- Release-announce - lists.openstack.org

puppet-mistral 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We enthusiastically announce the release of: puppet-mistral 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-mistral Download the package from: https://tarballs.openstack.org/puppet-mistral/ Please report issues through: https://bugs.launchpad.net/puppet-mistral/+bugs For more details, please see below. Changes in puppet-mistral 24.0.0..25.0.0 ---------------------------------------- 32f9bc7 Prepare 2024.2 release a2686b3 Add support for [oslo_messaging_rabbit] enable_cancel_on_failover 142263f logging: Deprecate watch_log_file ef7b1d3 Expose rabbit_qos_prefetch_count f03be59 Add validations for keystone resource parameters 51da4c4 Add support for [healthcheck] enable_by_file_paths 264251d reno: Update master for unmaintained/zed 60a43f7 coordination: Remove heartbeat_interval 4e23484 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/coordination.pp | 18 +---------- manifests/healthcheck.pp | 7 +++++ manifests/init.pp | 13 ++++++++ manifests/keystone/auth.pp | 34 ++++++++++---------- manifests/logging.pp | 13 +++++--- metadata.json | 8 ++--- .../deprecate-watch_log_file-57d04617cbac6847.yaml | 4 +++ ...enable_cancel_on_failover-9917be4e60bc9d78.yaml | 5 +++ .../hc-enable_by_file_paths-be1bd2c96e55168f.yaml | 5 +++ ...rabbit_qos_prefetch_count-c8a97c06fc25d7e4.yaml | 4 +++ ...nation-heartbeat_interval-719d61392b7e7db7.yaml | 5 +++ releasenotes/source/2024.1.rst | 6 ++++ releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/mistral_healthcheck_spec.rb | 3 ++ spec/classes/mistral_init_spec.rb | 36 ++++++++++++---------- spec/classes/mistral_logging_spec.rb | 1 - 17 files changed, 103 insertions(+), 62 deletions(-)

1 0

puppet-openstacklib 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We jubilantly announce the release of: puppet-openstacklib 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-openstacklib Download the package from: https://tarballs.openstack.org/puppet-openstacklib/ Please report issues through: https://bugs.launchpad.net/puppet-openstacklib/+bugs For more details, please see below. Changes in puppet-openstacklib 24.0.0..25.0.0 --------------------------------------------- 776c388 Prepare 2024.2 release 2238cf2 Validate input for file mode 1a1b7cc Add type to validate policy hash input 9351c2e Stop manipulating LOAD_PATH in spec files fa070e6 Bump upper version of puppetlabs-mysql d689704 Remove support for json format policy files 103c0ab reno: Update master for unmaintained/zed b6e251d Elaborate usage of openstacklib::policy::policies 805e984 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/policy.pp | 32 +++++++--- manifests/policy/base.pp | 68 ++++++---------------- manifests/policy/default.pp | 31 ++-------- metadata.json | 4 +- .../notes/remove-policy-json-8902dc11c5576e73.yaml | 5 ++ releasenotes/source/2024.1.rst | 6 ++ releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/defines/openstacklib_policy_base_spec.rb | 64 ++------------------ spec/defines/openstacklib_policy_default_spec.rb | 31 +--------- spec/defines/openstacklib_policy_spec.rb | 41 ++----------- spec/spec_helper.rb | 3 + spec/type_aliases/policies_spec.rb | 36 ++++++++++++ .../provider/openstack_config/ini_setting_spec.rb | 16 ----- types/policies.pp | 8 +++ 15 files changed, 124 insertions(+), 224 deletions(-)

