- Release-announce - lists.openstack.org

oslo.privsep 2.6.0 (xena)
by no-reply＠openstack.org 28 Jun '21

28 Jun '21

We joyfully announce the release of: oslo.privsep 2.6.0: OpenStack library for privilege separation This release is part of the xena release series. The source is available from: https://opendev.org/openstack/oslo.privsep Download the package from: https://pypi.org/project/oslo.privsep Please report issues through: https://bugs.launchpad.net/oslo.privsep/+bugs For more details, please see below. 2.6.0 ^^^^^ New Features * Add "timeout" as parameter to "PrivContext" and add "entrypoint_with_timeout" decorator to cover the issues with commands which take random time to finish. "PrivsepTimeout" is raised if timeout is reached. "Warning": The daemon (the root process) task won't stop when timeout is reached. That means we'll have less available threads if the related thread never finishes. * "PrivContext" accepts a new string parameter called "logger_name" to define the logger we want to use for the daemon logs of this context. By default all contexts use "oslo_privsep.daemon", but in some cases we may need finer grained log levels, for example nova running in debug mode could log its own privsep calls on INFO level regardless, but leave all libraries' privsep calls, such as os-brick's, to be logged in the normal DEBUG level. See bug 1922052. (https://bugs.launchpad.net/nova/+bug/1922052) Changes in oslo.privsep 2.5.0..2.6.0 ------------------------------------ f7f3349 Add timeout to PrivContext and entrypoint_with_timeout decorator 165cdde Upgrade the pre-commit-hooks version bd989a3 setup.cfg: Replace dashes with underscores 71c732c Allow finer grained log levels 22557b4 Add Python3 xena unit tests c4d0534 Update master for stable/wallaby 5f5db61 Fix requirements issues. dc97a45 Use TOX_CONSTRAINTS_FILE 55dd214 Use py3 as the default runtime for tox Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 10 ++-- .zuul.yaml | 3 +- lower-constraints.txt | 54 ------------------- oslo_privsep/comm.py | 54 ++++++++++++------- oslo_privsep/daemon.py | 60 ++++++++++------------ oslo_privsep/functional/test_daemon.py | 43 ++++++++++++++++ oslo_privsep/priv_context.py | 31 +++++++++-- ...nt_with_timeout_decorator-9aab5a74153b3632.yaml | 11 ++++ .../notes/context-logger-06b475357bebadc7.yaml | 15 ++++++ releasenotes/source/index.rst | 1 + releasenotes/source/wallaby.rst | 6 +++ setup.cfg | 8 +-- tox.ini | 12 ++--- 16 files changed, 301 insertions(+), 139 deletions(-)

