- Release-announce - lists.openstack.org

os-net-config 13.2.0 (victoria)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We are glad to announce the release of: os-net-config 13.2.0: OpenStack network configuration This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/os-net-config Download the package from: https://tarballs.openstack.org/os-net-config/ Please report issues through: https://bugs.launchpad.net/os-net-config/+bugs For more details, please see below. Changes in os-net-config 13.1.0..13.2.0 --------------------------------------- 7ba6fea Updating sriov_config service to run after openibd service f51bf9b Exclude DPDK mapped VF device even if not present 561f593 Check to ensure active DPDK NICs only mapped once 17d2fe4 basic support for Linux tap devices dce4963 Wire up new tripleo upgrades jobs template Diffstat (except docs and test files) ------------------------------------- etc/os-net-config/samples/linux_tap.json | 8 +++++++ etc/os-net-config/samples/linux_tap.yaml | 6 +++++ os_net_config/__init__.py | 11 +++++++++ os_net_config/impl_ifcfg.py | 12 ++++++++++ os_net_config/objects.py | 36 ++++++++++++++++++++++++++++++ os_net_config/schema.yaml | 38 ++++++++++++++++++++++++++++++++ os_net_config/utils.py | 18 +++++++++++---- zuul.d/layout.yaml | 1 + 11 files changed, 181 insertions(+), 4 deletions(-)

1 0

puppet-gnocchi 18.4.0 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We joyfully announce the release of: puppet-gnocchi 18.4.0: Puppet module for OpenStack Gnocchi This release is part of the wallaby stable release series. The source is available from: https://opendev.org/openstack/puppet-gnocchi Download the package from: https://tarballs.openstack.org/puppet-gnocchi/ Please report issues through: https://bugs.launchpad.net/puppet-gnocchi/+bugs For more details, please see below. 18.4.0 ^^^^^^ Upgrade Notes * Now policy.yaml is used by default instead of policy.json. Changes in puppet-gnocchi 18.3.0..18.4.0 ---------------------------------------- 2869e8f Update sphinx to the latest version 61ebf65 Prepare Wallaby RC1 f23b615 metadata.json: debian 11 c5484cf Use yaml instead of json for policy file adbff07 Update supported Ubuntu version to Focal Diffstat (except docs and test files) ------------------------------------- manifests/policy.pp | 24 ++++++++++++++++------ metadata.json | 12 +++++------ ...-format-from-json-to-yaml-790e4f7ef2d7e68c.yaml | 4 ++++ spec/classes/gnocchi_policy_spec.rb | 13 ++++++------ 5 files changed, 36 insertions(+), 19 deletions(-)

1 0

puppet-freezer 18.4.0 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We are happy to announce the release of: puppet-freezer 18.4.0: Puppet module for OpenStack freezer This release is part of the wallaby stable release series. The source is available from: https://opendev.org/openstack/puppet-freezer Download the package from: https://tarballs.openstack.org/puppet-freezer/ Please report issues through: https://bugs.launchpad.net/puppet-freezer/+bugs For more details, please see below. 18.4.0 ^^^^^^ New Features * The new "freezer::policy::enforce_scope" parameter has been added to support the corresponding parameter in oslo.policy library. * The new "freezer::policy::enforce_new_defaults" parameter has been added. Changes in puppet-freezer 7.3.0..18.4.0 --------------------------------------- 2249c4f Update sphinx to the latest version eafaaf3 Prepare Wallaby RC1 ebed1e8 Add support for oslo_policy/enforce_new_defaults 6ca0530 Update supported Ubuntu version to Focal 2569201 Add support for the oslo_policy/enforce_scope parameter 6f16284 Bump requirement of puppetlabs-apache Diffstat (except docs and test files) ------------------------------------- manifests/policy.pp | 23 ++++++++++++++++++---- metadata.json | 12 +++++------ ...oslo_policy-enforce_scope-42e5cf3eb936c51d.yaml | 5 +++++ ...licy-enforce_new_defaults-9bef2067d28758a6.yaml | 5 +++++ spec/classes/freezer_policy_spec.rb | 17 +++++++++------- 6 files changed, 46 insertions(+), 18 deletions(-)

