summaryrefslogtreecommitdiff
path: root/releasenotes
AgeCommit message (Collapse)AuthorFilesLines
2022-03-11libvirt: add Cyrus SASL packages for DIGEST-MD5train-eolMark Goddard1-0/+6
Adds Cyrus SASL packages necessary for the DIGEST-MD5 and SCRAM-SHA-256 mechanisms. These can be used for libvirt SASL authentication. Change-Id: I13e19ca29eeab40cd08fa3afe2cdf7531867f81b Partial-Bug: #1964013 (cherry picked from commit e1efa9d257c45e5f99364974ea66a6d6ba5a5605)
2022-03-04Build CentOS Stream 8 imagesMichal Nasiadka1-0/+5
This is part of the effort to allow a migration path for operators using CentOS 7 and Train today. Depends-On: https://review.opendev.org/c/openstack/kolla-ansible/+/831265 Change-Id: I75373eb21c4269c20f72603ad4cf162a472de25b (cherry picked from commit 67d6d28b6208cc004a50f19be1386d88c2404bc4)
2022-02-10Merge "Mitigate two Log4j vulnerabilities in Apache Storm" into stable/trainZuul1-0/+5
2022-02-09Drop CentOS Linux 8 image buildsMichal Nasiadka1-0/+6
(cherry picked from commit 405fca90f2c8d3763ac56ce8b925611d136bba6c) Change-Id: I95ea4a66a80bf035f8bd1180790c7e0c85d759ed (cherry picked from commit 07f519996381789c1f21850cfc9b27f3b86a6f4c)
2022-01-27Mitigate two Log4j vulnerabilities in Apache StormPierre Riteau1-0/+5
The Log4j version was bumped on GitHub [1] but it is still pending inclusion in a release of Apache Storm. Apply the alternative mitigation recommended by Log4j [2] of removing the JndiLookup class from the classpath. [1] https://github.com/apache/storm/pull/3427 [2] https://logging.apache.org/log4j/2.x/security.html Change-Id: Ib3ecd73f9e39e320acb2c5f0962b8af9b1a817e9 (cherry picked from commit 448e4f56aa6218a66b0074329d322c0b6089b2e6)
2021-06-18Fix _get_images_dir when pip-installed with --usertrain-em9.4.0James Pic1-0/+5
There are two cases where pip installs kolla share into ~/.local/share/kolla: - with `pip install --user kolla` - with `pip install kolla` as non-root This patch helps kolla find the share dir in these cases. Closes-Bug: #1930544 Change-Id: I0b3eb6744a34a601266179fb358510a5c500e6ba (cherry picked from commit db78657c231663f3e8ebbc18de43c06ddaa94c97)
2021-06-16Enable Debian updates repoRadosław Piliszek1-0/+9
Backport below Wallaby switching bullseye to buster. Closes-Bug: #1931544 Change-Id: I8460a4159c8da8ae0b856867e068d30fbffb4d34 (cherry picked from commit 789c9c3b84e84796ac8211112fa29f415f560c88)
2021-05-10Merge "[CI] Trust only infra mirrors and fix APT mirrors" into stable/trainZuul1-0/+5
2021-05-10[CI] Trust only infra mirrors and fix APT mirrorsMarcin Juszkiewicz1-0/+5
Infra mirrors get their indices rebuilt to avoid broken indices (due to partial update). Unfortunately, this wipes out the cryptographic signatures. Our approach so far was disabling apt security features globally. However, this is not a valid choice for external repos. It hid an issue we introduced with new RabbitMQ repos missing proper keys installed in the image. This caused permanent failures outside of our CI. Our process should be as close as possible to users' experience. This patch makes CI trust only the mirrors that have their indices rebuilt (so infra mirrors). For Train, fixed missing override parts as well. And it includes also: - I8209770ca1353fd89aacef0859ca3a373645c6b2 - Icb745f628c1c50d9f20df022b08ddc46fccc270c - Id3b55ac470a977be7ee7decdef3b49e8d89a130f Change-Id: Ic5abc4b87fd76f87aba383abf43e95ba70629fcb Co-Authored-By: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org> (cherry picked from commit c364c8be85f4653bf7af1c7ac0378823553e7441) (cherry picked from commit 4a482380408d107c59119b379add34f4b8e87ad7)
2021-05-07Merge "Fix Mistral source images to respect upper-constraints" into stable/trainZuul1-0/+4
2021-05-06rabbitmq: Move to packagecloudMichal Nasiadka1-0/+6
