July 2023 - Release-announce - lists.openstack.org

tacker 7.1.0 (yoga)
by no-reply＠openstack.org 28 Jul '23

28 Jul '23

We jubilantly announce the release of: tacker 7.1.0: OpenStack NFV Orchestration This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/tacker Download the package from: https://tarballs.openstack.org/tacker/ Please report issues through: https://bugs.launchpad.net/tacker/+bugs For more details, please see below. Changes in tacker 7.0.0..7.1.0 ------------------------------ 2625c003 Remove deprecated attributes from context 51ef6ca2 Fix usage of deprecated .best_match() 96ae85ee Drop lower-constraints.txt and its testing d06426d1 Suppress Warnings for SQL Alchemy IN operator Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 1 - lower-constraints.txt | 157 ----------------------------------------- requirements.txt | 3 + tacker/api/v1/base.py | 9 ++- tacker/context.py | 3 +- tacker/objects/vnf_package.py | 25 +++---- tacker/policies/base.py | 2 +- tacker/wsgi.py | 6 +- tox.ini | 6 -- 11 files changed, 30 insertions(+), 185 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 80daa4d2..2a5a3bc8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -0,0 +1,3 @@ +# Requirements lower bounds listed here are our best effort to keep them up to +# date but we do not test them so no guarantee of having them all correct. If +# you find any incorrect lower bounds, let us know or propose a fix.

1 0

heat-dashboard 7.0.1 (yoga)
by no-reply＠openstack.org 28 Jul '23

28 Jul '23

We are jazzed to announce the release of: heat-dashboard 7.0.1: Heat Management Dashboard This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/heat-dashboard Download the package from: https://tarballs.openstack.org/heat-dashboard/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/heat- dashboard For more details, please see below. Changes in heat-dashboard 7.0.0..7.0.1 -------------------------------------- 36ae65e Drop lower-constraints.txt and its testing 111e6a1 Yoga-only: Fix wrong job teamplate used 39c14dc Set False to include_empty_option 4da3fa2 Fixed Unit test for Heat-dashboard 505f4fd Update TOX_CONSTRAINTS_FILE for stable/yoga bbb14f9 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 2 +- .zuul.yaml | 3 +- heat_dashboard/content/stacks/forms.py | 13 ++- heat_dashboard/test/helpers.py | 7 +- lower-constraints.txt | 146 ------------------------ requirements.txt | 8 +- tox.ini | 10 +- 8 files changed, 26 insertions(+), 167 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b737e47..0aa0c4a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -0,0 +1,4 @@ +# Requirements lower bounds listed here are our best effort to keep them up to +# date but we do not test them so no guarantee of having them all correct. If +# you find any incorrect lower bounds, let us know or propose a fix. + @@ -10 +14 @@ -pbr!=2.1.0,>=2.0.0 # Apache-2.0 +pbr>=5.5.0 # Apache-2.0 @@ -15 +19 @@ python-heatclient>=1.10.0 # Apache-2.0 -horizon>=18.3.1 # Apache-2.0 +horizon>=22.0.0 # Apache-2.0

1 0

designate-dashboard 14.0.1 (yoga)
by no-reply＠openstack.org 28 Jul '23

28 Jul '23

We are satisfied to announce the release of: designate-dashboard 14.0.1: Designate Horizon UI bits This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/designate-dashboard Download the package from: https://tarballs.openstack.org/designate-dashboard/ Please report issues through: https://bugs.launchpad.net/designate-dashboard/+bugs For more details, please see below. Changes in designate-dashboard 14.0.0..14.0.1 --------------------------------------------- f2e7a13 Fix details pages reload behaviour aa3f958 Disable lower constraint job on stable/yoga 2a96e27 Fix issue with missing elements in the dashboard 8cd4637 Update TOX_CONSTRAINTS_FILE for stable/yoga 032c876 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 1 - .../os-designate-floatingip.module.js | 2 +- .../actions/update.service.js | 1 - .../os-designate-recordset.module.js | 2 +- .../os-designate-zone/actions/update.service.js | 1 - .../os-designate-zone/os-designate-zone.module.js | 2 +- lower-constraints.txt | 131 --------------------- tox.ini | 8 +- 9 files changed, 5 insertions(+), 144 deletions(-)

1 0

trove-dashboard 18.0.1 (yoga)
by no-reply＠openstack.org 28 Jul '23

28 Jul '23

We exuberantly announce the release of: trove-dashboard 18.0.1: Trove Management Dashboard This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/trove-dashboard Download the package from: https://tarballs.openstack.org/trove-dashboard/ Please report issues through: https://bugs.launchpad.net/trove-dashboard/+bugs For more details, please see below. Changes in trove-dashboard 18.0.0..18.0.1 ----------------------------------------- 93a7fad Works around a failure to load openstack dashboard 35c12b7 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .../databases/_launch_instances_network_help.html | 4 ++ .../templates/databases/_update_networks.html | 37 +++++++++++++++ .../content/databases/workflows/create_instance.py | 48 ++++++++++++++++++-- 6 files changed, 112 insertions(+), 40 deletions(-)