1 0

puppet-tripleo 13.6.0 (victoria)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We exuberantly announce the release of: puppet-tripleo 13.6.0: Puppet module for OpenStack TripleO This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/puppet-tripleo Download the package from: https://tarballs.openstack.org/puppet-tripleo/ Please report issues through: https://bugs.launchpad.net/puppet-tripleo/+bugs For more details, please see below. 13.6.0 ^^^^^^ New Features ************ * Add ability to specify the memcache_security_strategy and memcache_secret_key for keystone authtoken middleware. The keys used by individual services are hashed with a salt (the service name), to isolate them. * Add ability to specify memcached port for all services. The port defaults to hiera('memcached_authtoken_port', 11211) for authtoken middleware and hiera('memcached_port', 11211) for other uses. * Add parameter for setting monitor interval for ovndbs (default is 30s) Bug Fixes ********* * libvirt 6.8.0 introduces virt-ssh-helper which prepends the libvirt ssh command with a "which virt-ssh-helper". libvirt used to first check for *nc* (netcat). But these two libvirt commits[1][2] have now changed it to first look for *virt-ssh-helper*, if it not available, then fall back to *nc*. This trips up the 'nova- migration-wrapper' as it does not support virt-ssh-helper atm. Until this is implemented, this change force to use "netcat" (*nc*) by appending to the migration URI: "&proxy=netcat" [1] https://libvirt.org/git/?p=libvirt.git;a=commit;h=f8ec7c842d (rpc: use new virt-ssh-helper binary for remote tunnelling, 2020-07-08) [2] https://libvirt.org/git/?p=libvirt.git;a=commit;h=7d959c302d (rpc: Fix virt-ssh-helper detection, 2020-10-27) Changes in puppet-tripleo 13.5.0..13.6.0 ---------------------------------------- 856f4d9c Fix memcached restart on cert renewal ca31ff1e Add monitor interval for ovn dbs bf5a4a98 Fix live-migration with libvirt >= 6.8.0 f5e362b5 Replace deprecated zuul template tripleo-standalone-multinode-ipa 1234d164 Handle cinder_mount_point_base for cinder mounting needs f08f2e8e Add authtoken security options 4dca24b6 Add parameters for multipath connection in cinder store 3abadd48 Add ability to specify memcached port 7b00af7d Fix manila-share with ceph-nfs backend 51ff421c Adding key_size option on the certmonger_certificate function 8575c3e2 Wire up new tripleo upgrades jobs template 3e92158b Stop including nova::metadata on computes Diffstat (except docs and test files) ------------------------------------- Puppetfile_extras | 2 +- files/certmonger-memcached-refresh.sh | 6 +++-- manifests/certmonger/ceph_dashboard.pp | 6 +++++ manifests/certmonger/ceph_grafana.pp | 6 +++++ manifests/certmonger/ceph_rgw.pp | 6 +++++ manifests/certmonger/etcd.pp | 6 +++++ manifests/certmonger/haproxy.pp | 6 +++++ manifests/certmonger/httpd.pp | 6 +++++ manifests/certmonger/libvirt.pp | 6 +++++ manifests/certmonger/libvirt_vnc.pp | 6 +++++ manifests/certmonger/memcached.pp | 6 +++++ manifests/certmonger/metrics_qdr.pp | 6 +++++ manifests/certmonger/mysql.pp | 6 +++++ manifests/certmonger/neutron.pp | 6 +++++ manifests/certmonger/neutron_ovn.pp | 6 +++++ manifests/certmonger/novnc_proxy.pp | 5 ++++ manifests/certmonger/openvswitch.pp | 6 +++++ manifests/certmonger/ovn_controller.pp | 6 +++++ manifests/certmonger/ovn_dbs.pp | 6 +++++ manifests/certmonger/ovn_metadata.pp | 6 +++++ manifests/certmonger/ovn_octavia.pp | 6 +++++ manifests/certmonger/qemu.pp | 6 +++++ manifests/certmonger/rabbitmq.pp | 6 +++++ manifests/certmonger/redis.pp | 6 +++++ manifests/profile/base/aodh/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/barbican/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/cinder/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/designate/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/glance/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/glance/backend/cinder.pp | 18 +++++++++++++ manifests/profile/base/gnocchi/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/heat.pp | 9 +++++-- manifests/profile/base/heat/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/ironic/authtoken.pp | 30 +++++++++++++++++++--- .../profile/base/ironic_inspector/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/keystone.pp | 7 ++++- manifests/profile/base/manila/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/mistral/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/neutron/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/nova.pp | 9 +++++-- manifests/profile/base/nova/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/nova/compute.pp | 5 ---- manifests/profile/base/nova/migration/client.pp | 5 +++- manifests/profile/base/novajoin/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/octavia/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/placement/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/base/swift.pp | 6 ++--- manifests/profile/base/swift/proxy.pp | 6 ++--- manifests/profile/base/zaqar/authtoken.pp | 30 +++++++++++++++++++--- manifests/profile/pacemaker/ceph_nfs.pp | 5 +++- manifests/profile/pacemaker/ovn_dbs_bundle.pp | 15 +++++++++-- .../add-memcache-security-92060c4fe540774c.yaml | 7 +++++ .../notes/add-memcached-port-048959c2f58f0a57.yaml | 6 +++++ .../monitor_interval_ovndbs-6af18ba7f4a17cc5.yaml | 4 +++ ...e_live_migration_force_nc-f903a09955164ad9.yaml | 15 +++++++++++ ...pleo_profile_base_glance_backend_cinder_spec.rb | 6 +++++ zuul.d/layout.yaml | 3 ++- 57 files changed, 700 insertions(+), 75 deletions(-)

1 0

puppet-ec2api 18.4.0 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We exuberantly announce the release of: puppet-ec2api 18.4.0: Puppet module for OpenStack Ec2api This release is part of the wallaby stable release series. The source is available from: https://opendev.org/openstack/puppet-ec2api Download the package from: https://tarballs.openstack.org/puppet-ec2api/ Please report issues through: https://bugs.launchpad.net/puppet-ec2api/+bugs For more details, please see below. 18.4.0 ^^^^^^ New Features * The new "ec2api::policy::enforce_scope" parameter has been added to support the corresponding parameter in oslo.policy library. * The new "ec2api::policy::enforce_new_defaults" parameter has been added. Changes in puppet-ec2api 18.3.0..18.4.0 --------------------------------------- 842938e Update sphinx to the latest version d6c0484 Prepare Wallaby RC1 aa9f9c9 Add support for oslo_policy/enforce_new_defaults b476993 Fix a unit test error 3e52369 Update supported Ubuntu version to Focal 5804bbe Add support for the oslo_policy/enforce_scope parameter Diffstat (except docs and test files) ------------------------------------- manifests/policy.pp | 23 ++++++++++++++++++---- metadata.json | 10 +++++----- ...oslo_policy-enforce_scope-34b9b8673911953d.yaml | 5 +++++ ...licy-enforce_new_defaults-45a0a649e3169556.yaml | 5 +++++ spec/classes/ec2api_api_spec.rb | 4 +++- spec/classes/ec2api_init_spec.rb | 4 +++- spec/classes/ec2api_metadata_spec.rb | 4 +++- spec/classes/ec2api_policy_spec.rb | 17 +++++++++------- 9 files changed, 54 insertions(+), 20 deletions(-)

1 0

puppet-designate 18.4.0 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We are thrilled to announce the release of: puppet-designate 18.4.0: Puppet module for OpenStack Designate This release is part of the wallaby stable release series. The source is available from: https://opendev.org/openstack/puppet-designate Download the package from: https://tarballs.openstack.org/puppet-designate/ Please report issues through: https://bugs.launchpad.net/puppet-designate/+bugs For more details, please see below. 18.4.0 ^^^^^^ New Features ************ * The new "designate::policy::enforce_scope" parameter has been added to support the corresponding parameter in oslo.policy library. * The new "designate::policy::enforce_new_defaults" parameter has been added. * Add support for PostgreSQL database backend via designate::db::postgresql Deprecation Notes ***************** * The "designate::api::service_ensure" parameter has been deprecated. Use the "designate::api::manage_service" parameter instead, which accepts True or False instead. Changes in puppet-designate 18.3.0..18.4.0 ------------------------------------------ 5bd0491 Update sphinx to the latest version b5dd1fd Prepare Wallaby RC1 1016467 Add support for oslo_policy/enforce_new_defaults e35f3b4 Update supported Ubuntu version to Focal 7477015 Add designate::db::postgresql class. 2793574 Add support for the oslo_policy/enforce_scope parameter 4820eaa Rename confusing service_ensure parameter Diffstat (except docs and test files) ------------------------------------- manifests/api.pp | 24 ++++++++--- manifests/db/postgresql.pp | 49 ++++++++++++++++++++++ manifests/policy.pp | 21 ++++++++-- metadata.json | 10 ++--- .../notes/api-manage_service-4ff2fed27ad8c822.yaml | 6 +++ ...oslo_policy-enforce_scope-756ebf4f2154cfe6.yaml | 5 +++ ...licy-enforce_new_defaults-b8b0869d32ebb8a1.yaml | 5 +++ .../notes/postgresql-441cce8804597ce3.yaml | 4 ++ spec/classes/designate_db_postgresql_spec.rb | 45 ++++++++++++++++++++ spec/classes/designate_policy_spec.rb | 17 ++++---- 11 files changed, 166 insertions(+), 22 deletions(-)

