March 2019 - Release-announce - lists.openstack.org

os-brick 2.3.6 (queens)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We contentedly announce the release of: os-brick 2.3.6: OpenStack Cinder brick library for managing local volume attaches This release is part of the queens stable release series. The source is available from: https://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.org/project/os-brick Please report issues through launchpad: https://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 2.3.5..2.3.6 -------------------------------- 44a0486 'iscsiadm -m session' failure handling Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/connectors/iscsi.py | 7 +++---- 2 files changed, 13 insertions(+), 9 deletions(-)

1 0

os-brick 2.5.6 (rocky)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are pleased to announce the release of: os-brick 2.5.6: OpenStack Cinder brick library for managing local volume attaches This release is part of the rocky stable release series. The source is available from: https://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.org/project/os-brick Please report issues through launchpad: https://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 2.5.5..2.5.6 -------------------------------- 80ee8f8 'iscsiadm -m session' failure handling Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/connectors/iscsi.py | 7 +++---- 2 files changed, 13 insertions(+), 9 deletions(-)

1 0

os-brick 1.15.8 (pike)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are delighted to announce the release of: os-brick 1.15.8: OpenStack Cinder brick library for managing local volume attaches This release is part of the pike stable release series. The source is available from: http://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.org/project/os-brick Please report issues through launchpad: http://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 1.15.7..1.15.8 ---------------------------------- c183991 'iscsiadm -m session' failure handling 7ce5854 Handle multiple errors in multipath -l parsing Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/connectors/iscsi.py | 7 ++--- os_brick/initiator/linuxscsi.py | 3 +- 4 files changed, 53 insertions(+), 10 deletions(-)

1 0

manila-tempest-plugin 0.2.0 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We jubilantly announce the release of: manila-tempest-plugin 0.2.0: Tempest plugin manila-tempest-plugin This release is part of the stein release series. The source is available from: https://git.openstack.org/cgit/openstack/manila-tempest-plugin Download the package from: https://tarballs.openstack.org/manila-tempest-plugin/ Please report issues through launchpad: https://bugs.launchpad.net/manila-tempest-plugin For more details, please see below. Changes in manila-tempest-plugin 0.1.0..0.2.0 --------------------------------------------- 9743939 Delete servers before deleting its share network 5782a70 Verify request ID in all manila responses 3705694 Add functional tests for manage/unmanage of shares in DHSS=True c60922f Temporarily disable test_manage_invalid 50a6760 Fix microversion request URL 29eaeef Add tests for share type availability_zones extra-spec fd6314d Add tests for export location changes in APIv 2.47 6247e9e Scenario test: Create/manage share and write data 839c98b Fix availability zones tests df99c2d Migrate CentOS jobs to ubuntu bionic beaver e5d788e Fix access-rule filter for python3 df4ab07 Extend testing for reset state operation 8e9a39a Py3: Use urlopen from six.moves.urllib.request 89262f6 Remove glusterfs-nfs job 97670ca Change openstack-dev to openstack-discuss b961880 Add skip_checks classmethod d83f970 [Trivial Fix] update home-page url e5117d1 fix tox python3 overrides d8039b8 Fixes test skips in 7c56035bb68d16b52b73de17b61c3bb08e18fe82 4c91b6e import zuul job settings from project-config Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 14 +- .../services/share/v2/json/shares_client.py | 177 +++++++++-- .../admin/test_share_servers_manage_negative.py | 331 +++++++++++++++++++ .../api/admin/test_snapshot_manage_negative.py | 103 ++++-- .../test_replication_export_locations_negative.py | 110 +++++++ .../api/test_share_type_availability_zones.py | 143 +++++++++ .../test_share_type_availability_zones_negative.py | 92 ++++++ setup.cfg | 4 +- tox.ini | 4 + 34 files changed, 2334 insertions(+), 296 deletions(-)