1 0

puppet-barbican 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We enthusiastically announce the release of: puppet-barbican 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-barbican Download the package from: https://tarballs.openstack.org/puppet-barbican/ Please report issues through: https://bugs.launchpad.net/puppet-barbican/+bugs For more details, please see below. Changes in puppet-barbican 24.0.0..25.0.0 ----------------------------------------- 6819e89 Prepare 2024.2 release 8bbaa1b Expose parameter to customize [oslo_messaging_notifications] retry b0f5ecb Add support for [oslo_messaging_rabbit] enable_cancel_on_failover d234232 logging: Deprecate watch_log_file a76c93a Expose rabbit_qos_prefetch_count f7e2d67 Expose configure_service aeda2af Use common format for service description 2f64e99 Add validations for keystone resource parameters 965812b Add support for [healthcheck] enable_by_file_paths da65faf reno: Update master for unmaintained/zed bff31cb Remove old note about database options 160f279 Remove purge of old database options 475bdd2 Remove parameters for certificate plugins 35a2f76 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/api.pp | 45 ++++++++++------------ manifests/api/logging.pp | 14 ++++--- manifests/db.pp | 12 ------ manifests/healthcheck.pp | 7 ++++ manifests/keystone/auth.pp | 42 +++++++++++--------- manifests/plugins/dogtag.pp | 45 +++------------------- metadata.json | 8 ++-- .../notes/configure_service-61ed7d0299efa5ab.yaml | 5 +++ .../deprecate-watch_log_file-a5c7aa7e5b963c9d.yaml | 5 +++ ...enable_cancel_on_failover-949ea5478cde4429.yaml | 5 +++ .../hc-enable_by_file_paths-dbe0857be8b08516.yaml | 5 +++ .../notes/notification-retry-e92962f26c9b9c89.yaml | 4 ++ ...rabbit_qos_prefetch_count-e1ed7f53831ee203.yaml | 5 +++ ...e-certificate-plugin-opts-d59847041c1d19fb.yaml | 10 +++++ releasenotes/source/2024.1.rst | 6 +++ releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/barbican_api_logging_spec.rb | 3 +- spec/classes/barbican_api_spec.rb | 11 +++++- spec/classes/barbican_healthcheck_spec.rb | 3 ++ spec/classes/barbican_keystone_auth_spec.rb | 11 ++++-- 21 files changed, 137 insertions(+), 112 deletions(-)

1 0

puppet-heat 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are happy to announce the release of: puppet-heat 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-heat Download the package from: https://tarballs.openstack.org/puppet-heat/ Please report issues through: https://bugs.launchpad.net/puppet-heat/+bugs For more details, please see below. Changes in puppet-heat 24.0.0..25.0.0 ------------------------------------- 390b5ff Prepare 2024.2 release 946b61d Expose parameter to customize [oslo_messaging_notifications] retry 23d4ce4 Add support for [oslo_messaging_rabbit] enable_cancel_on_failover 190cc62 Support [DEFAULT] max_*_api_microversion options e40faa4 logging: Deprecate watch_log_file 24445b4 Add validations for keystone resource parameters 1d2aa66 Add support for [DEFAULT] hidden_stack_tags d5cfc68 Expose rabbit_qos_prefetch_count 8af2640 Add support for [DEFAULT] template_fetch_timeout option 7651af1 Deprecate heat::clients::sahara a2e29e6 Add support for [healthcheck] enable_by_file_paths abbb1a7 Add missing test coverage for [DEFAULT] options f960819 reno: Update master for unmaintained/zed 051c308 Remove support for amqp1 messaging driver 00dc29e Validate auth_encryption_key by date type b4b3238 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/clients/sahara.pp | 3 + manifests/engine.pp | 30 +++-- manifests/healthcheck.pp | 7 ++ manifests/init.pp | 123 +++++---------------- manifests/keystone/auth.pp | 42 +++---- manifests/keystone/auth_cfn.pp | 34 +++--- manifests/logging.pp | 13 ++- metadata.json | 8 +- .../notes/deprecate-sahara-41ac42905be6985f.yaml | 5 + .../deprecate-watch_log_file-6342d0fbba934b04.yaml | 4 + ...enable_cancel_on_failover-6fe6805b6aeca8c2.yaml | 5 + .../engine-hidden_stack_tags-5e25b4ecf56893ce.yaml | 4 + .../hc-enable_by_file_paths-7f6e615f13f9964b.yaml | 5 + .../max-api-microversion-04c6d74e62f890ed.yaml | 7 ++ .../notes/notification-retry-11e012a40f003694.yaml | 4 + ...rabbit_qos_prefetch_count-9249a522b562467d.yaml | 4 + .../notes/remove-amqp1-8ac4d653bb0889e4.yaml | 4 + .../template_fetch_timeout-c1f6a9766346712d.yaml | 4 + releasenotes/source/2024.1.rst | 6 + releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/heat_engine_spec.rb | 35 +++--- spec/classes/heat_healthcheck_spec.rb | 3 + spec/classes/heat_init_spec.rb | 78 +++---------- spec/classes/heat_logging_spec.rb | 1 - spec/type_aliases/authencryptionkey_spec.rb | 40 +++++++ types/authencryptionkey.pp | 5 + 27 files changed, 250 insertions(+), 227 deletions(-)

