August 2018 - Release-announce - lists.openstack.org

patrole 0.4.0 (rocky)
by no-reply＠openstack.org 16 Aug '18

16 Aug '18

We are jazzed to announce the release of: patrole 0.4.0: Patrole is a tool for verifying that Role-Based Access Control is being enforced across OpenStack deployments. This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/patrole Download the package from: https://tarballs.openstack.org/patrole/ Please report issues through launchpad: https://bugs.launchpad.net/patrole For more details, please see below. 0.4.0 ^^^^^ Prelude ******* This release is to tag the Patrole for OpenStack Rocky release. After this release, Patrole will support below OpenStack Releases: * Rocky * Queens * Pike Current development of Patrole is for OpenStack Stein development cycle. Every Patrole commit is also tested against master during the Stein cycle. However, this does not necessarily mean that using Patrole as of this tag will work against a Stein (or future release) cloud. New Features ************ * In order to strive toward complete test coverage for the services it tests, Patrole now offers RBAC coverage for the APIs included in neutron-tempest-plugin. If this plugin is not installed or enabled, then Patrole will skip those tests. * A new configuration group "[policy_feature_enabled]" has been added to Patrole which will be responsible for collecting the feature flags to be used for newly introduced policies or policies that were changed in a backwards-incompatible way. * create_port_fixed_ips_ip_address_policy (Neutron) * update_port_fixed_ips_ip_address_policy (Neutron) * limits_extension_used_limits_policy (Cinder) * volume_extension_volume_actions_attach_policy (Cinder) * volume_extension_volume_actions_reserve_policy (Cinder) * volume_extension_volume_actions_unreserve_policy (Cinder) These feature flags will be supported until Pike release cycle is EOL. * Patrole now offers support for multiple policies. The "rules" argument has been added to the "rbac_rule_validation.action" decorator, which takes a list of policy names which Patrole will use to determine the expected test result. This allows Patrole to more accurately determine whether RBAC is configured correctly, since some API endpoints enforce multiple policies. Multiple policy support includes the capability to specify multiple expected error codes, as some components may return different error codes for different roles due to checking multiple policy rules. The "expected_error_codes" argument has been added to the "rbac_rule_validation.action" decorator, which is a list of error codes expected when the corresponding rule in the "rules" list is disallowed to perform the API action. For this reason, the error codes in the "expected_error_codes" list must appear in the same order as their corresponding rules in the "rules" list. For example: expected_error_codes[0] is the error code for the rules[0] rule. expected_error_codes[1] is the error code for the rules[1] rule. ... Upgrade Notes ************* * The "admin_only" kwarg has been removed from "rbac_rule_validation" decorator because it is no longer used by any tests. Besides that, it should not be used because Patrole is dedicated to RBAC testing and an admin-only check is not RBAC because it does not use "oslo.policy" library. * The "switch_role" method in "rbac_utils" module has been removed because it is a clunky way of manipulating Tempest roles to achieve RBAC testing. Use "override_role" instead. * The "[patrole].strict_policy_check" was deprecated during the Queens release cycle. It is removed in this release cycle because Patrole should always fail on invalid policies. Deprecation Notes ***************** * The "[patrole].enable_rbac" option is deprecated and will be removed during the "S" release. This is a legacy option that was meaningful downstream when Patrole was a suite of tests inside Tempest itself. Now that Patrole exists upstream as a Tempest plugin, it is paradoxical to install the Patrole plugin yet have an option that allows all Patrole tests to be skipped. This option is at odds with current Patrole architecture. To skip RBAC tests going forward, with Patrole Tempest plugin already installed, use an appropriate regex. * The "rule" argument in the "rbac_rule_validation.action" decorator has been deprecated in favor of "rules". The "expected_error_code" argument in the "rbac_rule_validation.action" decorator has been deprecated in favor of "expected_error_codes". Changes in patrole 0.3.0..0.4.0 ------------------------------- 9ee07cf Fix 'ref' format errors in README file cad317e Add releasenote to tag the Patrole for Rocky release 73d9f95 Add tests to cover flavors 2cc271c Add tests to cover auto_allocated_topology 3e98fe4 Update segments rbac tests with error codes 1d82978 Reset ntp_client cached token in override_role context a137576 Improve tests for test_volume_basic_crud.py 8390341 Deprecate enable_rbac configuration option d48d892 Remove misleading todo from config.py d067148 Add tests to cover segments 2ee0db0 Add list backups with details for backup:backup_project_attribute 9d45e40 Adds create_network tests for missing policy actions f8d1c74 Adds the following tests for update_network: 1884c57 Increase test stability of backup RBAC tests e917655 Docs: Add RBAC overview documentation fdc4514 trivial: Fix HACKING.rst nits causing rendering issues f6ffb8b Add README in the devstack folder eb197db Add REVIEWING documentation 51299a1 Improve exception that is raised following invalid service 561d028 Cap additional nova-network tests at Queens 299b9d4 Bump hacking to 1.1.0 1bbf48e followup: Include spec/discussion references f800a1c Add documentation explaining why Patrole tests aren't in Tempest e5ee4be docs: Add symlink to readme from overview documentation f16b6b3 Update overpermission/underpermission rbac exceptions d91c124 Change Neutron tests to use multi-policy support f5ed588 trivial: Drop empty services folder under patrole_tempest_plugin 318fa3b Use tempest-multinode-full parent for multinode Zuul jobs c0cb7eb multi policy: Fix logging issues with multiple policies 543f7b9 docs: Add Patrole overview documentation ddac38b Limit .zuul.yaml gate jobs to most important jobs only 1bed58b Add fixed ip cleanup to test_add_fixed_ip e7679f7 Fix Neutron-related return values on some list APIs 35a7711 Add support for handling multiple error codes 2fc2929 Gate fix: Rename Member (legacy) to member role 5da0aad