1 0

trove 17.0.1 (yoga)
by no-reply＠openstack.org 28 Jul '23

28 Jul '23

We high-spiritedly announce the release of: trove 17.0.1: OpenStack DBaaS This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/trove Download the package from: https://tarballs.openstack.org/trove/ Please report issues through: https://bugs.launchpad.net/trove/+bugs For more details, please see below. 17.0.1 ^^^^^^ Bug Fixes * check if the user input is legal, currently, trove may have a RCE vulnerability. more details see: Stroy 2010004 * Fix guest-agent failed to start postgres container due to execution of the "CREATE DATABASE" statement within the context manager of psycopg library. See the following for details Stroy 2010761 Changes in trove 17.0.0..17.0.1 ------------------------------- f07e85de Fix "create database" failed for postgress 25e67af5 [CI] Move queue setting to project level 08e960d1 Fix illegal shell characters b1bbc7d8 Change settings for stable/yoga e30d4c93 Update TOX_CONSTRAINTS_FILE for stable/yoga 5c621e83 Update TOX_CONSTRAINTS_FILE for stable/yoga 1a0fb8c8 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 6 +++--- devstack/settings | 2 +- .../elements/guest-agent/source-repository-guest-agent | 4 ++-- integration/scripts/trovestack | 2 +- integration/scripts/trovestack.rc | 2 +- .../notes/fix-illegal-value-be1acadc8c54c224.yaml | 6 ++++++ .../fix-postgress-create-database-75fbe03e3b4e296d.yaml | 8 ++++++++ tox.ini | 2 +- trove/backup/service.py | 3 +++ trove/common/cfg.py | 2 +- trove/common/exception.py | 4 ++++ trove/common/utils.py | 11 +++++++++++ trove/guestagent/api.py | 2 +- trove/guestagent/datastore/postgres/service.py | 7 +++++-- 16 files changed, 65 insertions(+), 13 deletions(-)

1 0

tooz 4.2.0
by no-reply＠openstack.org 26 Jul '23

26 Jul '23

We enthusiastically announce the release of: tooz 4.2.0: Coordination library for distributed systems. The source is available from: https://opendev.org/openstack/tooz Download the package from: https://pypi.org/project/tooz For more details, please see below. Changes in tooz 4.1.0..4.2.0 ---------------------------- bed303e Fix: Add timeout for mysql driver Diffstat (except docs and test files) ------------------------------------- tooz/drivers/mysql.py | 6 ++---- 2 files changed, 17 insertions(+), 5 deletions(-)

