September 2024 - Release-announce

skyline-console 5.0.0.0rc2 (dalmatian)
by no-reply＠openstack.org 27 Sep '24

27 Sep '24

Hello everyone, A new release candidate for skyline-console for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/skyline-console/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/skyline-console/src/branch/stable/dalmatian Release notes for skyline-console can be found at: https://docs.openstack.org/releasenotes/skyline-console/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/skyline-apiserver/+bugs and tag it *dalmatian-rc-potential* to bring it to the skyline-console release crew's attention.

1 0

manila 19.0.0.0rc2 (dalmatian)
by no-reply＠openstack.org 27 Sep '24

27 Sep '24

Hello everyone, A new release candidate for manila for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/manila/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/manila/src/branch/stable/dalmatian Release notes for manila can be found at: https://docs.openstack.org/releasenotes/manila/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/manila/+bugs and tag it *dalmatian-rc-potential* to bring it to the manila release crew's attention.

1 0

zun-tempest-plugin 4.10.0 (dalmatian)
by no-reply＠openstack.org 26 Sep '24

26 Sep '24

We high-spiritedly announce the release of: zun-tempest-plugin 4.10.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/zun-tempest-plugin Download the package from: https://tarballs.openstack.org/zun-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/zun/+bugs For more details, please see below. Changes in zun-tempest-plugin xena-last..4.10.0 ----------------------------------------------- 8a0b3cf Add stable/2023.1 jobs on master gate Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)

1 0

kuryr-libnetwork 14.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 26 Sep '24

26 Sep '24

Hello everyone, A new release candidate for kuryr-libnetwork for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kuryr-libnetwork/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/kuryr-libnetwork/src/branch/stable/dalmatian Release notes for kuryr-libnetwork can be found at: https://docs.openstack.org/releasenotes/kuryr-libnetwork/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/kuryr-libnetwork/+bugs and tag it *dalmatian-rc-potential* to bring it to the kuryr-libnetwork release crew's attention.

1 0

cinder 25.0.0.0rc2 (dalmatian)
by no-reply＠openstack.org 26 Sep '24

26 Sep '24

Hello everyone, A new release candidate for cinder for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/cinder/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/cinder/src/branch/stable/dalmatian Release notes for cinder can be found at: https://docs.openstack.org/releasenotes/cinder/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/cinder/+bugs and tag it *dalmatian-rc-potential* to bring it to the cinder release crew's attention.

1 0

neutron 25.0.0.0rc2 (dalmatian)
by no-reply＠openstack.org 25 Sep '24

25 Sep '24

Hello everyone, A new release candidate for neutron for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/neutron/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/neutron/src/branch/stable/dalmatian Release notes for neutron can be found at: https://docs.openstack.org/releasenotes/neutron/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron/+bugs and tag it *dalmatian-rc-potential* to bring it to the neutron release crew's attention.

1 0

zun 14.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 25 Sep '24

25 Sep '24

Hello everyone, A new release candidate for zun for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/zun/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/zun/src/branch/stable/dalmatian Release notes for zun can be found at: https://docs.openstack.org/releasenotes/zun/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/zun/+bugs and tag it *dalmatian-rc-potential* to bring it to the zun release crew's attention.

1 0

manila-tempest-plugin 2.5.0 (dalmatian)
by no-reply＠openstack.org 25 Sep '24

25 Sep '24

We exuberantly announce the release of: manila-tempest-plugin 2.5.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/manila-tempest-plugin Download the package from: https://tarballs.openstack.org/manila-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/manila/+bugs For more details, please see below. Changes in manila-tempest-plugin 2.4.0..2.5.0 --------------------------------------------- 0f6b522 Fix cephfs-nfs job 94d5164 Disable Ceph for Nova in cephfs-nfs multinode job 1161810 Add waiter to access create on resource setup b758fb4 Skip test_share_extend in CephFS jobs a042024 Enable API testing with standalone cephfs-nfs job a04b5f6 Fix multinode-cpehfs-nfs-cephadm e73f63c Fix lack of share type id in share creation Diffstat (except docs and test files) ------------------------------------- .../api/test_access_rules_metadata_negative.py | 4 ++++ zuul.d/manila-tempest-jobs.yaml | 22 ++++++++++++++++++---- 3 files changed, 25 insertions(+), 6 deletions(-)

1 0

tempest 41.0.0 (dalmatian)
by no-reply＠openstack.org 25 Sep '24

25 Sep '24

We joyfully announce the release of: tempest 41.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/tempest Download the package from: https://pypi.org/project/tempest Please report issues through: https://bugs.launchpad.net/tempest/+bugs For more details, please see below. 41.0.0 ^^^^^^ Prelude ******* This release is to tag Tempest for OpenStack 2024.2 release. This release marks the start of 2024.2 release support in Tempest. After this release, Tempest will support below OpenStack Releases: * 2024.2 * 2024.1 * 2023.2 * 2023.1 Current development of Tempest is for OpenStack 2025.1 development cycle. Every Tempest commit is also tested against master during the 2025.1 cycle. However, this does not necessarily mean that using Tempest as of this tag will work against a 2025.1 (or future release) cloud. To be on safe side, use this tag to test the OpenStack 2024.2 release. New Features ************ * Adding a new config options *[scenario]/target_dir* which allows users to specify the location where timestamps files will be written to. The default value is /tmp that, however, cannot be expected to persist across reboots of an instance. * Add support for project manager and domain manager personas by adding "get_project_manager_creds" and "get_domain_manager_creds" to the "DynamicCredentialProvider" and "PreProvisionedCredentialProvider" classes of the common library. Changes in tempest 40.0.0..41.0.0 --------------------------------- 7e247a7b0 Use stable constraint in tox to release new tag for 2024.2 b98ab0b2b Add releasenote to tag the Tempest for 2024.2 release 09cff3cb7 Enable snapshot deletion with deps on ceph d6437c9dd Wait for all instance ports to become ACTIVE 9086dca53 Parametrize target_dir for the timestamp ef2ad57d9 Add releasenotes page for version 40.0.0 f8fe4c702 Drop centos 8 stream jobs a0199bfcd Add credential generation for manager personas fb97bde51 Switch to the master constraint in tox.ini 57183797b Add wait for location import task 9f6fce1bd Fix AttributeError with 'SSHExecCommandFailed' Diffstat (except docs and test files) ------------------------------------- ...rio-config-opt-target-dir-5a969b64be1dc718.yaml | 7 +++ .../notes/add-manager-creds-49acd9192110c3e3.yaml | 7 +++ .../tempest-2024-2-release-78846595720db3cd.yaml | 17 +++++++ releasenotes/source/index.rst | 1 + releasenotes/source/v40.0.0.rst | 6 +++ tempest/api/compute/base.py | 2 +- tempest/api/compute/images/test_images.py | 24 +++++++++ tempest/api/volume/test_volume_delete_cascade.py | 5 +- tempest/common/waiters.py | 22 +++++++++ tempest/config.py | 5 +- tempest/lib/common/cred_provider.py | 8 +++ tempest/lib/common/dynamic_creds.py | 8 ++- tempest/lib/common/preprov_creds.py | 14 ++++++ tempest/scenario/manager.py | 21 ++++++-- tox.ini | 10 ++-- zuul.d/integrated-gate.yaml | 15 ------ zuul.d/project.yaml | 14 ++---- zuul.d/stable-jobs.yaml | 38 --------------- 22 files changed, 309 insertions(+), 81 deletions(-)

1 0

ansible-role-thales-hsm 8.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 25 Sep '24

25 Sep '24

Hello everyone, A new release candidate for ansible-role-thales-hsm for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/ansible-role-thales-hsm/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/ansible-role-thales-hsm/src/branch/stable/dal… Release notes for ansible-role-thales-hsm can be found at: https://docs.openstack.org/releasenotes/ansible-role-thales-hsm/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/1184 and tag it *dalmatian-rc-potential* to bring it to the ansible-role-thales-hsm release crew's attention.

1 0

neutron-tempest-plugin 2.9.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are psyched to announce the release of: neutron-tempest-plugin 2.9.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/neutron-tempest-plugin Download the package from: https://tarballs.openstack.org/neutron-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. Changes in neutron-tempest-plugin zed-last..2.9.0 ------------------------------------------------- 153b67d Revert "Neutron&Designate DNS integration - some enhancements" 3c1f829 Add 2024.2 (Dalmatian) stable jobs 9be9375 Skip NetworkWritableMtuTest when driver is ML2/OVN 4f3dbe4 Add test for extension "quota-check-limit-default" 86ddcd2 refactor: Remove unused code from utils and tests 3c3eace Log console output on con.test_connection timeout 9044cdf zuul: remove obsolete job definitions 2f8c956 Switch enforce-scope job to ovn bccb600 Revert "Make neutron-tempest-plugin-designate-scenario non voting" 9881eff Update snat_rules_apply_to_nested_networks with ovn details 65b00c0 Add tests for the 'trusted' attribute in port resource 444a68e Revert "Switch networking-sfc job to be run with eventlet" 7c4473d Make neutron-tempest-plugin-designate-scenario non voting 279eea9 Use ovs and ovn from packages 889566a Implement nested snat validation test scenario 8a74ef3 Remove unstable_test from FIP test_east_west 2d66355 refactor: don't require host= for check_connectivity a8c221c [pagination tests] Do not fail on zero resources c37caf4 Revert "Make neutron-tempest-plugin-sfc job non-voting temporary" c1fe226 Switch networking-sfc job to be run with eventlet 4a0b234 Test metadata query over IPv6 only network with OVS and LB 0274381 Filter resources in pagination tests to avoid random failures e0d03fc Test metadata query over IPv6 only network 5225abc Fix check of the revision number in the resonse from API 56d4dc9 Bump swap to 3GB in linuxbridge and openvswitch jobs a7a7ce8 Temporary switch lb/ovs/ovn scenario jobs to cirros-0.5.3 5c5dc01 Make neutron-tempest-plugin-designate-scenario non-voting temporary 575840d [WSGI] Move all OVS jobs to use WSGI API module 8f72612 Add a new client method: "get_loaded_network_extensions" 9674758 [ovn jobs] collect northd and controller logs 9aec7b6 Add test for the validate auto_allocated_topology API 2fa58d9 Add wsgi enabled OVS and OVN tempest jobs 74a78a4 Make neutron-tempest-plugin-sfc job non-voting temporary 5019dce UM only: change zed to use unmaintained/ aa8581b Fix incorrect services/externaldns line 671fdd3 Fix regex lines in zuul.d/* files c76727b Use RE2 compatible regex for irrelevant-files 58016a6 Add pre-commit configuration 1a8b36e Remove devstack-gate requirement 1bb8e62 Add Active Active L3 GW scenario test cases ba353d3 Remove old excludes 22bc061 Stop running zed jobs in check/gate 52e6cb7 Negative test: set quota lower than resource count 537dc18 Switch to neutron-tempest-plugin-2.6.0 in yoga jobs eb17a84 UM only: change wallaby and xena to use unmaintained/ 7013c81 Neutron&Designate DNS integration - some enhancements Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 33 + neutron_tempest_plugin/api/admin/test_ports.py | 36 + neutron_tempest_plugin/api/admin/test_quotas.py | 19 +- .../api/admin/test_quotas_negative.py | 17 + neutron_tempest_plugin/api/base.py | 54 +- .../api/test_auto_allocated_topology.py | 8 + .../api/test_router_interface_fip.py | 2 +- neutron_tempest_plugin/api/test_routers.py | 7 +- neutron_tempest_plugin/api/test_security_groups.py | 11 +- neutron_tempest_plugin/api/test_subnets.py | 5 +- neutron_tempest_plugin/common/utils.py | 11 - neutron_tempest_plugin/config.py | 6 + neutron_tempest_plugin/scenario/base.py | 15 +- neutron_tempest_plugin/scenario/test_floatingip.py | 57 +- neutron_tempest_plugin/scenario/test_metadata.py | 66 +- neutron_tempest_plugin/scenario/test_mtu.py | 12 +- .../scenario/test_multiple_gws.py | 750 +++++++++++++++++++++ .../scenario/test_security_groups.py | 54 +- neutron_tempest_plugin/scenario/test_trunk.py | 1 - .../scenario/test_vlan_transparency.py | 4 +- .../services/network/json/network_client.py | 8 + playbooks/plugin-ovn-scenario-pre-run.yaml | 3 + requirements.txt | 10 +- test-requirements.txt | 6 +- zuul.d/2023_1_jobs.yaml | 22 +- zuul.d/2023_2_jobs.yaml | 22 +- zuul.d/2024_1_jobs.yaml | 22 +- zuul.d/2024_2_jobs.yaml | 272 ++++++++ zuul.d/base-nested-switch.yaml | 7 +- zuul.d/master_jobs.yaml | 278 ++++++-- zuul.d/project.yaml | 43 +- zuul.d/victoria_jobs.yaml | 11 + zuul.d/wallaby_jobs.yaml | 32 +- zuul.d/xena_jobs.yaml | 37 +- zuul.d/yoga_jobs.yaml | 17 +- zuul.d/zed_jobs.yaml | 56 +- 38 files changed, 1783 insertions(+), 238 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 9423079..957f186 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,5 +1 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - -pbr!=2.1.0,>=2.0.0 # Apache-2.0 +pbr>=3.0.0 # Apache-2.0 @@ -11 +7 @@ oslo.log>=3.36.0 # Apache-2.0 -oslo.serialization!=2.19.1,>=2.18.0 # Apache-2.0 +oslo.serialization>=2.20.0 # Apache-2.0 @@ -19 +15 @@ testtools>=2.2.0 # MIT -eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT +eventlet>=0.21.0 # MIT diff --git a/test-requirements.txt b/test-requirements.txt index f5bac7c..0151f21 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,4 +0,0 @@ -# The order of packages is significant, because pip processes them in the order -# of appearance. Changing the order has an impact on the overall integration -# process, which may cause wedges in the gate later. - @@ -7 +3 @@ hacking>=3.2.0,<3.3.0 # Apache-2.0 -coverage!=4.4,>=4.0 # Apache-2.0 +coverage>=4.4.1 # Apache-2.0

1 0

designate-tempest-plugin 0.23.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are happy to announce the release of: designate-tempest-plugin 0.23.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/designate-tempest-plugin Download the package from: https://tarballs.openstack.org/designate-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/designate/+bugs For more details, please see below. Changes in designate-tempest-plugin zed-last..0.23.0 ---------------------------------------------------- bb1996d Remove system scope token usage 3871e53 Add stable/2024.1 jobs on master gate 97a6de4 Remove stable/zed and add stable/caracal jobs 93ff912 doc: Update the module of services decorator 701612d Updating python testing classifier as per Yoga testing runtime Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 14 ++--- setup.cfg | 1 + 33 files changed, 216 insertions(+), 578 deletions(-)

1 0

barbican-tempest-plugin 4.1.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are satisfied to announce the release of: barbican-tempest-plugin 4.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/barbican-tempest-plugin Download the package from: https://tarballs.openstack.org/barbican-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/barbican/+bugs For more details, please see below. Changes in barbican-tempest-plugin zed-last..4.1.0 -------------------------------------------------- d7f9674 Add stable/2024.1 jobs on master gate Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+)

1 0

keystone-tempest-plugin 0.17.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are thrilled to announce the release of: keystone-tempest-plugin 0.17.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/keystone-tempest-plugin Download the package from: https://tarballs.openstack.org/keystone-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. Changes in keystone-tempest-plugin 0.16.0..0.17.0 ------------------------------------------------- 3338cb4 Fix bugs link e8cec01 Adjust domain tests for changed list_domains scoping behavior fe77bfd Drop reference to removed glance-registry eb302c9 Cleanup py27 support Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 1 - README.rst | 2 +- setup.py | 9 --------- 4 files changed, 8 insertions(+), 11 deletions(-)

1 0

telemetry-tempest-plugin 2.3.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are glad to announce the release of: telemetry-tempest-plugin 2.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/telemetry-tempest-plugin Download the package from: https://tarballs.openstack.org/telemetry-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/ceilometer/+bugs For more details, please see below. Changes in telemetry-tempest-plugin 2.2.0..2.3.0 ------------------------------------------------ 405a904 Poll multiple times for deleted resources. b33ad02 Cleanup leftover stacks. 615dc19 Add basic admin tests for Aodh Diffstat (except docs and test files) ------------------------------------- .../aodh/api/admin/__init__.py | 0 .../aodh/api/admin/test_alarming_api_admin.py | 115 +++++++++++++++++++++ telemetry_tempest_plugin/aodh/api/base.py | 12 +++ .../telemetry_integration_gabbits/autoscaling.yaml | 6 ++ .../autoscaling.yaml | 6 ++ .../scenario/test_telemetry_integration.py | 31 +++++- .../test_telemetry_integration_prometheus.py | 34 +++++- 7 files changed, 200 insertions(+), 4 deletions(-)