1 0

ironic 17.0.0 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

We are thrilled to announce the release of: ironic 17.0.0: OpenStack Bare Metal Provisioning This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 17.0.0 ^^^^^^ Prelude ******* The Ironic community is proud to release Ironic 17.0! Where if it were developer years instead of major versions, we would all be very afraid since it already has access to the car keys. This release of Ironic includes numerous advancements which extend an operator's ability to customize and further extend their deployment to meet their needs. * Redfish enhancements including Out of Band RAID configuration management and automatic setting of Secure Boot on nodes deployed using "redfish". * Deployment enhancements including UEFI Partition Image handling, per-instance per-deployments of default interface selections, user requestable "deploy_steps" at deploy time, IPA file injection, and support for setting a node's boot mode via "instance_info". * Support for "system" scoped Role Based Access controls *and* "project" scoped access is available by default for associated nodes when the "node" "owner" or "lessee" fields are set. This effort alone added over 1,500 new unit tests. * Operator friendly fixes such as memory over-consumption guard for memory intensive tasks, vendor hardware aware handling to help address issues such as different settings being needed to invoke UEFI, and "lazy" loading of database attributes to reduce the overall database load. Along with all of this massive amount of work, a number of bugs were fixed while we were along the road trip of this development cycle. We sincerely hope you enjoy it! New Features ************ * It is now possible to configure a priority for both the delete and create configuration RAID cleaning steps which are disabled by default. * Adds "import_configuration", "export_configuration" and "import_export_configuration" steps to "idrac-redfish" management interface. These steps allow to use configuration from another system as template and replicate that configuration to other, similarly capable, systems. Currently, this feature is experimental. * Adds support for passing a "kernel_append_param" setting to the "ilo-virtual-media" and "ilo-uefi-https" boot interfaces using the configuration parameter "[ilo]/kernel_append_param" with the "ilo" and "ilo5" hardware types. * Adds support for the discovery of PXE Enabled NICs using the "idrac- redfish" inspect interface with the "idrac" hardware type. With this feature, a port's "pxe_enabled" status will be recorded on the bare metal port. * Adds support to manage certificates to the "ilo5" hardware type. A new optional boolean driver_info parameter "ilo_add_certificates" is introduced which can be used by the user to request addition of certificates to the iLO with "ilo-uefi-https" boot interface. * Adds the "[deploy]enable_nvme_secure_erase" option which allows the operator to enable NVMe format option for all nodes being managed by the conductor. * Add "anaconda" deploy interface to Ironic. This driver will deploy the OS using anaconda installer and kickstart file instead of IPA. To support this feature a new configuration group "anaconda" is added to Ironic configuration file along with "default_ks_template" configuration option. The deploy interface uses heartbeat API to communicate. The kickstart template must include %pre %post %onerror and %traceback sections that should send status of the deployment back to Ironic API using heartbeats. An example of such calls to hearbeat API can be found in the default kickstart template. To enable anaconda to send status back to Ironic API via heartbeat "agent_status" and "agent_status_message" are added to the heartbeat API. Use of these new parameters require API microversion 1.72 or greater. * Adds support for fast-tracking to "ansible" deploy interface. * Allows providing a list of IPMI cipher suite versions via the new configuration option "[ipmi]/cipher_suite_versions". The configuration is only used when "ipmi_cipher_suite" is not set in "driver_info". * Adds a new "disable_ramdisk" parameter to the manual cleaning API. If set to "true", IPA won't get booted for cleaning. Only steps explicitly marked as compatible can be executed this way. The parameter is available in the API version 1.70. * Provides operator ability to override URL settings required for provisioning/cleaning in the event of virtual media based deployment. These scenarios tend to require more delineation than more traditional deployments as they often have a different environmental security requirements. Set these two new configuration options using an IP address that is available to these nodes (both the ramdisk and the BMCs): [deploy] external_http_url = <routable URL of the HTTP server> external_callback_url = <routable URL of bare metal API> * Adds new GPU dynamic capabilities to "ilo" drivers inspection. gpu_<vendor>_count: Integer gpu_<gpu_device_name>_count: Integer gpu_<gpu_device_name>: Boolean * Enhance "idrac-wsman" inspect hardware interface to report an additional GPU device namely GV100GL [Tesla V100 PCIe 16GB]. With this enhancement, following GPU devices are reported * TU104GL [Tesla T4] * GV100GL [Tesla V100 PCIe 16GB] * Adds basic support for managing RAID configuration via the Redfish out-of-band (OOB) management protocol to the "idrac" hardware type by adding new interface named "idrac-redfish". For this iDRAC firmware greater than 4.40.00.00 is required. The "idrac" hardware type now supports "idrac-wsman", "idrac", "idrac-redfish", and "no- raid" interfaces in given priority order. * Allows node "*_interface" values to be overridden by values in a node "instance_info" field. This gives non-administrative users a temporary method of setting interface values. * The network data schema is now configurable via the new configuration options "[api]network_data_schema". * Adds capability to use "project" scoped requests in concert with "system" scoped requests for a composite Role Based Access Control (RBAC) model. As Ironic is mainly an administrative service, this capability has only been extended to API endpoints which are not purely administrative in nature. This consists of the following API endpoints: nodes, ports, portgroups, volume connectors, volume targets, and allocations. * Project "scoped" requests for baremetal allocations, will automatically record the "project_id" of the requestor as the "owner" of the node. * Adds support for automatic creation of ports for "redfish" enabled bare metal nodes using prior to ironic-inspector introspection. This feature is a part of "redfish" management interface. * Supplying configuration to the agent using the "redfish-virtual- media" boot interface now works through USB instead of floppy by default. Modern hardware (and even virtual machines) has limited support for floppies. * Adds support for pre-built ISO images to the "redfish-virtual- media" boot interface and its derivatives. * Adds a "redfish" native "raid_interface" to the "redfish" hardware type. See story 2003514 (https://storyboard.openstack.org/#!