- Release-announce - lists.openstack.org

neutron-lib 3.6.1 (bobcat)
by no-reply＠openstack.org 22 May '23

22 May '23

We eagerly announce the release of: neutron-lib 3.6.1: Neutron shared routines and utilities This release is part of the bobcat release series. The source is available from: https://opendev.org/openstack/neutron-lib Download the package from: https://pypi.org/project/neutron-lib Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. Changes in neutron-lib 3.6.0..3.6.1 ----------------------------------- c5ca1dd Context.elevated() method sets all required roles for context object Diffstat (except docs and test files) ------------------------------------- neutron_lib/context.py | 5 +++-- 2 files changed, 32 insertions(+), 2 deletions(-)

1 0

cinder 21.3.0 (zed)
by no-reply＠openstack.org 17 May '23

17 May '23

We are jazzed to announce the release of: cinder 21.3.0: OpenStack Block Storage This release is part of the zed stable release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 21.3.0 ^^^^^^ Known Issues ************ * For security reasons (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) manually deleting an attachment, manually doing the "os-terminate_connection" "os- detach" or "os-force_detach" actions will no longer be allowed unless the request is coming from another OpenStack service on behalf of a user. Upgrade Notes ************* * Nova must be configured to send service tokens (https://docs.openstack.org/cinder/latest/configuration/block- storage/service-token.html) **and** cinder must be configured to recognize at least one of the roles that the nova service user has been assigned in keystone. By default, cinder will recognize the "service" role, so if the nova service user is assigned a differently named role in your cloud, you must adjust your cinder configuration file ("service_token_roles" configuration option in the "keystone_authtoken" section). If nova and cinder are not configured correctly in this regard, detaching volumes will no longer work (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) Critical Issues *************** * Detaching volumes will fail if Nova is not configured to send service tokens (https://docs.openstack.org/cinder/latest/configuration/block- storage/service-token.html), please read the upgrade section for more information. (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) Security Issues *************** * As part of the fix for Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555) cinder now rejects user attachment delete requests for attachments that are being used by nova instances to ensure that no leftover devices are produced on the compute nodes which could be used to access another project's volumes. Terminate connection, detach, and force detach volume actions are not allowed for users. Bug Fixes ********* * Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555) Fixed issue where a user manually deleting an attachment, calling terminate connection, detach, or force detach, for a volume that is still used by a nova instance resulted in leftover devices on the compute node. These operations will now fail. Changes in cinder 21.2.0..21.3.0 -------------------------------- cb4682fb8 Reject unsafe delete attachment calls Diffstat (except docs and test files) ------------------------------------- api-ref/source/v3/attachments.inc | 15 ++ api-ref/source/v3/volumes-v3-volumes-actions.inc | 55 ++++++ cinder/compute/nova.py | 7 + cinder/exception.py | 7 + cinder/volume/api.py | 98 +++++++++++ .../configuration/block-storage/service-token.rst | 46 +++-- .../redirect-detach-nova-4b7b7902d7d182e0.yaml | 42 +++++ 15 files changed, 503 insertions(+), 23 deletions(-)