Gate fix: Cap nova-network tests at Queens 383960d Drop old README file ece376d Remove duplicate test_unmanage_volume test 57ab8c4 Remove duplicate subnet tests fromt test_networks_rbac module 3056b98 Wait for interface to detach for all interface tests d0ddf7d Add RBAC tests for identity v3 application credentials API 8251477 Refactor `test_confirm_resize_server` to pass for all roles 68f4c2f fix tox python3 overrides 66d54a9 Docs: Add requirements authority module to documentation bc865df Fix test_volume_upload BadRequest error 2880cad Remove RBAC test_volume_list_image_metadata test case ac3e85d Move VirtualInterfacesRbacTest into separate module 778b780 Add docstrings for requirements_authority module 31e308e Move RbacAuthority class into separate module 9ae705d Docs: Add documentation on policy feature flags f1ba5ae Wait for interface to detach for required tests 97117b0 Fix typos for custom requirements config options descriptions 7cd2161 fix typos in documentation 443d39c docs: Add Patrole RBAC field guide 94fc2ca [trivial] Update short-hand doc reference with real link 44d7784 Update rbac_rule_validation for multi-policy support 4c3ae9b Make patrole-member job run for queens and pike branches 739041f feature flag: Policy feature enabled config group 3896908 Create or attach interface should use specific network 58515ed Gate fix: Cap hacking to avoid gate failure 6c0f40a Add waiters to Nova tests to prevent tearDown failures af81f05 Add skip check to 'test_update_volume_attachment' d737199 Rephrase Patrole skip message for better sorting 7dec873 Always use correct host for aggregates test suite 05c8597 [TrivialFix] Use tempest.config instead of oslo_config.cfg d0c6929 Add RBAC tests for identity v3 project tags 8d29e70 Fix test_show_server_usage not checking expected attributes c330bab Add max microversion = 2.42 for compute host tests 88d4fc7 Set max microversion for some hypervisor tests to 2.52 0ad6bde Increase RBAC test coverage for floating ips bulk API 04352ea Set max_microversion 2.43 for virtual_interfaces tests 3d8623d Fix: Set max_microversion to 2.38 for image metadata compute tests b43c486 Drop min_microversion = '2.10' from compute test 445c48b RBAC test for Keystone v3 OS-ENDPOINT-POLICY API 2fe986d Add functools.wraps decorator to rbac_rule_validation 4ef7e53 Remove already-deprecated strict_policy_check option 1c8620a Remove deprecated switch_role method 8669a51 add lower-constraints job 932b81d Update docs building bb46c5a Fix a bug in patrole documentation. 6da23e6 Fix tests for snapshots extended_snapshot_attributes policy f918e08 Add RBAC test for listing snapshots with details 55bc499 Updated from global requirements 097d94c Patrole base job as zuulv3 native 5ca7ada Add releasenotes page for v0.3.0 3f67a39 [Fix Gate] Fix network segments policy test raising 503 f9ace2b [docs] Add information about supported & stable tests 318a0bf Remove admin_only kwarg from rbac_rule_validation decorator 0548f03 Add v0.2.0 releasenotes page 6e86fc1 Increase coverage for volume metadata tests bb1ebaa Fix test_limits_rbac not checking for expected response b437ae1 Add RBAC test for show_encryption_specs_item Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 156 ++++++- HACKING.rst | 113 +++-- README.rst | 200 +++++++-- REVIEWING.rst | 136 ++++++ devstack/README.rst | 25 ++ devstack/plugin.sh | 25 +- etc/patrole.conf.sample | 110 +++-- lower-constraints.txt | 84 ++++ patrole_tempest_plugin/README.rst | 5 - patrole_tempest_plugin/config.py | 121 ++++-- patrole_tempest_plugin/hacking/checks.py | 4 +- patrole_tempest_plugin/plugin.py | 21 +- patrole_tempest_plugin/policy_authority.py | 24 +- patrole_tempest_plugin/rbac_authority.py | 38 ++ patrole_tempest_plugin/rbac_exceptions.py | 30 +- patrole_tempest_plugin/rbac_rule_validation.py | 326 ++++++++++----- patrole_tempest_plugin/rbac_utils.py | 92 ++-- patrole_tempest_plugin/requirements_authority.py | 54 ++- patrole_tempest_plugin/services/__init__.py | 0 .../api/compute/test_floating_ips_bulk_rbac.py | 68 ++- .../test_server_misc_policy_actions_rbac.py | 130 ++++-- .../compute/test_server_volume_attachments_rbac.py | 9 + .../api/compute/test_virtual_interfaces_rbac.py | 64 +++ .../v3/test_application_credentials_rbac.py | 85 ++++ .../identity/v3/test_policy_association_rbac.py | 152 +++++++ .../api/identity/v3/test_project_tags_rbac.py | 96 +++++ .../network/test_auto_allocated_topology_rbac.py | 44 ++ .../api/network/test_metering_label_rules_rbac.py | 5 +- .../api/network/test_network_segments_rbac.py | 122 ++++++ .../network/test_networks_multiprovider_rbac.py | 99 ----- .../api/volume/test_snapshots_metadata_rbac.py | 9 - .../api/volume/test_volume_basic_crud_rbac.py | 33 +- .../api/volume/test_volumes_snapshots_rbac.py | 88 ++-- playbooks/patrole-admin/post.yaml | 80 ---- playbooks/patrole-admin/run.yaml | 60 --- playbooks/patrole-member/post.yaml | 80 ---- playbooks/patrole-member/run.yaml | 61 --- playbooks/patrole-multinode-admin/post.yaml | 80 ---- playbooks/patrole-multinode-admin/run.yaml | 63 --- playbooks/patrole-multinode-member/post.yaml | 80 ---- playbooks/patrole-multinode-member/run.yaml | 63 --- playbooks/patrole-py35-member/post.yaml | 80 ---- playbooks/patrole-py35-member/run.yaml | 70 ---- ...on-tempest-plugin-clients-c031e232021b390c.yaml | 7 + ...patible-rule-feature-flag-ebe8b44c0aa663a8.yaml | 16 + ...recate-enable-rbac-option-1e499bb0914cdee8.yaml | 13 + .../multi-policy-support-4e5c8b4e9e25ad9d.yaml | 31 ++ .../patrole-rocky-release-e6f36691306bec7e.yaml | 14 + .../remove-admin-only-kwarg-919f1a4797318a33.yaml | 8 + ...ve-deprecated-switch-role-148c9a5c6796857f.yaml | 6 + ...emove-strict-policy-check-480e3d664f7b2d96.yaml | 6 + releasenotes/source/index.rst | 8 +- releasenotes/source/v0.2.0.rst | 6 + releasenotes/source/v0.3.0.rst | 6 + requirements.txt | 2 +- setup.cfg | 6 - test-requirements.txt | 6 +- tox.ini | 30 +- 106 files changed, 4350 insertions(+), 1789 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 35c6038..cc13aa9 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ oslo.log>=3.36.0 # Apache-2.0 -oslo.config>=5.1.0 # Apache-2.0 +oslo.config>=5.2.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index add2388..9085c07 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -4,5 +4 @@ -hacking>=1.0.0 # Apache-2.0 - -sphinx!=1.6.6,>=1.6.2 # BSD -openstackdocstheme>=1.18.1 # Apache-2.0 -reno>=2.5.0 # Apache-2.0 +hacking>=1.1.0,<1.2.0 # Apache-2.0

