May 2023 - Release-announce - lists.openstack.org

keystonemiddleware 10.3.0 (bobcat)
by no-reply＠openstack.org 17 May '23

17 May '23

We are stoked to announce the release of: keystonemiddleware 10.3.0: Middleware for OpenStack Identity This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/keystonemiddleware Download the package from: https://pypi.org/project/keystonemiddleware Please report issues through: https://bugs.launchpad.net/keystonemiddleware/+bugs For more details, please see below. 10.3.0 ^^^^^^ New Features * [blueprint support-oauth2-mtls (https://blueprints.launchpad.net/keystone/+spec/support- oauth2-mtls)] The oauth2_mtls_token filter has been added for accepting or denying incoming requests containing OAuth 2.0 certificate-bound access tokens that are obtained from keystone identity server by users through their OAuth 2.0 credentials and Mutual-TLS certificates. Changes in keystonemiddleware 10.2.0..10.3.0 -------------------------------------------- 92cdf8a Add timeout for requests a59020f OAuth 2.0 Mutual-TLS Support 1c820f0 Add missing doc requirements Diffstat (except docs and test files) ------------------------------------- keystonemiddleware/ec2_token.py | 9 +- keystonemiddleware/oauth2_mtls_token.py | 156 +++++++++ keystonemiddleware/s3_token.py | 12 +- .../unit/test_oauth2_mtls_token_middleware.py | 373 +++++++++++++++++++++ .../bp-support-oauth2-mtls-2d2686c9d5b1fe1f.yaml | 8 + setup.cfg | 1 + 8 files changed, 668 insertions(+), 4 deletions(-)

1 0

glance_store 4.1.1 (zed)
by no-reply＠openstack.org 17 May '23

17 May '23

We are excited to announce the release of: glance_store 4.1.1: OpenStack Image Service Store Library This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/glance_store Download the package from: https://pypi.org/project/glance_store For more details, please see below. 4.1.1 ^^^^^ Security Issues * Cinder glance_store driver: in order to avoid a situation where a leftover device could be mapped to a different volume than the one intended, the cinder glance_store driver now instructs the os-brick library to force detach volumes, which ensures that devices are removed from the host. See Bug #2004555 (https://bugs.launchpad.net/glance- store/+bug/2004555) for more information about this issue. Changes in glance_store 4.1.0..4.1.1 ------------------------------------ e9d2509 Add force to os-brick disconnect 3d3467d Fix tox4 error 8034cdc Update TOX_CONSTRAINTS_FILE for stable/zed c05c7e5 Update .gitreview for stable/zed Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + glance_store/_drivers/cinder.py | 5 ++++- glance_store/common/attachment_state_manager.py | 3 ++- releasenotes/notes/bug-2004555-4fd67fce86c07461.yaml | 11 +++++++++++ tox.ini | 7 +++---- 7 files changed, 24 insertions(+), 9 deletions(-)