bintray is being shut down 1st of May 2021, rabbitmq docs direct users to packagecloud - so let's move. For Victoria and below, includes I6a3ba599af3deedd450b4ffff6b86a0c04628340 (base: drop Linaro OBS key for CentOS and Ubuntu) For Train, fixes also the order of rpm gpg key imports and yum operations (otherwise CentOS 8 [with dnf] fails because repos are enabled early and keys are missing). And it also pins erlang version where required. Change-Id: I499251d13ca77aea2215f8a879b7bb8dd51f1c9f (cherry picked from commit 641b936bc7fd33203a80bb3827fce7c44d010476)
2021-01-29Fix Mistral source images to respect upper-constraintsRadosław Piliszek1-0/+4
Backport to all supported branches. Change-Id: I4a13bbe959e3324f05d5cf78a3be2415eb2ba7ec (cherry picked from commit 004d9eb5d575fcb140b4d90fb30ced0a81dd3e66)
2020-12-23Mark helm-repository unbuildableRadosław Piliszek1-0/+6
The chart repository is gone and the building fails. Change-Id: I205eb2209cb0ccaecee247b95c65ed65bf4ed9e0
2020-12-18Merge "Add daxio for nvdimm scenario" into stable/trainZuul1-0/+7
2020-12-18Add daxio for nvdimm scenarioMartin Schuppert1-0/+7
nova-compute uses daxio to cleanup vpmem backend device on instance delete. If the daxio binary is missing in the nova-compute container instance delete fails. daxio is provided in centos via daxio, in ubuntu via the pmdk-tools package. Conflicts: docker/base/apt_preferences.debian Also: nova-compute: daxio on CentOS 8 is x86-64 only Change-Id: Ifb5948653565e2ae902783762e20e33527020efe Closes-Bug: 1907124 (cherry picked from commit 6176d54179109e85dee5ebc29a7726bcb05f76a9) (cherry picked from commit 40a1c7a6ebabb1554e0ce7b54d6b356c2bac1ce5) (cherry picked from commit 14b96abd6f6a6671d4dc97035b9ece61145cdcf2)
2020-12-18mariadb: Fixes incremental backup failure when full not created todayabraden1-0/+6
backup_full() saves the history name in $BACKUP_DIR/last_full_date. backup_incremental() attempts to read from $BACKUP_DIR/last_full_date into $LAST_FULL_DATE. After the read attempt; if $LAST_FULL_DATE is zero length then $(date +%d-%m-%Y) is used. Change-Id: I4172b814d5d95ae3debbc1cf3feaeee2e2bec9bd Closes-bug: 1897948 (cherry picked from commit ccfe65b5f7fe437141f342421488c176038fddb0)
2020-12-15Support CentOS 8.3abraden1-0/+21
Backport this until Train. CentOS 8.3 renamed system repos. [1] This caused failures when disabling and enabling. More details in the referenced bug report. Notice CentOS 8.2 and below will no longer work. Train backport also includes some fixes for the fallout from the new pip resolver. * cap bandit<1.6.3, since bandit no longer supports Python 2. * mark kuryr-libnetwork unbuildable for source images. * mark almanach-base & dragonflow-base unbuildable for Debian & Ubuntu source images. * Don't install networking-hyperv in source neutron-server images. pip complains of a conflict. (https://bugs.launchpad.net/kolla/+bug/1907826) [1] https://wiki.centos.org/Manuals/ReleaseNotes/CentOS8.2011#Yum_repo_file_and_repoid_changes Change-Id: I2d67b3ed7b7c521bc755ec9a87365c9962a9eeff Closes-Bug: #1907213 Closes-Bug: #1907826 Co-Authored-By: Radosław Piliszek <radoslaw.piliszek@gmail.com> Depends-On: https://review.opendev.org/766211 Depends-On: https://review.opendev.org/767157
2020-10-14Add sysfsutils to nova-compute ubuntu sourceRadosław Piliszek1-0/+5
This fixes the FC Cinder backend usage in Nova. Change-Id: I036cfe3af3dd96625f986a820c78a10e6558b086 Closes-bug: #1884484 (cherry picked from commit 0c8702c96f852eae7a1fb784a260c01c15fb86f3)
2020-09-17Merge "Fix kolla_set_configs --check with a directory" into stable/trainZuul1-0/+6
2020-09-14Fix Masakari dashboard policy file locationMark Goddard1-0/+5
The horizon image copies the masakari dashboard's policy file to Python site packages, but it should go to /etc/openstack-dashboard. This allows the dashboard to be seen by non-admins, although it fails to load. We get an error like the following in horizon.log: No policy rules for service 'instance-ha' in /etc/openstack-dashboard/masakari_policy.json This change fixes the issue. Change-Id: I8ede183c76a830de06ce6524dc3f6f6944b182c1 Closes-Bug: #1894240 (cherry picked from commit 4f44870376f47c6a65bd02cc83d2ef39fd1f5ae9)