1 0

puppet-gnocchi 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are psyched to announce the release of: puppet-gnocchi 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-gnocchi Download the package from: https://tarballs.openstack.org/puppet-gnocchi/ Please report issues through: https://bugs.launchpad.net/puppet-gnocchi/+bugs For more details, please see below. Changes in puppet-gnocchi 24.0.0..25.0.0 ---------------------------------------- 29f6749 Prepare 2024.2 release d86a775 logging: Deprecate unused watch_log_file option 3cae643 Add validations for keystone resource parameters cf80535 Add support for [storage] swift_container_prefix 7d7d2f5 Fix additional override for file incoming driver 103040a ceph: Simplify parameter validations 4fab961 Add support for [healthcheck] enable_by_file_paths 9feec88 reno: Update master for unmaintained/zed 7e77264 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/healthcheck.pp | 7 +++ manifests/keystone/auth.pp | 50 +++++++++++----------- manifests/logging.pp | 28 +++++++----- manifests/storage/ceph.pp | 25 +++++++---- manifests/storage/incoming/file.pp | 16 ++----- manifests/storage/swift.pp | 6 +++ metadata.json | 8 ++-- .../deprecate-watch_log_file-f29924b2bcb809f1.yaml | 5 +++ .../hc-enable_by_file_paths-40231ad5bbc4ae0f.yaml | 5 +++ .../swift_container_prefix-ea1aaa526fbd2a54.yaml | 5 +++ releasenotes/source/2024.1.rst | 6 +++ releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/gnocchi_healthcheck_spec.rb | 3 ++ spec/classes/gnocchi_logging_spec.rb | 19 ++++---- spec/classes/gnocchi_storage_incoming_file_spec.rb | 4 +- spec/classes/gnocchi_storage_swift_spec.rb | 5 ++- 17 files changed, 120 insertions(+), 75 deletions(-)

1 0

puppet-designate 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are amped to announce the release of: puppet-designate 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-designate Download the package from: https://tarballs.openstack.org/puppet-designate/ Please report issues through: https://bugs.launchpad.net/puppet-designate/+bugs For more details, please see below. Changes in puppet-designate 24.0.0..25.0.0 ------------------------------------------ a18e6c7 Prepare 2024.2 release f7e4f73 Expose parameter to customize [oslo_messaging_notifications] retry 90bf5ed Add support for [oslo_messaging_rabbit] enable_cancel_on_failover 5fdb3a7 Expose tunable options for RabbitMQ heartbeat 413ac43 logging: Deprecate watch_log_file d9143cf Adjust default service description 9f50822 Add validations for keystone resource parameters 67a24c2 Expose rabbit_qos_prefetch_count 64faf03 Fix inconsistent default notification driver f6c9f69 Add support for [healthcheck] enable_by_file_paths 8bdfb02 Remove dependency on puppet-dns b86d200 Add support for [producer_task] increment_serial options 8c41a42 reno: Update master for unmaintained/zed 8bd62fc Remove configuration of BIND 9 service 7e09ca6 Remove deprecated manage_pool parameters d7e3934 mdns: Clean up deprecated parameters 682f9cf Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/backend/bind9.pp | 72 +++++-------- manifests/backend/pdns4.pp | 48 ++++----- manifests/healthcheck.pp | 7 ++ manifests/init.pp | 111 ++++++++++++++------- manifests/keystone/auth.pp | 36 +++---- manifests/logging.pp | 13 ++- manifests/mdns.pp | 46 --------- manifests/producer_task/increment_serial.pp | 32 ++++++ metadata.json | 12 +-- .../notes/bug-2079986-10aed43f57d0f55c.yaml | 7 ++ .../deprecate-watch_log_file-51f4f8723228cd45.yaml | 4 + ...enable_cancel_on_failover-7e860ff3908b8dc2.yaml | 5 + .../hc-enable_by_file_paths-4e1cdd1ae239e14a.yaml | 5 + .../mdns-cleanup-dalmetian-7588fb88c4df856a.yaml | 10 ++ .../notes/notification-retry-33da16698e35e99d.yaml | 4 + ...cer_task_increment_serial-4eb267af619775c3.yaml | 5 + .../rabbit-heartbeat-opts-7d9fb65a28ec151f.yaml | 7 ++ ...rabbit_qos_prefetch_count-64a0125d2dcacf37.yaml | 4 + ...emove-bind9-configuration-0999987234bcdf32.yaml | 6 ++ .../notes/remove-manage_pool-6eb0eb1473df9b22.yaml | 7 ++ releasenotes/source/2024.1.rst | 6 ++ releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/designate_backend_bind9_spec.rb | 40 +------- spec/classes/designate_backend_pdns4_spec.rb | 13 --- spec/classes/designate_healthcheck_spec.rb | 3 + spec/classes/designate_init_spec.rb | 67 ++++++++----- spec/classes/designate_keystone_auth_spec.rb | 6 +- spec/classes/designate_logging_spec.rb | 1 - ...esignate_producer_task_increment_serial_spec.rb | 45 +++++++++ 30 files changed, 349 insertions(+), 276 deletions(-)