1 0

octavia 11.0.1 (zed)
by no-reply＠openstack.org 20 Jul '23

20 Jul '23

We contentedly announce the release of: octavia 11.0.1: OpenStack Octavia Scalable Load Balancer as a Service This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/octavia Download the package from: https://pypi.org/project/octavia Please report issues through: https://storyboard.openstack.org/#!/project/908 For more details, please see below. 11.0.1 ^^^^^^ Security Issues *************** * Filter out private information from the taskflow logs when ''INFO'' level messages are enabled and when jobboard is enabled. Logs might have included TLS certificates and private_key. By default, in Octavia only WARNING and above messages are enabled in taskflow and jobboard is disabled. Bug Fixes ********* * Added a filter to hide a bogus ComputeWaitTimeoutException exception when creating an amphora when jobboard is disabled. This exception is part of the flow when creating a load balancer or an amphora and should not be shown to the user. * The parameters of a taskflow Flow were logged in ''INFO'' level messages by taskflow, it included TLS-enabled listeners and pools parameters, such as certificates and private_key. * Fix an authentication error with Barbican when creating a TERMINATED_HTTPS listener with application credential tokens or trust IDs. * Fixed a potential race condition in the member batch update API call, the load balancers might not have been locked properly. * Fixed a "corrupted global server state file" error in Centos 9 Stream when reloading the state of the servers after restarting haproxy. It also fixed the recovering of the operational state of the servers in haproxy after its restart. * Fix a bug when full graph of load balancer is created without listeners if jobboard_enabled=False * Fixed a bug that prevented Octavia from creating listeners with the fully-populated load balancer API in SINGLE topology mode. * Fixed backwards compatibility issue with the feature that preserves HAProxy server states between reloads. HAProxy version 1.5 or below do not support this feature, so Octavia will not to activate it on amphorae with those versions. * Fixed a bug that didn't set all the active load balancer Health Monitors ONLINE in populated LB single-create calls. * Fix a bug that prevented the operating_status of a health-monitor to be set to ONLINE when ipv6 addresses were enclosed within square brackets in "controller_ip_port_list". * Fixed a potential error when plugging a member from a new network after deleting another member and unplugging its network. Octavia may have tried to plug the new network to a new interface but with an already existing name. This fix requires to update the Amphora image. * Fix an issue with PING health-monitors on Centos 8 Stream. Changes in Centos and systemd prevent an unprivileged user from sending ping requests from a network namespace. * Fixed a bug that didn't set the correct provisioning_status for unattached pools when creating a fully-populated load balancer. * Fixed an SELinux issues with TCP-based health-monitor on UDP pools, some specific monitoring ports were denied by SELinux. The Amphora image now enables the "keepalived_connect_any" SELinux boolean that allows connections to any ports. * When plugging a new member subnet, the amphora sends an IP advertisement of the newly allocated IP. It allows the servers on the same L2 network to flush the ARP entries of a previously allocated IP address. Changes in octavia 11.0.0..11.0.1 --------------------------------- 4d52ce9c Fix TCP HMs on UDP pools with SELinux 2e034c1e Fix hm operating status to ONLINE in single lb call 05b33434 Avoid interface name collisions in the amphora 396785da Fix pool creation with single LB create call ba0c244d Fix pep8 error 6a380e37 Send IP advertisements when plugging a new member subnet 332d7dee Fix octavia to accept [ipv6]:port b2437857 Fix ORM caching for with_for_update calls c87fbc07 Fix grenade job & pin pylint on stable/branches 4022aaf7 Filter out details from taskflow logs with v2+jobboard 0bc7d289 Filter ComputeWaitTimeoutException when jobboard is disabled 8cd697e8 Fix PING health-monitor with recent Centos releases 4e9203ad Fix listener creation with fully-populated API cfd87ccb Fix full graph loadbalancer creation if jobboard is disabled 572c0dac Add a newline when writing the server state file fb2e1d2e Handle feature compatibility of HAProxy server-state-file option 48fad7c2 Fix prometheus-proxy service name in Red Hat-based distros 960977cc Fix barbican client with application credentials/trusts b7fc5b10 Add *.orig to .gitignore 4f2a019d Update TOX_CONSTRAINTS_FILE for stable/zed d8ec4499 Update .gitreview for stable/zed Diffstat (except docs and test files) ------------------------------------- .gitignore | 1 + .gitreview | 1 + .../12-enable-prometheus-proxy-systemd | 2 +- .../amphora-agent/source-repository-amphora-agent | 4 +- elements/amphora-agent/svc-map | 3 + .../post-install.d/50-selinux-policies | 3 + .../post-install.d/20-haproxy-tune-kernel | 8 +++ elements/octavia-lib/source-repository-octavia-lib | 2 +- octavia/amphorae/backends/agent/api_server/plug.py | 25 +++++-- octavia/amphorae/backends/agent/api_server/util.py | 21 ++++++ .../backends/health_daemon/health_sender.py | 2 + octavia/amphorae/backends/utils/haproxy_query.py | 2 +- octavia/certificates/common/auth/barbican_acl.py | 27 ++++---- octavia/common/base_taskflow.py | 44 ++++++++++++ octavia/common/constants.py | 1 + .../jinja/haproxy/combined_listeners/jinja_cfg.py | 4 +- .../haproxy/combined_listeners/templates/base.j2 | 2 + .../combined_listeners/templates/haproxy.cfg.j2 | 2 +- .../haproxy/combined_listeners/templates/macros.j2 | 4 +- .../controller/worker/v1/flows/listener_flows.py | 3 + .../worker/v1/flows/load_balancer_flows.py | 31 +++++---- .../controller/worker/v1/tasks/database_tasks.py | 44 +++++++++++- octavia/controller/worker/v2/controller_worker.py | 7 +- .../controller/worker/v2/flows/listener_flows.py | 3 + .../worker/v2/flows/load_balancer_flows.py | 32 +++++---- .../controller/worker/v2/tasks/database_tasks.py | 45 +++++++++++- octavia/db/repositories.py | 80 +++++++++++++++------- octavia/hacking/checks.py | 2 +- .../backend/agent/api_server/test_server.py | 19 +++-- .../agent/api_server/test_haproxy_compatibility.py | 2 - .../backends/agent/api_server/test_plug.py | 60 ++++++++++++++-- .../backends/agent/api_server/test_util.py | 35 ++++++++++ .../backends/health_daemon/test_health_sender.py | 18 +++++ .../amphorae/backends/utils/test_haproxy_query.py | 2 +- .../certificates/common/auth/test_barbican_acl.py | 3 +- .../haproxy/combined_listeners/test_jinja_cfg.py | 69 +++++++------------ .../sample_configs/sample_configs_combined.py | 5 +- .../worker/v1/flows/test_load_balancer_flows.py | 7 +- .../worker/v1/tasks/test_database_tasks.py | 63 +++++++++++++++-- .../worker/v2/flows/test_load_balancer_flows.py | 7 +- .../worker/v2/tasks/test_database_tasks.py | 56 ++++++++++++++- .../controller/worker/v2/test_controller_worker.py | 47 +++++++++++++ ...on-when-jobboard-disabled-6f1375463f5a71dc.yaml | 7 ++ ...mation-from-taskflow-logs-0d8697140423b4d5.yaml | 12 ++++ ...tial-tokens-with-barbican-3b7d13283206c124.yaml | 5 ++ ...ber-update-race-condition-09b82e2cc3121e03.yaml | 5 ++ ...-global-server-state-file-325ab7c62e21ff14.yaml | 7 ++ ...dbalancer-creation-if-jobboard-is-disabled.yaml | 5 ++ ...opulated-lb-with-listener-92a369ea8d57e8f5.yaml | 5 ++ ...y-about-server-state-file-df70e5ac859417e2.yaml | 7 ++ ...-online-in-single-lb-call-214a7ca22937a877.yaml | 5 ++ ...ress-enclosed-in-brackets-c1cfc4717465ba09.yaml | 6 ++ ...twork-interface-collision-939fd32587ea3344.yaml | 8 +++ ...-ping-hm-on-centos-stream-6624f19c8da86e22.yaml | 6 ++ ...tatus-on-lb-single-create-897070aee0a42da6.yaml | 5 ++ ...linux-tcp-hm-on-udp-pools-89c3b8db89e359ba.yaml | 7 ++ ...-subnet-ip-advertisements-af2264844079ef6b.yaml | 6 ++ test-requirements.txt | 2 +- tox.ini | 8 +-- zuul.d/jobs.yaml | 9 +-- 62 files changed, 811 insertions(+), 186 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 051ebbdf..9fc15cb1 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -11 +11 @@ oslotest>=3.2.0 # Apache-2.0 -pylint>=2.5.3 # GPLv2 +pylint>=2.5.3,<=2.15.10 # GPLv2