1 0

puppet-ceph 2.6.0
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are tickled pink to announce the release of: puppet-ceph 2.6.0: Puppet module for Ceph Download the package from: https://tarballs.openstack.org/puppet-ceph/ For more details, please see below. 2.6.0 ^^^^^ Upgrade Notes ************* * The PKI functionality in the ceph::rgw::keystone class is now deprecated and the functionality is removed since Keystone v2.0 API is not available anymore and PKI tokens is removed. * Ceph Firefly is EOL since a long time and is no longer supported. * The default value for ceph::rgw::keystone::rgw_keystone_accepted_roles is changed from Member to member * The deprecated class ceph::rgw::apache_fastcgi is now removed. * The ceph::rgw::keystone class now defaults to configuration it for Keystone V3 API. The v2.0 functionality is removed. * The ceph::rgw::keystone class now requires the rgw_keystone_admin_domain, rgw_keystone_admin_project, rgw_keystone_admin_user and rgw_keystone_admin_password parameters to be configured, these were previously only required when configuring Keystone V3, which is now the default and v2.0 has been removed. Deprecation Notes ***************** * ceph::rgw::keystone::use_pki is deprecated and has no effect. * ceph::rgw::keystone::rgw_keystone_revocation_interval is deprecated and has no effect. * ceph::rgw::keystone::nss_db_path is deprecated and has no effect. * ceph::rgw::keystone::user is deprecated and has no effect. * The ceph::rgw::keystone::rgw_keystone_version is deprecated and now has no effect. * The ceph::rgw::keystone::rgw_keystone_admin_token is deprecated and now has no effect. Changes in puppet-ceph 2.5.2..2.6.0 ----------------------------------- a85fb9b Release 2.6.0 01c6a6a Release puppet-ceph 2.5.3 3fe321f Change Keystone RGW default role from Member to member 8df92d5 Deprecated Keystone v2.0 and PKI tokens in Keystone RGW 85b9d61 Deprecate keystone v2.0 functionality e94c107 Use validate_legacy e39f7d2 Remove Firefly base repo hacking e0069da Fix the misspelling of "required" 658c951 Modify puppet version 4 to 5 9529e8d Add support for encrypted OSDs 764bcf9 Do not check for ldap secret with Fedora and RedHat > 7 698def7 Do not enable Ceph el7 repos for Fedora b817404 Fix minor typo in ceph-disk params. c629218 Allow setting explicit osd type as well as wal and db locations. 096fefe Supply hrefs for table of contents according to context 436437a Change openstack-dev to openstack-discuss e77cead Remove ceph::rgw::apache_fastcgi 8e4cae9 Fix stdlib version in metadata 90738b9 Convert spec testing to use rspec-puppet-facts 3e7cba5 Update min tox version to 2.0 9dc3440 Allow setting pool application tag as supported from the Luminous release. Diffstat (except docs and test files) ------------------------------------- README.md | 1 + manifests/osd.pp | 56 ++- manifests/params.pp | 2 - manifests/pool.pp | 18 + manifests/profile/params.pp | 3 +- manifests/repo.pp | 79 ++--- manifests/rgw/apache_fastcgi.pp | 164 --------- manifests/rgw/keystone.pp | 228 ++++++------- metadata.json | 6 +- .../add-ceph-mgr-support-d2a5e9104021f81a.yaml | 2 +- ...eprecate-rgw-keystone-pki-d8d5862f18c1e196.yaml | 16 + .../notes/firefly-removed-ff181871f3ea5be3.yaml | 4 + ...keystone-rgw-default-role-01c22244b6340a32.yaml | 5 + .../notes/remove-fcgi-f5651dfd6538fdd3.yaml | 4 + .../rgw-keystone-deprecate-14288623c16b4561.yaml | 18 + setup.cfg | 2 +- spec/classes/ceph_conf_spec.rb | 32 +- spec/classes/ceph_init_spec.rb | 142 ++++---- spec/classes/ceph_mds_spec.rb | 24 +- spec/classes/ceph_mons_spec.rb | 14 +- spec/classes/ceph_osds_spec.rb | 17 +- spec/classes/ceph_profile_base_spec.rb | 14 +- spec/classes/ceph_profile_client_spec.rb | 14 +- spec/classes/ceph_profile_fs_spec.rb | 4 +- spec/classes/ceph_profile_mds_spec.rb | 6 +- spec/classes/ceph_profile_mgr_spec.rb | 4 +- spec/classes/ceph_profile_mon_spec.rb | 6 +- spec/classes/ceph_profile_osd_spec.rb | 12 +- spec/classes/ceph_profile_params_spec.rb | 6 +- spec/classes/ceph_repo_spec.rb | 377 ++++++++++----------- spec/classes/ceph_spec.rb | 0 spec/defines/ceph_fs_spec.rb | 6 +- spec/defines/ceph_key_spec.rb | 18 +- spec/defines/ceph_mgr_spec.rb | 72 ++-- spec/defines/ceph_mon_spec.rb | 360 ++++++++++---------- spec/defines/ceph_osd_spec.rb | 330 +++++++++++++++--- spec/defines/ceph_pool_spec.rb | 32 +- spec/defines/ceph_rbd_mirror_spec.rb | 52 +-- spec/defines/ceph_rgw_apache_fastcgi_spec.rb | 141 -------- spec/defines/ceph_rgw_apache_proxy_fcgi_spec.rb | 244 +++++++------ spec/defines/ceph_rgw_civetweb_spec.rb | 30 +- spec/defines/ceph_rgw_keystone_spec.rb | 346 +++---------------- spec/defines/ceph_rgw_spec.rb | 337 +++++++++--------- tox.ini | 2 +- 44 files changed, 1470 insertions(+), 1780 deletions(-)