1 0

nova 27.1.0 (antelope)
by no-reply＠openstack.org 17 May '23

17 May '23

We are overjoyed to announce the release of: nova 27.1.0: Cloud computing fabric controller This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 27.1.0 ^^^^^^ Upgrade Notes * Configuration of service user tokens is now **required** for all Nova services to ensure security of block-storage volume data. All Nova configuration files must configure the "[service_user]" section as described in the documentation. See https://bugs.launchpad.net/nova/+bug/2004555 for more details. (https://docs.openstack.org/nova/latest/admin/configuration /service-user-token.html) Changes in nova 27.0.0..27.1.0 ------------------------------ 09f85a8a92 CI: fix backport validator for new branch naming 6eab57952e Bump nova-ceph-multstore timeout a02f966873 Revert "Debug Nova APIs call failures" eb3fe4ddc6 Have host look for CPU controller of cgroupsv2 location. 1f781423ee Enable use of service user token with admin context efb01985db Use force=True for os-brick disconnect during delete fa2ba3ab2c Handle zero pinned CPU in a cell with mixed policy 2cf835be82 Reproduce asym NUMA mixed CPU policy bug acb511652c Save cell socket correctly when updating host NUMA topology 29e3f2f2ab Reproduce bug 1995153 47b6850bb1 [stable-only] Update TOX_CONSTRAINTS_FILE for stable/2023.1 d081938e22 [stable-only] Update .gitreview for stable/2023.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 3 +- .../admin/configuration/cross-cell-resize.rst | 2 +- .../admin/configuration/service-user-token.rst | 59 +++++++++++ .../admin/migrate-instance-with-snapshot.rst | 2 +- nova/api/openstack/wsgi.py | 6 -- nova/cmd/status.py | 11 ++ nova/network/neutron.py | 8 +- nova/service_auth.py | 6 +- .../functional/regressions/test_bug_1595962.py | 1 + .../functional/regressions/test_bug_1995153.py | 107 ++++++++++++++++++++ .../unit/virt/libvirt/volume/test_fibrechannel.py | 20 ++++ .../unit/virt/libvirt/volume/test_storpool.py | 16 ++- .../unit/virt/libvirt/volume/test_vzstorage.py | 8 +- nova/virt/hardware.py | 11 +- nova/virt/hyperv/vmops.py | 2 +- nova/virt/hyperv/volumeops.py | 12 +-- nova/virt/libvirt/driver.py | 7 +- nova/virt/libvirt/host.py | 31 +++++- nova/virt/libvirt/volume/fibrechannel.py | 7 +- nova/virt/libvirt/volume/fs.py | 2 +- nova/virt/libvirt/volume/iscsi.py | 7 +- nova/virt/libvirt/volume/lightos.py | 7 +- nova/virt/libvirt/volume/nvme.py | 6 +- nova/virt/libvirt/volume/quobyte.py | 2 +- nova/virt/libvirt/volume/scaleio.py | 7 +- nova/virt/libvirt/volume/smbfs.py | 2 +- nova/virt/libvirt/volume/storpool.py | 5 +- nova/virt/libvirt/volume/volume.py | 2 +- nova/virt/libvirt/volume/vzstorage.py | 5 +- nova/volume/cinder.py | 8 +- .../notes/service-user-token-421d067c16257782.yaml | 11 ++ tools/check-cherry-picks.sh | 2 +- tox.ini | 4 +- 65 files changed, 859 insertions(+), 187 deletions(-)

1 0

puppet-ironic 19.5.0 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are jazzed to announce the release of: puppet-ironic 19.5.0: Puppet module for OpenStack Ironic This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-ironic Download the package from: https://tarballs.openstack.org/puppet-ironic/ Please report issues through: https://bugs.launchpad.net/puppet-ironic/+bugs For more details, please see below. 19.5.0 ^^^^^^ New Features ************ * The "ironic::conductor" class now supports the following two new parameters. * "heartbeat_interval" * "heartbeat_timeout" * The new "ironic::disk_utils" class has been added. * The new "ironic::pxe::tftp_use_xinetd" parameter has been added. When this parameter is set to "false", the ironic-dnsmasq-tftp- server service, which actually manages a dnsmasq process, is used instead of xinetd, to implement TFTP server. Note that the dnsmasq service is currently available only in RDO. * The pxe parameter *uefi_pxe_bootfile_name* is now managed by puppet, keeping the ironic default of *bootx64.efi*. The shim EFI binary is copied to the TFTP root directory, to a file named the value of *uefi_pxe_bootfile_name*. The grub EFI binary is copied to the TFTP root directory to a file named *grubx64.efi*. With these changes, using the pxe boot driver with UEFI boot will result in a grub network boot which is Secure Boot capable. Bug Fixes ********* * Now the "ironic::pxe" class properly installs the pxelinux.0 file using the separate "pxelinux" package in Debian and Ubuntu. The new "pxelinux_file_path" parameter can be used to determine the source path to locate the file. When this parameter is set to false then the class does not manage the file. * The wrong source directory to copy syslinux files in Debiand or Ubuntu has been fixed. * Fixed an issue where dnsmasq DHCP configuration for ironic- inspector would point to the wrong UEFI iPXE bootfile. See bug: 1952652 (https://bugs.launchpad.net/puppet-ironic/+bug/1952652). * Now the "tftpd-hap" package is installed insted of the "tftpd" package in Debian and Ubuntu. Changes in puppet-ironic 19.4.0..19.5.0 --------------------------------------- 1af3df3 Prepare the final stable/xena release 61f8ec1 Fix efi file paths in RHEL 596cd4c Copy shim and grub efi binaries to tftp root 181cb07 inspector: Fix wrong group of policy file 0d8437c setuptools: Disable auto discovery 8718318 Debian/Ubuntu: Fix installation of pxelinux.0 and syslinux files b12fcfe Debian/Ubuntu: The staging driver package is not available 6048343 Debian/Ubuntu: Do not use the ironic-inspector-dnsmasq service 1fcfe39 conductor: Support tuning of heartbeats 6aa42e8 Add support for [disk_utils] parameters fdf29c6 Debian/Ubuntu: Use tftpd-hpa instead of tftpd d30bb0e Refactor unit tests of ironic::pxe 3e6254b CentOS 9: Fix unit tests for ironic::pxe 7e1f420 Add support for MultiStrOpt (inspector) e9a5508 pxe: Create tftp_root directory before starting dnsmasq a51fce3 Support use of dnsmasq as tftp service d0bbd07 Fix invalid dependencies 2688458 Fix name of iPXE efi bootrom 7b15d40 Remove TripleO job a83a3dc Update TOX_CONSTRAINTS_FILE for stable/xena 5eeb1b1 Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 1 - .../{ini_setting.rb => openstackconfig.rb} | 4 +- lib/puppet/type/ironic_inspector_config.rb | 12 +- manifests/conductor.pp | 13 + manifests/disk_utils.pp | 61 +++++ manifests/drivers/pxe.pp | 19 +- manifests/drivers/staging.pp | 13 +- manifests/inspector.pp | 36 ++- manifests/inspector/policy.pp | 2 +- manifests/keystone/auth.pp | 4 +- manifests/params.pp | 48 +++- manifests/pxe.pp | 179 ++++++++++--- manifests/pxe/common.pp | 18 +- metadata.json | 2 +- .../conductor-heartbeat-d92790f3e6a59c4b.yaml | 8 + .../debian-syslinux-files-c36f21ae936c0594.yaml | 12 + .../notes/disk_utils-ff85c8b00595d8b8.yaml | 4 + ...q-uefi-ipxe-boot-filename-83fefc1e48ea7f4f.yaml | 8 + .../notes/tftp_use_xinetd-710c4eb59d3b0501.yaml | 8 + .../uefi_pxe_bootfile_name-eb2244dc9b9fd954.yaml | 12 + .../use-tftpd-hpa-in-debian-07f5429e791ab883.yaml | 5 + setup.py | 1 + spec/classes/ironic_conductor_spec.rb | 6 + spec/classes/ironic_disk_utils_spec.rb | 60 +++++ spec/classes/ironic_drivers_pxe_spec.rb | 9 +- spec/classes/ironic_drivers_staging_spec.rb | 9 +- spec/classes/ironic_inspector_policy_spec.rb | 4 +- spec/classes/ironic_inspector_spec.rb | 18 +- spec/classes/ironic_pxe_spec.rb | 287 ++++++++++++++++++--- ...ini_setting_spec.rb => openstackconfig_spec.rb} | 18 +- spec/unit/type/ironic_inspector_config_spec.rb | 45 ++++ templates/dnsmasq_tftp_server.erb | 8 + templates/inspector_dnsmasq_http.erb | 4 +- tox.ini | 2 +- 35 files changed, 800 insertions(+), 141 deletions(-)

