- Release-announce - lists.openstack.org

openstack-governance 0.8.0
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are pumped to announce the release of: openstack-governance 0.8.0: OpenStack Governance Documents The source is available from: https://opendev.org/openstack/openstack-governance Download the package from: https://tarballs.openstack.org/governance/ For more details, please see below. Changes in openstack-governance 0.7.0..0.8.0 -------------------------------------------- add9a06e Reorder repos alphabetically 67f7be00 Add exception for Sept 2020 term election 297e1a43 Add openstack/osops to Ops Docs and Tooling SIG 8382a101 kolla-cli: deprecation - Mark as deprecated a9a1b07f Reinstate weekly meetings 70fa9c90 Add openstack-helm-deployments to openstack-helm 403f588a Retire the devstack-plugin-zmq project 7f1058a1 Add openstack-ansible/os_senlin role e7a8fe84 Move ansible-role-XXX-hsm projects to Barbican team 1d7fb74f Update and simplify comparison of working groups e90a4464 Add etcd3gw to Oslo 1174effc Move towards dual office hours in diff TZ 08763131 Resolution to define distributed leadership for projects 6b2e491d Fix names inside check-review-status 0aa813b5 Add python-dracclient to be owned by Hardware Vendor SIG 56442877 Pierre Riteau as CloudKitty PTL for Victoria 0e9ffd10 Clean up expired i18n SIG extra-ATCs 4db165ec Sort SIG names in repo owner list 5084a1e1 Drop all exceptions for legacy validation d5a9229e Add legacy repository validation cf2872a1 Drop neutron-vpnaas from legacy projects f1e5071a Reverse sort series in selected goals fbebf372 Add Ceph iSCSI charm to OpenStack charms 611f026c Declare supported runtimes for Wallaby release 40200267 Add Keystone Kerberos charm to OpenStack charms 3a3017f3 Deprecate os_congress project 5d5805c8 Create starter-kit:kubernetes-in-virt tag Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 15 ++ goals/selected/index.rst | 1 + reference/charter.rst | 2 +- .../comparison-of-official-group-structures.rst | 289 +++++++++------------ reference/election-exceptions.rst | 26 ++ reference/index.rst | 1 + reference/legacy.yaml | 12 +- reference/projects.yaml | 65 ++++- reference/runtimes/wallaby.rst | 47 ++++ reference/sigs-repos.yaml | 182 ++----------- reference/tags/index.rst | 1 + reference/tags/starter-kit_kubernetes-in-virt.rst | 161 ++++++++++++ reference/team-formats.png | Bin 147642 -> 42888 bytes .../20200803-distributed-project-leadership.rst | 199 ++++++++++++++ resolutions/20200831-reinstate-weekly-meetings.rst | 67 +++++ .../20170425-drop-tc-weekly-meetings.rst | 0 tools/check_review_status.py | 2 +- tools/validate-legacy.py | 85 ++++++ tools/validate_repositories.py | 25 -- tox.ini | 5 + 21 files changed, 821 insertions(+), 370 deletions(-)

1 0

sahara-tests 0.11.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are happy to announce the release of: sahara-tests 0.11.0: Sahara tests This release is part of the victoria release series. The source is available from: https://opendev.org/openstack/sahara-tests Download the package from: https://tarballs.openstack.org/sahara-tests/ Please report issues through: https://storyboard.openstack.org/#!/project/940 For more details, please see below. Changes in sahara-tests 0.10.0..0.11.0 -------------------------------------- 8c3c00c [goal] Migrate sahara tempest plugin jobs to focal a98a644 Revert "Revert "Temporarily disable ceilometer (currently broken)"" afa2701 Revert "Temporarily disable ceilometer (currently broken)" dc388e1 Temporarily disable ceilometer (currently broken) 1eb866f Fix URL of Maven Central Repository 8dd47f3 scenario tests: use py2 on <=train branches 21c5b0b zuul: use the correct syntax for a jinja test (non filter) ff53c44 Use unittest.mock instead of mock f119332 Switch to newer openstackdocstheme and reno versions b31e536 Add support for python 3.8 d9695cd Remove .testr.conf 7d33a65 Fix hacking min version to 3.0.1 Diffstat (except docs and test files) ------------------------------------- .testr.conf | 8 -------- .zuul.yaml | 21 +++++++++++++++++---- releasenotes/source/conf.py | 9 ++++----- requirements.txt | 2 +- roles/setup-sahara-scenario-env/tasks/main.yaml | 4 ++-- .../defaults/edp-examples/edp-spark/README.rst | 2 +- setup.cfg | 3 ++- setup.py | 8 -------- test-requirements.txt | 3 +-- tox.ini | 2 +- 16 files changed, 40 insertions(+), 54 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b5a7778..0c89a28 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ fixtures>=3.0.0 # Apache-2.0/BSD -jsonschema!=2.5.0,<3.0.0,>=2.0.0 # MIT +jsonschema>=3.2.0 # MIT diff --git a/test-requirements.txt b/test-requirements.txt index 412b233..b590895 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking>=3.0,<3.1.0 # Apache-2.0 +hacking>=3.0.1,<3.1.0 # Apache-2.0 @@ -11 +10,0 @@ doc8 # Apache-2.0 -mock>=1.2 # BSD