1 0

octavia-tempest-plugin 0.1.0 (rocky)
by no-reply＠openstack.org 15 Aug '18

15 Aug '18

We are pleased to announce the release of: octavia-tempest-plugin 0.1.0: Tempest plugin for Octavia This is the first release of octavia-tempest-plugin. This release is part of the rocky release series. The source is available from: http://git.openstack.org/cgit/openstack/octavia-tempest-plugin Download the package from: https://tarballs.openstack.org/octavia-tempest-plugin/ Please report issues through launchpad: https://storyboard.openstack.org/#!/project/910 For more details, please see below. Changes in octavia-tempest-plugin 7359782a54f6610e694597b4df372b7e307cc158..0.1.0 --------------------------------------------------------------------------------- b057322 Add "wait for active" after object delete 8999651 Re-enable KVM ce50c73 fix tox python3 overrides 07c9a63 Fix a potential IP address conflict 437eff6 Spare amps have no role 57be518 Correctly guess amp count based on detected topo dfc11ee Create scenario tests for amphora e029af2 Create api+scenario tests for l7rules 446f8be Create api+scenario tests for l7policies 60ed9d9 Create api+scenario tests for healthmonitors 0f28a48 Migrate to stestr cd72b56 Create basic traffic balancing scenario test de3e054 Create api+scenario tests for members 8ffce3e Create api+scenario tests for pools 008dbec Fix sphinx-docs job for sphinx >1.7 d5046c0 Fix the invalid home-page url fbbd2b4 Create api+scenario tests for listeners a795ae6 Fix tests for Octavia API compat changes 986e3f5 Create scenario tests for load balancers 0c90ef6 Revert "Create scenario tests for loadbalancers" 6f0c71f Updated from global requirements fac9602 Updated from global requirements b8f7f53 Zuul: Remove project name 045cc5e Updated from global requirements ac449fe Updated from global requirements bf966a9 Create floating ip by normal user 5c1518d Rename tox_venvlist (2/2) eaedb34 Rename tox_venvlist (1/2) b706987 Fix a typo in the test HTTP server 2a69ad0 Enable Qos in gate 80deb38 Add missing __init__.py file 36ece2d Update README a268ca7 Disable more services from the scenario jobs ed613e2 Updated from global requirements 8564290 Add a scenario test gate 638c4ef Create scenario tests for loadbalancers 1f41eac Updated from global requirements c0246d0 Updated from global requirements bf8dbae Updated from global requirements 81d6349 Updated from global requirements 34139b0 Initial setup of the octavia-tempest-plugin repo Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..5b1b3ee --- /dev/null +++ b/requirements.txt @@ -0,0 +1,15 @@ +# The order of packages is significant, because pip processes them in the order +# of appearance. Changing the order has an impact on the overall integration +# process, which may cause wedges in the gate later. + +python-dateutil>=2.5.3 # BSD +ipaddress>=1.0.17;python_version<'3.3' # PSF +pbr!=2.1.0,>=2.0.0 # Apache-2.0 +oslo.config>=5.2.0 # Apache-2.0 +oslo.log>=3.36.0 # Apache-2.0 +oslo.utils>=3.33.0 # Apache-2.0 +oslotest>=3.2.0 # Apache-2.0 +requests>=2.14.2 # Apache-2.0 +six>=1.10.0 # MIT +tempest>=17.1.0 # Apache-2.0 +tenacity>=4.4.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt new file mode 100644 index 0000000..47c128f --- /dev/null +++ b/test-requirements.txt @@ -0,0 +1,12 @@ +# The order of packages is significant, because pip processes them in the order +# of appearance. Changing the order has an impact on the overall integration +# process, which may cause wedges in the gate later. + +hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 + +coverage!=4.4,>=4.0 # Apache-2.0 +python-subunit>=1.0.0 # Apache-2.0/BSD +oslotest>=3.2.0 # Apache-2.0 +stestr>=2.0.0 # Apache-2.0 +testscenarios>=0.4 # Apache-2.0/BSD +testtools>=2.2.0 # MIT

1 0

osc-lib 1.11.1 (rocky)
by no-reply＠openstack.org 15 Aug '18

15 Aug '18

We are satisfied to announce the release of: osc-lib 1.11.1: OpenStackClient Library This release is part of the rocky stable release series. The source is available from: https://git.openstack.org/cgit/openstack/osc-lib Download the package from: https://pypi.org/project/osc-lib Please report issues through launchpad: https://bugs.launchpad.net/python-openstackclient For more details, please see below. Changes in osc-lib 1.11.0..1.11.1 --------------------------------- 5d7e3a7 Revert "Fixes a bug with issubclass() being called on an instance" 5c953f1 Update .gitreview for stable/rocky Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + osc_lib/utils/__init__.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)

1 0

zun 2.1.0 (rocky)
by no-reply＠openstack.org 14 Aug '18

14 Aug '18

We are overjoyed to announce the release of: zun 2.1.0: OpenStack Containers service This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/zun Download the package from: https://tarballs.openstack.org/zun/ Please report issues through launchpad: https://bugs.launchpad.net/zun For more details, please see below. Changes in zun 2.0.0..2.1.0 --------------------------- 4776766 Fix a missing import of _ in objects 2faeffb Change quota_class policy to admin only 7775e55 Add get_count method 3d52504 Update quota db api 0ac5d13 Ignore field 'uuid' when convert from db to object. 0ff34ca Remove project_id in path c334d1c Ignore H405 f6f9e29 Delete duplicate code f2d0ee9 Attached volume has no attached_servers 6ba0e6f Use redefined get in CinderAPI b65e691 Move cinder_api definition to init e7b75a4 Delete non-essential code (devpath) 1306f61 Release port if failed to connect network 9a9e979 Runtime aware scheduling e5f911c Optimize error log for bool_from_string 5880d8e Runtime aware scheduling a2b5e96 Mountpoint remains after detaching volume 5e0b371 Support Cinder volume multi-attach 5456a1d Unbind port when disconnect nerwork 7bf6ebe Check policy only when the status of container is running e26fb4a Refactor list function in docker driver 0fc74ff Add healthcheck to api-ref 6120034 Add api for privileged de07e1e api-ref: add return code for services APIs 9b98afc Add privileged to etcd database 68df96c Support health check for Docker containers 416aa62 Give extended privileges to the container 67caab4 Remove unused auto_heal in schemas de82a5d Reuse the RPC transport to create RPC client 2a0926d Refactor network disconnect code 9e97bdd Support to update auto_heal of container 2721612 Optimizing code for checking the value of force/stop e40332c When using multipath, detach volume failure 7572495 Add the missing dependency on rootwrap 086745d Do not wait if volume status is error 7d10486 Disk size is smaller than base_device_size 81701eb Delete volume when failed to attach 8ce961e Add a comment for Container Object version. e1bbd02 Just modify database when updating the name of container 1ad1bfe Needn't verify the deleted image b5c0ef6 Delete error volume which auto_remove is True ebd57dd Add legacy init script for Ubuntu a6be2ed Fix the json schema for network_attach Diffstat (except docs and test files) ------------------------------------- api-ref/source/containers.inc | 10 ++ api-ref/source/parameters.yaml | 38 ++++++++ api-ref/source/samples/container-create-req.json | 9 +- api-ref/source/samples/container-create-resp.json | 9 +- api-ref/source/samples/container-get-all-resp.json | 9 +- api-ref/source/samples/container-show-resp.json | 9 +- api-ref/source/samples/container-update-resp.json | 9 +- api-ref/source/services.inc | 9 ++ contrib/legacy-ubuntu-init/README.rst | 41 ++++++++ contrib/legacy-ubuntu-init/etc/init/zun-api.conf | 12 +++ .../legacy-ubuntu-init/etc/init/zun-compute.conf | 12 +++ .../legacy-ubuntu-init/etc/init/zun-wsproxy.conf | 12 +++ lower-constraints.txt | 1 + requirements.txt | 1 + tox.ini | 5 +- zun/api/controllers/v1/containers.py | 60 ++++++++---- zun/api/controllers/v1/schemas/containers.py | 14 +-- zun/api/controllers/v1/schemas/parameter_types.py | 28 +++++- zun/api/controllers/v1/views/containers_view.py | 3 +- zun/api/controllers/v1/views/hosts_view.py | 1 + zun/api/controllers/v1/zun_services.py | 7 +- zun/api/controllers/versions.py | 6 +- zun/api/rest_api_version_history.rst | 11 +++ zun/common/config.py | 1 + zun/common/mount.py | 10 +- zun/common/policies/base.py | 7 +- zun/common/policies/container.py | 13 +++ zun/common/policies/quota.py | 8 +- zun/common/policies/quota_class.py | 2 +- zun/common/rpc.py | 18 ++++ zun/common/rpc_service.py | 12 +-- zun/common/utils.py | 13 ++- zun/compute/manager.py | 46 +++++++-- zun/compute/rpcapi.py | 4 +- zun/container/docker/driver.py | 51 +++++++--- zun/container/driver.py | 9 +- zun/db/api.py | 7 +- zun/db/etcd/models.py | 1 + .../105626c4f972_add_privileged_to_container.py | 35 +++++++ .../2fb377a5a519_add_healthcheck_to_container.py | 36 +++++++ .../bc56b9932dd9_add_runtime_to_compute_node.py | 38 ++++++++ .../f746cd28bcac_add_host_to_volume_mapping.py | 34 +++++++ zun/db/sqlalchemy/api.py | 32 ++++--- zun/db/sqlalchemy/models.py | 4 + zun/image/glance/driver.py | 13 ++- zun/network/kuryr_network.py | 99 +++++++++++++++++--- zun/objects/compute_node.py | 4 +- zun/objects/container.py | 25 ++++- zun/objects/quota.py | 2 + zun/objects/quota_class.py | 3 + zun/objects/volume_mapping.py | 10 +- zun/scheduler/filters/runtime_filter.py | 39 ++++++++ zun/scheduler/host_state.py | 2 + .../unit/api/controllers/v1/test_containers.py | 27 ++++++ .../unit/container/docker/test_docker_driver.py | 20 +++- .../unit/scheduler/filters/test_runtime_filter.py | 52 +++++++++++ zun/volume/cinder_api.py | 6 +- zun/volume/cinder_workflow.py | 23 +++-- zun/volume/driver.py | 25 ++--- 69 files changed, 1020 insertions(+), 198 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d2b945d..b4abac6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -26,0 +27 @@ oslo.db>=4.27.0 # Apache-2.0 +oslo.rootwrap>=5.8.0 # Apache-2.0