/story/2003514) for details. Note that common RAID cases have been tested, but cases that are more complex or rely on vendor-specific implementation details may not work as desired due to capability limitations. * Adds support for managing an iDRAC -- reset, clear job queue, and reset to known good state -- via the Redfish out-of-band (OOB) management protocol to the "idrac" hardware type. This is offered by new "idrac-redfish" management hardware interface implementation cleaning steps: "reset_idrac", "clear_job_queue", and "known_good_state". "known_good_state" both resets an iDRAC and clears its job queue. * Adds "[conductor]clean_step_priority_override" configuration parameter which allows the operator to define a custom order in which the cleaning steps are to run. * The Baremetal API, provided by the "ironic-api" process, now supports use of "system" scoped "keystone" authentication for the following endpoints: nodes, ports, portgroups, chassis, drivers, driver vendor passthru, volume targets, volume connectors, conductors, allocations, events, deploy templates * Introduces lazy-loading of ports, portgroups, volume connections and volume targets in task manager. For periodic tasks which create a task manager object but don't require the aforementioned data (e.g. power sync), this change should reduce the number of database interactions by around two thirds, speeding up overall execution. * Adds support for multipath volumes. If the volume properties have multiple portals, then it will generate multiple iscsi urls and append them together for use in the generated ipxe file. Known Issues ************ * The addition of both "project" and "system" scoped Role Based Access controls does add additional database queries when linked resources are accessed. Example, when attempting to access a "port" or "portgroup", the associated node needs to be checked as this helps govern overall object access to the object for "project" scoped requests. This does not impact "system" scoped requests. Operators who adopt project scoped access may find it necessary to verify or add additional database indexes in relation to the node "uuid" column as well as "node_id" field in any table which may recieve heavy project query scope activity. The "ironic" project anticipates that this will be a future work item of the project to help improve database performance. Upgrade Notes ************* * The "ilo-virtual-media" and "ilo-uefi-https" boot interfaces does not use "[pxe]pxe_append_params" anymore. To pass kernel parameters use new configuration parameter "[ilo]/kernel_append_param". * Legacy policy rules have been deprecated. Operators are advised to review and update any custom policy files in use. Please see Secure Role Based Access Controls for more information. * The functionality of using a port.extra "vif_port_id" value to signal and control a VIF attachment has been removed to support changing the permission model and access control policy. Use of "vif_port_id" outside of the VIF attachment/detachment workflow has been deprecated since the Ocata development cycle. * Deprecated policy rules are not expressed via a default policy file generation from the source code. The generated default policy file indicates the new default policies with notes on the deprecation to which "oslo.policy" falls back to, until the "[oslo_policy]enforce_scope" and "[oslo_policy]enforce_new_defaults" have been set to "True". Please see the Victoria policy configuration (https://docs.openstack.org/ironic/victoria/configura tion/policy.html) documentation to reference prior policy configuration. * Operators are encouraged to move to "system" scope based authentication by setting "[oslo_policy]enforce_scope" and "[oslo_policy]enforce_new_defaults". This requires a migration from using an "admin project" with the "baremetal_admin" and "baremetal_observer". System wide administrators using "system" scoped "admin" and "reader" accounts superceed the deprecated model. Deprecation Notes ***************** * Deprecates ATA specific "agent_continue_if_ata_erase_failed" agent's option which is replaced with "agent_continue_if_secure_erase_failed". The new option supports both ATA and NVMe secure erase. In order to ensure a smooth migration to the new configuration option, the operators need to upgrade Ironic Python Agent image to Wallaby release prior to upgrading Ironic Conductor to Xena. * Pre-RBAC support rules have been deprecated. These consist of: * admin_api * is_member * is_observer * is_node_owner * is_node_lessee * is_allocation_owner These rules will likely be removed in the Xena development cycle. Operators are advised to review any custom policy rules for these rules and move to the Secure Role Based Access Controls (https://docs.openstack.org/ironic/latest/admin/secure-rbac.html) model. * The node's "driver_info" parameter "config_via_floppy" of the "redfish-virtual-media" boot interface has been renamed to "config_via_removable". The old alias is deprecated. * Use of an "admin project" with ironic is deprecated. With this the custom roles, "baremetal_admin" and "baremetal_observer" are also deprecated. Please migrate to using a "system" scoped account with the "admin" and "reader" roles, respectively. Security Issues *************** * Ability to create an allocation has been restricted by a new policy rule "baremetal::allocation::create_pre_rbac" which prevents creation of allocations by any project administrator when operating with the new Role Based Access Control model. The use and enforcement of this rule is disabled