1 0

ironic 16.0.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are pumped to announce the release of: ironic 16.0.0: OpenStack Bare Metal Provisioning This release is part of the victoria release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 16.0.0 ^^^^^^ Prelude ******* The Ironic team is proud to announce the release of Ironic 16.0. For over six years, the contributors to this project have continued to drive forth and provide what we collectively feel is the best platform for managing and deploying bare metal hardware. The innovation, the drive, and the pursuit of improving infrastructure operators' lives has yet to cease, and has no signs of stopping anytime soon. As with any release, we have some things we are particularly proud of: * Support for TLS encryption of Agent communications. * Support for in-band deployment steps enabling software RAID to be configured at deployment time. * Ramdisk/Virtual Media pass-through of ISO images. * BMC-less "agent" power control, so BMC's are not required for deployments. * Network configuration injection with virtual media based ramdisks. * Integrated basic authentication for standalone Ironic operators. And with any major release, a number of bugs have been fixed. Cross- vendor features see increased parity. Every contributor has something to be proud of in this release. And with that, we hope you enjoy it! New Features ************ * Adds "ilo-uefi-https" boot interface to "ilo5" hardware type. This boot interface levereges the iLO UEFI firmware capability to boot from given HTTPS URLs hosted securely over HTTPS webserver with standard/custom certificates. * Adds functionality to the "ilo" and "ilo5" hardware types by enabling virtual media boot without user-built deploy/rescue/boot ISO images. Instead, ironic will build necessary images out of common kernel/ramdisk pair (though user needs to provide ESP image). User provided deploy/rescue/boot ISO images are also supported. * Adds support of DHCP less deploy to "ilo" and "ilo5" hardware types by using the "network_data" property on the node field, operators can now apply network configuration to be embedded in iLO based Virtual Media based deployment ramdisks which include networking configuration enabling the deployment to operate without the use of DHCP. * Adds an ability to accept a custom TLS certificate in the heartbeat API. * Adds a configuration option "webserver_verify_ca" to support custom certificates to validate URLs hosted on a HTTPS webserver. * Using the "network_data" property on the node field, operators can now apply network configuration to be embedded in Redfish based Virtual Media based deployment ramdisks which include networking configuration enabling the deployment to operate without the use of DHCP. See Redfish driver documentation for more information (https: //docs.openstack.org/ironic/latest/admin/drivers/redfish.html#layer -3-or-dhcp-less-ramdisk-booting). * "file://" images are now supported in the "direct" deploy interface. * Adds a new possible value for "image_download_source": "local". When used, even "http://" images are downloaded, converted to RAW if needed and served from the conductor's HTTP server. This feature targets primarily nodes with low RAM. * Adds support in "idrac-wsman" inspect hardware interface for reporting number of GPU devices connected to a system. This information is advertised through capability "pci_gpu_devices", which can be used to make scheduling decisions for the node. Currently, NVIDIA Tesla T4 GPU devices are reported. * Adds support for managing BIOS settings via the Redfish out-of- band (OOB) management protocol to the "idrac" hardware type. The new hardware BIOS interface implementation which offers it is named "idrac-redfish". The "idrac" hardware type declares support for that new interface implementation, in addition to all BIOS interface implementations it has been supporting. The highest priority BIOS interface remains the same, the one which relies on the Web Services Management (WS-Man) OOB management protocol. The new "idrac-redfish" immediately follows it. It now supports the following BIOS interface implementations, listed in priority order from highest to lowest: "idrac-wsman", "idrac-redfish", and "no-bios". For more information, see story 2008100 (https://storyboard.openstack.org/#!/story/2008100) * Adds a new configuration option "[ilo]verify_ca" and a new "driver_info" parameter "ilo_verify_ca" to enhance certificate verification for hardware type ilo and ilo5 which can take directory and bolean values apart from file. * Adds functionality to perform out-of-band one button secure erase operation for iLO5 based HPE Proliant servers as a "management" clean step "one_button_secure_erase" for "ilo5" hardware type. * The "image_download_source" configuration option can now also be set per node in the "instance_info" or "driver_info" (the former having the highest priority). * Allows configuring IPMI cipher suite via the new "driver_info" parameter "ipmi_cipher_suite". * Adds "driver_internal_info" field to the node-related notification "baremetal.node.provision_set.*", new payload version 1.16. * Adds support for performing firmware updates using the "redfish" and "idrac" hardware types. A new firmware update cleaning step has been added to the "redfish" hardware type. The "idrac" hardware type also automatically gains this capability through inheritance. * A new configuration option "[agent]require_tls" allows rejecting ramdisk callback URLs that don't use the "https://" schema. * Supports the Fujitsu "irmc" hardware type again. The Third Party CI for the driver has started to work correctly in September 2020. Upgrade Notes ************* * The "one_button_secure_erase" clean step in the "ilo5" hardware type requires "proliantutils" version "2.10.0". Please upgrade this library to leverage this feature. * The default value of the configuration option "[agent]image_download_source" has been changed to "http" to simplify transition from the "iscsi" deploy interface. Set it to "swift" explicitly to maintain the previous behavior. * The deprecated "iscsi" deploy interface is no longer enabled by default, set "enabled_deploy_interfaces" to override. It is also no longer the first in the list of deploy interface priorities, so it has to be requested explicitly if the "direct" deploy is also enabled. * Since the "direct" deploy interface is now used by default, you need to configure "[deploy]http_url" and "[deploy]http_root" to point at a local HTTP server or configure access to Swift. * Support for token-less agents has been removed as the token-less agent support was deprecated in the Ussuri development cycle. The ironic-python-agent must be updated to 6.1.0 or higher to support communicating with the Ironic deployment after upgrade. This will generally require deployment, cleaning, and rescue kernels and ramdisks to be updated. If this is not done, actions such as cleaning and deployment will time out as the agent will be unable to record heartbeats with Ironic. For more information, please see the agent token (https://docs.openstack.org/ironic/latest/admin/agent- token.html) documentation. * The "redfish-virtual-media" boot interface is now the last in the list of priorities from the "redfish" hardware type. This means that new nodes will be created with "ipxe" or "pxe" boot if they are enabled. The reason for this change is limited support for pure Redfish virtual media from hardware vendors. To use virtual media with Redfish, please provide an explicit "boot_interface" parameter when creating nodes. If you enable only the "redfish" hardware type, you can also set the "default_boot_interface" configuration option to "redfish-virtual- media". Deprecation Notes ***************** * The "[ilo]ca_file" configuration option is deprecated for removal, please use "[ilo]verify_ca" instead which can take directory and boolean values apart from file for certificate verification. * The "iscsi" deploy interface is now deprecated, "direct" or "ansible" deploy should be used instead. We expected the complete removal of the "iscsi" deploy code to happen in the "X" release. * With the switch from neutronclient to openstacksdk the "[neutron]/retries" option has been deprecated, use "[neutron]/status_code_retries" and "[neutron]/status_code_retry_delay" instead. Security Issues *************** * Ramdisks supporting agent token are now globally required by Ironic. As this is a core security mechanism, it cannot be disabled and support for the "[DEFAULT]require_agent_token" configuration parameter has been removed as tokens