1 0

watcher-tempest-plugin 3.2.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are happy to announce the release of: watcher-tempest-plugin 3.2.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/watcher-tempest-plugin Download the package from: https://tarballs.openstack.org/watcher-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/watcher/+bugs For more details, please see below. Changes in watcher-tempest-plugin zed-last..3.2.0 ------------------------------------------------- 0076e32 Add stable/2023.2|2024.1 jobs on master gate Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 34 ++++++++++------------------------ 1 file changed, 10 insertions(+), 24 deletions(-)

1 0

glance-tempest-plugin 0.10.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are pleased to announce the release of: glance-tempest-plugin 0.10.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/glance-tempest-plugin Download the package from: https://tarballs.openstack.org/glance-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. Changes in glance-tempest-plugin zed-last..0.10.0 ------------------------------------------------- e94d4cf Update CI testing configuration Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-)

1 0

cinder-tempest-plugin 1.15.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are gleeful to announce the release of: cinder-tempest-plugin 1.15.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/cinder-tempest-plugin Download the package from: https://tarballs.openstack.org/cinder-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. Changes in cinder-tempest-plugin 1.14.0..1.15.0 ----------------------------------------------- 7329a20 Multiattach: Fix implicit requirement for encryption support 1aa0a56 Skip image format detection tests for compute 68347e7 Conditionallly skip manage snapshot tests 2480d48 Drop centos 8 stream jobs 1c6b23d Replace use of deprecated devstack option edd1933 Bump hacking to 6.1.0 b4ab5d6 Remove unused babel.cfg Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 17 +++++++--------- babel.cfg | 2 -- cinder_tempest_plugin/rbac/v3/test_snapshots.py | 12 +++++++++++ .../scenario/test_volume_multiattach.py | 23 ++++++++++++++-------- test-requirements.txt | 2 +- 5 files changed, 35 insertions(+), 21 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 905ad51..cb279bc 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking>=3.0.1,<3.1 # Apache-2.0 +hacking>=6.1.0,<7.0 # Apache-2.0

1 0

octavia-tempest-plugin 2.8.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are happy to announce the release of: octavia-tempest-plugin 2.8.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/octavia-tempest-plugin Download the package from: https://tarballs.openstack.org/octavia-tempest-plugin/ Please report issues through: https://storyboard.openstack.org/#!/project/908 For more details, please see below. 2.8.0 ^^^^^ Other Notes * When using the "keystone_default_roles" RBAC tests, the "load- balancer_*" roles are no longer used by tempest, it relies only on the keystone "admin", "member", "reader" roles. The "[load_balancer].member_role", "[load_balancer].admin_role", "[load_balancer].observer_role" and "[load_balancer].global_observer_role" settings are ignored. Changes in octavia-tempest-plugin zed-last..2.8.0 ------------------------------------------------- 0dbd292 Updates of jobs config for 2024.2 cba3b22 Use only keystone roles in keystone RBAC tests c4eb494 Add stable/2024.1 jobs on master gate 1e90ece Add backup member tests 946527e Add testing jobs for Rocky Linux Diffstat (except docs and test files) ------------------------------------- octavia_tempest_plugin/common/constants.py | 2 + ...one-default-roles-changes-10733c184f0eebc3.yaml | 9 ++ zuul.d/jobs.yaml | 139 ++++++++++------- zuul.d/projects.yaml | 14 ++ 7 files changed, 454 insertions(+), 70 deletions(-)

1 0

ironic-tempest-plugin 2.11.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are delighted to announce the release of: ironic-tempest-plugin 2.11.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-tempest-plugin Download the package from: https://tarballs.openstack.org/ironic-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. Changes in ironic-tempest-plugin zed-last..2.11.0 ------------------------------------------------- f51e00f The adoption test should not depend on the iscsi deploy cf168b8 Add tempest tests for runbooks 540ab0c CI: scale back the number of inspector and scope enforced jobs 7faed25 Work around missing microversion headers on / b294d96 A simple standalone test for in-band inspection feb584a reboot the node in basic ops tests a41979e Exclude ramdisk tests with tinycore in uefi mode 332dacd Handle invalid configuration for vif test execution 5fdaffe Patch to enforce json extension works in existing API behaviour 19d1006 Additional test state fixes 56b1631 Vmedia advanced ops: Clarify config drive and don't ping after rebuild Diffstat (except docs and test files) ------------------------------------- ironic_tempest_plugin/config.py | 9 +- ironic_tempest_plugin/services/baremetal/base.py | 19 +- .../services/baremetal/v1/json/baremetal_client.py | 97 ++++-- .../scenario/ironic_standalone/test_adoption.py | 2 +- .../ironic_standalone/test_advanced_ops.py | 5 +- .../ironic_standalone/test_inspection_basic.py | 56 +++- .../scenario/test_baremetal_boot_from_volume.py | 3 + zuul.d/project.yaml | 33 +- zuul.d/stable-jobs.yaml | 288 ----------------- 20 files changed, 1098 insertions(+), 426 deletions(-)

1 0

venus-tempest-plugin 3.3.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are ecstatic to announce the release of: venus-tempest-plugin 3.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/venus-tempest-plugin Download the package from: https://tarballs.openstack.org/venus-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/openstack-venus/+bugs For more details, please see below. Changes in venus-tempest-plugin 3.1.0..3.3.0 -------------------------------------------- b6eb963 add venus api testcase for list api versions Diffstat (except docs and test files) ------------------------------------- venus_tempest_plugin/services/venus_rest_client.py | 5 ++++ 2 files changed, 35 insertions(+)

1 0

ironic-inspector 12.3.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We exuberantly announce the release of: ironic-inspector 12.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-inspector Download the package from: https://tarballs.openstack.org/ironic-inspector/ Please report issues through: https://bugs.launchpad.net/ironic-inspector/+bugs For more details, please see below. 12.3.0 ^^^^^^ Deprecation Notes ***************** * This project is now in the maintenance mode and new deployments of it are discouraged. Please use built-in in-band inspection in ironic (https://docs.openstack.org/ironic/latest/admin/inspection/index.ht ml) instead. For existing deployments, see the migration guide (htt ps://docs.openstack.org/ironic/latest/admin/inspection/migration.ht ml). Bug Fixes ********* * No longer throws an exception if an address of some node cannot be resolved, but just logs a warning instead. This fixes the issue that if an address of any other node is not resolvable, no new node can be registered, even if its own address is resolvable. * Fixes memory leak with openstacksdk 2.0 and newer. This version requires connections to be explicitly closed, otherwise they stay in memory forever. Changes in ironic-inspector 12.2.0..12.3.0 ------------------------------------------ 2318bf7 Fix: ignore resolve error while looking up node a031db7 Imported Translations from Zanata 80c6cfa Drop SQLALCHEMY_WARN_20 54242ba Try enabling port 5050 on PUBLIC_BRIDGE 751c199 Fix versions in release notes e3e23b6 Link to configuration options 4324871 Imported Translations from Zanata d897a4d Don't fail if data already migrated 2084ae1 Imported Translations from Zanata e96ee4b Deprecate the project 48a3bf6 Cache openstacksdk Connections to avoid leaking memory c11113d Follow up to broken Zuul config 2d909b4 Excise use of non-timezone aware utcnow() Diffstat (except docs and test files) ------------------------------------- README.rst | 7 + api-ref/source/index.rst | 5 + devstack/plugin.sh | 2 + ironic_inspector/cmd/migration.py | 20 +- ironic_inspector/common/ironic.py | 39 ++-- ironic_inspector/process.py | 3 +- ironic_inspector/test/unit/db/test_migrations.py | 3 +- ironic_inspector/test/unit/test_common_ironic.py | 16 +- .../test/unit/test_dnsmasq_pxe_filter.py | 3 +- ironic_inspector/test/unit/test_node_cache.py | 28 +-- releasenotes/notes/deprecate-d23ae14b5bd3779e.yaml | 8 + .../ignore-resolve-error-5c20514598e0dbbf.yaml | 7 + .../notes/sdk-2-leak-500f3669afb6713e.yaml | 5 + releasenotes/source/2023.1.rst | 2 +- releasenotes/source/2023.2.rst | 6 +- releasenotes/source/2024.1.rst | 6 +- .../locale/en_GB/LC_MESSAGES/releasenotes.po | 235 ++++++++++++++++++++- releasenotes/source/zed.rst | 2 +- tox.ini | 1 - zuul.d/ironic-inspector-jobs.yaml | 12 -- 21 files changed, 346 insertions(+), 73 deletions(-)

1 0

ironic 26.1.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We are jazzed to announce the release of: ironic 26.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 26.1.0 ^^^^^^ Prelude ******* The Ironic project is pleased to announce the release Ironic 26.1, also known as the "2024.2" or "Dalmatian" release. This release adds functionality to enable the creation and use of "runbooks" of repeated steps in "cleaning" and "service" states. Furthermore, cloud admins are now able to "lease" baremetal nodes to Nova users automatically through the use of metadata provided by Nova. Firmware updates have improved capability and ease-of-use on BMCs which manage multiple hosts. Also users of the "redfish" hardware type can now invoke firmware updates as a "service" step. Operators seeking to migrate away from BIOS booting now have additional options to help enforce migration mandates. Coupled with numerous bug fixes and other minor enhancements, this release of Ironic will improve the life of operators for years to come. We hope you enjoy! New Features ************ * Adds a new API concept, runbooks, to enable self-service of maintenance items on nodes by project members. Runbooks are curated lists of steps that can be run on nodes only associated via traits and used in lieu of an explicit list of steps for manual cleaning or servicing. * Adds a new top-level REST API endpoint */v1/runbooks/* with basic CRUD support. * Extends the */v1/nodes/<node>/states/provision* API to accept a runbook ident (name or UUID) instead of *clean_steps* or *service_steps* for servicing or manual cleaning. * Implements RBAC-aware lifecycle management for runbooks, allowing projects to limit who can CRUD and use a runbook. * Ironic now supports automatically setting node.lessee at deployment time using metadata provided at deploy time, typically by OpenStack Nova. When "[conductor]/automatic_lessee_source" is set to "instance", Ironic will set the lessee field on the node and remove it before cleaning. * Adds a new capability allowing to fetch the list of virtual media devices attached to a node by making a GET request. * Make the "idrac" hardware type inherit from the "redfish" hardware type since the "idrac" hardware type is an extension of the "redfish" with Dell specific overrides. This will ensure that features available to the "redfish" hardware type will always be available to "idrac". Added "redfish" interface as available for the "bios", "power" and "vendor" interfaces of the "idrac" hardware type. Upgrade Notes ************* * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "ironic-python-agent" ramdisks will also need to be upgraded. * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "[conductor]conductor_always_validates_images" setting may be set to "True" as a short term remedy while "ironic- python-agent" ramdisks are being updated. Alternatively it may be advisable to also set the "[agent]image_download_source" setting to "local" to minimize redundant network data transfers. * As a result of security fixes to address "qemu-img" image conversion security issues, a new configuration parameter has been added to Ironic, "[conductor]permitted_image_formats" with a default value of "raw,qcow2,iso". Raw and qcow2 format disk images are the image formats the Ironic community has consistently stated as what is supported and expected for use with Ironic. These formats also match the formats which the Ironic community tests. Operators who leverage other disk image formats, may need to modify this setting further. * "[conductor]/automatic_lessee" has been deprecated in favor of "[conductor]/automatic_lessee_source". Standalone Ironic deployments previously setting "automatic_lessee" to "True" now may want to set "automatic_lessee_source" to "request" to retain existing behavior. Deployers explicitly setting "automatic_lessee" to false may want to set "automatic_lessee_source" to "none" to retain existing behavior. The old configuration option, when explicitly set, will be honored until fully removed. * Ironic will now automatically set the node.lessee field for all deployments by default when provided in node instance_info at deployment time. Deployers are encouraged to review their security settings and Ironic Secure RBAC documentation to ensure no unexpected access is granted. * Ironic now requires rescue passwords to be hashed. Operators who would like to continue using unhashed passwords must set *[conductor]/require_rescue_password_hashed* to "false". Deprecation Notes ***************** * The "[[agent]]manage_agent_boot" configuration directive is being deprecated. It is completely untested, and requires operators to manually configure significant parts of infrastructure typically handled by Ironic. Operators using this configuration are advised to migrate away from it before it's scheduled removal during the 2025.2 cycle releases, coming out late 2025. * Deprecates the "idrac-redfish" interfaces in favor of the "redfish" interfaces for the "bios", "power", and "vendor" interfaces. This is a no-op change as these interfaces wrapped the "redfish" interface with no change already. Security Issues *************** * Ironic now checks the supplied image format value against the detected format of the image file, and will prevent deployments should the values mismatch. If being used with Glance and a mismatch in metadata is identified, it will require images to be re-uploaded with a new image ID to represent corrected metadata. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic *always* inspects the supplied user image content for safety prior to deployment of a node should the image pass through the conductor, even if the image is supplied in "raw" format. This is utilized to identify the format of the image and the overall safety of the image, such that source images with unknown or unsafe feature usage are explicitly rejected. This can be disabled by setting "[conductor]disable_deep_image_inspection" to "True". This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic can also inspect images which would normally be provided as a URL for direct download by the "ironic-python-agent" ramdisk. This is not enabled by default as it will increase the overall network traffic and disk space utilization of the conductor. This level of inspection can be enabled by setting "[conductor]conductor_always_validates_images" to "True". Once the "ironic-python-agent" ramdisk has been updated, it will perform similar image security checks independently, should an image conversion be required. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic now explicitly enforces a list of permitted image types for deployment via the "[conductor]permitted_image_formats" setting, which defaults to "raw", "qcow2", and "iso". While the project has classically always declared permissible images as "qcow2" and "raw", it was previously possible to supply other image formats known to "qemu-img", and the utility would attempt to convert the images. The "iso" support is required for "boot from ISO" ramdisk support. * Ironic now explicitly passes the source input format to executions of "qemu-img" to limit the permitted qemu disk image drivers which may evaluate an image to prevent any mismatched format attacks against "qemu-img". * The "ansible" deploy interface example playbooks now supply an input format to execution of "qemu-img". If you are using customized playbooks, please add "-f {{ ironic.image.disk_format }}" to your invocations of "qemu-img". If you do not do so, "qemu-img" will automatically try and guess which can lead to known security issues with the incorrect source format driver. * Operators who have implemented any custom deployment drivers or additional functionality like machine snapshot, should review their downstream code to ensure they are properly invoking "qemu-img". If there are any questions or concerns, please reach out to the Ironic project developers. * Operators are reminded that they should utilize cleaning in their environments. Disabling any security features such as cleaning or image inspection are at **your** **own** **risk**. Should you have any issues with security related features, please don't hesitate to open a bug with the project. * The "[conductor]disable_deep_image_inspection" setting is conveyed to the "ironic-python-agent" ramdisks automatically, and will prevent those operating ramdisks from performing deep inspection of images before they are written. * The "[conductor]permitted_image_formats" setting is conveyed to the "ironic-python-agent" ramdisks automatically. Should a need arise to explicitly permit an additional format, that should take place in the Ironic service configuration. Bug Fixes ********* * Adds microversion headers to the root ('/') endpoint. * Fixes multiple issues in the handling of images as it relates to the execution of the "qemu-img" utility, which is used for image format conversion, where a malicious user could craft a disk image to potentially extract information from an "ironic-conductor" process's operating environment. Ironic now explicitly enforces a list of approved image formats as a "[conductor]permitted_image_formats" list, which mirrors the image formats the Ironic project has historically tested and expressed as known working. Testing is not based upon file extension, but upon content fingerprinting of the disk image files. This is tracked as CVE-2024-44082 via bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Fixes inspection failure when "bmc_address" or "bmc_v6address" is "null" in the inventory received from the ramdisk. * The network_data fetched from Neutron contained 'links', 'networks' but was missing 'services'. This patch brings in 'services' to include dns nameservers that can be configured by Glean or cloud- init during cleaning and provisioning operations, especially when virtual media boot is used without DHCP. * Set node "alive" and make it fast trackable as soon as inspection is finished, in addition add a wait for the agent to callback should it not be available when fast track is attempted. * Replaces *ari/aki* format references with appropriate artifacts for kernel and ramdisk in the documentation and Ironic DevStack plugin. * Update "kernel_append_params" to match the "[pxe]" configuration, addressing a TODO from the Xena release. Other Notes *********** * Removes support for pre-SQLAlchemy 2.0 query objects from the internal database API. Downstream plug-ins must be adjusted to use the new-style queries. Changes in ironic 26.0.0..26.1.0 -------------------------------- 5857ca0cd Update release mappings f082c24d2 Add Prelude for end of cycle release eb27c6e21 Drop SQLALCHEMY_WARN_20 a8c3beaca Bring back the metal3-integration job b19507d64 Add microversion headers to root ('/') endpoint 1c201f094 Make sure qemu-img command is available in debian/suse 771cee464 Drop description for ZeroMQ d44a65883 Remove legacy Query support from _paginate_query 4fea3575c Fix inspection if bmc_address or bmc_v6address is None 510f87a03 Try limiting MTU to at least 1280 3f6507d85 Remove default override for RBAC config options 94fcae5e1 CI: Remove scope enforced ci jobs c996aafa6 CVE-2024-44982: Harden all image handling and conversion code b07ebc412 Set node "alive" when inspection finished e01522cd4 Imported Translations from Zanata 40e100387 Remove skip check for Python 3.6 0eda3d65e Support Automatic Lessee from instance metadata 42bd2a069 Use the correct command to fetch ovs state 52fdbb743 idrac: inherit driver interface from redfish 72c792bb2 Temporarily disable PXE booting test in the standalone job aaec00275 Replace reference to ari/aki 1aa780377 Deduplicate and remove invalid information for steps df39b7874 Fix versions in release notes 11dfe23cf Update network_data.json to include dns nameservers 8e6b758bf Clarify how to configure for non-master branch e3d6b644f Enable the inspection test in the redfish standalone job 17ba2b3db docs-audit-2024: Labeling references 018a7dcae Better handle missing inspection_network 2a6abc810 [docs] Add procedure to EoL and delete old bugfix branch c316443c9 Some documentaion improvements for ironic docs 040924ee6 Add unit test to ensure full node object is not logged a885a0544 Update configuration value in iRMC 754cf3f58 Fix conductor startup warning message ba096e091 Follow up to the runbooks change (#922142) a9a6ec7b3 Update error message 582b2e991 Link to configuration options 23b61e2ba Fix error message not interpolated 3f34f04bf [CI] Fix job parent name c9cf2347e add virtual media GET api 4750c4e9f docs-audit-2024: Use gerunds for task headings db7e4deff DevStack: enable the new in-band inspection by default 48f50248c Self-Service via Runbooks 816a7dfe8 Remove ironic-inspector from bugfix branches bfdfd6c16 [devstack] Ensure downgrade_dnsmasq is idempotent 631f50d21 CI: set tftp folder permission d146558ac Require hashed passwords for rescue by default 465bedbe7 Deprecate [agent]/manage_agent_boot 223a70043 Test devstack OSCaas against all Ironic jobs Diffstat (except docs and test files) ------------------------------------- api-ref/source/baremetal-api-v1-get-vmedia.inc | 21 + .../source/baremetal-api-v1-node-management.inc | 18 + api-ref/source/baremetal-api-v1-runbooks.inc | 245 +++++ api-ref/source/index.rst | 1 + api-ref/source/parameters.yaml | 67 ++ .../source/samples/node-set-provision-state.json | 4 + api-ref/source/samples/node-set-service-state.json | 12 + api-ref/source/samples/runbook-create-request.json | 19 + .../source/samples/runbook-create-response.json | 34 + .../source/samples/runbook-detail-response.json | 39 + api-ref/source/samples/runbook-list-response.json | 18 + api-ref/source/samples/runbook-show-response.json | 35 + api-ref/source/samples/runbook-update-request.json | 7 + .../source/samples/runbook-update-response.json | 34 + bindep.txt | 4 +- devstack/lib/ironic | 58 +- devstack/settings | 11 +- ironic/api/controllers/root.py | 2 + ironic/api/controllers/v1/__init__.py | 9 +- ironic/api/controllers/v1/deploy_template.py | 38 +- ironic/api/controllers/v1/node.py | 90 +- ironic/api/controllers/v1/notification_utils.py | 3 + ironic/api/controllers/v1/ramdisk.py | 6 +- ironic/api/controllers/v1/runbook.py | 391 +++++++ ironic/api/controllers/v1/utils.py | 142 +++ ironic/api/controllers/v1/versions.py | 6 +- ironic/cmd/conductor.py | 2 +- ironic/common/exception.py | 20 + ironic/common/image_format_inspector.py | 1038 ++++++++++++++++++ ironic/common/images.py | 152 ++- ironic/common/lessee_sources.py | 28 + ironic/common/neutron.py | 17 +- ironic/common/policy.py | 145 ++- ironic/common/qemu_img.py | 89 ++ ironic/common/release_mappings.py | 75 +- ironic/conductor/cleaning.py | 6 + ironic/conductor/deployments.py | 100 +- ironic/conductor/manager.py | 27 +- ironic/conductor/rpcapi.py | 21 +- ironic/conductor/utils.py | 21 +- ironic/conf/__init__.py | 2 + ironic/conf/agent.py | 3 +- ironic/conf/conductor.py | 84 +- ironic/conf/default.py | 4 +- ironic/conf/disk_utils.py | 33 + ironic/conf/irmc.py | 3 +- ironic/conf/opts.py | 1 + ironic/db/api.py | 95 ++ .../66bd9c5604d5_add_runbook_and_runbook_step.py | 70 ++ ironic/db/sqlalchemy/api.py | 271 ++++- ironic/db/sqlalchemy/models.py | 45 + ironic/drivers/base.py | 10 + ironic/drivers/drac.py | 45 +- .../playbooks/roles/deploy/tasks/write.yaml | 2 +- ironic/drivers/modules/deploy_utils.py | 202 +++- ironic/drivers/modules/drac/bios.py | 2 + ironic/drivers/modules/drac/power.py | 3 +- ironic/drivers/modules/drac/vendor_passthru.py | 2 + ironic/drivers/modules/image_cache.py | 71 +- ironic/drivers/modules/pxe_base.py | 5 +- ironic/drivers/modules/redfish/boot.py | 82 ++ ironic/drivers/modules/redfish/inspect.py | 2 +- ironic/drivers/modules/redfish/management.py | 12 + ironic/drivers/modules/storage/external.py | 6 +- ironic/objects/__init__.py | 1 + ironic/objects/runbook.py | 252 +++++ .../common/json_samples/neutron_subnet_show.json | 2 +- .../json_samples/neutron_subnet_show_ipv6.json | 2 +- .../drivers/modules/redfish/test_management.py | 6 + .../unit/drivers/modules/test_deploy_utils.py | 515 ++++++++- playbooks/ci-workarounds/get_extra_logging.yaml | 5 +- .../notes/2024.2-prelude-66649e7ee0781484.yaml | 15 + ...-headers-to-root-endpoint-199cb910a7aa53f9.yaml | 4 + .../notes/add-runbooks-38c3efa97ace8c67.yaml | 19 + .../address-qemu-issues-1bbead8bb70b76fb.yaml | 108 ++ .../automatic-lessee-source-37abe917b8cb5c36.yaml | 24 + .../notes/bmc-address-none-8214a3f7b67d6a0d.yaml | 5 + ...precate-manage-agent-boot-8474287a11b485cc.yaml | 9 + ...work-data-dns-nameservers-f363b3a66c109b4d.yaml | 9 + ...generic-virtual-media-get-f09003e5031b9c3d.yaml | 5 + .../idrac-extends-redfish-6692c2ecdb07dc2e.yaml | 15 + ...re-hashed-rescue-password-6f7c0424e12c1aeb.yaml | 5 + ...-when-inspection-finished-1ec74828852eaeef.yaml | 7 + .../notes/sqla-query-d5347ae962b06428.yaml | 6 + ...isk-artifacts-delineation-15a7d652d34b196f.yaml | 5 + ...of-a-configuration-option-91708f3366afd4c6.yaml | 5 + releasenotes/source/2023.2.rst | 2 +- releasenotes/source/2024.1.rst | 6 +- releasenotes/source/icehouse.rst | 6 +- .../locale/en_GB/LC_MESSAGES/releasenotes.po | 65 +- requirements.txt | 2 +- tox.ini | 2 - zuul.d/ironic-jobs.yaml | 7 +- zuul.d/project.yaml | 7 - 156 files changed, 9052 insertions(+), 628 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7773d6e40..25f9d4c49 100644 --- a/requirements.txt +++ b/requirements.txt @@ -22 +22 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.policy>=3.7.0 # Apache-2.0 +oslo.policy>=4.4.0 # Apache-2.0