2020-09-14Fix kolla_set_configs --check with a directoryMark Goddard1-0/+6
There are several issues with kolla_set_configs --check: 1. We calculate the destination path incorrectly when comparing a file in a directory, due to passing arguments to os.path.relpath in the wrong order 2. For directories that have not changed, we also attempt to compare them as files, which fails when they are open()ed. 3. If the config JSON does not have a config_files key, it fails with a KeyError. The first two issues affect the fluentd container, which specifies directories as the source, without using a glob. The third affects OVN containers. This patch fixes these issues. Closes-Bug: #1890567 Change-Id: I8921befe51da4282121443849177a7ca5ebe8822 (cherry picked from commit c5320eb22386c34d83435fa0b9aa03b178996b52)
2020-09-04Merge "Use upstream Erlang on CentOS 8" into stable/trainZuul1-0/+6
2020-09-04Use upstream Erlang on CentOS 8Radosław Piliszek1-0/+6
Train only. In CentOS 8 Train we had a mix of rmq upstream and rdo packages, erlang was from RDO and rmq (3.7) from rmq. As this is not really tested by any other party, I propose to unify the sources of both. Change-Id: I52094ce9e3d98cbdedfdc23c8a43dd3093ce1771 Closes-bug: #1884034
2020-09-03Upgrade Fluentd Monasca pluginDoug Szumski1-0/+5
Switch to YAJI JSON parser as suggested in [1]. [1] https://docs.fluentd.org/quickstart/faq#i-got-encoding-error-inside-plugin-how-to-fix-it Closes-Bug: #1889065 Change-Id: I2ecd3b029b956e000feaaa9e10a169521ba53d66 (cherry picked from commit 556d4353aa846765557cfdd3c6e087a25248c517)
2020-07-27Fix masakari-monitors image on CentOS 8Mark Goddard1-0/+4
Train only. The version of libvirt-python allowed by upper-constraints in Train (5.7.0) does not support CentOS 8. This prevented the masakari-monitors image from building. This change modifies the upper constraints file in the masakari-monitors image to use 5.10.0, the earliest version that does support CentOS 8. Change-Id: Ia980be14fdf9c4fc15bb379b940ae491de035725
2020-07-14Fix Logstash 6 log rotation - Stable/TrainBartosz Bezak1-0/+9
Logstash 6 introduced in Centos 8 in Train release comes with log4j2 configuration that does not remove old compressed logs after rotation Log rotation config backported from Logstash 7 - Combination of Size Based and Time Based policies. Deletion occurs after 30 days or 3000 MB log files size - whichever comes first. Change-Id: Ib44f493aad0813a8aba916c7c353b60cab954b5f (cherry picked from commit 15f2af1b0217da0a0281268442202f22915570a1) Closes-Bug: #1886975
2020-07-06Drop systemd support from nsswitch.conf on RHEL-based distros9.2.0Michele Baldessari1-0/+7
A bit like we did for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 we should remove the nss-systemd lookup from containers. The reasons for this are as follows: 1) Just like for I3e0e86026f5a4a78473bed824cd1682d3a020cd5 when this nss module is triggered it tries to talk to dbus. It triggers a bunch of selinux denials and it makes little sense to open all containers to talk to dbus. In particular, if a container is run as non-privileged and bind-mounts /run from the host, we will hit selinux denials like the following: type=USER_AVC msg=audit(1592337775.860:74119): pid=1284 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_call interface=org.freedesktop.DBus member=Hello dest=org.freedesktop.DBus spid=406228 scontext=system_u:system_r:container_t:s0:c162,c886 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'UID="dbus" AUID="unset" SAUID="dbus" 2) It just makes little sense in a kolla-world to have containers talk to dbus/systemd and it saves us some time when a