January 2023 - Release-announce - lists.openstack.org

glance 25.1.0 (zed)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are tickled pink to announce the release of: glance 25.1.0: OpenStack Image Service This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. Changes in glance 25.0.0..25.1.0 -------------------------------- 022e1502 Fix tox4 error 4967ab69 Enforce image safety during image_conversion 07f98747 Fix unintentional exception inspecting VMDK 06a92288 [stable-only] Remove glance-code-constants-check 014ae273 Update TOX_CONSTRAINTS_FILE for stable/zed 9cf5206c Update .gitreview for stable/zed Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 19 --------- glance/async_/flows/plugins/image_conversion.py | 23 +++++++++++ glance/common/config.py | 12 ++++++ glance/common/format_inspector.py | 2 +- .../async_/flows/plugins/test_image_conversion.py | 47 ++++++++++++++++++++++ tox.ini | 7 ++-- 8 files changed, 106 insertions(+), 23 deletions(-)

1 0

swift 2.31.0 (antelope)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are psyched to announce the release of: swift 2.31.0: OpenStack Object Storage This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/swift Download the package from: https://tarballs.openstack.org/swift/ Please report issues through: https://bugs.launchpad.net/swift/+bugs For more details, please see below. 2.31.0 ^^^^^^ New Features ************ * Added support for Python 3.10. * Added an optional "backend_ratelimit" middleware for backend servers. See the backend server sample configuration files for more information. * Sharding improvements * Added a "merge" subcommand to "swift-manage-shard-ranges" to merge arbitrary shard ranges into a container DB. Minimal safety checks are performed; it should only be used for emergency shard range manipulation by expert users. * Warnings are now emitted when sharding appears to have become stuck. Use the new "container_sharding_timeout" option to configure the "stuck" threshold; the default is 48 hours. * Metrics improvements * Added timing stats for memcached operations. * Renamed and improved the granularity of shard range cache and backend stats. Metrics dashboards may need to be updated. * Emit stats when backend nodes are error-limited. * Added the ability to configure a chance to skip checking memcache when querying account and container information. This allows some fraction of traffic to go to disk and refresh memcache before the key ages out. Recommended values for the new "account_existence_skip_cache_pct" and "container_existence_skip_cache_pct" options are in the range of 0.0 to 0.01. * Absolute-form request targets are now accepted. This enables access for certain clients and SDKs (including some older versions of rclone that were using an old version of aws-sdk-go). Upgrade Notes ************* * Static large object segments may now be deleted asynchronously by default. Operators may return to the old behavior by disabling the "allow_async_delete" option in the "[filter:slo]" section in their proxy-server.conf. Security Issues *************** * Fixed a security issue in how "s3api" handles XML parsing that allowed authenticated S3 clients to read arbitrary files from proxy servers. Refer to CVE-2022-47950 for more information. Bug Fixes ********* * S3 API improvements * Fixed a server error when handling malformed CompleteMultipartUpload requests. * Improved error reporting when attempting to set invalid "X-Delete- At" or "X-Delete-After" values via the S3 API. * Sharding improvements * Sync more shard ranges from the root database to the shards. This helps ensure shard range repairs effected at the root make their way to shards that would otherwise be stuck trying to further divide into sub-shards. * Improved performance of "delimiter" listings for sharded containers. * Added more safety checks to the "repair" subcommand of "swift- manage-shard-ranges". * Better handle "EOFError" and "KeyboardInterrupt" when prompting for input in "swift-manage-shard-ranges". * Stop warning about transient overlaps when auditing shard ranges. * Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14, and 3.10.6 that could cause some "domain_remap" requests to be routed to the wrong object. * Fixed a server error when attempting to access data in a deleted container that had an erasure-coded storage policy. * Improved error messages to clients that encounter errors using the "formpost" middleware. * Removed some inappropriate error-suppression when locking account and container databases. * Improved server start-up time when using multiple workers. * Removed some unnecessary locking when logging. * Added some basic object-metadata validation; invalid diskfiles will be quarantined via the auditor or reconstructor. * Enhanced logging when error-limiting a backend node. * Various other minor bug fixes and improvements. Changes in swift 2.30.0..2.31.0 ------------------------------- 90f9a479b Authors/ChangeLog for 2.31.0 5de745c2b Add Kota's private email address to mailmap 941b9082d Proxy: move '_get_update_shard' from base class to child class. 2f32d0770 swift_proxy: add memcache skip success/error stats for shard range. 30ffafb3e Clean up some cruft 3550e00dd tests: Ensure XXE injection tests have config loaded 51a944850 Skip coverage reports when running pytest directly 908595ee0 Don't run reno as part of building an sdist cc1c649de Clean up project URLs for PyPI dd9b687f7 Fix docs build b8467e190 s3api: Prevent XXE injections 69b18e3c5 tests: Remove references to soft_lock 930744f36 Declare py310 support fb477d17a CI: Remove nodeset pin for DSVM jobs ee12a11e7 Add attrs to lower-constraints b4124e0cd Memcached: add timing stats to set/get and other public functions f77172e2a CI: pin tox at the project level ec9504733 Sharder: add a new probe test for the case of slow parent sharding. f6ac7d449 Tolerate absolute-form request targets 2d7c1dc6d CI: Fix our usage of tox 20b48a690 Clean up a bunch of deprecation warnings 2d0fea6a5 CI: Add py310 unit test job ef155bd74 Switch to pytest 884f5538f Inline parse_request from cpython 597887ded Extract SwiftHttpProtocol to its own module 4cba97d7b Malformed CompleteMultipartUpload request should 400 d363236a2 s3api errors for unsupported headers x-delete-at, x-delete-after 001d931e6 sharder: update own_sr stats explicitly 07b909c26 s-m-s-r: handle EOFError and KeyboardInterrupt 861d13c51 DB locks shouldn't squelch errors 662ef2808 trivial: fix flakey account/test_auditor.py assertion a1939cba0 proxy: add test for ContainerController._GET_using_cache bd5d09903 proxy: refactor ContainerController._GET_using_cache 7a0118fca proxy-server: include suppression time in error limit log 230b467af sharding: avoid transient overlaps while auditing. 5a9f5f521 Temporary pin the swift-dsvm-functional nodeset to Focal 983622d51 account_auditor: fix warning string 26c86c0e4 db_auditor: remove logging translation 2bcf3d1a8 sharder: merge shard shard_ranges from root while sharding 12df65e37 Imported Translations from Zanata 38124221d Proxy: add metrics related to error limiter. d1b2bbdcf Mark rolling-upgrade job non-voting 623024848 proxy: extract response error handling to single method 162847d15 tests: Tolerate NoSuchBucket errors when cleaning up f08b8e0af wsgi: Start workers in parallel, rather than serially 052abed75 Move base CI job to jammy c4ad66b49 Sharder: add more logs during container cleaving. 3571cdf2f CI: Install pip from pinned upstream for py2 probe tests a8516e151 Refactor memcache config and MemcacheRing loading 51730f127 proxy: refactor error limiter to a class a7af17394 Clean up some replication error messages 326e68d70 Fix a formpost reponse bug 79e8f56ac Imported Translations from Zanata cc033154a py2constraints: pin PasteDeploy version 4ed2b89cb Sharder: warn when sharding appears to have stalled. e09d4bcf4 Stop locking in our SysLogHandler 07b5f139a playbooks: replace ansible_ssh_user with ansible_user a46f2324a sharder: always merge child shard ranges fetched from root e838d8a94 swift-drive-audit: reload systemd after editing fstab f15b92084 sharder: always get ranges from root while shrinking 429702e30 sharder: refactor _audit_shard_container 7b345e754 Update master for stable/zed a425f06ee Imported Translations from Zanata 6bcb50985 sharder: trivial tidy up of unit tests 94fb7a0e7 Set irrelevant-files for openstacksdk-functional-devstack job 0860db1f6 Fix test.probe.brain CLI 9bdb77a38 Fixes Storage-Policy AttributeError in proxy a53270a15 swift-manage-shard-ranges repair: check for parent-child overlaps. 032d7aa05 ShardName: add test and clarify docstrings 73bce6331 ShardRange: add is_child_of method 745a7f04f Add validation method for metadata in ECDiskfile 3e6650f99 Fix misuse of assertTrue d2edf6646 swift-manage-shard-ranges: add 'merge' subcommand 5c6407bf5 proxy: Add a chance to skip memcache for get_*_info calls c4ff49c32 CI: Add rolling upgrade job coming from stable/yoga a9177a4b9 Add note about rsync_bwlimit suffixes da52e5675 Migrate CentOS Stream 8 FIPS job to CentOS Stream 9 d0feee190 Add MPU to s3api tests 17664cfb9 Use daemon property instead of setDaemon method 61624ab83 swift-manage-shard-ranges repair: ignore recent overlaps 38866a396 Optimize ShardRanges a little 85d063b20 ring: Have RingBuilder.debug return to old state 25463b253 sharding: Skip shards that can't include any new subdir entries ccaf49a00 Add backend rate limiting middleware fa1058b6e slo: Default allow_async_delete to true Diffstat (except docs and test files) ------------------------------------- .mailmap | 4 +- .zuul.yaml | 155 +- AUTHORS | 6 +- CHANGELOG | 95 ++ CONTRIBUTING.rst | 4 +- bin/swift-drive-audit | 4 + bindep.txt | 2 +- etc/account-server.conf-sample | 14 +- etc/container-server.conf-sample | 20 +- etc/object-server.conf-sample | 17 +- etc/proxy-server.conf-sample | 4 +- lower-constraints.txt | 8 +- py2-constraints.txt | 7 +- py36-constraints.txt | 3 - .../notes/2_31_0_release-77e6b20dfba3b32c.yaml | 118 ++ releasenotes/source/index.rst | 2 + .../locale/en_GB/LC_MESSAGES/releasenotes.po | 164 ++- releasenotes/source/zed.rst | 6 + setup.cfg | 23 +- swift/__init__.py | 10 +- swift/account/auditor.py | 7 +- swift/account/reaper.py | 17 +- swift/cli/dispersion_report.py | 7 +- swift/cli/manage_shard_ranges.py | 222 ++- swift/common/db.py | 19 +- swift/common/db_auditor.py | 19 +- swift/common/error_limiter.py | 93 ++ swift/common/http_protocol.py | 326 +++++ swift/common/memcached.py | 118 +- swift/common/middleware/backend_ratelimit.py | 86 ++ swift/common/middleware/formpost.py | 26 +- swift/common/middleware/memcache.py | 96 +- .../middleware/s3api/controllers/multi_upload.py | 20 +- swift/common/middleware/s3api/etree.py | 2 +- swift/common/middleware/s3api/exception.py | 4 - swift/common/middleware/s3api/s3api.py | 3 + swift/common/middleware/s3api/s3request.py | 18 +- swift/common/middleware/slo.py | 4 +- .../common/middleware/versioned_writes/__init__.py | 3 + swift/common/ring/builder.py | 4 +- swift/common/swob.py | 3 + swift/common/utils.py | 354 ++++- swift/common/wsgi.py | 266 +--- swift/container/backend.py | 108 +- swift/container/sharder.py | 510 +++++-- swift/container/updater.py | 12 +- swift/obj/auditor.py | 4 + swift/obj/diskfile.py | 14 + swift/obj/reconstructor.py | 19 +- swift/obj/replicator.py | 19 +- swift/obj/ssync_sender.py | 18 +- swift/obj/updater.py | 19 +- swift/proxy/controllers/base.py | 162 +-- swift/proxy/controllers/container.py | 297 ++-- swift/proxy/controllers/obj.py | 113 +- swift/proxy/server.py | 124 +- test-requirements.txt | 7 +- test/__init__.py | 55 +- test/functional/__init__.py | 3 +- test/functional/s3api/test_object.py | 51 +- test/functional/s3api/test_presigned.py | 30 + test/functional/s3api/test_xxe_injection.py | 231 +++ test/probe/brain.py | 5 +- test/probe/common.py | 22 + test/probe/test_sharder.py | 335 ++++- test/s3api/__init__.py | 4 + test/s3api/test_mpu.py | 140 ++ test/s3api/test_request_target_style.py | 56 + test/unit/__init__.py | 4 - test/unit/account/test_auditor.py | 6 +- test/unit/cli/test_manage_shard_ranges.py | 625 +++++++- test/unit/common/middleware/helpers.py | 4 +- test/unit/common/middleware/s3api/__init__.py | 5 + .../common/middleware/s3api/test_multi_delete.py | 40 + test/unit/common/middleware/s3api/test_s3token.py | 12 +- .../common/middleware/test_backend_ratelimit.py | 170 +++ test/unit/common/middleware/test_formpost.py | 32 +- test/unit/common/middleware/test_memcache.py | 214 +-- test/unit/common/middleware/test_slo.py | 10 +- test/unit/common/test_db.py | 23 +- test/unit/common/test_db_replicator.py | 93 +- test/unit/common/test_error_limiter.py | 99 ++ test/unit/common/test_http_protocol.py | 454 ++++++ test/unit/common/test_manager.py | 6 +- test/unit/common/test_memcached.py | 276 ++++ test/unit/common/test_storage_policy.py | 5 +- test/unit/common/test_utils.py | 537 ++++++- test/unit/common/test_wsgi.py | 335 +---- test/unit/container/test_backend.py | 125 +- test/unit/container/test_server.py | 15 +- test/unit/container/test_sharder.py | 1526 +++++++++++++++++--- test/unit/helpers.py | 8 +- test/unit/obj/common.py | 1 + test/unit/obj/test_auditor.py | 31 +- test/unit/obj/test_diskfile.py | 36 +- test/unit/obj/test_replicator.py | 24 +- test/unit/obj/test_server.py | 10 +- test/unit/obj/test_ssync.py | 1 + test/unit/proxy/controllers/test_base.py | 56 +- test/unit/proxy/controllers/test_container.py | 583 +++++++- test/unit/proxy/controllers/test_obj.py | 26 +- test/unit/proxy/test_server.py | 619 ++++++-- tools/playbooks/common/install_dependencies.yaml | 24 +- tools/playbooks/multinode_setup/common_config.yaml | 4 +- tools/playbooks/multinode_setup/make_rings.yaml | 8 +- tools/playbooks/multinode_setup/run.yaml | 2 +- .../templates/make_multinode_rings.j2 | 2 +- .../saio_single_node_setup/setup_saio.yaml | 14 +- tools/test-setup.sh | 12 + tox.ini | 43 +- 117 files changed, 8657 insertions(+), 2648 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 7eb48af72..488080ae5 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7,4 +7,3 @@ hacking>=2.0,<2.1.0 # Apache-2.0 -coverage>=3.6 # Apache-2.0 -nose>=1.3.7 # LGPL -nosexcover>=1.0.10 # BSD -nosehtmloutput>=0.0.3 # Apache-2.0 +coverage>=5.0.4 # Apache-2.0 +pytest>=4.6.11 # MIT +pytest-cov>=2.12.1 # MIT