are now always required by Ironic. For more information, please see the agent token (https://docs.openstack.org/ironic/latest/admin/agent-token.html) documentation. Bug Fixes ********* * Fixes compatability with some hardware that requires the file name of any virtual media to end with the suffix ".iso" when Ironic generates a virtual media image. We recommend operators generating their own virtual media files to name the files with proper extensions. * Fixes the deployment failure with Ussuri (and older) ramdisks that happens when another IPA command runs after "prepare_image". * Fixes an issue with the "ansible" deployment interface where automatic root deviec selection would accidently choose the system CD-ROM device, which was likely to occur when the ansible deployment interface was used with virtual media boot. The "ansible" deployment interface now ignores all Ramdisks, Loopbacks, CD-ROMs, and floppy disk devices. * Fixes an issue that caused in-band deploy steps inserted before "write_image" to be skipped when fast-track is used. * Fixes an issue where in-band deploy and clean steps were being cached across reboots of the agent. * Fixed iRMC inspection for getting MAC address. * Fixes an issue with agent token handling where the agent has not been upgraded resulting in an AgentAPIError, when the token is not required. The conductor now retries without sending an agent token. * Fixes a potential race in the hash ring code that could result in the hash rings never updated after their initial load. * Fixes the deprecated "idrac" hardware interface implementation "__init__" methods to call their base class "__init__" methods before emitting a log message warning about their deprecation. For more information, see story 2008197 (https://storyboard.openstack.org/#!/story/2008197) * Fixes an issue where agent heartbeats would be queued if a pre- existing lock was being held for the node which performed a heartbeat operation. The agent heartbeat implementation will no longer retry attempts to acquire an exclusive lock. * Prevents a take over from happening in the middle of a deploy step processing. This could happen if the RPC call "continue_node_deploy" is routed to a different conductor. * Fixes wiping the agent secret token on manual power off or reboot. Also makes sure to remove the agent URL since it may potentially change. * Fixes HTTP 500 when trying to unset the "protected" attribute via the CLI. * Fixes cleaning and managed inspection not respecting the "default_boot_mode" configuration option. * Fixes cleaning and managed inspection not following the standard boot mode handling logic, particularly, not trying to assert the requested boot mode if the driver allows it. * Fixes "redfish" BIOS interface "apply_configuration" cleaning/deploy step to work with Redfish Services that must be supplied the Distributed Management Task Force (DMTF) Redfish standard "@Redfish.SettingsApplyTime" annotation [1] to specify when to apply the requested settings, such as the Dell EMC integrated Dell Remote Acesss Controller (iDRAC). For more information, see story 2008163 (https://storyboard.openstack.org/#!/story/2008163) [1] http://redfish.dmtf.org/schemas/DSP0266_1.11.0.html#settings- resource * No longer silently ignores exceptions that happen when trying to run the next clean or deploy step. Other Notes *********** * The ironic conductor internal logic has been updated to return an error if no agent version has been submitted during a heartbeat. This is because versions have been transmitted by the agents for quite some time and support for the default use of agent token forces all agents to be updated. As such redundant code been removed and tests updated accordingly. * Communication with neutron is now using openstacksdk, removing the dependency on neutronclient. Changes in ironic 15.2.0..16.0.0 -------------------------------- 101fc2968 Add GPU reporting to idrac-wsman inspect interface 42d83a2bf Don't migrate away from iscsi if it is the default 68cea19d9 Minor agent version code cleanup 8bd138ca8 Support iRMC hardware type again 365005ba4 devstack: do not default to swift if SWIFT_ENABLE_TEMPURLS is False f2d5e88e0 Trivial: fix formatting in the prelude 0e399f750 Fix handling OctetString for pysnmp a1c5559fa Handle patching node /protected value with None 631fe9d8c Handle conductor_affinity earlier in the deployment process eae15a40e Update 'idrac' driver requirements for Victoria f0e0ef634 Redfish driver firmware update 9c171efdc Release notes prelude for the Victoria release 0c3f52ec9 Do not silently ignore exceptions when running next steps d3872cfcd Fix a race condition in the hash ring code 09f79416e Follow-up patch for iso less vmedia support bc628ac6e Route conductor notification RPC to the same conductor d5df36feb Fix invalid assert_has_calls b4fafd887 Adding changes for iso less vmedia support 76a6fca8d Use correct error handler instead of calling process_event('fail') 5ff3defb5 Fix deprecated 'idrac' interface '__init__'s 3e362dff5 Amend the agent_verify_ca release note to mention the configuration option 8d8d9de90 Add documentation for ISO boot 38349c5b8 Update release mappings and API history for 16.0 a0b28708b autospec for classmethods and staticmethods for Python < 3.7.4 cd2e557ac Release note updates for Victoria release 1a9020deb Update tests for Redfish BIOS apply_configuration 796e2302c Add Redfish BIOS interface to idrac HW type cb8cc0ca6 Expose agent_verify_ca in configuration and correctly handle booleans 29c507f0e Use tempdirs for /tftpboot, /httpboot creation tests 65d506639 Fix redfish BIOS to use @Redfish.SettingsApplyTime b0b71653c Make the standalone-redfish job voting d8dccc8d0 Deprecate the iscsi deploy interface ed0ef6cf5 Reduce VMs for multinode and standalone jobs 7d0661a1b Reduce grenade node count a141b6f17 Limit inspector jobs to 1 testing VM 4e8f664ea CI: Remove the build check for pre-build ramdisks only e6e774f52 Do not retry locking when heartbeating 6d36b0b78 Adds ilo-uefi-https boot interface to ilo5 1f0174bb4 Native zuulv3 grenade multinode multitenant 2773c5fb2 Allow configuring IPMI cipher suite a1bb35983 Clarify HPE Edgeline support ce6947755 Add redfish options to the generated docs bc04a42a9 Also wipe agent token on manual power off or reboot d87550049 Remove install unnecessary packages 19d97e656 Fix lower-constraints for Ubuntu Focal ab4fdb8e7 Add release note for dhcp-less deploy 5f9efb34e Handle default_boot_mode during cleaning/inspection with PXE/iPXE 3334b7177 Add 'agent_token' to heartbeat request c715e35c8 Follow-up patch for One Button Secure Erase clean step 2b676a686 Accept and use a TLS certificate from the agent 41f15dba6 clean up mac address with the pxe configuration files b5d5e5774 Change [agent]image_download_source=http f6b65cb68 Add an option to require TLS for agent callback_url 1154292d4 Allow HttpImageService to accept custom certificate 6ee91fc3a Adds few of the security dashboard parameters to capabilities 5b272b0c4 Remove token-less agent support fa383c916 Detail iPXE + LACP troubleshooting information ce46cc461 Do not assume that prepare_image is the last command to run 9fb4074bf OOB one button secure erase for iLO5 based HPE Proliant servers. 95f569ade Add missing log for clean failed 485126e8a Trivial: fix minor typo on RFC number 44cf63c23 Update deploy steps documentation 958f15a07 documentation: follow-up to file:// support in direct deploy 778d715b5 Enhance certificate verification for ilo harware type 747753f91 Add L3 boot section to the docs 840ce1666 Allow setting image_download_source per node 9ac5c0277 Support caching http:// images locally in the direct deploy c31cb7d99 Support file:/// images for the direct deploy ce39115fa Explicitely do not allocate initial space for virtual volumes f28d30eaf Feat: add ibmc hardware info support for devstack ed6f9a14e [trivial] remove emacs config from devstack script 02fc64a35 Remove absolute path with iptables when L3 enabled 5c467e7d3 Update nodes in notifications documentation 71f5cfb42 Suffix the ISO names with '.iso' 2e91f7b2b Remove the unused coding style modules 3945fa4c2 driver_internal_info in provision notifications 8fff98a6f Enforce autospec in ilo tests 269ada268 Enforce autospec in common tests c165f71a5 Decouple the ISO creation logic from redfish 0071d2846 Ansible deploy - Ignore invalid devices c9720b025 Move redfish-virtual-media to the back of supported_boot_interfaces e9bda223f Increase memory of tinyipa vms 7dd611dc5 Ensure in-band deploy steps are present in time for fast-track deployments dae84efd6 Fix network_data path for dhcpless