July 2026 - Release-announce - lists.openstack.org

oslo.service 4.8.0 (hibiscus)
by no-reply＠openstack.org 31 Jul '26

31 Jul '26

We are happy to announce the release of: oslo.service 4.8.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/oslo.service Download the package from: https://pypi.org/project/oslo.service Please report issues through: https://bugs.launchpad.net/oslo.service/+bugs For more details, please see below. 4.8.0 ^^^^^ Upgrade Notes ************* * Applications relying on the threading backend's brief automatic selection of "spawn" must now request it explicitly. Existing applications that relied on workers inheriting parent-process state keep the historical "fork" behavior. Bug Fixes ********* * The threading backend once again uses "fork" by default on platforms where it is available. A service and its configuration being picklable does not guarantee that application state initialized in the parent process is available in a fresh "spawn" worker. Applications that are fully spawn-safe can opt in with "service.launch(..., start_method="spawn")". On platforms without "fork", "spawn" remains the default. Explicit spawn requests validate that the service and "ConfigOpts" can be serialized. Changes in oslo.service 4.7.0..4.8.0 ------------------------------------ f402f4e Keep fork as the default multiprocessing method 064dcc8 Ensure extra dependency for bandit to use toml 1d25fb9 Add fork-safety regression tests and CI job for spawn multiprocessing Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 1 + .zuul.yaml | 14 + oslo_service/backend/_threading/service.py | 111 +++--- .../functional/test_fork_safety_regression.py | 380 +++++++++++++++++++++ ...tiprocessing-start-method-5f8702b62dfe3c9a.yaml | 18 + tox.ini | 12 + 11 files changed, 664 insertions(+), 84 deletions(-)

1 0

tooz 9.0.1
by no-reply＠openstack.org 30 Jul '26

30 Jul '26

We are jazzed to announce the release of: tooz 9.0.1 The source is available from: https://opendev.org/openstack/tooz Download the package from: https://pypi.org/project/tooz For more details, please see below. 9.0.1 ^^^^^ Bug Fixes * Fixed a bug where blocking lock acquisition (e.g. "MemcachedLock.acquire()" with its default "blocking=True") was incorrectly treated as a 1-second timeout instead of "no limit", causing it to raise "tenacity.RetryError" after about a second instead of waiting for the lock to free up. Changes in tooz 9.0.0..9.0.1 ---------------------------- 100d17f retry: Don't treat bool as a numeric stop_max_delay 173183c zookeeper: Fix wrong member used by get_member_capabilities Diffstat (except docs and test files) ------------------------------------- ...retry-bool-stop-max-delay-3f8f7e0a9c1b4d2e.yaml | 8 +++ tooz/_retry.py | 4 +- tooz/drivers/zookeeper.py | 2 +- 4 files changed, 73 insertions(+), 2 deletions(-)