1 0

kolla 12.0.0 (wallaby)
by no-reply＠openstack.org 23 Jun '21

23 Jun '21

We are ecstatic to announce the release of: kolla 12.0.0: Kolla OpenStack Deployment This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/kolla Download the package from: https://tarballs.openstack.org/kolla/ Please report issues through: https://bugs.launchpad.net/kolla/+bugs For more details, please see below. 12.0.0 ^^^^^^ New Features ************ * Adds the Monasca datasource plugin to the Grafana image. This allows Monasca users to visualise metrics in Grafana without using the Monasca Grafana fork. * Debian 'bullseye' is now used instead of 'buster'. Bullseye is the next stable release of Debian, and is currently in a 'freeze' state. Several images gained Debian support with the move to bullseye. Upgrade Notes ************* * The "monasca-grafana" image has been dropped because it was using several deprecated components and was not buildable. Support for "Monasca" datasource was added into standard "grafana" instead. * Changed default of "network_mode" to "host" since Kolla-Ansible "bootstrap-servers" is deploying Docker without a bridge by default since Wallaby Deprecation Notes ***************** * Support for building ppc64le container images has been deprecated in Wallaby cycle and will be removed in Xena. * The "tempest" and "rally" images are deprecated and will be removed in the Xena cycle. The reason is that these are not services of an OpenStack cloud but its clients. Security Issues *************** * Fixes security issue in Prometheus as per advisory. Bug Fixes ********* * Fixes location of monitoring_policy in Horizon, so access policy is correctly enforced. Note that by current default, admin doesn't not have Monitoring access. LP#1928408 * Fix support for kolla install in "~/.local". LP#1930544 * Fixes an issue with logs going missing in the Fluentd pipeline by pinning td-agent to 4.0.*. LP#1930867 * Fixes issues arising from the lack of Debian updates repo being enabled. LP#1931544 Other Notes *********** * Debian images enable the Debian updates repo now. This is aligned with the base Debian image. Changes in kolla 12.0.0.0rc1..12.0.0 ------------------------------------ d578ac260 horizon: Correct location of monitoring_policy file 24bad11ed Horizon: Install policy files for manila-ui 128a45a2b Horizon: Install required policy files for heat-dashboard 8cd42eccc Fix _get_images_dir when pip-installed with --user a0eb21df3 Revert "libvirt: pin edk2-ovmf" 11d63e07c Pin td-agent to 4.0.* to fix missing logs b5ba6792d [docs] Fix Debian release name 746ae194e Enable Debian updates repo 01f5ce486 Revert "[CI] Add grafana to allowed-to-fail" f9f2f12cc Change network_mode default to host 5e38030b0 [CI] Add grafana to allowed-to-fail 51802de96 Add missing default policy files for ubuntu-binary-horizon cfa9ee486 docs: Update Freenode to OFTC 65a8b37a5 ubuntu: unpin OVS b22089051 libvirt: pin edk2-ovmf cb1457fea Install Monasca datasource plugin for Grafana fe1c8e882 Revert "CI: add monasca-grafana to allowed-to-fail images" 66b5abf67 Drop monasca-grafana image. 3ba3ccd8b [Security] Fix open redirect in Prometheus 227831c58 centos: clean up repo enable/disable/keys 858c27486 gnocchi-base: numpy provides aarch64 binary wheels 7726bbe2d docs: update supported OS distros e7a71f17d CI: drop bashism from template overrides b2e6babf1 [release] Use UCA Wallaby 2e3c2d9b6 base: check for compatible distro using just sh 496c0c006 setup.cfg: Replace dashes with underscores f885c6c1d Deprecate tempest and rally 00bfe8775 [CI] Trust only infra mirrors c01b017e5 Revert "CI: drop ubuntu-aarch64 job" 58503574a CI: move to Debian 'bullseye' nodes 46e81aa56 Revert "CI: temporarily disable CentOS/AArch64 testing" de52c2bfc Install RabbitMQ repo key on Ubuntu and Debian 1e747d7ef [CI] Fix Ubuntu cephadm jobs names 2c51d968c CentOS on AArch64 has only Erlang 22 490dcfcd2 CI: Remove kolla_python_version from Debian/Ubuntu jobs 084dd5e4e Pin erlang 934f5f0d8 Revert "deprecate use of GnuPG ids for APT keys" 53225b2bf centos: switch to RDO final release of Wallaby a1ad81338 neutron: Remove vmware-nsx and networking-mlx from binary 67dc1d3f0 releasenotes: we move to Debian bullseye 1f5014e01 move to Debian 'bullseye' 13abc31c2 Disable trove for Debian/binary b85b63ec9 docs: deprecate ppc64le in Wallaby de9e3cc3b Update TOX_CONSTRAINTS_FILE for stable/wallaby 21f1fd8ee Update .gitreview for stable/wallaby Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.d/base.yaml | 8 +- .zuul.d/centos.yaml | 6 +- .zuul.d/debian.yaml | 8 +- .zuul.d/ubuntu.yaml | 55 ++++------- README.rst | 4 +- contrib/neutron-plugins/README.rst | 5 +- .../template_override-networking-mlnx.j2 | 4 + .../template_override-vmware-nsx.j2 | 4 + .../mariadb-server/security_reset.expect.debian | 67 +++++++++++++ .../prometheus/prometheus-v2-server/Dockerfile.j2 | 2 +- kolla/common/config.py | 17 ++-- kolla/image/build.py | 22 ++--- kolla/template/repos.yaml | 2 - ...sca-datasource-to-grafana-06dfe0ce329a7b7f.yaml | 6 ++ .../notes/bug-1928408-4a22a85570eee8d6.yaml | 7 ++ .../notes/bug-1930544-a8926990f3a578a9.yaml | 5 + releasenotes/notes/bug-1930867.yaml | 6 ++ .../notes/bug-1931544-5a091735efb6d6dd.yaml | 9 ++ .../notes/debian-bullseye-4fedf3b3638783de.yaml | 6 ++ .../notes/deprecate-apt-keys-eff6e68272923b6b.yaml | 7 -- ...deprecate-monasca-grafana-d05af2e96cffd82c.yaml | 5 - .../notes/deprecate-ppc64le-2b7b642e79bddd66.yaml | 5 + ...precate-tempest-and-rally-0647efa7209cf03a.yaml | 7 ++ .../drop-monasca-grafana-df2c45d6826752f6.yaml | 7 ++ .../notes/network-mode-host-2aca256e2a1fbf68.yaml | 6 ++ ...ty-fix-prometheus-v2.26.1-03e1410ad8ed4410.yaml | 4 + ...-neutron-plugins-excluded-b72220a2ea8c1a40.yaml | 5 +- setup.cfg | 8 +- tox.ini | 6 +- 62 files changed, 352 insertions(+), 423 deletions(-)