1 0

bifrost 19.1.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We joyfully announce the release of: bifrost 19.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/bifrost Download the package from: https://tarballs.openstack.org/bifrost/ Please report issues through: https://bugs.launchpad.net/bifrost/+bugs For more details, please see below. 19.1.0 ^^^^^^ Upgrade Notes * When creating a virtual testing environment on newer distributions such as Ubuntu 24.04, UEFI firmware with 4M flash storage will be used. Existing virtual machines may need to be migrated if they were created on an older distribution. Changes in bifrost 19.0.0..19.1.0 --------------------------------- 46e23a1c Support OVMF with 4M flash storage 20835d20 Fix missed occurrence of SETUPTOOLS_USE_DISTUTILS ddd266fd Restart systemd services on failure Diffstat (except docs and test files) ------------------------------------- playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml | 7 +++++++ .../roles/bifrost-ironic-install/templates/systemd_template.j2 | 1 + playbooks/roles/bifrost-pip-install/tasks/main.yml | 4 +--- releasenotes/notes/ovmf-m4-f8e63d8bb824fccb.yaml | 7 +++++++ 4 files changed, 16 insertions(+), 3 deletions(-)

1 0

ironic-python-agent 9.14.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We jubilantly announce the release of: ironic-python-agent 9.14.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent/+bugs For more details, please see below. 9.14.0 ^^^^^^ Upgrade Notes ************* * Deployers implementing their own "HardwareManagers" must to audit their code for unsafe uses of *qemu-img* and related methods. Security Issues *************** * Ironic-Python-Agent now checks any supplied image format value against the detected format of the image file and will prevent deployments should the values mismatch. * Images previously misconfigured as raw despite being in another format, in some non-default configurations, may have been mistakenly converted if needed. Ironic-Python-Agent will no longer perform conversion in any case for images with metadata indicating in raw format. * Ironic-Python-Agent *always* inspects any non-raw user image content for safety before running any qemu-based utilities on the image. This is utilized to identify the format of the image and to verify the overall safety of the image. Any images with unknown or unsafe feature uses are explicitly rejected. This can be disabled in both IPA and Ironic by setting "[conductor]disable_deep_image_inspection" to "True" for the Ironic deployment. Image inspection is the primary mitigation for CVE-2024-44082 being tracked in bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) Operators may desire to set "[conductor]conductor_always_validates_images" on Ironic conductors to mitigate the issue before they have upgraded their Ironic-Python- Agent. * Ironic-Python-Agent now explicitly enforces a list of permitted image types for deployment, defaulting to "raw" and "qcow2". Other image types may work, but are not explicitly supported and must be enabled. This can be modified by setting "[conductor]permitted_image_formats" for all Ironic services. Bug Fixes ********* * Adds a preliminary check for IPMI device files before the BMC detection attempts, optimizing *ipmitool* command calls on systems without IPMI capabilities. * Fixes multiple issues in the handling of images as it related to execution of the "qemu-img" utility. When using this utility to convert an unsafe image, a malicious user can extract information from a node while Ironic-Python-Agent is deploying or converting an image. Ironic-Python-Agent now inspects all non-raw images for safety, and never runs qemu-based utilities on raw images. This fix is tracked as CVE-2024-44082 and bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) * Images with metadata indicating a "raw" disk format may have been transparently converted from another format. Now, these images will have their exact contents imaged to disk without modification. Changes in ironic-python-agent 9.13.0..9.14.0 --------------------------------------------- 2d79eae Check for the existence of an IPMI device e303a36 Inspect non-raw images for safety ba5c1bf Remove and disable examples job bd3b596 Fix series in release notes b173ce9 [doc] Clarify Step return values 4cea26f update dynamic-login to mention the sshkey option Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/agent.py | 6 + ironic_python_agent/config.py | 36 +- ironic_python_agent/disk_utils.py | 111 ++- ironic_python_agent/errors.py | 9 + ironic_python_agent/extensions/standby.py | 85 +- ironic_python_agent/format_inspector.py | 1044 ++++++++++++++++++++ ironic_python_agent/hardware.py | 58 +- ironic_python_agent/partition_utils.py | 9 +- ironic_python_agent/qemu_img.py | 153 +++ ironic_python_agent/utils.py | 11 + ...-device-before-invocation-45b00d15c94edd00.yaml | 6 + .../notes/image-security-5c23b890409101c9.yaml | 48 + releasenotes/source/2023.1.rst | 2 +- releasenotes/source/2023.2.rst | 2 +- releasenotes/source/2024.1.rst | 2 +- releasenotes/source/zed.rst | 2 +- zuul.d/ironic-python-agent-jobs.yaml | 17 +- zuul.d/project.yaml | 2 - 27 files changed, 2952 insertions(+), 201 deletions(-)

1 0

nova 30.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

Hello everyone, A new release candidate for nova for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/nova/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/nova/src/branch/stable/dalmatian Release notes for nova can be found at: https://docs.openstack.org/releasenotes/nova/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/nova/+bugs and tag it *dalmatian-rc-potential* to bring it to the nova release crew's attention.

1 0

cyborg 13.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

Hello everyone, A new release candidate for cyborg for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/cyborg/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/cyborg/src/branch/stable/dalmatian Release notes for cyborg can be found at: https://docs.openstack.org/releasenotes/cyborg/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/openstack-cyborg/+bugs and tag it *dalmatian-rc-potential* to bring it to the cyborg release crew's attention.

1 0

vitrage-tempest-plugin 6.4.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are ecstatic to announce the release of: vitrage-tempest-plugin 6.4.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/vitrage-tempest-plugin Download the package from: https://tarballs.openstack.org/vitrage-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/vitrage/+bugs For more details, please see below. Changes in vitrage-tempest-plugin zed-last..6.4.0 ------------------------------------------------- d2ff974 Revert "Temporary disable checks to solve circular dependency" f89426f Ensure that private networks are also accounted a86db28 Temporary disable checks to solve circular dependency Diffstat (except docs and test files) ------------------------------------- 3 files changed, 10 insertions(+), 10 deletions(-)

1 0

cyborg-tempest-plugin 2.4.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We contentedly announce the release of: cyborg-tempest-plugin 2.4.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/cyborg-tempest-plugin Download the package from: https://tarballs.openstack.org/cyborg-tempest-plugin/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/cyborg For more details, please see below. Changes in cyborg-tempest-plugin 2.3.0..2.4.0 --------------------------------------------- 3125a3e Replace deprecated admin_manager 176242d Replace usage of deprecated path for attr decorator f3950af Update stable branch tests Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 36 +++++++++------------- 6 files changed, 34 insertions(+), 42 deletions(-)

1 0

mistral-tempest-plugin 2.4.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are chuffed to announce the release of: mistral-tempest-plugin 2.4.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/mistral-tempest-plugin Download the package from: https://tarballs.openstack.org/mistral-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/mistral/+bugs For more details, please see below. Changes in mistral-tempest-plugin zed-last..2.4.0 ------------------------------------------------- cbd1a97 Add new workflow wflong that will took longer 55f280d Remove devstack mistral-devstack-ussuri e668459 Drop devstack-gate Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 8 -------- 3 files changed, 15 insertions(+), 12 deletions(-)

1 0

trove-tempest-plugin 2.4.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are glad to announce the release of: trove-tempest-plugin 2.4.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/trove-tempest-plugin Download the package from: https://tarballs.openstack.org/trove-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/trove/+bugs For more details, please see below. Changes in trove-tempest-plugin zed-last..2.4.0 ----------------------------------------------- f557061 Add support of sqlachemy 2.0 Diffstat (except docs and test files) ------------------------------------- 1 file changed, 3 insertions(+), 4 deletions(-)

1 0

heat-tempest-plugin 2.3.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We exuberantly announce the release of: heat-tempest-plugin 2.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/heat-tempest-plugin Download the package from: https://tarballs.openstack.org/heat-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/heat/+bugs For more details, please see below. 2.3.0 ^^^^^ Deprecation Notes * The "auth_version" option has been deprecated and has no effect. This option will be removed in a future release. Changes in heat-tempest-plugin zed-last..2.3.0 ---------------------------------------------- 7ecadfb Deprecate auth_version option f9f9d82 Allow custom DNS servers Diffstat (except docs and test files) ------------------------------------- heat_tempest_plugin/config.py | 6 +++++ heat_tempest_plugin/services/clients.py | 31 +++++++++------------- .../deprecate-auth_version-45a3cbb9711ac0aa.yaml | 5 ++++ 4 files changed, 26 insertions(+), 19 deletions(-)

1 0

blazar-tempest-plugin 0.14.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are overjoyed to announce the release of: blazar-tempest-plugin 0.14.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/blazar-tempest-plugin Download the package from: https://tarballs.openstack.org/blazar-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/blazar/+bugs For more details, please see below. Changes in blazar-tempest-plugin zed-last..0.14.0 ------------------------------------------------- 2950909 Add scenario for flavor-based instance reservation 12c9fbd Add stable/2024.1 jobs on master gate 142cd42 Remove test for unmaintained zed branch Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 32 ++++-- blazar_tempest_plugin/config.py | 3 + 4 files changed, 155 insertions(+), 8 deletions(-)