deployments ff00047b4 Switch Ironic to openstacksdk for Neutron 90bb75b39 Fix: port attribute name propagate_uplink_status 26d08bdda Remove qemu-img rootwrap filter 9e7f1cb57 ISO ramdisk virtual media test enablement 3e9360fc3 Documentation update for ilo hardware type 2f184f7c4 Pass global-request-id to ironic-python-agent 30d9cb47e Handle an older agent with agent_token Diffstat (except docs and test files) ------------------------------------- api-ref/source/baremetal-api-v1-misc.inc | 4 + api-ref/source/parameters.yaml | 7 + devstack/lib/ironic | 113 +- devstack/tools/ironic/scripts/create-node.sh | 2 +- devstack/upgrade/upgrade.sh | 1 + driver-requirements.txt | 8 +- etc/ironic/rootwrap.d/ironic-images.filters | 6 - ironic/api/controllers/v1/node.py | 3 + ironic/api/controllers/v1/ramdisk.py | 24 +- ironic/api/controllers/v1/utils.py | 5 + ironic/api/controllers/v1/versions.py | 4 +- ironic/cmd/conductor.py | 12 - ironic/cmd/dbsync.py | 2 + ironic/common/hash_ring.py | 28 +- ironic/common/image_service.py | 38 +- ironic/common/images.py | 6 +- ironic/common/keystone.py | 24 +- ironic/common/neutron.py | 326 +++--- ironic/common/pxe_utils.py | 13 +- ironic/common/release_mappings.py | 28 +- ironic/conductor/cleaning.py | 2 + ironic/conductor/deployments.py | 19 +- ironic/conductor/manager.py | 59 +- ironic/conductor/rpcapi.py | 13 +- ironic/conductor/task_manager.py | 7 +- ironic/conductor/utils.py | 122 +- ironic/conf/agent.py | 26 +- ironic/conf/auth.py | 18 +- ironic/conf/default.py | 33 +- ironic/conf/ilo.py | 21 + ironic/conf/neutron.py | 6 +- ironic/conf/opts.py | 3 +- ironic/conf/redfish.py | 10 + ironic/db/api.py | 12 + ironic/db/sqlalchemy/api.py | 53 + ironic/dhcp/neutron.py | 38 +- ironic/drivers/base.py | 4 +- ironic/drivers/drac.py | 2 +- ironic/drivers/generic.py | 2 +- ironic/drivers/ilo.py | 6 + ironic/drivers/irmc.py | 2 - ironic/drivers/modules/agent.py | 81 +- ironic/drivers/modules/agent_base.py | 8 +- ironic/drivers/modules/agent_client.py | 75 +- .../ansible/playbooks/library/root_hints.py | 6 + ironic/drivers/modules/boot_mode_utils.py | 5 +- ironic/drivers/modules/deploy_utils.py | 158 ++- ironic/drivers/modules/drac/bios.py | 11 + ironic/drivers/modules/drac/inspect.py | 25 +- ironic/drivers/modules/drac/management.py | 3 +- ironic/drivers/modules/drac/power.py | 1 + ironic/drivers/modules/drac/raid.py | 1 + ironic/drivers/modules/drac/vendor_passthru.py | 1 + ironic/drivers/modules/ilo/boot.py | 567 +++++++-- ironic/drivers/modules/ilo/common.py | 155 ++- ironic/drivers/modules/ilo/inspect.py | 4 +- ironic/drivers/modules/ilo/management.py | 48 +- ironic/drivers/modules/ilo/raid.py | 6 +- ironic/drivers/modules/image_utils.py | 534 +++++++++ ironic/drivers/modules/ipmitool.py | 35 +- ironic/drivers/modules/irmc/bios.py | 2 - ironic/drivers/modules/irmc/boot.py | 6 - ironic/drivers/modules/irmc/inspect.py | 4 +- ironic/drivers/modules/irmc/power.py | 2 - ironic/drivers/modules/irmc/raid.py | 2 - ironic/drivers/modules/iscsi_deploy.py | 5 + ironic/drivers/modules/network/common.py | 39 +- ironic/drivers/modules/network/flat.py | 16 +- ironic/drivers/modules/pxe_base.py | 3 +- ironic/drivers/modules/redfish/bios.py | 9 +- ironic/drivers/modules/redfish/boot.py | 465 +------- ironic/drivers/modules/redfish/management.py | 337 ++++++ ironic/drivers/modules/redfish/utils.py | 65 +- ironic/drivers/redfish.py | 6 +- ironic/objects/node.py | 7 +- ironic/objects/notification.py | 12 +- .../common/json_samples/neutron_port_show.json | 4 +- .../json_samples/neutron_port_show_ipv6.json | 2 +- .../unit/drivers/modules/drac/test_inspect.py | 115 +- .../drivers/modules/ilo/test_firmware_processor.py | 2 +- .../unit/drivers/modules/ilo/test_management.py | 68 +- .../drivers/modules/intel_ipmi/test_intel_ipmi.py | 3 +- .../unit/drivers/modules/irmc/test_inspect.py | 23 +- .../unit/drivers/modules/network/test_flat.py | 22 +- .../unit/drivers/modules/network/test_neutron.py | 127 +- .../unit/drivers/modules/redfish/test_bios.py | 71 +- .../unit/drivers/modules/redfish/test_boot.py | 494 ++------ .../drivers/modules/redfish/test_management.py | 564 +++++++++ .../unit/drivers/modules/redfish/test_utils.py | 17 + .../unit/drivers/modules/test_agent_client.py | 125 +- .../unit/drivers/modules/test_boot_mode_utils.py | 11 + .../unit/drivers/modules/test_deploy_utils.py | 150 ++- .../unit/drivers/modules/test_iscsi_deploy.py | 7 +- .../unit/drivers/third_party_driver_mock_specs.py | 4 + lower-constraints.txt | 19 +- .../run.yaml | 173 --- .../legacy/ironic-dsvm-base-multinode/post.yaml | 15 - .../legacy/ironic-dsvm-base-multinode/pre.yaml | 22 - ...uefi-https-boot-interface-f3b163a8a6243283.yaml | 7 + .../add-iso-less-vmedia-ilo-5816922c03d0fd85.yaml | 18 + .../notes/add-iso-suffix-557a4fc4382fd7f3.yaml | 7 + ...urity_capabilities_to_ilo-1ff11b01e5930cc7.yaml | 9 + .../notes/agent-uuid-5d86bc18849acda3.yaml | 5 + .../notes/agent-verify-ca-6efa3dfc469bab02.yaml | 4 + .../notes/agent-verify-ca-ddbfbb0f27198d82.yaml | 3 +- ...om_certificate_validation-8ba00759ed79e429.yaml | 5 + ...ble-device-name-filtering-0adfca7d8ba4cbcc.yaml | 9 + .../notes/dhcpless-deploy-4b91de74adeff781.yaml | 9 + .../notes/direct-file-6f80728d76093530.yaml | 4 + .../notes/fast-track-steps-81bd79a2a91e1b30.yaml | 8 + .../fix-irmc-inspection-c9ae3864a96b2588.yaml | 4 + ...andle-older-agent-command-5930124fd03bb327.yaml | 6 + releasenotes/notes/hash-ring-6ce212ab86c2592d.yaml | 5 + .../notes/http-local-4e8f32c6d5309f12.yaml | 7 + ...add-gpu-reporting-support-f4d80e2071f85f6a.yaml | 8 + ...-add-redfish-bios-support-3633d2fc94d31f62.yaml | 19 + ...-idrac-interface-__init__-362696b389c86d5d.yaml | 8 + ...-verification-enhancement-8eefd541cfc2a9da.yaml | 12 + ...b-one-button-secure-erase-f55628f8aa767c20.yaml | 9 + .../image-download-http-976c82f440c61c96.yaml | 7 + .../image_download_source-842282c70b226e93.yaml | 6 + .../notes/ipmi-cipher-suite-499097740f7c86ee.yaml | 5 + .../notes/iscsi-deprecation-eb184141f88e7182.yaml | 16 + ...nor-agent-version-cleanup-842e3919a366b9d6.yaml | 8 + .../no-heartbeat-retries-d6837684e7257249.yaml | 7 + .../no-tokenless-agents-c6c16d79ccc0da7a.yaml | 20 + ...ions_driver_internal_info-3012f9834b6ade6b.yaml | 5 + .../notes/notify-topic-451493784ce45e73.yaml | 6 + .../notes/power-off-token-0403e8a054f31125.yaml | 5 + .../prelude-for-victoria-e65b4c63ce1e1a7a.yaml | 26 + .../notes/protected-unset-0620b844afbb635e.yaml | 5 + .../notes/pxe-boot-mode-9084ccf35e54bbc0.yaml | 9 + .../redfish-firmware-update-a06d0624325a66ca.yaml | 9 + ...-bios-settings-apply-time-9b50979d2afc0d27.yaml | 14 + .../notes/redfish-priorities-adf4b7bfbee0ca25.yaml | 13 + ...nclient-with-openstacksdk-20c06d9d0316c2df.yaml | 10 + .../notes/require-tls-3880e6bec3075f4d.yaml | 5 + .../notes/spawn-error-2249f94606388fbd.yaml | 5 + ...support-irmc-driver-again-589db26927e32847.yaml | 5 + requirements.txt | 9 +- setup.cfg | 2 + test-requirements.txt | 5 +- tox.ini | 4 - zuul.d/ironic-jobs.yaml | 235 +++- zuul.d/legacy-ironic-jobs.yaml | 46 - zuul.d/project.yaml | 11 +- 205 files changed, 8171 insertions(+), 3392 deletions(-) Requirements updates -------------------- diff --git a/driver-requirements.txt b/driver-requirements.txt index 539d27ba9..b00680fa2 100644 --- a/driver-requirements.txt +++ b/driver-requirements.txt @@ -7 +7 @@ -proliantutils>=2.9.5 +proliantutils>=2.10.0 @@ -10 +10 @@ python-scciclient>=0.8.0 -python-dracclient>=3.1.0,<5.0.0 +python-dracclient>=5.1.0,<6.0.0 @@ -14 +14 @@ python-xclarityclient>=0.1.6 -sushy>=3.2.0 +sushy>=3.4.0 @@ -23 +23 @@ python-ibmcclient>=0.2.2,<0.3.0 -sushy-oem-idrac<=1.0.0 +sushy-oem-idrac<2.0.0 diff --git a/requirements.txt b/requirements.txt index 9f7593b3c..b36a38789 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5,2 +5,2 @@ pbr!=2.1.0,>=2.0.0 # Apache-2.0 -SQLAlchemy!=1.1.5,!=1.1.6,!=1.1.7,!=1.1.8,>=1.0.10 # MIT -alembic>=0.9.6 # MIT +SQLAlchemy>=1.2.19 # MIT +alembic>=1.4.2 # MIT @@ -11 +10,0 @@ python-cinderclient!=4.0.0,>=3.3.0 # Apache-2.0 -python-neutronclient>=6.7.0 # Apache-2.0 @@ -22 +21 @@ oslo.context>=2.19.2 # Apache-2.0 -oslo.db>=4.40.0 # Apache-2.0 +oslo.db>=6.0.0 # Apache-2.0 @@ -46 +45 @@ tooz>=2.7.0 # Apache-2.0 -openstacksdk>=0.37.0 # Apache-2.0 +openstacksdk>=0.48.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 4d3bdfcea..fb628fe40 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -9 +9 @@ fixtures>=3.0.0 # Apache-2.0/BSD -PyMySQL>=0.7.6 # MIT License +PyMySQL>=0.8.0 # MIT License @@ -14 +14 @@ stestr>=1.0.0 # Apache-2.0 -psycopg2>=2.7.3 # LGPL/ZPL +psycopg2>=2.8.5 # LGPL/ZPL @@ -18,0 +19 @@ pycodestyle>=2.0.0,<2.6.0 # MIT +pysnmp>=4.4.12