1 0

octavia 10.1.0 (yoga)
by no-reply＠openstack.org 19 Jul '23

19 Jul '23

We are satisfied to announce the release of: octavia 10.1.0: OpenStack Octavia Scalable Load Balancer as a Service This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/octavia Download the package from: https://pypi.org/project/octavia Please report issues through: https://storyboard.openstack.org/#!/project/908 For more details, please see below. 10.1.0 ^^^^^^ Known Issues ************ * When using a distribution with a recent SELinux release such as CentOS 8 Stream, PING health-monitor does not work as shell_exec_t calls are denied by SELinux. * Fixed configuration issue which allowed authenticated and authorized users to inject code into HAProxy configuration using API requests. Octavia API no longer accepts unencoded whitespace characters in url_path values in update requests for healthmonitors. Upgrade Notes ************* * The fix that updates the Netfilter Conntrack Sysfs variables requires rebuilding the amphora image in order to be effective. Security Issues *************** * Filter out private information from the taskflow logs when ''INFO'' level messages are enabled and when jobboard is enabled. Logs might have included TLS certificates and private_key. By default, in Octavia only WARNING and above messages are enabled in taskflow and jobboard is disabled. Bug Fixes ********* * In order to avoid hitting the Neutron API hard when batch update with creating many new members, we cache the subnet validation results in batch update members API call. We also change to validate new members only during batch update members since subnet ID is immutable. * Ensure that the provided rsyslog configuration file is used by rsyslog in the amphora by restarting the service when using the amphorav1 provider, it fixes the log offloading feature on distributions that start rsyslog before cloud-init. * The parameters of a taskflow Flow were logged in ''INFO'' level messages by taskflow, it included TLS-enabled listeners and pools parameters, such as certificates and private_key. * Fix an authentication error with Barbican when creating a TERMINATED_HTTPS listener with application credential tokens or trust IDs. * Fixed a potential race condition in the member batch update API call, the load balancers might not have been locked properly. * Fix an issue that may have occurred when running the amphorav2 with persistence, the ComputeActiveWait was incorrectly executed twice on different controllers. * Fixed a "corrupted global server state file" error in Centos 9 Stream when reloading the state of the servers after restarting haproxy. It also fixed the recovering of the operational state of the servers in haproxy after its restart. * Fix disabled UDP pools. Disabled UDP pools were marked as "OFFLINE" but the requests were still forwarded to the members of the pool. * Fix the shutdown of the driver-agent, the process might have been stuck while waiting for threads to finish. Systemd would have killed the process after a timeout, but some children processes might have leaked on the controllers. * Enable required SELinux booleans for CentOS or RHEL amphora image. * Fix a bug when full graph of load balancer is created without listeners if jobboard_enabled=False * Fixed a bug that prevented Octavia from creating listeners with the fully-populated load balancer API in SINGLE topology mode. * Fixed backwards compatibility issue with the feature that preserves HAProxy server states between reloads. HAProxy version 1.5 or below do not support this feature, so Octavia will not to activate it on amphorae with those versions. * Fix a bug that prevented the provisioning_state of a health- monitor to be set to ERROR when an error occurred while creating, updating or deleting a health-monitor. * Fixed a bug that didn't set all the active load balancer Health Monitors ONLINE in populated LB single-create calls. * Fix a bug that prevented the operating_status of a health-monitor to be set to ONLINE when ipv6 addresses were enclosed within square brackets in "controller_ip_port_list". * Fixes listener creation failure when protocol used is PROXY or PROXYV2 which are pool protocol and not listener protocol. * Fix update listener certs failed. The fix ensures that an existing certificate gets overwritten properly. * Fixed a potential error when plugging a member from a new network after deleting another member and unplugging its network. Octavia may have tried to plug the new network to a new interface but with an already existing name. This fix requires to update the Amphora image. * Netfilter Conntrack Sysfs variables net.netfilter.nf_conntrack_max and nf_conntrack_expect_max get set to sensible values on the amphora now. Previously, kernel default values were used which were much too low for the configured net.netfilter.nf_conntrack_buckets value. As a result packets could get dropped because the conntrack table got filled too quickly. Note that this affects only UDP and SCTP protocol listeners. Connection tracking is disabled for TCP- based connections on the amphora including HTTP(S). * Now the "[nova] service_name" parameter is effectively used to find the nova endpoint in keystone catalog. The parameter had no effect before it was fixed. * Fix an issue with PING health-monitors on Centos 8 Stream. Changes in Centos and systemd prevent an unprivileged user from sending ping requests from a network namespace. * Fix PING health-monitors with recent haproxy releases (>=2.2), haproxy now requires an additional "insecure-fork-wanted" option to authorize the Octavia