1 0

puppet-cinder 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are ecstatic to announce the release of: puppet-cinder 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-cinder Download the package from: https://tarballs.openstack.org/puppet-cinder/ Please report issues through: https://bugs.launchpad.net/puppet-cinder/+bugs For more details, please see below. Changes in puppet-cinder 24.0.0..25.0.0 --------------------------------------- fcf3fd4 Prepare 2024.2 release df1f2fd Expose parameter to customize [oslo_messaging_notifications] retry 35f8f89 Add support for [oslo_messaging_rabbit] enable_cancel_on_failover 204a7f2 Support new os-brick options 2e6f49c Require nova password 6e02ee9 logging: Deprecate watch_log_file 7e0cc4f Expose configure_service b897bfd Deprecate management of cinder v3 user ff0b443 Add validations for keystone resource parameters 8bf8355 Expose rabbit_qos_prefetch_count 656c44f Add support for [healthcheck] enable_by_file_paths 9055ae4 Add manage_package to RBD backend 890806e reno: Update master for unmaintained/zed 234b28c Remove support for amqp1 messaging driver f85ffa6 Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/backend/rbd.pp | 15 ++- manifests/healthcheck.pp | 7 ++ manifests/init.pp | 113 +++-------------- manifests/keystone/auth.pp | 136 ++++++++++++--------- manifests/logging.pp | 13 +- manifests/nova.pp | 34 +++--- manifests/os_brick.pp | 17 ++- metadata.json | 8 +- ...ge_package-to-rbd-backend-ce4239485895cbd1.yaml | 5 + .../notes/configure_service-e5e355b83ecbeb9f.yaml | 5 + .../deprecate-volume-v3-user-cb5c833a5b18f007.yaml | 16 +++ .../deprecate-watch_log_file-8554d796827fb5f4.yaml | 4 + ...enable_cancel_on_failover-1098f32930dfb254.yaml | 5 + .../hc-enable_by_file_paths-b3bbf78328e6e062.yaml | 5 + .../notes/notification-retry-dafd2c1b861dd831.yaml | 4 + ...s-brick-wait_mpath_device-bff9501f0e5225d6.yaml | 8 ++ ...rabbit_qos_prefetch_count-11fc96c4347c7e12.yaml | 4 + .../notes/remove-amqp1-c99a5ccc0871ad59.yaml | 4 + .../require-nova-password-06929462c62cc63a.yaml | 13 ++ releasenotes/source/2024.1.rst | 6 + releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/cinder_healthcheck_spec.rb | 3 + spec/classes/cinder_init_spec.rb | 50 ++------ spec/classes/cinder_keystone_auth_spec.rb | 6 +- spec/classes/cinder_logging_spec.rb | 1 - spec/classes/cinder_nova_spec.rb | 27 ++-- spec/classes/cinder_os_brick_spec.rb | 12 +- spec/defines/cinder_backend_rbd_spec.rb | 9 ++ 29 files changed, 292 insertions(+), 241 deletions(-)