1 0

magnum-tempest-plugin 2.5.0 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are happy to announce the release of: magnum-tempest-plugin 2.5.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/magnum-tempest-plugin Download the package from: https://tarballs.openstack.org/magnum-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/magnum/+bugs For more details, please see below. Changes in magnum-tempest-plugin zed-last..2.5.0 ------------------------------------------------ ecb2436 Add stable/2024.1 jobs on master gate 64e1cb3 CI: Drop Zed testing as it is unmaintained Diffstat (except docs and test files) ------------------------------------- .zuul.d/jobs_2024_1.yaml | 63 ++++++++++++++++++++++++++++++++++++++++++++++++ .zuul.d/jobs_zed.yaml | 23 ------------------ .zuul.d/project.yaml | 2 +- 3 files changed, 64 insertions(+), 24 deletions(-)

1 0

python-openstackclient 7.1.2 (dalmatian)
by no-reply＠openstack.org 19 Sep '24

19 Sep '24

We are thrilled to announce the release of: python-openstackclient 7.1.2 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/python-openstackclient Download the package from: https://pypi.org/project/python-openstackclient Please report issues through: https://storyboard.openstack.org/#!/project/openstack/python- openstackclient For more details, please see below. Changes in python-openstackclient 7.1.1..7.1.2 ---------------------------------------------- 08c84454 evacuate SDK actually uses admin_pass param Diffstat (except docs and test files) ------------------------------------- openstackclient/compute/v2/server.py | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-)

1 0

python-openstackclient 7.1.1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

We are satisfied to announce the release of: python-openstackclient 7.1.1 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/python-openstackclient Download the package from: https://pypi.org/project/python-openstackclient Please report issues through: https://storyboard.openstack.org/#!/project/openstack/python- openstackclient For more details, please see below. Changes in python-openstackclient 7.1.0..7.1.1 ---------------------------------------------- fb958fa5 evacuate: Fix password parameter name for SDK f74c8856 Update TOX_CONSTRAINTS_FILE for stable/2024.2 f13a007d Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + openstackclient/compute/v2/server.py | 2 +- tox.ini | 8 ++++---- 4 files changed, 11 insertions(+), 10 deletions(-)

1 0

designate 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for designate for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/designate/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/designate/src/branch/stable/dalmatian Release notes for designate can be found at: https://docs.openstack.org/releasenotes/designate/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/designate/+bugs and tag it *dalmatian-rc-potential* to bring it to the designate release crew's attention.

1 0

designate-dashboard 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for designate-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/designate-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/designate-dashboard/src/branch/stable/dalmati… Release notes for designate-dashboard can be found at: https://docs.openstack.org/releasenotes/designate-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/designate-dashboard/+bugs and tag it *dalmatian-rc-potential* to bring it to the designate-dashboard release crew's attention.

1 0

manila-ui 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for manila-ui for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/manila-ui/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/manila-ui/src/branch/stable/dalmatian Release notes for manila-ui can be found at: https://docs.openstack.org/releasenotes/manila-ui/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/manila-ui/+bugs and tag it *dalmatian-rc-potential* to bring it to the manila-ui release crew's attention.

1 0

vitrage 13.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for vitrage for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/vitrage/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/vitrage/src/branch/stable/dalmatian Release notes for vitrage can be found at: https://docs.openstack.org/releasenotes/vitrage/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/vitrage and tag it *dalmatian-rc-potential* to bring it to the vitrage release crew's attention.

1 0

mistral 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for mistral for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/mistral/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/mistral/src/branch/stable/dalmatian Release notes for mistral can be found at: https://docs.openstack.org/releasenotes/mistral/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/mistral/+bugs and tag it *dalmatian-rc-potential* to bring it to the mistral release crew's attention.

1 0

vitrage-dashboard 7.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for vitrage-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/vitrage-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/vitrage-dashboard/src/branch/stable/dalmatian Release notes for vitrage-dashboard can be found at: https://docs.openstack.org/releasenotes/vitrage-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/vitrage-dashboard and tag it *dalmatian-rc-potential* to bring it to the vitrage-dashboard release crew's attention.

1 0

cloudkitty-dashboard 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for cloudkitty-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/cloudkitty-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/cloudkitty-dashboard/src/branch/stable/dalmat… Release notes for cloudkitty-dashboard can be found at: https://docs.openstack.org/releasenotes/cloudkitty-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/cloudkitty-dashboard and tag it *dalmatian-rc-potential* to bring it to the cloudkitty-dashboard release crew's attention.

1 0

adjutant-ui 9.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for adjutant-ui for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/adjutant-ui/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/adjutant-ui/src/branch/stable/dalmatian Release notes for adjutant-ui can be found at: https://docs.openstack.org/releasenotes/adjutant-ui/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/adjutant-ui and tag it *dalmatian-rc-potential* to bring it to the adjutant-ui release crew's attention.

1 0

cinder 25.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for cinder for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/cinder/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/cinder/src/branch/stable/dalmatian Release notes for cinder can be found at: https://docs.openstack.org/releasenotes/cinder/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/cinder/+bugs and tag it *dalmatian-rc-potential* to bring it to the cinder release crew's attention.

1 0

ceilometer 23.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for ceilometer for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/ceilometer/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/ceilometer/src/branch/stable/dalmatian Release notes for ceilometer can be found at: https://docs.openstack.org/releasenotes/ceilometer/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/ceilometer/+bugs and tag it *dalmatian-rc-potential* to bring it to the ceilometer release crew's attention.

1 0

horizon 25.1.0 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

We are excited to announce the release of: horizon 25.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/horizon Download the package from: https://tarballs.openstack.org/horizon/ Please report issues through: https://bugs.launchpad.net/horizon/+bugs For more details, please see below. Changes in horizon 25.0.0..25.1.0 --------------------------------- e8f734703 pytest-based UI tests add basic browse settings tests e6d7aedeb pytest-based UI tests add delete multiple image rows test d6ffcdd14 netaddr: fix IP conversion issues with netaddr>1.0.0 ab5e01a0d Keep new RBAC disable by default 4974d965c Update horizon tests to use the RBAC new roles fa2b0ba74 SDK for Neutron Subnetpools c7a640733 SDK for Neutron ports dfc5b4b64 SDK for Neutron Trunks bb79e92eb pytest-based selenium tests increase selenium implicit wait c786ebb58 Fix generation of inventory capacities 2a269db9a pytest-based UI tests add delete multiple instance rows test bc8d2d71f pytest-based UI tests add message after change password test 30888edfd Fix Placement statistics display c18f9d90a Sort image source choices by name for volume 079eceb2c Force logging of /auth/password in operation log c3f9736e6 Displaying more properties in the image drawer fd1fa88c6 Update XStatic-JQuery.quicksearch min. version to include latest CVE fix fcce68a91 Prevent KeyError when getting value of optional key 0b7f2c514 pytest-based selenium tests add fix test_disassociate_floatingip c7650f4c0 Update xstatic-jquery-ui min. version to include latest CVE fix 7eea4feb3 Drop old integration tests job 4a4155d96 Test for displayed volumes without attachments a70ba5525 feat: add floating IP address field under Project Dashboard 4f9b5b90d Delete container show duplicate toast notifications 0ffd5c7ae Show Created At column for backups table dbdd37646 Show availability zone for volume backups 55e9db652 Add help text for edit instance form 8cca9edbd Replace deprecated glanceclient exceptions 9dee7d2b0 Bump django-compressor requirement 3c0557d69 [TRIVIAL] Add comment about policy override for images>launch button a81da461f Update python classifier in setup.cfg 53c82bbff Fix floating IP associated to unbound port 3b222c85c CSS fix makes "Delete item" button active 9c75ebba0 Fix allowed address pair row unique ID Diffstat (except docs and test files) ------------------------------------- .zuul.d/project.yaml | 7 +- .zuul.d/tempest-and-integrated.yaml | 32 -- .zuul.d/xstatic-master.yaml | 4 +- horizon/defaults.py | 2 +- horizon/forms/fields.py | 6 +- horizon/middleware/operation_log.py | 14 +- .../framework/widgets/form/fields/array.html | 2 +- openstack_auth/policy.py | 17 +- openstack_dashboard/api/neutron.py | 117 +++---- openstack_dashboard/api/placement.py | 65 ++-- .../dashboards/admin/aggregates/workflows.py | 2 +- .../dashboards/admin/backups/tables.py | 4 +- .../templates/backups/_detail_overview.html | 2 + .../identity/application_credentials/forms.py | 4 +- .../dashboards/identity/users/forms.py | 6 +- .../dashboards/project/backups/tables.py | 3 + .../templates/backups/_detail_overview.html | 2 + .../dashboards/project/floating_ips/forms.py | 10 + .../dashboards/project/floating_ips/tables.py | 4 +- .../dashboards/project/images/images/tables.py | 3 + .../project/instances/workflows/update_instance.py | 11 +- .../extensions/allowed_address_pairs/tables.py | 4 +- .../dashboards/project/networks/ports/tables.py | 2 +- .../dashboards/project/networks/ports/views.py | 8 +- .../dashboards/project/networks/subnets/views.py | 5 +- .../dashboards/project/volumes/forms.py | 7 +- openstack_dashboard/exceptions.py | 8 +- .../static/app/core/images/details/drawer.html | 23 +- .../core/openstack-service-api/common-test.mock.js | 9 +- .../core/openstack-service-api/swift.service.js | 1 + .../openstack-service-api/swift.service.spec.js | 8 +- openstack_dashboard/test/helpers.py | 8 +- .../test/selenium/integration/test_floatingips.py | 51 +-- .../test/selenium/ui/test_actions.py | 96 ++++++ .../test/selenium/ui/test_browse.py | 18 + .../test/selenium/ui/test_settings.py | 50 +++ openstack_dashboard/test/test_data/neutron_data.py | 79 +++-- .../test/unit/api/rest/test_policy.py | 4 + openstack_dashboard/test/unit/api/test_network.py | 13 +- openstack_dashboard/test/unit/api/test_neutron.py | 368 +++++++++++---------- requirements.txt | 6 +- 46 files changed, 704 insertions(+), 444 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 3197078fa..e7178e202 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +9 @@ Django>=4.2,<4.3 # BSD -django-compressor>=2.4.1 # MIT +django-compressor>=4.4 # MIT @@ -51 +51 @@ XStatic-JQuery-Migrate>=3 # MIT License -XStatic-JQuery.quicksearch>=2.0.3.1 # MIT License +XStatic-JQuery.quicksearch>=2.0.3.2 # MIT License @@ -53 +53 @@ XStatic-JQuery.TableSorter>=2.14.5.1 # MIT License -XStatic-jquery-ui>=1.12.1.1 # MIT License +XStatic-jquery-ui>=1.13.0.1 # MIT License

1 0

aodh 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for aodh for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/aodh/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/aodh/src/branch/stable/dalmatian Release notes for aodh can be found at: https://docs.openstack.org/releasenotes/aodh/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/aodh/+bugs and tag it *dalmatian-rc-potential* to bring it to the aodh release crew's attention.

1 0

cloudkitty 21.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for cloudkitty for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/cloudkitty/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/cloudkitty/src/branch/stable/dalmatian Release notes for cloudkitty can be found at: https://docs.openstack.org/releasenotes/cloudkitty/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/cloudkitty and tag it *dalmatian-rc-potential* to bring it to the cloudkitty release crew's attention.

1 0

tacker 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for tacker for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/tacker/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/tacker/src/branch/stable/dalmatian Release notes for tacker can be found at: https://docs.openstack.org/releasenotes/tacker/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/tacker/+bugs and tag it *dalmatian-rc-potential* to bring it to the tacker release crew's attention.

1 0

magnum-ui 15.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for magnum-ui for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/magnum-ui/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/magnum-ui/src/branch/stable/dalmatian Release notes for magnum-ui can be found at: https://docs.openstack.org/releasenotes/magnum-ui/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/magnum-ui/+bugs and tag it *dalmatian-rc-potential* to bring it to the magnum-ui release crew's attention.

1 0

zun-ui 14.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for zun-ui for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/zun-ui/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/zun-ui/src/branch/stable/dalmatian Release notes for zun-ui can be found at: https://docs.openstack.org/releasenotes/zun-ui/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/zun-ui/+bugs and tag it *dalmatian-rc-potential* to bring it to the zun-ui release crew's attention.

1 0

masakari-monitors 18.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for masakari-monitors for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/masakari-monitors/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/masakari-monitors/src/branch/stable/dalmatian Release notes for masakari-monitors can be found at: https://docs.openstack.org/releasenotes/masakari-monitors/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/masakari-monitors/+bugs and tag it *dalmatian-rc-potential* to bring it to the masakari-monitors release crew's attention.

1 0

magnum 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for magnum for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/magnum/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/magnum/src/branch/stable/dalmatian Release notes for magnum can be found at: https://docs.openstack.org/releasenotes/magnum/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/magnum/+bugs and tag it *dalmatian-rc-potential* to bring it to the magnum release crew's attention.

1 0

trove-dashboard 23.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for trove-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/trove-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/trove-dashboard/src/branch/stable/dalmatian Release notes for trove-dashboard can be found at: https://docs.openstack.org/releasenotes/trove-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/trove-dashboard/+bugs and tag it *dalmatian-rc-potential* to bring it to the trove-dashboard release crew's attention.

1 0

masakari 18.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for masakari for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/masakari/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/masakari/src/branch/stable/dalmatian Release notes for masakari can be found at: https://docs.openstack.org/releasenotes/masakari/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/masakari/+bugs and tag it *dalmatian-rc-potential* to bring it to the masakari release crew's attention.

1 0

mistral-dashboard 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for mistral-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/mistral-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/mistral-dashboard/src/branch/stable/dalmatian Release notes for mistral-dashboard can be found at: https://docs.openstack.org/releasenotes/mistral-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/mistral/+bugs and tag it *dalmatian-rc-potential* to bring it to the mistral-dashboard release crew's attention.

1 0

trove 22.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for trove for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/trove/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/trove/src/branch/stable/dalmatian Release notes for trove can be found at: https://docs.openstack.org/releasenotes/trove/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/trove/+bugs and tag it *dalmatian-rc-potential* to bring it to the trove release crew's attention.

1 0

masakari-dashboard 11.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for masakari-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/masakari-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/masakari-dashboard/src/branch/stable/dalmatian Release notes for masakari-dashboard can be found at: https://docs.openstack.org/releasenotes/masakari-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/masakari/+bugs and tag it *dalmatian-rc-potential* to bring it to the masakari-dashboard release crew's attention.

1 0

watcher-dashboard 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for watcher-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/watcher-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/watcher-dashboard/src/branch/stable/dalmatian Release notes for watcher-dashboard can be found at: https://docs.openstack.org/releasenotes/watcher-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/watcher-dashboard/+bugs and tag it *dalmatian-rc-potential* to bring it to the watcher-dashboard release crew's attention.

1 0

watcher 13.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

Hello everyone, A new release candidate for watcher for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/watcher/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/watcher/src/branch/stable/dalmatian Release notes for watcher can be found at: https://docs.openstack.org/releasenotes/watcher/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/watcher/+bugs and tag it *dalmatian-rc-potential* to bring it to the watcher release crew's attention.

1 0

release-test 7.0.0 (dalmatian)
by no-reply＠openstack.org 16 Sep '24

16 Sep '24

We are thrilled to announce the release of: release-test 7.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/release-test Download the package from: https://tarballs.openstack.org/release-test/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. Changes in release-test 6.0.0..7.0.0 ------------------------------------ 2871df0 Update bindep for python3 187d627 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- bindep.txt | 4 ++-- releasenotes/source/2024.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + 3 files changed, 9 insertions(+), 2 deletions(-)

1 0

placement 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for placement for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/placement/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/placement/src/branch/stable/dalmatian Release notes for placement can be found at: https://docs.openstack.org/releasenotes/placement/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/placement and tag it *dalmatian-rc-potential* to bring it to the placement release crew's attention.

