castellan 3.10.1 release

meta:version: 3.10.1
meta:diff-start: -
meta:series: yoga
meta:release-type: release
meta:pypi: no
meta:first: no
meta:release:Author: Daniel Bengtsson <dbengt@redhat.com>
meta:release:Commit: Daniel Bengtsson <dbengt@redhat.com>
meta:release:Change-Id: I5975a5917c875817bc2faed18a0dc7c3f9705372
meta:release:Code-Review+2: Hervé Beraud <herveberaud.pro@gmail.com>
meta:release:Code-Review+2: Elod Illes <elod.illes@est.tech>
meta:release:Workflow+1: Elod Illes <elod.illes@est.tech>

Change-Id: I086d90b6f46e31582d412b8725e48cba5c21d6bc

Change-Id: If1e244c808eeb5303b6b29d723cd60cdb66e6e86

Vault Namespaces [0] is a feature available in Vault Enterprise that
can be considered as a more advanced isolation feature on top of current
KV Mountpoint option in Castellan Vault plugin.

Passing a namespace in all request headers (including Auth) allows to organize
Vault-in-Vault style of isolation, with clients using the same simple URI path
but accessing separate sets of entities in Vault.

[0] https://www.vaultproject.io/docs/enterprise/namespaces

Change-Id: I627c20002bb2a0a1b346b57e824f87f856eca4c9

previous pattern ignored any file that started with 'vault_'.
While not affecting changes to the vault_key_manager.py file that was
already checked into the repository, this pattern effectively hides said
file from many modern search tools (like ack, ag or ripgrep)
that by default ignore files according to .gitignore patterns.

This patch changes this pattern to ignore 'vault_*' files and
directories only in the root of the repo.

Change-Id: Id2095d9a401154435c346916e10df777b70d28dc

This is an automatically generated patch to ensure unit testing
is in place for all the of the tested runtimes for yoga.

See also the PTI in governance [1].

[1]: https://governance.openstack.org/tc/reference/project-testing-interface.html

Change-Id: Id850ad18409023a9303fbeb4f9326dd4a3878134

Add file to the reno documentation build to show release notes for
stable/xena.

Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/xena.

Sem-Ver: feature
Change-Id: I1f1fdd54490efa1ca406c7e6b807ce643a73f613

castellan 3.9.1 release

meta:version: 3.9.1
meta:diff-start: -
meta:series: xena
meta:release-type: release
meta:pypi: no
meta:first: no
meta:release:Author: Hervé Beraud <hberaud@redhat.com>
meta:release:Commit: Hervé Beraud <hberaud@redhat.com>
meta:release:Change-Id: I63492f11606983f672011cafb03b21fe14fb0214
meta:release:Code-Review+2: Hervé Beraud <herveberaud.pro@gmail.com>
meta:release:Code-Review+2: Thierry Carrez <thierry@openstack.org>
meta:release:Workflow+1: Thierry Carrez <thierry@openstack.org>

Change-Id: Ic01b44f168a5d199fc0b7119adc3d0bf52d027e0

This change adds support to the Barbican key manager for configuring a
service user. This can be used to provide additional security through
the combination of a user token and a service token, with appropriate
modifications to Barbican API policy.

Use of a service user is enabled via the [barbican]
send_service_user_token option, which defaults to False. When set to
True, the service user is configured via keystoneauth options in the
barbican_service_user group.

Change-Id: I143cb57c8534a8dc0a91e6e42917dd0c134170c0

The patch bumps min version of tox to 3.18.0 in order to
replace tox's whitelist_externals by allowlist_externals option:
https://github.com/tox-dev/tox/blob/master/docs/changelog.rst#v3180-2020-07-23

Change-Id: Id9b9f5c3a99f6b3717a69a65e1aadc25aa4d48b4

openstack-tox-docs job started to fail with the following error:

! LaTeX Error: File `tgtermes.sty' not found.

This patch adds the required font package to bindep doc profile.

Change-Id: I242da5c4fcc3096a47f85bd8a265ad8f072b2a30

Resolves warnings like the following:

  UserWarning: Usage of dash-separated 'description-file' will not be
  supported in future versions. Please use the underscore name
  'description_file' instead

Change-Id: I172ea38886f6d6ed55eb8ef4337824e075fd1297

The goal here is to avoid conflicts between flake8 and hacking version each
2 days.

Inspired from nova's approach[1].

The flake8 version to install will be determined by hacking and
requirements[2] will stay aligned instead of relying on different versions.

[1] https://opendev.org/openstack/nova/src/branch/master/.pre-commit-config.yaml#L26-L35
[2] https://opendev.org/openstack/hacking/src/branch/master/requirements.txt#L1

Change-Id: I29daa7205fc28e2768792c24fa054257e9f66674

This is an automatically generated patch to ensure unit testing
is in place for all the of the tested runtimes for xena.

See also the PTI in governance [1].

[1]: https://governance.openstack.org/tc/reference/project-testing-interface.html

Change-Id: Ia049005001e29c84957ebebbeae922cab0f60e97

Add file to the reno documentation build to show release notes for
stable/wallaby.

Use pbr instruction to increment the minor version number
automatically so that master versions are higher than the versions on
stable/wallaby.

Sem-Ver: feature
Change-Id: Ia9a6c82e840dc8cbd6d37aca394e718a03ba4c77

These were missed in change: I1d4de15d017a306e64df8447cf1bd64c70cf361a

Change-Id: I906c1e5f24aa93d7cc65f149b9164f85a7c57e7c

castellan 3.7.1 release

meta:version: 3.7.1
meta:diff-start: -
meta:series: wallaby
meta:release-type: release
meta:pypi: no
meta:first: no
meta:release:Author: Hervé Beraud <hberaud@redhat.com>
meta:release:Commit: Hervé Beraud <hberaud@redhat.com>
meta:release:Change-Id: Id73da4b9db2ed57c06ebf9d541f8baee5b5003d4
meta:release:Code-Review+2: Hervé Beraud <hberaud@redhat.com>
meta:release:Code-Review+2: Sean McGinnis <sean.mcginnis@gmail.com>
meta:release:Workflow+1: Sean McGinnis <sean.mcginnis@gmail.com>

... so that we can easily identify the logics which are referring to
configuration parameters.

Change-Id: I93427a64b83f474c7c2dd45c8c200e7a3c9bc6f9

This change introduces a new option to define the region to which
the Barbican endpoint belongs. This is required if the deployment has
multiple regions and a single Keystone instance stores multiple
Barbican endpoints for different regions.
This change also ensures that the same interface and region are used
in endpoint detection and api version detection.

Change-Id: If2c0055d45922937e259a8f22f5879c9faa41e35

Change-Id: Ibd761519cb6ef2ee27aebe2b02c80c8c5c0b7ca4

We facing errors related to the new pip resolver, this
topic was discussed on the ML and QA team proposed to
to test lower-constraints [1].

I propose to drop this test because the complexity and recurring pain needed
to maintain that now exceeds the benefits provided by this mechanismes.

[1] http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019390.html

Change-Id: I1d4de15d017a306e64df8447cf1bd64c70cf361a

It is standard practice to search for services in the catalog by
service type and interface only. Service name should be left
to deployers to choose and this could be something other than barbican.

Change-Id: I9dddba1e52bbf1ee1d8227fdb45e625fdbf0a21b