1 0

nova 25.2.0 (yoga)
by no-reply＠openstack.org 17 May '23

17 May '23

We enthusiastically announce the release of: nova 25.2.0: Cloud computing fabric controller This release is part of the yoga stable release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 25.2.0 ^^^^^^ Upgrade Notes * Configuration of service user tokens is now **required** for all Nova services to ensure security of block-storage volume data. All Nova configuration files must configure the "[service_user]" section as described in the documentation. See https://bugs.launchpad.net/nova/+bug/2004555 for more details. (https://docs.openstack.org/nova/latest/admin/configuration /service-user-token.html) Changes in nova 25.1.1..25.2.0 ------------------------------ acb31f01b1 CI: fix backport validator for new branch naming 98c3e3707c Enable use of service user token with admin context 4d8efa2d19 Use force=True for os-brick disconnect during delete 6c1b862274 Remove deleted projects from flavor access list 286aadf289 Handle InstanceInvalidState exception 37129b4b44 Remove mentions of removed scheduler filters 5f086d437e Fix LM rollback w/o multi port bindings extension Diffstat (except docs and test files) ------------------------------------- .../admin/configuration/cross-cell-resize.rst | 2 +- .../admin/configuration/service-user-token.rst | 59 ++++++++++++++++++++ .../admin/migrate-instance-with-snapshot.rst | 2 +- nova/api/openstack/compute/flavor_access.py | 9 ++- nova/api/openstack/compute/remote_consoles.py | 3 + nova/api/openstack/identity.py | 22 +++++--- nova/cmd/status.py | 11 ++++ nova/conf/compute.py | 12 +--- nova/network/neutron.py | 8 ++- nova/service_auth.py | 6 +- .../functional/regressions/test_bug_1888395.py | 13 ++--- .../api/openstack/compute/test_flavor_access.py | 25 ++++++++- .../api/openstack/compute/test_remote_consoles.py | 12 ++++ .../unit/virt/libvirt/volume/test_fibrechannel.py | 20 +++++++ .../unit/virt/libvirt/volume/test_storpool.py | 16 +++++- .../unit/virt/libvirt/volume/test_vzstorage.py | 8 ++- nova/virt/hyperv/vmops.py | 2 +- nova/virt/hyperv/volumeops.py | 12 ++-- nova/virt/libvirt/driver.py | 18 +++--- nova/virt/libvirt/volume/fibrechannel.py | 7 ++- nova/virt/libvirt/volume/fs.py | 2 +- nova/virt/libvirt/volume/iscsi.py | 7 ++- nova/virt/libvirt/volume/lightos.py | 7 ++- nova/virt/libvirt/volume/nvme.py | 6 +- nova/virt/libvirt/volume/quobyte.py | 2 +- nova/virt/libvirt/volume/scaleio.py | 7 ++- nova/virt/libvirt/volume/smbfs.py | 2 +- nova/virt/libvirt/volume/storpool.py | 5 +- nova/virt/libvirt/volume/volume.py | 2 +- nova/virt/libvirt/volume/vzstorage.py | 5 +- nova/volume/cinder.py | 8 ++- .../notes/service-user-token-421d067c16257782.yaml | 11 ++++ tools/check-cherry-picks.sh | 2 +- 55 files changed, 560 insertions(+), 157 deletions(-)

1 0

puppet-mistral 19.4.1 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are pleased to announce the release of: puppet-mistral 19.4.1: Puppet module for OpenStack Mistral This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-mistral Download the package from: https://tarballs.openstack.org/puppet-mistral/ Please report issues through: https://bugs.launchpad.net/puppet-mistral/+bugs For more details, please see below. 19.4.1 ^^^^^^ Bug Fixes * Now the base "Puppet::Provider::Mistral" class loads service user credential using the proper keystoneauth parameters. Changes in puppet-mistral 19.4.0..19.4.1 ---------------------------------------- 23c7017 Prepare the final stable/xena release 987849d setuptools: Disable auto discovery 2a7b5ba Fix authtoken parameters to load service user credential 952145c Update TOX_CONSTRAINTS_FILE for stable/xena 746710c Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + lib/puppet/provider/mistral.rb | 9 ++-- metadata.json | 2 +- .../notes/bug-1961601-1df5a15bead1daf3.yaml | 5 +++ setup.py | 1 + spec/unit/provider/mistral_spec.rb | 48 ++++++++++++++++++++++ tox.ini | 2 +- 7 files changed, 61 insertions(+), 7 deletions(-)

1 0

puppet-tempest 19.5.1 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are excited to announce the release of: puppet-tempest 19.5.1: Puppet module for OpenStack Tempest This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-tempest Download the package from: https://tarballs.openstack.org/puppet-tempest/ Please report issues through: https://bugs.launchpad.net/puppet-tempest/+bugs For more details, please see below. 19.5.1 ^^^^^^ Bug Fixes * The "tempest" class no longer installes a "python3-<service>-tests" package, unless the package provides tempest plugins. * Now the "python3-keystone-tests-tempest" package is installed instead of the "python3-keyston-tests" package in CentOS and RHEL. * Default value of the "tempest::tempest_repo_uri" parameter has been updated and now the OpenDev repository is used instead of Github. Changes in puppet-tempest 19.5.0..19.5.1 ---------------------------------------- ebe6917 Prepare the final stable/xena release da6ec76 setuptools: Disable auto discovery 0d7072e CentOS: Install tempest plugin packages only a21b29e Change git url for Tempest to opendev.org Diffstat (except docs and test files) ------------------------------------- manifests/init.pp | 4 ++-- manifests/params.pp | 10 ++++++---- metadata.json | 2 +- releasenotes/notes/bug-1969361-849e95dbcf6f8395.yaml | 9 +++++++++ releasenotes/notes/tempest-repo-opendev-76ee1bab934194fa.yaml | 5 +++++ setup.py | 1 + spec/classes/tempest_init_spec.rb | 2 +- 7 files changed, 25 insertions(+), 8 deletions(-)