PING healthcheck. * Fix a bug when adding a member on a subnet that belongs to a network with multiple subnets, an incorrect subnet may have been plugged in the amphora. * Fix a bug when deleting the last member plugged on a network, the port that was no longer used was not deleted. * Fixed a bug that didn't set the correct provisioning_status for unattached pools when creating a fully-populated load balancer. * Fix a bug when updating a load balancer with a QoS policy after a failover, Octavia attempted to update the VRRP ports of the deleted amphorae, moving the provisioning status of the load balancer to ERROR. * Fix a potential race condition when updating a resource in the amphorav2 worker. The worker was not waiting for the resource to be set to PENDING_UPDATE, so the resource may have been updated with old data from the database, resulting in a no-op update. * Fix the rescheduling of taskflow tasks that have been resumed after being interrupted. * Fixed issue with SELinux and the lvs-masquerade.sh script on the amphora. The script already runs with root permissions, so the use of sudo inside the script is unneeded. * Fixed an SELinux issues with TCP-based health-monitor on UDP pools, some specific monitoring ports were denied by SELinux. The Amphora image now enables the "keepalived_connect_any" SELinux boolean that allows connections to any ports. * Fix an issue when Octavia performs a failover of an ACTIVE-STANDBY load balancer that has both amphorae missing. Some tasks in the controller took too much time to timeout because the timeout value defined in "[haproxy_amphora].active_connection_max_retries" and "[haproxy_amphora].active_connection_rety_interval" was not used. * Fix a serialization issue when using TLSContainer with amphorav2 driver with persistence, a list of bytes type in the data model was not correctly converted to serializable data. * Fixed "Could not retrieve certificate" error when updating/deleting the client_ca_tls_container_ref field of a listener after a CA/CRL was deleted. * Fix a python3 error that prevented to use the "[controller_worker]/user_data_config_drive" option when building amphorae. * Fixed validations in L7 rule and session cookie APIs in order to prevent authenticated and authorized users to inject code into HAProxy configuration. CR and LF (\r and \n) are no longer allowed in L7 rule keys and values. The session persistence cookie names must follow the rules described in https://developer.mozilla.org/en- US/docs/Web/HTTP/Headers/Set-Cookie. * Fix load balancers stuck in PENDING_UPDATE issues for some API calls (POST /l7rule, PUT /pool) when a provider denied the call. * The Octavia API returned an unhelpful message when a constraint failed while creating an object in the DB. The error now contains the name and the value of the parameter that breaks the constraints. * When plugging a new member subnet, the amphora sends an IP advertisement of the newly allocated IP. It allows the servers on the same L2 network to flush the ARP entries of a previously allocated IP address. * Validate that the creation of L7 policies is compatible with the protocol of the listener in the Amphora driver. L7 policies are allowed for Terminated HTTPS or HTTP protocol listeners, but not for HTTPS, TCP or UDP protocols listeners. Other Notes *********** * The string representation of data base model objects has been improved. Calling str() on them will return a certain subset of fields and calling repr() on them will return all fields. This is helpful for debugging, but it may also change some of the log messages that Octavia emits. Changes in octavia 10.0.0..10.1.0 --------------------------------- da9dc123 Fix TCP HMs on UDP pools with SELinux b555ffc2 Fix hm operating status to ONLINE in single lb call 202d1dc4 Avoid interface name collisions in the amphora dabd33af Fix pool creation with single LB create call e0f7a145 Send IP advertisements when plugging a new member subnet 09e0beb6 Fix pep8 error dd29742d Prevent incorrect reschedule of resumed tasks with jobboard db22c0b9 Fix serialization of lists in data_models.to_dict e4cfb3e5 Remove incorrect info message ae3cc5b3 Enable taskflow retry feature when waiting for compute 0c8c5037 Fix octavia to accept [ipv6]:port df2a5275 Fix ORM caching for with_for_update calls cc276721 Fix ignored [nova] service_name 6ae3d23e Fix listener creation allowing pool protocol d3191eb9 Fix unclear error messages in the API 524ce505 Fix update listener certs doesn't work 3b3458b7 Fix template issue with user_data_config_drive 3380b292 Fix prometheus-proxy systemd service 4b588d4e Fix grenade job 23a7ca77 Pin pylint on stable/branches 46f774ad Filter out details from taskflow logs with v2+jobboard 2e5bc334 Fix PING health-monitor with recent Centos releases d4d8d597 Fix PING health-monitor with recent haproxy releases 66a62bc2 Fix listener creation with fully-populated API c662e42b Fix full graph loadbalancer creation if jobboard is disabled 3605689a Add a newline when writing the server state file 8aa5eaa8 Handle feature compatibility of HAProxy server-state-file option 74736870 Fix barbican client with application credentials/trusts 5efaf360 Fix prometheus-proxy service name in Red Hat-based distros 0d8a06bd Use python3.9 for tips jobs d4b0c4f5 Restart rsyslog from cloud-init in amphorav1 10042f76 Add *.orig to .gitignore 64947c5f Fix sporadic unit test failure 62e1d1fa Update zuul queue configuration 71c61b80 Fix plugging member subnets on existing networks e76efd82 Passphrase parameters should be secret d75613fa Reconfigure amphora network interfaces seamlessly 