1 0

ironic 21.3.0 (antelope)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We exuberantly announce the release of: ironic 21.3.0: OpenStack Bare Metal Provisioning This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 21.3.0 ^^^^^^ New Features ************ * Adds API version "1.81" which enables fetching node inventory which might have been stored during introspection * Adds verify step and node vendor passthru method to deal with a firmware incompatibility issue with iRMC versions S6 2.00 and later in which HTTP connection to REST API is not supported and HTTPS connections to REST API is required. Verify step checks connection to iRMC REST API and if connection succeeds, it fetches version of iRMC firmware and store it in "driver_internal_info/irmc_fw_version". Ironic operators use node vendor passthru method to fetch & update iRMC firmware version cached in "driver_internal_info/irmc_fw_version". Upgrade Notes ************* * Since iRMC versions S6 2.00 and later, iRMC firmware doesn't support HTTP connection to REST API. Operators need to set "[irmc] port" in ironic.conf or "driver_info/irmc_port" to 443. * When Ironic operator uses irmc driver against Fujitsu server which runs iRMC version S6 2.00 or later, operator may need to set Redfish parameters in "driver_info" so this fix can operate properly or operator should enable IPMI over LAN through BMC settings, if possible. Bug Fixes ********* * Fixes an issue where if selinux is enabled and enforcing, and the published image is a hardlink, the source selinux context is preserved, causing access denied when retrieving the image using hardlink URL. * Fixes the default value for the "[DEFAULT]grub_config_path" variable to be the default path for UEFI bootloader configurations, where as the default was previously the BIOS grub2 configuration path. * Fixes a firmware incompatibility issue with iRMC versions S6 2.00 and later now doesn't support IPMI over LAN by default. To deal with this problem, irmc driver first tries IPMI operation then, if IPMI operation fails, it tries Redfish API of Fujitsu server. The operator must set Redfish parameters in the "driver_info" if iRMC disable or doesn't support IPMI over LAN. * Fixes "'NoneType' object is not iterable" in conductor logs for "redfish" and "idrac-redfish" RAID clean and deploy steps. The message should no longer appear. For affected nodes re-create the node or delete "raid_configs" entry from "driver_internal_info" field. Changes in ironic 21.2.0..21.3.0 -------------------------------- fbe22b23b Move and fix reno config for releasenotes job 692a383fd [CI] Swap anaconda urls b63d15ccd Make reno ignore bugfix eol tags 38777e503 Clarify release docs: bugfix releases optional fe69e06c7 Reorganise Inventory Storage 8604a799a Docs: Troubleshooting: how to exit clean failed f8608dbd9 Use new get_rpc_client API from oslo.messaging 9a85e4787 CI: Fix race prone unit test in networking f11321099 Create [inventory] d23f72ee5 [iRMC] Handle IPMI incompatibility in iRMC S6 2.x eae33a0ac [iRMC] identify BMC firmware version 2e80ea909 API for node inventory c05c09fd3 Fix selinux context of published image hardlink 2f4a156d2 Fix grub config path default 5cd7bfc52 Docs: Add considerations to anaconda docs 05f6003fe [DOC] Add entry regarding cleaning+raid ca5ed66d5 setup.py: Remove 'py_modules' 0230d361f CI: Reset VM footprint to 2.6GB 1d07be823 Use centos grub artifacts with centos ramdisk for vmedia cab04afe6 Create IRONIC_VM_MACS_CSV_FILE if it does not exist 7150478cd Fix unbound variable in devstack plugin 93158aadd Use tinycore 13 for base ramdisk image 6b84fbf8f Fix CI facd1bca6 Remove lib/neutron-legacy leftovers 17c9e58c9 Fix "'NoneType' object is not iterable" in RAID ef772c2c1 Fixes for tox 4.0 8b00932e4 Use association_proxy for ports node_uuid 44ccc397c Add doc for lsblk: /dev/nvme0n1p2: not a block device 973d3b6ea Enable alternative storage for inventory Diffstat (except docs and test files) ------------------------------------- .../source/baremetal-api-v1-nodes-inventory.inc | 40 +++ api-ref/source/parameters.yaml | 12 + .../source/samples/node-inventory-response.json | 31 ++ devstack/lib/ironic | 21 +- devstack/plugin.sh | 2 +- devstack/upgrade/upgrade.sh | 2 +- ironic/api/controllers/v1/node.py | 25 +- ironic/api/controllers/v1/port.py | 8 +- ironic/api/controllers/v1/utils.py | 5 + ironic/api/controllers/v1/versions.py | 4 +- ironic/common/policy.py | 13 + ironic/common/release_mappings.py | 4 +- ironic/common/rpc.py | 7 +- ironic/common/swift.py | 42 +++ ironic/conf/__init__.py | 2 + ironic/conf/default.py | 2 +- ironic/conf/inventory.py | 34 +++ ironic/conf/opts.py | 1 + ironic/db/sqlalchemy/api.py | 4 +- ironic/db/sqlalchemy/models.py | 10 + ironic/drivers/irmc.py | 6 + ironic/drivers/modules/image_utils.py | 10 + ironic/drivers/modules/inspect_utils.py | 87 ++++++ ironic/drivers/modules/inspector.py | 14 +- ironic/drivers/modules/irmc/common.py | 219 +++++++++++++ ironic/drivers/modules/irmc/inspect.py | 89 ++++-- ironic/drivers/modules/irmc/management.py | 287 +++++++++++++++--- ironic/drivers/modules/irmc/power.py | 57 +++- ironic/drivers/modules/irmc/vendor.py | 75 +++++ ironic/drivers/modules/redfish/raid.py | 8 +- ironic/objects/port.py | 8 +- .../unit/drivers/modules/irmc/test_inspect.py | 107 ++++++- .../unit/drivers/modules/irmc/test_management.py | 337 ++++++++++++++++++++- .../unit/drivers/modules/network/test_common.py | 4 +- .../unit/drivers/modules/redfish/test_raid.py | 4 + .../unit/drivers/modules/test_inspect_utils.py | 121 ++++++++ .../unit/drivers/third_party_driver_mock_specs.py | 2 + releasenotes/config.yaml | 5 + .../notes/add-node-inventory-7cde961b14caa11e.yaml | 5 + ...ix-context-image-hardlink-16f452974abc7327.yaml | 7 + ...ix-grub2-uefi-config-path-f1b4c5083cc97ee5.yaml | 14 + ...2.00-http-incompatibility-61a31d12aa33fbd8.yaml | 19 ++ ...2.00-ipmi-incompatibility-118484a424df02b1.yaml | 15 + ...pe-object-is-not-iterable-0592926d890d6c11.yaml | 7 + reno.yaml | 4 - requirements.txt | 2 +- setup.cfg | 1 + setup.py | 4 +- tox.ini | 12 +- zuul.d/ironic-jobs.yaml | 10 +- 67 files changed, 2303 insertions(+), 209 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8a57727ec..0c73e632e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -42 +42 @@ keystonemiddleware>=9.5.0 # Apache-2.0 -oslo.messaging>=5.29.0 # Apache-2.0 +oslo.messaging>=14.1.0 # Apache-2.0

1 0

glance 24.2.0 (yoga)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are jazzed to announce the release of: glance 24.2.0: OpenStack Image Service This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. 24.2.0 ^^^^^^ Upgrade Notes ************* * The Image service API call "DELETE /v2/cache/{image_id}" and "DELETE /v2/cache" now returns a 204 (No Content) response code to indicate success. In glance 24.0.0 (the initial Yoga release), it had mistakenly returned a 200. Bug Fixes ********* * Bug #1979699 (https://bugs.launchpad.net/glance/+bug/1979699) Fix the "glance-cache-prefetcher" command to set up access to backend stores when the multi store feature is used. * Bug 1980049 (https://bugs.launchpad.net/glance/+bug/1980049) Fixed the success response code of the REST API call "DELETE /v2/cache/{image_id}" and "DELETE /v2/cache" to be 204 (No Content), following the original design of the feature. Changes in glance 24.1.0..24.2.0 -------------------------------- 3f6c689b Fix tox4 error dc8e5a5c Enforce image safety during image_conversion 5fbf4737 [stable-only] Remove glance-code-constants-check f3ae67fa Mock getaddrinfo in cinder store tests 20110a7d Fix tests for logging connection info b4091752 glance-cache-prefetcher: Set up access to multistore backends ea4ed6df [APIImpact] Correct API response code for DELETE cache APIs Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 19 --------- glance/api/v2/cached_images.py | 6 +++ glance/async_/flows/plugins/image_conversion.py | 23 +++++++++++ glance/cmd/cache_prefetcher.py | 12 ++++-- glance/common/config.py | 12 ++++++ .../v2/test_legacy_update_cinder_store.py | 31 ++++++++++---- .../async_/flows/plugins/test_image_conversion.py | 47 ++++++++++++++++++++++ .../notes/bug-1979699-70182ec2aead0383.yaml | 6 +++ .../notes/bug-1980049-623d2eb0fa074136.yaml | 14 +++++++ tox.ini | 5 ++- 11 files changed, 145 insertions(+), 34 deletions(-)

1 0

glance 23.1.0 (xena)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are overjoyed to announce the release of: glance 23.1.0: OpenStack Image Service This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/glance Download the package from: https://tarballs.openstack.org/glance/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. 23.1.0 ^^^^^^ Bug Fixes * Bug #1979699 (https://bugs.launchpad.net/glance/+bug/1979699) Fix the "glance-cache-prefetcher" command to set up access to backend stores when the multi store feature is used. Changes in glance 23.0.0..23.1.0 -------------------------------- e45a32d1 Fix tox4 error f45b5f02 Enforce image safety during image_conversion 2281c086 Fix unintentional exception inspecting VMDK 3cfbb69c [stable-only] Remove glance-code-constants-check fc9a53d2 Fix failing namespace list delete race 2f125d83 glance-cache-prefetcher: Set up access to multistore backends 316ce965 Fix set_property_atomic() boolean type casting e1a66af4 [CI] Add upper constraints to install command 965a9783 Add "bochs" as a possible video model 881b24a2 Update qcow test to use qcow2 instead b76dd788 [stable-only] Specify openstacksdk stable branch Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 29 +++++-------- etc/metadefs/compute-libvirt-image.json | 3 +- glance/api/v2/metadef_namespaces.py | 8 +++- glance/async_/flows/plugins/image_conversion.py | 23 +++++++++++ glance/cmd/cache_prefetcher.py | 12 ++++-- glance/common/config.py | 12 ++++++ glance/common/format_inspector.py | 2 +- glance/db/sqlalchemy/api.py | 10 ++--- .../async_/flows/plugins/test_image_conversion.py | 47 ++++++++++++++++++++++ .../notes/bug-1979699-70182ec2aead0383.yaml | 6 +++ tox.ini | 13 +++--- 15 files changed, 187 insertions(+), 40 deletions(-)

1 0

python-openstackclient 5.6.1 (xena)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We enthusiastically announce the release of: python-openstackclient 5.6.1: OpenStack Command-line Client This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/python-openstackclient Download the package from: https://pypi.org/project/python-openstackclient Please report issues through: https://storyboard.openstack.org/#!/project/openstack/python- openstackclient For more details, please see below. 5.6.1 ^^^^^ New Features ************ * Add support for compute API microversion 2.47, which changes how flavor details are included in server detail responses. In 2.46 and below, only the flavor ID was shown in the server detail response. Starting in 2.47, flavor information is embedded in the server response. The newer behavior is now supported. Bug Fixes ********* * Filtering servers by tags ("server list --tag", "server list --not- tag") now works correctly. [Bug 1946816 (https://bugs.launchpad.net/bugs/1946816) * Fixed create image from volume command. If user wants to pass "visibility" and "protected" fields, they need to specify volume microversion 3.1 or greater by passing "os-volume-api-version 3.1" with the command. Changes in python-openstackclient 5.6.0..5.6.1 ---------------------------------------------- db417598 compute: Require image when rebuilding a volume-backed server 665d93ff Fix: create image from volume command cde8db3d Stop testing lower-constraints 0873e758 compute: Show flavor in 'server list' with API >= 2.47 f4adbcef compute: Reorder building of columns for 'server list' e53d034f Fix typo error in listing server's column name cbc64f94 compute: Fix filtering servers by tags ec637205 Update TOX_CONSTRAINTS_FILE for stable/xena 33b627bd Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 1 - lower-constraints.txt | 98 ---- openstackclient/compute/v2/server.py | 226 ++++---- openstackclient/image/v2/image.py | 18 +- .../notes/bug-1946816-7665858605453578.yaml | 6 + ...er-list-microversion-2.47-af200e9bb4747e2d.yaml | 8 + ...-image-create-from-volume-c573e553161605c4.yaml | 7 + requirements.txt | 4 + tox.ini | 14 +- 12 files changed, 617 insertions(+), 453 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 0ac991da..d3155a25 100644 --- a/requirements.txt +++ b/requirements.txt @@ -0,0 +1,4 @@ +# Requirements lower bounds listed here are our best effort to keep them up to +# date but we do not test them so no guarantee of having them all correct. If +# you find any incorrect lower bounds, let us know or propose a fix. +