1 0

python-troveclient 8.6.0 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

We enthusiastically announce the release of: python-troveclient 8.6.0: Client library for OpenStack DBaaS API This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/python-troveclient Download the package from: https://pypi.org/project/python-troveclient Please report issues through: https://bugs.launchpad.net/python-troveclient/+bugs For more details, please see below. Changes in python-troveclient 8.5.0..8.6.0 ------------------------------------------ 2d912fb use stevedore to load extensions 59fb4a2 Remove logic for Python < 3 0d6ffdd reno: Update master for unmaintained/zed bcefdc6 reno: Update master for unmaintained/xena 5922b73 reno: Update master for unmaintained/wallaby ede9b0d reno: Update master for unmaintained/victoria Diffstat (except docs and test files) ------------------------------------- releasenotes/source/victoria.rst | 2 +- releasenotes/source/wallaby.rst | 2 +- releasenotes/source/xena.rst | 2 +- releasenotes/source/zed.rst | 2 +- requirements.txt | 1 + troveclient/auth_plugin.py | 19 ++++++++----------- troveclient/shell.py | 18 +++++++----------- troveclient/utils.py | 19 ++++--------------- 9 files changed, 24 insertions(+), 62 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 9459683..69f35bd 100644 --- a/requirements.txt +++ b/requirements.txt @@ -13,0 +14 @@ python-openstackclient>=3.12.0 # Apache-2.0 +stevedore>=2.0.1 # Apache-2.0

1 0

blazar 14.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for blazar for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/blazar/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/blazar/src/branch/stable/dalmatian Release notes for blazar can be found at: https://docs.openstack.org/releasenotes/blazar/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/blazar/+bugs and tag it *dalmatian-rc-potential* to bring it to the blazar release crew's attention.

1 0

blazar-nova 6.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for blazar-nova for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/blazar-nova/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/blazar-nova/src/branch/stable/dalmatian Release notes for blazar-nova can be found at: https://docs.openstack.org/releasenotes/blazar-nova/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/blazar/+bugs and tag it *dalmatian-rc-potential* to bring it to the blazar-nova release crew's attention.

1 0

skyline-apiserver 5.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for skyline-apiserver for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/skyline-apiserver/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/skyline-apiserver/src/branch/stable/dalmatian Release notes for skyline-apiserver can be found at: https://docs.openstack.org/releasenotes/skyline-apiserver/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/skyline-apiserver/+bugs and tag it *dalmatian-rc-potential* to bring it to the skyline-apiserver release crew's attention.

1 0

skyline-console 5.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for skyline-console for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/skyline-console/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/skyline-console/src/branch/stable/dalmatian Release notes for skyline-console can be found at: https://docs.openstack.org/releasenotes/skyline-console/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/skyline-apiserver/+bugs and tag it *dalmatian-rc-potential* to bring it to the skyline-console release crew's attention.

1 0

manila 19.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for manila for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/manila/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/manila/src/branch/stable/dalmatian Release notes for manila can be found at: https://docs.openstack.org/releasenotes/manila/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/manila/+bugs and tag it *dalmatian-rc-potential* to bring it to the manila release crew's attention.

1 0

neutron 25.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for neutron for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/neutron/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/neutron/src/branch/stable/dalmatian Release notes for neutron can be found at: https://docs.openstack.org/releasenotes/neutron/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron/+bugs and tag it *dalmatian-rc-potential* to bring it to the neutron release crew's attention.

1 0

adjutant 9.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for adjutant for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/adjutant/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/adjutant/src/branch/stable/dalmatian Release notes for adjutant can be found at: https://docs.openstack.org/releasenotes/adjutant/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/adjutant and tag it *dalmatian-rc-potential* to bring it to the adjutant release crew's attention.

1 0

tacker-horizon 10.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for tacker-horizon for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/tacker-horizon/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/tacker-horizon/src/branch/stable/dalmatian Release notes for tacker-horizon can be found at: https://docs.openstack.org/releasenotes/tacker-horizon/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/tacker/+bugs and tag it *dalmatian-rc-potential* to bring it to the tacker-horizon release crew's attention.

1 0

blazar-dashboard 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 13 Sep '24

13 Sep '24

Hello everyone, A new release candidate for blazar-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/blazar-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/blazar-dashboard/src/branch/stable/dalmatian Release notes for blazar-dashboard can be found at: https://docs.openstack.org/releasenotes/blazar-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/blazar/+bugs and tag it *dalmatian-rc-potential* to bring it to the blazar-dashboard release crew's attention.

1 0

ironic 21.4.3 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We contentedly announce the release of: ironic 21.4.3: OpenStack Bare Metal Provisioning This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 21.4.3 ^^^^^^ Upgrade Notes ************* * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "ironic-python-agent" ramdisks will also need to be upgraded. * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "[conductor]conductor_always_validates_images" setting may be set to "True" as a short term remedy while "ironic- python-agent" ramdisks are being updated. Alternatively it may be advisable to also set the "[agent]image_download_source" setting to "local" to minimize redundant network data transfers. * As a result of security fixes to address "qemu-img" image conversion security issues, a new configuration parameter has been added to Ironic, "[conductor]permitted_image_formats" with a default value of "raw,qcow2,iso". Raw and qcow2 format disk images are the image formats the Ironic community has consistently stated as what is supported and expected for use with Ironic. These formats also match the formats which the Ironic community tests. Operators who leverage other disk image formats, may need to modify this setting further. Security Issues *************** * Ironic now checks the supplied image format value against the detected format of the image file, and will prevent deployments should the values mismatch. If being used with Glance and a mismatch in metadata is identified, it will require images to be re-uploaded with a new image ID to represent corrected metadata. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic *always* inspects the supplied user image content for safety prior to deployment of a node should the image pass through the conductor, even if the image is supplied in "raw" format. This is utilized to identify the format of the image and the overall safety of the image, such that source images with unknown or unsafe feature usage are explicitly rejected. This can be disabled by setting "[conductor]disable_deep_image_inspection" to "True". This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic can also inspect images which would normally be provided as a URL for direct download by the "ironic-python-agent" ramdisk. This is not enabled by default as it will increase the overall network traffic and disk space utilization of the conductor. This level of inspection can be enabled by setting "[conductor]conductor_always_validates_images" to "True". Once the "ironic-python-agent" ramdisk has been updated, it will perform similar image security checks independently, should an image conversion be required. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic now explicitly enforces a list of permitted image types for deployment via the "[conductor]permitted_image_formats" setting, which defaults to "raw", "qcow2", and "iso". While the project has classically always declared permissible images as "qcow2" and "raw", it was previously possible to supply other image formats known to "qemu-img", and the utility would attempt to convert the images. The "iso" support is required for "boot from ISO" ramdisk support. * Ironic now explicitly passes the source input format to executions of "qemu-img" to limit the permitted qemu disk image drivers which may evaluate an image to prevent any mismatched format attacks against "qemu-img". * The "ansible" deploy interface example playbooks now supply an input format to execution of "qemu-img". If you are using customized playbooks, please add "-f {{ ironic.image.disk_format }}" to your invocations of "qemu-img". If you do not do so, "qemu-img" will automatically try and guess which can lead to known security issues with the incorrect source format driver. * Operators who have implemented any custom deployment drivers or additional functionality like machine snapshot, should review their downstream code to ensure they are properly invoking "qemu-img". If there are any questions or concerns, please reach out to the Ironic project developers. * Operators are reminded that they should utilize cleaning in their environments. Disabling any security features such as cleaning or image inspection are at **your** **own** **risk**. Should you have any issues with security related features, please don't hesitate to open a bug with the project. * The "[conductor]disable_deep_image_inspection" setting is conveyed to the "ironic-python-agent" ramdisks automatically, and will prevent those operating ramdisks from performing deep inspection of images before they are written. * The "[conductor]permitted_image_formats" setting is conveyed to the "ironic-python-agent" ramdisks automatically. Should a need arise to explicitly permit an additional format, that should take place in the Ironic service configuration. Bug Fixes ********* * Fixes multiple issues in the handling of images as it relates to the execution of the "qemu-img" utility, which is used for image format conversion, where a malicious user could craft a disk image to potentially extract information from an "ironic-conductor" process's operating environment. Ironic now explicitly enforces a list of approved image formats as a "[conductor]permitted_image_formats" list, which mirrors the image formats the Ironic project has historically tested and expressed as known working. Testing is not based upon file extension, but upon content fingerprinting of the disk image files. This is tracked as CVE-2024-44082 via bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) Changes in ironic 21.4.2..21.4.3 -------------------------------- d409512b4 CI: stable/2023.1 - remove partition and older non-voting jobs 188d43616 CVE-2024-44982: Harden all image handling and conversion code 12b49a29d [CI][stable only] fix zuul config 2e1bfeb15 [CI] Fix job parent name Diffstat (except docs and test files) ------------------------------------- ironic/api/controllers/v1/ramdisk.py | 2 + ironic/common/exception.py | 4 + ironic/common/image_format_inspector.py | 1038 ++++++++++++++++++++ ironic/common/images.py | 152 ++- ironic/common/qemu_img.py | 89 ++ ironic/conf/__init__.py | 2 + ironic/conf/conductor.py | 43 + ironic/conf/disk_utils.py | 33 + ironic/conf/opts.py | 1 + .../playbooks/roles/deploy/tasks/write.yaml | 2 +- ironic/drivers/modules/deploy_utils.py | 202 +++- ironic/drivers/modules/image_cache.py | 71 +- .../unit/drivers/modules/test_deploy_utils.py | 515 +++++++++- .../address-qemu-issues-1bbead8bb70b76fb.yaml | 108 ++ zuul.d/ironic-jobs.yaml | 3 +- zuul.d/project.yaml | 18 - 25 files changed, 3500 insertions(+), 184 deletions(-)

1 0

ironic-python-agent 9.7.2 (bobcat)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are glad to announce the release of: ironic-python-agent 9.7.2: Ironic Python Agent Ramdisk This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- python-agent For more details, please see below. 9.7.2 ^^^^^ Upgrade Notes ************* * Deployers implementing their own "HardwareManagers" must to audit their code for unsafe uses of *qemu-img* and related methods. Security Issues *************** * Ironic-Python-Agent now checks any supplied image format value against the detected format of the image file and will prevent deployments should the values mismatch. * Images previously misconfigured as raw despite being in another format, in some non-default configurations, may have been mistakenly converted if needed. Ironic-Python-Agent will no longer perform conversion in any case for images with metadata indicating in raw format. * Ironic-Python-Agent *always* inspects any non-raw user image content for safety before running any qemu-based utilities on the image. This is utilized to identify the format of the image and to verify the overall safety of the image. Any images with unknown or unsafe feature uses are explicitly rejected. This can be disabled in both IPA and Ironic by setting "[conductor]disable_deep_image_inspection" to "True" for the Ironic deployment. Image inspection is the primary mitigation for CVE-2024-44082 being tracked in bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) Operators may desire to set "[conductor]conductor_always_validates_images" on Ironic conductors to mitigate the issue before they have upgraded their Ironic-Python- Agent. * Ironic-Python-Agent now explicitly enforces a list of permitted image types for deployment, defaulting to "raw" and "qcow2". Other image types may work, but are not explicitly supported and must be enabled. This can be modified by setting "[conductor]permitted_image_formats" for all Ironic services. Bug Fixes ********* * Fixes an issue where configuration drive volumes which are mounted by the operating system could remain mounted and cause a lock to be held, which may conflict with actions such as "rebuild". The agent now always makes sure the folder used by Glean and Cloud-init is not mounted. * Fixes multiple issues in the handling of images as it related to execution of the "qemu-img" utility. When using this utility to convert an unsafe image, a malicious user can extract information from a node while Ironic-Python-Agent is deploying or converting an image. Ironic-Python-Agent now inspects all non-raw images for safety, and never runs qemu-based utilities on raw images. This fix is tracked as CVE-2024-44082 and bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) * Images with metadata indicating a "raw" disk format may have been transparently converted from another format. Now, these images will have their exact contents imaged to disk without modification. * Fixes bug 2066308, an issue where Ironic Python Agent would call evaluate_hardware_support multiple times on hardware manager plugins. Scanning for hardware and disks is time consuming, and caused timeouts on badly-performing nodes. Changes in ironic-python-agent 9.7.1..9.7.2 ------------------------------------------- b7fa84d Inspect non-raw images for safety 9008eca Remove and disable examples job b066a21 Call evaluate_hardware_support exactly once per hwm 0337474 Unmount config drives Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/agent.py | 6 + ironic_python_agent/config.py | 69 +- ironic_python_agent/disk_partitioner.py | 125 +++ ironic_python_agent/disk_utils.py | 788 +++++++++++++++ ironic_python_agent/errors.py | 9 + ironic_python_agent/extensions/standby.py | 86 +- ironic_python_agent/format_inspector.py | 1044 +++++++++++++++++++ ironic_python_agent/hardware.py | 67 +- ironic_python_agent/partition_utils.py | 11 +- ironic_python_agent/qemu_img.py | 153 +++ ironic_python_agent/utils.py | 28 + ...-config-drive-is-umounted-a3985bbb45e89051.yaml | 8 + .../notes/image-security-5c23b890409101c9.yaml | 48 + ...ate-hardware-support-once-9ec1ae327b4e03f2.yaml | 7 + zuul.d/ironic-python-agent-jobs.yaml | 17 +- zuul.d/project.yaml | 2 - 27 files changed, 4305 insertions(+), 199 deletions(-)

1 0

ironic 23.0.2 (bobcat)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are glad to announce the release of: ironic 23.0.2: OpenStack Bare Metal Provisioning This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 23.0.2 ^^^^^^ Upgrade Notes ************* * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "ironic-python-agent" ramdisks will also need to be upgraded. * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "[conductor]conductor_always_validates_images" setting may be set to "True" as a short term remedy while "ironic- python-agent" ramdisks are being updated. Alternatively it may be advisable to also set the "[agent]image_download_source" setting to "local" to minimize redundant network data transfers. * As a result of security fixes to address "qemu-img" image conversion security issues, a new configuration parameter has been added to Ironic, "[conductor]permitted_image_formats" with a default value of "raw,qcow2,iso". Raw and qcow2 format disk images are the image formats the Ironic community has consistently stated as what is supported and expected for use with Ironic. These formats also match the formats which the Ironic community tests. Operators who leverage other disk image formats, may need to modify this setting further. Security Issues *************** * Ironic now checks the supplied image format value against the detected format of the image file, and will prevent deployments should the values mismatch. If being used with Glance and a mismatch in metadata is identified, it will require images to be re-uploaded with a new image ID to represent corrected metadata. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic *always* inspects the supplied user image content for safety prior to deployment of a node should the image pass through the conductor, even if the image is supplied in "raw" format. This is utilized to identify the format of the image and the overall safety of the image, such that source images with unknown or unsafe feature usage are explicitly rejected. This can be disabled by setting "[conductor]disable_deep_image_inspection" to "True". This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic can also inspect images which would normally be provided as a URL for direct download by the "ironic-python-agent" ramdisk. This is not enabled by default as it will increase the overall network traffic and disk space utilization of the conductor. This level of inspection can be enabled by setting "[conductor]conductor_always_validates_images" to "True". Once the "ironic-python-agent" ramdisk has been updated, it will perform similar image security checks independently, should an image conversion be required. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic now explicitly enforces a list of permitted image types for deployment via the "[conductor]permitted_image_formats" setting, which defaults to "raw", "qcow2", and "iso". While the project has classically always declared permissible images as "qcow2" and "raw", it was previously possible to supply other image formats known to "qemu-img", and the utility would attempt to convert the images. The "iso" support is required for "boot from ISO" ramdisk support. * Ironic now explicitly passes the source input format to executions of "qemu-img" to limit the permitted qemu disk image drivers which may evaluate an image to prevent any mismatched format attacks against "qemu-img". * The "ansible" deploy interface example playbooks now supply an input format to execution of "qemu-img". If you are using customized playbooks, please add "-f {{ ironic.image.disk_format }}" to your invocations of "qemu-img". If you do not do so, "qemu-img" will automatically try and guess which can lead to known security issues with the incorrect source format driver. * Operators who have implemented any custom deployment drivers or additional functionality like machine snapshot, should review their downstream code to ensure they are properly invoking "qemu-img". If there are any questions or concerns, please reach out to the Ironic project developers. * Operators are reminded that they should utilize cleaning in their environments. Disabling any security features such as cleaning or image inspection are at **your** **own** **risk**. Should you have any issues with security related features, please don't hesitate to open a bug with the project. * The "[conductor]disable_deep_image_inspection" setting is conveyed to the "ironic-python-agent" ramdisks automatically, and will prevent those operating ramdisks from performing deep inspection of images before they are written. * The "[conductor]permitted_image_formats" setting is conveyed to the "ironic-python-agent" ramdisks automatically. Should a need arise to explicitly permit an additional format, that should take place in the Ironic service configuration. Bug Fixes ********* * Fixes issue with configuring virtual media boot for executing service steps by adding missing entries for states.SERVICING and states.SERVICEWAIT in the whitelist of the states allowed by this method. * Fixes multiple issues in the handling of images as it relates to the execution of the "qemu-img" utility, which is used for image format conversion, where a malicious user could craft a disk image to potentially extract information from an "ironic-conductor" process's operating environment. Ironic now explicitly enforces a list of approved image formats as a "[conductor]permitted_image_formats" list, which mirrors the image formats the Ironic project has historically tested and expressed as known working. Testing is not based upon file extension, but upon content fingerprinting of the disk image files. This is tracked as CVE-2024-44082 via bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Service step validation no longer requires a priority field, which is not supported for servicing. * Adds an ISO publisher value to ISO images which are mastered as part of cleaning/deployment/service operations in support of a fix for bug 2032377 (https://bugs.launchpad.net/ironic/+bug/2032377) Changes in ironic 23.0.1..23.0.2 -------------------------------- 79f685be2 CI: Remove grenade jobs for 2023.2 6a7c1ce16 CVE-2024-44982: Harden all image handling and conversion code bd7adb094 Temporary disable ironic-standalone-redfish on stable/2023.2 9b09987b6 fix: Fix class typo for portgroup. Portgroup instead of PortGroup 81f79769c Remove SQLAlchemy tips jobs d4ce99c89 Fix spurious CI job failures around partition images c71e124f9 Inject a randomized publisher id 0638b08d1 Handle servicing failures in the Redfish BIOS interface 7bf5f13b0 Stop assuming service steps have priorities b81bbdd7d Add states.SERVICING and SERVICEWAIT to need_prepare_ramdisk Diffstat (except docs and test files) ------------------------------------- devstack/lib/ironic | 7 +- ironic/api/controllers/v1/port.py | 2 +- ironic/api/controllers/v1/ramdisk.py | 2 + ironic/common/exception.py | 4 + ironic/common/image_format_inspector.py | 1038 ++++++++++++++++++++ ironic/common/images.py | 190 +++- ironic/common/qemu_img.py | 89 ++ ironic/conductor/steps.py | 25 +- ironic/conf/__init__.py | 2 + ironic/conf/conductor.py | 43 + ironic/conf/disk_utils.py | 33 + ironic/conf/opts.py | 1 + .../playbooks/roles/deploy/tasks/write.yaml | 2 +- ironic/drivers/modules/deploy_utils.py | 218 +++- ironic/drivers/modules/image_cache.py | 71 +- ironic/drivers/modules/image_utils.py | 34 +- ironic/drivers/modules/redfish/bios.py | 7 +- ironic/drivers/utils.py | 4 +- .../unit/drivers/modules/test_deploy_utils.py | 515 +++++++++- ...g-to-need-prepare-ramdisk-fb0634b4f7d851bd.yaml | 7 + .../address-qemu-issues-1bbead8bb70b76fb.yaml | 108 ++ .../notes/service-priority-7482622471102c6b.yaml | 5 + ...ia-publisher-id-injection-c88674a31634f852.yaml | 6 + zuul.d/ironic-jobs.yaml | 18 - zuul.d/project.yaml | 17 +- 36 files changed, 3722 insertions(+), 287 deletions(-)