1 0

ironic 38.0.0 (hibiscus)
by no-reply＠openstack.org 30 Jul '26

30 Jul '26

We enthusiastically announce the release of: ironic 38.0.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 38.0.0 ^^^^^^ New Features ************ * Adds a new "ironic-manage" utility. Its first sub-commands, "ironic- manage drivers hardware-types" and "ironic-manage drivers interfaces [<interface type> ...]", list the hardware type and hardware interface entry points installed on the system, to help operators discover valid values for the "[DEFAULT]enabled_hardware_types" and "[DEFAULT]enabled_<interface type>_interfaces" configuration options. * Add new configuration options under the "[api]" group in config: "disallow_deploy_steps", "disallow_clean_steps", and "disallow_service_steps". Using these operators can block specific steps from being executed across all workflows. Each option accepts a list of steps in "interface.step" format (e.g. "raid.create_configuration"). Steps are rejected at the API level with an error for user-requested operations, and silently filtered at the conductor level for automated workflows (driver steps, deploy templates, runbooks). All three options are mutable and can be reloaded via SIGHUP without restarting services. For more information, refer to ` bug 2150456 <https://bugs.launchpad.net/ironic/+bug/2150456>`. Known Issues ************ * System operators should note that changing the owner field on a node does not affect its child or parent nodes, potentially resulting in these nodes being in different projects. Upgrade Notes ************* * Adds an upgrade check that issues a warning when any node has a different owner from its parent node. * The "/v1/events" API now validates request bodies using the Ironic API schema validation framework. Invalid event requests continue to return an error response, but some validation failures may now include a more generic error message than before. * The deprecated "[oslo_policy] enforce_scope" configuration option has been removed in oslo.policy version 6.0.0 which will impact Ironic as there is no longer any way to disable RBAC policy scope enforcement; scope checks are now always enforced regardless of configuration. If you are not upgrading the oslo.policy to 6.0.0, then there will not be any change in scope enforcement behaviour. * Support for Python 3.10 has been removed. Now Python 3.11 is the minimum version supported. * The default value of "tls_minimum_version" in the "[api]", "[json_rpc]", and "[agent]" configuration groups, as well as the "webserver_tls_minimum_version" option in "[DEFAULT]", has been changed from "1.2" to "1.3". TLS 1.3 is widely supported and is required for Post-Quantum Cryptography key exchange. This change was discussed on the openstack-discuss mailing list with no objections. Operators whose infrastructure does not yet support TLS 1.3 can restore the previous behavior by setting "tls_minimum_version = 1.2" in the affected configuration groups. Deprecation Notes ***************** * Depreciate the "management" interface for providing firmware updates. This was added prior to the creation of the dedicated "firmware" interface which supports all the update operations of the "management" with additional process and feature fixes coming to the "firmware" interface only. Security Issues *************** * Addresses a potential security issues where an admin of a project could create nodes with "parent_node" set to a node from a different project. * Prevents changing the "node_uuid" of ports, port groups, volume targets, and volume connectors to point to a node with a different owner from the initial node. In some cases this is not normally permitted due to the database model, but additional access checking was added across these similar resources for consistency in the event the Ironic project fixes 12150252 (https://bugs.launchpad.net/ironic/+bug/2150252) * The IPMI Vendor-Passthru interface method "send_raw" step has been disabled by default due to security implications. A malicious user with sufficient Ironic access could utilzie this interface to make manual changes to BMCs when the "ipmitool" vendor-passthru interface was enabled. * Hardens the Ironic inspector LLDP parsing by checking for maximum length of TLV value as defined in the standard (511 octets). Furthermore, adds an upper bound for possible interfaces that a device can send inspection data about (64). *bug 2155051 <https://bugs.launchpad.net/ironic/+bug/2155051>* * Kickstart configdrive URL fetches and inspection rule "api-call" actions now use TLS-hardened sessions, applying the "webserver_verify_ca", "webserver_tls_minimum_version", and "webserver_tls_ciphers" settings. Previously these code paths used bare "requests.get()" or "requests.Session()" calls without TLS hardening, potentially allowing TLS downgrade attacks on these connections. * The minimum TLS protocol version now defaults to 1.3 across all Ironic services, improving security posture and enabling Post- Quantum Cryptography key exchange support. Bug Fixes ********* * The autodetect deploy interface now supports adopting nodes. * The "[pxe]pxe_bootfile_name_by_arch" and "[pxe]ipxe_bootfile_name_by_arch" options now support composite keys in the format "arch-boot_mode" (e.g. "x86_64-bios:undionly.kpxe", "x86_64-uefi:snponly.efi"). The composite key is tried first, then the arch-only key as a fallback, preserving backward compatibility. Previously it was not possible to specify different boot files for the same architecture in different boot modes (e.g. x86_64 in both UEFI and BIOS), because the boot mode check was skipped when a by- arch entry matched. Fixes bug 2157027 (https://bugs.launchpad.net/ironic/+bug/2157027) * Fixes a bug where ironic allowed the ability for operators to send raw commands when the "ipmitool" vendor interface was enabled and configured for a baremetal node utilizing the IPMI protocol. The Ironic project generally recommends the use of "redfish" instead of IPMI, however recognizes that is not universally possible for all operators. More information can be found in bug 2150458 (https://bugs.launchpad.net/ironic/+bug/2150458) * Fixes BIOS firmware updates via Redfish SimpleUpdate on Dell iDRAC failing silently when the BMC purges the TaskMonitor before Ironic can observe it. Previously, a disappeared task was assumed successful and cleaning