1 0

openstacksdk 0.62.0 (yoga)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are happy to announce the release of: openstacksdk 0.62.0: An SDK for building applications to work with OpenStack This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/openstacksdk Download the package from: https://pypi.org/project/openstacksdk Please report issues through: https://storyboard.openstack.org/#!/project/openstack/openstacksdk For more details, please see below. Changes in openstacksdk 0.61.0..0.62.0 -------------------------------------- 4ceff8f3 Replace deprecated inspect.getargspec call f41a2039 Update tox.ini for tox v4 compatibility fd300de6 Update TOX_CONSTRAINTS_FILE for stable/yoga d17fbb98 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + openstack/cloud/_utils.py | 2 +- tox.ini | 21 +++++++++++++-------- 3 files changed, 15 insertions(+), 9 deletions(-)

1 0

swift 2.29.2 (yoga)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are excited to announce the release of: swift 2.29.2: OpenStack Object Storage This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/swift Download the package from: https://tarballs.openstack.org/swift/ Please report issues through: https://bugs.launchpad.net/swift/+bugs For more details, please see below. 2.29.2 ^^^^^^ Security Issues *************** * Fixed a security issue in how "s3api" handles XML parsing that allowed authenticated S3 clients to read arbitrary files from proxy servers. Refer to CVE-2022-47950 for more information. * Constant-time string comparisons are now used when checking S3 API signatures. Bug Fixes ********* * Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14, and 3.10.6 that could cause some "domain_remap" requests to be routed to the wrong object. * Improved compatibility with certain FIPS-mode-enabled systems. Changes in swift 2.29.1..2.29.2 ------------------------------- 198798312 Authors/ChangeLog for 2.29.2 d8d04ef43 s3api: Prevent XXE injections e84cd4414 Fix docs build 8cf39653d [stable-only] Pin tox<4 for stable branches (<=stable/zed) testing eb994ea50 CI: pin tox at the project level a6a85919a Inline parse_request from cpython 4d6d6ba51 Extract SwiftHttpProtocol to its own module 5f45626fc playbooks: replace ansible_ssh_user with ansible_user 10849f049 py2constraints: pin PasteDeploy version 3e6ce930b CI: Add nslookup_target to FIPS jobs 00763d5a0 Stop partial()ing hashlib.new 7c888bf6c tests: Fix swiftclient/requests log level & Ignore py36 deprecation warnings 36ebcc848 s3api: Use constant-time string comparisons in check_signature 687515c06 Update TOX_CONSTRAINTS_FILE for stable/yoga 59e7ddd1b Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 8 +- AUTHORS | 1 + CHANGELOG | 16 + py2-constraints.txt | 1 + .../notes/2_29_2_release-de619e50f10cc413.yaml | 20 + swift/__init__.py | 10 +- swift/common/http_protocol.py | 320 ++++++++++++++++ swift/common/middleware/s3api/etree.py | 2 +- swift/common/middleware/s3api/s3request.py | 7 +- swift/common/middleware/tempurl.py | 3 +- swift/common/wsgi.py | 234 +----------- test/__init__.py | 4 + test/functional/__init__.py | 3 +- test/functional/s3api/test_xxe_injection.py | 231 ++++++++++++ test/probe/test_sharder.py | 9 +- .../common/middleware/s3api/test_multi_delete.py | 40 ++ .../unit/common/middleware/s3api/test_s3request.py | 11 + test/unit/common/test_http_protocol.py | 412 +++++++++++++++++++++ test/unit/common/test_wsgi.py | 335 +---------------- test/unit/helpers.py | 2 +- test/unit/proxy/test_server.py | 3 +- tools/playbooks/common/install_dependencies.yaml | 20 +- tools/playbooks/dsvm/pre.yaml | 8 +- tools/playbooks/multinode_setup/common_config.yaml | 4 +- tools/playbooks/multinode_setup/make_rings.yaml | 8 +- tools/playbooks/multinode_setup/pre.yaml | 8 +- tools/playbooks/multinode_setup/run.yaml | 2 +- .../templates/make_multinode_rings.j2 | 2 +- .../saio_single_node_setup/setup_saio.yaml | 14 +- tox.ini | 7 +- 31 files changed, 1139 insertions(+), 607 deletions(-)

1 0

swift 2.30.1 (zed)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are satisfied to announce the release of: swift 2.30.1: OpenStack Object Storage This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/swift Download the package from: https://tarballs.openstack.org/swift/ Please report issues through: https://bugs.launchpad.net/swift/+bugs For more details, please see below. 2.30.1 ^^^^^^ Security Issues *************** * Fixed a security issue in how "s3api" handles XML parsing that allowed authenticated S3 clients to read arbitrary files from proxy servers. Refer to CVE-2022-47950 for more information. Bug Fixes ********* * Fixed a path-rewriting bug introduced in Python 3.7.14, 3.8.14, 3.9.14, and 3.10.6 that could cause some "domain_remap" requests to be routed to the wrong object. Changes in swift 2.30.0..2.30.1 ------------------------------- fbec7694e Authors/ChangeLog for 2.30.1 041cb672e tests: Ensure XXE injection tests have config loaded d444fc73b Fix docs build 8dd96470a s3api: Prevent XXE injections a2d363de6 [stable-only] Pin tox<4 for stable branches (<=stable/zed) testing 191bb266d CI: pin tox at the project level 5637dddcd CI: Pin tox<4 on stable branches aa81e4f2b Inline parse_request from cpython f37cf45f7 Extract SwiftHttpProtocol to its own module c8662c6f0 Mark rolling-upgrade job non-voting 88e3f7be9 Fix Zed CI 6fd031055 Migrate CentOS Stream 8 FIPS job to CentOS Stream 9 49d35e0c3 Update TOX_CONSTRAINTS_FILE for stable/zed 86c46d614 Update .gitreview for stable/zed Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .mailmap | 1 + .zuul.yaml | 75 ++-- AUTHORS | 3 +- CHANGELOG | 13 +- py2-constraints.txt | 1 + .../notes/2_30_1_release-856dd70ec466aa74.yaml | 13 + swift/__init__.py | 10 +- swift/common/http_protocol.py | 320 ++++++++++++++++ swift/common/middleware/s3api/etree.py | 2 +- swift/common/wsgi.py | 234 +----------- test/functional/__init__.py | 3 +- test/functional/s3api/test_xxe_injection.py | 231 ++++++++++++ .../common/middleware/s3api/test_multi_delete.py | 40 ++ test/unit/common/test_http_protocol.py | 412 +++++++++++++++++++++ test/unit/common/test_wsgi.py | 335 +---------------- test/unit/helpers.py | 2 +- test/unit/proxy/test_server.py | 3 +- tools/playbooks/common/install_dependencies.yaml | 20 +- tools/playbooks/dsvm/pre.yaml | 8 +- tools/playbooks/multinode_setup/common_config.yaml | 4 +- tools/playbooks/multinode_setup/make_rings.yaml | 8 +- tools/playbooks/multinode_setup/pre.yaml | 8 +- tools/playbooks/multinode_setup/run.yaml | 2 +- .../templates/make_multinode_rings.j2 | 2 +- .../saio_single_node_setup/setup_saio.yaml | 14 +- tools/test-setup.sh | 12 + tox.ini | 7 +- 29 files changed, 1155 insertions(+), 637 deletions(-)

1 0

ironic-inspector 11.3.0 (antelope)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are satisfied to announce the release of: ironic-inspector 11.3.0: Hardware introspection for OpenStack Bare Metal This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic-inspector Download the package from: https://tarballs.openstack.org/ironic-inspector/ Please report issues through: https://storyboard.openstack.org/#!/project/944 For more details, please see below. 11.3.0 ^^^^^^ Upgrade Notes ************* * The minimum version of SQLAlchemy is now "1.4.0", in preparation for the future anticipated release of SQLAlchemy "2.0.0". * The minimum version of Oslo.DB is now "12.1.0", in preparation for the future anticipated release of SQLAlchemy "2.0.0". * Database schema upgrades from versions prior to "7.3.0" are not supported. Please upgrade to an intermediate release prior to upgrading to this release. Deprecation Notes ***************** * Plugin maintainers should be aware that the Node Cache object field "version_id" filed is no longer in use. It is still returned by the data model if stored for the purposes of compatability, but Inspector will not update the field through the normal course of it's operation. Bug Fixes ********* * Fixes an issue where database responses of nodes would get orphaned in inspector process RAM, and would not be garbage collected. We were able to discover and reproduce this issue while working on database connectivity locks remaining in place. Please see story 2009727 (https://storyboard.openstack.org/#!/story/2009727) for more details. Other Notes *********** * Plugin maintainers who are directly working with the database will need to update their plugins. Specifically the Database API has been delineated into using "enginefacade" with a dedicated reader and writer model, in anticipation of support for SQLAlchemy 2.0 and an eventual merge of Inspector into Ironic at some point in the future. Database actions are now performed through the "ironic_inspector.db.api" module, where previously they were spread across "ironic_inspector.db" and "ironic_inspector.node_cache". Changes in ironic-inspector 11.2.0..11.3.0 ------------------------------------------ 20797f0 Stop gating on unit test coverage e1f3b71 Make reno ignore bugfix eol tags 84b5f8c Use new get_rpc_client API from oslo.messaging f853061 setup.py: Remove 'py_modules' cb1e856 Rename NodeInfo._lock to avoid conflict with Mock._lock in tests 0f5bbf6 Fix tox4 and setuptools errors dac7f02 Remove lib/neutron-legacy leftovers 3fe42b5 SQLAlchemy 2.0 Support Diffstat (except docs and test files) ------------------------------------- devstack/upgrade/upgrade.sh | 2 +- ironic_inspector/cmd/dbsync.py | 4 +- ironic_inspector/common/rpc.py | 2 +- ironic_inspector/conductor/manager.py | 8 +- ironic_inspector/db/__init__.py | 19 + ironic_inspector/{ => db}/alembic.ini | 0 ironic_inspector/db/api.py | 637 +++++++++++++++++++++ ironic_inspector/db/migration.py | 118 ++++ ironic_inspector/{ => db}/migrations/env.py | 36 +- .../{ => db}/migrations/script.py.mako | 0 .../18440d0834af_introducing_the_aborting_state.py | 59 ++ .../2970d2d44edc_add_manage_boot_to_nodes.py | 0 .../versions/578f84f38d_inital_db_schema.py | 0 .../882b2d84cb1b_attribute_constraints_relaxing.py | 0 ...5109d5063a_added_scope_column_to_rules_table.py | 0 .../bf8dec16023c_add_introspection_data_table.py | 0 ...d00d6e3f38c4_change_created_finished_at_type.py | 0 ...2e48801c8ef_introducing_node_state_attribute.py | 0 .../migrations/versions/d588418040d_add_rules.py | 0 ...9a4a81d88_add_invert_field_to_rule_condition.py | 0 ironic_inspector/{db.py => db/model.py} | 91 +-- .../18440d0834af_introducing_the_aborting_state.py | 43 -- ironic_inspector/node_cache.py | 311 +++++----- ironic_inspector/plugins/introspection_data.py | 8 +- ironic_inspector/process.py | 12 +- ironic_inspector/rules.py | 63 +- ironic_inspector/test/base.py | 93 ++- ironic_inspector/test/functional.py | 23 +- ironic_inspector/test/unit/db/__init__.py | 0 ironic_inspector/test/unit/db/test_api.py | 146 +++++ .../test/unit/{ => db}/test_migrations.py | 11 +- ironic_inspector/test/unit/test_db.py | 80 --- ironic_inspector/test/unit/test_introspect.py | 4 +- ironic_inspector/test/unit/test_manager.py | 7 - ironic_inspector/test/unit/test_node_cache.py | 399 +++++-------- .../test/unit/test_plugins_introspection_data.py | 15 +- ironic_inspector/test/unit/test_process.py | 24 +- ironic_inspector/test/unit/test_rules.py | 16 +- ironic_inspector/test/unit/test_utils.py | 1 + ironic_inspector/utils.py | 26 + releasenotes/config.yaml | 2 + ...qlalchemy-minimum-version-cd34a2e10d7946fd.yaml | 37 ++ requirements.txt | 6 +- setup.py | 3 +- tox.ini | 9 +- zuul.d/project.yaml | 4 +- 46 files changed, 1519 insertions(+), 800 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d09d388..5d1c2de 100644 --- a/requirements.txt +++ b/requirements.txt @@ -27 +27 @@ oslo.context>=2.22.0 # Apache-2.0 -oslo.db>=6.0.0 # Apache-2.0 +oslo.db>=12.1.0 # Apache-2.0 @@ -30 +30 @@ oslo.log>=4.3.0 # Apache-2.0 -oslo.messaging>=5.32.0 # Apache-2.0 +oslo.messaging>=14.1.0 # Apache-2.0 @@ -40 +40 @@ stevedore>=1.20.0 # Apache-2.0 -SQLAlchemy>=1.2.19 # MIT +SQLAlchemy>=1.4.0 # MIT

1 0

ironic-python-agent 9.3.0 (antelope)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are thrilled to announce the release of: ironic-python-agent 9.3.0: Ironic Python Agent Ramdisk This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- python-agent For more details, please see below. 9.3.0 ^^^^^ New Features * Ramdisk log collection now uses the hardware managers mechanism. You can provide a *collect_system_logs* call to extend the collection process. Changes in ironic-python-agent 9.2.0..9.3.0 ------------------------------------------- f8fc7e5 Make reno ignore bugfix eol tags c26f498 Make logs collection a hardware manager call f2b4ac8 Readd usedevelop true to tox.ini 7f69144 Remove old, unused proxy.sh file 39b6553 Fix for tox4 and setuptools 1846d6f modify error word node 3ded705 Fixes for tox 4.0 604c708 Fix create configuration unit tests Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/hardware.py | 71 +++++++++++++ ironic_python_agent/utils.py | 73 ++----------- proxy.sh | 6 -- releasenotes/config.yaml | 2 + .../notes/collect-manager-a80bcf370048eeec.yaml | 5 + setup.py | 1 + tox.ini | 17 +-- zuul.d/ironic-python-agent-jobs.yaml | 1 - 11 files changed, 177 insertions(+), 171 deletions(-)