1 0

kayobe 10.0.0 (wallaby)
by no-reply＠openstack.org 23 Jun '21

23 Jun '21

We are stoked to announce the release of: kayobe 10.0.0: Deployment of OpenStack to bare metal using OpenStack kolla and bifrost This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/kayobe Download the package from: https://tarballs.openstack.org/kayobe/ Please report issues through: https://storyboard.openstack.org/#!/project/openstack/kayobe For more details, please see below. 10.0.0 ^^^^^^ New Features ************ * Adds support for CentOS Stream 8 as a host Operating System and base container image. This is the only distribution of CentOS supported from the Wallaby release. The Victoria release will support both CentOS Linux 8 and CentOS Stream 8 hosts and images, and provides a route for migration. * Adds a new flag, "docker_registry_network_mode", which defaults to "host". This may be used to set the network mode of the Docker registry container. * Adds support for passing through additional host variables from Kayobe to Kolla Ansible. This is done via the following variables: * "kolla_seed_inventory_pass_through_host_vars_extra" * "kolla_seed_inventory_pass_through_host_vars_map_extra" * "kolla_overcloud_inventory_pass_through_host_vars_extra" * "kolla_overcloud_inventory_pass_through_host_vars_map_extra" See story 2008797 for details. * Adds a new "kayobe overcloud service prechecks" command to run Kolla Ansible prechecks without deploying services. * Adds support for Ubuntu Focal 20.04 as a host and container Operating System for seed, seed hypervisor and overcloud hosts. Upgrade Notes ************* * CentOS Linux 8 is no longer supported as a host Operating System or base container image. CentOS users should migrate to CentOS Stream 8. The Victoria release will support both CentOS Linux 8 and CentOS Stream 8 hosts and images, and provides a route for migration. * Updates the NTP implementation from the chrony container deployed by kolla-ansible to configuring chrony as a host service. Chrony is now installed on all hosts in the "ntp" group, which defaults to include the seed, overcloud, and seed-hypervisor groups. On existing deployments, you should run *kayobe overcloud host configure* to migrate from the kolla-ansible deployed container. This can optionally be scoped to just use the "ntp" tag. You can continue to use the kolla container by setting *kolla_enable_chrony* to "true". Bug Fixes ********* * Fixes an issue with container image builds by using "host" as the default "network_mode" for "kolla-build". See story 2008942 for details. Changes in kayobe 10.0.0.0rc1..10.0.0 ------------------------------------- 51ddc295 docs: Stop setting os_distribution in development all-in-one e010356e CI: test base container image build in seed jobs 30563e52 docs: add variable for current branch 7d56e8fd docs: improve automated seed development info 64bc058f Add kayobe overcloud service prechecks command 2e221681 Fix overcloud post configure Python interpreter issues 36fcec12 Revert "CI: Fix libvirt errors caused by latest edk2-ovmf" 7e6ca694 Fix container image builds 3f9e4c50 Ubuntu: ensure /usr/bin/python is python3 5fe1a7ed chrony: cleanup during overcloud host upgrade 9a374af8 Optimise order of inspector_processing_hooks 4648b90b ntp: check for ntp group in inventory 1d43eda8 docs: Update Freenode to OFTC c5e5d697 CI: Fix libvirt errors caused by latest edk2-ovmf a9a2f382 Replace custom serial loop with throttle 38360a4d Support additional pass through host variables 64e183c4 Make docker registry network mode configurable c01e5f0a Remove default time sources from customisable configuration b79daa16 CentOS Stream: update DNF repo file names 73dfeb29 Fixes for Ansible 2.10 eb90ad21 docs: add reno and upgrade info for CentOS Stream e5a319aa CI: Remove unused Docker images after overcloud upgrade 010a1833 Adds support for configuring chrony 7a56c95a Ubuntu: add documentation & release note f3dffec0 Ubuntu: avoid shadowing of networkd config files c36c78bd Add os_release variable, build CentOS stream images 4e17dcef Ubuntu: install qemu-img on seed-hypervisor a495bbc1 setup.cfg: Replace dashes with underscores 0f0604b8 Revert to binary images for nova 2f736f5c Update .gitreview for stable/wallaby Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + README.rst | 2 +- ansible/group_vars/all/bifrost | 5 +- ansible/group_vars/all/docker-registry | 3 + ansible/group_vars/all/globals | 4 + ansible/group_vars/all/inspector | 2 +- ansible/group_vars/all/ipa | 4 + ansible/group_vars/all/kolla | 70 +++++++- ansible/group_vars/all/time | 29 ++++ ansible/provision-net.yml | 8 +- ansible/roles/dnf/tasks/local-mirror.yml | 10 ++ .../roles/dnf/templates/CentOS-AppStream.repo.j2 | 19 -- ansible/roles/dnf/templates/CentOS-Base.repo.j2 | 19 -- ansible/roles/dnf/templates/CentOS-Extras.repo.j2 | 20 --- .../dnf/templates/CentOS-Stream-AppStream.repo.j2 | 17 ++ .../dnf/templates/CentOS-Stream-BaseOS.repo.j2 | 17 ++ .../dnf/templates/CentOS-Stream-Extras.repo.j2 | 17 ++ ansible/roles/docker-registry/defaults/main.yml | 8 +- ansible/roles/ipa-images/tasks/set-driver-info.yml | 6 +- .../kolla-build/templates/kolla-build.conf.j2 | 4 + ansible/roles/network-debian/tasks/main.yml | 5 + ansible/roles/ntp/defaults/main.yml | 6 + ansible/roles/ntp/tasks/deploy.yml | 4 + ansible/roles/ntp/tasks/main.yml | 12 ++ ansible/roles/ntp/tasks/prepare.yml | 27 +++ ansible/roles/ntp/tasks/validate.yml | 11 ++ ansible/roles/ssh-known-host/tasks/main.yml | 8 +- ansible/time.yml | 33 ++++ ansible/timezone.yml | 28 ++- dev/functions | 2 +- dev/tenks-deploy-config-overcloud.yml | 2 + .../configuration/reference/docker-registry.rst | 9 +- .../reference/ironic-python-agent.rst | 5 +- .../configuration/reference/kolla-ansible.rst | 50 +++++- .../configuration/reference/os-distribution.rst | 34 ++++ .../configuration/scenarios/all-in-one/index.rst | 3 +- .../scenarios/all-in-one/overcloud.rst | 15 +- etc/kayobe/bifrost.yml | 3 +- etc/kayobe/docker-registry.yml | 3 + etc/kayobe/globals.yml | 4 + etc/kayobe/inventory/groups | 8 +- etc/kayobe/kolla.yml | 44 +++++ etc/kayobe/time.yml | 23 +++ kayobe/cli/commands.py | 47 ++++- .../overrides.yml.j2 | 8 + .../kayobe-overcloud-upgrade-base/globals.yml.j2 | 3 - playbooks/kayobe-overcloud-upgrade-base/run.yml | 6 + playbooks/kayobe-seed-base/overrides.yml.j2 | 4 +- playbooks/kayobe-seed-base/run.yml | 18 ++ .../notes/centos-stream-cb683a092153b93e.yaml | 13 ++ ...ker-registry-network-mode-3c678295b51d69c1.yaml | 6 + .../notes/extra-host-vars-13c28b790bc54f6b.yaml | 13 ++ ...nstall-chrony-on-the-host-283fa6fdd9cf9b4c.yaml | 11 ++ .../kolla-build-network-mode-ba92e36d52e70d99.yaml | 6 + .../notes/os-distribution-69445eb19a611d43.yaml | 5 +- .../notes/prechecks-command-a9153f667659c315.yaml | 5 + releasenotes/notes/ubuntu-e74f49ea72f69869.yaml | 5 + requirements.yml | 8 +- setup.cfg | 11 +- 78 files changed, 964 insertions(+), 333 deletions(-)

