- Release-announce - lists.openstack.org

glance-tempest-plugin 0.10.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are pleased to announce the release of: glance-tempest-plugin 0.10.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/glance-tempest-plugin Download the package from: https://tarballs.openstack.org/glance-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/glance/+bugs For more details, please see below. Changes in glance-tempest-plugin zed-last..0.10.0 ------------------------------------------------- e94d4cf Update CI testing configuration Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-)

1 0

cinder-tempest-plugin 1.15.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are gleeful to announce the release of: cinder-tempest-plugin 1.15.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/cinder-tempest-plugin Download the package from: https://tarballs.openstack.org/cinder-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. Changes in cinder-tempest-plugin 1.14.0..1.15.0 ----------------------------------------------- 7329a20 Multiattach: Fix implicit requirement for encryption support 1aa0a56 Skip image format detection tests for compute 68347e7 Conditionallly skip manage snapshot tests 2480d48 Drop centos 8 stream jobs 1c6b23d Replace use of deprecated devstack option edd1933 Bump hacking to 6.1.0 b4ab5d6 Remove unused babel.cfg Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 17 +++++++--------- babel.cfg | 2 -- cinder_tempest_plugin/rbac/v3/test_snapshots.py | 12 +++++++++++ .../scenario/test_volume_multiattach.py | 23 ++++++++++++++-------- test-requirements.txt | 2 +- 5 files changed, 35 insertions(+), 21 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 905ad51..cb279bc 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking>=3.0.1,<3.1 # Apache-2.0 +hacking>=6.1.0,<7.0 # Apache-2.0

1 0

octavia-tempest-plugin 2.8.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are happy to announce the release of: octavia-tempest-plugin 2.8.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/octavia-tempest-plugin Download the package from: https://tarballs.openstack.org/octavia-tempest-plugin/ Please report issues through: https://storyboard.openstack.org/#!/project/908 For more details, please see below. 2.8.0 ^^^^^ Other Notes * When using the "keystone_default_roles" RBAC tests, the "load- balancer_*" roles are no longer used by tempest, it relies only on the keystone "admin", "member", "reader" roles. The "[load_balancer].member_role", "[load_balancer].admin_role", "[load_balancer].observer_role" and "[load_balancer].global_observer_role" settings are ignored. Changes in octavia-tempest-plugin zed-last..2.8.0 ------------------------------------------------- 0dbd292 Updates of jobs config for 2024.2 cba3b22 Use only keystone roles in keystone RBAC tests c4eb494 Add stable/2024.1 jobs on master gate 1e90ece Add backup member tests 946527e Add testing jobs for Rocky Linux Diffstat (except docs and test files) ------------------------------------- octavia_tempest_plugin/common/constants.py | 2 + ...one-default-roles-changes-10733c184f0eebc3.yaml | 9 ++ zuul.d/jobs.yaml | 139 ++++++++++------- zuul.d/projects.yaml | 14 ++ 7 files changed, 454 insertions(+), 70 deletions(-)

1 0

ironic-tempest-plugin 2.11.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are delighted to announce the release of: ironic-tempest-plugin 2.11.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-tempest-plugin Download the package from: https://tarballs.openstack.org/ironic-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. Changes in ironic-tempest-plugin zed-last..2.11.0 ------------------------------------------------- f51e00f The adoption test should not depend on the iscsi deploy cf168b8 Add tempest tests for runbooks 540ab0c CI: scale back the number of inspector and scope enforced jobs 7faed25 Work around missing microversion headers on / b294d96 A simple standalone test for in-band inspection feb584a reboot the node in basic ops tests a41979e Exclude ramdisk tests with tinycore in uefi mode 332dacd Handle invalid configuration for vif test execution 5fdaffe Patch to enforce json extension works in existing API behaviour 19d1006 Additional test state fixes 56b1631 Vmedia advanced ops: Clarify config drive and don't ping after rebuild Diffstat (except docs and test files) ------------------------------------- ironic_tempest_plugin/config.py | 9 +- ironic_tempest_plugin/services/baremetal/base.py | 19 +- .../services/baremetal/v1/json/baremetal_client.py | 97 ++++-- .../scenario/ironic_standalone/test_adoption.py | 2 +- .../ironic_standalone/test_advanced_ops.py | 5 +- .../ironic_standalone/test_inspection_basic.py | 56 +++- .../scenario/test_baremetal_boot_from_volume.py | 3 + zuul.d/project.yaml | 33 +- zuul.d/stable-jobs.yaml | 288 ----------------- 20 files changed, 1098 insertions(+), 426 deletions(-)