1 0

patrole 0.5.0 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are tickled pink to announce the release of: patrole 0.5.0: Patrole is a tool for verifying that Role-Based Access Control is being enforced across OpenStack deployments. This release is part of the stein release series. The source is available from: https://git.openstack.org/cgit/openstack/patrole Download the package from: https://tarballs.openstack.org/patrole/ Please report issues through launchpad: https://storyboard.openstack.org/#!/project/openstack/patrole For more details, please see below. 0.5.0 ^^^^^ Prelude ******* This release is to tag the Patrole for OpenStack Stein release. After this release, Patrole will support below OpenStack Releases: * Stein * Rocky * Queens * Pike Current development of Patrole is for OpenStack Train development cycle. Every Patrole commit is also tested against master during the Train cycle. However, this does not necessarily mean that using Patrole as of this tag will work against a Train (or future release) cloud. New Features ************ * The exception class "RbacMalformedException" has been broken up into the following discrete exceptions: * "RbacMissingAttributeResponseBody" - incomplete means that the response body (for show or list) is missing certain attributes * "RbacPartialResponseBody" - partial means that a list response only returned a subset of the possible results available. * "RbacEmptyResponseBody" - empty means that the show or list response body is entirely empty Each of the exception classes above deals with a different type of failure related to a soft authorization failure. This means that, rather than a 403 error code getting returned by the server, the response body is incomplete in some way. * Add new exception called "RbacOverrideRoleException". Used for safeguarding against false positives that might occur when the expected exception isn't raised inside the "override_role" context. Specifically, when: * "override_role" isn't called * an exception is raised before "override_role" context * an exception is raised after "override_role" context * Supporting the role inference rules API gives Patrole an ability of testing role chains, when one role implies the second which can also imply the third: "admin" implies "member" implies "reader" Now in a case of testing against an "admin" role ("[patole] rbac_test_roles" = "admin") the "rbac_rule_validation.action" calls the "rbac_utils.get_all_needed_roles" function to extend the roles and validates a policy rule against the full list of possible roles: ["admin", "member", "reader"] Here is few examples: ["admin"] >> ["admin", "member", "reader"] ["member"] >> ["member", "reader"] ["reader"] >> ["reader"] ["custom_role"] >> ["custom_role"] ["custom_role", "member"] >> ["custom_role", "member", "reader"] * We have replaced CONF.patrole.rbac_test_role with CONF.patrole.rbac_test_roles, where instead of single role we can specify list of roles to be assigned to test user. This way we may run rbac tests for scenarios that requires user to have more that a single role. * In order to implement the tests for plugins which do not maintain the "policy.json" with full list of the policy rules and provide policy file with only their own policy rules, the Patrole should be able to load and merge multiple policy files for any of the services. * Discovery all policy files for each of the services. The updated "discover_policy_files" function picks all candidate paths found out of the potential paths in the "[patrole].custom_policy_files" config option. Using "glob.glob()" function makes it possible to use the patterns like '*.json' to discover the policy files. * Loading and merging a data from multiple policy files. Patrole loads a data from each of the discovered policy files for a service and merge the data from all files. * In order to test the list actions which doesn't have its own policy, implemented the "override_role_and_validate_list" function. The function has two modes: * Validating the number of the resources in a "ResponseBody" before calling the "override_role" and after. # make sure at least one resource is available self.ntp_client.create_policy_dscp_marking_rule() # the list of resources available for a user with admin role admin_resources = self.ntp_client.list_dscp_marking_rules( policy_id=self.policy_id)["dscp_marking_rules"] with self.rbac_utils.override_role_and_validate_list( self, admin_resources=admin_resources) as ctx: # the list of resources available for a user with member role ctx.resources = self.ntp_client.list_dscp_marking_rules( policy_id=self.policy_id)["dscp_marking_rules"] * Validating that a resource, created before "override_role", is not present in a "ResponseBody". # the resource created by a user with admin role admin_resource_id = ( self.ntp_client.create_dscp_marking_rule() ["dscp_marking_rule"]["id']) with self.rbac_utils.override_role_and_validate_list( self, admin_resource_id=admin_resource_id) as ctx: # the list of resources available for a user wirh member role ctx.resources = self.ntp_client.list_dscp_marking_rules( policy_id=self.policy_id)["dscp_marking_rules"] * Merged "RbacUtils" and "RbacUtilsMixin" classes. Now there is only "RbacUtilsMixin" class. The new class still provides all functionality of the original "RbacUtils" class. New implementation simplifies the usage of the rbac utils: * there is no need in calling "cls.setup_rbac_utils()" function, because it happens automatically at the "setup_clients" step. * there is no "rbac_utils" variable, so if you need to call a "override_role" function, just do it using "self": with self.override_role(): ... * there is no need in "test_obj" variable for "override_role" function, because it can use "self". * A new policy feature flag called "[policy_feature_flag].removed_nova_policies_stein" has been added to Patrole's config to handle Nova API extension policies removed in Stein. The policy feature flag is applied to tests that validate response bodies for expected attributes previously returned for the following policies that passed authorization: * os_compute_api:os-config-drive * os_compute_api:os-extended-availability-zone * os_compute_api:os-extended-status * os_compute_api:os-extended-volumes * os_compute_api:os-keypairs * os_compute_api:os-server-usage * os_compute_api:os-flavor-rxtx * os_compute_api:os-flavor-access (only from /flavors APIs) * os_compute_api:image-size Note that not all removed policies are included above because test coverage is missing for them (like os_compute_api:os-security- groups). * Added new feature flag called "removed_keystone_policies_stein" under the configuration group "[policy-feature-enabled]" for skipping Keystone tests whose policies were removed in Stein. This feature flag is currently applied to credentials-related policies, e.g.: identity:[create|update|get|delete]_credential * The "requirements_authority" module now supports the following 3 cases: * logical or operation of roles (existing functionality) * logical and operation of roles (new functionality) * logical not operation of roles (new functionality) <service_foo>: <logical_or_example>: - <allowed_role_1> - <allowed_role_2> <logical_and_example>: - <allowed_role_3>, <allowed_role_4> <service_bar>: <logical_not_example>: - <!disallowed_role_5> Each item under "logical_or_example" is "logical OR"-ed together. Each role in the comma-separated string under "logical_and_example" is "logical AND"-ed together. And each item prefixed with "!" under "logical_not_example" is "logical negated". This allows for expressing many more complex cases using the "requirements_authority" YAML syntax. For example, the policy rule (i.e. what may exist in a "policy.yaml" file): "foo_rule: (role:a and not role:b) or role:c" May now be expressed using the YAML syntax as: foo_rule: - a, !b - c * Patrole will validate the deprecated policy rules (if applicable) alongside the current policy rule. Add "[patrole] validate_deprecated_rules" enabled by default to validate the deprecated rules. * Added new Cinder feature flag ("CONF.policy_feature_enabled.added_cinder_policies_stein") for the following newly introduced granular Cinder policies: * "volume_extension:volume_type_encryption:create" * "volume_extension:volume_type_encryption:get" * "volume_extension:volume_type_encryption:update" * "volume_extension:volume_type_encryption:delete" The corresponding Patrole test cases are modified to support the granularity. The test cases also support backward compatibility with the old single rule: "volume_extension:volume_type_encryption" The "rules" parameter in "rbac_rule_validation.action" decorator now also accepts a list of callables; each callable should return a policy action (str). * Patrole now supports parsing custom YAML policy files, the new policy file extension since Ocata. The function "_get_policy_data" has been renamed to "get_rules" and been changed to re-use "oslo_policy.policy.Rules.load" function. Upgrade Notes ************* * The exception class "RbacMalformedException" has been removed. Use one of the following exception classes instead: * "RbacMissingAttributeResponseBody" * "RbacPartialResponseBody" * "RbacEmptyResponseBody" * Remove usage of "cls.setup_rbac_utils()" function. * Remove usage of "self.rbac_utils" variable: with self.rbac_utils.override_role(self): convert to with self.override_role(): * Remove "test_obj" in usage of "override_role" context manager: with self.override_role(self): convert to with self.override_role(): * Remove deprecated "[patrole].enable_rbac" configuration option. To skip Patrole tests going forward, use an appropriate regex. * The following deprecated parameters in "rbac_rule_validation.action" decorator: * "rule" * "expected_error_code" have been removed. Use the non-deprecated versions instead: * "rules" * "expected_error_codes" Deprecation Notes ***************** * Patrole will only support the v3 Tempest roles client for role overriding operations. Support for the v2 version has been dropped because the Keystone v2 API is slated for removal. * Config parameter CONF.rbac_test_role is deprecated in favor of CONF.rbac_test_roles that implements a list of roles instead of single role. Bug Fixes ********* * Previously, the "rbac_rule_validation.action" decorator could catch expected exceptions with no regard to where the error happened. Such behavior could cause false-positive results. To prevent this from happening from now on, if an exception happens outside of the "override_role" context, it will cause "rbac_exceptions.RbacOverrideRoleException" to be raised. Changes in patrole 0.4.0..0.5.0 ------------------------------- 9cd0a43 Fix README for Duplicate implicit target name: "storyboard" 87d83ea Add releasenote to tag the Patrole for Stein release b2ebe49 Updates Launchpad references to Storyboard 1a53003 Compute test are failing due not explicitly passing Network information 2db8338 Do not use self in classmethod 4e79004 Add py36 and py37 tox envs 198ac02 add python 3.7 unit test job 78e7f57 Refactoring RbacUtils part 3 - documentation d3d77ef Refactoring RbacUtils part 2 api tests ace8ea3 Refactoring RbacUtils 11e0c66 Enable checks and gate for reader role 7a308a0 Fix Policy action "get_flavors" not found 2a0fb1f Fix Policy action "get_network_ip_availabilities" not found 19e3bec Support implied rules d16ccfb Fix Doc mistakes and add log to gitignore. 588e806 Fix instability with volume attachment RBAC tests 55e5dfe Fix OverPermission exception for keystone tests 427c74c Fix the misspelling of "available" cd2c5fd Requirements yaml expected service names to be lowercase 6da06ed Use the canonical URL for repositories (git.openstack.org) 0868ded dict_object.keys() is not required for *in* operator 89d5d18 Change openstack-dev to openstack-discuss 0a82474 Rbac tests for Neutron list actions 22e2971 Add tests to cover trunks subports 02f6606 Add List Available Zones test cases for RBAC. a78dcae Fix the branches variant for stable branch job f5c0dfb Migrate patrol jobs to bionic(Ubuntu LTS 18.04) e36a973 docs: Include information about the list of supported projects b5d01cc Add missing ws seperator between words a261a2f Add tests to cover network ip availability API b68763c Add tests to cover service_profile bab9e94 Helper for validating RBAC list actions 47c43cb docs: Use sphinx-apidoc library for autodoc generation 0710e5d Validate omission of expected_error_codes defaults to 403 825d794 trivial: Fix irrelevant-files regexes for unit tests 0464e81 requirements authority: Use better exception/return code 4d4cb1e Add documentation about white box/black box testing to HACKING d02a8d8 RequirementsAuthority multi role support enhancement 2a5f41e Fix error codes for test_delete_flavor_service_profile 74f8e7d refactor: Break up RbacMalformedException into discrete exceptions 596bebd Replace all volume client aliases with _latest suffix 0d3c743 zuul: Use all rather than all-plugin for tox_envlist bbbdd93 refactor: Rename PluginRbacTest => ExtRbacTest b688823 Define common irrelevant-files d771e34 Update min tox version to 2.0 d1a87c5 trivial: Add hacking checks to irrelevant-files in .zuul.yaml 1b49965 trivial: Correct base class name in hacking check e0f3550 Multi role RBAC validation c38aca7 Add feature flag for Keystone policies removed in Stein ecfbb57 pbr: Remove unused translation sections from setup.cfg 904a02b hacking: Add hacking rule for plugin rbac test class names cacbd21 fix: Rename test classes causing accidental skip 2238c69 Fix test_update_address_scope_shared 42f7e1c docs: Add multi-policy validation documentation bf524fb Deprecate use of v2 roles client in rbac_utils.py 28c9c3a Fix create_rbac_policy tenant_id and network_id usage 1daa06a Use tempest.common.identity.identity_utils for project management 6925095 Add volume create from image test 8dd5f19 Remove invalid exception RbacConflictingPolicies 0170c99 docs: Add sections about context_is_admin/custom policy checks 59f538f Replace rule/expected_error_code with non-deprecated versions 2a6d329 Add tests to cover auto_allocated_topology 5f25db5 Add tests to cover neutron-agents dcd153a Remove extra_attr kwarg from RbacMalformedResponse 26b7e09 Add developer test writing guide for Patrole tests b485953 Include README for neutron + plugin tests 433bf50 Add tests to cover policy_minimum_bandwidth_rule d646a4c Add tests to cover policy_bandwidth_limit_rule 8c04bd8 Add granularity for volume_extension:volume_type_encryption ef7047d Use oslo_policy.policy.Rules.load to load rules 9358f74 Add :special-members: directive to automodule in docs e9a1355 Include README in patrole_tempest_plugin/tests/api via symlink 062fb15 Add support for multiple policy files 194752f Remove deprecated patrole.enable_rbac configuration option a3c15da Use templates for cover and lower-constraints d720bad switch documentation job to new PTI 4635c6a import zuul job settings from project-config a3d7311 Remove unused config.CONF 24961a8 Add test for create_subnetpool:is_default 11376ab Limit exception handling to calls within override_role e3b2527 Adds tests to cover QOS policy 849acef Adds tests to cover address scopes 1bee142 Add periodic-stable entry to .zuul.yaml 22bb9b3 Add Patrole gate job for stable/rocky 56bb731 Add tests to cover policy_dscp_marking_rule f4cb74c add python 3.6 unit test job 0f73e7c Add bandit python security scanning to pep8 98437d4 Remove override of 'expected_error_codes' with defaults 0f45285 Remove the usage of deprecated arg 'expected_error_code' 031b182 Add tests to cover RBAC policies 6bffc5c Skip the deprecated API extensions policy tests bd15460 Add release notes page for v0.4.0 63d8602 Add tests to cover flavor_service_profile 04b2628 Add tests to cover trunks fcd6fcf Add waiters after creating volume transfer for related tests Diffstat (except docs and test files) ------------------------------------- .gitignore | 2 + .zuul.yaml | 110 ++-- HACKING.rst | 55 +- README.rst | 41 +- REVIEWING.rst | 54 +- devstack/README.rst | 2 +- devstack/plugin.sh | 43 +- etc/patrole.conf.sample | 40 +- patrole_tempest_plugin/config.py | 52 +- patrole_tempest_plugin/hacking/checks.py | 41 ++ patrole_tempest_plugin/policy_authority.py | 181 +++--- patrole_tempest_plugin/rbac_exceptions.py | 84 ++- patrole_tempest_plugin/rbac_rule_validation.py | 185 ++++-- patrole_tempest_plugin/rbac_utils.py | 431 ++++++++++--- patrole_tempest_plugin/requirements_authority.py | 62 +- .../api/compute/test_availability_zone_rbac.py | 14 +- .../api/compute/test_flavor_extra_specs_rbac.py | 20 +- .../api/compute/test_floating_ip_pools_rbac.py | 4 +- .../api/compute/test_floating_ips_bulk_rbac.py | 12 +- .../compute/test_instance_usages_audit_log_rbac.py | 8 +- .../api/compute/test_quota_class_sets_rbac.py | 22 +- .../api/compute/test_server_migrations_rbac.py | 8 +- .../test_server_misc_policy_actions_rbac.py | 212 ++++--- .../compute/test_server_volume_attachments_rbac.py | 140 ++++- .../api/compute/test_virtual_interfaces_rbac.py | 4 +- .../v3/test_application_credentials_rbac.py | 28 +- .../identity/v3/test_domain_configuration_rbac.py | 58 +- .../api/identity/v3/test_ep_filter_groups_rbac.py | 24 +- .../identity/v3/test_ep_filter_projects_rbac.py | 20 +- .../api/identity/v3/test_oauth_consumers_rbac.py | 20 +- .../api/identity/v3/test_oauth_tokens_rbac.py | 24 +- .../identity/v3/test_policy_association_rbac.py | 36 +- .../api/identity/v3/test_project_tags_rbac.py | 24 +- .../api/identity/v3/test_role_assignments_rbac.py | 8 +- .../api/identity/v3/test_tokens_negative_rbac.py | 15 +- .../api/image/test_image_namespace_objects_rbac.py | 16 +- .../image/test_image_namespace_property_rbac.py | 16 +- .../api/image/test_image_namespace_tags_rbac.py | 20 +- .../api/image/test_image_resource_types_rbac.py | 15 +- .../network/test_auto_allocated_topology_rbac.py | 42 +- .../api/network/test_availability_zones_rbac.py | 48 ++ .../api/network/test_dscp_marking_rule_rbac.py | 121 ++++ .../network/test_flavor_service_profile_rbac.py | 77 +++ .../api/network/test_metering_label_rules_rbac.py | 29 +- .../network/test_network_ip_availability_rbac.py | 64 ++ .../api/network/test_network_segments_rbac.py | 11 +- .../test_policy_bandwidth_limit_rule_rbac.py | 109 ++++ .../test_policy_minimum_bandwidth_rule_rbac.py | 112 ++++ .../api/network/test_service_providers_rbac.py | 4 +- .../api/volume/test_snapshots_actions_rbac.py | 12 +- .../api/volume/test_snapshots_metadata_rbac.py | 30 +- .../api/volume/test_volume_basic_crud_rbac.py | 41 +- .../api/volume/test_volume_types_access_rbac.py | 12 +- .../volume/test_volume_types_extra_specs_rbac.py | 20 +- .../api/volume/test_volumes_snapshots_rbac.py | 36 +- ...-into-discrete-exceptions-92aedb99d0a13f58.yaml | 25 + ...ors-only-in-override-role-f7109a73f5ff70e2.yaml | 19 + ...oles-client-in-rbac-utils-087eda0658d18fa9.yaml | 6 + .../notes/implied-roles-96a307a2b9fa2a40.yaml | 22 + .../notes/multi-role-rbac-7f597c004a558956.yaml | 11 + .../multiple-policy-files-9aa7f7583283739e.yaml | 17 + ...de-role-and-validate-list-d3b80f773674a652.yaml | 37 ++ .../patrole-stein-release-874b36f2fedcd2fb.yaml | 15 + .../rbac-utils-refactoring-2f4f1e3b52fcae14.yaml | 49 ++ ...d-api-extensions-policies-fca3d31c7f5f1f6c.yaml | 23 + ...enable-rbac-config-option-a5e46ce1053b7dea.yaml | 5 + ...pected-error-codes-params-52071a83113934fd.yaml | 13 + ...licies-stein-feature-flag-6cfebbf64ed525d7.yaml | 8 + ...hority-multi-role-support-0fe53fc49567e595.yaml | 37 ++ .../support-deprecated-roles-eae9dc742cb4fa33.yaml | 7 + ...yption-policy-granularity-141ac283b9c0778e.yaml | 19 + .../yaml-policy-file-support-278d3edf64f98d69.yaml | 7 + releasenotes/source/index.rst | 1 + releasenotes/source/v0.4.0.rst | 6 + setup.cfg | 16 +- test-requirements.txt | 1 + tox.ini | 14 +- 184 files changed, 6243 insertions(+), 2600 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 9085c07..a08c27a 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10,0 +11 @@ oslotest>=3.2.0 # Apache-2.0 +bandit>=1.5 # Apache-2.0