when "[oslo_policy]enforce_new_defaults" is set which also makes the population of a "owner" field for allocations to become automatically populated. Most deployments should not encounter any issues with this security change, and the policy rule will be removed when support for the legacy "baremetal_admin" custom role has been removed. * Fixes an issue where ironic was not properly labeling dynamicly built virtual media ramdisks with the signifier flag so the ramdisk understands it was booted from virtual media. Bug Fixes ********* * When using the Neutron DHCP driver, Ironic would only use the first fixed IP address to determine what IP versions are use on the port. Now, it checks for all the IP addresses and adds DHCP options for all IP versions. * Rejects "configdrive" that is not a JSON, a URL or a base64 string. Previously invalid JSON supplied to ironicclient could end up accepted as a configdrive, which would cause a failure much later. * Fixes the "[deploy]configdrive_use_object_store" option that was broken during the Python 3 transition. * Fixes the problem about grub2 config file. Some higher versions of grub2 (e.g. 2.05 or 2.06-rc1) use grub.cfg-01-MAC, while another lower versions of grub2 (e.g. 2.04) use MAC.conf, so we generate both paths in order to be compatible with both. * Fixes the missing "boot_method" ramdisk parameter for dynamicly build virtual media payloads. This value must be set to "vmedia" for the ramdisk running on virtual media to understand it is executing from virtual media. This was fixed for cases where it is used with the "redfish-virtual-media" based boot interfaces as well as the "ilo-virtual-media" boot interface, which is where dynamic virtual media deployment/cleaning ramdisk generation is supported. * Fixes "idrac-wsman" BIOS "apply_configuration" and "factory_reset" clean and deploy steps to fail correctly in case of error when checking completed jobs. Before the fix when BIOS job failed, then node clean or deploy failed with timeout instead of actual error in cleaning or deploying step. * Adds handling of Redfish BMC's which lack a "BootSourceOverrideMode" flag, such that it is no longer a fatal error for a deployment if the BMC does not support this field. This most common on BMCs which feature only a partial implementation of the "ComputerSystem" resource "boot", but may also be observable on some older generations of BMCs which recieved updates to have partial Redfish support. * The fix for story 2008252 (https://storyboard.openstack.org/#!/story/2008252) synced the boot mode after changing the boot device because Supermicro nodes reset the boot mode if not included in the boot device set. However this can cause a problem on Dell nodes when changing the mode uefi->bios or bios->uefi, see story 2008712 (https://storyboard.openstack.org/#!/story/2008712) for details. Restrict the syncing of the boot mode to Supermicro. Other Notes *********** * Clean steps can now be marked with "requires_ramdisk=False" to make them compatible with the new "disable_ramdisk" argument of the manual cleaning API. * The API version of the Bare Metal API provided by the "ironic-api" service has been incremented to "1.71" to signify that the API supports System and Project scoped Role Based Access Controls, which is purely informational in nature, as the version itself cannot be used to change the API behavior for access controls. In excess of 1500 unit tests were added as part of the effort to implement Role Based Access Controls to help ensure the effort did not break the API behavior. Changes in ironic 16.2.0..17.0.0 -------------------------------- 288b8fd88 Add agent_status and agent_status_message params to heartbeat 8bd25a988 Restrict syncing of boot mode to Supermicro 601f6d51f Add iDRAC management via Redfish to idrac HW type 1523ae1ce Generic way to configure clean step priorites 12d1dd530 Fix configuration generation for ironic doc pages 4afbf7479 Fix Bandit check 4bd1c40bd Always add 'boot_method' vmedia in redfish/ilo vmedia boot 457d0cd70 Add import, export configuration to idrac-redfish d913ef639 Move configuration mold utilities fc457a49d [doc] Warning about out-of-sync ESPs for UEFI software RAID 86c34114d [doc] Update available software RAID levels. b029fb377 Automaticaly set cipher suite 9da8f418e Fix webserver_verify_ca config documentation 24be3c228 Allow using per-site network_data schema 15e20fe29 Add configuration mold storage 7d82d7f3d DRAC : idrac-redfish inspect updates pxe port 8f474bfe5 update grub2 file name 918f3c33c redfish boot_interfaces, ipmitool -> pxe 1abff50db redfish-virtual-media: allow USB devices instead of floppies 133dac255 Allow overriding an external URL for virtual media 83ce7c426 Fix idrac-wsman BIOS step async error handling f96ce6981 Follow up of Use OOB inspection to fetch MACs for IB inspection 9d3de26fb Validate the kickstart template and file before use 880bd639f Add anaconda support in the pxe boot driver 8cfde7447 Allow running RAID cleaning steps with in-band cleaning d55929fc7 Support pre-built deploy/rescue ISO in Redfish 80d4a0c51 Version 17.0 mapping/doc updates 8e79fafc8 Add prelude for Ironic 17.0. 752568eec Add known iDRAC virtual media boot issue 25efd0c8d Update idrac-redfish RAID release note f4ff15938 Remove extra/vif_port_id 67394c3cd Revise release notes for 17.0 release 9f221a7d4 Allow unsupported redfish set_boot_mode 26040d456 Add anaconda configuration and template 952695be3 Add Redfish RAID interface to idrac HW type e6863c6b7 Follow-up to RBAC allocation changes e5b391c32 Increment API version for Secure RBAC 9220f97ed Add runtime gpu capabilities to ilo inspection 426353c3f Deprecate legacy policies, update project scoped docs d6dd05ab1 Enable Reuse of Zuul Job in 3rd Party CI Environment 7552c489e Add iRMC Driver Support to DevStack Code 30a85bd0c API to force manual cleaning without booting IPA 642bc983b Allow ansible deploys to be fast-tracked 7ae3919dc Trivial: add a missing argument to an exception 88673f1e9 Allocation support for project scoped RBAC ebaa35993 Mark multinode non-voting due to high failure rate d8a0b0c27 Don't try to use attempts=None with tenacity dccff98a3 [doc] Add initial system-scoped text to secure-rbac f2e8c031c Switch to JSON RPC from ironic-lib 5c36615a9 Update dev quickstart docs 5f85a8966 Update Redfish RAID release note 6ba1ecad1 