1 0

venus-tempest-plugin 3.3.0 (dalmatian)
by no-reply＠openstack.org 23 Sep '24

23 Sep '24

We are ecstatic to announce the release of: venus-tempest-plugin 3.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/venus-tempest-plugin Download the package from: https://tarballs.openstack.org/venus-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/openstack-venus/+bugs For more details, please see below. Changes in venus-tempest-plugin 3.1.0..3.3.0 -------------------------------------------- b6eb963 add venus api testcase for list api versions Diffstat (except docs and test files) ------------------------------------- venus_tempest_plugin/services/venus_rest_client.py | 5 ++++ 2 files changed, 35 insertions(+)

1 0

ironic-inspector 12.3.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We exuberantly announce the release of: ironic-inspector 12.3.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-inspector Download the package from: https://tarballs.openstack.org/ironic-inspector/ Please report issues through: https://bugs.launchpad.net/ironic-inspector/+bugs For more details, please see below. 12.3.0 ^^^^^^ Deprecation Notes ***************** * This project is now in the maintenance mode and new deployments of it are discouraged. Please use built-in in-band inspection in ironic (https://docs.openstack.org/ironic/latest/admin/inspection/index.ht ml) instead. For existing deployments, see the migration guide (htt ps://docs.openstack.org/ironic/latest/admin/inspection/migration.ht ml). Bug Fixes ********* * No longer throws an exception if an address of some node cannot be resolved, but just logs a warning instead. This fixes the issue that if an address of any other node is not resolvable, no new node can be registered, even if its own address is resolvable. * Fixes memory leak with openstacksdk 2.0 and newer. This version requires connections to be explicitly closed, otherwise they stay in memory forever. Changes in ironic-inspector 12.2.0..12.3.0 ------------------------------------------ 2318bf7 Fix: ignore resolve error while looking up node a031db7 Imported Translations from Zanata 80c6cfa Drop SQLALCHEMY_WARN_20 54242ba Try enabling port 5050 on PUBLIC_BRIDGE 751c199 Fix versions in release notes e3e23b6 Link to configuration options 4324871 Imported Translations from Zanata d897a4d Don't fail if data already migrated 2084ae1 Imported Translations from Zanata e96ee4b Deprecate the project 48a3bf6 Cache openstacksdk Connections to avoid leaking memory c11113d Follow up to broken Zuul config 2d909b4 Excise use of non-timezone aware utcnow() Diffstat (except docs and test files) ------------------------------------- README.rst | 7 + api-ref/source/index.rst | 5 + devstack/plugin.sh | 2 + ironic_inspector/cmd/migration.py | 20 +- ironic_inspector/common/ironic.py | 39 ++-- ironic_inspector/process.py | 3 +- ironic_inspector/test/unit/db/test_migrations.py | 3 +- ironic_inspector/test/unit/test_common_ironic.py | 16 +- .../test/unit/test_dnsmasq_pxe_filter.py | 3 +- ironic_inspector/test/unit/test_node_cache.py | 28 +-- releasenotes/notes/deprecate-d23ae14b5bd3779e.yaml | 8 + .../ignore-resolve-error-5c20514598e0dbbf.yaml | 7 + .../notes/sdk-2-leak-500f3669afb6713e.yaml | 5 + releasenotes/source/2023.1.rst | 2 +- releasenotes/source/2023.2.rst | 6 +- releasenotes/source/2024.1.rst | 6 +- .../locale/en_GB/LC_MESSAGES/releasenotes.po | 235 ++++++++++++++++++++- releasenotes/source/zed.rst | 2 +- tox.ini | 1 - zuul.d/ironic-inspector-jobs.yaml | 12 -- 21 files changed, 346 insertions(+), 73 deletions(-)