1 0

kolla-ansible 12.0.0 (wallaby)
by no-reply＠openstack.org 23 Jun '21

23 Jun '21

We are psyched to announce the release of: kolla-ansible 12.0.0: Ansible Deployment of Kolla containers This release is part of the wallaby release series. The source is available from: https://opendev.org/openstack/kolla-ansible Download the package from: https://tarballs.openstack.org/kolla-ansible/ Please report issues through: https://bugs.launchpad.net/kolla-ansible/+bugs For more details, please see below. 12.0.0 ^^^^^^ New Features ************ * Adds support for CentOS Stream 8 as a host Operating System and base container image. This is the only distribution of CentOS supported from the Wallaby release. The Victoria release will support both CentOS Linux 8 and CentOS Stream 8 hosts and images, and provides a route for migration. * Supports Debian Bullseye (11) as host distribution. * Adds support in "kolla_docker" module to set "CgroupnsMode" for Docker containers (via "cgroupns_mode" module param). Requires Docker 20.10. Note that pre-20.10 all containers behave as if they were run with mode "host". * OVN deployment will now configure "external_ids:ovn-chassis-mac- mappings" to make DVR work on VLAN tenant networks. * Due to the removal of the Monasca Grafana fork, the Monasca datasource is now configured in vanilla Grafana. Upgrade Notes ************* * Bumps minimum required Docker version to 18.09 and minimum required Docker Python SDK version to 3.4.1. These two are checked in prechecks. * CentOS Linux 8 is no longer supported as a host Operating System or base container image. CentOS users should migrate to CentOS Stream 8. The Victoria release will support both CentOS Linux 8 and CentOS Stream 8 hosts and images, and provides a route for migration. * Adds a new flag, "docker_disable_ip_forward", which defaults to "docker_disable_default_iptables_rules" and is used to disable docker's "ip-forward" option which makes docker set "net.ipv4.ip_forward" sysctl to "1". By default, "docker_disable_default_iptables_rules" is "true", in which case docker's "ip-forward" option is "disabled". For existing hosts, this configuration change is applied when configuring docker via "kolla-ansible bootstrap-servers". Docker changes the sysctl in a non-persistent manner, so it will revert to the default of "0" after a reboot, if not configured elsewhere. This should not cause a problem, since Kolla Ansible applies the sysctl where necessary. Operators may wish to perform a proactive reboot, or apply the default through other means. * Service containers and configuration for the Monasca Grafana service will be removed automatically. It is up to the operator to remove the related HAProxy configuration, the Monasca Grafana database, and associated Docker volumes. Deprecation Notes ***************** * Support for configuration of NTP daemon (via "enable_host_ntp") is deprecated and will be removed in the next Kolla Ansible release (Xena). Please use other means of configuring NTP. * The Monasca Fork of Grafana is deprecated due to lack of maintenance and will be removed in the Xena release. Instead, support will be provided to allow Monasca users to migrate to the vanilla Grafana service with the Monasca datasource. * Support for deploying "tempest" and "rally" is deprecated and will be removed in the Xena cycle. The reason is that these are not services of an OpenStack cloud but its clients. Bug Fixes ********* * chronyd crash loop if server is rebooted (Debian) LP#1915528 * Fixed an issue when Docker was configured after startup on Debian/Ubuntu, which resulted in iptables rules being created - before they were disabled. LP#1923203 * Fixes an issue with Octavia SSH key copying if user disabled Octavia auto configuration. LP##1927727 * Fixed an issue where docker python SDK 5.0.0 was failing due to missing six - introduced a constraint to install version lower than 5.x. LP#1928915 * Fixes more-than-2-node RabbitMQ upgrade failing randomly. LP#1930293. * Fixes Swift deploy when TLS enabled. Added the missing handler and corrected the container name. LP#1931097 * Fixes "iscsid" failing in current CentOS 8 based images due to pid file being needlessly set. LP#1933033 * Fixes host bootstrap on Debian not removing the conflicting packages. It now behaves in accordance with the docs. LP#1933122 * Fixes potential issue with Alertmanger in non-HA deployments. In this scenario, peer gossip protocol