Allow users to configure priority for {create,delete}_configuration 342878ca6 Add CentOS7 for supported ramdisk for dhcpless deploy 7e1c08c40 RBAC Follow-up: Review follow-up. 0b920d2a0 Enforce autospec in test_console_utils 49fcbd491 Rework the standalone guide 472ffca26 docs: move overriding interfaces to the standalone documentation 5360c786a Update iDRAC doc with idrac-redfish-virtual-media 383afc2d8 Update iDRAC doc on Redfish vendor passthru interface a165fe326 Allow instance_info to override node interface 0354940e4 Allow support for multipath volumes 94fae9ac2 Enforce autospec in test_portgroup a8b5137db Revert "Update iDRAC doc with missing interfaces" 7f6b24c70 Follow-up on project scoped trait tests 5dff46a70 Project scope driver vendor pass-through e870bd34d Volume targets/connectors Project Scoped RBAC 00eb6dcfa Enforce autospec in test_port b0696ea0a Enforce autospec in test_volume_connector b4cae9b82 Enforce autospec in test_volume_target d7f4da237 Add Redfish RAID management to Ironic e9dfe5dda Port/Portgroup project scoped access f1641468b Project Scoping Node endpoint aa42582ac Add support for using NVMe specific cleaning 807a6d2be Prepare to use tinycore 12 for tinyipa 82cab603b Lazy-load node details from the DB 755918343 Adds config parameter kernel_append_param for iLO 20acfc26e secure-rbac - minor follow-up for project scoped tests 367cdcd66 Add both IPv4 and IPv6 DHCP options if interface has both 61c5b3fd2 [Trivial] Fix testing of volume connector exception decd72334 Switch iLO and iRMC to the new secure boot framework 7abac806a devstack: a safeguard for disabled tempurls 5533077c7 Enable swift temporary URLs in grenade and provide a good error message f541d517c [trivial] Remove default parameter from execute df69b7d14 Initial Project scoped tests eabb72b6b RBAC System Scope: observer -> reader 27a889854 Implement system scoped RBAC for the deploy templates APIs 046e99c0b Implement system scoped RBAC for the event APIs d5b5356d6 [trivial] fix typos in conductor f18fec232 Enforce autospec in test_driver 20a4f4aad Review feedback follow-up on Node System Scoped RBAC d146064cb Implement system scoped RBAC for the allocation APIs e1e35e874 Implement system scoped RBAC for conductor APIs 5ed58df55 Implement system scoped RBAC for volume APIs 69b28ca99 Implement system scoped RBAC for utility APIs ff883486e Implement system scoped RBAC for node and driver passthru 9e773d96c Implement system scoped RBAC for baremetal drivers eb8d7d6a8 Implement system scoped RBAC for chassis 4fe64c970 Implement system scoped RBAC for port groups 34edc6444 Implement "system" scoped RBAC for ports b0d8d1406 Implement "system" scoped RBAC for the node endpoint b66471e39 Add support for using NVMe specific cleaning 8e458d89b Trivial: fix incorrect ordering in iLO tests 52c01f87c Enforce autospec in test_notification_utils module 6ed75bc6c Enforce autospec in test_node 16e3c6662 Correct release mappings for 16.2 73bdebd12 Fix broken configdrive_use_object_store 6e09a008a Replace pysendfile with os.sendfile cf5deb77a Validate configdrive string format 437cae984 Enforce autospec in test_chassis b0607a266 Replace retrying with tenacity 414f0ca24 Switch multinode jobs to 512M RAM bb30f9945 Add some tuning documentation 7c8d1e1e7 Move the IPv6 job to the experimental pipeline e3ccb9ec2 Address some rbac review feedback in merged patches 189b5e40c devstack: support installing ironic-lib from source in DIB IPA e36d7af09 Report the slowest tests after a test run 05df3d7aa Use OOB inspection to fetch MACs for IB inspection 7d4c1214f Add support to manage certificates in iLO 94ba2641e Update oslo.policy requirement to version 3.6.2 1aea2040d More GPU support in idrac-wsman inspect interface fb3f6726d [doc-only] Add BFV basic flow and networking context Diffstat (except docs and test files) ------------------------------------- .../source/baremetal-api-v1-node-management.inc | 5 + api-ref/source/parameters.yaml | 8 + devstack/lib/ironic | 20 + driver-requirements.txt | 6 +- ironic/api/controllers/v1/allocation.py | 141 +- ironic/api/controllers/v1/bios.py | 8 +- ironic/api/controllers/v1/node.py | 284 ++- ironic/api/controllers/v1/port.py | 62 +- ironic/api/controllers/v1/portgroup.py | 103 +- ironic/api/controllers/v1/ramdisk.py | 33 +- ironic/api/controllers/v1/utils.py | 415 +++- ironic/api/controllers/v1/versions.py | 8 +- ironic/api/controllers/v1/volume_connector.py | 61 +- ironic/api/controllers/v1/volume_target.py | 87 +- ironic/common/context.py | 3 + ironic/common/driver_factory.py | 33 +- ironic/common/exception.py | 8 + ironic/common/glance_service/image_service.py | 17 +- ironic/common/glance_service/service_utils.py | 7 + ironic/common/image_service.py | 11 +- ironic/common/json_rpc/__init__.py | 20 - ironic/common/json_rpc/client.py | 207 -- ironic/common/json_rpc/server.py | 293 --- ironic/common/molds.py | 112 + ironic/common/neutron.py | 23 +- ironic/common/policy.py | 2016 ++++++++++++---- ironic/common/pxe_utils.py | 270 ++- ironic/common/release_mappings.py | 30 +- ironic/common/rpc_service.py | 6 +- ironic/common/swift.py | 7 +- ironic/common/utils.py | 30 +- ironic/conductor/allocations.py | 13 +- ironic/conductor/cleaning.py | 51 +- ironic/conductor/deployments.py | 3 +- ironic/conductor/manager.py | 24 +- ironic/conductor/rpcapi.py | 33 +- ironic/conductor/steps.py | 63 +- ironic/conductor/task_manager.py | 98 +- ironic/conductor/utils.py | 7 +- ironic/conf/__init__.py | 6 +- ironic/conf/anaconda.py | 36 + ironic/conf/api.py | 4 + ironic/conf/conductor.py | 13 + ironic/conf/default.py | 22 + ironic/conf/deploy.py | 47 +- ironic/conf/drac.py | 7 +- ironic/conf/ilo.py | 9 + ironic/conf/ipmi.py | 5 + ironic/conf/json_rpc.py | 61 - ironic/conf/molds.py | 41 + ironic/conf/opts.py | 21 +- ironic/conf/redfish.py | 10 + ironic/db/api.py | 31 +- ironic/db/sqlalchemy/api.py | 73 +- ironic/dhcp/neutron.py | 40 +- ironic/drivers/base.py | 26 +- ironic/drivers/drac.py | 5 +- ironic/drivers/generic.py | 3 +- ironic/drivers/modules/agent.py | 18 + ironic/drivers/modules/agent_base.py | 34 +- ironic/drivers/modules/agent_client.py | 32 +- ironic/drivers/modules/agent_power.py | 16 +- ironic/drivers/modules/ansible/deploy.py | 46 +- ironic/drivers/modules/deploy_utils.py | 43 +- ironic/drivers/modules/drac/bios.py | 20 +- ironic/drivers/modules/drac/inspect.py | 133 +- ironic/drivers/modules/drac/job.py | 11 +- ironic/drivers/modules/drac/management.py | 459 +++- ironic/drivers/modules/drac/raid.py | 164 ++ ironic/drivers/modules/ibmc/utils.py | 11 +- ironic/drivers/modules/ilo/boot.py | 93 +- ironic/drivers/modules/ilo/common.py | 173 +- ironic/drivers/modules/ilo/inspect.py | 7 + ironic/drivers/modules/ilo/management.py | 32 + ironic/drivers/modules/image_utils.py | 144 +- ironic/drivers/modules/inspector.py | 18 +- ironic/drivers/modules/ipmitool.py | 78 + ironic/drivers/modules/ipxe_config.template | 6 + ironic/drivers/modules/irmc/boot.py | 42 +- ironic/drivers/modules/irmc/common.py | 21 + ironic/drivers/modules/irmc/management.py | 32 + ironic/drivers/modules/iscsi_deploy.py | 9 +- ironic/drivers/modules/ks.cfg.template | 37 + ironic/drivers/modules/network/common.py | 12 +- ironic/drivers/modules/network/flat.py | 3 +- ironic/drivers/modules/network/neutron.py | 2 +- ironic/drivers/modules/pxe.py | 118 +- ironic/drivers/modules/pxe_base.py | 33 +- ironic/drivers/modules/pxe_config.template | 5 + ironic/drivers/modules/redfish/boot.py | 129 +- ironic/drivers/modules/redfish/inspect.py | 62 +- ironic/drivers/modules/redfish/management.py | 39 +- ironic/drivers/modules/redfish/raid.py | 1145 +++++++++ ironic/drivers/modules/redfish/utils.py | 80 +- ironic/drivers/modules/redfish/vendor.py | 2 +- ironic/drivers/modules/storage/cinder.py | 11 +- ironic/drivers/redfish.py | 7 + ironic/objects/portgroup.py | 18 +- ironic/objects/volume_connector.py | 13 +- ironic/objects/volume_target.py | 19 +- .../unit/api/controllers/v1/test_allocation.py | 87 +- .../api/controllers/v1/test_notification_utils.py | 7 +- .../unit/api/controllers/v1/test_portgroup.py | 225 +- .../api/controllers/v1/test_volume_connector.py | 56 +- .../unit/api/controllers/v1/test_volume_target.py | 55 +- .../drivers/ipxe_config_boot_from_iso.template | 6 + ...e_config_boot_from_volume_extra_volume.template | 6 + ...ipxe_config_boot_from_volume_multipath.template | 62 + ...nfig_boot_from_volume_no_extra_volumes.template | 6 + .../unit/drivers/ipxe_config_timeout.template | 6 + .../unit/drivers/modules/drac/test_inspect.py | 216 +- .../unit/drivers/modules/drac/test_management.py | 646 ++++- .../unit/drivers/modules/irmc/test_inspect.py | 17 - .../unit/drivers/modules/network/test_common.py | 150 +- .../unit/drivers/modules/network/test_flat.py | 23 +- .../unit/drivers/modules/network/test_neutron.py | 84 +- .../unit/drivers/modules/redfish/test_boot.py | 143 +- .../unit/drivers/modules/redfish/test_inspect.py | 119 + .../drivers/modules/redfish/test_management.py | 100 +- .../unit/drivers/modules/redfish/test_raid.py | 862 +++++++ .../unit/drivers/modules/redfish/test_utils.py | 29 +- .../unit/drivers/modules/test_agent_client.py | 18 +- .../unit/drivers/modules/test_console_utils.py | 81 +- .../unit/drivers/modules/test_deploy_utils.py | 32 +- .../unit/drivers/modules/test_iscsi_deploy.py | 8 +- .../unit/drivers/third_party_driver_mock_specs.py | 2 + .../add-clean-steps-priority-88d7de5973500a7d.yaml | 4 + ...d-config-mold-steps-idrac-1773d81953209964.yaml | 8 + .../add-dual-stack-dhcp-opts-6dc18ae10aeb599a.yaml | 5 + ...d-kernel-param-config-ilo-9b2cee8b0447f82e.yaml | 12 + ...xe-nic-support-in-redfish-5359897135df1348.yaml | 7 + ...d-support-to-manage_certs-b6615e15f697bc26.yaml | 7 + .../adds-nvme-erase-switch-fa91e867e45ede3c.yaml | 14 + ...ns-restricted-rbac-create-2847943150656432.yaml | 13 + ...anaconda-deploy-interface-c04932f6f469227a.yaml | 17 + .../notes/ansible-fast-track-cbecb132b6ff2b14.yaml | 4 + .../cipher_suite_versions-c64644860d3c220d.yaml | 6 + .../notes/configdrive-format-1b11f6068bd742cd.yaml | 6 + ...figdrive_use_object_store-93cfd7dc27d90003.yaml | 5 + .../notes/disable-ramdisk-5156a009812fbb17.yaml | 13 + .../notes/external-ip-5ec9b7b55a90cec4.yaml | 13 + ...ix-grub2-config-file-name-88e689a982a21684.yaml | 7 + ...-vmedia-boot-method-label-8008f49ace96f1cc.yaml | 15 + ...async-step-error-handling-80cd30c54c71c595.yaml | 8 + .../gpu_dynamic_capabilities-b56b90549882b6c2.yaml | 7 + ...drac-add-more-gpu-support-c3e24d8471ed6759.yaml | 9 + ...-add-redfish-raid-support-414aad5e633a160f.yaml | 9 + ...e-info-interface-override-287c7fcff1081469.yaml | 7 + .../network_data_schema-9342edf3c47b2a66.yaml | 5 + .../prelude-for-seventeen-638544be837c54fa.yaml | 34 + .../project-scoped-rbac-063c44ba593bb82a.yaml | 45 + .../redfish-autocreate-ports-53712a46dadd8203.yaml | 6 + ...ride-not-present-handling-92e7263617e467c4.yaml | 9 + .../notes/redfish-config-usb-3e9a7543b2912ae7.yaml | 11 + .../notes/redfish-deploy-iso-60873289278bf28f.yaml | 5 + .../redfish-raid-interface-e362e7a0e7140962.yaml | 10 + .../redfish_mgmt_clean_steps-c983a8858835046d.yaml | 9 + .../notes/releasenote-b3b25c13ea1e2844.yaml | 6 + .../remove-extra-vif-port-id-ea4e59176c2065fd.yaml | 8 + ...fter-device-to-supermicro-218e8cb57735c685.yaml | 11 + ...bac-api-version-increment-1785544f54a487b3.yaml | 10 + ...tem-scoped-authentication-28e3651de250bea8.yaml | 32 + .../taskmanager-lazy-load-32a14526c647c2f0.yaml | 9 + .../notes/volume-multipath-63b96f8331e771ae.yaml | 7 + requirements.txt | 7 +- setup.cfg | 3 + tools/config/ironic-config-generator.conf | 1 + tox.ini | 17 +- zuul.d/ironic-jobs.yaml | 82 +- zuul.d/project.yaml | 18 +- 250 files changed, 19107 insertions(+), 4885 deletions(-) Requirements updates -------------------- diff --git a/driver-requirements.txt b/driver-requirements.txt index 55d076e36..457040ed4 100644 --- a/driver-requirements.txt +++ b/driver-requirements.txt @@ -7 +7 @@ -proliantutils>=2.10.0 +proliantutils>=2.11.0 @@ -14 +14 @@ python-xclarityclient>=0.1.6 -sushy>=3.6.0 +sushy>=3.7.0 @@ -23 +23 @@ python-ibmcclient>=0.2.2,<0.3.0 -sushy-oem-idrac<2.0.0 +sushy-oem-idrac>=2.1.0,<3.0.0 diff --git a/requirements.txt b/requirements.txt index df346381b..ca59703cc 100644 --- a/requirements.txt +++ b/requirements.txt @@ -13 +13 @@ keystoneauth1>=4.2.0 # Apache-2.0 -ironic-lib>=4.3.0 # Apache-2.0 +ironic-lib>=4.6.1 # Apache-2.0 @@ -17 +16,0 @@ stevedore>=1.20.0 # Apache-2.0 -pysendfile>=2.0.0;sys_platform!='win32' # MIT @@ -25 +24 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.policy>=3.6.0 # Apache-2.0 +oslo.policy>=3.6.2 # Apache-2.0 @@ -39 +38 @@ oslo.messaging>=5.29.0 # Apache-2.0 -retrying!=1.3.0,>=1.2.3 # Apache-2.0 +tenacity>=6.2.0 # Apache-2.0