1 0

bifrost 9.0.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are excited to announce the release of: bifrost 9.0.0: Deployment of physical machines using OpenStack Ironic and Ansible This release is part of the victoria release series. The source is available from: https://opendev.org/openstack/bifrost Download the package from: https://tarballs.openstack.org/bifrost/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/bifrost For more details, please see below. 9.0.0 ^^^^^ New Features ************ * Adds support to install the Ironic Prometheus Exporter. It can be done through the "bifrost-cli" using "--enable-prometheus-exporter" option, or when setting *enable_prometheus_expoter=True* when deploying. * The first IPv4 address of the "network_interface" is now used for ironic and ironic-inspector API URLs in "clouds.yaml" in "openrc" instead of "localhost". Use "ironic_api_url" and "ironic_inspector_api_url" to override. * The "bifrost-keystone-client-config" role now validates that CLI access actually works with the generated configuration, use "skip_validation=false" to disable. * Supports TLS configuration by setting "enable_tls=true" and, optionally, "generate_tls=true". The corresponding "bifrost-cli" argument is "--enable-tls" (auto-generated certificates only). * The "bifrost-ironic-install" role now validates that the services have been started successfully, use "skip_validation" to disable. Known Issues ************ * Because of Ansible dependencies Bifrost only works on virtual environments created with "--system-site-packages". * When using Keystone for authentication, it may not be possible to disable TLS after enabling it if the certificate is in a non- standard location. * Due to upgrade limitations, it may not be possible to enable TLS on upgrading from a previous version. Do an upgrade first, then enable TLS in a separate installation step. Upgrade Notes ************* * The "use_public_urls" parameter is no longer supported, just provide "public_ip" instead. * Bifrost no longer adds ironic and ironic-inspector endpoints to the public firewalld zone, the operator has to do it explicitly if external access is expected. * Support for the legacy CSV inventory format has been removed, only JSON and YAML are supported now. * Support for installing and using RabbitMQ has been removed. * Support for storing introspection data in nginx has been removed. It was useful before ironic-inspector started supporting storing data in the database, which is the default nowadays. * Support for the OpenStack MetaData version 2012-08-10 has been removed from the "bifrost-configdrives-dynamic" role. The newest supported metadata version is now 2015-10-15. * The deprecated parameter "node_network_info" has been removed, use "node_network_data" instead. * Adds the explicit setting of file access permissions to get_url calls in bifrost ansible playbooks to ensure that the contents of "/httpboot" are world-readable independently of which Ansible version is in use. * Packaged iPXE ROMs are now used by default on openSUSE, set "download_ipxe=true" to override. * Bifrost will no longer kill all running dnsmasq processes for you. If you have dnsmasq processes that are not managed by systemd, you have to stop them yourself. * No longer supports installation outside of a virtual environment. The parameter "enable_venv" has been removed. Bug Fixes ********* * Fixes an issue where the bifrost-create-dib-image role overrides any existing ELEMENTS_PATH environment variable value. This fix appends any existing ELEMENTS_PATH value to the path set in the role. * Changes to keystone endpoint configuration are now automatically reflected on existing endpoints. * Correctly updates repositories copied with "copy_from_local_path". * When copying repositories using "copy_from_local_path", make sure they are consistently owned by the local user. Previously some repositories could end up owned by "root". * Correctly updates IPA images checksums on a major upgrade. * Automatically enables DHCP and TFTP services in firewalld on CentOS/RHEL. * Instead of modifying the "public" firewalld zone, creates a new zone "bifrost" and puts the "network_interface" in it. Set "firewalld_internal_zone=public" to revert to the previous behavior. * Makes "/var/lib/ironic" and its images subdirectories readable by nginx. This is required for using the images cache. * Fixes ACL of PXE and iPXE boot files to make sure they are world- readable. * Resolves the issue with ansible versions 2.9.12 and 2.8.14 where implicit setting of file permissions on files downloaded with get_url calls results in overly restrictive permissions. This leads to access denied while attempting to read the contents of "/httpboot" and results in failed deployments. * Ensures that repositories are consistently owned by the calling user. * Removes the "test_vm_network_enable_dhcp" option and disables DHCP on the libvirt network instead of unconditionally killing all dnsmasq processes on the machine. * Adds correct SELinux context for "/tftpboot". Other Notes *********** * The file "env-vars" has been removed. It contains variables that only work for no-auth mode and only for ironic itself (not inspector). Use the generated "clouds.yaml" or "openrc" in the home directory. * The primary supported version of Ubuntu is now 20.04 (Focal). Ubuntu 18.04 (Bionic) is still supported, but may be removed in a future release. * Ironic JSON RPC is now always authenticated, even in no-auth mode. * Removes the no longer used "transform_boot_image" variable. Changes in bifrost 8.3.0..9.0.0 ------------------------------- 4f175fd Add ipe installation to bifrost ac9eab4 Document a potential issue with firewalld and SSH a454be2 Always default skip_validation to skip_start 120fc5d Switch integration testing to Ubuntu Focal 813e323 Add some interfaces for development hardware types d550a1f bifrost-configdrives-dynamic: automatically find ed25519 SSH keys eaa04b1 bifrost-cli: do not provide any release if non can be detected dc57b72 Fix internal_ip detection in {enroll,deploy}-dynamic 90a98d0 Move CLI validation to bifrost-keystone-client-config 0ef62ca Ensure that repositories are owned by the running users 0c242fa test-bifrost: use existing playbooks 20863aa Cleanup test-bifrost.yaml 8a4e36a Correct the auth_strategy value (noauth instead of none) cd3fcaf Recover support for installing stable/ussuri 08339c3 Discourage using non-matching versions of Bifrost and Ironic 736eccf redfish-emulator: log handled requests 8cce676 Remove install unnecessary packages 3fcd7c5 [CI] Check with Kolla Ansible 321c823 Fix l-c testing for Ubuntu Focal (py38) 7e8e60f Re-download checkums on upgrades and updates c7f3935 Force updating repos with copy_from_local_path 3d07f8e Remove transform_boot_image a874c7a Always setup environment in bifrost-cli and make it less verbose 28c0848 Remove unnecessary overrides of ansible_python_interpreter 5e7f72a Fix install on systems without systemd e4ad94c Follow up on "Fix error 601" ddafc94 TLS support for API services e4d0325 Fix error 601 ea4ee59 Use packaged iPXE ROMs for openSUSE 710e0db Create our own firewalld zone and use it on real bare metal eb8d858 Workaround for setuptools 50.0 2e6ce41 ansible-lint: fix error 602 4140536 ansible-lint: fix error 504 0eee2d0 ansible-lint: fix error 206 ef51bdc Let us finish the rabbit hunt ee5fb69 Update keystone documentation 114c210 Move services to internal_ip by default and refactor endpoint creation 807700c Change LANG in install-deps.sh to en_US.UTF-8 57edf29 Make /var/lib/ironic/{,images,master_images} readable by nginx 5befa87 Disable DHCP on the libvirt network rather than