1 0

ironic 26.1.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We are jazzed to announce the release of: ironic 26.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 26.1.0 ^^^^^^ Prelude ******* The Ironic project is pleased to announce the release Ironic 26.1, also known as the "2024.2" or "Dalmatian" release. This release adds functionality to enable the creation and use of "runbooks" of repeated steps in "cleaning" and "service" states. Furthermore, cloud admins are now able to "lease" baremetal nodes to Nova users automatically through the use of metadata provided by Nova. Firmware updates have improved capability and ease-of-use on BMCs which manage multiple hosts. Also users of the "redfish" hardware type can now invoke firmware updates as a "service" step. Operators seeking to migrate away from BIOS booting now have additional options to help enforce migration mandates. Coupled with numerous bug fixes and other minor enhancements, this release of Ironic will improve the life of operators for years to come. We hope you enjoy! New Features ************ * Adds a new API concept, runbooks, to enable self-service of maintenance items on nodes by project members. Runbooks are curated lists of steps that can be run on nodes only associated via traits and used in lieu of an explicit list of steps for manual cleaning or servicing. * Adds a new top-level REST API endpoint */v1/runbooks/* with basic CRUD support. * Extends the */v1/nodes/<node>/states/provision* API to accept a runbook ident (name or UUID) instead of *clean_steps* or *service_steps* for servicing or manual cleaning. * Implements RBAC-aware lifecycle management for runbooks, allowing projects to limit who can CRUD and use a runbook. * Ironic now supports automatically setting node.lessee at deployment time using metadata provided at deploy time, typically by OpenStack Nova. When "[conductor]/automatic_lessee_source" is set to "instance", Ironic will set the lessee field on the node and remove it before cleaning. * Adds a new capability allowing to fetch the list of virtual media devices attached to a node by making a GET request. * Make the "idrac" hardware type inherit from the "redfish" hardware type since the "idrac" hardware type is an extension of the "redfish" with Dell specific overrides. This will ensure that features available to the "redfish" hardware type will always be available to "idrac". Added "redfish" interface as available for the "bios", "power" and "vendor" interfaces of the "idrac" hardware type. Upgrade Notes ************* * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "ironic-python-agent" ramdisks will also need to be upgraded. * When upgrading Ironic to address the "qemu-img" image conversion security issues, the "[conductor]conductor_always_validates_images" setting may be set to "True" as a short term remedy while "ironic- python-agent" ramdisks are being updated. Alternatively it may be advisable to also set the "[agent]image_download_source" setting to "local" to minimize redundant network data transfers. * As a result of security fixes to address "qemu-img" image conversion security issues, a new configuration parameter has been added to Ironic, "[conductor]permitted_image_formats" with a default value of "raw,qcow2,iso". Raw and qcow2 format disk images are the image formats the Ironic community has consistently stated as what is supported and expected for use with Ironic. These formats also match the formats which the Ironic community tests. Operators who leverage other disk image formats, may need to modify this setting further. * "[conductor]/automatic_lessee" has been deprecated in favor of "[conductor]/automatic_lessee_source". Standalone Ironic deployments previously setting "automatic_lessee" to "True" now may want to set "automatic_lessee_source" to "request" to retain existing behavior. Deployers explicitly setting "automatic_lessee" to false may want to set "automatic_lessee_source" to "none" to retain existing behavior. The old configuration option, when explicitly set, will be honored until fully removed. * Ironic will now automatically set the node.lessee field for all deployments by default when provided in node instance_info at deployment time. Deployers are encouraged to review their security settings and Ironic Secure RBAC documentation to ensure no unexpected access is granted. * Ironic now requires rescue passwords to be