1 0

openstack-ansible 24.5.1 (xena)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are amped to announce the release of: openstack-ansible 24.5.1: Ansible playbooks for deploying OpenStack This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ Please report issues through: https://bugs.launchpad.net/openstack-ansible/+bugs For more details, please see below. 24.5.1 ^^^^^^ Security Issues * This release includes SHA bump for Cinder, Nova and Glance that covers OSSA-2023-002 vulnarability (CVE-2022-47951). Changes in openstack-ansible 24.5.0..24.5.1 ------------------------------------------- ea543967f Bump OSA for stable/xena to cover CVE-2022-47951 Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 22 ++++++++++---------- playbooks/defaults/repo_packages/gnocchi.yml | 4 ++-- playbooks/defaults/repo_packages/nova_consoles.yml | 4 ++-- .../defaults/repo_packages/openstack_services.yml | 24 +++++++++++----------- .../notes/ossa-2023-002-054d135e3066cca8.yaml | 5 +++++ 5 files changed, 32 insertions(+), 27 deletions(-)

1 0

trove 16.0.1 (xena)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are thrilled to announce the release of: trove 16.0.1: OpenStack DBaaS This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/trove Download the package from: https://tarballs.openstack.org/trove/ Please report issues through: https://bugs.launchpad.net/trove/+bugs For more details, please see below. 16.0.1 ^^^^^^ Bug Fixes * check if the user input is legal, currently, trove may have a RCE vulnerability. more details see: Stroy 2010004 Changes in trove 16.0.0..16.0.1 ------------------------------- d3d7fe95 Fix illegal shell characters 40191dd5 Change settings for stable/xena 425f065d Update TOX_CONSTRAINTS_FILE for stable/xena f3864fc2 Fix trove guest agent logrotate 42df2251 Update TOX_CONSTRAINTS_FILE for stable/xena a9fea95b Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 4 ++-- devstack/settings | 2 +- .../guest-agent-source-install/31-guest-agent-install | 3 ++- .../guest-agent-source-install/guest-agent.logrotate | 7 +------ .../elements/guest-agent/source-repository-guest-agent | 4 ++-- integration/scripts/trovestack | 2 +- integration/scripts/trovestack.rc | 2 +- .../notes/fix-illegal-value-be1acadc8c54c224.yaml | 6 ++++++ tox.ini | 2 +- trove/backup/service.py | 3 +++ trove/common/cfg.py | 2 +- trove/common/exception.py | 4 ++++ trove/common/utils.py | 11 +++++++++++ trove/guestagent/api.py | 1 + 16 files changed, 54 insertions(+), 16 deletions(-)

1 0

openstack-ansible 25.3.0 (yoga)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are amped to announce the release of: openstack-ansible 25.3.0: Ansible playbooks for deploying OpenStack This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ Please report issues through: https://bugs.launchpad.net/openstack-ansible/+bugs For more details, please see below. 25.3.0 ^^^^^^ New Features ************ * A new parameter *octavia_provider_network_mtu* is added to set the MTU to 1500 by default. This is important for deployments which allow jumbo frames while setting the management to the standard Ethernet MTU. The MTU can be still changed at any point during the initial octavia deployment or with the *openstack network set --mtu* command line. Upgrade Notes ************* * A new parameter *octavia_provider_network_mtu* is added to set the MTU to 1500 by default. This is important for deployments which allow jumbo frames while setting the management to the standard Ethernet MTU. The MTU can be still changed at any point during the initial octavia deployment or with the *openstack network set --mtu* command line. Security Issues *************** * Erlang version was bumped to 24.3.4.7 to cover CVE-2022-37026 which has critical severity * This release includes SHA bump for Cinder, Nova and Glance that covers OSSA-2023-002 vulnarability (CVE-2022-47951). Changes in openstack-ansible 25.2.0..25.3.0 ------------------------------------------- 97fd09387 Bump OSA for stable/yoga to cover CVE-2022-47951 ec73393e2 Bump OpenStack-Ansible Yoga 94a8e34ab Add Glance tempest plugin repo to testing SHA pins list 2868c8d8e Sync ZFS pool names a159a8808 Prevent bootstrap failure when all roles/collections are overriden 2a1830a5d Increase thread/process to 2 for keystone 87b638b9c Update tox.ini c5b601dea Install ZFS packages for bootstrap-host if needed 61a3a6e1e Unset OSA-defined variables for bootstrap 4c50d612e Disable sahara tempest tests c26717127 Install dynamic-inventory as console_script e8daf3a71 Update upgrade instructions for Yoga release f93319481 Update self version fetching mechanism Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 128 ++++++++++----------- .../reference/inventory/generate-inventory.rst | 48 +++++++- inventory/dynamic_inventory.py | 6 +- playbooks/defaults/repo_packages/gnocchi.yml | 4 +- playbooks/defaults/repo_packages/nova_consoles.yml | 4 +- .../defaults/repo_packages/openstack_services.yml | 40 +++---- .../defaults/repo_packages/openstack_testing.yml | 6 +- .../notes/erlang_cve_37026-bdf6304e7772cf29.yaml | 5 + ...der_network_mtu-parameter-62978008dfe0882e.yaml | 17 +++ .../notes/ossa-2023-002-ac8462ef3a5702ad.yaml | 5 + scripts/bootstrap-ansible.sh | 6 +- scripts/get-ansible-collection-requirements.yml | 2 +- scripts/get-ansible-role-requirements.yml | 2 +- scripts/run-upgrade.sh | 1 - setup.cfg | 4 + .../bootstrap-host/tasks/prepare_data_disk.yml | 82 +++++++------ .../templates/user_variables.aio.yml.j2 | 10 +- .../templates/user_variables_sahara.yml.j2 | 2 +- tox.ini | 4 +- 21 files changed, 248 insertions(+), 146 deletions(-)

1 0

openstacksdk 1.0.0 (antelope)
by no-reply＠openstack.org 31 Jan '23

31 Jan '23

We are amped to announce the release of: openstacksdk 1.0.0: An SDK for building applications to work with OpenStack This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/openstacksdk Download the package from: https://pypi.org/project/openstacksdk Please report issues through: https://storyboard.openstack.org/#!/project/openstack/openstacksdk For more details, please see below. 1.0.0 ^^^^^ Prelude ******* This is a final R1.0 release of the OpenStackSDK. A few technical issues caused us not to reach this milestone cleanly, therefore we decided to one more time explicitly log everything what should be considered as R1.0. For detailed list of changes please see individual release notes from 0.99.0 to 0.103.0. Most important changes are explicitly repeated here. There were issues with maintainability of multiple available access interfaces, which forced us to consider what we are able to maintain in the long run and what we can not. That means that certain things were dropped, which is why we are releasing this as a major release. R1.0 is considered as a first major release with corresponding promise regarding backwards-compatibility. New Features ************ * The "find_snapshot" and "find_backup" methods have been added to the v2 block storage proxy API. These were previously only available for the v3 proxy API. * The "openstack.image.Image.import_image" method and "import_image" image proxy method now accept the following additional paramters: * "remote_region" * "remote_image_id" * "remote_service_interface" These are required to support the "glance-download" image import method. * A number of APIs support passing an admin-only "all_projects" filter when listing certain resources, allowing you to retrieve resources from all projects rather than just the current projects. This filter is now explicitly supported at the proxy layer for services and resources that support it. These are: * Block storage (v2) * "find_snapshot" * "snapshots" * "find_volume" * "volumes" * Block storage (v3) * "find_snapshot" * "snapshots" * "find_volume" * "volumes" * Compute (v2) * "find_server" * "find_server_group" * "server_groups" * Workflow (v2) * "find_cron_triggers" * "cron_triggers" * Add BGP Speaker and BGP Peer resources, and introduce support for CRUD operations for these. Additional REST operations introduced for speakers: add_bgp_peer, remove_bgp_peer, add_gateway_network, remove_gateway_network, get_advertised_routes, get_bgp_dragents, add_bgp_speaker_to_draget, remove_bgp_speaker_from_dragent. One new REST method is added to agents to cover the features of Dynamic Routing Agents schedulers: get_bgp_speakers_hosted_by_dragent * Add "Tap Service" and "Tap Flow" resources, and introduce support for CRUD operations for these. * Adds "get_boot_device" and "get_supported_boot_devices" to "openstack.baremetal.v1.Node". * Adds "get_node_boot_device" and "get_node_supported_boot_devices" to the baremetal Proxy. * Adds "get_console" and "set_console_state" to "openstack.baremetal.v1.Node". * Adds "get_node_console", "enable_node_console" and "disable_node_console" to the baremetal Proxy. * Adds "inject_nmi" "openstack.baremetal.v1.Node". * Adds "inject_nmi_to_node" to the baremetal Proxy. * Cloud layer is now consistently returning "Resource" class objects. Previously this was not always the case. * API response caching is implemented deep inside the code which will minimize roundtrips for repeated requests. * The majority of services were verified and adapted to the latest state of the API. * Certain code reorganization to further help in code reduction has been made (metadata, tag and quota support moved to standalone common classes). * The following proxy "find_*" operations will now retrieve a detailed resource by default when retrieving by name: * Block storage (v2) * "find_volume" * "find_snapshot" * "find_backup" * Block storage (v3) * "find_volume" * "find_snapshot" * "find_backup" * "find_group" * "find_group_snapshot" * Compute (v2) * "find_image" * "find_server" * "find_hypervisor" * Add search_resources method implementing generic search interface accepting resource name (as "service.resource"), name_or_id and list of additional filters and returning 0 or many resources matching those. This interface is primarily designed to be used by Ansible modules. * Server actions such as reboot and resize will now default to the latest microversion instead of 2.1 as before. * Convert container_infrastructure_management cloud operations to rely fully on service proxy with all resource classes created. Upgrade Notes ************* * No Munch conversion and normalization of the floating ips is happening anymore. For Neutron network a pure FloatingIP object is being returned, for Nova still munch object. * The signatures of the "openstack.image.v2.import_image" has changed. All arguments except "image" and "method" are now kwarg- only. * Cloud layer methods are returning "Resource" class objects instead of "Munch" objects. In some cases this cause renaming of the attributes. "Resource" class is "Munch" compatible and allows both dictionary and attribute base access. * Some historical methods, which were never properly tested were dropped. Deprecation Notes ***************** * The following Compute service proxy methods are now deprecated: * "find_image" * "get_image" * "delete_image" * "images" These are proxy APIs for the Image service. You should use the Image service instead via the Image service proxy methods. * search_floating_ips method is deprecated and should not be used anymore. It is going to be dropped approximately after one major cycle. * "Munch" is dropped as a dependency. The project has no releases since multiple years and was causing huge performance impact already during import. This has directly no negative imapct to SDK users (it now starts faster), but in the code we copied used "Munch" pieces. They are going to be consistently eliminated in next releases. Changes in openstacksdk 0.103.0..1.0.0 -------------------------------------- 9ea832d6 Prepare release note for R1.0 6e5f34db Drop munch dependency 71dcfba0 Add Tap Services and Flows to SDK a27619cb Finish Magnum rework b66c6cc8 Add magnum cluster templates resource 289e5c2d Convert cloud layer to use COE proxy layer b8038e65 Add BGP Speakers and Peers to SDK 8a8189ad image: Prevent passing conflicts args to stage_image 6baa435a image: Remove unsupported parameters from v1 proxy e2e5042d image: Modify signatures of various image methods d99fc112 image: Remove unnecessary abstractions 6462005c image: Remove _base_proxy module 121911fe image: Reformat proxy modules 433d97c4 image: Add missing image import options e8d351dd Add typing information and documentation d6ccf29f Drop _normalize class 6a0fd31a Revert "Add 'details' parameter to various 'find' proxy methods" a79ee9ae Move _normalize_coe_* into _coe class 1046b2e3 tox: Trivial fixes bfe2c598 Move normalize_server to compute mixin ea6ed716 Move normalize security group to sg class 0ea056f3 Add query mappings for vpnaas resources a0f969cf Update tox.ini for tox v4 compatibility 3356e7ce Allow passing more arguments to create_port f075e908 compute: Pass microversion for actions f4b9cc85 Fix docs for class SecurityGroupRule f9a3cc2f Add 'details' parameter to various 'find' proxy methods 6fee18fc Add 'all_projects' support to proxy layers 0c54b099 Remove unnecessary mocks e350c80a Add missing block storage v2 'find_*' methods 6b937b2c Deprecate all of the compute image proxy APIs 0018c5df Normalise query strings passed to 'find_*' methods d1384a98 baremetal: Add Node boot_device methods 397562bc baremetal: Add Node console methods d0e89705 baremetal: Add Node.inject_nmi method ae22f153 Whitelist cloud functional tests in acceptance 31599337 Rework network functional tests 88d8d53d coe: Add support for clusters b1f15919 docs: Add overview of supported services to README 62f64754 docs: Add docstring to 'openstack' module 2267d458 Stop normalizing floating ips 6b62d281 Implement unified search_resources method 70dbcfcd Initialize tests of real clouds Diffstat (except docs and test files) ------------------------------------- README.rst | 157 ++++ .../container_infrastructure_management.rst | 35 + .../cluster.rst | 12 + .../cluster_certificate.rst | 13 + .../cluster_template.rst | 13 + .../container_infrastructure_management/index.rst | 10 + .../service.rst | 12 + .../user/resources/network/v2/bgp_speaker.rst | 12 + .../user/resources/network/v2/tap_service.rst | 12 + examples/compute/create.py | 2 +- examples/compute/find.py | 2 +- include-acceptance-regular-user.txt | 12 + openstack/__init__.py | 72 +- openstack/_services_mixin.py | 5 +- openstack/baremetal/v1/_common.py | 3 + openstack/baremetal/v1/_proxy.py | 73 +- openstack/baremetal/v1/node.py | 119 +++ openstack/block_storage/v2/_proxy.py | 122 ++- openstack/block_storage/v3/_proxy.py | 161 +++- openstack/cloud/_accelerator.py | 2 + openstack/cloud/_baremetal.py | 5 +- openstack/cloud/_block_storage.py | 2 + openstack/cloud/_coe.py | 252 ++---- openstack/cloud/_compute.py | 170 +++- openstack/cloud/_dns.py | 2 + openstack/cloud/_floating_ip.py | 159 +++- openstack/cloud/_identity.py | 2 + openstack/cloud/_image.py | 2 + openstack/cloud/_network.py | 26 +- openstack/cloud/_normalize.py | 740 ---------------- openstack/cloud/_object_store.py | 3 +- openstack/cloud/_orchestration.py | 5 +- openstack/cloud/_security_group.py | 147 +++- openstack/cloud/_shared_file_system.py | 2 + openstack/cloud/meta.py | 10 +- openstack/cloud/openstackcloud.py | 84 +- openstack/compute/v2/_proxy.py | 252 ++++-- openstack/compute/v2/server.py | 12 +- .../__init__.py | 0 .../container_infrastructure_management_service.py | 24 + .../v1/__init__.py | 0 .../v1/_proxy.py | 254 ++++++ .../v1/cluster.py | 169 ++++ .../v1/cluster_certificate.py | 32 + .../v1/cluster_template.py | 116 +++ .../v1/service.py | 38 + openstack/dns/v2/_proxy.py | 14 +- openstack/exceptions.py | 15 +- openstack/identity/v3/_proxy.py | 64 +- openstack/image/_base_proxy.py | 282 ------ openstack/image/v1/_proxy.py | 351 ++++++-- openstack/image/v2/_proxy.py | 834 +++++++++++++----- openstack/image/v2/image.py | 58 +- openstack/network/v2/_proxy.py | 584 ++++++++----- openstack/network/v2/agent.py | 13 + openstack/network/v2/bgp_peer.py | 45 + openstack/network/v2/bgp_speaker.py | 169 ++++ openstack/network/v2/load_balancer.py | 6 + openstack/network/v2/port.py | 8 +- openstack/network/v2/router.py | 4 +- openstack/network/v2/security_group_rule.py | 10 +- openstack/network/v2/tap_flow.py | 55 ++ openstack/network/v2/tap_service.py | 51 ++ openstack/network/v2/vpn_endpoint_group.py | 7 + openstack/network/v2/vpn_ike_policy.py | 5 + openstack/network/v2/vpn_ipsec_policy.py | 7 + openstack/network/v2/vpn_ipsec_site_connection.py | 10 + openstack/network/v2/vpn_service.py | 6 + openstack/proxy.py | 59 +- openstack/resource.py | 31 +- .../functional/cloud/test_cluster_templates.py | 2 +- .../cloud/test_qos_bandwidth_limit_rule.py | 2 + .../functional/cloud/test_qos_dscp_marking_rule.py | 2 + .../cloud/test_qos_minimum_bandwidth_rule.py | 2 + .../functional/network/v2/test_address_group.py | 47 +- .../functional/network/v2/test_address_scope.py | 18 +- .../network/v2/test_agent_add_remove_network.py | 34 +- .../network/v2/test_agent_add_remove_router.py | 28 +- .../network/v2/test_auto_allocated_topology.py | 44 +- .../network/v2/test_availability_zone.py | 13 +- .../functional/network/v2/test_firewall_group.py | 17 +- .../functional/network/v2/test_firewall_policy.py | 17 +- .../functional/network/v2/test_firewall_rule.py | 42 +- .../v2/test_firewall_rule_insert_remove_policy.py | 75 +- .../functional/network/v2/test_floating_ip.py | 154 ++-- .../network/v2/test_l3_conntrack_helper.py | 34 +- .../network/v2/test_local_ip_association.py | 51 +- .../network/v2/test_network_ip_availability.py | 43 +- .../network/v2/test_network_segment_range.py | 85 +- .../functional/network/v2/test_port_forwarding.py | 136 +-- .../network/v2/test_qos_bandwidth_limit_rule.py | 66 +- .../network/v2/test_qos_dscp_marking_rule.py | 41 +- .../network/v2/test_qos_minimum_bandwidth_rule.py | 66 +- .../v2/test_qos_minimum_packet_rate_rule.py | 66 +- .../functional/network/v2/test_qos_rule_type.py | 15 +- .../functional/network/v2/test_rbac_policy.py | 76 +- .../network/v2/test_router_add_remove_interface.py | 38 +- .../functional/network/v2/test_security_group.py | 29 +- .../network/v2/test_security_group_rule.py | 36 +- .../functional/network/v2/test_service_profile.py | 79 +- .../functional/network/v2/test_service_provider.py | 7 +- .../network/v2/test_subnet_from_subnet_pool.py | 25 +- .../functional/network/v2/test_subnet_pool.py | 42 +- .../unit/cloud/test_coe_clusters_certificate.py | 29 +- .../__init__.py | 0 .../v1/__init__.py | 0 .../v1/test_cluster.py | 56 ++ .../v1/test_cluster_certificate.py | 43 + .../v1/test_cluster_template.py | 98 +++ .../v1/test_proxy.py | 124 +++ .../v1/test_service.py | 49 ++ .../unit/network/v2/test_vpn_endpoint_group.py | 5 + openstack/utils.py | 195 ++++- openstack/workflow/v2/_proxy.py | 42 +- ...d-backup-find-snapshot-v2-756a05ccd150db82.yaml | 6 + ...-compute-image-proxy-apis-986263f6aa1b1b25.yaml | 12 + ...floating_ip_normalization-41e0edcdb0c98aee.yaml | 10 + ...image-import-proxy-params-f19d8b6166104ebe.yaml | 12 + ...ayer-kwarg-only-arguments-94c9b2033d386160.yaml | 5 + .../list-all_projects-filter-27f1d471a7848507.yaml | 33 + ...network_add_bgp_resources-c182dc2873d6db18.yaml | 10 + ...etwork_add_taas_resources-86a947265e11ce84.yaml | 5 + .../notes/node-boot-devices-2ab4991d75a2ab52.yaml | 8 + .../notes/node-consoles-63589f22da98a689.yaml | 8 + .../notes/node-inject-nmi-53d12681026e0b6c.yaml | 6 + releasenotes/notes/r1-d4efe289ebf0cbcd.yaml | 40 + ...ew-for-find-proxy-methods-947a3280732c448a.yaml | 25 + .../notes/search_resource-b9c2f772e01d3b2c.yaml | 7 + ...ions-microversion-support-f14b293d9c3d3d5e.yaml | 5 + .../switch-coe-to-proxy-c18789ed27cc1d95.yaml | 5 + requirements.txt | 1 - tools/print-services.py | 19 +- tox.ini | 30 +- 216 files changed, 8147 insertions(+), 4243 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 78e57b41..6dc4d905 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12 +11,0 @@ keystoneauth1>=3.18.0 # Apache-2.0 -munch>=2.1.0 # MIT