1 0

neutron-tempest-plugin 0.3.0 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We contentedly announce the release of: neutron-tempest-plugin 0.3.0: Tempest plugin for Neutron Project This release is part of the stein release series. The source is available from: https://git.openstack.org/cgit/openstack/neutron-tempest-plugin Download the package from: https://tarballs.openstack.org/neutron-tempest-plugin/ Please report issues through launchpad: https://bugs.launchpad.net/neutron For more details, please see below. 0.3.0 ^^^^^ New Features ************ * Added a new method "delete_agent" to the AgentsClient class that implements agent deletion according to the neutron API. https://developer.openstack.org/api-ref/network/v2/index.html #delete-agent * Add new 'debtcollector' dependency with the purpose of deprecating methods that are going to be removed. Deprecation Notes ***************** * Deprecate method BaseTempestTestCase.create_and_associate_floatingip after replacing it with method BaseNetworkTest.create_floatingip. Changes in neutron-tempest-plugin 0.2.0..0.3.0 ---------------------------------------------- 0e8b686 Reenable tests cases in NetworkMigrationFromHA c1052e7 Remove test_port_resource_request_no_provider_net 8bbf899 add assert to ping test eaaf978 Add API test for network segment range extension 561cf62 Add logging of the test steps in NetworkWritableMtuTest 5b85ad8 Add tempest api tests for security groups RBAC 39f2532 Fix L3 agent scheduler tests in multinode environments 6b03ab1 Fix neutron-tempest-plugin tox pep8 setup 7451ad7 Log port details when FloatingIP port details test fails f238ed3 Added test_ports suite and a new test a92aa4e Allow NetworkWritableMtuTest to run on GENEVE (OVN) networks 7eb6725 Make provider network creation more error proof 2f90465 tests for port-resource-request 06ef854 Update test_trunk after adding new ip command tool. c2ed23d Add ip command tool for manually manage devices on VM. 5d0cea2 Keep stable branch jobs on Ubuntu Xenial f742a3d Remove unnecessary entries in resource prefix map f91dba5 Use self.create_port instead of client.create_port b8fbe0c Turn the list of extensions into multi-line b949913 Fix the extension list across jobs 0fab696 Remove deprecated extension "tag" and "tag-ext" db2e6c9 Test floatingip pools service plugin 158ddda Change openstack-dev to openstack-discuss e570de6 Update test cases after security group menthods improvements. 1582f71 Switch tempest plugin jobs to Python 3 1c9f40b Add scenario test for trunk E2E flow 49819a7 call remove_router_extra_routes only when extra_routes is enabled 5da7333 Test propagate_uplink_status on create port 0e04f8f Create wrapper tool for both local and remote shell command execution. 4c590d7 Improve security groups management. 6f9bb77 Fix race condition in test_security_groups 498a7f4 Fix execute_script method to avoid infinite wait. ee741b3 Add new test cases for network ip availability 47f6ae4 Make sure only one port_id is given. d54ae6c Enhance scenario test to cover network dns_domain 21f5342 Fix creating subnet without gateway d50fd0d Two fixes on test_list_available_zones f341b5b Add network availability zones client 5214b27 Move test cases from networking-midonet repository b1a3289 Add connectivity test via 2 routers and tenant networks da17f00 Use advanced image only when it's necessary dc9c6d6 test for minimum bw ingress direction b1c48b6 Remove test_rule_create_fail_for_direction_ingress aee61ac Fix flake8 E405 errors 8aaa73f Fix flake8 E265 errors ae328b9 Fix flake8 H404 errors 3e1d8f1 Update QoS scenario test 168e501 Fix raising TimeoutException in tests f31e3ee Migrate dvr multinode scenario to zuulv3 syntax 71bda86 Add guest image customization to DevStack plugin. af347da Wait for floating IP to be DOWN before checking port details 3dfa94c Refactor test cases after adding new params to create_floatingip. b600bea Add jobs for stable/rocky branch e137cd0 Mark NetworkMigrationFromHA scenario tests as unstable c9f5ec5 Update trunk tests to use create_trunk method. 2cbb10e Add release notes job to zuul template 6bf840f Fix bash cmd used in scenario trunk tests 299c4bd Add delete_agent to NetworkClientJSON 17bc8d8 Revert "Use nested virt in scenario jobs" 54f5592 Add tests to assert filter validation 12685c6 import zuul job settings from project-config 6f0644e Reuse SSH connections for executing multiple commands. e208962 Consolidate irrelevant-files in zuul config bf877c8 Deprecate BaseTempestTestCase.create_and_associate_floatingip method a69dcd5 Create floating IPs with additional parameters. 