1 0

glance_store 4.3.1 (antelope)
by no-reply＠openstack.org 17 May '23

17 May '23

We are psyched to announce the release of: glance_store 4.3.1: OpenStack Image Service Store Library This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/glance_store Download the package from: https://pypi.org/project/glance_store For more details, please see below. 4.3.1 ^^^^^ Security Issues * Cinder glance_store driver: in order to avoid a situation where a leftover device could be mapped to a different volume than the one intended, the cinder glance_store driver now instructs the os-brick library to force detach volumes, which ensures that devices are removed from the host. See Bug #2004555 (https://bugs.launchpad.net/glance- store/+bug/2004555) for more information about this issue. Changes in glance_store 4.3.0..4.3.1 ------------------------------------ a7eed02 Add force to os-brick disconnect 54d9449 Run cinder driver unit tests ddc4696 Update TOX_CONSTRAINTS_FILE for stable/2023.1 8d56f71 Update .gitreview for stable/2023.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + glance_store/_drivers/cinder/base.py | 3 ++- releasenotes/notes/bug-2004555-4fd67fce86c07461.yaml | 11 +++++++++++ test-requirements.txt | 1 + tox.ini | 6 +++--- 8 files changed, 20 insertions(+), 6 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index b623f81..2eaa226 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -13,0 +14 @@ coverage!=4.4,>=4.0 # Apache-2.0 +ddt>=1.4.4 # MIT