1 0

cinder-tempest-plugin 1.8.0 (antelope)
by no-reply＠openstack.org 27 Jan '23

27 Jan '23

We enthusiastically announce the release of: cinder-tempest-plugin 1.8.0: Tempest plugin tests for Cinder. This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/cinder-tempest-plugin Download the package from: https://tarballs.openstack.org/cinder-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. Changes in cinder-tempest-plugin 1.7.2..1.8.0 --------------------------------------------- 6b7ddd3 Don't test EOL cinderlib branches Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)

1 0

ironic-tempest-plugin 2.6.0 (antelope)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We contentedly announce the release of: ironic-tempest-plugin 2.6.0: Tempest plugin for ironic and ironic- inspector This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic-tempest-plugin Download the package from: https://tarballs.openstack.org/ironic-tempest-plugin/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic For more details, please see below. Changes in ironic-tempest-plugin 2.5.0..2.6.0 --------------------------------------------- 4684f91 Fix typo: BaremetalIdracRedfishConfigurationMolds 982d177 Tempest test for anaconda deploy Diffstat (except docs and test files) ------------------------------------- ironic_tempest_plugin/common/waiters.py | 35 ++++++++- ironic_tempest_plugin/config.py | 26 +++++++ ironic_tempest_plugin/exceptions.py | 5 ++ .../scenario/ironic_standalone/test_basic_ops.py | 46 ++++++++++++ .../scenario/ironic_standalone/test_cleaning.py | 2 +- zuul.d/project.yaml | 1 + 9 files changed, 208 insertions(+), 5 deletions(-)

1 0

cinder 20.1.0 (yoga)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are pleased to announce the release of: cinder 20.1.0: OpenStack Block Storage This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 20.1.0 ^^^^^^ Upgrade Notes ************* * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. Security Issues *************** * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow in order to prevent exposure of host information by modifying the named extents in a VMDK image. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. * As part of the fix for Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) cinder is now more strict in checking that the "disk_format" recorded for an image (as revealed by the Image Service API image-show response) matches what cinder detects when it downloads the image. Thus, some requests to create a volume from a source image that had previously succeeded may fail with an "ImageUnacceptable" error. Bug Fixes ********* * RBD Driver bug #1957073 (https://bugs.launchpad.net/cinder/+bug/1957073) Fixed snapshot deletion failure when its volume doesn't exist. * IBM Spectrum Virtualize Family driver: Bug #1976499 (https://bugs.launchpad.net/cinder/+bug/1976499) Setting correct SVC Code level for lsfcportsetmember call. * Bug #1978729 (https://bugs.launchpad.net/cinder/+bug/1978729) Fixed context.message_action is None on errors by backup drivers. The message_* properties of the context were not passed during rpc, which caused a double exception when a backup driver raised an exception, masking the actual backup driver exception. * Infinidat Driver bug #1981354 (https://bugs.launchpad.net/cinder/+bug/1981354) Fixed Infinidat driver to return all configured and enabled iSCSI portals for a given network space. * Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) Fixed issue where a VMDK image file whose createType allowed named extents could expose host information. This change introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats. * RBD driver bug #1916843 (https://bugs.launchpad.net/cinder/+bug/1916843) Fixed rpc timeout when backing up RBD snapshot. We no longer flatten temporary volumes and snapshots. * NFS driver bug #1946059 (https://bugs.launchpad.net/cinder/+bug/1946059) Fixed revert to snapshot operation. * Hitachi driver bug #1989176 (https://bugs.launchpad.net/cinder/+bug/1989176) Fixed Hitachi driver to output a message for resource lock correctly. * NetApp SolidFire driver Bug #1934435 (https://bugs.launchpad.net/cinder/+bug/1934435) Fixed errors that might occur when an operation is made to a volume at the same time as the Element OS upgrades. * PowerMax driver bug #1979668 (https://bugs.launchpad.net/cinder/+bug/1979668) Fixed visibility of manageable volumes in multiple storage groups. * PowerStore driver bug #1981068 (https://bugs.launchpad.net/cinder/+bug/1981068) Fixed request data validation for the REST client. Other Notes *********** * Unified how cinder calculates the virtual free storage space for a pool. Previously Cinder had 2 different mechanisms for calculating the virtual free storage. Now both the Capacity Filter and the Capacity Weigher use the same mechanism, which is based upon the defined terms in https://specs.openstack.org/openstack/cinder- specs/specs/queens/provisioning-improvements.html Changes in cinder 20.0.1..20.1.0 -------------------------------- 4cef5c0c4 Use the json format output of qemu-img info ae08757d9 Fix and unify capacity calculations 2ae5d5352 Check VMDK subformat against an allowed list 1bc0b9cab Serialize message_* properties of RequestContext f57576769 PowerStore driver - Request data validation fix 1f8016db2 Hitachi: fix to output resource lock message correctly a3c8857ee NFS: Fix generic revert to snapshot flow 6101e6a67 Increase swap size to 4GB 43fd2fadb rbd: Fix snapshot delete when the source volume doesn't exist ba15a23b7 Tests: Fix test runner never finishing 81cde9def Tests: Monkey patch before logs are loaded fc9fd8a7a Tests: Fix service stopping on cleanup bb510b64a Fix Infinidat driver to return all iSCSI portals 4de3270c9 [SVf] : Fix the SVC code level for lsfcportsetmember call 176855c28 Doc: To update the portset feature details in IBM Spectrum Virtualize user guide 44947ae1e NetApp SolidFire: Fix request errors while Element OS upgrade 014d17ef8 Log when waiting to acquire coordinator lock 164e5e22a PowerMax Driver - Add a release note for 784603 9b583401a SF: Remove compat clone image code 50c94ed09 RBD: Don't flatten temporary resources Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 + cinder/context.py | 15 +- cinder/coordination.py | 22 +- cinder/image/image_utils.py | 193 ++++++++-- cinder/scheduler/filters/capacity_filter.py | 50 ++- .../volume/drivers/solidfire/test_solidfire.py | 32 -- cinder/utils.py | 130 ++++++- .../volume/drivers/dell_emc/powerstore/client.py | 4 +- cinder/volume/drivers/hitachi/hbsd_rest_api.py | 2 +- .../ibm/storwize_svc/storwize_svc_common.py | 2 +- cinder/volume/drivers/infinidat.py | 24 +- cinder/volume/drivers/rbd.py | 67 ++-- cinder/volume/drivers/remotefs.py | 2 +- cinder/volume/drivers/solidfire.py | 49 +-- cinder/volume/flows/manager/create_volume.py | 4 +- .../configuration/tables/cinder-storwize.inc | 2 + .../notes/bug-1957073-0d1307a8637a62b7.yaml | 6 + ..._the_wrong_SVC_code_level-db06c4eca902f389.yaml | 7 + ...bug-1978729-cinder-backup-4cd87c4d71b7713e.yaml | 8 + ...nidat-iscsi-fix-multipath-3f8a0be5f541c66e.yaml | 7 + ...vmdk-subformat-allow-list-93e6943d9a486d11.yaml | 33 ++ .../ceph-backup-no-flatten-36557727e9d73b2b.yaml | 7 + .../fix-nfs-revert-to-snap-adc04204b3661d66.yaml | 6 + ...vsp-fix-resource-lock-msg-5a119426e6c65998.yaml | 6 + ...eptions-while-eos-upgrade-1e3df89b5fb79165.yaml | 7 + ...wermax-manageable-volumes-3fb4e5dcf5cc18e3.yaml | 6 + ...e-request-data-validation-6268f2ed07b7bf40.yaml | 6 + releasenotes/notes/slug-b6a0fc3db0a2dd45.yaml | 8 + 42 files changed, 1588 insertions(+), 454 deletions(-)