hashed. Operators who would like to continue using unhashed passwords must set *[conductor]/require_rescue_password_hashed* to "false". Deprecation Notes ***************** * The "[[agent]]manage_agent_boot" configuration directive is being deprecated. It is completely untested, and requires operators to manually configure significant parts of infrastructure typically handled by Ironic. Operators using this configuration are advised to migrate away from it before it's scheduled removal during the 2025.2 cycle releases, coming out late 2025. * Deprecates the "idrac-redfish" interfaces in favor of the "redfish" interfaces for the "bios", "power", and "vendor" interfaces. This is a no-op change as these interfaces wrapped the "redfish" interface with no change already. Security Issues *************** * Ironic now checks the supplied image format value against the detected format of the image file, and will prevent deployments should the values mismatch. If being used with Glance and a mismatch in metadata is identified, it will require images to be re-uploaded with a new image ID to represent corrected metadata. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic *always* inspects the supplied user image content for safety prior to deployment of a node should the image pass through the conductor, even if the image is supplied in "raw" format. This is utilized to identify the format of the image and the overall safety of the image, such that source images with unknown or unsafe feature usage are explicitly rejected. This can be disabled by setting "[conductor]disable_deep_image_inspection" to "True". This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic can also inspect images which would normally be provided as a URL for direct download by the "ironic-python-agent" ramdisk. This is not enabled by default as it will increase the overall network traffic and disk space utilization of the conductor. This level of inspection can be enabled by setting "[conductor]conductor_always_validates_images" to "True". Once the "ironic-python-agent" ramdisk has been updated, it will perform similar image security checks independently, should an image conversion be required. This is the result of CVE-2024-44082 tracked as bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Ironic now explicitly enforces a list of permitted image types for deployment via the "[conductor]permitted_image_formats" setting, which defaults to "raw", "qcow2", and "iso". While the project has classically always declared permissible images as "qcow2" and "raw", it was previously possible to supply other image formats known to "qemu-img", and the utility would attempt to convert the images. The "iso" support is required for "boot from ISO" ramdisk support. * Ironic now explicitly passes the source input format to executions of "qemu-img" to limit the permitted qemu disk image drivers which may evaluate an image to prevent any mismatched format attacks against "qemu-img". * The "ansible" deploy interface example playbooks now supply an input format to execution of "qemu-img". If you are using customized playbooks, please add "-f {{ ironic.image.disk_format }}" to your invocations of "qemu-img". If you do not do so, "qemu-img" will automatically try and guess which can lead to known security issues with the incorrect source format driver. * Operators who have implemented any custom deployment drivers or additional functionality like machine snapshot, should review their downstream code to ensure they are properly invoking "qemu-img". If there are any questions or concerns, please reach out to the Ironic project developers. * Operators are reminded that they should utilize cleaning in their environments. Disabling any security features such as cleaning or image inspection are at **your** **own** **risk**. Should you have any issues with security related features, please don't hesitate to open a bug with the project. * The "[conductor]disable_deep_image_inspection" setting is conveyed to the "ironic-python-agent" ramdisks automatically, and will prevent those operating ramdisks from performing deep inspection of images before they are written. * The "[conductor]permitted_image_formats" setting is conveyed to the "ironic-python-agent" ramdisks automatically. Should a need arise to explicitly permit an additional format, that should take place in the Ironic service configuration. Bug Fixes ********* * Adds microversion headers to the root ('/') endpoint. * Fixes multiple issues in the handling of images as it relates to the execution of the "qemu-img" utility, which is used for image format conversion, where a malicious user could craft a disk image to potentially extract information from an "ironic-conductor" process's operating environment. Ironic now explicitly enforces a list of approved image formats as a "[conductor]permitted_image_formats" list, which mirrors the image formats the Ironic project has historically tested and expressed as known working. Testing is not based upon file extension, but upon content fingerprinting of the disk image files. This is tracked as CVE-2024-44082 via bug 2071740 (https://bugs.launchpad.net/ironic/+bug/2071740) * Fixes inspection failure when "bmc_address" or "bmc_v6address" is "null" in the inventory received from the ramdisk. * The network_data fetched from Neutron contained 'links', 'networks' but was missing 'services'. This patch brings in 'services' to include dns nameservers that can be configured by Glean or cloud- init during cleaning and provisioning operations, especially when virtual media boot is used without DHCP. * Set node "alive" and make it fast trackable as soon as inspection is finished, in addition add a wait for the agent to callback should it not be available when fast track is attempted. * Replaces *ari/aki* format references with appropriate artifacts for kernel and ramdisk in the documentation and Ironic DevStack plugin. * Update "kernel_append_params" to match the "[pxe]" configuration, addressing a TODO from the Xena release. Other Notes *********** * Removes support for pre-SQLAlchemy 2.0 query objects from the internal database API. Downstream plug-ins must be adjusted to use the new-style queries. Changes in ironic 26.0.0..26.1.0 -------------------------------- 5857ca0cd Update release mappings f082c24d2 Add Prelude for end of cycle release eb27c6e21 Drop SQLALCHEMY_WARN_20 a8c3beaca Bring back the metal3-integration job b19507d64 Add microversion headers to root ('/') endpoint 1c201f094 Make sure qemu-img command is available in debian/suse 771cee464 Drop description for ZeroMQ d44a65883 Remove legacy Query support from _paginate_query 4fea3575c Fix inspection if bmc_address or bmc_v6address is None 510f87a03 Try limiting MTU to at least 1280 3f6507d85 Remove default override for RBAC config options 94fcae5e1 CI: Remove scope enforced ci jobs c996aafa6 CVE-2024-44982: Harden all image handling and conversion code b07ebc412 Set node "alive" when inspection finished e01522cd4 Imported Translations from Zanata 40e100387 Remove skip check for Python 3.6 0eda3d65e Support Automatic Lessee from instance metadata 42bd2a069 Use the correct command to fetch ovs state 52fdbb743 idrac: inherit driver interface from redfish 72c792bb2 Temporarily disable PXE booting test in the standalone job aaec00275 Replace reference to ari/aki 1aa780377 Deduplicate and remove invalid information for steps df39b7874 Fix versions in release notes 11dfe23cf Update network_data.json to include dns nameservers 8e6b758bf Clarify how to configure for non-master branch e3d6b644f Enable the inspection test in the redfish standalone job 17ba2b3db docs-audit-2024: Labeling references 018a7dcae Better handle missing inspection_network 2a6abc810 [docs] Add procedure to EoL and delete old bugfix branch c316443c9 Some documentaion improvements for ironic docs 040924ee6 Add unit test to ensure full node object is not logged a885a0544 Update configuration value in iRMC 754cf3f58 Fix conductor startup warning message ba096e091 Follow up to the runbooks change (#922142) a9a6ec7b3 Update error message 582b2e991 Link to configuration options 23b61e2ba Fix error message not interpolated 3f34f04bf [CI] Fix job parent name c9cf2347e add virtual media GET api 4750c4e9f docs-audit-2024: Use gerunds for task headings db7e4deff DevStack: enable the new in-band inspection by default 48f50248c Self-Service via Runbooks 816a7dfe8 Remove ironic-inspector from bugfix branches bfdfd6c16 [devstack] Ensure downgrade_dnsmasq is idempotent 631f50d21 CI: set tftp folder permission d146558ac Require hashed passwords for rescue by default 465bedbe7 Deprecate [agent]/manage_agent_boot 223a70043 Test devstack OSCaas against all Ironic jobs Diffstat (except docs and test files) ------------------------------------- api-ref/source/baremetal-api-v1-get-vmedia.inc | 21 + .../source/baremetal-api-v1-node-management.inc | 18 + api-ref/source/baremetal-api-v1-runbooks.inc | 245 +++++ api-ref/source/index.rst | 1 + api-ref/source/parameters.yaml | 67 ++ .../source/samples/node-set-provision-state.json | 4 + api-ref/source/samples/node-set-service-state.json | 12 + api-ref/source/samples/runbook-create-request.json | 19 + .../source/samples/runbook-create-response.json | 34 + .../source/samples/runbook-detail-response.json | 39 + api-ref/source/samples/runbook-list-response.json | 18 + api-ref/source/samples/runbook-show-response.json | 35 + api-ref/source/samples/runbook-update-request.json | 7 + .../source/samples/runbook-update-response.json | 34 + bindep.txt | 4 +- devstack/lib/ironic | 58 +- devstack/settings | 11 +- ironic/api/controllers/root.py | 2 + ironic/api/controllers/v1/__init__.py | 9 +- ironic/api/controllers/v1/deploy_template.py | 38 +- ironic/api/controllers/v1/node.py | 90 +- ironic/api/controllers/v1/notification_utils.py | 3 + ironic/api/controllers/v1/ramdisk.py | 6 +- ironic/api/controllers/v1/runbook.py | 391 +++++++ ironic/api/controllers/v1/utils.py | 142 +++ ironic/api/controllers/v1/versions.py | 6 +- ironic/cmd/conductor.py | 2 +- ironic/common/exception.py | 20 + ironic/common/image_format_inspector.py | 1038 ++++++++++++++++++ ironic/common/images.py | 152 ++- ironic/common/lessee_sources.py | 28 + ironic/common/neutron.py | 17 +- ironic/common/policy.py | 145 ++- ironic/common/qemu_img.py | 89 ++ ironic/common/release_mappings.py | 75 +- ironic/conductor/cleaning.py | 6 + ironic/conductor/deployments.py | 100 +- ironic/conductor/manager.py | 27 +- ironic/conductor/rpcapi.py | 21 +- ironic/conductor/utils.py | 21 +- ironic/conf/__init__.py | 2 + ironic/conf/agent.py | 3 +- ironic/conf/conductor.py | 84 +- ironic/conf/default.py | 4 +- ironic/conf/disk_utils.py | 33 + ironic/conf/irmc.py | 3 +- ironic/conf/opts.py | 1 + ironic/db/api.py | 95 ++ .../66bd9c5604d5_add_runbook_and_runbook_step.py | 70 ++ ironic/db/sqlalchemy/api.py | 271 ++++- ironic/db/sqlalchemy/models.py | 45 + ironic/drivers/base.py | 10 + ironic/drivers/drac.py | 45 +- .../playbooks/roles/deploy/tasks/write.yaml | 2 +- ironic/drivers/modules/deploy_utils.py | 202 +++- ironic/drivers/modules/drac/bios.py | 2 + ironic/drivers/modules/drac/power.py | 3 +- ironic/drivers/modules/drac/vendor_passthru.py | 2 + ironic/drivers/modules/image_cache.py | 71 +- ironic/drivers/modules/pxe_base.py | 5 +- ironic/drivers/modules/redfish/boot.py | 82 ++ ironic/drivers/modules/redfish/inspect.py | 2 +- ironic/drivers/modules/redfish/management.py | 12 + ironic/drivers/modules/storage/external.py | 6 +- ironic/objects/__init__.py | 1 + ironic/objects/runbook.py | 252 +++++ .../common/json_samples/neutron_subnet_show.json | 2 +- .../json_samples/neutron_subnet_show_ipv6.json | 2 +- .../drivers/modules/redfish/test_management.py | 6 + .../unit/drivers/modules/test_deploy_utils.py | 515 ++++++++- playbooks/ci-workarounds/get_extra_logging.yaml | 5 +- .../notes/2024.2-prelude-66649e7ee0781484.yaml | 15 + ...-headers-to-root-endpoint-199cb910a7aa53f9.yaml | 4 + .../notes/add-runbooks-38c3efa97ace8c67.yaml | 19 + .../address-qemu-issues-1bbead8bb70b76fb.yaml | 108 ++ .../automatic-lessee-source-37abe917b8cb5c36.yaml | 24 + .../notes/bmc-address-none-8214a3f7b67d6a0d.yaml | 5 + ...precate-manage-agent-boot-8474287a11b485cc.yaml | 9 + ...work-data-dns-nameservers-f363b3a66c109b4d.yaml | 9 + ...generic-virtual-media-get-f09003e5031b9c3d.yaml | 5 + .../idrac-extends-redfish-6692c2ecdb07dc2e.yaml | 15 + ...re-hashed-rescue-password-6f7c0424e12c1aeb.yaml | 5 + ...-when-inspection-finished-1ec74828852eaeef.yaml | 7 + .../notes/sqla-query-d5347ae962b06428.yaml | 6 + ...isk-artifacts-delineation-15a7d652d34b196f.yaml | 5 + ...of-a-configuration-option-91708f3366afd4c6.yaml | 5 + releasenotes/source/2023.2.rst | 2 +- releasenotes/source/2024.1.rst | 6 +- releasenotes/source/icehouse.rst | 6 +- .../locale/en_GB/LC_MESSAGES/releasenotes.po | 65 +- requirements.txt | 2 +- tox.ini | 2 - zuul.d/ironic-jobs.yaml | 7 +- zuul.d/project.yaml | 7 - 156 files changed, 9052 insertions(+), 628 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7773d6e40..25f9d4c49 100644 --- a/requirements.txt +++ b/requirements.txt @@ -22 +22 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.policy>=3.7.0 # Apache-2.0 +oslo.policy>=4.4.0 # Apache-2.0