1 0

puppet-swift 19.5.0 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are glad to announce the release of: puppet-swift 19.5.0: Puppet module for OpenStack Swift This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-swift Download the package from: https://tarballs.openstack.org/puppet-swift/ Please report issues through: https://bugs.launchpad.net/puppet-swift/+bugs For more details, please see below. 19.5.0 ^^^^^^ New Features * Now this module supports configurion options in */etc/swift /internal-client.conf`*. * The "swift::proxy::ceilometer" class now supports the following new parameters to manage options for Rabbit driver in oslo.messaging library. * "rabbit_ha_queues" * "heartbeat_timeout_threshold" * "heartbeat_rate" * "heartbeat_in_pthread" * "rabbit_qos_prefetch_count" * "amqp_durable_queues" * "kombu_reconnect_delay" * "kombu_failover_strategy" * "kombu_compression" Changes in puppet-swift 19.4.0..19.5.0 -------------------------------------- 65a08a5 Prepare the final stable/xena release e4a28d2 Ensure consistent IPv6 address format e7d8c64 setuptools: Disable auto discovery f2c839d Fix deprecation warning by validate_legacy ced957d Fix type validation warning for storage policy rings b5cb280 Support customizing internal-client.conf ff757c6 Support more [oslo_messaging_rabbit] parameters 331b926 Fix typo in swiftinit service type e7d5607 Fix missing argument of builder_file_path 5f5fac7 Remove TripleO job 635e94d Update TOX_CONSTRAINTS_FILE for stable/xena a72d035 Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 18 --- lib/puppet/provider/service/swiftinit.rb | 2 +- .../swift_internal_client_config/ini_setting.rb | 10 ++ lib/puppet/provider/swift_ring_builder.rb | 6 +- lib/puppet/type/ring_account_device.rb | 15 ++- lib/puppet/type/ring_container_device.rb | 15 ++- lib/puppet/type/ring_object_device.rb | 19 ++- lib/puppet/type/swift_internal_client_config.rb | 53 ++++++++ manifests/config.pp | 8 ++ manifests/deps.pp | 4 + manifests/internal_client.pp | 95 +++++++++++++++ manifests/internal_client/cache.pp | 76 ++++++++++++ manifests/internal_client/catch_errors.pp | 25 ++++ manifests/internal_client/proxy_logging.pp | 15 +++ manifests/internal_client/symlink.pp | 42 +++++++ manifests/proxy/ceilometer.pp | 134 ++++++++++++++++----- manifests/ringbuilder/create.pp | 6 +- manifests/ringbuilder/rebalance.pp | 6 +- manifests/storage/node.pp | 6 +- metadata.json | 2 +- .../notes/internal-client-ce022fa93df88aaa.yaml | 5 + ...slo-messaging-rabbit-opts-e4da4a73d1f2c788.yaml | 15 +++ setup.py | 1 + spec/classes/swift_config_spec.rb | 11 ++ spec/classes/swift_internal_client_cache_spec.rb | 78 ++++++++++++ .../swift_internal_client_catch_errors_spec.rb | 19 +++ spec/classes/swift_internal_client_spec.rb | 73 +++++++++++ spec/classes/swift_internal_client_symlink_spec.rb | 33 +++++ spec/classes/swift_proxy_ceilometer_spec.rb | 20 ++- spec/defines/swift_ringbuilder_create_spec.rb | 14 ++- spec/defines/swift_ringbuilder_rebalance_spec.rb | 16 ++- .../ini_setting_spec.rb | 49 ++++++++ .../unit/type/swift_internal_client_config_spec.rb | 19 +++ tox.ini | 2 +- 35 files changed, 829 insertions(+), 84 deletions(-)