doing `killall dnsmasq` 3aacfd3 Add correct SELinux context for /tftpboot and fix map-file ACL 9a026a7 Allow custom elements by appending existing ELEMENTS_PATH var fc022bd Trivial: remove a reference to update-rc.d 1f37c41 Explicitly set permissions on /httpboot contents 04a6973 Remove support for OpenStack MetaData version 2012-08-10 156a316 Authentication JSON RPC even in no-auth mode 7445e6f Stop supporting storing introspection data in nginx 790f81c Remove support for the legacy CSV format 2cf2125 Remove support for non-venv deployments b51efc1 ansible-lint: fix errors 303, 305, 306 62a803f ansible-lint: fix error 204 (Lines should be no longer than 160 chars) 6f825b0 Add a CI job with ansible-lint 3b52787 Remove env-vars 2eabfd7 Make the iPXE and PXE boot files world-readable 6e1bae9 Explicitly enable DHCP services on baremetal CentOS/RHEL d203955 dynamic: always use clouds.yaml when it is available df33abf Validate that the services are running after installation Diffstat (except docs and test files) ------------------------------------- .ansible-lint | 10 + bifrost/cli.py | 55 ++--- bifrost/inventory.py | 144 +------------ env-vars | 2 - lower-constraints.txt | 2 +- playbooks/ci/run.yaml | 3 +- playbooks/cleanup-deployment-images.yaml | 6 +- playbooks/deploy-dynamic.yaml | 5 + playbooks/enroll-dynamic.yaml | 7 +- playbooks/example-deploy-all-available-nodes.yaml | 14 +- playbooks/install.yaml | 17 +- playbooks/inventory/group_vars/localhost | 5 - playbooks/inventory/group_vars/target | 5 - playbooks/redeploy-dynamic.yaml | 21 +- playbooks/roles/bifrost-cloud-config/README.md | 4 + .../roles/bifrost-cloud-config/defaults/main.yml | 11 + .../roles/bifrost-cloud-config/tasks/main.yml | 35 +++- .../bifrost-configdrives-dynamic/defaults/main.yml | 12 +- .../bifrost-configdrives-dynamic/tasks/main.yml | 43 ++-- .../tasks/ssh_public_key_path.yaml | 36 +++- .../tasks/update_facts_from_ironic.yaml | 1 + .../bifrost-configdrives-dynamic/vars/main.yml | 5 - .../defaults/main.yml | 3 +- .../tasks/create_bootable_image.yml | 37 ++-- .../bifrost-create-bootable-image/tasks/main.yml | 2 +- .../bifrost-create-dib-image/defaults/main.yml | 3 +- .../roles/bifrost-create-dib-image/tasks/main.yml | 124 ++++++++---- playbooks/roles/bifrost-create-vm-nodes/README.md | 11 +- .../bifrost-create-vm-nodes/defaults/main.yml | 6 +- .../bifrost-create-vm-nodes/tasks/create_vm.yml | 8 +- .../roles/bifrost-create-vm-nodes/tasks/main.yml | 80 +++----- .../tasks/prepare_libvirt.yml | 8 +- .../bifrost-create-vm-nodes/templates/net.xml.j2 | 8 +- .../templates/redfish-emulator.service.j2 | 10 +- .../templates/vbmcd.service.j2 | 7 +- .../bifrost-deploy-nodes-dynamic/defaults/main.yml | 3 +- .../bifrost-deploy-nodes-dynamic/tasks/main.yml | 14 +- playbooks/roles/bifrost-ironic-install/README.md | 21 +- .../roles/bifrost-ironic-install/defaults/main.yml | 65 ++++-- .../defaults/required_defaults_Suse_family.yml | 11 +- .../bifrost-ironic-install/tasks/bootstrap.yml | 200 +++++++++--------- .../tasks/create_tftpboot.yml | 71 +++++-- .../tasks/download_ipa_image.yml | 92 +++++---- .../bifrost-ironic-install/tasks/get_ipxe.yml | 8 +- .../bifrost-ironic-install/tasks/hw_types.yml | 11 +- .../tasks/inspector_bootstrap.yml | 44 +++- .../roles/bifrost-ironic-install/tasks/install.yml | 12 +- .../bifrost-ironic-install/tasks/ironic_config.yml | 11 +- .../tasks/keystone_setup.yml | 224 +++++++-------------- .../tasks/keystone_setup_inspector.yml | 178 ++++++---------- .../roles/bifrost-ironic-install/tasks/main.yml | 33 +-- .../bifrost-ironic-install/tasks/migrations.yml | 7 +- .../tasks/prometheus_exporter_install.yml} | 26 +-- .../tasks/prometheus_exporter_start.yml | 38 ++++ .../tasks/set_ssh_private_key.yml | 10 +- .../tasks/setup_firewalld.yml | 50 +++++ .../roles/bifrost-ironic-install/tasks/start.yml | 30 ++- .../bifrost-ironic-install/tasks/validate.yml | 97 +++++++++ .../templates/inspector-default-boot-ipxe.j2 | 2 +- .../templates/ironic-inspector.conf.j2 | 28 ++- .../ironic-prometheus-exporter.service.j2 | 10 + .../templates/ironic.conf.j2 | 57 ++++-- .../bifrost-ironic-install/templates/nginx.conf.j2 | 8 - .../defaults/main.yml | 21 +- .../bifrost-keystone-client-config/tasks/main.yml | 11 +- .../tasks/validate.yml | 60 ++++++ .../templates/clouds.yaml.j2 | 15 ++ .../templates/openrc.j2 | 4 + .../bifrost-keystone-install/defaults/main.yml | 18 +- .../bifrost-keystone-install/tasks/bootstrap.yml | 73 ++++--- .../roles/bifrost-keystone-install/tasks/main.yml | 41 ++-- .../roles/bifrost-keystone-install/tasks/start.yml | 3 +- .../bifrost-keystone-install/tasks/upgrade.yml | 121 +++++++++++ .../templates/keystone-admin.ini.j2 | 4 +- .../templates/keystone-public.ini.j2 | 4 +- .../nginx_conf.d_bifrost-keystone.conf.j2 | 12 ++ .../roles/bifrost-pip-install/defaults/main.yml | 3 +- playbooks/roles/bifrost-pip-install/tasks/main.yml | 30 +-- .../bifrost-prep-for-install/defaults/main.yml | 13 +- .../roles/bifrost-prep-for-install/tasks/main.yml | 27 ++- .../defaults/main.yml | 7 +- .../tasks/main.yml | 8 +- playbooks/roles/bifrost-rabbitmq/defaults/main.yml | 11 - playbooks/roles/bifrost-rabbitmq/tasks/main.yml | 62 ------ .../roles/bifrost-test-dhcp/files/test-dhcp.py | 24 --- playbooks/roles/bifrost-test-dhcp/tasks/main.yml | 4 +- playbooks/roles/bifrost-tls/README.md | 86 ++++++++ playbooks/roles/bifrost-tls/defaults/main.yml | 34 ++++ playbooks/roles/bifrost-tls/tasks/main.yml | 54 +++++ .../defaults/main.yml | 3 +- .../tasks/main.yml | 1 + .../roles/ironic-delete-dynamic/defaults/main.yml | 3 +- .../roles/ironic-delete-dynamic/tasks/main.yml | 1 + .../roles/ironic-enroll-dynamic/defaults/main.yml | 3 +- .../roles/ironic-enroll-dynamic/tasks/main.yml | 3 +- .../roles/ironic-inspect-node/defaults/main.yml | 3 +- playbooks/roles/ironic-inspect-node/tasks/main.yml | 7 +- playbooks/test-bifrost-create-vm.yaml | 20 +- playbooks/test-bifrost.yaml | 100 ++------- releasenotes/notes/add-ipe-1f57e04d2881215f.yaml | 6 + .../allow-custom-elements-05c9495c8fd840e8.yaml | 7 + releasenotes/notes/api-url-a6f79de3cc8b0e3d.yaml | 15 ++ .../notes/cli-validate-474e15ba9631e72f.yaml | 6 + .../copy_from_local_path-8aff180483e6bced.yaml | 8 + .../download-ipa-upgrade-91e0fc4beea7419e.yaml | 4 + releasenotes/notes/env-vars-f07a4779a881c039.yaml | 6 + .../notes/firewalld-services-4c255c02d8d427f8.yaml | 4 + .../notes/firewalld-zone-d8c72fb5924a4916.yaml | 11 + releasenotes/notes/focal-e40fdd37d11faac9.yaml | 5 + .../notes/images-permissions-2042490e3ca13656.yaml | 5 + .../notes/interpreter-a6cd3a98e9cd239f.yaml | 5 + .../notes/json-rpc-auth-2430cc7432cbfe10.yaml | 4 + releasenotes/notes/no-csv-b7f149e88aba1b85.yaml | 5 + releasenotes/notes/no-rabbit-95434aaea3bb5528.yaml | 4 + .../notes/no-store-nginx-75bc3f9068fb8f78.yaml | 6 + .../notes/old-network-info-33a853faf6d6c6d0.yaml | 8 + releasenotes/notes/pxe-acl-26f3be809caa0c88.yaml | 4 + .../notes/releasenote-341a5eebe6168aea.yaml | 13 ++ .../notes/repo-owner-41db02a4d0406a7a.yaml | 4 + releasenotes/notes/suse-ipxe-ce4f1bf07db78860.yaml | 5 + ...st_vm_network_enable_dhcp-78923ef94b44e6d1.yaml | 11 + .../notes/tftp-context-6f918743ba9052b0.yaml | 4 + releasenotes/notes/tls-988e725820bb8aca.yaml | 14 ++ .../transform_boot_image-16fe26bd1a849aa0.yaml | 3 + releasenotes/notes/validate-261b92bc614f5d4a.yaml | 5 + .../notes/venv-forever-ba8b85b04a28a293.yaml | 5 + scripts/env-setup.sh | 45 ++--- scripts/install-deps.sh | 78 +++---- scripts/test-bifrost.sh | 12 +- tools/ansible-lint.sh | 25 +++ tools/vagrant_dev_env/vagrant.yml | 6 +- tox.ini | 9 +- zuul.d/bifrost-jobs.yaml | 42 +++- zuul.d/project.yaml | 38 +++- 143 files changed, 2198 insertions(+), 1735 deletions(-)