1 0

octavia 9.1.0 (xena)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We enthusiastically announce the release of: octavia 9.1.0: OpenStack Octavia Scalable Load Balancer as a Service This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/octavia Download the package from: https://pypi.org/project/octavia Please report issues through: https://storyboard.openstack.org/#!/project/908 For more details, please see below. 9.1.0 ^^^^^ Known Issues ************ * When using a distribution with a recent SELinux release such as CentOS 8 Stream, PING health-monitor does not work as shell_exec_t calls are denied by SELinux. * Fixed configuration issue which allowed authenticated and authorized users to inject code into HAProxy configuration using API requests. Octavia API no longer accepts unencoded whitespace characters in url_path values in update requests for healthmonitors. Upgrade Notes ************* * The fix that updates the Netfilter Conntrack Sysfs variables requires rebuilding the amphora image in order to be effective. Bug Fixes ********* * Increased the TCP buffer memory maximum and enabled MTU ICMP black hole detection. * The generated RSyslog configuration on the amphora supports now RSyslog failover with TCP if multiple RSyslog servers were specified. * In order to avoid hitting the Neutron API hard when batch update with creating many new members, we cache the subnet validation results in batch update members API call. We also change to validate new members only during batch update members since subnet ID is immutable. * Ensure that the provided rsyslog configuration file is used by the rsyslog by restarting the service, it fixes the log offloading feature on distributions that start rsyslog before cloud-init. * Ensure that the provided rsyslog configuration file is used by rsyslog in the amphora by restarting the service when using the amphorav1 provider, it fixes the log offloading feature on distributions that start rsyslog before cloud-init. * Fixed issues when building amphora image for Centos Stream 9. * Fixed issues when building amphora image for RHEL 9. * Fix an authentication error with Barbican when creating a TERMINATED_HTTPS listener with application credential tokens or trust IDs. * Correctly detect the member operating status "drain" when querying status data from HAProxy. * Fix the shutdown of the driver-agent, the process might have been stuck while waiting for threads to finish. Systemd would have killed the process after a timeout, but some children processes might have leaked on the controllers. * Enable required SELinux booleans for CentOS or RHEL amphora image. * Fixed backwards compatibility issue with the feature that preserves HAProxy server states between reloads. HAProxy version 1.5 or below do not support this feature, so Octavia will not to activate it on amphorae with those versions. * Fix a bug that prevented the provisioning_state of a health- monitor to be set to ERROR when an error occurred while creating, updating or deleting a health-monitor. * Fix an issue with IPv6 members that could have been set in operating_status "ERROR" just after being added. * Fix an issue with amphorav2 and persistence, some long tasks executed by a controller might have been released in taskflow and rescheduled on another controller. Octavia now ensures that a task is never released early by using a keepalive mechanism to notify taskflow (and its redis backend) that a job is still running. * Fixed an issue with members in ERROR operating status that may have been updated briefly to ONLINE during a Load Balancer configuration change. * Netfilter Conntrack Sysfs variables net.netfilter.nf_conntrack_max and nf_conntrack_expect_max get set to sensible values on the amphora now. Previously, kernel default values were used which were much too low for the configured net.netfilter.nf_conntrack_buckets value. As a result packets could get dropped because the conntrack table got filled too quickly. Note that this affects only UDP and SCTP protocol listeners. Connection tracking is disabled for TCP- based connections on the amphora including HTTP(S). * Fix a bug when adding a member on a subnet that belongs to a network with multiple subnets, an incorrect subnet may have been plugged in the amphora. * Fix a bug when deleting the last member plugged on a network, the port that was no longer used was not deleted. * Fix a bug when updating a load balancer with a QoS policy after a failover, Octavia attempted to update the VRRP ports of the deleted amphorae, moving the provisioning status of the load balancer to ERROR. * Fix a potential race condition when updating a resource in the amphorav2 worker. The worker was not waiting for the resource to be set to PENDING_UPDATE, so the resource may have been updated with old data from the database, resulting in a no-op update. * Fixed issue with SELinux and the lvs-masquerade.sh script on the amphora. The script already runs with root permissions, so the use of sudo inside the script is unneeded. * Fix an issue when Octavia performs a failover of an ACTIVE-STANDBY load balancer that has both amphorae missing. Some tasks in the controller took too much time to timeout because the timeout value defined in "[haproxy_amphora].active_connection_max_retries" and "[haproxy_amphora].active_connection_rety_interval" was not used. * Fix a bug that could have triggered a race condition when configuring a member interface in the amphora. Due to a race condition, a network interface might have been deleted from the amphora, leading to a loss of connectivity. * Fixed "Could not retrieve certificate" error when updating/deleting the client_ca_tls_container_ref field of a listener after a CA/CRL was deleted. * Fixed validations in L7 rule and session cookie APIs in order to prevent authenticated and authorized users to inject code into HAProxy configuration. CR and LF (\r and \n) are no longer allowed in L7 rule keys and values. The session persistence cookie names must follow the rules described in https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Set-Cookie. * Fix load balancers stuck in PENDING_UPDATE issues for some API calls (POST /l7rule, PUT /pool) when a provider denied the call. * Validate that the creation of L7 policies is compatible with the protocol of the listener in the Amphora driver. L7 policies are allowed for Terminated HTTPS or HTTP protocol listeners, but not for HTTPS, TCP or UDP protocols listeners. Other Notes *********** * The string representation of data base model objects has been improved. Calling str() on them will return a certain subset of fields and calling repr() on them will return all fields. This is helpful for debugging, but it may also change some of the log messages that Octavia emits. Changes in octavia 9.0.1..9.1.0 ------------------------------- fc55d6cf Increase TCP buffer maximum and MTU discovery bc2bded8 Handle feature compatibility of HAProxy server-state-file option e6dad97a Restart rsyslog from cloud-init in amphorav1 980b8e79 Change FIPS jobs to centos-9-stream 851510f4 Fix barbican client with application credentials/trusts c87ff96d Add *.orig to .gitignore 9c8e5e03 Fix sporadic unit test failure cde823eb Update zuul queue configuration 16fa7f8e Fix plugging member subnets on existing networks c513c9e7 Reconfigure amphora network interfaces seamlessly 9311c825 Ignore status update on deleted objects in driver-agent 15852b00 Cache subnets validation for batch member update 81cb9d5e Fix bug when rolling back prov and op status for some API calls 8b28293d Fix PortNotFound exception when updating a LB after a failover 279bc0b6 Catch exceptions on I/O in driver-agent 044de8e5 Apply openstack-selinux policies in Centos amphorae aa1c69a5 Fix update/delete listener CA/CRL error e33414db Fix driver-agent cleanup 11b9d8ae Move system scoped secure-RBAC to separate file c7aa79cd Fix HealthMonitorToErrorOnRevertTask revert method 9ed984f8 Improve string representation of DB models 4b87554b Fix potential race conditions on update requests in the v2 worker 5647db94 Fix duplicate object error messages 33eaff55 Set sensible nf_conntrack_max value in amphora 7f960f0e Correct format of release note c30aa9df Validate L7Rule value and cookie name d668e1f2 Fix new pylint issues 04207f60 Reject invalid whitespace in HM url_path value acd30aeb Remove unneeded sudo in lvs-masquerade.sh 5997304d Fix compile_amphora_details when using UDP listeners df1ecbda Deny the creation of L7Policies for HTTPS/TCP/UDP listeners 7adeb21c Fix AttributeError in exception handler edcd6931 Save the HAProxy state outside of its systemd unit 220f13f5 Restart rsyslog from cloud-init 4e1cc209 Pass timeout_dict to _get_haproxy_versions 5ade96be Fix Amphora RSyslog configuration for TCP failover 903b9a76 Use centos amphora image in the FIPS jobs 6958254a Fix ipv6 interface configuration 887ffeae Fix unplugging member ports 3a744f0c Fix amphora-agent elements for RHEL9 2f9fe00e Optimize DB object to provider dict conversions 9718e036 Fix detection of member operating status DRAIN 28220096 Fix amphora build in CentOS Stream 9 24ebc652 Preserve haproxy server states during reloads f78d7b0d Add fips jobs 58eac3d9 Update scripts to use fips allowed algorithms 987d6a34 Add keepalive for redis-based taskflow boards b47d5dfc Fix nft command line with negative priority values Diffstat (except docs and test files) ------------------------------------- .gitignore | 2 + .pylintrc | 4 - bin/create_dual_intermediate_CA.sh | 10 +- bin/create_single_CA_intermediate_CA.sh | 6 +- devstack/plugin.sh | 5 +- diskimage-create/README.rst | 2 + diskimage-create/diskimage-create.sh | 21 +- elements/amphora-agent/pkg-map | 21 + .../static/usr/local/bin/lvs-masquerade.sh | 12 +- elements/amphora-fips/README.rst | 7 + elements/amphora-fips/element-deps | 4 + elements/amphora-fips/environment.d/95-enable-fips | 28 + elements/amphora-fips/package-installs.yaml | 2 + elements/amphora-fips/pkg-map | 10 + .../amphora-fips/post-install.d/10-enable-fips | 22 + elements/amphora-selinux/README.rst | 3 + elements/amphora-selinux/element-deps | 2 + elements/amphora-selinux/package-installs.json | 4 + elements/amphora-selinux/pkg-map | 12 + .../post-install.d/50-selinux-policies | 19 + .../post-install.d/20-haproxy-tune-kernel | 9 +- .../haproxy-octavia/pre-install.d/01-repositories | 2 +- etc/policy/README.rst | 12 + etc/policy/keystone_default_roles-policy.yaml | 6 +- .../keystone_default_roles_scoped-policy.yaml | 37 + .../backends/agent/api_server/amphora_info.py | 8 +- .../backends/agent/api_server/loadbalancer.py | 14 + .../amphorae/backends/agent/api_server/osutils.py | 26 +- octavia/amphorae/backends/agent/api_server/plug.py | 78 +- .../amphorae/backends/agent/api_server/server.py | 3 +- .../api_server/templates/amphora-netns.systemd.j2 | 3 + octavia/amphorae/backends/agent/api_server/util.py | 4 + octavia/amphorae/backends/utils/haproxy_query.py | 40 +- octavia/amphorae/backends/utils/interface.py | 247 +++++- octavia/amphorae/backends/utils/interface_file.py | 106 ++- octavia/amphorae/backends/utils/network_utils.py | 3 +- octavia/amphorae/drivers/driver_base.py | 9 +- .../amphorae/drivers/haproxy/rest_api_driver.py | 104 ++- .../drivers/keepalived/vrrp_rest_driver.py | 3 +- octavia/amphorae/drivers/noop_driver/driver.py | 11 +- octavia/api/drivers/amphora_driver/v1/driver.py | 13 + octavia/api/drivers/amphora_driver/v2/driver.py | 13 + .../api/drivers/driver_agent/driver_listener.py | 99 +-- octavia/api/drivers/driver_agent/driver_updater.py | 14 +- octavia/api/drivers/utils.py | 12 +- octavia/api/v2/controllers/l7rule.py | 2 +- octavia/api/v2/controllers/listener.py | 14 +- octavia/api/v2/controllers/member.py | 40 +- octavia/api/v2/controllers/pool.py | 2 +- octavia/api/v2/types/l7rule.py | 13 +- octavia/api/v2/types/pool.py | 14 +- octavia/certificates/common/auth/barbican_acl.py | 27 +- octavia/common/base_taskflow.py | 19 +- octavia/common/constants.py | 14 +- .../jinja/haproxy/combined_listeners/jinja_cfg.py | 6 + .../haproxy/combined_listeners/templates/base.j2 | 3 + .../combined_listeners/templates/haproxy.cfg.j2 | 2 +- .../haproxy/combined_listeners/templates/macros.j2 | 5 +- .../logging/templates/10-rsyslog.conf.template | 36 +- .../templates/user_data_config_drive.template | 5 + octavia/common/validate.py | 1 + octavia/controller/worker/v1/controller_worker.py | 3 + .../controller/worker/v1/flows/amphora_flows.py | 7 +- .../worker/v1/flows/load_balancer_flows.py | 4 +- octavia/controller/worker/v1/flows/member_flows.py | 31 +- .../worker/v1/tasks/amphora_driver_tasks.py | 14 +- .../controller/worker/v1/tasks/compute_tasks.py | 6 +- .../controller/worker/v1/tasks/lifecycle_tasks.py | 2 +- .../controller/worker/v1/tasks/network_tasks.py | 257 +++++-- octavia/controller/worker/v2/controller_worker.py | 168 +++-- .../controller/worker/v2/flows/amphora_flows.py | 7 +- .../worker/v2/flows/load_balancer_flows.py | 4 +- octavia/controller/worker/v2/flows/member_flows.py | 31 +- .../worker/v2/tasks/amphora_driver_tasks.py | 16 +- .../controller/worker/v2/tasks/compute_tasks.py | 6 +- .../controller/worker/v2/tasks/lifecycle_tasks.py | 2 +- .../controller/worker/v2/tasks/network_tasks.py | 258 +++++-- octavia/db/base_models.py | 7 + octavia/db/models.py | 63 ++ octavia/network/base.py | 31 +- octavia/network/data_models.py | 5 +- .../drivers/neutron/allowed_address_pairs.py | 27 +- octavia/network/drivers/neutron/base.py | 32 + octavia/network/drivers/noop_driver/driver.py | 76 +- .../backend/agent/api_server/test_server.py | 55 +- .../api/drivers/driver_agent/test_driver_agent.py | 37 + .../backends/agent/api_server/test_amphora_info.py | 13 +- .../backends/agent/api_server/test_loadbalancer.py | 5 +- .../backends/agent/api_server/test_osutils.py | 16 + .../backends/agent/api_server/test_plug.py | 152 +++- .../amphorae/backends/utils/test_haproxy_query.py | 34 +- .../unit/amphorae/backends/utils/test_interface.py | 332 +++++++- .../amphorae/backends/utils/test_interface_file.py | 160 +++- .../drivers/haproxy/test_rest_api_driver_0_5.py | 60 +- .../drivers/haproxy/test_rest_api_driver_1_0.py | 90 ++- .../amphorae/drivers/noop_driver/test_driver.py | 4 +- .../api/drivers/amphora_driver/v1/test_driver.py | 20 +- .../api/drivers/amphora_driver/v2/test_driver.py | 20 +- .../drivers/driver_agent/test_driver_listener.py | 173 ++++- .../certificates/common/auth/test_barbican_acl.py | 3 +- .../haproxy/combined_listeners/test_jinja_cfg.py | 15 +- .../common/jinja/logging/test_logging_jinja_cfg.py | 53 +- .../unit/common/jinja/test_user_data_jinja_cfg.py | 18 +- .../sample_configs/sample_configs_combined.py | 21 +- .../common/sample_configs/sample_configs_split.py | 20 +- .../worker/v1/flows/test_amphora_flows.py | 8 +- .../worker/v1/flows/test_load_balancer_flows.py | 20 +- .../worker/v1/flows/test_member_flows.py | 25 +- .../worker/v1/tasks/test_amphora_driver_tasks.py | 18 +- .../worker/v1/tasks/test_compute_tasks.py | 41 +- .../worker/v1/tasks/test_lifecycle_tasks.py | 2 +- .../worker/v1/tasks/test_network_tasks.py | 835 ++++++++++++++++++--- .../controller/worker/v1/test_controller_worker.py | 5 + .../worker/v2/flows/test_amphora_flows.py | 4 +- .../worker/v2/flows/test_load_balancer_flows.py | 17 +- .../worker/v2/flows/test_member_flows.py | 21 +- .../worker/v2/tasks/test_amphora_driver_tasks.py | 26 +- .../worker/v2/tasks/test_compute_tasks.py | 41 +- .../worker/v2/tasks/test_lifecycle_tasks.py | 2 +- .../worker/v2/tasks/test_network_tasks.py | 803 ++++++++++++++++---- .../controller/worker/v2/test_controller_worker.py | 273 ++++++- .../drivers/neutron/test_allowed_address_pairs.py | 77 +- .../unit/network/drivers/neutron/test_base.py | 141 ++++ .../network/drivers/noop_driver/test_driver.py | 67 +- playbooks/enable-fips.yaml | 3 + ...mtu-black-hole-detection.-0640432a7202400f.yaml | 5 + ...-support-rsyslog-failover-f8bf00e0bf0fc27e.yaml | 5 + .../notes/catch_validation-27ffe48ca187c46f.yaml | 8 + ...syslog-config-is-reloaded-b4a25a98b661d0f1.yaml | 6 + ...syslog-reloaded-amphorav1-a4ec5127a459f3bf.yaml | 7 + ...o-support-centos-stream-9-e4c8599ae152d396.yaml | 4 + ...amphora-to-support-rhel-9-b10091e81b48533a.yaml | 4 + ...tial-tokens-with-barbican-3b7d13283206c124.yaml | 5 + ...ix-drain-status-detection-b9395fa4fe8c936f.yaml | 5 + ...r-agent-graceful-shutdown-daff9ffaccb09a9e.yaml | 7 + ...nforced-selinux-on-centos-27842ca6afbb500c.yaml | 4 + ...y-about-server-state-file-df70e5ac859417e2.yaml | 7 + ...itor-to-error-revert-task-feb38ba7641a4892.yaml | 6 + ...6-interface-configuration-61b1bd7d2c962cea.yaml | 5 + ...asks-with-redis-keepalive-af18211334c14f54.yaml | 8 + ...perating-status-on-reload-fe3688603bae8726.yaml | 5 + ...onntrack-max-value-in-amp-0e16eb50b42e7b58.yaml | 15 + ...x-plugging-member-subnets-8560cd9403ff79a7.yaml | 8 + ...-qos-apply-after-failover-561abbd153ab88ee.yaml | 6 + ...race-condiction-on-update-b5330c8fcf1800cd.yaml | 7 + ...ue-with-lvs-masquerade.sh-ebbb89886148c70f.yaml | 6 + ...ut-dict-in-failover-tasks-537456e0fe1d7cb8.yaml | 9 + ...x-unplugging-member-ports-262b35426e570edd.yaml | 7 + ...-update-listener-ca-error-167464debc06cba2.yaml | 5 + ...rules-and-session-cookies-cb88f3f1b90171f9.yaml | 9 + ...UPDATE-on-provider-errors-40a03adc8ef82a54.yaml | 5 + ...epresentation-of-db-model-1c4fe799186b4dea.yaml | 7 + .../ping-healthcheck-selinux-e3b7d360c8503527.yaml | 6 + ...-protocols-for-l7policies-83d678171f13136a.yaml | 7 + ...rl_path-value-in-requests-3eb3adedcd696433.yaml | 7 + zuul.d/jobs.yaml | 31 + zuul.d/projects.yaml | 8 +- 170 files changed, 5473 insertions(+), 1101 deletions(-)