lookup triggers the systemd module for whatever reason. Especially because the nss-systemd module does a few things which are not useful in a container (ensures that the root and nobody users and groups remain resolvable, SystemD's DynamicUser= feature, provide Lookup API via Varlink) The sed regex gives us the wanted results: $ diff -u /etc/nsswitch.conf.orig /etc/nsswitch.conf --- /etc/nsswitch.conf.orig 2020-06-19 07:18:10.974580755 +0000 +++ /etc/nsswitch.conf 2020-06-19 07:20:12.260230103 +0000 @@ -53,9 +53,9 @@ # group: db files # In order of likelihood of use to accelerate lookup. -passwd: sss files systemd +passwd: sss files shadow: files sss -group: sss files systemd +group: sss files hosts: files dns myhostname services: files sss netgroup: sss Related-Bug: #1883849 Change-Id: I81e5b7abf4571fece13a029e25911e9e4dece673 (cherry picked from commit dc2ddfa9750f94430a5b04b62fc1fa6adcb234f8)
2020-07-01Merge "Add Elasticsearch Curator Docker image" into stable/trainZuul1-0/+4
2020-07-01Merge "Add Logstash 6 for Monasca on Centos 8" into stable/trainZuul1-0/+5
2020-06-28Add Elasticsearch Curator Docker imageDoug Szumski1-0/+4
Kolla provides log aggregation, but no solution to set retention periods for aggregated logs. It therefore accumulates log data indefinitely unless a user manually intervenes. This change adds Elasticsearch Curator which provides a mechanism for automating such retention periods [1]. [1] https://www.elastic.co/guide/en/elasticsearch/client/curator/current/about.html The container contains cron to support running Curator periodically. Change-Id: Ief2c554a64ef6cc971635d7e2a718f63c310fbf6 (cherry picked from commit 37de8920aa7394089731c0fae75034c2c3d137ca)
2020-06-26Merge "Fix Monasca Agent Statsd service under Py3" into stable/trainZuul1-0/+4
2020-06-25Fix loading of Storm on Centos8 / Python 3Doug Szumski1-0/+5
In the Centos8 images, Storm fails to start since it cannot find Python. This patch ensures that it can by setting the PYTHON env var. Change-Id: If6663b2f6dfadfd6a6db5e4aaca4eb782b87161f Closes-Bug: #1876461
2020-06-25Add Logstash 6 for Monasca on Centos 8Doug Szumski1-0/+5
On Centos 8 we have Elasticsearch and Kibana 6, but Logstash (used by Monasca) is stuck on 2 which is not compatible. See the product compatibility matrix [1]. This adds Logstash 6, so that Monasca can use the full ELK 6 stack on Centos 8. Note that Monasca doesn't officially support ELK 6, but it does work. [1] https://www.elastic.co/support/matrix#matrix_compatibility Partial-Bug: #1884090 Change-Id: Id6f79e301cc109a029913f5628bab1848c138e7f
2020-06-25Fix Monasca Agent Statsd service under Py3Doug Szumski1-0/+4
Pulls in this fix: https://review.opendev.org/#/c/736610/ Partial-Bug: #1885104 Change-Id: I014c9a52b2f61a86e3a8adafdf4783c3f58148ef
2020-05-27Merge "nova-compute: add ndctl to expose NVDIMMs to guests" into stable/trainZuul1-0/+5
2020-05-26Fix release note formatting by removing extra backtickPierre Riteau1-1/+1
Change-Id: Ic1f94f2f69aa19455093526fab2951f1d556342d
2020-05-26nova-compute: add ndctl to expose NVDIMMs to guestsPiotr Kopec1-0/+5
`ndctl` is a utility for managing the nvdimm subsystem required by Nova for attaching PMEM(persistent memory) namespaces to guests [0]. [0]: https://docs.openstack.org/nova/latest/admin/virtual-persistent-memory.html Change-Id: I8ed1b6c1d0985b2a73206bd9249a5664cd80c912 Closes-Bug: #1870455 (cherry picked from commit f9ea23d940ec4ce35d503ac62f202daaa9db502d)
2020-05-18Merge "switch to official CentOS 8 repositories" into stable/train9.1.0Zuul1-0/+5
2020-05-17switch to official CentOS 8 repositoriesMarcin Juszkiewicz1-0/+5