1 0

ironic-python-agent 6.4.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are psyched to announce the release of: ironic-python-agent 6.4.0: Ironic Python Agent Ramdisk This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- python-agent For more details, please see below. 6.4.0 ^^^^^ New Features ************ * Enables support in IPA for hosting the API server over TLS. Using this support requires setting "[DEFAULT]listen_tls" to True, and then setting "[ssl]cert_file", "[ssl]key_file", and optionally "[ssl]ca_file" to files embedded in the ramdisk IPA runs inside. * When a recent enough version of ironic is detected and "listen_tls" is "False", agent will now generate a self-signed TLS certificate and send it to ironic on heartbeat. This ensures encrypted communication from ironic to the agent. Set "enable_auto_tls" to "False" to disable this behavior. * The "logs" inspection collector is now enabled by default, change "ipa-inspection-collectors" to disable. Upgrade Notes ************* * IPA heartbeat intervals now rely on accurate clock time. Any clean or deploy steps which attempt to sync the clock may cause heartbeats to not be emitted. IPA syncs time at startup and shutdown, so these steps should not be required. Bug Fixes ********* * Fixes an issue with nodes undergoing fast-track from introspection to deployment where the agent internal cache of the node may be stale. In particular, this can be observed if node does not honor a root device hint which is saved to Ironic's API *after* the agent was started. More information can be found in story 2008039 (https://storyboard.openstack.org/#!/story/2008039) * Fixes a minor incorrect keyword argument that was matching between the method caller and the unit test but not the actual method, unit test, and caller. This was a non-fatal issue, and should now permit the agent to attempt to lookup the node one last time before deploying the instance image to pick-up a root device hint. * Fixes an issue with the IntelCnaHardwareManager which prevented hardware managers with lower priority to be executed and therefore may blocked the initialization and collection of hardware these managers are supposed to take care of. * Fixes a bug where the partitions created during software RAID setup are cleaned too early and therefore may prevent the proper cleaning of the md superblocks. Leaving superblocks behind will impact the creation of new md devices later on. * Detects md component devices by their UUID, rather than by scanning the output of mdadm. This will prevent that devices miss md superblock cleanup when they are currently not part of an array. * Since the Ussuri release, IPA has ignored the listen_host and listen_port directives. This fixes the behavior and restores those configuration values to working status. https://storyboard.openstack.org/#!/story/2008016 Other Notes *********** * Adds an explicit capture of connectivity failures in the heartbeat process to provide a more verbose error message in line with what is occuring as opposed to just indicating that an error occured. This new exception is called "HeartbeatConnectionError" and is likely only going to be visible if there is a local connectivity failure such as a router failure, switchport in a blocking state, or connection centered transient failure. Changes in ironic-python-agent 6.3.0..6.4.0 ------------------------------------------- 044c64d Software RAID: Get component devices by md UUID c7aec77 Software RAID: Don't delete partitions too early 565d596 Document ramdisk TLS and update existing TLS docs 4b0ef13 Fix: make Intel CNA hardware manager none generic a01646f Simplify heartbeating by removing use of select() afb521d CI: Lower memory usage of VMs/Increase swap 8f49757 Documentation: fix incorrect step names fe6b687 When reporting that agent is busy, report the executed command 9dd968f [doc] Clarify custom hardware manager inheritance 021e0a6 Generate a TLS certificate and send it to ironic 6a80564 Refactor API version negotiation code 08fdae9 Fix l-c 3426963 Fix backup node lookup 9b75453 Fix and run the correct functional tests job 63513ae Remove unused jobs 85bd44d Prepare to move ipa-builder jobs 1d11f0b If listen_tls is true, enable TLS on wsgi server 700c14c Move ironic-standalone-ipa-src to Ubuntu Focal 4716669 Replace oslo's loopingcall with tenacity 7d0ad36 Make WSGI server respect listen_* directives d3c3d4d Update the cache if we don't have a root device hint ffacb71 Document in-band deploy steps and add more docs for custom steps 3faf13b Refactor and fix documentation 82c7043 Remove experimental jobs d415287 Revert "Temporary disable multiple jobs to land CI fixes." 2a5ba7e Increase memory for tinyipa jobs 9ebab1b Temporary disable multiple jobs to land CI fixes. f670f70 Clarify connection error on heartbeats d50ff06 Enable the logs collection by default ba6ca24 Add possibility to pass global request ID Diffstat (except docs and test files) ------------------------------------- ironic_python_agent/__init__.py | 8 + ironic_python_agent/agent.py | 91 +++++---- ironic_python_agent/api/app.py | 25 ++- ironic_python_agent/config.py | 26 ++- ironic_python_agent/errors.py | 19 ++ ironic_python_agent/extensions/base.py | 2 +- ironic_python_agent/extensions/iscsi.py | 3 +- ironic_python_agent/extensions/standby.py | 6 +- ironic_python_agent/hardware.py | 143 +++++++++++--- ironic_python_agent/hardware_managers/cna.py | 23 +-- ironic_python_agent/ironic_api_client.py | 69 ++++--- ironic_python_agent/tls_utils.py | 111 +++++++++++ lower-constraints.txt | 6 +- .../add-optional-tls-support-3ab6a834154fedec.yaml | 8 + releasenotes/notes/auto-tls-b52b873663f35618.yaml | 8 + .../change-heartbeat-method-d0119406137022e3.yaml | 7 + ...artbeat-connection-errors-2af152bf2d7928e2.yaml | 10 + .../fasttrack-stale-cache-fd93b56a955c7ab1.yaml | 9 + ...arly-node-lookup-argument-83d3f717c039e454.yaml | 9 + ...nx-hardware-mgr-never-run-72072580be4d6e7a.yaml | 7 + .../fix_partition_cleanup-46491861c930db12.yaml | 6 + ...get_md_components_by_uuid-7f08d423ea9e7c94.yaml | 6 + .../notes/inspector-logs-9b7c010c219691d2.yaml | 5 + ...respect-listen-directives-94fb863c5b692c07.yaml | 7 + requirements.txt | 4 +- zuul.d/ironic-python-agent-jobs.yaml | 98 ++-------- zuul.d/project.yaml | 8 +- 47 files changed, 1335 insertions(+), 469 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 28ea8ac..690a5b1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18,0 +19 @@ stevedore>=1.20.0 # Apache-2.0 +tenacity>=6.2.0 # Apache-2.0 @@ -20 +21,2 @@ ironic-lib>=4.1.0 # Apache-2.0 -Werkzeug>=0.15.0 # BSD License +Werkzeug>=1.0.1 # BSD License +cryptography>=2.3 # BSD/Apache-2.0

1 0

ironic-inspector 10.4.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We jubilantly announce the release of: ironic-inspector 10.4.0: Hardware introspection for OpenStack Bare Metal This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/ironic-inspector Download the package from: https://tarballs.openstack.org/ironic-inspector/ Please report issues through: https://storyboard.openstack.org/#!/project/944 For more details, please see below. 10.4.0 ^^^^^^ New Features ************ * Adds an "accelerators" plugin to identify acclerator devices and update the bare metal node for future scheduling. The accelerator devices will be saved to node properties under the key "accelerators". Introduces a configuration option "[accelerators]known_devices" to specify a configuration file which contains required information to identify accelerator devices, by default it uses the in-tree configuration file named "known_accelerators.yaml". * The dnsmasq pxe-filter now supports mapping between host InfiniBand MAC to EthernetOverInfiniBand MAC. (This was previously only supported by the iptables pxe-filter.) * By default the DHCP filtering will open the DHCP server for any node when introspection is active. It will only block DHCP for enrolled nodes that are not being introspected. Doing so is required to support interface discovery (which by default will enroll the pxe port to ironic if not present). This behaviour is not always wanted, as nodes not managed by ironic may boot the inspection image. A new option was added "[pxe_filter]deny_unknown_macs" which allow changeing this behaviour so that the DHCP server only allow enrolled nodes being introspected and deny everything else. Note: If this option is "True", nodes must have at least one enrolled port prior to introspection. Bug Fixes ********* * Fixes the node identification logic to enable a user to list the "redfish_address" label for "driver_info" field values for identification of a machine using the "[DEFAULT]ipmi_address_fields" configuration option. Previously the host would just not be matched as the full URL would be evaluated instead of what the URL may resolve to. Changes in ironic-inspector 10.3.0..10.4.0 ------------------------------------------ b4f008f Revert "Power off before inspection" 7a067a9 pxe filter - option to always block unknown hosts 245cbed Correct the docstring for _should_enable_unknown_hosts 2f6df39 Limit inspector jobs to 1 testing VM 4644981 Add NVIDIA V100 to known accelerator devices 9a89c30 Fix l-c and mysql GRANT syntex for Ubuntu Focal 34b264e Power off before inspection de2a27a Identify accelerator devices during introspection f4648fa Replace retrying with tenacity 6792848 Minor doc fix to kernel options bbc5cd7 Fix URL parsing to enable redfish_address matching 17f58aa Log outcome of `check_conditions` method. 6732d5e Follow up to incorrect pxe-enabled was set Diffstat (except docs and test files) ------------------------------------- ironic_inspector/common/ironic.py | 18 +- ironic_inspector/conf/__init__.py | 2 + ironic_inspector/conf/accelerators.py | 35 ++++ ironic_inspector/conf/default.py | 3 +- ironic_inspector/conf/iptables.py | 2 +- ironic_inspector/conf/pxe_filter.py | 9 + ironic_inspector/known_accelerators.yaml | 9 + ironic_inspector/node_cache.py | 3 +- ironic_inspector/plugins/accel_device.py | 78 ++++++++ ironic_inspector/pxe_filter/base.py | 77 ++++++++ ironic_inspector/pxe_filter/dnsmasq.py | 16 +- ironic_inspector/pxe_filter/iptables.py | 95 ++++------ ironic_inspector/rules.py | 13 +- ironic_inspector/test/functional.py | 2 +- ironic_inspector/test/unit/test_common_ironic.py | 37 ++++ .../test/unit/test_dnsmasq_pxe_filter.py | 54 +++++- ironic_inspector/test/unit/test_iptables.py | 205 ++++++++------------- ironic_inspector/test/unit/test_node_cache.py | 26 +++ .../test/unit/test_plugins_accel_device.py | 52 ++++++ ironic_inspector/test/unit/test_pxe_filter.py | 197 ++++++++++++++++++++ lower-constraints.txt | 11 +- .../notes/accelerators-2aa4f0cedf359810.yaml | 10 + ...e-filter-eoib-mac-support-7567bbc7c6bf1878.yaml | 6 + ...-deny-unknown-host-option-b84b2aa1f7f49a17.yaml | 17 ++ .../support_redfish_address-94eae2c0d2879f53.yaml | 8 + requirements.txt | 11 +- setup.cfg | 1 + tools/test-setup.sh | 4 +- zuul.d/ironic-inspector-jobs.yaml | 1 + 31 files changed, 791 insertions(+), 226 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index a31f8d9..bbf3a80 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ automaton>=1.9.0 # Apache-2.0 -alembic>=0.9.6 # MIT +alembic>=1.4.2 # MIT @@ -17,0 +18 @@ pytz>=2013.6 # MIT +PyYAML>=5.3.1 @@ -22 +23 @@ oslo.context>=2.19.2 # Apache-2.0 -oslo.db>=4.40.0 # Apache-2.0 +oslo.db>=6.0.0 # Apache-2.0 @@ -32 +33 @@ oslo.utils>=3.33.0 # Apache-2.0 -retrying!=1.3.0,>=1.2.3 # Apache-2.0 +tenacity>=6.2.0 # Apache-2.0 @@ -34,2 +35,2 @@ stevedore>=1.20.0 # Apache-2.0 -SQLAlchemy!=1.1.5,!=1.1.6,!=1.1.7,!=1.1.8,>=1.0.10 # MIT -tooz>=1.64.0 # Apache-2.0 +SQLAlchemy>=1.2.19 # MIT +tooz>=2.5.1 # Apache-2.0