1 0

puppet-gnocchi 19.5.0 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are gleeful to announce the release of: puppet-gnocchi 19.5.0: Puppet module for OpenStack Gnocchi This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-gnocchi Download the package from: https://tarballs.openstack.org/puppet-gnocchi/ Please report issues through: https://bugs.launchpad.net/puppet-gnocchi/+bugs For more details, please see below. 19.5.0 ^^^^^^ New Features * Install python-boto3 automatically in order to satisfy s3 storage backend package dependencies. This can be disabled by setting the "gnocchi::storage::s3::manage_boto3" parameter. Changes in puppet-gnocchi 19.4.0..19.5.0 ---------------------------------------- fdc70e2 Prepare the final stable/xena release 0221ef2 setuptools: Disable auto discovery db97bc7 s3_access_key_id should be secret a51f532 Ensure required packages are installed for s3 support. 1cf22a1 Update TOX_CONSTRAINTS_FILE for stable/xena 21379e2 Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + manifests/params.pp | 1 + manifests/storage/s3.pp | 21 ++++++++++- metadata.json | 2 +- .../fix-s3-and-install-boto3-49991c1b453c2168.yaml | 6 ++++ setup.py | 1 + spec/classes/gnocchi_storage_s3_spec.rb | 42 +++++++++++++++++++++- tox.ini | 2 +- 8 files changed, 72 insertions(+), 4 deletions(-)

1 0

puppet-keystone 19.5.0 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are jazzed to announce the release of: puppet-keystone 19.5.0: Puppet module for OpenStack Keystone This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-keystone Download the package from: https://tarballs.openstack.org/puppet-keystone/ Please report issues through: https://bugs.launchpad.net/puppet-keystone/+bugs For more details, please see below. 19.5.0 ^^^^^^ New Features ************ * Added "description" parameter to "keystone_user" resource. * The "keystone::federation::ipenidc" class now supports the new "openidc_response_mode" parameter, to customize mod_auth_openidc response mode. Security Issues *************** * Content of fernet keys and credential keys are now hidden from output, when these files are updated. Changes in puppet-keystone 19.4.0..19.5.0 ----------------------------------------- 16883a6 Prepare the final stable/xena release ca43d64 OIDC: Make sure the dependent auth modules are loaded 9510fcd setuptools: Disable auto discovery f5d1daf Ensure key contents are hidden 114272f Make sure keystone package name is asserted 07c30e3 Add description support to keystone_user 801f94d keystone_user: Use un-scoped token to verify password ed8ab83 Ensure inet6: formatting for a comma-separated list string bcc37d7 Use systemctl to restart the keystone service 2b391b4 OIDC: Add support for setting OIDCResponseMode cd8172d Remove TripleO job d48547f Update TOX_CONSTRAINTS_FILE for stable/xena 73184be Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 19 --- lib/puppet/provider/keystone.rb | 11 +- lib/puppet/provider/keystone_user/openstack.rb | 25 ++-- lib/puppet/type/keystone_user.rb | 4 + manifests/federation/openidc.pp | 9 ++ manifests/init.pp | 4 +- manifests/resource/authtoken.pp | 7 +- metadata.json | 2 +- .../notes/bug-1979672-003a5939f3bd6f67.yaml | 5 + ...user-provider-description-18806553c4b2be3f.yaml | 4 + .../openidc_response_mode-f5a2ddf95bd4b752.yaml | 6 + setup.py | 1 + spec/acceptance/keystone_wsgi_apache_spec.rb | 11 +- spec/classes/keystone_federation_openidc_spec.rb | 15 +++ spec/classes/keystone_init_spec.rb | 15 ++- spec/defines/keystone_resource_authtoken_spec.rb | 39 +++++- spec/unit/provider/keystone_spec.rb | 2 +- spec/unit/provider/keystone_user/openstack_spec.rb | 131 +++++++++------------ templates/openidc.conf.erb | 3 + tox.ini | 2 +- 21 files changed, 185 insertions(+), 131 deletions(-)