0598c4fb Ignore status update on deleted objects in driver-agent 384619ef Cache subnets validation for batch member update 3e6f180b Fix bug when rolling back prov and op status for some API calls 328ffc00 Fix PortNotFound exception when updating a LB after a failover d5565417 Catch exceptions on I/O in driver-agent 995fe216 Apply openstack-selinux policies in Centos amphorae ef76cbf7 Change FIPS jobs to centos-9-stream 1a1c5d42 Fix driver-agent cleanup 74f2baf5 Fix update/delete listener CA/CRL error c8dd836e Move system scoped secure-RBAC to separate file 5ca3849a Fix HealthMonitorToErrorOnRevertTask revert method 2cb52fe6 Improve string representation of DB models e6989982 Fix duplicate object error messages 9a25da98 Fix potential race conditions on update requests in the v2 worker 78603681 Set sensible nf_conntrack_max value in amphora 7c3f2a57 Exclude invalid TLS version ef4ef042 Correct format of release note a2371823 Fix compile_amphora_details when using UDP listeners e397a118 Fix disabled UDP pools 133ec476 Validate L7Rule value and cookie name 399c2f17 Fix new pylint issues 9afb3af6 Reject invalid whitespace in HM url_path value 0df7c6b7 Remove unneeded sudo in lvs-masquerade.sh 4248e98a Deny the creation of L7Policies for HTTPS/TCP/UDP listeners 7aaac224 Fix AttributeError in exception handler 0a062cd6 Save the HAProxy state outside of its systemd unit 1da04d12 Pass timeout_dict to _get_haproxy_versions a8a35e08 Update TOX_CONSTRAINTS_FILE for stable/yoga c2939bc6 Update .gitreview for stable/yoga Diffstat (except docs and test files) ------------------------------------- .gitignore | 2 + .gitreview | 1 + .pylintrc | 5 - diskimage-create/diskimage-create.sh | 9 +- .../prometheus-proxy.service | 2 +- .../12-enable-prometheus-proxy-systemd | 2 +- .../amphora-agent/source-repository-amphora-agent | 4 +- .../static/usr/local/bin/lvs-masquerade.sh | 4 +- elements/amphora-agent/svc-map | 3 + elements/amphora-selinux/README.rst | 3 + elements/amphora-selinux/element-deps | 2 + elements/amphora-selinux/package-installs.json | 4 + elements/amphora-selinux/pkg-map | 12 + .../post-install.d/50-selinux-policies | 22 + .../post-install.d/20-haproxy-tune-kernel | 8 + elements/octavia-lib/source-repository-octavia-lib | 2 +- etc/policy/README.rst | 12 + etc/policy/keystone_default_roles-policy.yaml | 6 +- .../keystone_default_roles_scoped-policy.yaml | 37 + .../backends/agent/api_server/amphora_info.py | 8 +- .../backends/agent/api_server/loadbalancer.py | 14 +- .../amphorae/backends/agent/api_server/osutils.py | 26 +- octavia/amphorae/backends/agent/api_server/plug.py | 103 ++- .../amphorae/backends/agent/api_server/server.py | 3 +- .../api_server/templates/amphora-netns.systemd.j2 | 3 + .../agent/api_server/templates/systemd.conf.j2 | 1 - octavia/amphorae/backends/agent/api_server/util.py | 21 + .../backends/health_daemon/health_sender.py | 2 + octavia/amphorae/backends/utils/haproxy_query.py | 28 +- octavia/amphorae/backends/utils/interface.py | 231 +++++- octavia/amphorae/backends/utils/interface_file.py | 106 ++- octavia/amphorae/backends/utils/network_utils.py | 3 +- octavia/amphorae/drivers/driver_base.py | 9 +- .../amphorae/drivers/haproxy/rest_api_driver.py | 104 ++- .../drivers/keepalived/vrrp_rest_driver.py | 3 +- octavia/amphorae/drivers/noop_driver/driver.py | 11 +- octavia/api/drivers/amphora_driver/v1/driver.py | 13 + octavia/api/drivers/amphora_driver/v2/driver.py | 13 + .../api/drivers/driver_agent/driver_listener.py | 99 +-- octavia/api/drivers/driver_agent/driver_updater.py | 14 +- octavia/api/drivers/utils.py | 12 +- octavia/api/v2/controllers/health_monitor.py | 8 +- octavia/api/v2/controllers/l7policy.py | 8 +- octavia/api/v2/controllers/l7rule.py | 10 +- octavia/api/v2/controllers/listener.py | 14 +- octavia/api/v2/controllers/member.py | 48 +- octavia/api/v2/controllers/pool.py | 10 +- octavia/api/v2/types/l7rule.py | 13 +- octavia/api/v2/types/listener.py | 7 +- octavia/api/v2/types/pool.py | 14 +- octavia/certificates/common/auth/barbican_acl.py | 27 +- octavia/certificates/common/local.py | 6 +- octavia/common/base_taskflow.py | 97 ++- octavia/common/config.py | 8 +- octavia/common/constants.py | 16 +- octavia/common/data_models.py | 95 +-- .../jinja/haproxy/combined_listeners/jinja_cfg.py | 18 +- .../haproxy/combined_listeners/templates/base.j2 | 5 + .../combined_listeners/templates/haproxy.cfg.j2 | 2 +- .../haproxy/combined_listeners/templates/macros.j2 | 4 +- octavia/common/jinja/lvs/templates/macros.j2 | 6 +- octavia/common/validate.py | 1 + octavia/compute/drivers/nova_driver.py | 1 + octavia/controller/worker/v1/controller_worker.py | 3 + .../controller/worker/v1/flows/amphora_flows.py | 7 +- .../controller/worker/v1/flows/listener_flows.py | 3 + .../worker/v1/flows/load_balancer_flows.py | 33 +- octavia/controller/worker/v1/flows/member_flows.py | 31 +- .../worker/v1/tasks/amphora_driver_tasks.py | 14 +- .../controller/worker/v1/tasks/compute_tasks.py | 9 +- .../controller/worker/v1/tasks/database_tasks.py | 44 +- .../controller/worker/v1/tasks/lifecycle_tasks.py | 2 +- .../controller/worker/v1/tasks/network_tasks.py | 257 +++++-- octavia/controller/worker/v2/controller_worker.py | 94 ++- .../controller/worker/v2/flows/amphora_flows.py | 36 +- .../controller/worker/v2/flows/listener_flows.py | 3 + .../worker/v2/flows/load_balancer_flows.py | 34 +- octavia/controller/worker/v2/flows/member_flows.py | 31 +- .../worker/v2/tasks/amphora_driver_tasks.py | 16 +- .../controller/worker/v2/tasks/compute_tasks.py | 43 +- .../controller/worker/v2/tasks/database_tasks.py | 45 +- .../controller/worker/v2/tasks/lifecycle_tasks.py | 2 +- .../controller/worker/v2/tasks/network_tasks.py | 258 +++++-- octavia/db/base_models.py | 7 + octavia/db/models.py | 63 ++ octavia/db/repositories.py | 94 ++- octavia/hacking/checks.py | 2 +- octavia/network/base.py | 31 +- octavia/network/data_models.py | 5 +- .../drivers/neutron/allowed_address_pairs.py | 10 +- octavia/network/drivers/neutron/base.py | 32 + octavia/network/drivers/noop_driver/driver.py | 76 +- .../backend/agent/api_server/test_server.py | 74 +- .../api/drivers/driver_agent/test_driver_agent.py | 37 + .../backends/agent/api_server/test_amphora_info.py | 13 +- .../agent/api_server/test_haproxy_compatibility.py | 2 - .../backends/agent/api_server/test_loadbalancer.py | 5 +- .../backends/agent/api_server/test_osutils.py | 16 + .../backends/agent/api_server/test_plug.py | 200 ++++- .../backends/agent/api_server/test_util.py | 35 + .../backends/health_daemon/test_health_sender.py | 18 + .../amphorae/backends/utils/test_haproxy_query.py | 28 + .../unit/amphorae/backends/utils/test_interface.py | 282 ++++++- .../amphorae/backends/utils/test_interface_file.py | 160 +++- .../drivers/haproxy/test_rest_api_driver_0_5.py | 60 +- .../drivers/haproxy/test_rest_api_driver_1_0.py | 90 ++- .../amphorae/drivers/noop_driver/test_driver.py | 4 +- .../api/drivers/amphora_driver/v1/test_driver.py | 20 +- .../api/drivers/amphora_driver/v2/test_driver.py | 20 +- .../drivers/driver_agent/test_driver_listener.py | 173 ++++- .../certificates/common/auth/test_barbican_acl.py | 3 +- .../haproxy/combined_listeners/test_jinja_cfg.py | 186 ++++- .../sample_configs/sample_configs_combined.py | 26 +- .../common/sample_configs/sample_configs_split.py | 20 +- .../worker/v1/flows/test_amphora_flows.py | 8 +- .../worker/v1/flows/test_load_balancer_flows.py | 19 +- .../worker/v1/flows/test_member_flows.py | 25 +- .../worker/v1/tasks/test_amphora_driver_tasks.py | 18 +- .../worker/v1/tasks/test_compute_tasks.py | 44 +- .../worker/v1/tasks/test_database_tasks.py | 63 +- .../worker/v1/tasks/test_lifecycle_tasks.py | 2 +- .../worker/v1/tasks/test_network_tasks.py | 835 ++++++++++++++++++--- .../controller/worker/v1/test_controller_worker.py | 5 + .../worker/v2/flows/test_amphora_flows.py | 4 +- .../worker/v2/flows/test_load_balancer_flows.py | 19 +- .../worker/v2/flows/test_member_flows.py | 21 +- .../worker/v2/tasks/test_amphora_driver_tasks.py | 26 +- .../worker/v2/tasks/test_compute_tasks.py | 8 +- .../worker/v2/tasks/test_database_tasks.py | 56 +- .../worker/v2/tasks/test_lifecycle_tasks.py | 2 +- .../worker/v2/tasks/test_network_tasks.py | 803 ++++++++++++++++---- .../controller/worker/v2/test_controller_worker.py | 270 ++++++- .../drivers/neutron/test_allowed_address_pairs.py | 7 +- .../unit/network/drivers/neutron/test_base.py | 141 ++++ .../network/drivers/noop_driver/test_driver.py | 67 +- .../notes/catch_validation-27ffe48ca187c46f.yaml | 8 + ...syslog-reloaded-amphorav1-a4ec5127a459f3bf.yaml | 7 + ...mation-from-taskflow-logs-0d8697140423b4d5.yaml | 12 + ...tial-tokens-with-barbican-3b7d13283206c124.yaml | 5 + ...ber-update-race-condition-09b82e2cc3121e03.yaml | 5 + ...putewait-with-persistence-d10223bfb48a0ded.yaml | 6 + ...-global-server-state-file-325ab7c62e21ff14.yaml | 7 + .../fix-disabled-udp-pool-3e84558f996017d5.yaml | 5 + ...r-agent-graceful-shutdown-daff9ffaccb09a9e.yaml | 7 + ...nforced-selinux-on-centos-27842ca6afbb500c.yaml | 4 + ...dbalancer-creation-if-jobboard-is-disabled.yaml | 5 + ...opulated-lb-with-listener-92a369ea8d57e8f5.yaml | 5 + ...y-about-server-state-file-df70e5ac859417e2.yaml | 7 + ...itor-to-error-revert-task-feb38ba7641a4892.yaml | 6 + ...-online-in-single-lb-call-214a7ca22937a877.yaml | 5 + ...ress-enclosed-in-brackets-c1cfc4717465ba09.yaml | 6 + ...on-allowing-pool-protocol-b9e9ef147f6eeaf4.yaml | 5 + ...tener-update-certs-failed-315c66f4806e76c8.yaml | 5 + ...twork-interface-collision-939fd32587ea3344.yaml | 8 + ...onntrack-max-value-in-amp-0e16eb50b42e7b58.yaml | 15 + .../fix-nova-service_name-6bde4970047817f4.yaml | 6 + ...-ping-hm-on-centos-stream-6624f19c8da86e22.yaml | 6 + ...-ping-hm-with-haproxy-2.2-9b83777172fb8835.yaml | 6 + ...x-plugging-member-subnets-8560cd9403ff79a7.yaml | 8 + ...tatus-on-lb-single-create-897070aee0a42da6.yaml | 5 + ...-qos-apply-after-failover-561abbd153ab88ee.yaml | 6 + ...race-condiction-on-update-b5330c8fcf1800cd.yaml | 7 + ...chedule-of-jobboard-tasks-929c066dea9267fd.yaml | 5 + ...ue-with-lvs-masquerade.sh-ebbb89886148c70f.yaml | 6 + ...linux-tcp-hm-on-udp-pools-89c3b8db89e359ba.yaml | 7 + ...ut-dict-in-failover-tasks-537456e0fe1d7cb8.yaml | 9 + ...s-container-serialization-1cb83ad4c9eca3b8.yaml | 6 + ...-update-listener-ca-error-167464debc06cba2.yaml | 5 + ...ix-user_data_config_drive-b4ce8cc66fb21365.yaml | 6 + ...rules-and-session-cookies-cb88f3f1b90171f9.yaml | 9 + ...UPDATE-on-provider-errors-40a03adc8ef82a54.yaml | 5 + ...essage-failed-constraints-6ad10bd22cac523a.yaml | 6 + ...epresentation-of-db-model-1c4fe799186b4dea.yaml | 7 + ...-subnet-ip-advertisements-af2264844079ef6b.yaml | 6 + .../ping-healthcheck-selinux-e3b7d360c8503527.yaml | 6 + ...-protocols-for-l7policies-83d678171f13136a.yaml | 7 + ...rl_path-value-in-requests-3eb3adedcd696433.yaml | 7 + test-requirements.txt | 2 +- tox.ini | 8 +- zuul.d/jobs.yaml | 45 +- zuul.d/projects.yaml | 2 +- 197 files changed, 6080 insertions(+), 1231 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index a4e7a9ba..555d738c 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -11 +11 @@ oslotest>=3.2.0 # Apache-2.0 -pylint>=2.5.3 # GPLv2 +pylint>=2.5.3,<=2.15.10 # GPLv2