1 0

ironic 10.1.4 (queens)
by no-reply＠openstack.org 14 Aug '18

14 Aug '18

We are stoked to announce the release of: ironic 10.1.4: OpenStack Bare Metal Provisioning This release is part of the queens stable release series. The source is available from: https://git.openstack.org/cgit/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through launchpad: https://bugs.launchpad.net/ironic For more details, please see below. 10.1.4 ^^^^^^ Deprecation Notes ***************** * The "xclarity" hardware type, as well as the supporting driver interfaces have been deprecated and are scheduled to be removed from ironic in the Stein development cycle. This is due to the lack of operational Third Party testing to help ensure that the support for Lenovo XClarity is functional. The "xclarity" hardware type was introduced at the end of the Queens development cycle. During implementation of Third Party CI, the Lenovo team encountered some unforseen delays. Lenovo is continuing to work towards Third Party CI, and upon establishment and verification of functional Third Party CI, this deprecation will be rescinded. Bug Fixes ********* * Adds more "ipmitool" error messages to be treated as retryable by the ipmitool interfaces (such as power and management hardware interfaces). Specifically, "Node busy", "Timeout", "Out of space" and "BMC initialization in progress" reporting emitted by "ipmitool" will cause ironic to retry IPMI command. This change should improve the reliability of IPMI-based communicaton with BMC. * Fixes an issue that caused the integrated Dell Remote Access Controller (iDRAC) "management" hardware interface implementation, "idrac", to fail to boot nodes in Unified Extensible Firmware Interface (UEFI) boot mode. That interface is supported by the "idrac" hardware type. The issue is resolved for Dell EMC PowerEdge 13th and 14th generation servers. It is not resolved for PowerEdge 12th generation and earlier servers. For more information, see story 1656841 (https://storyboard.openstack.org/#!/story/1656841). * The periodic tasks for the "inspector" inspect interface are no longer disabled if the "[inspector]enabled" option is not set to "True". The help string of this option claims that it does not apply to hardware types. In any case, the periodic tasks are only run if any enabled classic driver or hardware interface requires them. * Ironic API now returns "503 Service Unavailable" for action requiring a conductor when no conductors are online. Bug: 2002600 (https://storyboard.openstack.org/#!/story/2002600). * Fixes an issue seen during node tear down where a port being deleted by the Bare Metal service could be deleted by the Compute service, leading to an unhandled error from the Networking service. See story 2002637 for further details. Changes in ironic 10.1.3..10.1.4 -------------------------------- 8beb083 Fix error thrown by logging in common/neutron.py b5390dd Fix iDRAC hardware type does not work with UEFI 82fd058 Deprecate xclarity hardware type b365239 Do not disable inspector periodic tasks if [inspector]enabled is False ea24d18 Fix error when deleting a non-existent port 4402cc4 Raise TemporaryFailure if no conductors are online e2ca035 Adds more `ipmitool` errors as retryable Diffstat (except docs and test files) ------------------------------------- ironic/common/neutron.py | 5 +- ironic/conductor/rpcapi.py | 4 + ironic/drivers/modules/drac/management.py | 172 ++++++++++-- ironic/drivers/modules/inspector.py | 3 +- ironic/drivers/modules/ipmitool.py | 22 +- ironic/drivers/modules/oneview/inspect.py | 3 +- ironic/drivers/modules/xclarity/management.py | 9 + ironic/drivers/modules/xclarity/power.py | 9 + ironic/drivers/xclarity.py | 9 + .../unit/drivers/modules/drac/test_management.py | 304 +++++++++++++++++++-- ...retryable-ipmitool-errors-1c9351a89ff0ec1a.yaml | 9 + .../notes/deprecate-xclarity-d687571fb65ad099.yaml | 13 + .../idrac-uefi-boot-mode-86f4694b4247a1ca.yaml | 11 + .../inspector-periodics-34449c9d77830b3c.yaml | 8 + ...3-if-no-conductors-online-ead1512628182ec4.yaml | 6 + .../notes/story-2002637-4825d60b096e475b.yaml | 7 + 19 files changed, 673 insertions(+), 126 deletions(-)

1 0

openstackdocstheme 1.22.0
by no-reply＠openstack.org 14 Aug '18

14 Aug '18

We contentedly announce the release of: openstackdocstheme 1.22.0: OpenStack Docs Theme The source is available from: https://git.openstack.org/cgit/openstack/openstackdocstheme Download the package from: https://tarballs.openstack.org/openstackdocstheme/ Please report issues through launchpad: https://launchpad.net/openstack-doc-tools For more details, please see below. Changes in openstackdocstheme 1.21.2..1.22.0 -------------------------------------------- e697470 Added deprecation badge Diffstat (except docs and test files) ------------------------------------- openstackdocstheme/theme/openstackdocs/layout.html | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)

1 0

os-brick 2.3.3 (queens)
by no-reply＠openstack.org 14 Aug '18

14 Aug '18

We are psyched to announce the release of: os-brick 2.3.3: OpenStack Cinder brick library for managing local volume attaches This release is part of the queens stable release series. The source is available from: https://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.org/project/os-brick Please report issues through launchpad: https://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 2.3.2..2.3.3 -------------------------------- e211056 FC fix for scanning only connected HBA's dc5935d RemoteFS: don't fail in do_mount if already mounted Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/linuxfc.py | 14 +++++++++----- os_brick/remotefs/remotefs.py | 13 +++++++++++-- 3 files changed, 25 insertions(+), 10 deletions(-)

