We are thrilled to announce the release of:

openstack-ansible 16.0.4: Ansible playbooks for deploying OpenStack

This release is part of the pike release series.

The source is available from:

https://git.openstack.org/cgit/openstack/openstack-ansible

Download the package from:

https://tarballs.openstack.org/openstack-ansible/

For more details, please see below.

16.0.4 ^^^^^^

New Features ************

* Adds a new flag to enable Octavia V2 API (disabled by default) to facilitate to run Octavia stand alone (without Neutron)

* Adds a new flag to toggle Octavia V1 API (the API needed to run in conjunction with Neutron) and enables it by default.

* Deployers can set "lxc_hosts_opensuse_mirror_url" to use their preferred mirror for the openSUSE repositories. They can also set the "lxc_hosts_opensuse_mirror_obs_url" if they want to set a different mirror for the OBS repositories. If they want to use the same mirror in both cases then they can leave the latter variable to its default value. The full list of mirrors and their capabilities can be obtained at http://mirrors.opensuse.org/

* Deployers can set "pip_install_opensuse_mirror_url" to use their preferred mirror for the openSUSE repositories. They can also set the "pip_install_opensuse_mirror_obs_url" if they want to set a different mirror for the OBS repositories. If they want to use the same mirror in both cases then they can leave the latter variable to its default value. The full list of mirrors and their capabilities can be obtained at http://mirrors.opensuse.org/

* The "tempest_images" data structure for the "os_tempest" role now expects the values for each image to include "name" (optionally) and "format" (the disk format). Also, the optional variable "checksum" may be used to set the checksum expected for the file in the format "<algorithm>:<checksum>".

* The default location for the image downloads in the "os_tempest" role set by the "tempest_image_dir" variable has now been changed to be "/opt/cache/files" in order to match the default location in nodepool. This improves the reliability of CI testing in OpenStack CI as it will find the file already cached there.

* A new variable has been introduced into the "os_tempest" role named "tempest_image_downloader". When set to "deployment-host" (which is the default) it uses the deployment host to handle the download of images to be used for tempest testing. The images are then uploaded to the target host for uploading into Glance.

* Enable Kernel Shared Memory support by setting "nova_compute_ksm_enabled" to "True".

Deprecation Notes *****************

* The following variables have been removed from the "os_tempest" role to simplify it. They have been replaced through the use of the data structure "tempest_images" which now has equivalent variables per image. - cirros_version - tempest_img_url - tempest_image_file - tempest_img_disk_format - tempest_img_name - tempest_images.sha256 (replaced by checksum)

Security Issues ***************

* The following headers were added as additional default (and static) values. *X-Content-Type-Options nosniff*, *X-XSS-Protection "1; mode=block"*, and *Content-Security-Policy "default-src 'self' https: wss:;"*. Additionally, the *X-Frame-Options DENY* header was added, defaulting to DENY. You may override the header via the *keystone_x_frame_options* variable.

Bug Fixes *********

* The "os_tempest" tempest role was downloading images twice - once arbitrarily, and once to use for testing. This has been consolidated into a single download to a consistent location.

Changes in openstack-ansible 16.0.3..16.0.4 -------------------------------------------

aee35c8 Fix in-tree version 600754f Revert "Add ceph_mons to ceph example" 7a40b17 Run dstat in gate tests 6249a8c [DOCS] Correct secret uuid in Ceph example e98b0fe Make pw-token-gen.py more random ac05785 Retry apt cache update 83e2b54 Add ceph_mons to ceph example 1037caf Update all SHAs for 16.0.4 156e34e [DOCS] Add ceph production example configuration af2ad0e Set ceph_mons in group_vars a016318 Update lxc_hosts role SHA for continue option removal

Diffstat (except docs and test files) -------------------------------------

ansible-role-requirements.yml | 90 ++++++------ .../source/app-advanced-config-options.rst | 2 +- deploy-guide/source/app-ceph.rst | 2 +- deploy-guide/source/app-config-prod-ceph.rst | 131 +++++++++++++++++ deploy-guide/source/app-custom-layouts.rst | 2 +- deploy-guide/source/app-limited-connectivity.rst | 2 +- deploy-guide/source/app-networking.rst | 2 +- deploy-guide/source/app-resources.rst | 2 +- deploy-guide/source/app-security.rst | 2 +- deploy-guide/source/app.rst | 1 + .../source/figures/arch-layout-production-ceph.png | Bin 0 -> 167033 bytes .../source/figures/arch-layout-production-ceph.svg | 3 + deploy-guide/source/figures/arch-layout.graffle | Bin 6161 -> 8655 bytes .../openstack_user_config.yml.prod-ceph.example | 162 +++++++++++++++++++++ .../user_variables.yml.prod-ceph.example | 41 ++++++ group_vars/all/all.yml | 2 +- group_vars/all/ceph.yml | 6 + playbooks/defaults/repo_packages/gnocchi.yml | 2 +- .../defaults/repo_packages/openstack_services.yml | 68 ++++----- ...tavia-V2-(standalone)-API-d644b92ad374f2cf.yaml | 7 + .../add-security-headers-e46c205b42b9598b.yaml | 8 + ...nsuse-mirror-url-variable-6660f16c3e9bf1ff.yaml | 10 ++ ...nsuse-mirror-url-variable-74d22825e808211e.yaml | 10 ++ ...emove-duplicated-download-99a9ec5bfe4ba749.yaml | 37 +++++ .../notes/support-ksm-fe6993158768a14e.yaml | 5 + scripts/gate-check-commit.sh | 7 +- scripts/pw-token-gen.py | 3 +- scripts/scripts-library.sh | 35 ++++- .../bootstrap-host/tasks/install_packages.yml | 4 + zuul.d/jobs.yaml | 2 +- 31 files changed, 553 insertions(+), 98 deletions(-)