1 0

trove_tempest_plugin 2.0.0 (antelope)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We enthusiastically announce the release of: trove_tempest_plugin 2.0.0: Tempest plugin for Trove project This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/trove_tempest_plugin Download the package from: https://tarballs.openstack.org/trove-tempest-plugin/ For more details, please see below. Changes in trove_tempest_plugin victoria-last..2.0.0 ---------------------------------------------------- fe377e0 Add python3.9 support 4cd62b2 setup.cfg: Replace dashes with underscores Diffstat (except docs and test files) ------------------------------------- setup.cfg | 9 ++++----- tox.ini | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-)

1 0

cinder 21.1.0 (zed)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are overjoyed to announce the release of: cinder 21.1.0: OpenStack Block Storage This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 21.1.0 ^^^^^^ Upgrade Notes ************* * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. Security Issues *************** * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow in order to prevent exposure of host information by modifying the named extents in a VMDK image. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. * As part of the fix for Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) cinder is now more strict in checking that the "disk_format" recorded for an image (as revealed by the Image Service API image-show response) matches what cinder detects when it downloads the image. Thus, some requests to create a volume from a source image that had previously succeeded may fail with an "ImageUnacceptable" error. Bug Fixes ********* * Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) Fixed issue where a VMDK image file whose createType allowed named extents could expose host information. This change introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats. Changes in cinder 21.0.0..21.1.0 -------------------------------- 11b0f97a0 Use the json format output of qemu-img info ba37dc2ea Check VMDK subformat against an allowed list Diffstat (except docs and test files) ------------------------------------- cinder/image/image_utils.py | 193 ++++++++-- cinder/volume/flows/manager/create_volume.py | 4 +- ...vmdk-subformat-allow-list-93e6943d9a486d11.yaml | 33 ++ 6 files changed, 764 insertions(+), 218 deletions(-)

1 0

nova 26.1.0 (zed)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are amped to announce the release of: nova 26.1.0: Cloud computing fabric controller This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 26.1.0 ^^^^^^ Bug Fixes ********* * Fixed when placement returns ironic nodes that have just started automatic cleaning as possible valid candidates. This is done by marking all ironic nodes with an instance on them as reserved, such that nova only makes them available once we have double checked Ironic reports the node as available. If you don't have automatic cleaning on, this might mean it takes longer than normal for Ironic nodes to become available for new instances. If you want the old behaviour use the following workaround config: *[workarounds]skip_reserve_in_use_ironic_nodes=true* * apache mod_wsgi does not support passing commandline arguments to the wsgi application that it hosts. As a result when the nova api or metadata api where run under mod_wsgi it was not posible to use multiple config files or non-default file names i.e. nova-api.conf This has been adressed by the intoduction of a new, optional, envionment varible "OS_NOVA_CONFIG_FILES". "OS_NOVA_CONFIG_FILES" is a ";" seperated list fo file path relitive to "OS_NOVA_CONFIG_DIR". When unset the default "api-paste.ini" and "nova.conf" will be used form "/etc/nova". This is supported for the nova api and nova metadata wsgi applications. Other Notes *********** * A workaround has been added to the libvirt driver to catch and pass migrations that were previously failing with the error: "libvirt.libvirtError: internal error: migration was active, but no RAM info was set" See bug 1982284 for more details. (https://bugs.launchpad.net/nova/+bug/1982284) Changes in nova 26.0.0..26.1.0 ------------------------------ 6e8ed78470 [stable-only][cve] Check VMDK create-type against an allowed list ea789a6222 Correct config help message related options c9de185ea1 Ironic nodes with instance reserved in placement d92d093418 Support multiple config file with mod_wsgi 643b0c7d35 [compute] always set instance.host in post_livemigration 74a618a811 Adds a repoducer for post live migration fail 00396fa939 Handle "no RAM info was set" migration case c3489ed5cc Remove mentions of removed scheduler filters Diffstat (except docs and test files) ------------------------------------- nova/api/openstack/wsgi_app.py | 5 +- nova/compute/manager.py | 43 ++++++++++++++-- nova/conf/compute.py | 21 ++++---- nova/conf/ironic.py | 1 + nova/conf/libvirt.py | 1 + nova/conf/mks.py | 2 + nova/conf/vmware.py | 5 ++ nova/conf/workarounds.py | 15 ++++++ .../functional/regressions/test_bug_1628606.py | 60 ++++++++++++++++++++++ nova/virt/images.py | 31 +++++++++++ nova/virt/ironic/driver.py | 26 +++++++--- nova/virt/libvirt/guest.py | 7 +++ ...andle-no-ram-info-was-set-99784934ed80fd72.yaml | 11 ++++ ...fix-ironic-scheduler-race-08cf8aba0365f512.yaml | 11 ++++ ...onfig-files-with-mod_wsgi-f114ea5fdd8b9a51.yaml | 14 +++++ 22 files changed, 392 insertions(+), 29 deletions(-)

1 0

cinder 19.2.0 (xena)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are amped to announce the release of: cinder 19.2.0: OpenStack Block Storage This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 19.2.0 ^^^^^^ Upgrade Notes ************* * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. Security Issues *************** * This release introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow in order to prevent exposure of host information by modifying the named extents in a VMDK image. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats, which do not use named extents. * As part of the fix for Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) cinder is now more strict in checking that the "disk_format" recorded for an image (as revealed by the Image Service API image-show response) matches what cinder detects when it downloads the image. Thus, some requests to create a volume from a source image that had previously succeeded may fail with an "ImageUnacceptable" error. Bug Fixes ********* * RBD Driver bug #1957073 (https://bugs.launchpad.net/cinder/+bug/1957073) Fixed snapshot deletion failure when its volume doesn't exist. * Bug #1996188 (https://bugs.launchpad.net/cinder/+bug/1996188) Fixed issue where a VMDK image file whose createType allowed named extents could expose host information. This change introduces a new configuration option, "vmdk_allowed_types", that specifies the list of VMDK image subformats that Cinder will allow. The default setting allows only the 'streamOptimized' and 'monolithicSparse' subformats. * RBD driver bug #1916843 (https://bugs.launchpad.net/cinder/+bug/1916843) Fixed rpc timeout when backing up RBD snapshot. We no longer flatten temporary volumes and snapshots. * NFS driver bug #1946059 (https://bugs.launchpad.net/cinder/+bug/1946059) Fixed revert to snapshot operation. * HPE 3PAR driver Bug #1958122 (https://bugs.launchpad.net/cinder/+bug/1958122) Fixed issue of multi-detach operation in multi host environment. * PowerMax driver bug #1930290 (https://bugs.launchpad.net/cinder/+bug/1930290) This fixes the QoS conflict issue on a child storage group by not setting QoS on a parent storage group. Changes in cinder 19.1.1..19.2.0 -------------------------------- 9810c05e7 Use the json format output of qemu-img info e96415409 Check VMDK subformat against an allowed list 4c7dbde44 rbd: Fix snapshot delete when the source volume doesn't exist d941ad28f NFS: Fix generic revert to snapshot flow 14f6b7ac6 Unpin flake8-logging-format 4a1c0fa7f Pin flake8-logging-format to 0.6.0 c58f74029 SF: Remove compat clone image code 5a21cd9be RBD: Don't flatten temporary resources b25e15828 HPE 3PAR: In multi host env, fix multi-detach operation b5e84fea7 PowerMax Driver - Update unsupported retype combinations 6e3fd9e8f PowerMax Driver - QoS should not be set on parent storage group 61c26789c PowerMax Driver - Retype fix for replication Diffstat (except docs and test files) ------------------------------------- cinder/image/image_utils.py | 193 ++++++++-- .../drivers/dell_emc/powermax/powermax_data.py | 5 + .../dell_emc/powermax/test_powermax_common.py | 75 +++- .../dell_emc/powermax/test_powermax_masking.py | 24 ++ .../volume/drivers/solidfire/test_solidfire.py | 32 -- cinder/volume/drivers/dell_emc/powermax/common.py | 74 +++- cinder/volume/drivers/dell_emc/powermax/masking.py | 13 +- cinder/volume/drivers/hpe/hpe_3par_common.py | 57 ++- .../volume/drivers/netapp/dataontap/block_cmode.py | 10 +- .../volume/drivers/netapp/dataontap/nfs_cmode.py | 8 +- cinder/volume/drivers/rbd.py | 67 ++-- cinder/volume/drivers/remotefs.py | 2 +- cinder/volume/drivers/solidfire.py | 33 -- cinder/volume/flows/manager/create_volume.py | 4 +- .../notes/bug-1957073-0d1307a8637a62b7.yaml | 6 + ...vmdk-subformat-allow-list-93e6943d9a486d11.yaml | 33 ++ .../ceph-backup-no-flatten-36557727e9d73b2b.yaml | 7 + .../fix-nfs-revert-to-snap-adc04204b3661d66.yaml | 6 + ...-detach-in-multi-host-env-3f2211f29a336b6e.yaml | 6 + .../powermax-bug-1930290-4f598329a6ced006.yaml | 7 + 25 files changed, 1225 insertions(+), 379 deletions(-)