1 0

magnum 7.0.0 (rocky)
by no-reply＠openstack.org 13 Aug '18

13 Aug '18

We are thrilled to announce the release of: magnum 7.0.0: Container Management project for OpenStack This release is part of the rocky release series. The source is available from: ** http://git.openstack.org/cgit/openstack/magnum Download the package from: https://tarballs.openstack.org/magnum/ Please report issues through launchpad: ** http://bugs.launchpad.net/magnum For more details, please see below. 7.0.0 ^^^^^ New Features ************ * k8s_fedora_atomic clusters are deployed with RBAC support. Along with RBAC Node authorization is added so the appropriate certificates are generated. * This release introduces 'federations' endpoint to Magnum API, which allows an admin to create and manage federations of clusters through Magnum. As the feature is still under development, the endpoints are not bound to any driver yet. For more details, please refer to bp /federation-api [1]. [1] https://review.openstack.org/#/q/topic:bp/federation-api * This is allowing no floating IP to be usable with a multimaster configuration in terms of load balancers. * Add new label 'cert_manager_api' enabling the kubernetes certificate manager api. * Embed certificates in kubernetes config file when issuing 'cluster config', instead of generating additional files with the certificates. This is now the default behavior. To get the old behavior and still generate cert files, pass --output-certs. * Add 'cloud_provider_enabled' label for the k8s_fedora_atomic driver. Defaults to true. For specific kubernetes versions if 'cinder' is selected as a 'volume_driver', it is implied that the cloud provider will be enabled since they are combined. * Add new labels 'ingress_controller' and 'ingress_controller_role' enabling the deployment of a Kubernetes Ingress Controller backend for clusters. Default for 'ingress_controller' is '' (meaning no controller deployed), with possible values being 'traefik'. Default for 'ingress_controller_role' is 'ingress'. * In the OpenStack deployment with Octavia service enabled, the Octavia service should be used not only for master nodes high availability, but also for k8s LoadBalancer type service implementation as well. * Update kubernetes dashboard to *v1.8.3* which is compatible via kubectl proxy. Addionally, heapster is deployed as standalone deployemt and the user can enable a grafana-influx stack with the *influx_grafana_dashboard_enabled* label. See the kubernetes dashboard documenation for more details. https://github.com/kubernetes/dashboard/wiki * Update k8s_fedora_atomic driver to the latest Fedora Atomic 27 release and run etcd and flanneld in system containers which are removed from the base OS. Known Issues ************ * Adding 'calico' as network driver for Kubernetes so as to support network isolation between namespace with k8s network policy. * Currently, the replicas of coreDNS pod is hardcoded as 1. It's not a reasonable number for such a critical service. Without DNS, probably all workloads running on the k8s cluster will be broken. Now Magnum is making the coreDNS pod autoscaling based on the nodes and cores number. Upgrade Notes ************* * Using the queens (>=2.9.0) python-magnumclient, when a user executes openstack coe cluster config, the client certificate has admin as Common Name (CN) and system:masters for Organization which are required for authorization with RBAC enabled clusters. This change in the client is backwards compatible, so old clusters (without RBAC enabled) can be reached with certificates generated by the new client. However, old magnum clients will generate certificates that will not be able to contact RBAC enabled clusters. This issue affects only k8s_fedora_atomic clusters and clients <=2.8.0, note that 2.8.0 is still a queens release but only 2.9.0 includes the relevant patch. Finally, users can always generate and sign the certificates using this [0] procedure even with old clients since only the cluster config command is affected. [0] https://docs.openstack.org/magnum/latest/user/index.html #interfacing-with-a-secure-cluster * New clusters should be created with kube_tag=v1.9.3 or later. v1.9.3 is the default version in the queens release. * New clusters will be created with kube_tag=v1.11.1 or later. v1.11.1 is the default version in the Rocky release. Security Issues *************** * k8s_fedora Remove cluster role from the kubernetes-dashboard account. When accessing the dashboard and skip authentication, users login with the kunernetes-dashboard service account, if that service account has the cluster role, users have admin access without authentication. Create an admin service account for this use case and others. Bug Fixes ********* * Add *region* parameter to the Global configuration section of the Kubernetes configuration file. Setting this parameter will allow Magnum cluster to be created in the multi-regional OpenStack installation. * Add *trustee_keystone_region_name* optional parameter to the *trust* section. This parameter is useful for multi-regional OpenStack installations with different Identity service for every region. In such installation it is necessary to specify a region when searching for *auth_url* to authenticate a trustee user. * Now user can update labels in cluster-template. Previously string is passed as a value to labels, but we know that labels can only hold dictionary values. Now we are parsing the string and storing it as dictionary for labels in cluster-template. * Fix etcd configuration in k8s_fedora_atomic driver. Explicitly enable client and peer authentication and set trusted CA (ETCD_TRUSTED_CA_FILE, ETCD_PEER_TRUSTED_CA_FILE, ETCD_CLIENT_CERT_AUTH, ETCD_PEER_CLIENT_CERT_AUTH). Only new clusters will benefit from the fix. * When creating a multi-master cluster, all master nodes will attempt to create kubernetes resources in the cluster at this same time, like coredns, the dashboard, calico etc. This race conditon shouldn't be a problem when doing declarative calls instead of imperative (kubectl apply instead of create). However, due to [1], kubectl fails to apply the changes and the deployemnt scripts fail causing cluster to creation to fail in the case of Heat SoftwareDeployments. This patch passes the ResourceGroup index of every master so that resource creation will be attempted only from the first master node. [1] https://github.com/kubernetes/kubernetes/issues/44165 * Create admin cluster role for k8s_fedora_atomic, it is defined in the configuration but it wasn't applied. * Fix bug #1758672 [1] to protect kubelet in the k8s_fedora_atomic driver. Before this patch kubelet was listening to 0.0.0.0 and for clusters with floating IPs the kubelet was exposed. Also, even on clusters without fips the kubelet was exposed inside the cluster. This patch allows access to the kubelet only over https and with the appropriate roles. The apiserver and heapster have the appropriate roles to access it. Finally, all read-only ports have been closed to not expose any cluster data. The only remaining open ports without authentication are for healthz. [1] https://bugs.launchpad.net/magnum/+bug/1758672 * Strip signed certificate. Certificate (ca.crt) has to be striped for some application parsers as they might require pure base64 representation of the certificate itself, without empty characters at the beginning nor the end of file. * Multi