1 0

glance_store 3.0.1 (yoga)
by no-reply＠openstack.org 17 May '23

17 May '23

We are gleeful to announce the release of: glance_store 3.0.1: OpenStack Image Service Store Library This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/glance_store Download the package from: https://pypi.org/project/glance_store For more details, please see below. 3.0.1 ^^^^^ Security Issues *************** * Cinder glance_store driver: in order to avoid a situation where a leftover device could be mapped to a different volume than the one intended, the cinder glance_store driver now instructs the os-brick library to force detach volumes, which ensures that devices are removed from the host. See Bug #2004555 (https://bugs.launchpad.net/glance- store/+bug/2004555) for more information about this issue. Bug Fixes ********* * Now the "project_domain_name" parameter and the "user_domain_name" parameter are properly used by swift backends. Previously these two parameters were ignored and the "*_domain_id" parameters should be set to use a keystone domain different from the default one. * Bug #1970698 (https://bugs.launchpad.net/glance- store/+bug/1970698): Cinder: Fixed exception logging when the image create operation fails due to failing to attach volume to glance host. * Bug #1969373 (https://bugs.launchpad.net/glance- store/+bug/1969373): Cinder Driver: Correct the retry interval from fixed 1 second to exponential backoff for attaching a volume during image create/save operation. Changes in glance_store 3.0.0..3.0.1 ------------------------------------ 2830182 Add force to os-brick disconnect bc9375e Fix tox4 error 4e5b90a Swift: Honor *_domain_name parameters 69fd0dc Cinder: Correct exception logging during attach c6716cb Correct retry interval during attach volume 88bd7fc Update TOX_CONSTRAINTS_FILE for stable/yoga 74fee65 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + glance_store/_drivers/cinder.py | 5 +- glance_store/_drivers/swift/utils.py | 33 +++++----- glance_store/common/attachment_state_manager.py | 7 ++- glance_store/common/cinder_utils.py | 4 +- .../unit/common/test_attachment_state_manager.py | 13 +++- .../notes/bug-1620999-8b76a0ad14826197.yaml | 7 +++ .../notes/bug-2004555-4fd67fce86c07461.yaml | 11 ++++ ...ion-logging-during-attach-9546e24189db83c4.yaml | 6 ++ .../fix-interval-in-retries-471155ff34d9f0e9.yaml | 7 +++ tox.ini | 7 +-- 17 files changed, 247 insertions(+), 41 deletions(-)

1 0

keystoneauth1 5.2.0 (bobcat)
by no-reply＠openstack.org 17 May '23

17 May '23

We are satisfied to announce the release of: keystoneauth1 5.2.0: Authentication Library for OpenStack Identity This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/keystoneauth1 Download the package from: https://pypi.org/project/keystoneauth1 For more details, please see below. 5.2.0 ^^^^^ New Features ************ * [blueprint support-oauth2-mtls (https://blueprints.launchpad.net/keystone/+spec/support- oauth2-mtls)] Added a new OAuth2mTlsClientCredential plugin, accessible via the 'v3oauth2mtlsclientcredential' entry point, making possible to authenticate using an OAuth 2.0 Mutual-TLS client credentials. Keystoneauth can now be used to access the OpenStack APIs that use the keystone middleware to support OAuth2.0 mutual-TLS client authentication through the keystone identity server. Bug Fixes ********* * [bug 1998366 (https://bugs.launchpad.net/keystoneauth/+bug/1998366)] Federated auth plugins now can work with unversioned auth url (e.g. "http://keystone"). Changes in keystoneauth1 5.1.2..5.2.0 ------------------------------------- 2e40bbf Update master for stable/2023.1 44e5b2d New auth plugin v3oidcdeviceauthz ca28df8 OAuth 2.0 Mutual-TLS Support 192a27a Remove six bef3dfb setup.cfg: Restore python_requires after a typo 737790f Allow federation to work with unversioned auth_url 19db34e Switch to 2023.1 Python3 unit tests and generic template name aaca2b3 Update master for stable/zed be2223c Replace abc.abstractproperty with property and abc.abstractmethod Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 +- keystoneauth1/_fair_semaphore.py | 4 +- keystoneauth1/_utils.py | 5 +- keystoneauth1/access/access.py | 8 + keystoneauth1/access/service_catalog.py | 5 +- keystoneauth1/discover.py | 7 +- keystoneauth1/exceptions/oidc.py | 9 + keystoneauth1/extras/_saml2/v3/adfs.py | 3 +- keystoneauth1/fixture/serializer.py | 5 +- keystoneauth1/fixture/v3.py | 18 +- keystoneauth1/identity/__init__.py | 10 +- keystoneauth1/identity/base.py | 9 +- keystoneauth1/identity/generic/base.py | 9 +- keystoneauth1/identity/v2.py | 5 +- keystoneauth1/identity/v3/__init__.py | 6 +- keystoneauth1/identity/v3/base.py | 11 +- keystoneauth1/identity/v3/federation.py | 10 +- keystoneauth1/identity/v3/k2k.py | 4 +- .../identity/v3/oauth2_mtls_client_credential.py | 125 +++++++++++ keystoneauth1/identity/v3/oidc.py | 148 ++++++++++++- keystoneauth1/identity/v3/tokenless_auth.py | 5 +- keystoneauth1/loading/_plugins/identity/v3.py | 54 +++++ keystoneauth1/loading/base.py | 4 +- keystoneauth1/session.py | 28 +-- .../unit/identity/test_identity_v3_federation.py | 18 +- .../bp-support-oauth2-mtls-177cda05265ae65c.yaml | 10 + .../notes/bug-1998366-27cd486b46fb56b0.yaml | 6 + releasenotes/source/2023.1.rst | 6 + releasenotes/source/index.rst | 2 + releasenotes/source/zed.rst | 6 + requirements.txt | 5 - setup.cfg | 4 +- 44 files changed, 829 insertions(+), 137 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 4f06ae0..30d3d7f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,4 +4,0 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - @@ -21 +16,0 @@ requests>=2.14.2 # Apache-2.0 -six>=1.10.0 # MIT