is now disabled and Alertmanager won't try to form a cluster with non-existing other instances. LP#1926463 * Adds a new flag, "docker_disable_ip_forward", which defaults to "docker_disable_default_iptables_rules" and is used to disable docker's "ip-forward" option which makes docker set "net.ipv4.ip_forward" sysctl to "1". This is to protect from creating all-forwarding hosts. LP#1931615 * Fixes an issue when generating "/etc/hosts" during "kolla-ansible bootstrap-servers" when one or more hosts has an "api_interface" with dashes ("-") in its name. LP#1927357 * Fixes the container image used by mariabackup. It was using the "mariadb" image, which was deprecated in Victoria and removed in Wallaby. LP#1928129 * Fixes an issue with Octavia deployment when using a custom service auth project. If "octavia_service_auth_project" is set to a project that does not exist, Octavia deployment would fail. The project is now created. LP#1922100 Changes in kolla-ansible 12.0.0.0rc1..12.0.0 -------------------------------------------- bcce291aa Fix host bootstrap pkg removal on Debian ecddf74d7 Do not set pid file for iscsid 2e76e0565 Support editable installation in all cases cf58c0460 tox: Add find command to allowlist_externals list 315d8eec2 baremetal: fix /etc/hosts generation when api_interface has dashes a6a2e5ec1 chronyd crash loop if Debian server is rebooted 252671f8b Stop fluentd deprecation warnings of type vs @type 381e3a40d Fix parsing of infra.mariadb.xinetd logs 189c1c245 Fix neutron-ovn-metadata-agent with policy.yaml cbd474cc4 octavia: Ensure service auth project exists c24a56b7d Merge glance sections for nova.conf.j2 b79d2a4f0 Redis configuration syntax update 13deb4304 Update blazar.conf template 5ba041019 Add the ansible_managed header for admin-openrc.sh e3f43eee5 Reno follow up for docker_disable_ip_forward c272af91c Drop /sys/fs/cgroup mounts eb4815345 Disable docker's ip-forward when iptables disabled f11af96cc Fix RabbitMQ restart ordering 98c29107a Add forgotten 'Restart container' handler for swift 12dc47483 grafana: add bootstrap during upgrade a8982e571 Bump min Docker version 94e115e15 chrony: allow to remove the container 12382be7a [CI] Drop Zuul host groups 0c58f83d6 [CI] Move to Debian Bullseye 7b3190871 Add support for Debian Bullseye (11) as host distro efd51bccb [docker] Add support for setting CgroupnsMode 58f3f3042 Trivial if conditional fix in keystone.json e7c68252f docs: Update Freenode to OFTC 0b971b61d Fix release note markup ee92b33b3 Use mariadb-server image for mariabackup d8b4e81c0 CI: Use PATH to find kolla-ansible script d31ec6609 cinder: fix condition to copy backend TLS certs af7c7cc6b Remove [octavia]/base_url option from neutron.conf b887b1c4c docs: update supported OS distros 924affb65 Mariadb shards documentation af7778e3a CI: Configure IP on a linux bridge instead of OVS br-ex 4e8c1493c CI: add grafana to monasca image list 2bff29328 Remove Monasca Grafana service 7e31c959e [CI] Fix testing in cephadm scenario ee8bd456b baremetal: Install Docker SDK less than 5.0.0 bf351eb97 CI: Fix nfv job with kolla dependency 34349f6ad CI: Wait for NTP synced status in systemd 3a661b7ad baremetal: Don't start Docker after install on Debian/Ubuntu e0fc09cde Disable Alertmanager's peer gossip in non-HA deployments bfdd36ff3 CI: allow Elasticsearch status to be green or yellow a92ce428a Use @type instead of type deafe00dd Do not write octavia_amp_ssh_key if auto_config disabled cb38206dc Fix "Restart mariadb-clustercheck container" during config gen 465a38545 ovn: make DVR work on VLAN tenant networks 71811d947 octavia: Fix duplicate api_settings 1e5709150 ovn: omit unnecessary bridge mappings 381fe0d27 setup.cfg: Replace dashes with underscores d83aad7ee Deprecate tempest and rally 5894894ff Deprecate enable_host_ntp f73c00c83 Bump up python version for Debian Bullseye aaa2bb977 cephadm: Set auth_allow_insecure_global_id_reclaim to true 8ccbdf3c2 Add Monasca Grafana deprecation notice 4f87d9f36 Use wallaby images in wallaby deployments adef109a1 Avoid an Ansible quirk in hacluster role 3f7e02765 docs: Improve policy documentation 6bcbaf235 Update TOX_CONSTRAINTS_FILE for stable/wallaby e80783f1d Update .gitreview for stable/wallaby Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + ansible/chrony-cleanup.yml | 14 +++ ansible/group_vars/all.yml | 7 +- ansible/library/kolla_docker.py | 44 +++++++- ansible/roles/baremetal/defaults/main.yml | 2 + ansible/roles/baremetal/tasks/install.yml | 28 ++++- ansible/roles/baremetal/tasks/post-install.yml | 30 +++++- ansible/roles/baremetal/tasks/pre-install.yml | 4 +- ansible/roles/blazar/templates/blazar.conf.j2 | 10 +- ansible/roles/chrony/tasks/cleanup.yml | 12 +++ ansible/roles/chrony/templates/chrony.json.j2 | 4 +- ansible/roles/cinder/tasks/config.yml | 2 +- ansible/roles/common/templates/admin-openrc.sh.j2 | 2 + .../common/templates/conf/input/02-mariadb.conf.j2 | 2 +- .../common/templates/conf/output/00-local.conf.j2 | 8 +- ansible/roles/grafana/defaults/main.yml | 9 ++ ansible/roles/grafana/tasks/upgrade.yml | 5 + .../roles/hacluster/tasks/bootstrap_service.yml | 4 +- ansible/roles/haproxy/tasks/precheck.yml | 27 ----- ansible/roles/iscsi/defaults/main.yml | 2 - ansible/roles/iscsi/templates/iscsid.json.j2 | 2 +- ansible/roles/keystone/templates/keystone.json.j2 | 2 +- ansible/roles/mariadb/defaults/main.yml | 2 +- ansible/roles/mariadb/handlers/main.yml | 2 + ansible/roles/monasca/defaults/main.yml | 24 +---- ansible/roles/monasca/handlers/main.yml | 53 --------- ansible/roles/monasca/tasks/bootstrap.yml | 3 +- ansible/roles/monasca/tasks/config.yml | 19 ---- ansible/roles/monasca/tasks/deploy.yml | 2 - ansible/roles/monasca/tasks/post_config.yml | 120 --------------------- ansible/roles/monasca/tasks/precheck.yml | 11 -- ansible/roles/monasca/tasks/upgrade.yml | 30 ------ .../templates/monasca-grafana/grafana.ini.j2 | 55 ---------- .../monasca-grafana/monasca-grafana.json.j2 | 23 ---- ansible/roles/multipathd/defaults/main.yml | 1 - .../templates/neutron-ovn-metadata-agent.json.j2 | 13 ++- ansible/roles/neutron/templates/neutron.conf.j2 | 5 - ansible/roles/nova-cell/defaults/main.yml | 2 +- ansible/roles/nova-cell/handlers/main.yml | 1 + ansible/roles/nova-cell/tasks/check-containers.yml | 1 + ansible/roles/nova-cell/templates/nova.conf.j2 | 5 +- ansible/roles/octavia/defaults/main.yml | 7 ++ ansible/roles/octavia/tasks/config.yml | 4 +- ansible/roles/octavia/tasks/register.yml | 15 --- ansible/roles/octavia/templates/octavia.conf.j2 | 4 +- ansible/roles/ovn/defaults/main.yml | 2 + ansible/roles/ovn/tasks/bootstrap.yml | 6 +- ansible/roles/prechecks/defaults/main.yml | 3 + ansible/roles/prechecks/tasks/timesync_checks.yml | 73 +++++++++++-- ansible/roles/prechecks/vars/main.yml | 5 +- .../templates/prometheus-alertmanager.json.j2 | 2 +- ansible/roles/rabbitmq/handlers/main.yml | 18 +++- ansible/roles/rally/tasks/main.yml | 5 + ansible/roles/redis/templates/redis.conf.j2 | 10 +- ansible/roles/swift/defaults/main.yml | 2 +- ansible/roles/swift/handlers/main.yml | 4 + ansible/roles/tempest/tasks/main.yml | 5 + .../bootstrap-servers.rst | 5 + .../logging-and-monitoring/monasca-guide.rst | 54 +++++----- etc/kolla/globals.yml | 4 +- etc/kolla/passwords.yml | 1 - ...yd-crash-loop-if-server-is-rebooted-debian.yaml | 5 + .../notes/bug-1922721-19163cfb491d0035.yaml | 4 +- .../notes/bug-1923203-f9ff247befc4bd75.yaml | 6 ++ .../notes/bug-1927727-4437103de59e85e5.yaml | 6 ++ .../notes/bug-1928915-482b2d53bb2a4d92.yaml | 6 ++ .../notes/bug-1930293-d8a524f2070e6779.yaml | 5 + .../notes/bug-1931097-c94832ed2ed92c3a.yaml | 6 ++ .../notes/bug-1933033-76746d127285cfe8.yaml | 6 ++ .../notes/bug-1933122-b34311ba73092080.yaml | 6 ++ ...imum-docker-version-18-09-37af3b4c134da67e.yaml | 6 ++ .../notes/centos-stream-686441cc4c0e47d7.yaml | 13 +++ .../debian-bullseye-host-adc7778d7103b84f.yaml | 4 + .../notes/deprecate-chrony-077a8686e79a919e.yaml | 16 ++- ...deprecate-enable-host-ntp-3ad934c097f18b1b.yaml | 7 ++ ...deprecate-monasca-grafana-f5bfc61a5d453a8e.yaml | 7 ++ ...precate-tempest-and-rally-2418cbe2a9f315a4.yaml | 7 ++ ...e-alertmanager-clustering-ec70f5f970c4933a.yaml | 7 ++ .../docker-cgroupns-mode-9e1b32c357a14095.yaml | 7 ++ ...docker-disable-ip-forward-b0490b71f9f07cd6.yaml | 24 +++++ .../notes/etc-hosts-dashes-37d0dc07c8fc881f.yaml | 7 ++ .../notes/mariabackup-image-8b31622f59890e28.yaml | 6 ++ ...eate-service-auth-project-aa38b12ebb601777.yaml | 7 ++ .../notes/ovn_dvr_vlan-f36a6868cfd4776e.yaml | 5 + .../remove-monasca-grafana-43cf1f74b09a6e54.yaml | 11 ++ roles/bridge/tasks/main.yml | 12 +++ roles/cephadm/tasks/main.yml | 11 ++ roles/veth/tasks/main.yml | 12 +++ setup.cfg | 8 +- tools/kolla-ansible | 33 +++++- tox.ini | 17 +-- zuul.d/base.yaml | 6 +- zuul.d/jobs.yaml | 8 +- zuul.d/nodesets.yaml | 62 +++-------- 114 files changed, 878 insertions(+), 635 deletions(-)