master deployments for k8s driver use different service account keys for each api/controller manager server which leads to 401 errors for service accounts. This patch will create a signed cert and private key for k8s service account keys explicitly, dedicatedly for the k8s cluster to avoid the inconsistent keys issue. Changes in magnum 6.0.1..7.0.0 ------------------------------ cf12bb7 Bump k8s version to v1.11.1 feed29d Using cgroupfs as default cgroup-driver 2535915 [k8s] Fix docker volume issue 9d147fa Reno for embed certs in kubernetes config b991838 Using simple public/private key for k8s service account keys eb930a3 Create /etc/kubernetes/manifests on k8s master 1b0fbc2 Change Kubelet flexvolume directory a127c66 Trustee: provide region_name to auth_url searching 4751d32 Fix the heat-container-agent docker image 797f015 Resolve stack outputs only on COMPLETE d417395 Add etcd_volume_size parameter in coreos template ae158f3 Update the default admission control list 974399a k8s_fedora: Add cloud_provider_enabled label ff67ac8 Switch to stestr f6d1c0d Fix etcd race condition issue b7bfee5 Support disabling floating IPs in swarm mode c069cfb Add release notes link in README a28e560 Provide a region to the K8S Fedora Atomic config cff4823 Rename scripts 80f806f Make service account private key hidden 2521afa Pass in `region_name` to get correct heat endpoint 97f086c Revert "Rename scripts" 591a2dc Rename scripts 393e70f Allow multimaster lb with no floating ip option 043c57d Sync service account keys for multi masters 003e27f Added error handling for discoveryurl 4c5d38a k8s_fedora: Create admin cluster-role 4292b86 k8s_fedora: enable tls in traefik ingress 1710f3a k8s_fedora: set ingress traefik log level to INFO e8ac68b Use HostAddressOpt for opts that accept IP and hostnames 3c72d7b Fix race condition issue for k8s multi masters ec58c23 Add option to specify Cgroup driver for Kubelet da910ac fix tox python3 overrides edee703 Strip signed certificate d66b4f2 Revert "Strip signed certificate" 9e97c8b Devicemapper storage driver need specified volume 8996e35 Release note for supporting Octavia as LoadBalancer type service backend 69ffdae Strip signed certificate 2cc57c5 Use Octavia for LoadBalancer type service 38878fd k8s_fedora: Make CoreDNS config a SoftwareDeployment a015193 Update ca related magnum comands to osc b319f72 [doc] fix coredns correct image verison b8fb70d [doc] Correct the non-existent link for the Fedora image 8729997 Open the 8472 port of master for vxlan 91d5229 k8s_fedora: Add admin user 6215887 Follow the new PTI for document build 9eac5ed Imported Translations from Zanata 338b045 Fix incompatible requirement f6ed7d3 Add and improve tests for certificate manager 3d1ee57 Stop using slave_scripts/install-distro-packages.sh 449c8f2 Add bindep.txt file 79c002c Add calico-node on k8s master node 54a4ac9 Make DNS pod autoscale 1c0b972 fix a typo d179c37 Adding documentations about network in vms 16ce059 Adding glossary.rst 405b0c2 k8s_fedora: Add flannel to master nodes d9e590b Cache barbican certs for periodic tasks a1fb448 k8s_fedora: Explicitly set etcd authentication 205e8ad k8s_fedora: Add kubelet authentication/authorization c0f8db9 Updated from global requirements 96e8e6c add lower-constraints job 79f4cc0 Add service account to daemonset in traefik d07fb7f Add missing RBAC config for Prometheus a56c14d TrivialFix: Correcting JSON syntax dd7ed64 Update minimum version of docker in unit tests 1431be0 Add reno for RBAC and client incompatibility 57b9457 Add minimum system requirements to docs 14bf2b2 Use pip_check_reqs module 3721e6b Specify grafana version 21b50f6 Imported Translations from Zanata 30785ac Update kubernetes dashboard to v1.8.3 1eb9bf1 kuberntes: Disable the scale_manager for scale down 4efb58b k8s: allow passing extra options to kube daemons 0b18989 [kubernetes] add ingress controller 6aac363 Admin can now delete clusters in any project d95ba4d Run etcd and flanneld in a system container 838b8da Support calico as network driver 05c7f35 Add disabled_drivers config option 1e36980 Using v1.9.3 as default k8s version 0e6e27e Enables MySQL Cluster Support for Magnum 5a34d7d Check CERT_MANAGER_API if True or False 0e95314 Add missed space in k8s template file 3c8edd4 Add support for Octavia resources in Heat faa9e90 [k8s] allow enabling kubernetes cert manager api 11e7f33 Document use of kube_tag label 1caa885 Change swarm ClusterTemplate coe to swarm-mode 21c87f3 Now user can update label values in cluster-template ec950be federation api: api endpoints 4d39559 Driver's name are case sensitive 38e1051 Update reno for stable/queens 5b45639 Replace CentOS package mysql-devel > mariadb-devel 2329cb7 k8s: Fix kubelet, add RBAC and pass e2e tests 7142ba7 Corrected some misspellings in magnum Diffstat (except docs and test files) ------------------------------------- .gitignore | 6 +- .stestr.conf | 4 + .zuul.yaml | 2 + README.rst | 1 + .../source/samples/certificates-ca-show-resp.json | 2 +- api-ref/source/samples/cluster-get-one-resp.json | 2 +- bindep.txt | 4 + devstack/lib/magnum | 15 +- devstack/plugin.sh | 2 +- lower-constraints.txt | 172 +++++ magnum/api/attr_validator.py | 27 + magnum/api/controllers/v1/__init__.py | 12 + magnum/api/controllers/v1/cluster.py | 8 +- magnum/api/controllers/v1/cluster_template.py | 6 + magnum/api/controllers/v1/federation.py | 454 ++++++++++++ magnum/api/utils.py | 9 + magnum/api/validation.py | 41 +- magnum/cmd/conductor.py | 2 + magnum/common/exception.py | 9 + magnum/common/keystone.py | 29 + magnum/common/policies/__init__.py | 2 + magnum/common/policies/cluster.py | 11 + magnum/common/policies/cluster_template.py | 11 + magnum/common/policies/federation.py | 91 +++ magnum/common/x509/operations.py | 52 +- magnum/conductor/api.py | 23 + magnum/conductor/handlers/common/cert_manager.py | 91 ++- magnum/conductor/handlers/federation_conductor.py | 32 + magnum/conf/cluster.py | 4 + magnum/conf/drivers.py | 8 +- magnum/conf/services.py | 13 +- magnum/conf/trust.py | 5 +- .../versions/05d3e97de9ee_add_volume_driver.py | 7 +- .../versions/2581ebaf0cb2_initial_migration.py | 8 +- ...35cff7c86221_add_private_network_to_baymodel.py | 8 +- ...65537a94a_add_network_driver_baymodel_column.py | 7 +- .../versions/4956f03cabad_add_cluster_distro.py | 7 +- .../4ea34a59a64c_add_discovery_url_to_bay.py | 8 +- .../versions/5518af8dbc21_rename_cert_uuid.py | 9 +- .../592131657ca1_add_coe_column_to_baymodel.py | 10 +- .../5d4caa6e0a42_create_trustee_for_each_bay.py | 11 +- .../alembic/versions/966a99e70ff_add_proxy.py | 14 +- ...71_add_fixed_subnet_column_to_baymodel_table.py | 8 +- ...47f5931da8_add_insecure_registry_to_baymodel.py | 8 +- .../fcb4efee8f8b_add_version_info_to_bay.py | 11 +- magnum/db/sqlalchemy/models.py | 40 +- magnum/drivers/common/driver.py | 18 +- .../common/image/heat-container-agent/Dockerfile | 26 +- .../scripts/heat-config-notify | 6 +- .../scripts/write-os-apply-config-templates.sh | 2 + .../environments/disable_floating_ip.yaml | 6 + .../environments/disable_lb_floating_ip.yaml | 4 + .../templates/environments/enable_floating_ip.yaml | 6 + .../environments/enable_lb_floating_ip.yaml | 4 + .../templates/environments/with_master_lb.yaml | 1 - .../environments/with_master_lb_octavia.yaml | 13 + .../configure_docker_storage_driver_atomic.sh | 12 +- .../kubernetes/fragments/calico-service.sh | 465 ++++++++++++ .../kubernetes/fragments/configure-etcd.sh | 13 +- .../fragments/configure-kubernetes-master.sh | 115 ++- .../fragments/configure-kubernetes-minion.sh | 169 +++-- .../kubernetes/fragments/core-dns-service.sh | 172 ++++- .../fragments/enable-cert-api-manager.sh | 15 + .../fragments/enable-ingress-controller.sh | 23 + .../kubernetes/fragments/enable-ingress-traefik.sh | 165 +++++ .../fragments/enable-prometheus-monitoring | 434 ----------- .../fragments/enable-prometheus-monitoring.sh | 484 +++++++++++++ .../kubernetes/fragments/enable-services-master.sh | 18 +- .../kubernetes/fragments/flannel-config-service.sh | 73 ++ .../kubernetes/fragments/flannel-service.sh | 82 +++ .../fragments/kube-apiserver-to-kubelet-role.sh | 86 +++ .../kubernetes/fragments/kube-dashboard-service.sh | 491 ++++++++++--- .../fragments/kube-system-namespace-service.sh | 71 -- .../kubernetes/fragments/make-cert-client.sh | 115 ++- .../templates/kubernetes/fragments/make-cert.sh | 124 ++-- .../kubernetes/fragments/network-config-service.sh | 79 -- .../kubernetes/fragments/network-service.sh | 82 --- .../kubernetes/fragments/wc-notify-master.sh | 7 +- .../kubernetes/fragments/write-flannel-config.sh | 28 + .../fragments/write-heat-params-master.yaml | 24 + .../kubernetes/fragments/write-heat-params.yaml | 6 + .../kubernetes/fragments/write-kube-os-config.sh | 7 + .../kubernetes/fragments/write-network-config.sh | 28 - .../common/templates/swarm/fragments/make-cert.py | 42 +- magnum/drivers/heat/driver.py | 20 +- magnum/drivers/heat/k8s_fedora_template_def.py | 45 +- magnum/drivers/heat/k8s_template_def.py | 14 +- magnum/drivers/heat/swarm_mode_template_def.py | 53 +- magnum/drivers/heat/template_def.py | 28 +- magnum/drivers/k8s_coreos_v1/driver.py | 6 +- .../fragments/write-heat-params-master.yaml | 1 + .../templates/fragments/write-heat-params.yaml | 1 + .../k8s_coreos_v1/templates/kubecluster.yaml | 22 +- .../k8s_coreos_v1/templates/kubemaster.yaml | 12 + .../k8s_coreos_v1/templates/kubeminion.yaml | 7 + magnum/drivers/k8s_fedora_atomic_v1/driver.py | 6 +- .../templates/kubecluster.yaml | 170 ++++- .../k8s_fedora_atomic_v1/templates/kubemaster.yaml | 267 ++++++- .../k8s_fedora_atomic_v1/templates/kubeminion.yaml | 49 +- magnum/drivers/k8s_fedora_ironic_v1/driver.py | 6 +- .../templates/kubecluster.yaml | 18 +- .../k8s_fedora_ironic_v1/templates/kubemaster.yaml | 38 +- .../templates/kubeminion_software_configs.yaml | 13 +- .../templates/swarmcluster.yaml | 14 +- .../templates/swarmmaster.yaml | 2 +- .../templates/swarmnode.yaml | 2 +- magnum/objects/__init__.py | 6 +- magnum/objects/federation.py | 215 ++++++ magnum/objects/fields.py | 26 + .../api/controllers/v1/test_cluster_template.py | 32 + .../unit/api/controllers/v1/test_federation.py | 415 +++++++++++ .../conductor/handlers/common/test_cert_manager.py | 234 +++++- .../conductor/handlers/test_cluster_conductor.py | 2 +- .../handlers/test_federation_conductor.py | 38 + .../handlers/test_k8s_cluster_conductor.py | 200 ++++- .../handlers/test_mesos_cluster_conductor.py | 78 +- .../handlers/test_swarm_cluster_conductor.py | 92 ++- playbooks/pre/prepare-workspace-images.yaml | 8 +- ...nd-client-incompatibility-fdfeab326dfda3bf.yaml | 20 + .../notes/add-federation-api-cf55d04f96772b0f.yaml | 11 + .../allow-multimaster-no-fip-b11520485012d949.yaml | 5 + ...broken-kuberenetes-client-d2d1da6029825208.yaml | 4 + ...284-k8s-fedora-admin-user-e760f9b0edf49391.yaml | 8 + ...02728-kube-os-conf-region-46cd60537bdabdb2.yaml | 6 + ...-trustee-auth-region-name-37796a4e6a274fb8.yaml | 8 + .../calico-network-driver-0199c2459041ae81.yaml | 5 + .../notes/cert-manager-api-ee0cf7f3b767bb5d.yaml | 5 + .../notes/client-embed-certs-322701471e4d6e1d.yaml | 6 + ...er_template_update_labels-10ce66c87795f11c.yaml | 7 + ...ure-etcd-auth-bug-1759813-baac5e0fe8a2e97f.yaml | 7 + .../notes/dns-autoscale-90b63e3d71d7794e.yaml | 8 + ...able_cloud_provider_label-ed79295041bc46a8.yaml | 7 + ...ion-for-k8s-multi-masters-29bd36de57df355a.yaml | 13 + .../notes/ingress-controller-552ea956ceabdd25.yaml | 8 + ...atomic_apply_cluster_role-8a46c881de1a1fa3.yaml | 5 + ...8s_fedora_protect_kubelet-8468ddcb92c2a624.yaml | 12 + .../strip-ca-certificate-a09d0c31c45973df.yaml | 7 + ...t-octavia-for-k8s-service-d5d7fd041f9d76fa.yaml | 6 + ...nt-keys-for-multi-masters-71217c4cf4dd472c.yaml | 9 + ...date-kubernetes-dashboard-5196831c32d55aee.yaml | 8 + .../notes/update-to-f27-cc8aa873cdf111bc.yaml | 10 + .../upgrade-to-k8s-v1.11.1-8065fd768873295d.yaml | 5 + releasenotes/source/index.rst | 1 + .../locale/en_GB/LC_MESSAGES/releasenotes.po | 806 +++++++++++++++++++++ .../source/locale/fr/LC_MESSAGES/releasenotes.po | 64 -- releasenotes/source/queens.rst | 6 + requirements.txt | 28 +- setup.cfg | 8 - specs/containers-service.rst | 2 +- test-requirements.txt | 9 +- tools/pretty_tox.sh | 16 - tox.ini | 59 +- 175 files changed, 7977 insertions(+), 1389 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index cf3e3d1..0e5ffaa 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +9 @@ Babel!=2.4.0,>=2.3.4 # BSD -PyYAML>=3.10 # MIT +PyYAML>=3.12 # MIT @@ -18 +18 @@ enum34>=1.0.4;python_version=='2.7' or python_version=='2.6' or python_version== -eventlet!=0.18.3,!=0.20.1,<0.21.0,>=0.18.2 # MIT +eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT @@ -21 +21 @@ jsonpatch!=1.20,>=1.16 # BSD -keystoneauth1>=3.3.0 # Apache-2.0 +keystoneauth1>=3.4.0 # Apache-2.0 @@ -23 +23 @@ keystonemiddleware>=4.17.0 # Apache-2.0 -kubernetes>=4.0.0 # Apache-2.0 +kubernetes>=5.0.0 # Apache-2.0 @@ -26,2 +26,2 @@ netaddr>=0.7.18 # BSD -oslo.concurrency>=3.20.0 # Apache-2.0 -oslo.config>=5.1.0 # Apache-2.0 +oslo.concurrency>=3.26.0 # Apache-2.0 +oslo.config>=5.2.0 # Apache-2.0 @@ -31 +31 @@ oslo.i18n>=3.15.3 # Apache-2.0 -oslo.log>=3.30.0 # Apache-2.0 +oslo.log>=3.36.0 # Apache-2.0 @@ -38 +38 @@ oslo.utils>=3.33.0 # Apache-2.0 -oslo.versionedobjects>=1.28.0 # Apache-2.0 +oslo.versionedobjects>=1.31.2 # Apache-2.0 @@ -43 +43 @@ pycadf!=2.0.0,>=1.1.0 # Apache-2.0 -python-barbicanclient!=4.5.0,!=4.5.1,>=4.0.0 # Apache-2.0 +python-barbicanclient>=4.5.2 # Apache-2.0 @@ -46 +46 @@ python-heatclient>=1.10.0 # Apache-2.0 -python-neutronclient>=6.3.0 # Apache-2.0 +python-neutronclient>=6.7.0 # Apache-2.0 @@ -50 +50 @@ requests>=2.14.2 # Apache-2.0 -setuptools!=24.0.0,!=34.0.0,!=34.0.1,!=34.0.2,!=34.0.3,!=34.1.0,!=34.1.1,!=34.2.0,!=34.3.0,!=34.3.1,!=34.3.2,!=36.2.0,>=16.0 # PSF/ZPL +setuptools!=24.0.0,!=34.0.0,!=34.0.1,!=34.0.2,!=34.0.3,!=34.1.0,!=34.1.1,!=34.2.0,!=34.3.0,!=34.3.1,!=34.3.2,!=36.2.0,>=21.0.0 # PSF/ZPL @@ -53,3 +53,3 @@ stevedore>=1.20.0 # Apache-2.0 -taskflow>=2.7.0 # Apache-2.0 -cryptography!=2.0,>=1.9 # BSD/Apache-2.0 -Werkzeug>=0.7 # BSD License +taskflow>=2.16.0 # Apache-2.0 +cryptography>=2.1 # BSD/Apache-2.0 +Werkzeug>=0.9 # BSD License diff --git a/test-requirements.txt b/test-requirements.txt index 12535af..209b0c4 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -15,2 +15 @@ mock>=2.0.0 # BSD -openstackdocstheme>=1.17.0 # Apache-2.0 -oslotest>=1.10.0 # Apache-2.0 +oslotest>=3.2.0 # Apache-2.0 @@ -18 +16,0 @@ osprofiler>=1.4.0 # Apache-2.0 -os-api-ref>=1.4.0 # Apache-2.0 @@ -22 +20 @@ pytz>=2013.6 # MIT -sphinx>=1.6.2 # BSD +sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD @@ -23,0 +22 @@ testrepository>=0.0.18 # Apache-2.0/BSD +stestr>=2.0.0 # Apache-2.0 @@ -26,2 +24,0 @@ testtools>=2.2.0 # MIT -# releasenotes -reno>=2.5.0 # Apache-2.0