1 0

ironic 24.1.2 (caracal)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We eagerly announce the release of: ironic 24.1.2: OpenStack Bare Metal Provisioning This release is part of the caracal release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 24.1.2 ^^^^^^ Upgrade Notes ************* * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "ironic-python-agent" ramdisks will also need to be upgraded. * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "[conductor]conductor_always_validates_images" setting may be set to "True" as a short term remedy while "ironic- python-agent" ramdisks are being updated. Alternatively it may be advisable to also set the "[agent]image_download_source" setting to "local" to minimize redundant network data transfers. * As a result of security fixes to address "qemu-img" image conversion security issues, a new configuration parameter has been added to Ironic, "[conductor]permitted_image_formats" with a default value of "raw,qcow2,iso". Raw and qcow2 format disk images are the image formats the Ironic community has consistently stated as what is supported and expected for use with Ironic. These formats also match the formats which the Ironic community tests. Operators who leverage other disk image formats, may need to modify this setting further. Security Issues *************** * Ironic now checks the supplied image format value against the detected format of the image file, and will prevent deployments should the values mismatch. If being used with Glance and a mismatch in metadata is identified, it will require images to be re-uploaded with a new image ID to represent corrected metadata. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic *always* inspects the supplied user image content for safety prior to deployment of a node should the image pass through the conductor, even if the image is supplied in "raw" format. This is utilized to identify the format of the image and the overall safety of the image, such that source images with unknown or unsafe feature usage are explicitly rejected. This can be disabled by setting "[conductor]disable_deep_image_inspection" to "True". This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic can also inspect images which would normally be provided as a URL for direct download by the "ironic-python-agent" ramdisk. This is not enabled by default as it will increase the overall network traffic and disk space utilization of the conductor. This level of inspection can be enabled by setting "[conductor]conductor_always_validates_images" to "True". Once the "ironic-python-agent" ramdisk has been updated, it will perform similar image security checks independently, should an image conversion be required. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic now explicitly enforces a list of permitted image types for deployment via the "[conductor]permitted_image_formats" setting, which defaults to "raw", "qcow2", and "iso". While the project has classically always declared permissible images as "qcow2" and "raw", it was previously possible to supply other image formats known to "qemu-img", and the utility would attempt to convert the images. The "iso" support is required for "boot from ISO" ramdisk support. * Ironic now explicitly passes the source input format to executions of "qemu-img" to limit the permitted qemu disk image drivers which may evaluate an image to prevent any mismatched format attacks against "qemu-img". * The "ansible" deploy interface example playbooks now supply an input format to execution of "qemu-img". If you are using customized playbooks, please add "-f {{ ironic.image.disk_format }}" to your invocations of "qemu-img". If you do not do so, "qemu-img" will automatically try and guess which can lead to known security issues with the incorrect source format driver. * Operators who have implemented any custom deployment drivers or additional functionality like machine snapshot, should review their downstream code to ensure they are properly invoking "qemu-img". If there are any questions or concerns, please reach out to the Ironic project developers. * Operators are reminded that they should utilize cleaning in their environments. Disabling any security features such as cleaning or image inspection are at **your** **own** **risk**. Should you have any issues with security related features, please don't hesitate to open a bug with the project. * The "[conductor]disable_deep_image_inspection" setting is conveyed to the "ironic-python-agent" ramdisks automatically, and will prevent those operating ramdisks from performing deep inspection of images before they are written. * The "[conductor]permitted_image_formats" setting is conveyed to the "ironic-python-agent" ramdisks automatically. Should a need arise to explicitly permit an additional format, that should take place in the Ironic service configuration. Bug Fixes ********* * Fixes an issue with units tests that show this DeprecationWarning: The metaschema specified by $schema was not found. Using the latest draft to validate, but this will raise an error in the future. cls = validator_for(schema) Removed the warning for deprecated schema by using a new template. * Fixes the issue of service steps not starting due to servicing states (states.SERVICING and states.SERVICEWAIT) missing from _FASTTRACK_HEARTBEAT_ALLOWED constant. * Fixes issue with configuring virtual media boot for executing service steps by adding missing entries for states.SERVICING and states.SERVICEWAIT in the whitelist of the states allowed by this method. * Fixes multiple issues in the handling of images as it relates to the execution of the "qemu-img" utility, which is used for image format conversion, where a malicious user could craft a disk image to potentially extract information from an "ironic-conductor" process's operating environment. Ironic now explicitly enforces a list of approved image formats as a "[conductor]permitted_image_formats" list, which mirrors the image formats the Ironic project has historically tested and expressed as known working. Testing is not based upon file extension, but upon content fingerprinting of the disk image files. This is tracked as CVE-2024-44082 via bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Fixes usage of redfish detach virtual media feature to be conform to the general implementation. Before the detach virtual media API call using redfish driver was not working as intended and caused the operation to fail. * Fixes an issue in redfish attach/detach generic virtual media where the attached devices are not correctly recognized causing the attach operation to fail. * Service step validation no longer requires a priority field, which is not supported for servicing. * Fixes service steps that rely on a reboot. Previously, the reboot was not properly recognized in the conductor logic. * Adds an ISO publisher value to ISO images which are mastered as part of cleaning/deployment/service operations in support of a fix for bug 2032377 (https://bugs.launchpad.net/ironic/+bug/2032377) * Fixes generated URL when using the virtual media attachment API. Previously, it missed the node UUID, causing conflicts between different nodes. Changes in ironic 24.1.1..24.1.2 -------------------------------- f7c7ea935 CVE-2024-44982: Harden all image handling and conversion code f33949e37 CI: Disable metal3-integration test job 25c78951a [CI][stable only] fix zuul config 9ac841796 [CI] Fix job parent name 84fb43b81 fix: Fix class typo for portgroup. Portgroup instead of PortGroup 55987f269 Correct bond_mode enum value for 802.3ad 4e09e6dc5 Remove SQLAlchemy tips jobs f0b623881 Fix spurious CI job failures around partition images 78c1d9a98 Inject a randomized publisher id 394ee3763 Redfish: fix error formatting when mounting vmedia 5026e3079 Fix attach/detach vmedia redfish implementation d31ea3d05 Fix redfish detach generic vmedia device method 22666a889 Add states.SERVICING and SERVICEWAIT to _FASTTRACK_HEARTBEAT_ALLOWED 438fd6220 Remove deprecation warning by setting schema 2638b6c00 Fix the confusion around service_reboot/servicing_reboot 7b6e58a5a Fix servicing clean-up 5733379b6 Handle servicing failures in the Redfish BIOS interface 5f9ceb492 Fix get_async_step_return_state to account for servicing 9bfe422f7 Stop assuming service steps have priorities fab3772cb Add states.SERVICING and SERVICEWAIT to need_prepare_ramdisk ac2c86861 Fix generating local paths when connecting virtual media Diffstat (except docs and test files) ------------------------------------- devstack/lib/ironic | 7 +- ironic/api/controllers/v1/network-data-schema.json | 4 +- ironic/api/controllers/v1/port.py | 2 +- ironic/api/controllers/v1/ramdisk.py | 2 + ironic/common/async_steps.py | 168 ++++ ironic/common/exception.py | 4 + ironic/common/image_format_inspector.py | 1038 ++++++++++++++++++++ ironic/common/images.py | 190 +++- ironic/common/qemu_img.py | 89 ++ ironic/common/states.py | 5 + ironic/conductor/cleaning.py | 11 +- ironic/conductor/deployments.py | 12 +- ironic/conductor/manager.py | 19 +- ironic/conductor/servicing.py | 12 +- ironic/conductor/steps.py | 25 +- ironic/conductor/utils.py | 36 +- ironic/conf/__init__.py | 2 + ironic/conf/conductor.py | 43 + ironic/conf/disk_utils.py | 33 + ironic/conf/opts.py | 1 + ironic/drivers/modules/agent.py | 8 +- ironic/drivers/modules/agent_base.py | 39 +- .../playbooks/roles/deploy/tasks/write.yaml | 2 +- ironic/drivers/modules/deploy_utils.py | 306 ++++-- ironic/drivers/modules/image_cache.py | 71 +- ironic/drivers/modules/image_utils.py | 38 +- ironic/drivers/modules/redfish/bios.py | 7 +- ironic/drivers/modules/redfish/boot.py | 8 +- ironic/drivers/modules/redfish/firmware_utils.py | 2 +- ironic/drivers/modules/redfish/management.py | 22 +- ironic/drivers/utils.py | 4 +- .../unit/drivers/modules/drac/test_management.py | 9 +- .../modules/network/json_samples/network_data.json | 2 +- .../drivers/modules/redfish/test_management.py | 43 +- .../unit/drivers/modules/redfish/test_raid.py | 58 +- .../unit/drivers/modules/test_deploy_utils.py | 520 +++++++++- releasenotes/notes/2061160-5e080a17ae31fb53.yaml | 8 + ...ng-to-heartbeat-fasttrack-85863df34ece6401.yaml | 6 + ...g-to-need-prepare-ramdisk-fb0634b4f7d851bd.yaml | 7 + .../address-qemu-issues-1bbead8bb70b76fb.yaml | 108 ++ ...fix-detach-vmedia-redfish-c86b7d0f72217816.yaml | 7 + ...x-redfish-advmedia-part02-67ac1b22153ff1cf.yaml | 6 + .../notes/service-priority-7482622471102c6b.yaml | 5 + .../notes/servicing-reboot-502f474a01f937a8.yaml | 5 + ...ia-publisher-id-injection-c88674a31634f852.yaml | 6 + .../notes/vmedia-path-648cfa258708e0bb.yaml | 6 + zuul.d/ironic-jobs.yaml | 23 +- zuul.d/project.yaml | 12 +- 63 files changed, 4116 insertions(+), 542 deletions(-)

1 0

ironic-python-agent 9.4.2 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are chuffed to announce the release of: ironic-python-agent 9.4.2: Ironic Python Agent Ramdisk This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- python-agent For more details, please see below. 9.4.2 ^^^^^ Upgrade Notes ************* * Deployers implementing their own "HardwareManagers" must to audit their code for unsafe uses of *qemu-img* and related methods. Security Issues *************** * Ironic-Python-Agent now checks any supplied image format value against the detected format of the image file and will prevent deployments should the values mismatch. * Images previously misconfigured as raw despite being in another format, in some non-default configurations, may have been mistakenly converted if needed. Ironic-Python-Agent will no longer perform conversion in any case for images with metadata indicating in raw format. * Ironic-Python-Agent *always* inspects any non-raw user image content for safety before running any qemu-based utilities on the image. This is utilized to identify the format of the image and to verify the overall safety of the image. Any images with unknown or unsafe feature uses are explicitly rejected. This can be disabled in both IPA and Ironic by setting "[conductor]disable_deep_image_inspection" to "True" for the Ironic deployment. Image inspection is the primary mitigation for CVE-2024-44082 being tracked in bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) Operators may desire to set "[conductor]conductor_always_validates_images" on Ironic conductors to mitigate the issue before they have upgraded their Ironic-Python- Agent. * Ironic-Python-Agent now explicitly enforces a list of permitted image types for deployment, defaulting to "raw" and "qcow2". Other image types may work, but are not explicitly supported and must be enabled. This can be modified by setting "[conductor]permitted_image_formats" for all Ironic services. Bug Fixes ********* * Fixes multiple issues in the handling of images as it related to execution of the "qemu-img" utility. When using this utility to convert an unsafe image, a malicious user can extract information from a node while Ironic-Python-Agent is deploying or converting an image. Ironic-Python-Agent now inspects all non-raw images for safety, and never runs qemu-based utilities on raw images. This fix is tracked as CVE-2024-44082 and bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) * Images with metadata indicating a "raw" disk format may have been transparently converted from another format. Now, these images will have their exact contents imaged to disk without modification. Changes in ironic-python-agent 9.4.1..9.4.2 ------------------------------------------- a1da3c9 Inspect non-raw images for safety 2af0f10 [stable-only] Multiple job fixes 6123489 CI: Dial back CI jobs for 2023.1 Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/agent.py | 6 + ironic_python_agent/config.py | 69 +- ironic_python_agent/disk_partitioner.py | 125 +++ ironic_python_agent/disk_utils.py | 788 +++++++++++++++ ironic_python_agent/errors.py | 9 + ironic_python_agent/extensions/standby.py | 83 +- ironic_python_agent/format_inspector.py | 1044 +++++++++++++++++++ ironic_python_agent/partition_utils.py | 11 +- ironic_python_agent/qemu_img.py | 153 +++ .../notes/image-security-5c23b890409101c9.yaml | 48 + zuul.d/ironic-python-agent-jobs.yaml | 17 +- zuul.d/project.yaml | 27 +- 18 files changed, 4100 insertions(+), 145 deletions(-)