1 0

nova 25.1.0 (yoga)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are amped to announce the release of: nova 25.1.0: Cloud computing fabric controller This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 25.1.0 ^^^^^^ Known Issues ************ * Nova's use of libvirt's compareCPU() API served its purpose over the years, but its design limitations break live migration in subtle ways. For example, the compareCPU() API compares against the host physical CPUID. Some of the features from this CPUID aren not exposed by KVM, and then there are some features that KVM emulates that are not in the host CPUID. The latter can cause bogus live migration failures. With QEMU >=2.9 and libvirt >= 4.4.0, libvirt will do the right thing in terms of CPU compatibility checks on the destination host during live migration. Nova satisfies these minimum version requirements by a good margin. So, this workaround provides a way to skip the CPU comparison check on the destination host before migrating a guest, and let libvirt handle it correctly. This workaround will be deprecated and removed once Nova replaces the older libvirt APIs with their newer counterparts. The work is being tracked via this blueprint cpu-selection-with-hypervisor- consideration. (https://blueprints.launchpad.net/nova/+spec/cpu-selection-with- hypervisor-consideration) Bug Fixes ********* * As a fix for bug 1942329 (https://bugs.launchpad.net/neutron/+bug/1942329) nova now updates the MAC address of the "direct-physical" ports during mova operations to reflect the MAC address of the physical device on the destination host. Those servers that were created before this fix need to be moved or the port needs to be detached and the re- attached to synchronize the MAC address. * Bug #1978444 (https://bugs.launchpad.net/nova/+bug/1978444) Now nova retries deleting a volume attachment in case Cinder API returns "504 Gateway Timeout". Also, "404 Not Found" is now ignored and leaves only a warning message. * Bug #1981813 (https://bugs.launchpad.net/nova/+bug/1981813) Now nova detects if the "vnic_type" of a bound port has been changed in neutron and leaves an ERROR message in the compute service log as such change on a bound port is not supported. Also the restart of the nova-compute service will not crash any more after such port change. Nova will log an ERROR and skip the initialization of the instance with such port during the startup. * If compute service is down in source node and user try to stop instance, instance gets stuck at powering-off, hence evacuation fails with msg: Cannot 'evacuate' instance <instance-id> while it is in task_state powering-off. It is now possible for evacuation to ignore the vm task state. For more details see: bug 1978983 (https://bugs.launchpad.net/nova/+bug/1978983) * When vDPA was first introduced move operations were implemented in the code but untested either in a real environment or in functional tests. Due to this gap nova elected to block move operations for instance with vDPA devices. All move operations except for live migration have now been tested and found to indeed work so the API blocks have now been removed and functional tests introduced. Other operations such as suspend and live migration require code changes to support and will be enabled as new features in the future. Other Notes *********** * A workaround has been added to the libvirt driver to catch and pass migrations that were previously failing with the error: "libvirt.libvirtError: internal error: migration was active, but no RAM info was set" See bug 1982284 for more details. (https://bugs.launchpad.net/nova/+bug/1982284) Changes in nova 25.0.1..25.1.0 ------------------------------ 516f0de1f6 [stable-only][cve] Check VMDK create-type against an allowed list a28c827195 Gracefully ERROR in _init_instance if vnic_type changed 4954f99368 Reproduce bug 1981813 in func env 4a2b44c7cf Adapt websocketproxy tests for SimpleHTTPServer fix 041939361e enable blocked VDPA move operations f98858aa77 Add compute restart capability for libvirt func tests 69667a817c Remove double mocking... again b40bd1bf52 Remove double mocking 813377077b Record SRIOV PF MAC in the binding profile 683cbd0633 refactor: remove duplicated logic 17ae907569 [compute] always set instance.host in post_livemigration 71e5a1dbcc Adds a repoducer for post live migration fail 4316234e63 Handle "no RAM info was set" migration case 2738317167 nova-live-migration tests not needed for Ironic 6d61fccb84 For evacuation, ignore if task_state is not None 6bd0bf00fc add regression test case for bug 1978983 b94ffb1123 Retry attachment delete API call for 504 Gateway Timeout 0f6c0cd2e4 Fix typos in help messages 277f88e387 libvirt: Add a workaround to skip compareCPU() on destination 6f32b11864 neutron: Unbind remaining ports after PortNotFound Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 19 +- nova/compute/api.py | 12 +- nova/compute/manager.py | 60 +- nova/compute/resource_tracker.py | 2 +- nova/conf/compute.py | 11 +- nova/conf/hyperv.py | 2 +- nova/conf/libvirt.py | 4 +- nova/conf/neutron.py | 2 +- nova/conf/quota.py | 2 +- nova/conf/scheduler.py | 4 +- nova/conf/workarounds.py | 8 + nova/network/neutron.py | 90 ++- nova/objects/pci_device.py | 19 + nova/test.py | 15 +- .../functional/compute/test_resource_tracker.py | 10 - .../libvirt/test_device_bus_migration.py | 8 +- .../functional/libvirt/test_numa_live_migration.py | 12 +- .../functional/libvirt/test_pci_sriov_servers.py | 743 +++++++++++++++++++-- .../functional/regressions/test_bug_1628606.py | 60 ++ .../functional/regressions/test_bug_1781286.py | 30 +- .../functional/regressions/test_bug_1896463.py | 8 - .../functional/regressions/test_bug_1978983.py | 71 ++ .../api/openstack/compute/test_create_backup.py | 4 - .../unit/api/openstack/compute/test_hypervisors.py | 394 +++++------ .../unit/api/openstack/compute/test_limits.py | 164 +++-- .../api/openstack/compute/test_migrate_server.py | 3 +- .../unit/api/openstack/compute/test_quotas.py | 5 +- .../api/openstack/compute/test_server_actions.py | 38 +- .../openstack/compute/test_server_group_quotas.py | 7 +- .../unit/api/openstack/compute/test_servers.py | 30 +- .../unit/api/openstack/compute/test_volumes.py | 10 +- nova/virt/fake.py | 35 + nova/virt/images.py | 31 + nova/virt/libvirt/driver.py | 19 +- nova/virt/libvirt/guest.py | 7 + nova/virt/libvirt/host.py | 15 + nova/volume/cinder.py | 18 +- .../notes/bug-1942329-22b08fa4b322881d.yaml | 9 + .../notes/bug-1978444-db46df5f3d5ea19e.yaml | 7 + ...-1981813-vnic-type-change-9f3e16fae885b57f.yaml | 9 + ...andle-no-ram-info-was-set-99784934ed80fd72.yaml | 11 + ...task-state-for-evacuation-e000f141d0153638.yaml | 11 + .../skip-compare-cpu-on-dest-6ae419ddd61fd0f8.yaml | 24 + .../notes/vdpa-move-ops-a7b3799807807a92.yaml | 11 + 82 files changed, 2930 insertions(+), 1167 deletions(-)

1 0

nova 24.2.0 (xena)
by no-reply＠openstack.org 26 Jan '23

26 Jan '23

We are overjoyed to announce the release of: nova 24.2.0: Cloud computing fabric controller This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 24.2.0 ^^^^^^ Bug Fixes ********* * As a fix for bug 1942329 (https://bugs.launchpad.net/neutron/+bug/1942329) nova now updates the MAC address of the "direct-physical" ports during mova operations to reflect the MAC address of the physical device on the destination host. Those servers that were created before this fix need to be moved or the port needs to be detached and the re- attached to synchronize the MAC address. * [bug 1958636 (https://bugs.launchpad.net/nova/+bug/1958636) Explicitly check for and enable SMM when firmware requires it. Previously we assumed libvirt would do this for us but this is not true in all cases. * Bug #1978444 (https://bugs.launchpad.net/nova/+bug/1978444) Now nova retries deleting a volume attachment in case Cinder API returns "504 Gateway Timeout". Also, "404 Not Found" is now ignored and leaves only a warning message. * Bug #1981813 (https://bugs.launchpad.net/nova/+bug/1981813) Now nova detects if the "vnic_type" of a bound port has been changed in neutron and leaves an ERROR message in the compute service log as such change on a bound port is not supported. Also the restart of the nova-compute service will not crash any more after such port change. Nova will log an ERROR and skip the initialization of the instance with such port during the startup. * During the havana cycle it was discovered that eventlet monkey patching of greendns broke ipv6. https://bugs.launchpad.net/nova/+bug/1164822 Since then nova has been disabling eventlet monkey patching of greendns. Eventlet adressed the ipv6 limitation in v0.17 with the introduction of python 3 support in 2015. Nova however continued to disable it, which can result i slow dns queries blocking the entire nova api or other binary because socket.getaddrinfo becomes a blocking call into glibc see: https://bugs.launchpad.net/nova/+bug/1964149 for more details. * If compute service is down in source node and user try to stop instance, instance gets stuck at powering-off, hence evacuation fails with msg: Cannot 'evacuate' instance <instance-id> while it is in task_state powering-off. It is now possible for evacuation to ignore the vm task state. For more details see: bug 1978983 (https://bugs.launchpad.net/nova/+bug/1978983) * When vDPA was first introduced move operations were implemented in the code but untested either in a real environment or in functional tests. Due to this gap nova elected to block move operations for instance with vDPA devices. All move operations except for live migration have now been tested and found to indeed work so the API blocks have now been removed and functional tests introduced. Other operations such as suspend and live migration require code changes to support and will be enabled as new features in the future. Other Notes *********** * A workaround has been added to the libvirt driver to catch and pass migrations that were previously failing with the error: "libvirt.libvirtError: internal error: migration was active, but no RAM info was set" See bug 1982284 for more details. (https://bugs.launchpad.net/nova/+bug/1982284) Changes in nova 24.1.1..24.2.0 ------------------------------ 1a98a1a650 Gracefully ERROR in _init_instance if vnic_type changed 0c87681135 Reproduce bug 1981813 in func env 867c4dd893 [stable-only][cve] Check VMDK create-type against an allowed list c3092e3ee7 enable blocked VDPA move operations afc55c564f Add compute restart capability for libvirt func tests b36bc9247f Remove double mocking... again 54c7c97cb8 Remove double mocking a340630c5c Record SRIOV PF MAC in the binding profile e7c2e55c66 refactor: remove duplicated logic 0e4a257e86 Adapt websocketproxy tests for SimpleHTTPServer fix 14f9b7627e Retry attachment delete API call for 504 Gateway Timeout 15502ddedc [compute] always set instance.host in post_livemigration 5efcc3f695 Adds a repoducer for post live migration fail 98d9936e54 Handle "no RAM info was set" migration case 8e9aa71e1a For evacuation, ignore if task_state is not None 1e0af92e17 add regression test case for bug 1978983 62e1a621d1 [nova/libvirt] Support for checking and enabling SMM when needed 076f95371a Fix instance's image_ref lost on failed unshelving ec73ff1f78 Reproducer unit test for bug 1934094 d322f8e8b5 neutron: Unbind remaining ports after PortNotFound b12f7ebcdd Retry in CellDatabases fixture when global DB state changes a913ab1aab reenable greendns in nova. 513241a7e4 Fix the wrong exception used to retry detach API calls Diffstat (except docs and test files) ------------------------------------- nova/compute/api.py | 12 +- nova/compute/manager.py | 63 +- nova/compute/resource_tracker.py | 7 +- nova/conf/compute.py | 9 + nova/exception.py | 4 + nova/monkey_patch.py | 15 +- nova/network/neutron.py | 93 ++- nova/objects/pci_device.py | 19 + nova/test.py | 15 +- .../functional/compute/test_resource_tracker.py | 10 - .../functional/libvirt/test_numa_live_migration.py | 12 +- .../functional/libvirt/test_pci_sriov_servers.py | 819 ++++++++++++++++++--- .../functional/regressions/test_bug_1628606.py | 60 ++ .../functional/regressions/test_bug_1781286.py | 30 +- .../functional/regressions/test_bug_1978983.py | 71 ++ .../api/openstack/compute/test_create_backup.py | 4 - .../unit/api/openstack/compute/test_hypervisors.py | 394 +++++----- .../unit/api/openstack/compute/test_limits.py | 167 ++--- .../api/openstack/compute/test_migrate_server.py | 3 +- .../api/openstack/compute/test_server_actions.py | 38 +- .../unit/api/openstack/compute/test_servers.py | 30 +- .../unit/api/openstack/compute/test_volumes.py | 10 +- nova/virt/fake.py | 39 + nova/virt/images.py | 31 + nova/virt/libvirt/config.py | 13 + nova/virt/libvirt/driver.py | 10 +- nova/virt/libvirt/guest.py | 7 + nova/virt/libvirt/host.py | 22 +- nova/volume/cinder.py | 26 +- .../notes/bug-1942329-22b08fa4b322881d.yaml | 9 + .../notes/bug-1958636-smm-check-and-enable.yaml | 7 + .../notes/bug-1978444-db46df5f3d5ea19e.yaml | 7 + ...-1981813-vnic-type-change-9f3e16fae885b57f.yaml | 9 + ...andle-no-ram-info-was-set-99784934ed80fd72.yaml | 11 + releasenotes/notes/greendns-34df7f9fba952bcd.yaml | 14 + ...task-state-for-evacuation-e000f141d0153638.yaml | 11 + .../notes/vdpa-move-ops-a7b3799807807a92.yaml | 11 + 76 files changed, 3120 insertions(+), 1241 deletions(-)

1 0