2de722e Cleanup Tempest tests legacy resources 7a5d022 Stop running designate scenario job on docs-only changes Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 466 ++++++++++++++++++--- README.rst | 1 + devstack/customize_image.sh | 158 +++++++ devstack/functions.sh | 87 ++++ devstack/plugin.sh | 10 + devstack/settings | 4 + .../api/admin/test_agent_availability_zone.py | 7 +- .../api/admin/test_agent_management.py | 4 +- .../test_extension_driver_port_security_admin.py | 4 +- .../api/admin/test_external_network_extension.py | 6 +- .../api/admin/test_floating_ips_admin_actions.py | 18 +- .../api/admin/test_l3_agent_scheduler.py | 26 +- .../api/admin/test_network_segment_range.py | 247 +++++++++++ neutron_tempest_plugin/api/admin/test_ports.py | 121 ++++++ .../api/admin/test_quotas_negative.py | 75 ++-- .../api/admin/test_routers_dvr.py | 9 +- .../api/admin/test_routers_ha.py | 11 +- .../api/admin/test_security_groups.py | 4 +- .../api/admin/test_shared_network_extension.py | 12 +- neutron_tempest_plugin/api/admin/test_tag.py | 48 +-- neutron_tempest_plugin/api/base.py | 241 +++++++++-- neutron_tempest_plugin/api/base_security_groups.py | 78 +--- neutron_tempest_plugin/api/clients.py | 4 +- .../api/test_allowed_address_pair.py | 23 +- .../api/test_auto_allocated_topology.py | 2 +- .../api/test_availability_zones.py | 30 ++ neutron_tempest_plugin/api/test_dhcp_ipv6.py | 4 +- .../api/test_extension_driver_port_security.py | 18 +- .../api/test_extra_dhcp_options.py | 9 +- .../api/test_flavors_extensions.py | 2 +- neutron_tempest_plugin/api/test_floating_ips.py | 64 ++- .../api/test_floating_ips_negative.py | 10 +- .../api/test_metering_extensions.py | 2 +- .../api/test_network_ip_availability.py | 130 +++--- neutron_tempest_plugin/api/test_networks.py | 7 +- .../api/test_networks_negative.py | 3 +- neutron_tempest_plugin/api/test_ports.py | 22 + neutron_tempest_plugin/api/test_qos.py | 22 +- neutron_tempest_plugin/api/test_revisions.py | 80 ++-- .../api/test_router_interface_fip.py | 120 ++++++ .../api/test_routers_negative.py | 4 +- neutron_tempest_plugin/api/test_security_groups.py | 254 ++++++++--- .../api/test_security_groups_negative.py | 50 ++- neutron_tempest_plugin/api/test_subnetpools.py | 12 +- neutron_tempest_plugin/api/test_subnets.py | 5 +- neutron_tempest_plugin/api/test_timestamp.py | 109 ++--- neutron_tempest_plugin/api/test_trunk.py | 282 ++++++------- neutron_tempest_plugin/api/test_trunk_details.py | 29 +- neutron_tempest_plugin/api/test_trunk_negative.py | 114 +++-- neutron_tempest_plugin/common/constants.py | 8 + neutron_tempest_plugin/common/ip.py | 316 ++++++++++++++ neutron_tempest_plugin/common/shell.py | 180 ++++++++ neutron_tempest_plugin/common/ssh.py | 204 ++++++++- neutron_tempest_plugin/common/utils.py | 20 +- neutron_tempest_plugin/config.py | 32 +- neutron_tempest_plugin/exceptions.py | 78 +++- .../scenario/admin/test_floatingip.py | 37 +- neutron_tempest_plugin/scenario/base.py | 53 ++- neutron_tempest_plugin/scenario/test_bgp.py | 232 ++++++++++ .../scenario/test_connectivity.py | 111 +++++ .../scenario/test_dns_integration.py | 10 +- neutron_tempest_plugin/scenario/test_fip64.py | 92 ++++ neutron_tempest_plugin/scenario/test_floatingip.py | 47 ++- .../scenario/test_internal_dns.py | 11 +- neutron_tempest_plugin/scenario/test_mtu.py | 54 ++- neutron_tempest_plugin/scenario/test_ports.py | 80 ++++ neutron_tempest_plugin/scenario/test_qos.py | 134 +++++- .../scenario/test_security_groups.py | 19 +- neutron_tempest_plugin/scenario/test_trunk.py | 466 ++++++++++++--------- .../services/network/json/network_client.py | 40 +- playbooks/dvr-multinode-scenario-pre-run.yaml | 3 + .../post.yaml | 15 - .../run.yaml | 60 --- ...ents-client-delete-method-de1a7fb3f845999c.yaml | 7 + .../mark-methods-removals-f8b230171c045a3e.yaml | 11 + releasenotes/source/README.rst | 34 ++ releasenotes/source/conf.py | 29 +- releasenotes/source/index.rst | 11 +- requirements.txt | 4 +- roles/multi-node-setup/README.rst | 23 + roles/multi-node-setup/defaults/main.yaml | 2 + roles/multi-node-setup/tasks/main.yaml | 17 + setup.cfg | 13 +- tools/customize_ubuntu_image | 16 +- tox.ini | 12 +- 85 files changed, 4256 insertions(+), 1273 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 5660c68..bb836d1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6 +6 @@ pbr!=2.1.0,>=2.0.0 # Apache-2.0 -neutron-lib>=1.18.0 # Apache-2.0 +neutron-lib>=1.25.0 # Apache-2.0 @@ -12,0 +13 @@ oslo.utils>=3.33.0 # Apache-2.0 +paramiko>=2.0.0 # LGPLv2.1+ @@ -18,0 +20 @@ eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT +debtcollector>=1.2.0 # Apache-2.0