1 0

ironic-ui 4.2.0 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We enthusiastically announce the release of: ironic-ui 4.2.0: Ironic plugin UI for Horizon to allow users to view and manage bare metal nodes, ports and drivers. This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/ironic-ui Download the package from: https://pypi.org/project/ironic-ui Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic-ui For more details, please see below. Changes in ironic-ui 4.1.0..4.2.0 --------------------------------- 927b4c2 [goal] Migrate testing to ubuntu focal Diffstat (except docs and test files) ------------------------------------- bindep.txt | 1 + ironic_ui/karma.conf.js | 2 +- lower-constraints.txt | 2 +- package.json | 2 +- 4 files changed, 4 insertions(+), 3 deletions(-)

1 0

ironic-prometheus-exporter 2.1.1 (victoria)
by no-reply＠openstack.org 02 Oct '20

02 Oct '20

We are stoked to announce the release of: ironic-prometheus-exporter 2.1.1: Prometheus Exporter for Ironic Hardware Sensor data This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/ironic-prometheus-exporter Download the package from: https://tarballs.openstack.org/ironic-prometheus-exporter/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/ironic- prometheus-exporter For more details, please see below. 2.1.1 ^^^^^ Bug Fixes * Fix an issue where IPE fails if the node does not have *node_name* set Changes in ironic-prometheus-exporter 2.1.0..2.1.1 -------------------------------------------------- 6e6f218 Fallback to `node_uuid` if`node_name` is not present 4ac00a8 Update ram to avoid Kernel Panic Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 +- ironic_prometheus_exporter/messaging.py | 5 +- ironic_prometheus_exporter/parsers/header.py | 9 +- ironic_prometheus_exporter/parsers/ipmi.py | 4 + ironic_prometheus_exporter/parsers/redfish.py | 6 +- .../json_samples/notification-empty-node_name.json | 17 + .../notification-ipmi-none-node_name.json | 2348 ++++++++++++++++++++ .../json_samples/notification-none-node_name.json | 17 + .../notification-redfish-none-node_name.json | 67 + .../notes/no-node_name-ae693f6a030fed5f.yaml | 4 + 13 files changed, 2615 insertions(+), 9 deletions(-)

1 0

oslo.privsep 2.1.2 (ussuri)
by no-reply＠openstack.org 01 Oct '20

01 Oct '20

We high-spiritedly announce the release of: oslo.privsep 2.1.2: OpenStack library for privilege separation This release is part of the ussuri stable release series. The source is available from: https://opendev.org/openstack/oslo.privsep Download the package from: https://pypi.org/project/oslo.privsep Please report issues through: https://bugs.launchpad.net/oslo.privsep/+bugs For more details, please see below. 2.1.2 ^^^^^ Other Notes * The "oslo.privsep" client can be called from a program using eventlet. If "eventlet.monkey_patch", some libraries will be patched, for example "threading" or "os". When the root daemon is forked from the client process, those libraries remain patched. Now, when the daemon is forked from the client process, those libraries and methods are restored to the original values. The goal is to prevent some timeouts when using eventlet threads (user threads); system threads are preemptive and the code does not need to care about the executor token. Changes in oslo.privsep 2.1.1..2.1.2 ------------------------------------ 6d41ef9 Undo the eventlet monkey patch for the privileged daemon a376b53 Update TOX/UPPER_CONSTRAINTS_FILE for stable/ussuri 9b239b5 Update .gitreview for stable/ussuri Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + lower-constraints.txt | 2 +- oslo_privsep/daemon.py | 36 ++++++++++++++++++++++ ...y-patch-privileged-daemon-160e00296549df3d.yaml | 11 +++++++ requirements.txt | 2 +- tox.ini | 4 +-- 7 files changed, 80 insertions(+), 4 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 7228b1a..8541ac3 100644 --- a/requirements.txt +++ b/requirements.txt @@ -10 +10 @@ cffi>=1.7.0 # MIT -eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT +eventlet>=0.21.0 # MIT

1 0

manila-tempest-plugin 1.2.0 (victoria)
by no-reply＠openstack.org 01 Oct '20

01 Oct '20

We enthusiastically announce the release of: manila-tempest-plugin 1.2.0: Tempest plugin manila-tempest-plugin This release is part of the victoria release series. The source is available from: https://opendev.org/openstack/manila-tempest-plugin Download the package from: https://tarballs.openstack.org/manila-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/manila/+bugs For more details, please see below. Changes in manila-tempest-plugin 1.1.0..1.2.0 --------------------------------------------- e0c51e8 Keep few integration jobs running on Bionic 7836ae8 Fix export location sent to manage share operation b3089a7 Fix share server migration tests 125959e Don't ignore invalid export location ip version a6602ec Increase CephFS backing file size a98919f [Negative] Create share with non allowed share type 0d523bb Add tests for share server migration 1e115c5 Remove unused "_ping_host_from_export_location" method 88452b3 Add uuid for tests 4f0dbe0 Ping to export location until it is reachable d672a3e Add share resize scenario tests for CephFS Native 75f0d60 Revert CephFS test image to Bionic Beaver 2b30874 SSH over IPv4 when using a storage network d354d67 Remove experimental flag from share replication feature 1369e54 Fix skip condition for "test_default_share_group_type_applied" 1d1461d Add flake8-import-order extension to tox.ini 6db73a3 Ensure share server is created when driver handles share servers 58723ff Fixed InvalidConfiguration() exception to print correct message 842d08b Zuulv3 native "standalone" GlusterFS native, NFS jobs df804d8 Add Zuulv3 native jobs for the dummy driver 3cf113b Add py38 package metadata Diffstat (except docs and test files) ------------------------------------- .../services/share/json/shares_client.py | 2 +- .../services/share/v2/json/shares_client.py | 166 +++++++-- .../api/admin/test_export_locations_negative.py | 9 + .../api/admin/test_share_group_types_negative.py | 13 + .../api/admin/test_share_instances_negative.py | 3 + .../admin/test_share_servers_manage_negative.py | 8 + .../api/admin/test_share_servers_migration.py | 408 +++++++++++++++++++++ .../admin/test_share_servers_migration_negative.py | 392 ++++++++++++++++++++ .../api/admin/test_share_snapshot_instances.py | 5 + .../test_share_snapshot_instances_negative.py | 6 + .../api/admin/test_share_types_extra_specs.py | 7 + .../admin/test_share_types_extra_specs_negative.py | 33 ++ .../api/admin/test_snapshot_export_locations.py | 5 + .../test_snapshot_export_locations_negative.py | 9 + .../api/admin/test_snapshot_manage_negative.py | 5 + .../api/test_access_rules_metadata_negative.py | 3 + .../test_replication_export_locations_negative.py | 5 + .../api/test_security_services_mapping_negative.py | 13 + .../api/test_share_network_subnets_negative.py | 14 +- .../api/test_share_type_availability_zones.py | 6 + .../test_share_type_availability_zones_negative.py | 5 + .../api/test_shares_from_snapshot_across_pools.py | 3 + .../manila-tempest-plugin-standalone/post.yaml | 6 + .../manila-tempest-plugin-standalone/run.yaml | 11 + roles/set-tempest-config/README.rst | 19 + roles/set-tempest-config/defaults/main.yml | 3 + roles/set-tempest-config/tasks/main.yml | 14 + setup.cfg | 1 + test-requirements.txt | 1 + tox.ini | 9 +- zuul.d/manila-tempest-jobs.yaml | 285 +++++++++++++- zuul.d/project.yaml | 16 +- 109 files changed, 2395 insertions(+), 154 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index f230fa9..cf025c3 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -15,0 +16 @@ reno>=2.5.0 # Apache-2.0 +flake8-import-order

1 0