We are jazzed to announce the release of: tripleo-heat-templates 13.3.0: Heat templates for deploying OpenStack with OpenStack. This release is part of the victoria stable release series. The source is available from: https://opendev.org/openstack/tripleo-heat-templates Download the package from: https://tarballs.openstack.org/tripleo-heat-templates/ Please report issues through: https://bugs.launchpad.net/tripleo/+bugs For more details, please see below. 13.3.0 ^^^^^^ New Features ************ * Added new options for deploying Barbican with PKCS#11 backends: *BarbicanPkcs11CryptoTokenLabels* and *BarbicanPkcs11CryptoOsLockingOk* * The "OS::TripleO::{{role.name}}::PreNetworkConfig" resource has been restored. This resource can be used to implement any configuration steps executed before network configurations are applied. * *QemuDefaultTLSVerify* will allow operators to enable or disable TLS client certificate verification. Enabling this option will reject any client who does not have a certificate signed by the CA in /etc/pki/qemu/ca-cert.pem. The default is true and matches libvirt's. We will want to disable this by default in train. * Adding ptp parameters for timemaster service configuration on overcloud compute node.Timemaster will use already present chrony parameters. PTPMessageTransport, PTPInterfaces are added new. Deprecation Notes ***************** * The *BarbicanPkcs11CryptoTokenLabel* option has been deprecated and replaced with the *BarbicanPkcs11CryptoTokenLabels* option. Bug Fixes ********* * Now "ExtraConfigPre" resource and "NodeExtraConfig" resource are executed after network configurations are applied in nodes. This is consitent with the previous version with heat software deployment mechanism instead of config-download. * Previously access to the sshd running by the nova-migration-target container is only limited via the sshd_config. While login is not possible from other networks, the service is reachable via all networks. This change limits the access to the NovaLibvirt and NovaApi networks which are used for cold and live-migration. * Nova vnc configuration right now uses NovaVncProxyNetwork, NovaLibvirtNetwork and NovaApiNetwork to configure the different components (novnc proxy, nova-compute and libvirt) for vnc. If one of the networks get changed from internal_api, the service configuration between libvirt, nova-compute and novnc proxy gets inconsistent and the console is broken. This changed to just use NovaLibvirtNetwork for configuring the vnc endpoints and removes NovaVncProxyNetwork completely. Changes in tripleo-heat-templates 13.2.0..13.3.0 ------------------------------------------------ 4890946ec Fix network_cidrs when ManageNetworks: false 0eaa748bb Add dependency on OVNMacAddressNetwork for role ResourceGroup f35479563 Set tags on all OS::Neutron::Port resources 007eaecf0 Stop handler flush cf17ac91e Add tags to THT network resources d39526de1 Fix "ManageNetworks" use-case 9b67d6420 Add new options for Barbican PKCS#11 backend b4cec5b72 Add OVNEncapType option to the ovn controller template b6d85231a Re-add NovaVncProxyNetwork to service_net_map.j2.yaml 86de3c350 Disable tunneled mode when use_tls_for_live_migration 0fba0ce39 Add openstack-tox-tht to the gate 9536a5f31 Fix RoleParameters in tuned-baremetal-ansible.yaml 1311f8a52 Don't assume every role has default_route_networks 1785dabb8 Correct metrics_qdr logging path and regex parsing 521eae135 Run update tasks with become c71b72b29 Stop using (and breaking) /var/tmp for horizon temporary things f8485c9db Moving nova-consoleauth to step4 6ba1d84a4 Missing client certificate for live-migration with TLS 50c089a1f Add RootStackName to group_vars 48c444796 Add systemd dependency to openvswitch to ovn-controller b542452cc Disabling LM PostCopy and AutoConverge for RT roles ce9ae8666 Mount /etc/openldap inside the keystone container 9befbde21 Limit access to sshd used for nova migration b276cb24b Remove ovn-cms-options from OVS