1 0

octavia 8.0.0.0rc2 (wallaby)
by no-reply＠openstack.org 01 Apr '21

01 Apr '21

Hello everyone, A new release candidate for octavia for the end of the Wallaby cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/octavia/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Wallaby release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/wallaby release branch at: https://opendev.org/openstack/octavia/src/branch/stable/wallaby Release notes for octavia can be found at: https://docs.openstack.org/releasenotes/octavia/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/908 and tag it *wallaby-rc-potential* to bring it to the octavia release crew's attention.

1 0

ironic-python-agent 7.0.0 (wallaby)
by no-reply＠openstack.org 31 Mar '21

31 Mar '21

We are amped to announce the release of: ironic-python-agent 7.0.0: Ironic Python Agent Ramdisk This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- python-agent For more details, please see below. 7.0.0 ^^^^^ New Features ************ * Adds support for NVMe-specific storage cleaning to IPA. Currently this is implemented by using nvme-cli format functionality. Crypto Erase is used if supported by the device, otherwise the code falls back to User Data Erase. The operators can control NVMe cleaning by using deploy.enable_nvme_erase config option which controls "agent_enable_nvme_erase" internal setting in driver_internal_info. * Adds a new deploy step "deploy.inject_files" to inject arbitrary files into the instance. See the hardware managers documentation (https://docs.openstack.org/ironic-python- agent/latest/admin/hardware_managers.html) for details. Known Issues ************ * Logic around virtual media device validation is now much more strict, and may not work in all cases. Should you discover a case, please provide the output from "lsblk -P -O" with a virtual media device attached to the Ironic development community via Storyboard (https://storyboard.openstack.org/#!/project/947) * Internal logic to copy configuration data from virtual media now requires the "boot_method=vmedia" flag to be set on the kernel command line of the bootloader for the virtual media. Operators crafting custom boot ISOs, should ensure that the appropriate command line is being added in any custom build processes. Upgrade Notes ************* * It is no longer possible to enable the so called *standalone mode*, in which the agent does not communicate with ironic. This mode is only useful for local testing, enabling it on production is always wrong. The ironic team does not support using ironic-python- agent as a standalone application outside of the normal workflow. Security Issues *************** * Addresses a potential vector in which an system authenticated malicious actor could leveraged data left on disk in some limited cases to make the API of the "ironic-python-agent" attackable, or possibly break cleaning processes to prevent the machine from being able to be returned to the available pool. Please see story 2008749 (https://storyboard.openstack.org/#!/story/2008749) for more information. Bug Fixes ********* * Adds validation of Virtual Media devices in order to prevent existing partitions on the system from being considered as potential sources of IPA configuration data. * Adds check into the configuration load from virtual media, to ensure it only occurs when the machine booted from virtual media. * IPA will now successfully clean configuration when it encounters a software RAID array that was previously created using entire devices instead of partitions. * IPA now properly checks if the root partition is already mounted. See Story 2008631 (https://storyboard.openstack.org/#!/story/2008631) for details. * Fixes an issue where metadata erasure cleaning fails for partitions because the read-only file isn't found, while it is available at the base device. Adds a check for the base device file on failure. See story 2008696 (https://storyboard.openstack.org/#!/story/2008696) * Fixes incorrect root partition UUID after streaming a raw partition image. * Increase memory usage limit for "qemu-img convert" command to 2 GiB. See Story 2008667 (https://storyboard.openstack.org/#!/story/2008667) for details. Changes in ironic-python-agent 6.6.0..7.0.0 ------------------------------------------- 993f9a0 Make the virtual media job voting afcc5d3 Fix incorrect lsblk tag and add a virtual media job 8dd6589 Validate vmedia for vmedia usage de726d4 Do not permit IPA standalone to be enabled by conf 2a64413 typo chanages -> changes d622d38 Refactor: use mounted from ironic-lib e613366 Fix root UUID for streamed partition images 4afe4f6 Check the base device if the read-only file cannot be read 45371bf Prepare to use tinycore 12 bff252c Remove default parameter from execute 5492ad7 Increase the memory limit for qemu-img d2127e7 Remove nvme-cli warning and delay on nvme-format 2220aaa Added comment about IPA logs being uploaded to Ironic ab267aa Allow clean_configuration to run against full-device arrays 0459c61 Use try_execute from ironic-lib 8bcf1be Add support for using NVMe specific cleaning 7d7940d Move some raid specific functions to raid_utils 319efe2 Fixes local boot for partition images 59cb08f New deploy step for injecting arbitrary files a35761c Remove samples from the hardware test module Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/cmd/agent.py | 2 +- ironic_python_agent/config.py | 11 +- ironic_python_agent/extensions/image.py | 2 +- ironic_python_agent/extensions/standby.py | 9 +- ironic_python_agent/hardware.py | 261 ++-- ironic_python_agent/inject_files.py | 256 ++++ ironic_python_agent/raid_utils.py | 87 ++ ironic_python_agent/shell/write_image.sh | 4 +- ironic_python_agent/utils.py | 226 +++- .../adds-nvme-secure-erase-0ecfd624e5f50581.yaml | 8 + ...eck-virtual-media-devices-a9b1f54c3fe7884d.yaml | 30 + ...an-config-for-full-device-28ee09b58d97d122.yaml | 5 + ...boot-for-partition-images-755f570dc0982868.yaml | 7 + .../notes/inject-files-b411369ce6856dac.yaml | 7 + .../notes/no-standalone-bb34eae2cc468837.yaml | 8 + ...eck_read_only_base_device-5bc15ac2f034aca9.yaml | 7 + .../notes/streaming-uuid-fdf136a7745fbb3d.yaml | 5 + .../notes/up-qemuimg-mem-1536183a02b3a235.yaml | 7 + requirements.txt | 2 +- zuul.d/ironic-python-agent-jobs.yaml | 31 +- zuul.d/project.yaml | 2 + 30 files changed, 3198 insertions(+), 1338 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 690a5b1..9fefc99 100644 --- a/requirements.txt +++ b/requirements.txt @@ -20 +20 @@ tenacity>=6.2.0 # Apache-2.0 -ironic-lib>=4.1.0 # Apache-2.0 +ironic-lib>=4.5.0 # Apache-2.0

1 0

keystone_tempest_plugin 0.7.0 (wallaby)
by no-reply＠openstack.org 31 Mar '21

31 Mar '21

We contentedly announce the release of: keystone_tempest_plugin 0.7.0: Tempest plugin keystone_tempest_plugin This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/keystone_tempest_plugin Download the package from: https://tarballs.openstack.org/keystone-tempest-plugin/ For more details, please see below. Changes in keystone_tempest_plugin 0.6.0..0.7.0 ----------------------------------------------- a6d4cea Add RBAC tests 2473e5b Update federation jobs to use ubuntu focal Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 44 +- keystone_tempest_plugin/config.py | 6 +- keystone_tempest_plugin/plugin.py | 4 +- tox.ini | 2 +- 37 files changed, 16027 insertions(+), 7 deletions(-)

1 0