RDO builds of stable/train for CentOS 8 went into phase when we do not need to use delorean builds. EPEL is disabled like it is in Ussuri (RDO packages may conflict with it). Erlang for RabbitMQ is used from CentOS 8 'rabbitmq-38' repo while RabbitMQ is still 3.7.* from same place as usual. 'python3-pika' is dropped from openstack-base as it is EPEL only package and is not used by any image (dropped in Ussuri in https://review.opendev.org/#/c/710003/ patch) AArch64 is not supported until CentOS 8.2 release. Change-Id: I9d3ed54f4d10ef7ad2d52ed3aeca15f3968cd163
2020-05-08Use Python 3 for mod_wsgi in cyborg and monasca on Debian/UbuntuMark Goddard1-0/+6
In Train kolla switched to Python 3 in Debian and Ubuntu source images. For services running under httpd with mod_wsgi, they should install libapache2-mod-wsgi-py3 rather than libapache2-mod-wsgi. This was done for most images, but cyborg and monasca were omitted. This change fixes that. Change-Id: I25cfa62dbf20490685617b4a4185bf95ab91725e Closes-Bug: #1873421 (cherry picked from commit f5d31da12fa66cedfc2e270b8cd3be8e2bb9254b)
2020-04-23Add nfs dependencies to glance containerRajat Dhasmana1-0/+6
Glance API image lacked nfs programs/utils to be able to mount NFS exports. This affected Glance usage with Cinder backend when NFS was used as Cinder backend. Closes-Bug: #1868574 Change-Id: I3aac1e6a7f7c5f839b036f15713af949fba206cc (cherry picked from commit cac9d46aa6dbac6631bdcae67db125a88e1c3234)
2020-04-22Merge "CentOS 8: Add rabbitmq-3.7.24 image (CentOS 7 only)" into stable/trainZuul1-0/+6
2020-04-17Merge "Add vitrage-persistor image" into stable/trainZuul1-0/+6
2020-04-16Merge "add dpdk_telemetry and logparser for C8, use centos-release-opstools ↵Zuul1-0/+8
for C8" into stable/train
2020-04-16Merge "Ensure proper JSON in keystone bootstrap" into stable/trainZuul1-0/+5
2020-04-15Merge "Add docs and release note for CentOS 8" into stable/trainZuul1-0/+16
2020-04-15CentOS 8: Add rabbitmq-3.7.24 image (CentOS 7 only)Mark Goddard1-0/+6
The CentOS 7 rabbitmq image contains 3.7.10, and the CentOS 8 rabbitmq image contains 3.7.24. These versions are not compatible, which prevents a rolling migration from CentOS 7 to CentOS 8. This change adds a rabbitmq-3.7.24 image, available for CentOS 7 images only. This provides a path for migration, by first upgrading all CentOS 7 rabbitmq containers to use this image. Depends-On: https://review.opendev.org/720218 Change-Id: Icff279be07c4767dd0b18c697894373f46102bf1 Partially-Implements: blueprint centos-rhel-8
2020-04-14Ensure proper JSON in keystone bootstrapRadosław Piliszek1-0/+5
This fixes the issue when keystone-manage output included backslashes and/or double quotation marks which broke JSON string. Change-Id: Ifae18c407210c12745d29fc4c95dca69aeafe6a8 Closes-bug: #1866017 (cherry picked from commit 33d184a731458bb45d1206bdae4fb172629a76e7)
2020-04-11Add vitrage-persistor imageQ.hongtao1-0/+6
Kolla was missing vitrage-persistor image required by Vitrage for data storage. Change-Id: Id5e143636f9a81e7294b775f3d8b9134bee58054 Closes-Bug: #1869319 (cherry picked from commit ad06096448a585a16ad73b610b0adc81b597ccec)
2020-04-09Add elasticsearch6 and kibana6 imagesSylvain Baubeau1-0/+6
Elasticsearch and Kibana only support CentOS 8 from version 6.x, but in Train Kolla uses ELK 5.x. This change adds new elasticsearch6 and kibana6 images based on ELK 6.x only for CentOS 7 and 8. This enables two things: 1. provide elasticsearch and kibana for CentOS 8 in Train 2. provide a migration path from CentOS 7 to 8 that does not involve a simultaneous major upgrade, by first upgrading CentOS 7 to ELK 6.x. The new images are based on the upgrade to 6.x in Ussuri in I8b52b2630a72393bf4b9c7095fc67db6c36c27fa. This includes a switch to start using oss tagged binaries. These binaries contain only features that are available under the Apache 2.0 license. Related: blueprint elasticsearch-kibana-version-upgrade Co-authored-by: Dincer Celik <hello@dincercelik.com> Change-Id: I8b52b2630a72393bf4b9c7095fc67db6c36c27fa
generated by cgit v1.2.3 (git 2.39.1) at 2026-11-05 20:05:54 +0000