1 0

bifrost 19.1.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We joyfully announce the release of: bifrost 19.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/bifrost Download the package from: https://tarballs.openstack.org/bifrost/ Please report issues through: https://bugs.launchpad.net/bifrost/+bugs For more details, please see below. 19.1.0 ^^^^^^ Upgrade Notes * When creating a virtual testing environment on newer distributions such as Ubuntu 24.04, UEFI firmware with 4M flash storage will be used. Existing virtual machines may need to be migrated if they were created on an older distribution. Changes in bifrost 19.0.0..19.1.0 --------------------------------- 46e23a1c Support OVMF with 4M flash storage 20835d20 Fix missed occurrence of SETUPTOOLS_USE_DISTUTILS ddd266fd Restart systemd services on failure Diffstat (except docs and test files) ------------------------------------- playbooks/roles/bifrost-create-vm-nodes/defaults/main.yml | 7 +++++++ .../roles/bifrost-ironic-install/templates/systemd_template.j2 | 1 + playbooks/roles/bifrost-pip-install/tasks/main.yml | 4 +--- releasenotes/notes/ovmf-m4-f8e63d8bb824fccb.yaml | 7 +++++++ 4 files changed, 16 insertions(+), 3 deletions(-)

1 0

ironic-python-agent 9.14.0 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

We jubilantly announce the release of: ironic-python-agent 9.14.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent/+bugs For more details, please see below. 9.14.0 ^^^^^^ Upgrade Notes ************* * Deployers implementing their own "HardwareManagers" must to audit their code for unsafe uses of *qemu-img* and related methods. Security Issues *************** * Ironic-Python-Agent now checks any supplied image format value against the detected format of the image file and will prevent deployments should the values mismatch. * Images previously misconfigured as raw despite being in another format, in some non-default configurations, may have been mistakenly converted if needed. Ironic-Python-Agent will no longer perform conversion in any case for images with metadata indicating in raw format. * Ironic-Python-Agent *always* inspects any non-raw user image content for safety before running any qemu-based utilities on the image. This is utilized to identify the format of the image and to verify the overall safety of the image. Any images with unknown or unsafe feature uses are explicitly rejected. This can be disabled in both IPA and Ironic by setting "[conductor]disable_deep_image_inspection" to "True" for the Ironic deployment. Image inspection is the primary mitigation for CVE-2024-44082 being tracked in bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) Operators may desire to set "[conductor]conductor_always_validates_images" on Ironic conductors to mitigate the issue before they have upgraded their Ironic-Python- Agent. * Ironic-Python-Agent now explicitly enforces a list of permitted image types for deployment, defaulting to "raw" and "qcow2". Other image types may work, but are not explicitly supported and must be enabled. This can be modified by setting "[conductor]permitted_image_formats" for all Ironic services. Bug Fixes ********* * Adds a preliminary check for IPMI device files before the BMC detection attempts, optimizing *ipmitool* command calls on systems without IPMI capabilities. * Fixes multiple issues in the handling of images as it related to execution of the "qemu-img" utility. When using this utility to convert an unsafe image, a malicious user can extract information from a node while Ironic-Python-Agent is deploying or converting an image. Ironic-Python-Agent now inspects all non-raw images for safety, and never runs qemu-based utilities on raw images. This fix is tracked as CVE-2024-44082 and bug 2071740 (https://bugs.launchpad.net/ironic-python-agent/+bug/2071740) * Images with metadata indicating a "raw" disk format may have been transparently converted from another format. Now, these images will have their exact contents imaged to disk without modification. Changes in ironic-python-agent 9.13.0..9.14.0 --------------------------------------------- 2d79eae Check for the existence of an IPMI device e303a36 Inspect non-raw images for safety ba5c1bf Remove and disable examples job bd3b596 Fix series in release notes b173ce9 [doc] Clarify Step return values 4cea26f update dynamic-login to mention the sshkey option Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/agent.py | 6 + ironic_python_agent/config.py | 36 +- ironic_python_agent/disk_utils.py | 111 ++- ironic_python_agent/errors.py | 9 + ironic_python_agent/extensions/standby.py | 85 +- ironic_python_agent/format_inspector.py | 1044 ++++++++++++++++++++ ironic_python_agent/hardware.py | 58 +- ironic_python_agent/partition_utils.py | 9 +- ironic_python_agent/qemu_img.py | 153 +++ ironic_python_agent/utils.py | 11 + ...-device-before-invocation-45b00d15c94edd00.yaml | 6 + .../notes/image-security-5c23b890409101c9.yaml | 48 + releasenotes/source/2023.1.rst | 2 +- releasenotes/source/2023.2.rst | 2 +- releasenotes/source/2024.1.rst | 2 +- releasenotes/source/zed.rst | 2 +- zuul.d/ironic-python-agent-jobs.yaml | 17 +- zuul.d/project.yaml | 2 - 27 files changed, 2952 insertions(+), 201 deletions(-)

1 0

nova 30.0.0.0rc1 (dalmatian)
by no-reply＠openstack.org 20 Sep '24

20 Sep '24

Hello everyone, A new release candidate for nova for the end of the Dalmatian cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/nova/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Dalmatian release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/dalmatian release branch at: https://opendev.org/openstack/nova/src/branch/stable/dalmatian Release notes for nova can be found at: https://docs.openstack.org/releasenotes/nova/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/nova/+bugs and tag it *dalmatian-rc-potential* to bring it to the nova release crew's attention.

1 0