1 0

ironic 17.0.3 (wallaby)
by no-reply＠openstack.org 23 Jun '21

23 Jun '21

We eagerly announce the release of: ironic 17.0.3: OpenStack Bare Metal Provisioning This release is part of the wallaby stable release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://storyboard.openstack.org/#!/project/943 For more details, please see below. 17.0.3 ^^^^^^ Security Issues *************** * Fixes an issue with the "/v1/nodes/detail" endpoint where an authenticated user could explicitly ask for an "instance_uuid" lookup and the associated node would be returned to the user with sensitive fields redacted in the result payload if the user did not explicitly have "owner" or "lessee" permissions over the node. This is considered a low-impact low-risk issue as it requires the API consumer to already know the UUID value of the associated instance, and the returned information is mainly metadata in nature. More information can be found in Storyboard story 2008976 (https://storyboard.openstack.org/#!/story/2008976) Bug Fixes ********* * If the agent accepts a command, but is unable to reply to Ironic (which sporadically happens before of the eventlet's TLS implementation), we currently retry the request and fail because the command is already executing. Ironic now detects this situation by checking the list of executing commands after receiving a connection error. If the requested command is the last one, we assume that the command request succeeded. * When local boot is used (e.g. by default), the instance image validation now happens only in the deploy interface, not in the boot interface (as before). This means that the boot interface validation will now pass in many cases where it would previously fail. * Fixes an issue with the "/v1/nodes/detail" endpoint where requests for an explicit "instance_uuid" match would not follow the standard query handling path and thus not be filtered based on policy determined access level and node level "owner" or "lessee" fields appropriately. Additional information can be found in story 2008976 (https://storyboard.openstack.org/#!/story/2008976) * No longer masks configdrive when sending the node's record to in- band deploy steps. * Fixes handling of single-value (non-key-value) parameters in the "[inspector]extra_kernel_params" configuration options. * The behavior when a bootable iso ramdisk is provided behind an http server is to download and serve the image from the conductor; the image is removed only when the node is undeployed. In certain cases, for example on large deployments, this could cause undesired behaviors, like the conductor nodes running out of disk storage. To avoid this event we provide an option "[deploy]ramdisk_image_download_source" to be able to tell the ramdisk interface to directly use the bootable iso url from its original source instead of downloading it and serving it from the conductor node. The default behavior is unchanged. * Fixes sub-optimal Ironic API performance where Secure RBAC related field level policy checks were executing without first checking if there were field results. This helps improve API performance when only specific columns have been requested by the API consumer. Changes in ironic 17.0.2..17.0.3 -------------------------------- adc4f7657 Fix node detail instance_uuid request handling 566cff59a Handle non-key-value params in [inspector]extra_kernel_params 05c838073 dhcp-less: mention how to provide network_data to instance f99d68707 Refactor iDRAC OEM extension manager calls fc8e1652b Improve agent_client logging d3f62f83e Set download stable branch for IPA f9eb7abe8 Secure RBAC - Efficent node santiziation c7af96938 Update project conundrum related docs 0500fe107 Avoid unnecessary validation in boot interfaces 77be4c6c6 Delete unavailable py2 package fce4cc11b Fix deployment when executing a command fails after the command starts 659eef72e Provide an option to not cache bootable iso ramdisks 78e10ce59 Update refarch with information about image_download_source 7b723bcce Do not mask configdrive when executing in-band deploy steps fe2377855 Inherit InvalidImageRef from InvalidParameterValue Diffstat (except docs and test files) ------------------------------------- devstack/lib/ironic | 2 +- .../include/configure-ironic-api-mod_wsgi.inc | 10 +- .../install/include/configure-ironic-api.inc | 2 +- ironic/api/controllers/v1/node.py | 143 ++++++++-------- ironic/common/exception.py | 2 +- ironic/common/pxe_utils.py | 5 +- ironic/common/utils.py | 16 ++ ironic/conf/deploy.py | 16 ++ ironic/db/sqlalchemy/api.py | 2 +- ironic/drivers/modules/agent_client.py | 121 +++++++++++--- ironic/drivers/modules/drac/boot.py | 67 +------- ironic/drivers/modules/drac/inspect.py | 46 +---- ironic/drivers/modules/drac/management.py | 185 ++++----------------- ironic/drivers/modules/drac/raid.py | 43 +---- ironic/drivers/modules/drac/utils.py | 121 ++++++++++++++ ironic/drivers/modules/image_utils.py | 14 +- ironic/drivers/modules/inspector.py | 6 +- ironic/drivers/modules/pxe_base.py | 14 +- ironic/drivers/modules/redfish/boot.py | 11 +- ironic/objects/node.py | 10 +- .../unit/drivers/modules/drac/test_inspect.py | 27 --- .../unit/drivers/modules/drac/test_management.py | 124 ++------------ .../unit/drivers/modules/redfish/test_boot.py | 74 ++------- .../unit/drivers/modules/test_agent_client.py | 117 +++++++++++++ .../notes/agent-last-command-4ec6967c995ba84a.yaml | 9 + .../notes/boot-validate-6b4b6b40c8e27273.yaml | 7 + ...ed-instance-info-behavior-1375914a30621eca.yaml | 20 +++ .../deploy-step-configdrive-86ea2bb267211b88.yaml | 5 + .../inspector-kernel-params-6db82c633d7361e2.yaml | 5 + ...ion-no-cache-http-ramdisk-62fc29cdd1d5b152.yaml | 14 ++ ...-sanitization-performance-dc7886952144bb04.yaml | 7 + 54 files changed, 1037 insertions(+), 858 deletions(-)

