!=4.5.1,>=4.0.0 # Apache-2.0 +python-barbicanclient>=4.5.2 # Apache-2.0 @@ -9,3 +9,3 @@ python-subunit>=1.0.0 # Apache-2.0/BSD -sphinx>=1.6.2 # BSD -openstackdocstheme>=1.17.0 # Apache-2.0 -oslotest>=1.10.0 # Apache-2.0 +sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD +openstackdocstheme>=1.18.1 # Apache-2.0 +oslotest>=3.2.0 # Apache-2.0

1 0

oslo.vmware 2.29.0 (rocky)
by no-reply＠openstack.org 14 May '18

14 May '18

We are overjoyed to announce the release of: oslo.vmware 2.29.0: Oslo VMware library This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.vmware Download the package from: https://pypi.org/project/oslo.vmware Please report issues through launchpad: https://bugs.launchpad.net/oslo.vmware For more details, please see below. Changes in oslo.vmware 2.28.0..2.29.0 ------------------------------------- 654966f PBM WSDL for vSphere 6.7 bcf2977 Remove stale pip-missing-reqs tox test 95ca244 fix a typo:s/extention/extension 6251b6c Trivial: Update pypi url to new url cda1daf set default python to python3 Diffstat (except docs and test files) ------------------------------------- README.rst | 4 +- oslo_vmware/vim_util.py | 2 +- oslo_vmware/wsdl/6.7/core-types.xsd | 282 + oslo_vmware/wsdl/6.7/pbm-messagetypes.xsd | 223 + oslo_vmware/wsdl/6.7/pbm-types.xsd | 998 + oslo_vmware/wsdl/6.7/pbm.wsdl | 3983 ++++ oslo_vmware/wsdl/6.7/pbmService.wsdl | 16 + oslo_vmware/wsdl/6.7/query-types.xsd | 254 + oslo_vmware/wsdl/6.7/reflect-types.xsd | 14 + oslo_vmware/wsdl/6.7/vim-types.xsd | 33696 ++++++++++++++++++++++++++++ tox.ini | 13 +- 12 files changed, 39479 insertions(+), 20 deletions(-)

1 0

oslo.utils 3.36.2 (rocky)
by no-reply＠openstack.org 14 May '18

14 May '18

We contentedly announce the release of: oslo.utils 3.36.2: Oslo Utility library This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.utils Download the package from: https://pypi.org/project/oslo.utils Please report issues through launchpad: https://bugs.launchpad.net/oslo.utils For more details, please see below. Changes in oslo.utils 3.36.1..3.36.2 ------------------------------------ 0fb1b0a Add private_key to the list of sanitized keys d365e4f Remove stale pip-missing-reqs tox test de4d748 Capitalize Oslo Diffstat (except docs and test files) ------------------------------------- oslo_utils/strutils.py | 2 +- tox.ini | 8 -------- 3 files changed, 3 insertions(+), 11 deletions(-)

1 0

oslo.rootwrap 5.14.1 (rocky)
by no-reply＠openstack.org 14 May '18

14 May '18

We are tickled pink to announce the release of: oslo.rootwrap 5.14.1: Oslo Rootwrap This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.rootwrap Download the package from: https://pypi.org/project/oslo.rootwrap Please report issues through launchpad: https://bugs.launchpad.net/oslo.rootwrap For more details, please see below. Changes in oslo.rootwrap 5.14.0..5.14.1 --------------------------------------- ed125c0 Make IpNetnsExecFilter more strict to detect aliases 7fad1d9 Remove stale pip-missing-reqs tox test 667c227 Trivial: Update pypi url to new url Diffstat (except docs and test files) ------------------------------------- README.rst | 4 ++-- oslo_rootwrap/filters.py | 11 ++++++++--- tox.ini | 8 -------- 4 files changed, 21 insertions(+), 13 deletions(-)

1 0

oslo.service 1.31.2 (rocky)
by no-reply＠openstack.org 14 May '18

14 May '18

We are chuffed to announce the release of: oslo.service 1.31.2: oslo.service library This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.service Download the package from: https://pypi.org/project/oslo.service Please report issues through launchpad: https://bugs.launchpad.net/oslo.service For more details, please see below. Changes in oslo.service 1.31.1..1.31.2 -------------------------------------- 20a2178 [ThreadGroup] Don't remove timer when stop timers 61fad31 tox.ini: Use python3.5 in py35 environment cad75e4 Python 3: Fix eventlet wakeup after signal 7532537 Python 3: Fix non-deterministic test 44bd20b Remove stale pip-missing-reqs tox test c1df0a2 Trivial: Update pypi url to new url 9f79e86 add lower-constraints job b3a42f0 move doc8 test to pep8 job bd96a33 set default python to python3 Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 9 +++++ README.rst | 4 +- lower-constraints.txt | 74 ++++++++++++++++++++++++++++++++++ oslo_service/service.py | 63 +++++++++++++++++++++++++++++ oslo_service/threadgroup.py | 16 ++++++-- tox.ini | 27 +++++++------ 8 files changed, 180 insertions(+), 22 deletions(-)

1 0

pbr 4.0.3
by no-reply＠openstack.org 14 May '18

14 May '18

We eagerly announce the release of: pbr 4.0.3: Python Build Reasonableness The source is available from: https://git.openstack.org/cgit/openstack-dev/pbr Download the package from: https://pypi.org/project/pbr Please report issues through launchpad: https://bugs.launchpad.net/pbr For more details, please see below. Changes in pbr 4.0.2..4.0.3 --------------------------- 0da792a Don't poke in pip for requests a562b12 Fix builddoc with sphinx <= 1.6 Diffstat (except docs and test files) ------------------------------------- pbr/builddoc.py | 2 +- tools/integration.sh | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-)

1 0