1 0

designate-tempest-plugin 0.5.0 (rocky)
by no-reply＠openstack.org 13 Aug '18

13 Aug '18

We are psyched to announce the release of: designate-tempest-plugin 0.5.0: OpenStack DNS As A Service (Designate) Functional Tests This release is part of the rocky release series. Download the package from: https://tarballs.openstack.org/designate-tempest-plugin/ For more details, please see below. Changes in designate-tempest-plugin 0.4.0..0.5.0 ------------------------------------------------ 142f9e2 Default bug_1573141_fixed to true f348bfe Switch to stestr d8728b4 Fix error when creating TimeoutException 76317cd Updated from global requirements 7a68f73 Fix the invalid links in docs 9e76482 Add recordset scenario test 5f8208e Run pep8 as part of default tox run f015ecb Do not create network resources for API tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 2 +- .stestr.conf | 4 + .testr.conf | 12 --- README.rst | 8 +- designate_tempest_plugin/common/waiters.py | 2 +- designate_tempest_plugin/config.py | 5 +- setup.cfg | 2 +- test-requirements.txt | 2 +- tools/pretty_tox.sh | 6 -- tox.ini | 4 +- 30 files changed, 313 insertions(+), 38 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 90882be..f6c0a00 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ openstackdocstheme>=1.18.1 # Apache-2.0 -sphinx!=1.6.6,>=1.6.2 # BSD +sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD

1 0

python-karborclient 1.1.0 (rocky)
by no-reply＠openstack.org 13 Aug '18

13 Aug '18

We jubilantly announce the release of: python-karborclient 1.1.0: Python client library for Karbor API This release is part of the rocky release series. The source is available from: https://git.openstack.org/cgit/openstack/python-karborclient Download the package from: https://pypi.org/project/python-karborclient Please report issues through launchpad: https://bugs.launchpad.net/python-karborclient For more details, please see below. Changes in python-karborclient 1.0.0..1.1.0 ------------------------------------------- 7aca76b fix tox python3 overrides 103d4da Trivial: Update pypi url to new url 0fe7b7c add lower-constraints job 01d1aa0 Follow the new PTI for document build e7e720c Updated from global requirements c3b5d57 Update links in README 63c9890 Updated from global requirements 84d19ef Delete tox.ini functional when functional test is real. 4c47bd0 Change home-page url for karborclient e11f2e8 Add 'rm -f .testrepository/times.dbm' command in testenv Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 7 ++++ README.rst | 11 ++--- lower-constraints.txt | 88 ++++++++++++++++++++++++++++++++++++++++ requirements.txt | 2 +- setup.cfg | 11 +---- test-requirements.txt | 4 +- tox.ini | 27 ++++++++---- 12 files changed, 138 insertions(+), 37 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 464e858..2af4ee3 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ PrettyTable<0.8,>=0.7.1 # BSD -keystoneauth1>=3.3.0 # Apache-2.0 +keystoneauth1>=3.4.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 9c18537..27e5330 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10,2 +9,0 @@ docutils>=0.11 # OSI-Approved Open Source, Public Domain -sphinx!=1.6.6,>=1.6.2 # BSD -openstackdocstheme>=1.17.0 # Apache-2.0 @@ -14 +12 @@ python-openstackclient>=3.12.0 # Apache-2.0 -requests-mock>=1.1.0 # Apache-2.0 +requests-mock>=1.2.0 # Apache-2.0

1 0