1 0

tripleo-operator-ansible 0.5.1
by no-reply＠openstack.org 23 Jun '21

23 Jun '21

We are overjoyed to announce the release of: tripleo-operator-ansible 0.5.1: Operator ansible assets for the TripleO project. The source is available from: https://opendev.org/openstack/tripleo-operator-ansible Download the package from: https://tarballs.openstack.org/tripleo-operator-ansible/ For more details, please see below. Changes in tripleo-operator-ansible 0.5.0..0.5.1 ------------------------------------------------ 574ada8 Revert "Added publish-openstack-python-tarball job to publish the tarballs" d997a4b Added publish-openstack-python-tarball job to publish the tarballs 920f76c Correct the tox option for skipping sdist generation 2278638 Add missing "vip" argument to the CLI 99641cf tripleo_overcloud_node_provision - add --network-config f8c8076 Add role for tripleo_overcloud_network_vip_provision c801580 Add role for tripleo_overcloud_network_provision 17ed0d7 Only trigger provider when consumer child present c1527ca tripleo_repo: add missing >- to remove trailing \n 0f20569 tripleo_repos: add tripleo_repos_repo_branch Diffstat (except docs and test files) ------------------------------------- .../tripleo_overcloud_network_provision/README.md | 57 +++++++++++++++++++++ .../defaults/main.yml | 14 ++++++ .../meta/main.yml | 42 ++++++++++++++++ .../molecule/default/converge.yml | 44 ++++++++++++++++ .../molecule/default/molecule.yml | 19 +++++++ .../molecule/default/prepare.yml | 8 +++ .../tasks/main.yml | 58 ++++++++++++++++++++++ .../README.md | 58 ++++++++++++++++++++++ .../defaults/main.yml | 15 ++++++ .../meta/main.yml | 42 ++++++++++++++++ .../molecule/default/converge.yml | 44 ++++++++++++++++ .../molecule/default/molecule.yml | 19 +++++++ .../molecule/default/prepare.yml | 8 +++ .../tasks/main.yml | 58 ++++++++++++++++++++++ .../defaults/main.yml | 1 + .../molecule/default/converge.yml | 12 +++++ .../tasks/main.yml | 1 + roles/tripleo_repos/README.md | 1 + roles/tripleo_repos/defaults/main.yml | 1 + roles/tripleo_repos/tasks/install.yml | 4 +- tox.ini | 2 +- zuul.d/layout.yaml | 10 +++- 26 files changed, 526 insertions(+), 4 deletions(-)

1 0

kayobe 10.0.0.0rc2 (wallaby)
by no-reply＠openstack.org 22 Jun '21

22 Jun '21

Hello everyone, A new release candidate for kayobe for the end of the Wallaby cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kayobe/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Wallaby release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/wallaby release branch at: https://opendev.org/openstack/kayobe/src/branch/stable/wallaby Release notes for kayobe can be found at: https://docs.openstack.org/releasenotes/kayobe/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/kayobe and tag it *wallaby-rc-potential* to bring it to the kayobe release crew's attention.

1 0

kolla 12.0.0.0rc2 (wallaby)
by no-reply＠openstack.org 22 Jun '21

22 Jun '21

Hello everyone, A new release candidate for kolla for the end of the Wallaby cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kolla/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Wallaby release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/wallaby release branch at: https://opendev.org/openstack/kolla/src/branch/stable/wallaby Release notes for kolla can be found at: https://docs.openstack.org/releasenotes/kolla/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/kolla/+bugs and tag it *wallaby-rc-potential* to bring it to the kolla release crew's attention.

1 0

kolla-ansible 12.0.0.0rc2 (wallaby)
by no-reply＠openstack.org 22 Jun '21

22 Jun '21

Hello everyone, A new release candidate for kolla-ansible for the end of the Wallaby cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kolla-ansible/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Wallaby release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/wallaby release branch at: https://opendev.org/openstack/kolla-ansible/src/branch/stable/wallaby Release notes for kolla-ansible can be found at: https://docs.openstack.org/releasenotes/kolla-ansible/ If you find an issue that could be considered release-critical, please file it at: https://bugs.launchpad.net/kolla-ansible/+bugs and tag it *wallaby-rc-potential* to bring it to the kolla-ansible release crew's attention.

1 0

puppet-nova 15.8.1 (train)
by no-reply＠openstack.org 21 Jun '21

21 Jun '21

We are gleeful to announce the release of: puppet-nova 15.8.1: Puppet module for OpenStack Nova This release is part of the train stable release series. The source is available from: https://opendev.org/openstack/puppet-nova Download the package from: https://tarballs.openstack.org/puppet-nova/ Please report issues through: https://bugs.launchpad.net/puppet-nova/+bugs For more details, please see below. Changes in puppet-nova 15.8.0..15.8.1 ------------------------------------- 287ce1fe Bump metadata to create the real final train release 2442758b Fixing section ovsdb_connection e2c2ba61 Prepare the final stable/train release 43cd2b49 Introducing default_tls_verify a6adf208 Disable libvirtd.service before starting sockets f939f674 Add TLS options to oslo.cache 2ae766f1 Allow both DEFAULT/dhcp_domain and api/dhcp_domain to be set dbba136c Set dhcp_domain for all nova services 64113fee Revert "Remove parameter nova::compute::pci_passthrough" Diffstat (except docs and test files) ------------------------------------- manifests/cache.pp | 43 +++++++++++++++++ manifests/compute.pp | 15 ++++++ manifests/compute/libvirt/qemu.pp | 12 +++++ manifests/init.pp | 9 +++- manifests/metadata.pp | 16 ++----- manifests/migration/libvirt.pp | 12 ++++- metadata.json | 14 +++--- .../notes/add_tls_options-9f4cd19db6a76a76.yaml | 4 ++ .../qemu-default_tls_verify-57e7afd6670afec2.yaml | 5 ++ spec/classes/nova_cache_spec.rb | 17 +++++++ spec/classes/nova_compute_libvirt_qemu_spec.rb | 55 +++++++++++++++++++++- spec/classes/nova_compute_spec.rb | 55 ++++++++++++++++++++++ spec/classes/nova_init_spec.rb | 8 +++- 13 files changed, 240 insertions(+), 25 deletions(-)

1 0