1 0

ironic-python-agent 9.11.1 (caracal)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are stoked to announce the release of: ironic-python-agent 9.11.1: Ironic Python Agent Ramdisk This release is part of the caracal release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent/+bugs For more details, please see below. 9.11.1 ^^^^^^ Upgrade Notes ************* * Deployers implementing their own "HardwareManagers" must to audit their code for unsafe uses of *qemu-img* and related methods. Security Issues *************** * Ironic-Python-Agent now checks any supplied image format value against the detected format of the image file and will prevent deployments should the values mismatch. * Images previously misconfigured as raw despite being in another format, in some non-default configurations, may have been mistakenly converted if needed. Ironic-Python-Agent will no longer perform conversion in any case for images with metadata indicating in raw format. * Ironic-Python-Agent *always* inspects any non-raw user image content for safety before running any qemu-based utilities on the image. This is utilized to identify the format of the image and to verify the overall safety of the image. Any images with unknown or unsafe feature uses are explicitly rejected. This can be disabled in both IPA and Ironic by setting "[conductor]disable_deep_image_inspection" to "True" for the Ironic deployment. Image inspection is the primary mitigation for CVE-2024-44082 being tracked in bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) Operators may desire to set "[conductor]conductor_always_validates_images" on Ironic conductors to mitigate the issue before they have upgraded their Ironic-Python- Agent. * Ironic-Python-Agent now explicitly enforces a list of permitted image types for deployment, defaulting to "raw" and "qcow2". Other image types may work, but are not explicitly supported and must be enabled. This can be modified by setting "[conductor]permitted_image_formats" for all Ironic services. Bug Fixes ********* * Fixes an issue where configuration drive volumes which are mounted by the operating system could remain mounted and cause a lock to be held, which may conflict with actions such as "rebuild". The agent now always makes sure the folder used by Glean and Cloud-init is not mounted. * Fixes multiple issues in the handling of images as it related to execution of the "qemu-img" utility. When using this utility to convert an unsafe image, a malicious user can extract information from a node while Ironic-Python-Agent is deploying or converting an image. Ironic-Python-Agent now inspects all non-raw images for safety, and never runs qemu-based utilities on raw images. This fix is tracked as CVE-2024-44082 and bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) * Images with metadata indicating a "raw" disk format may have been transparently converted from another format. Now, these images will have their exact contents imaged to disk without modification. * Fixes bug 2066308, an issue where Ironic Python Agent would call evaluate_hardware_support multiple times on hardware manager plugins. Scanning for hardware and disks is time consuming, and caused timeouts on badly-performing nodes. Changes in ironic-python-agent 9.11.0..9.11.1 --------------------------------------------- 06fe5ff Inspect non-raw images for safety 46744b1 Remove and disable examples job e9c0578 Call evaluate_hardware_support exactly once per hwm c1581df Unmount config drives Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/agent.py | 6 + ironic_python_agent/config.py | 76 +- ironic_python_agent/disk_partitioner.py | 124 +++ ironic_python_agent/disk_utils.py | 782 +++++++++++++++ ironic_python_agent/errors.py | 9 + ironic_python_agent/extensions/standby.py | 86 +- ironic_python_agent/format_inspector.py | 1044 ++++++++++++++++++++ ironic_python_agent/hardware.py | 67 +- ironic_python_agent/partition_utils.py | 11 +- ironic_python_agent/qemu_img.py | 153 +++ ironic_python_agent/utils.py | 28 + ...-config-drive-is-umounted-a3985bbb45e89051.yaml | 8 + .../notes/image-security-5c23b890409101c9.yaml | 48 + ...ate-hardware-support-once-9ec1ae327b4e03f2.yaml | 7 + zuul.d/ironic-python-agent-jobs.yaml | 18 +- zuul.d/project.yaml | 2 - 27 files changed, 4260 insertions(+), 199 deletions(-)

1 0

venus-dashboard 5.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for venus-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/venus-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/venus-dashboard/src/branch/stable/dalmatian Release notes for venus-dashboard can be found at: https://docs.openstack.org/releasenotes/venus-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/openstack-venus/+bugs and tag it *dalmatian-rc-potential* to bring it to the venus-dashboard release crew's attention.

1 0

heat-dashboard 12.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for heat-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/heat-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/heat-dashboard/src/branch/stable/dalmatian Release notes for heat-dashboard can be found at: https://docs.openstack.org/releasenotes/heat-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/heat-dashboard and tag it *dalmatian-rc-potential* to bring it to the heat-dashboard release crew's attention.

1 0

heat-agents 9.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for heat-agents for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/heat-agents/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/heat-agents/src/branch/stable/dalmatian Release notes for heat-agents can be found at: https://docs.openstack.org/releasenotes/heat-agents/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/heat-agents/+bugs and tag it *dalmatian-rc-potential* to bring it to the heat-agents release crew's attention.

1 0

heat 23.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for heat for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/heat/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/heat/src/branch/stable/dalmatian Release notes for heat can be found at: https://docs.openstack.org/releasenotes/heat/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/989 and tag it *dalmatian-rc-potential* to bring it to the heat release crew's attention.

1 0

keystone 26.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for keystone for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/keystone/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/keystone/src/branch/stable/dalmatian Release notes for keystone can be found at: https://docs.openstack.org/releasenotes/keystone/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/keystone/+bugs and tag it *dalmatian-rc-potential* to bring it to the keystone release crew's attention.

1 0

storlets 14.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for storlets for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/storlets/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/storlets/src/branch/stable/dalmatian Release notes for storlets can be found at: https://docs.openstack.org/releasenotes/storlets/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/storlets/+bugs and tag it *dalmatian-rc-potential* to bring it to the storlets release crew's attention.

1 0

ovn-octavia-provider 7.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for ovn-octavia-provider for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/ovn-octavia-provider/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/ovn-octavia-provider/src/branch/stable/dalmat… Release notes for ovn-octavia-provider can be found at: https://docs.openstack.org/releasenotes/ovn-octavia-provider/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron/+bugs and tag it *dalmatian-rc-potential* to bring it to the ovn-octavia-provider release crew's attention.

1 0

octavia 15.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for octavia for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/octavia/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/octavia/src/branch/stable/dalmatian Release notes for octavia can be found at: https://docs.openstack.org/releasenotes/octavia/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/908 and tag it *dalmatian-rc-potential* to bring it to the octavia release crew's attention.

1 0

ovn-bgp-agent 3.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for ovn-bgp-agent for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/ovn-bgp-agent/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/ovn-bgp-agent/src/branch/stable/dalmatian Release notes for ovn-bgp-agent can be found at: https://docs.openstack.org/releasenotes/ovn-bgp-agent/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/ovn-bgp-agent/+bugs and tag it *dalmatian-rc-potential* to bring it to the ovn-bgp-agent release crew's attention.

1 0

kolla 17.5.0 (bobcat)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are delighted to announce the release of: kolla 17.5.0: Kolla OpenStack Deployment This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/kolla Download the package from: https://tarballs.openstack.org/kolla/ Please report issues through: https://bugs.launchpad.net/kolla/+bugs For more details, please see below. 17.5.0 ^^^^^^ Bug Fixes * Apache services like Keystone now started with correct unicode locale. Keystone under Apache on Ubuntu will fail with a UnicodeEncodeError when LDAP driver and DEBUG are enabled. LP#2076453 * Fixes an issue where kolla-toolbox will fail to build due to mismatched rabbitmq-server dependencies. LP#2066171 Changes in kolla 17.4.0..17.5.0 ------------------------------- 1f156fb39 keystone: Fix requests-kerberos installation ae20362c6 CI: Disable CentOS/Rocky/Ubuntu aarch64 jobs 15fd9ded6 Configure Apache services to use correct locale cfc0bd82b Trivial fix letsencrypt base image f3d1bba06 Pass rabbitmq apt preferences into kolla-toolbox Diffstat (except docs and test files) ------------------------------------- .zuul.d/centos.yaml | 3 --- .zuul.d/rocky.yaml | 3 --- .zuul.d/ubuntu.yaml | 3 --- .../notes/configure-apache-locale-d0150e5881f00e65.yaml | 7 +++++++ ...ss-rmq-preferences-into-kolla-toolbox-32d7209c4cf1f3c9.yaml | 6 ++++++ 11 files changed, 40 insertions(+), 12 deletions(-)

1 0

kolla-ansible 18.2.0 (caracal)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are chuffed to announce the release of: kolla-ansible 18.2.0: Ansible Deployment of Kolla containers This release is part of the caracal release series. The source is available from: https://opendev.org/openstack/kolla-ansible Download the package from: https://tarballs.openstack.org/kolla-ansible/ Please report issues through: https://bugs.launchpad.net/kolla-ansible/+bugs For more details, please see below. 18.2.0 ^^^^^^ New Features ************ * Modifies public API firewalld rules to be applied immediately to a running firewalld service. This requires firewalld to be running, but avoids reloading firewalld, which is disruptive due to the way in which firewalld builds its firewall chains. * Added a command to upgrade to a target version of RabbitMQ. This is required before a SLURP upgrade. See the docs for more details: https://docs.openstack.org/kolla-ansible/latest/reference/message- queues/rabbitmq.html#slurp Bug Fixes ********* * Fixes an deploy opensearch with enable TLS on the internal VIP. * Fixes handling of openvswitch on "manila-share" nodes. LP#1993285 * Adds database configuration necessary for barbican. LP#2072554 * Fixes behaviour of Change Password screen in Horizon until bug #2073639 is resolved. LP#2073159 * Fixes the Python requests library issue when using custom CA by adding the REQUESTS_CA environment variable to the kolla-toolbox container. See LP#1967132 * Fixes the detection of the Nova Compute Ironic service when a custom *host* option is set in the service config file. See LP#2056571 * Removes the default */tmp/* mountpoint from the horizon container. This change is made to harden the container and prevent potential security issues. For more information, see the Bug Report: LP#2068126. * Fixed an issue with the "prometheus.yml" template which would break when deploying alertmanager. * Fixes an issue where OVN northbound or southbound database deployment could fail when a new leader is elected. LP#2059124 Changes in kolla-ansible 18.1.0..18.2.0 --------------------------------------- 014dd4915 Apply public firewalld rules immediately 2e31fbd67 Add REQUESTS_CA_BUNDLE to kolla-toolbox container e32cda95d hardening horizon: don't mount hosts /tmp d98c5b49d [2024.1 only] CI: RMQ version upgrade before SLURP 03c7e8496 Add command to upgrade to a target version of RMQ d79698ae9 CI: Only migrate RMQ queues during SLURP 6876041e2 Fix issue with Swift Recon middleware 3340cfe35 Fix post-config of OVS for manila-share servers 0f97aa222 Fix prometheus.yml templating be86bf81c Work around OVN DB leader election race condition c0eee5e6a CI: drop RMQ reconfigure step in queue migrations 4268379da Restart OVS container after hw-offload change e77135b19 Add /v3 suffix to OPENSTACK_KEYSTONE_URL 9206eb495 fix flake8 error in database_shards.py 88e6a3784 CI: Use u-c in openstack-clients role 0c52bb15b Support custom Nova Compute Ironic host names dad9bc400 Fix barbican's configuration e70468f57 Add ca_path for module uri in opensearch role d090164bb Fix prechecks for interfaces with dashes Diffstat (except docs and test files) ------------------------------------- ansible/rabbitmq-upgrade.yml | 21 ++++++++ ansible/roles/barbican/templates/barbican.conf.j2 | 7 ++- ansible/roles/common/defaults/main.yml | 1 + ansible/roles/haproxy-config/tasks/main.yml | 7 ++- ansible/roles/horizon/defaults/main.yml | 1 - .../horizon/templates/_9998-kolla-settings.py.j2 | 3 +- ansible/roles/loadbalancer/handlers/main.yml | 6 --- ansible/roles/loadbalancer/tasks/precheck.yml | 2 +- .../nova-cell/tasks/wait_discover_computes.yml | 2 +- ansible/roles/nova-cell/templates/nova.conf.j2 | 2 +- ansible/roles/opensearch/handlers/main.yml | 2 + ansible/roles/opensearch/tasks/post-config.yml | 4 ++ ansible/roles/openvswitch/tasks/post-config.yml | 6 ++- ansible/roles/ovn-db/defaults/main.yml | 2 + ansible/roles/ovn-db/tasks/bootstrap-db.yml | 10 ++++ ansible/roles/prechecks/tasks/port_checks.yml | 2 +- .../roles/prometheus/templates/prometheus.yml.j2 | 4 +- ansible/roles/rabbitmq/defaults/main.yml | 2 + ansible/roles/swift/tasks/start.yml | 2 + .../logging-and-monitoring/prometheus-guide.rst | 2 +- kolla_ansible/database_shards.py | 4 +- .../notes/add-opensearch-uri-68a657c55ce9c9f1.yaml | 4 ++ .../notes/bug-1993285-127fe764e461465a.yaml | 5 ++ .../notes/bug-2072554-d113b89975985520.yaml | 5 ++ .../notes/bug-2073159-c54c773c72c8fb11.yaml | 6 +++ .../notes/bug-923105-d451a78930973a82.yaml | 7 +++ .../firewalld-immediate-c2abf09977c455a9.yaml | 7 +++ ...ompute-ironic-host-option-a7a3f6ae095f5201.yaml | 6 +++ .../harden_horizon_tmp_usage-0d690e49645b99a8.yaml | 6 +++ .../prometheus-template-fix-b971aad477a8fdc9.yaml | 5 ++ ...mq-target-upgrade-command-d5f9d9fc27fa28f8.yaml | 6 +++ ...round-ovn-leader-election-f7f75e93e9300d96.yaml | 6 +++ roles/cephadm/tasks/main.yml | 4 +- roles/openstack-clients/defaults/main.yml | 2 + roles/openstack-clients/tasks/main.yml | 1 + tools/kolla-ansible | 8 +++ 42 files changed, 300 insertions(+), 60 deletions(-)

1 0

neutron-vpnaas 25.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for neutron-vpnaas for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/neutron-vpnaas/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/neutron-vpnaas/src/branch/stable/dalmatian Release notes for neutron-vpnaas can be found at: https://docs.openstack.org/releasenotes/neutron-vpnaas/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron/+bugs and tag it *dalmatian-rc-potential* to bring it to the neutron-vpnaas release crew's attention.

1 0

networking-bgpvpn 21.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for networking-bgpvpn for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/networking-bgpvpn/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/networking-bgpvpn/src/branch/stable/dalmatian Release notes for networking-bgpvpn can be found at: https://docs.openstack.org/releasenotes/networking-bgpvpn/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/bgpvpn/+bugs and tag it *dalmatian-rc-potential* to bring it to the networking-bgpvpn release crew's attention.

1 0

kolla 16.6.0 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are happy to announce the release of: kolla 16.6.0: Kolla OpenStack Deployment This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/kolla Download the package from: https://tarballs.openstack.org/kolla/ Please report issues through: https://bugs.launchpad.net/kolla/+bugs For more details, please see below. 16.6.0 ^^^^^^ Bug Fixes * Apache services like Keystone now started with correct unicode locale. Keystone under Apache on Ubuntu will fail with a UnicodeEncodeError when LDAP driver and DEBUG are enabled. LP#2076453 * Fixes an issue where kolla-toolbox will fail to build due to mismatched rabbitmq-server dependencies. LP#2066171 Changes in kolla 16.5.0..16.6.0 ------------------------------- 3a39a79ee keystone: Fix requests-kerberos installation 0d55fe0f7 CI: Disable CentOS/Rocky/Ubuntu aarch64 jobs a7a602b9b Configure Apache services to use correct locale 343e0bc40 Build RabbitMQ 3.11, 3.12 and 3.13 in 2023.1 0f6b1a2c7 Move apt_prefs pins to respective images Diffstat (except docs and test files) ------------------------------------- .zuul.d/centos.yaml | 3 --- .../kolla-toolbox/apt_preferences_rabbitmq.debian | 1 + .../kolla-toolbox/apt_preferences_rabbitmq.ubuntu | 1 + .../rabbitmq-3-12/apt_preferences_rabbitmq.debian | 7 ++++++ .../rabbitmq-3-12/apt_preferences_rabbitmq.ubuntu | 7 ++++++ .../rabbitmq-3-12/rabbitmq_packages_rpm.centos | 4 ++++ .../rabbitmq-3-12/rabbitmq_packages_rpm.rocky | 4 ++++ .../rabbitmq-3-13/apt_preferences_rabbitmq.debian | 7 ++++++ .../rabbitmq-3-13/apt_preferences_rabbitmq.ubuntu | 7 ++++++ .../rabbitmq-3-13/rabbitmq_packages_rpm.centos | 4 ++++ .../rabbitmq-3-13/rabbitmq_packages_rpm.rocky | 4 ++++ .../rabbitmq/apt_preferences_rabbitmq.debian | 7 ++++++ .../rabbitmq/apt_preferences_rabbitmq.ubuntu | 7 ++++++ .../rabbitmq/{ => rabbitmq}/healthcheck_rabbitmq | 0 .../rabbitmq/rabbitmq/rabbitmq_packages_rpm.centos | 4 ++++ .../rabbitmq/rabbitmq/rabbitmq_packages_rpm.rocky | 4 ++++ kolla/template/repos.yaml | 28 ++++++++++++++++++---- .../configure-apache-locale-d0150e5881f00e65.yaml | 7 ++++++ ...rences-into-kolla-toolbox-32d7209c4cf1f3c9.yaml | 6 +++++ 32 files changed, 146 insertions(+), 22 deletions(-)