1 0

puppet-nova 19.5.0 (xena)
by no-reply＠openstack.org 17 May '23

17 May '23

We are psyched to announce the release of: puppet-nova 19.5.0: Puppet module for OpenStack Nova This release is part of the xena stable release series. The source is available from: https://opendev.org/openstack/puppet-nova Download the package from: https://tarballs.openstack.org/puppet-nova/ Please report issues through: https://bugs.launchpad.net/puppet-nova/+bugs For more details, please see below. 19.5.0 ^^^^^^ New Features * Added "disable_compute_service_check_for_ffu" paramter to "nova::workarounds" to configure the configuration option with the same name. * Added "enable_qemu_monitor_announce_self" paramter to "nova::workarounds" to configure the configuration option with the same name. * The following parameter and class have been added, to support usage of the service token feature with the Barbican key manager. * The "nova::key_manager::barbican::send_service_user_token" parameter * The "nova::key_manager::barbican::service_user" class * Add "sysinfo_serial" parameter to control a Serial number entry generation method. Defaults to "$::os_service_default". * The "nova_flavor" resource now supports the "project_name" property. This property should be used instead of the "project" property when project name is used instead of project id. * New parameters "max_client_requests" and "admin_max_client_requests" allow to configure corresponding settings for libvirt. * Added parameter "wait_for_vif_plugged_event_during_hard_reboot" to "nova::workarounds" to configure the config option with the same name. Changes in puppet-nova 19.4.0..19.5.0 ------------------------------------- 9b412fde Prepare the final stable/xena release 9061e0c5 Wire-in max_client_requests for libvirt 74e9c951 setuptools: Disable auto discovery d0e7fb98 Expose [workaround]/disable_compute_service_check_for_ffu c4ed32df Add sysinfo_serial to control Serial number gen a66c8b4c Add wait_for_vif_plugged_event_during_hard_reboot bdf1413f nova_flavor: Add the new project_name property c6fbc193 Remove unused str2hash f887f207 Ensure auth_endpoint is cleared by reset f5be102f Fix missing update of property_hash 7238c13a Add enable_qemu_monitor_announce_self workaround b750dc10 nova_flavor: Strip '' from project id value b9398853 CentOS: Ensure /etc/sysconfig/libvirtd(-guests) exists a8b79dbb Fix error in 140chars lint check 2f409b6d Debian/Ubuntu: Use ceph-common instead of ceph 956c8e5a key_manager: Add service user options for Barbican key manager 38079353 Override default mkisofs_cmd in CentOS 9. 3fc355a1 Use service anchor to ensure API is up 119f4616 Add missing dependency about nova_api_paste_ini 542e1fbc Remove TripleO job b6996814 Update TOX_CONSTRAINTS_FILE for stable/xena 4688ca65 Update .gitreview for stable/xena Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 19 ---- lib/puppet/provider/nova.rb | 11 +-- lib/puppet/provider/nova_aggregate/openstack.rb | 2 + lib/puppet/provider/nova_cell_v2/nova_manage.rb | 20 ++-- lib/puppet/provider/nova_flavor/openstack.rb | 86 +++++++++++++---- lib/puppet/provider/nova_service/openstack.rb | 8 +- lib/puppet/type/nova_flavor.rb | 26 ++++- manifests/api.pp | 2 +- manifests/compute.pp | 13 ++- manifests/compute/libvirt.pp | 6 ++ manifests/compute/libvirt/virtnodedevd.pp | 37 ++++--- manifests/compute/libvirt/virtproxyd.pp | 41 +++++--- manifests/compute/libvirt/virtqemud.pp | 37 ++++--- manifests/compute/libvirt/virtsecretd.pp | 37 ++++--- manifests/compute/libvirt_guests.pp | 9 ++ manifests/compute/rbd.pp | 2 +- manifests/config.pp | 4 +- manifests/cron/archive_deleted_rows.pp | 5 +- manifests/cron/purge_shadow_tables.pp | 5 +- manifests/deps.pp | 4 + manifests/key_manager/barbican.pp | 34 ++++--- manifests/key_manager/barbican/service_user.pp | 94 ++++++++++++++++++ manifests/migration/libvirt.pp | 9 ++ manifests/params.pp | 5 +- manifests/workarounds.pp | 37 ++++++- metadata.json | 2 +- ...ute_service_check_for_ffu-4c4cc458df3ca33b.yaml | 6 ++ ...emu_monitor_announce_self-9e307efdb0061fce.yaml | 6 ++ .../barbican_service_user-887eb51cb8e9efce.yaml | 8 ++ .../libvirt_sysinfo_serial-e1603d45446726c3.yaml | 5 + .../nova_flavor-project_name-fbab75b57ad9d4b3.yaml | 6 ++ ...bvirt_max_client_requests-1709c1d7a282264d.yaml | 5 + ..._event_during_hard_reboot-092dada6f6a1e632.yaml | 5 + setup.py | 1 + spec/acceptance/nova_wsgi_apache_spec.rb | 28 ++++-- spec/classes/nova_api_spec.rb | 4 +- spec/classes/nova_compute_libvirt_guests_spec.rb | 23 ++++- spec/classes/nova_compute_libvirt_spec.rb | 3 + .../nova_compute_libvirt_virtnodedevd_spec.rb | 18 ++-- .../nova_compute_libvirt_virtproxyd_spec.rb | 20 ++-- .../classes/nova_compute_libvirt_virtqemud_spec.rb | 18 ++-- .../nova_compute_libvirt_virtsecretd_spec.rb | 18 ++-- spec/classes/nova_compute_rbd_spec.rb | 5 +- .../nova_key_manager_barbican_service_user_spec.rb | 79 +++++++++++++++ spec/classes/nova_key_manager_barbican_spec.rb | 45 +++++---- spec/classes/nova_migration_libvirt_spec.rb | 15 +++ spec/classes/nova_workarounds_spec.rb | 17 +++- .../unit/provider/nova_aggregate/openstack_spec.rb | 3 +- spec/unit/provider/nova_flavor/openstack_spec.rb | 107 +++++++++++++++++++-- spec/unit/provider/nova_spec.rb | 27 ------ tox.ini | 2 +- 52 files changed, 780 insertions(+), 250 deletions(-)