1 0

congress-tempest-plugin 0.2.0 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are amped to announce the release of: congress-tempest-plugin 0.2.0: Tempest Plugin for Congress project This release is part of the stein release series. The source is available from: https://git.openstack.org/cgit/openstack/congress-tempest-plugin Download the package from: https://tarballs.openstack.org/congress-tempest-plugin/ Please report issues through launchpad: https://bugs.launchpad.net/congress For more details, please see below. Changes in congress-tempest-plugin 0.1.0..0.2.0 ----------------------------------------------- 4d310aa Add python 3.6 to setup.cfg, in line with Stein target 3607a08 Move legacy job to bionic and stable on xenial fe86b9e Update nova server test for addiing created_at field 4390716 Add test for servers.addresses table in nova driver df0b7e5 Resolve test_datasource_db_sync_add_remove instability 2b4c0ba disable murano scenario test in queens-py35 job 842fe2a nova_servers_addresses_table feature flag 773f397 Update home-page f4bcf65 Add policy eval tests to vitrage webhook driver 4ca37b6 Change openstack-dev to openstack-discuss 6c2fadc Neutron driver test use admin 4b10bef Update hacking version 3d1a06d Update CI jobs in sync with migration in congress repo 0beba1d Fix queens py35 job 51dda09 add z3 support_builtins feature flag 52fecd0 Modify monasca-webhook test 54945ed Monasca webhook rocky schema feature flag e31aa96 tempest test for z3 builtins 63ee08f Add python 3.6 for test and remove pypy in tox df91e38 Removed older version of python added 3.5 be89877 Temporarily disable monasca webhook test e607d01 add queens & rocky check jobs 9e5813e Revert "temporarily disable nova driver tests" de69e03 temporarily disable nova driver tests a39a7a7 skipping some tests for queens 66692c8 import zuul job settings from project-config 7a260ce fix tox python3 overrides Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 168 ++++++++++++++++++- congress_tempest_plugin/config.py | 26 ++- congress_tempest_plugin/plugin.py | 6 +- .../scenario/congress_datasources/test_glancev2.py | 4 +- .../scenario/congress_datasources/test_monasca.py | 96 ++++++++++- .../scenario/congress_datasources/test_murano.py | 4 +- .../congress_datasources/test_neutronv2.py | 14 +- .../congress_datasources/test_neutronv2_qos.py | 5 +- .../scenario/congress_datasources/test_nova.py | 109 +++++++++++-- .../scenario/congress_datasources/test_vitrage.py | 178 +++++++++++++++------ .../legacy/congress-devstack-api-base/post.yaml | 80 +++++++++ .../legacy/congress-devstack-api-base/run.yaml | 105 ++++++++++++ .../congress-devstack-api-py27-queens/post.yaml | 80 +++++++++ .../congress-devstack-api-py27-queens/run.yaml | 90 +++++++++++ .../congress-devstack-api-py27-rocky/post.yaml | 80 +++++++++ .../congress-devstack-api-py27-rocky/run.yaml | 104 ++++++++++++ .../congress-devstack-api-py35-queens/post.yaml | 80 +++++++++ .../congress-devstack-api-py35-queens/run.yaml | 89 +++++++++++ .../congress-devstack-api-py35-rocky/post.yaml | 80 +++++++++ .../congress-devstack-api-py35-rocky/run.yaml | 88 ++++++++++ .../congress-devstack-py35-api-mysql/post.yaml | 80 +++++++++ .../congress-devstack-py35-api-mysql/run.yaml | 89 +++++++++++ .../legacy/congress-pe-replicated-base/post.yaml | 80 +++++++++ .../legacy/congress-pe-replicated-base/run.yaml | 90 +++++++++++ setup.cfg | 8 +- test-requirements.txt | 2 +- tox.ini | 11 +- 33 files changed, 1869 insertions(+), 108 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 0543291..43a96a3 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 +hacking>=1.1.0,<1.2.0 # Apache-2.0

1 0

kuryr-tempest-plugin 0.4.1 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are delighted to announce the release of: kuryr-tempest-plugin 0.4.1: Kuryr Tempest Plugin This release is part of the stein release series. Download the package from: https://tarballs.openstack.org/kuryr-tempest-plugin/ For more details, please see below. Changes in kuryr-tempest-plugin 0.4.0..0.4.1 -------------------------------------------- 0d51e99 Test CRD podSelector update fc53fd0 Rerun test in a single thread if multi-thread failed 4673523 Service cleanup should be optional 5ed5aee Testing port_pool_min and port_pool_max bab0b85 Use assertTrue in checking pod connectivity 6f3f241 Working with noop for vif_pool_driver 2a19675 Checking connectivity from host to pod/service in the namespace Diffstat (except docs and test files) ------------------------------------- 5 files changed, 334 insertions(+), 32 deletions(-)

1 0

designate-tempest-plugin 0.6.0 (stein)
by no-reply＠openstack.org 26 Mar '19

26 Mar '19

We are excited to announce the release of: designate-tempest-plugin 0.6.0: OpenStack DNS As A Service (Designate) Functional Tests This release is part of the stein release series. Download the package from: https://tarballs.openstack.org/designate-tempest-plugin/ For more details, please see below. Changes in designate-tempest-plugin 0.5.0..0.6.0 ------------------------------------------------ 9a0a360 Properly quote TXT/SPF sample data 2da1d6e Fix deleting zones after tests 02fca4d Change openstack-dev to openstack-discuss fd1eb9b Delete created zone in recordset validation tests ba13329 fix tox python3 overrides 1e1c2f2 Re-enable tests that were disabled due to bug #1623576 d14f818 Fixing python 3 support for pep8 and doc 60e5372 Add test for quota set for invalid project 7462c37 switch documentation job to new PTI 7ce15eb import zuul job settings from project-config d64d8ae Use new tempest option to verify redirects Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 5 ++++ designate_tempest_plugin/config.py | 4 +++ designate_tempest_plugin/data_utils.py | 4 +-- .../services/dns/query/query_client.py | 3 +- .../services/dns/v2/json/recordset_client.py | 14 +++++++++ setup.cfg | 2 +- tox.ini | 4 ++- 27 files changed, 181 insertions(+), 77 deletions(-)

1 0