1 0

kolla-ansible 17.5.0 (bobcat)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are satisfied to announce the release of: kolla-ansible 17.5.0: Ansible Deployment of Kolla containers This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/kolla-ansible Download the package from: https://tarballs.openstack.org/kolla-ansible/ Please report issues through: https://bugs.launchpad.net/kolla-ansible/+bugs For more details, please see below. 17.5.0 ^^^^^^ New Features ************ * Modifies public API firewalld rules to be applied immediately to a running firewalld service. This requires firewalld to be running, but avoids reloading firewalld, which is disruptive due to the way in which firewalld builds its firewall chains. Bug Fixes ********* * Fixes an deploy opensearch with enable TLS on the internal VIP. * Fixes handling of openvswitch on "manila-share" nodes. LP#1993285 * Fixes behaviour of Change Password screen in Horizon until bug #2073639 is resolved. LP#2073159 * Fixes the Python requests library issue when using custom CA by adding the REQUESTS_CA environment variable to the kolla-toolbox container. See LP#1967132 * Fixes configuration of CloudKitty when internal TLS is enabled. LP#1998831 * Fixes the detection of the Nova Compute Ironic service when a custom *host* option is set in the service config file. See LP#2056571 * Removes the default */tmp/* mountpoint from the horizon container. This change is made to harden the container and prevent potential security issues. For more information, see the Bug Report: LP#2068126. * Fixes an issue where OVN northbound or southbound database deployment could fail when a new leader is elected. LP#2059124 Changes in kolla-ansible 17.4.0..17.5.0 --------------------------------------- 127db7678 Apply public firewalld rules immediately 5b076458a Add REQUESTS_CA_BUNDLE to kolla-toolbox container b0bb8bc56 hardening horizon: don't mount hosts /tmp 1517c547c Fix issue with Swift Recon middleware 2f1984f91 Fix post-config of OVS for manila-share servers 5eda8fd79 Work around OVN DB leader election race condition d5d3ae3a0 Restart OVS container after hw-offload change d2d846f6f Add /v3 suffix to OPENSTACK_KEYSTONE_URL cfa27ee1d fix flake8 error in database_shards.py 79532d598 Support custom Nova Compute Ironic host names d7ef05780 Support CloudKitty deployment with internal TLS 0594a284c Add ca_path for module uri in opensearch role Diffstat (except docs and test files) ------------------------------------- ansible/roles/cloudkitty/defaults/main.yml | 8 ++-- ansible/roles/cloudkitty/tasks/bootstrap.yml | 3 ++ ansible/roles/common/defaults/main.yml | 1 + ansible/roles/haproxy-config/tasks/main.yml | 7 ++-- ansible/roles/horizon/defaults/main.yml | 1 - ansible/roles/horizon/templates/local_settings.j2 | 3 +- ansible/roles/loadbalancer/handlers/main.yml | 6 --- .../nova-cell/tasks/wait_discover_computes.yml | 2 +- ansible/roles/nova-cell/templates/nova.conf.j2 | 2 +- ansible/roles/opensearch/handlers/main.yml | 2 + ansible/roles/opensearch/tasks/post-config.yml | 4 ++ ansible/roles/openvswitch/tasks/post-config.yml | 4 ++ ansible/roles/ovn-db/defaults/main.yml | 2 + ansible/roles/ovn-db/tasks/bootstrap-db.yml | 10 +++++ ansible/roles/swift/tasks/start.yml | 2 + kolla_ansible/database_shards.py | 4 +- .../notes/add-opensearch-uri-68a657c55ce9c9f1.yaml | 4 ++ .../notes/bug-1993285-127fe764e461465a.yaml | 5 +++ .../notes/bug-2073159-c54c773c72c8fb11.yaml | 6 +++ .../notes/bug-923105-d451a78930973a82.yaml | 7 ++++ .../cloudkitty-internal-tls-c3e18be2a9f95c5d.yaml | 5 +++ .../firewalld-immediate-c2abf09977c455a9.yaml | 7 ++++ ...ompute-ironic-host-option-a7a3f6ae095f5201.yaml | 6 +++ .../harden_horizon_tmp_usage-0d690e49645b99a8.yaml | 6 +++ ...round-ovn-leader-election-f7f75e93e9300d96.yaml | 6 +++ 26 files changed, 136 insertions(+), 20 deletions(-)

1 0

neutron-vpnaas-dashboard 11.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for neutron-vpnaas-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/neutron-vpnaas-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/neutron-vpnaas-dashboard/src/branch/stable/da… Release notes for neutron-vpnaas-dashboard can be found at: https://docs.openstack.org/releasenotes/neutron-vpnaas-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron-vpnaas-dashboard/+bugs and tag it *dalmatian-rc-potential* to bring it to the neutron-vpnaas-dashboard release crew's attention.

1 0

neutron-fwaas-dashboard 8.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

Hello everyone, A new release candidate for neutron-fwaas-dashboard for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/neutron-fwaas-dashboard/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/neutron-fwaas-dashboard/src/branch/stable/dal… Release notes for neutron-fwaas-dashboard can be found at: https://docs.openstack.org/releasenotes/neutron-fwaas-dashboard/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/neutron-fwaas-dashboard/+bugs and tag it *dalmatian-rc-potential* to bring it to the neutron-fwaas-dashboard release crew's attention.

1 0

kayobe 15.5.0 (bobcat)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are psyched to announce the release of: kayobe 15.5.0: Deployment of OpenStack to bare metal using OpenStack kolla and bifrost This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/kayobe Download the package from: https://tarballs.openstack.org/kayobe/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/kayobe For more details, please see below. 15.5.0 ^^^^^^ New Features ************ * Adds support for specifying "boot_firmware" and "machine" variables to seed and infra VMs. This can be used to launch VMs in UEFI boot mode with Q35 machine type. * Bumps stackhpc.libvirt-vm Ansible role to "v1.16.1". Bug Fixes ********* * "eos_config" does not support the "provider" parameter since Ansible 7. Users are required to update their configuration according to Arista EOS documentation (https://docs.openstack.org/kayobe/latest/configuration/reference /physical-network.html#arista-eos). * Fixes a bug where systemd-networkd was not permanently enabled when the unit was already in state "runtime-enabled". LP#2073100 Changes in kayobe 15.4.0..15.5.0 -------------------------------- c642a626 arista-switch: Fix eos_config call e0afd3a3 CI: Add openstack-tox-pep8 job, fix pep8 failures 4fa4445a seed-vm/infra-vms: Add support for EFI and q35 06c7c02c Bump stackhpc.systemd_networkd role to v1.0.6 abf7b293 Stop replacing dashes with underscores for Kolla interfaces Diffstat (except docs and test files) ------------------------------------- ansible/inventory/group_vars/all/infra-vms | 6 ++++++ ansible/inventory/group_vars/all/seed-vm | 6 ++++++ ansible/inventory/group_vars/all/switches/arista | 22 ------------------- ansible/roles/arista-switch/tasks/main.yml | 4 +--- ansible/roles/infra-vms/tasks/deploy.yml | 2 ++ ansible/roles/infra-vms/tasks/destroy.yml | 1 + ansible/seed-vm-deprovision.yml | 15 ++++++++----- ansible/seed-vm-provision.yml | 3 ++- .../configuration/reference/physical-network.rst | 11 ++++------ etc/kayobe/infra-vms.yml | 6 ++++++ etc/kayobe/seed-vm.yml | 6 ++++++ kayobe/plugins/action/kolla_ansible_host_vars.py | 4 ---- .../plugins/action/test_kolla_ansible_host_vars.py | 20 ----------------- playbooks/kayobe-seed-vm-base/overrides.yml.j2 | 7 ++++++ .../notes/bug-2058365-a9acdb3cdf2a29f9.yaml | 7 ++++++ ...systemd-networkd-enabling-10bf4e5f0903c311.yaml | 6 ++++++ ...-infra-vm-boot-fw-machine-096251c45653f98c.yaml | 8 +++++++ requirements.yml | 6 +++--- zuul.d/jobs.yaml | 25 ++++++++++++++++++++++ zuul.d/project.yaml | 3 +++ 21 files changed, 105 insertions(+), 69 deletions(-)

1 0

kayobe 14.7.0 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are tickled pink to announce the release of: kayobe 14.7.0: Deployment of OpenStack to bare metal using OpenStack kolla and bifrost This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/kayobe Download the package from: https://tarballs.openstack.org/kayobe/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/kayobe For more details, please see below. 14.7.0 ^^^^^^ New Features ************ * Adds support for specifying "boot_firmware" and "machine" variables to seed and infra VMs. This can be used to launch VMs in UEFI boot mode with Q35 machine type. * Bumps stackhpc.libvirt-vm Ansible role to "v1.16.1". Bug Fixes ********* * "eos_config" does not support the "provider" parameter since Ansible 7. Users are required to update their configuration according to Arista EOS documentation (https://docs.openstack.org/kayobe/latest/configuration/reference /physical-network.html#arista-eos). * Fixes a bug where systemd-networkd was not permanently enabled when the unit was already in state "runtime-enabled". LP#2073100 Changes in kayobe 14.6.0..14.7.0 -------------------------------- afacd339 arista-switch: Fix eos_config call ace210f9 seed-vm/infra-vms: Add support for EFI and q35 07047917 Bump stackhpc.systemd_networkd role to v1.0.6 ff60f19a Stop replacing dashes with underscores for Kolla interfaces Diffstat (except docs and test files) ------------------------------------- ansible/inventory/group_vars/all/infra-vms | 6 ++++++ ansible/inventory/group_vars/all/seed-vm | 6 ++++++ ansible/inventory/group_vars/all/switches/arista | 22 ------------------- ansible/roles/arista-switch/tasks/main.yml | 4 +--- ansible/roles/infra-vms/tasks/deploy.yml | 2 ++ ansible/roles/infra-vms/tasks/destroy.yml | 1 + ansible/seed-vm-deprovision.yml | 15 ++++++++----- ansible/seed-vm-provision.yml | 3 ++- .../configuration/reference/physical-network.rst | 11 ++++------ etc/kayobe/infra-vms.yml | 6 ++++++ etc/kayobe/seed-vm.yml | 6 ++++++ kayobe/plugins/action/kolla_ansible_host_vars.py | 4 ---- .../plugins/action/test_kolla_ansible_host_vars.py | 20 ----------------- playbooks/kayobe-seed-vm-base/overrides.yml.j2 | 7 ++++++ .../notes/bug-2058365-a9acdb3cdf2a29f9.yaml | 7 ++++++ ...systemd-networkd-enabling-10bf4e5f0903c311.yaml | 6 ++++++ ...-infra-vm-boot-fw-machine-096251c45653f98c.yaml | 8 +++++++ requirements.yml | 6 +++--- zuul.d/jobs.yaml | 25 ++++++++++++++++++++++ zuul.d/project.yaml | 2 ++ 20 files changed, 102 insertions(+), 65 deletions(-)

1 0

kolla-ansible 16.7.0 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We exuberantly announce the release of: kolla-ansible 16.7.0: Ansible Deployment of Kolla containers This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/kolla-ansible Download the package from: https://tarballs.openstack.org/kolla-ansible/ Please report issues through: https://bugs.launchpad.net/kolla-ansible/+bugs For more details, please see below. 16.7.0 ^^^^^^ New Features ************ * Modifies public API firewalld rules to be applied immediately to a running firewalld service. This requires firewalld to be running, but avoids reloading firewalld, which is disruptive due to the way in which firewalld builds its firewall chains. * Added a command to upgrade to a target version of RabbitMQ. This is required before a SLURP upgrade. See the docs for more details: https://docs.openstack.org/kolla-ansible/latest/reference/message- queues/rabbitmq.html#slurp Bug Fixes ********* * Fixes an deploy opensearch with enable TLS on the internal VIP. * Fixes handling of openvswitch on "manila-share" nodes. LP#1993285 * Fixes behaviour of Change Password screen in Horizon until bug #2073639 is resolved. LP#2073159 * Fixes the Python requests library issue when using custom CA by adding the REQUESTS_CA environment variable to the kolla-toolbox container. See LP#1967132 * Fixes configuration of CloudKitty when internal TLS is enabled. LP#1998831 * Fixes the dimensions comparison when we set values like *1g* in the container dimensions configuration, making the docker container getting restarted even with no changes, as we are comparing *1g* with *1073741824*, which is displayed in the docker inspect while *1g* is in the configuration. * Fixes the detection of the Nova Compute Ironic service when a custom *host* option is set in the service config file. See LP#2056571 * Removes the default */tmp/* mountpoint from the horizon container. This change is made to harden the container and prevent potential security issues. For more information, see the Bug Report: LP#2068126. * Fixes an issue where OVN northbound or southbound database deployment could fail when a new leader is elected. LP#2059124 Changes in kolla-ansible 16.6.0..16.7.0 --------------------------------------- 13918ee58 Apply public firewalld rules immediately 36ca3b0d1 Add REQUESTS_CA_BUNDLE to kolla-toolbox container 4b6508724 hardening horizon: don't mount hosts /tmp dfd4eef81 Add command to upgrade to a target version of RMQ 14a21976a Fix issue with Swift Recon middleware 6d94a5017 Fix post-config of OVS for manila-share servers eced788ab Work around OVN DB leader election race condition 558f6c298 Restart OVS container after hw-offload change e8aa5d212 Add /v3 suffix to OPENSTACK_KEYSTONE_URL 97bcdedda fix flake8 error in database_shards.py c2693987a Support custom Nova Compute Ironic host names b40fabc6e Support CloudKitty deployment with internal TLS 58683d056 Fix the docker container dimensions comparison for short notation 73415f862 Add ca_path for module uri in opensearch role Diffstat (except docs and test files) ------------------------------------- ansible/module_utils/kolla_container_worker.py | 79 ++++++++++++++++++++-- ansible/rabbitmq-upgrade.yml | 21 ++++++ ansible/roles/cloudkitty/defaults/main.yml | 8 +-- ansible/roles/cloudkitty/tasks/bootstrap.yml | 3 + ansible/roles/common/defaults/main.yml | 1 + ansible/roles/haproxy-config/tasks/main.yml | 7 +- ansible/roles/horizon/defaults/main.yml | 1 - ansible/roles/horizon/templates/local_settings.j2 | 3 +- ansible/roles/loadbalancer/handlers/main.yml | 6 -- .../nova-cell/tasks/wait_discover_computes.yml | 2 +- ansible/roles/nova-cell/templates/nova.conf.j2 | 2 +- ansible/roles/opensearch/handlers/main.yml | 2 + ansible/roles/opensearch/tasks/post-config.yml | 4 ++ ansible/roles/openvswitch/tasks/post-config.yml | 4 ++ ansible/roles/ovn-db/defaults/main.yml | 2 + ansible/roles/ovn-db/tasks/bootstrap-db.yml | 10 +++ ansible/roles/rabbitmq/defaults/main.yml | 2 + ansible/roles/swift/tasks/start.yml | 2 + kolla_ansible/database_shards.py | 4 +- .../notes/add-opensearch-uri-68a657c55ce9c9f1.yaml | 4 ++ .../notes/bug-1993285-127fe764e461465a.yaml | 5 ++ .../notes/bug-2073159-c54c773c72c8fb11.yaml | 6 ++ .../notes/bug-923105-d451a78930973a82.yaml | 7 ++ .../cloudkitty-internal-tls-c3e18be2a9f95c5d.yaml | 5 ++ .../firewalld-immediate-c2abf09977c455a9.yaml | 7 ++ ...ges-when-using-dimensions-ad94b657b6c29cfc.yaml | 10 +++ ...ompute-ironic-host-option-a7a3f6ae095f5201.yaml | 6 ++ .../harden_horizon_tmp_usage-0d690e49645b99a8.yaml | 6 ++ ...mq-target-upgrade-command-d5f9d9fc27fa28f8.yaml | 6 ++ ...round-ovn-leader-election-f7f75e93e9300d96.yaml | 6 ++ tools/kolla-ansible | 8 +++ 34 files changed, 372 insertions(+), 25 deletions(-)

1 0

barbican 16.0.1 (antelope)
by no-reply＠openstack.org 12 Sep '24

12 Sep '24

We are chuffed to announce the release of: barbican 16.0.1: OpenStack Secure Key Management This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/barbican Download the package from: https://tarballs.openstack.org/barbican/ Please report issues through: https://bugs.launchpad.net/barbican/+bugs For more details, please see below. 16.0.1 ^^^^^^ Security Issues * System scope has been removed from the RBAC policies as specified in the Consistent and Secure Default RBAC community goal. See: https://governance.openstack.org/tc/goals/selected/consistent-and- secure-rbac.html APIs that required system scoped tokens can now be accessed by using a project scoped token with the "admin" role. Changes in barbican 16.0.0..16.0.1 ---------------------------------- 9c8fb8c3 Update secret:delete policy to allow admin to delete secret 2f3df026 Remove System scope from policy b38b2139 Fix functional tests e2bd3b95 Stable-only: Remove TripleO job b5c2f838 Update TOX_CONSTRAINTS_FILE for stable/2023.1 441f7d47 Update .gitreview for stable/2023.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 10 ++------ barbican/common/policies/base.py | 7 ------ barbican/common/policies/consumers.py | 28 +++++++++++----------- barbican/common/policies/quotas.py | 12 +++++----- barbican/common/policies/secrets.py | 6 +++-- barbican/common/policies/secretstores.py | 8 +++---- barbican/common/policies/transportkeys.py | 12 +++++----- ...-system-scope-from-policy-f2f68c42c0742812.yaml | 8 +++++++ tox.ini | 12 ++++++---- 10 files changed, 53 insertions(+), 51 deletions(-)

1 0