1 0

cinder 22.1.0 (antelope)
by no-reply＠openstack.org 17 May '23

17 May '23

We are ecstatic to announce the release of: cinder 22.1.0: OpenStack Block Storage This release is part of the antelope release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 22.1.0 ^^^^^^ Known Issues ************ * For security reasons (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) manually deleting an attachment, manually doing the "os-terminate_connection", "os- detach" or "os-force_detach" actions will no longer be allowed in most cases unless the request is coming from another OpenStack service on behalf of a user. Upgrade Notes ************* * Nova must be configured to send service tokens (https://docs.openstack.org/cinder/latest/configuration/block- storage/service-token.html) **and** cinder must be configured to recognize at least one of the roles that the nova service user has been assigned in keystone. By default, cinder will recognize the "service" role, so if the nova service user is assigned a differently named role in your cloud, you must adjust your cinder configuration file ("service_token_roles" configuration option in the "keystone_authtoken" section). If nova and cinder are not configured correctly in this regard, detaching volumes will no longer work (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) Critical Issues *************** * Detaching volumes will fail if Nova is not configured to send service tokens (https://docs.openstack.org/cinder/latest/configuration/block- storage/service-token.html), please read the upgrade section for more information. (Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555)) Security Issues *************** * As part of the fix for Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555) cinder now rejects user attachment delete requests for attachments that are being used by nova instances to ensure that no leftover devices are produced on the compute nodes which could be used to access another project's volumes. Terminate connection, detach, and force detach volume actions (calls that are not usually made by users directly) are, in most cases, not allowed for users. Bug Fixes ********* * Bug #2004555 (https://bugs.launchpad.net/cinder/+bug/2004555) Fixed issue where a user manually deleting an attachment, calling terminate connection, detach, or force detach, for a volume that is still used by a nova instance resulted in leftover devices on the compute node. These operations will now fail when it is believed to be a problem. Changes in cinder 22.0.0..22.1.0 -------------------------------- dd6010a9f Reject unsafe delete attachment calls 5975376ba [Pure Storage] Add check for new error message 63e6dfdb0 Update url of "Unity Replication White Paper" Diffstat (except docs and test files) ------------------------------------- api-ref/source/v3/attachments.inc | 15 ++ api-ref/source/v3/volumes-v3-volumes-actions.inc | 55 ++++++ cinder/compute/nova.py | 7 + cinder/exception.py | 7 + cinder/volume/api.py | 98 +++++++++++ cinder/volume/drivers/pure.py | 6 +- .../drivers/dell-emc-unity-driver.rst | 4 +- .../configuration/block-storage/service-token.rst | 46 +++-- .../redirect-detach-nova-4b7b7902d7d182e0.yaml | 43 +++++ 17 files changed, 510 insertions(+), 27 deletions(-)

1 0