1 0

puppet-aodh 25.0.0 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are delighted to announce the release of: puppet-aodh 25.0.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/puppet-aodh Download the package from: https://tarballs.openstack.org/puppet-aodh/ Please report issues through: https://bugs.launchpad.net/puppet-aodh/+bugs For more details, please see below. Changes in puppet-aodh 24.0.0..25.0.0 ------------------------------------- 105c5ca Prepare 2024.2 release 757b677 Expose parameter to customize [oslo_messaging_notifications] retry e953e3b Rename parameters for queue manager options 649aac3 Rename enable_cancel_on_failover parameter 3667928 logging: Deprecate watch_log_file 0dfb7be Expose configure_service f77f3ed Expose rabbit_qos_prefetch_count ba7a10c Add support for [oslo_messaging_rabbit] rabbit_stream_fanout 96bd6ba rabbitmq: Support queue manager options 87ea30d Add support for [oslo_messaging_rabbit] enable_cancel_on_failover d9656f8 Add support for [healthcheck] enable_by_file_paths 9dc871a Add validations for keystone resource parameters 10f001b reno: Update master for unmaintained/zed 38fcbdc Remove support for amqp1 messaging driver a213cbd Update master for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- manifests/healthcheck.pp | 7 + manifests/init.pp | 154 ++++++++------------- manifests/keystone/auth.pp | 42 +++--- manifests/logging.pp | 13 +- metadata.json | 8 +- .../notes/configure_service-f332e1faf10dfc10.yaml | 5 + .../deprecate-watch_log_file-6f414067deb5cc8c.yaml | 4 + ...enable_cancel_on_failover-c8ab28cfe303a700.yaml | 4 + .../hc-enable_by_file_paths-17fc4a38a2e0e5a1.yaml | 5 + .../notes/notification-retry-9dde0e986fc1b4b3.yaml | 4 + .../rabbit-queue-manager-143e28f3ad172721.yaml | 7 + ...rabbit_qos_prefetch_count-a5b3ec24883bac8e.yaml | 4 + .../rabbit_stream_fanout-1836844c6865d08e.yaml | 4 + .../notes/remove-amqp1-0593ad9afb227fa9.yaml | 4 + releasenotes/source/2024.1.rst | 6 + releasenotes/source/index.rst | 1 + releasenotes/source/zed.rst | 2 +- spec/classes/aodh_healthcheck_spec.rb | 3 + spec/classes/aodh_init_spec.rb | 62 ++++----- spec/classes/aodh_keystone_auth_spec.rb | 7 +- spec/classes/aodh_logging_spec.rb | 1 - 21 files changed, 187 insertions(+), 160 deletions(-)

1 0

ironic 26.1.1 (dalmatian)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are gleeful to announce the release of: ironic 26.1.1 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 26.1.1 ^^^^^^ Security Issues *************** * An issue in Ironic has been resolved where image checksums would not be checked prior to the conversion of an image to a "raw" format image from another image format. With default settings, this normally would not take place, however the "image_download_source" option, which is available to be set at a "node" level for a single deployment, by default for that baremetal node in all cases, or via the "[agent]image_download_source" configuration option when set to "local". By default, this setting is "http". This was in concert with the "[DEFAULT]force_raw_images" when set to "True", which caused Ironic to download and convert the file. In a fully integrated context of Ironic's use in a larger OpenStack deployment, where images are coming from the Glance image service, the previous pattern was not problematic. The overall issue was introduced as a result of the capability to supply, cache, and convert a disk image provided as a URL by an authenticated user. Ironic will now validate the user supplied checksum prior to image conversion on the conductor. This can be disabled using the "[conductor]disable_file_checksum" configuration option. Bug Fixes ********* * Fixes a security issue where Ironic would fail to checksum disk image files it downloads when Ironic had been requested to download and convert the image to a raw image format. This required the "image_download_source" to be explicitly set to "local", which is not the default. This fix can be disabled by setting "[conductor]disable_file_checksum" to "True", however this option will be removed in new major Ironic releases. As a result of this, parity has been introduced to align Ironic to Ironic-Python-Agent's support for checksums used by "standalone" users of Ironic. This includes support for remote checksum files to be supplied by URL, in order to prevent breaking existing users which may have inadvertently been leveraging the prior code path. This support can be disabled by setting "[conductor]disable_support_for_checksum_files" to "True". * Fixes aborting in-band inspection. Previously, it would fail with "Can not transition from state 'inspect failed' on event 'abort'". Changes in ironic 26.1.0..26.1.1 -------------------------------- afe4f4809 Checksum files before raw conversion 3f7f75f47 Fix double transition to INSPECTFAIL on aborting in-band inspection 4f90f4234 Update TOX_CONSTRAINTS_FILE for stable/2024.2 5989e389a Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + ironic/common/checksum_utils.py | 258 +++++++++++++++++++++ ironic/common/exception.py | 22 ++ ironic/common/image_service.py | 37 +++ ironic/common/images.py | 7 +- ironic/conductor/inspection.py | 5 +- ironic/conf/conductor.py | 22 ++ ironic/drivers/modules/deploy_utils.py | 70 ++++-- ironic/drivers/modules/image_cache.py | 44 +++- ironic/drivers/modules/inspector/agent.py | 8 +- .../unit/drivers/modules/inspector/test_agent.py | 40 ++++ .../unit/drivers/modules/test_deploy_utils.py | 229 ++++++++++++++++-- ...hecksum-before-conversion-66d273b94fa2ba4d.yaml | 44 ++++ .../notes/inspect-abort-8add5e6e6b599357.yaml | 5 + tox.ini | 14 +- 21 files changed, 1207 insertions(+), 94 deletions(-)

