Open Stack

We are thrilled to announce the release of:

instack-undercloud 9.0.0: instack-undercloud

This release is part of the rocky release series.

The source is available from:

    https://git.openstack.org/cgit/openstack/instack-undercloud

Download the package from:

    https://tarballs.openstack.org/instack-undercloud/

Please report issues through launchpad:

    https://bugs.launchpad.net/tripleo

For more details, please see below.

9.0.0
^^^^^


New Features
************

* The undercloud now uses the "baremetal" neutron ML2 mechanism
  driver, and the l2 agent ironic-neutron-agent. This enables the
  possibility to use neutron routed networks in the undercloud.


Upgrade Notes
*************

* During an upgrade to this release, a migration of all nodes from
  classic drivers to hardware types will be attempted. For some nodes
  it may result in non-supported optional interfaces (like "agent"
  RAID or shellinabox console) to be reset to their no-op
  implementations (like "no-raid" RAID or "no-console" console). Nodes
  that cannot be upgraded will be skipped. Manual upgrade will be
  required, since the classic drivers may be removed in the Rocky
  release.


Security Issues
***************

* TLS is now used by default for the public endpoints. This is done
  through the generate_service_certificates option, which now defaults
  to 'True'.

* Restrict memcached service to TCP and localhost network
  (CVE-2018-1000115).


Bug Fixes
*********

* The user-provided certificate (via the
  undercloud_service_certificate option) now takes precedence over the
  autogenerated certificate (which is created via the
  generate_service_certificate option)

* Using the "dnsmasq" PXE filter for inspection fixes bug

Changes in instack-undercloud 8.3.0..9.0.0
------------------------------------------

ea55f3d Enable missing support for large objects in Swift
4d57a74 Replace LOG.warn with LOG.warning
b1fe5c0 Always include certmonger_user
6a016a6 Use the default queue when calling create_deployment_plan
3bab129 Fix help string for subnets option
5e1a4d9 Use the new dnsmasq PXE filter in ironic-inspector
73d8eff Fix next_hop for metadata service host route on local_subnet
b8f0603 Updated from global requirements
656722b add lower-constraints job
f9b54b8 Add purge shadow tables to instack-undercloud
122807b Set undercloud nova notification_format to 'unversioned'
41f2694 Enable TLS by default
20c4088 Add Nova UI endpoints to the endpoint list
fafb701 Updated from global requirements
1bc7a07 Ensure mtu is set correctly on ctlplane
b0894d0 Add configuration for the Nova proxy endpoint
db01d14 remove workaround for tuskar* packages
9fc6b98 Make user-provided cert take priority over autogenerated one
a52ba3e [CVE-2018-1000115] memcached: restrict to TCP & localhost
c1dd23c Mariadb online upgrade after yum update
dace40e zuul: do not run containerized undercloud
565a7f4 Remove duplicate entry for neutron::service_plugins
410b9ce remove ownership change of ironic-dbsync.log
998230d Remove cloud-init and disable os-collect-config
e3c3e89 Only delete and re-create managed Mistral workflows
0497316 Don't double load config
b29abfb Remove ceilometer expirer from instack
28ff631 Install and enable neutron baremetal ML2 and L2 agent
3756d3d Enable automatic migration for classic drivers to hardware types
dd05950 Drop inspection_enable_uefi option
b82b8d4 Remove dnsmasq-ironic.conf management
ce5dc7f Update reno for stable/queens
a689f01 Update the outdated links
8ae1c7d Increase size of Heat max_template_size
ffff124 Fix the url for TripleO documentation page
8b65d59 Updated from global requirements
061b995 Update reno for stable/queens


Diffstat (except docs and test files)
-------------------------------------

README.md                                          |   4 +-
.../puppet-stack-config/puppet-stack-config.pp     |  52 ++++---
.../puppet-stack-config.yaml.template              |  32 ++++-
instack_undercloud/undercloud.py                   | 151 ++++++++++++---------
lower-constraints.txt                              |  84 ++++++++++++
.../notes/TLS-by-default-bc12660c12ba7ab1.yaml     |   5 +
.../change-cert-precedence-e1926868d137aa1d.yaml   |   6 +
...or-use-pxe-filter-dnsmasq-611a69bc12011989.yaml |   3 +
.../memcached_hardening-3d6984c9b6e5f3f3.yaml      |   4 +
...migrate-to-hardware-types-df0b6a3bd0f818fc.yaml |   9 ++
.../networking-baremetal-ml2-4b50d6bab617c00c.yaml |   5 +
releasenotes/source/index.rst                      |   1 +
releasenotes/source/queens.rst                     |   6 +
requirements.txt                                   |   6 +-
test-requirements.txt                              |   2 +-
tox.ini                                            |   7 +
undercloud.conf.sample                             |   6 +-
zuul.d/layout.yaml                                 |  12 +-
zuul.d/project.yaml                                |   7 +
21 files changed, 329 insertions(+), 186 deletions(-)


Requirements updates
--------------------

diff --git a/requirements.txt b/requirements.txt
index 16af2ea..3502afb 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -5 +5 @@ six>=1.10.0 # MIT
-python-ironicclient>=2.2.0 # Apache-2.0
+python-ironicclient>=2.3.0 # Apache-2.0
@@ -8 +8 @@ python-novaclient>=9.1.0 # Apache-2.0
-python-mistralclient>=3.1.0 # Apache-2.0
+python-mistralclient!=3.2.0,>=3.1.0 # Apache-2.0
@@ -10 +10 @@ python-swiftclient>=3.2.0 # Apache-2.0
-oslo.config>=5.1.0 # Apache-2.0
+oslo.config>=5.2.0 # Apache-2.0
diff --git a/test-requirements.txt b/test-requirements.txt
index 717ba55..25a9112 100644
--- a/test-requirements.txt
+++ b/test-requirements.txt
@@ -6 +6 @@ openstackdocstheme>=1.18.1 # Apache-2.0
-sphinx!=1.6.6,>=1.6.2 # BSD
+sphinx!=1.6.6,!=1.6.7,>=1.6.2 # BSD