1 0

openstack-ansible 27.0.1 (antelope)
by no-reply＠openstack.org 19 Jul '23

19 Jul '23

We high-spiritedly announce the release of: openstack-ansible 27.0.1: Ansible playbooks for deploying OpenStack This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ Please report issues through: https://bugs.launchpad.net/openstack-ansible/+bugs For more details, please see below. Changes in openstack-ansible 27.0.0..27.0.1 ------------------------------------------- 400b89e92 Pin version of setuptools 9921c23ea Bump SHAs for stable/2023.1 a4a5925e5 Adjust default value for *_backend_ssl 49f0bd36e Add support for 'tls-transition' scenario 02d037920 Ensure management_address is used instead of ansible_host b107778f6 Add 2023.1 to the compatability matrix 7230336c0 [doc] Update upgrade guide to mention SLURP 2dffd36fa Remove other releases from 2023.1 index page Diffstat (except docs and test files) ------------------------------------- ansible-collection-requirements.yml | 2 +- ansible-role-requirements.yml | 34 ++-- deploy-guide/source/conf.py | 4 +- .../admin/upgrades/os-compatibility-matrix.html | 27 +++ global-requirement-pins.txt | 1 + inventory/group_vars/all/infra.yml | 6 +- inventory/group_vars/all/source_git.yml | 4 +- .../group_vars/blazar_all/haproxy_service.yml | 2 +- inventory/group_vars/cinder_all/source_git.yml | 4 +- inventory/group_vars/designate_all/source_git.yml | 4 +- inventory/group_vars/galera_all.yml | 4 +- inventory/group_vars/gnocchi_all/source_git.yml | 5 +- .../group_vars/horizon_all/haproxy_service.yml | 2 +- inventory/group_vars/horizon_all/source_git.yml | 6 +- inventory/group_vars/ironic_all/source_git.yml | 4 +- inventory/group_vars/magnum_all/source_git.yml | 4 +- inventory/group_vars/memcached.yml | 2 +- inventory/group_vars/neutron_all/source_git.yml | 6 +- inventory/group_vars/nova_all/source_git.yml | 4 +- inventory/group_vars/octavia_all/source_git.yml | 6 +- inventory/group_vars/swift_all/source_git.yml | 4 +- inventory/group_vars/trove_all/source_git.yml | 4 +- playbooks/common-tasks/unbound-clients.yml | 2 +- playbooks/healthcheck-infrastructure.yml | 18 +- .../galera-cluster-rolling-restart.yml | 2 +- .../bootstrap-host/tasks/prepare_aio_config.yml | 3 + .../templates/user_variables_tls-transition.yml.j2 | 21 +++ 30 files changed, 145 insertions(+), 260 deletions(-)

1 0

XStatic-Angular-lrdragndrop 1.0.2.6
by no-reply＠openstack.org 19 Jul '23

19 Jul '23

We are pumped to announce the release of: XStatic-Angular-lrdragndrop 1.0.2.6: Angular-lrdragndrop 1.0.2 (XStatic packaging standard) The source is available from: https://opendev.org/openstack/XStatic-Angular-lrdragndrop Download the package from: https://pypi.org/project/XStatic-Angular-lrdragndrop For more details, please see below. Changes in XStatic-Angular-lrdragndrop 1.0.2.5..1.0.2.6 ------------------------------------------------------- c4790f2 Fix syntax error in isJqueryEventDataTransfer function Diffstat (except docs and test files) ------------------------------------- xstatic/pkg/angular_lrdragndrop/__init__.py | 2 +- xstatic/pkg/angular_lrdragndrop/data/lrdragndrop.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)

1 0