1 0

ironic 23.0.3 (bobcat)
by no-reply＠openstack.org 04 Oct '24

04 Oct '24

We are stoked to announce the release of: ironic 23.0.3 This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 23.0.3 ^^^^^^ Security Issues *************** * An issue in Ironic has been resolved where image checksums would not be checked prior to the conversion of an image to a "raw" format image from another image format. With default settings, this normally would not take place, however the "image_download_source" option, which is available to be set at a "node" level for a single deployment, by default for that baremetal node in all cases, or via the "[agent]image_download_source" configuration option when set to "local". By default, this setting is "http". This was in concert with the "[DEFAULT]force_raw_images" when set to "True", which caused Ironic to download and convert the file. In a fully integrated context of Ironic's use in a larger OpenStack deployment, where images are coming from the Glance image service, the previous pattern was not problematic. The overall issue was introduced as a result of the capability to supply, cache, and convert a disk image provided as a URL by an authenticated user. Ironic will now validate the user supplied checksum prior to image conversion on the conductor. This can be disabled using the "[conductor]disable_file_checksum" configuration option. Bug Fixes ********* * Fixes inspection failure when "bmc_address" or "bmc_v6address" is "null" in the inventory received from the ramdisk. * Fixes a security issue where Ironic would fail to checksum disk image files it downloads when Ironic had been requested to download and convert the image to a raw image format. This required the "image_download_source" to be explicitly set to "local", which is not the default. This fix can be disabled by setting "[conductor]disable_file_checksum" to "True", however this option will be removed in new major Ironic releases. As a result of this, parity has been introduced to align Ironic to Ironic-Python-Agent's support for checksums used by "standalone" users of Ironic. This includes support for remote checksum files to be supplied by URL, in order to prevent breaking existing users which may have inadvertently been leveraging the prior code path. This support can be disabled by setting "[conductor]disable_support_for_checksum_files" to "True". * Fixes aborting in-band inspection. Previously, it would fail with "Can not transition from state 'inspect failed' on event 'abort'". Changes in ironic 23.0.2..23.0.3 -------------------------------- b3d85c494 Checksum files before raw conversion 7c996f0aa Fix double transition to INSPECTFAIL on aborting in-band inspection 009f73717 Fix inspection if bmc_address or bmc_v6address is None 1588d4215 Try limiting MTU to at least 1280 786996b77 [CI][stable only] fix zuul config fbe70f8e6 [CI] Fix job parent name Diffstat (except docs and test files) ------------------------------------- devstack/settings | 11 +- ironic/api/controllers/v1/ramdisk.py | 4 +- ironic/common/checksum_utils.py | 258 +++++++++++++++++++++ ironic/common/exception.py | 22 ++ ironic/common/image_service.py | 35 +++ ironic/common/images.py | 7 +- ironic/conductor/inspection.py | 5 +- ironic/conf/conductor.py | 22 ++ ironic/drivers/modules/deploy_utils.py | 70 ++++-- ironic/drivers/modules/image_cache.py | 44 +++- ironic/drivers/modules/inspector/agent.py | 8 +- .../unit/drivers/modules/inspector/test_agent.py | 40 ++++ .../unit/drivers/modules/test_deploy_utils.py | 229 ++++++++++++++++-- .../notes/bmc-address-none-8214a3f7b67d6a0d.yaml | 5 + ...hecksum-before-conversion-66d273b94fa2ba4d.yaml | 44 ++++ .../notes/inspect-abort-8add5e6e6b599357.yaml | 5 + zuul.d/ironic-jobs.yaml | 3 +- 24 files changed, 1216 insertions(+), 93 deletions(-)

1 0