1 0

python-adjutantclient 1.0.0 (bobcat)
by no-reply＠openstack.org 17 May '23

17 May '23

We are excited to announce the release of: python-adjutantclient 1.0.0: Adjutant API Client Library This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/python-adjutantclient Download the package from: https://pypi.org/project/python-adjutantclient Please report issues through: https://storyboard.openstack.org/#!/project/openstack/python- adjutantclient For more details, please see below. Changes in python-adjutantclient 0.12.0..1.0.0 ---------------------------------------------- db795e2 Fix listing and removing roles from users. c50e3fe Fix typo in help text 5a92d90 Bugfix: Six removal introduced regression in v1/users b4ef3e6 Add check-requirements to Zuul tests Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 1 + adjutantclient/common/base.py | 6 ++++-- adjutantclient/osc/v1/users.py | 8 +++----- adjutantclient/v1/roles.py | 3 ++- adjutantclient/v1/users.py | 2 +- requirements.txt | 4 ++-- test-requirements.txt | 1 - 7 files changed, 13 insertions(+), 12 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 75e7f0e..586e25e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ iso8601>=0.1.11 # MIT -osc-lib>=1.5.1 # Apache-2.0 +osc-lib>=1.8.0 # Apache-2.0 @@ -16 +16 @@ PyYAML>=3.10.0 # MIT -requests!=2.12.2,!=2.13.0,>=2.10.0 # Apache-2.0 +requests>=2.14.2 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index fe3f111..5078794 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +6,0 @@ ddt>=1.0.1 # MIT -discover # BSD

1 0

oslo.messaging 14.3.0 (bobcat)
by no-reply＠openstack.org 15 May '23

15 May '23

We exuberantly announce the release of: oslo.messaging 14.3.0: Oslo Messaging API This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/oslo.messaging Download the package from: https://pypi.org/project/oslo.messaging Please report issues through: https://bugs.launchpad.net/oslo.messaging/+bugs For more details, please see below. 14.3.0 ^^^^^^ Bug Fixes * Fixed typo in variable names "rabbit_quorum_max_memory_length" and "rabbit_quorum_max_memory_bytes". Please make changes in your config files to correspond correct variables. Changes in oslo.messaging 14.2.0..14.3.0 ---------------------------------------- fd2381c7 Disable greenthreads for RabbitDriver "listen" connections 9b1e2dc4 Update master for stable/2023.1 115cfb5b Fix typo in quorum-related variables for RabbitMQ Diffstat (except docs and test files) ------------------------------------- oslo_messaging/_drivers/impl_rabbit.py | 12 ++++++++---- oslo_messaging/_utils.py | 3 +++ releasenotes/notes/rabbit_quorum_typo-9c06a9fd8d767f53.yaml | 6 ++++++ releasenotes/source/2023.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + 6 files changed, 26 insertions(+), 6 deletions(-)

1 0

oslo.policy 4.2.0 (bobcat)
by no-reply＠openstack.org 15 May '23

15 May '23

We jubilantly announce the release of: oslo.policy 4.2.0: Oslo Policy library This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/oslo.policy Download the package from: https://pypi.org/project/oslo.policy Please report issues through: https://bugs.launchpad.net/oslo.policy/+bugs For more details, please see below. Changes in oslo.policy 4.1.1..4.2.0 ----------------------------------- 93129eb Revert "Moves supported python runtimes from version 3.8 to 3.10" 67a3d3b Moves supported python runtimes from version 3.8 to 3.10 d80573c Fix deprecated rule logic if the rule was deleted in policy directory. e7b9dd1 Update master for stable/2023.1 Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 20 ++++++++++---------- oslo_policy/policy.py | 1 + releasenotes/source/2023.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + setup.cfg | 1 + 5 files changed, 19 insertions(+), 10 deletions(-)

1 0