when OVNCMSOptions is set to "" e1998a8e5 Ensure ansible_fqdn is set 5171cd3d7 Fix NovaVncProxyNetwork removal df04e9518 Remove no longer used NovaNfsEnabled parameter and condtion de98fdb20 HA: fix race when moving VIP during minor update 1e137876a [update][upgrade] Use container-tools:3.0 63001263a HA: inject public certificates without blocking container 5325ac311 Move tmpwatch from cron.daily to actual root crontab 4260d30ea Set vlan-limit value depending on vlan_transparent setting c2e62032b Correct spelling mistake 4be137395 Config parameters for timemaster service 721a8d414 [OVN] Remove check for OVN + Availability Zones 87fc83d7b Restore PreNetworkConfig resources 9ba03482c live_migration setting should be under libvirt namespace 05b191d3e Use single NovaLibvirtNetwork to configure instance console components 178018d90 Switch Octavia external tasks to 'post deploy' Diffstat (except docs and test files) ------------------------------------- common/deploy-steps.j2 | 31 +++- deployed-server/ctlplane-port.yaml | 8 + deployed-server/deployed-neutron-port.yaml | 11 ++ deployed-server/deployed-server.yaml | 8 + .../barbican/barbican-api-container-puppet.yaml | 20 ++- .../barbican-backend-pkcs11-crypto-puppet.yaml | 16 +- deployment/glance/glance-api-container-puppet.yaml | 2 +- deployment/haproxy/haproxy-public-tls-inject.yaml | 6 +- deployment/horizon/horizon-container-puppet.yaml | 23 ++- deployment/ipa/ipaservices-baremetal-ansible.yaml | 9 ++ deployment/keystone/keystone-container-puppet.yaml | 1 + .../logrotate-crond-container-puppet.yaml | 45 ++++-- deployment/metrics/qdr-container-puppet.yaml | 4 +- .../neutron/neutron-api-container-puppet.yaml | 3 +- .../neutron/neutron-dhcp-container-puppet.yaml | 4 +- deployment/nova/nova-compute-container-puppet.yaml | 58 ++++--- deployment/nova/nova-ironic-container-puppet.yaml | 12 -- deployment/nova/nova-libvirt-container-puppet.yaml | 25 ++- .../nova-migration-target-container-puppet.yaml | 52 ++++--- .../nova/nova-vnc-proxy-container-puppet.yaml | 33 ++-- .../octavia/octavia-deployment-config.j2.yaml | 3 +- .../ovn/ovn-controller-container-puppet.yaml | 24 ++- .../pacemaker/pacemaker-baremetal-puppet.yaml | 4 +- .../timemaster/timemaster-baremetal-ansible.yaml | 171 +++++++++++++++++++++ deployment/timesync/chrony-baremetal-ansible.yaml | 2 - deployment/tls/undercloud-tls.yaml | 3 + deployment/tuned/tuned-baremetal-ansible.yaml | 19 ++- environments/barbican-backend-pkcs11-atos.yaml | 13 +- environments/barbican-backend-pkcs11-lunasa.yaml | 3 +- environments/barbican-backend-pkcs11-thales.yaml | 3 +- .../lifecycle/undercloud-upgrade-prepare.yaml | 2 +- environments/lifecycle/update-prepare.yaml | 2 +- environments/lifecycle/upgrade-prepare.yaml | 2 +- .../config/2-linux-bonds-vlans/role.role.j2.yaml | 2 +- network/config/bond-with-vlans/role.role.j2.yaml | 2 +- .../config/multiple-nics-vlans/role.role.j2.yaml | 2 +- network/config/multiple-nics/role.role.j2.yaml | 2 +- .../role.role.j2.yaml | 2 +- network/config/single-nic-vlans/role.role.j2.yaml | 2 +- network/network.j2 | 63 +++++--- network/ports/ctlplane_vip.yaml | 16 +- network/ports/from_service.yaml | 3 + network/ports/from_service_v6.yaml | 3 + network/ports/noop.yaml | 13 ++ network/ports/ovn_mac_addr_port.yaml | 16 ++ network/ports/port.j2 | 39 +++++ network/ports/port_from_pool.j2 | 13 ++ network/ports/vip.yaml | 15 ++ network/ports/vip_v6.yaml | 16 +- overcloud-resource-registry-puppet.j2.yaml | 2 + overcloud.j2.yaml | 24 ++- puppet/role.role.j2.yaml | 13 ++ ...r-barbican-pkcs11-options-a2ec14369518b40e.yaml | 9 ++ .../notes/bug-1907214-df2f07cbacbe8a24.yaml | 13 ++ ...introducing-qemutlsverify-af590e0243fe6b08.yaml | 9 ++ ...va_migration_limit_access-20be8d69686ca95c.yaml | 8 + .../notes/nova_novnc_network-83a1479bf227f867.yaml | 10 ++ ...dd_support_for_timemaster-a8dc3e4d5db4e8b3.yaml | 7 + tools/process-templates.py | 5 + zuul.d/layout.yaml | 1 + 60 files changed, 751 insertions(+), 181 deletions(-)