completed without rebooting, leaving the staged firmware unapplied. Now, a reboot is triggered to apply the staged BIOS update via the BMC's scheduled job. * Fixes a security issue where user can list volume connectors, volume targets and ports of nodes that they are not authorized to access. Volume connectors and target could be listed when specifying the node ID and ports could be listed by giving a valid shard. Related bug report bug 2150461 (https://bugs.launchpad.net/ironic/+bug/2150461) * Fixes a race condition where deleting a node could return an HTTP 409 (NodeLocked) error to the caller even though the node was successfully deleted. This occurred because the task manager's resource cleanup attempted to release the database reservation on the already-deleted node row, which could raise "NodeLocked" instead of "NodeNotFound" depending on transaction visibility timing. A subsequent retry by the client would then return HTTP 404, confusing operators. The conductor now clears its task reference to the node immediately after a successful deletion so that the cleanup path no longer attempts to release a reservation on a non-existent row. * Fixes a bug where Redfish firmware updates were incorrectly declared as failed when the BMC task was in the "New" state. Some BMCs, notably Dell iDRAC, return "TaskState.NEW" immediately after a "SimpleUpdate" request before the task transitions to "Starting". Previously, the "New" state was not recognized as an in-progress state and was treated as a terminal failure, causing the firmware update to be aborted with a misleading error message such as "Error: New". * Fixes the "_query_update_status" periodic task to use the "[redfish]firmware_update_status_interval" configuration option for its polling interval instead of "[redfish]firmware_update_fail_interval". Both options default to 60 seconds, so this was only visible when they were explicitly configured to different values. * No longer attempts to list Glance image members for images whose visibility is not "shared". Glance rejects member listing for non- shared images with a 403 error, which previously caused a spurious error to be logged on every access check for public, community, and private images. * It is documented as being able to use the 'noop' deploy interface with the manual-management hardware type and used as an example in the documentation. However the manual-management hardware type did not report that it supported 'noop' so it was not possible to do this operation so fix the code to allow it. * Fixes an issue where the conductor's internal metrics (written to "$(hostname)-ironic.metrics") were not collected when "ironic- conductor" ran under oslo.service's **spawn** worker model with "[metrics] backend = collector". The module-level "METRICS" logger in "ironic.conductor.manager" was created at import time before configuration was restored in the spawned child process, defaulting to "NoopMetricLogger". Calls to "get_metrics_data()" then raised "MetricsNotSupported" on every sensor data collection cycle. The "METRICS" logger is now re-created after "prepare_command()" restores configuration, matching the configured backend. Operators using "ironic-prometheus-exporter" should see the conductor metrics file generated correctly alongside per-node hardware metrics. * Fixes an intermittent failure of "redfish-virtual-media" based boot (used during inspection, cleaning and deployment) where the node could power on with no ISO actually mounted, leading to a timeout with no useful error. Some BMCs continue to report virtual media as still "Inserted" for a short window after a successful eject, and because the boot ISO URL is derived from the node UUID, the previously inserted URL matched the one about to be inserted, so the insert was skipped. Ironic now ejects any virtual media already present before inserting, instead of trusting the reported state. * Fixes an issue for setting bios parameters on hardware where pending settings contain all bios settings. See bug 2157002 (https://bugs.launchpad.net/ironic/+bug/2157002) * Fixes fast-track after inspection, if the first heartbeat is blocked by ongoing processing. Previously in this case "agent_url" would not be recorded on the node, and the agent was wrongly presumed dead. * Fixed an issue where inserting into the "node_history" table could fail when the event string exceeded the database column's 64KiB limit. Long events are now safely truncated based on UTF-8 encoded byte length, preserving an equal distribution of the beginning and the end of the event message to maintain troubleshooting context. * Fixes filesystem corruption errors (particularly visible on iDRAC consoles) that could occur when Redfish virtual media was ejected while the ramdisk OS was still running. The soft power off previously added during inspection tear-down is reverted; instead, the "redfish-virtual-media" boot interface now powers the node off before ejecting virtual media during ramdisk cleanup. See bug 2160374 (https://bugs.launchpad.net/ironic/+bug/2160374) * Fixes an issue where the conductor periodic task "ConductorManager._send_sensor_data" was not scheduled when "ironic- conductor" ran under oslo.service's **spawn** worker model. The task could appear in debug logs as "found" during "init_host()", but futurist never submitted it, so no sensor data was published to the notification bus even when "[sensor_data] send_sensor_data" was enabled in "ironic.conf". Spawn workers unpickle the conductor manager before configuration is reloaded in the child process. The "enabled" flag for this periodic was therefore evaluated at import time using the default value ("False"). Ironic now defers evaluation of "enabled" and "interval" for this task until configuration is available, and refreshes periodic attributes after spawn unpickling and when periodic tasks are collected. Operators using "ironic-prometheus-exporter", Ceilometer, or other consumers of conductor sensor notifications should see data collection resume without changing configuration. Other conductor periodics were not affected. * Neutron port operations now always use service credentials from config, rather than the user's token context. This prevents ports being created with an unexpected project id (e.g. the project id of the user's context). * Fixed the noVNC websocket proxy to copy the "[cors] allowed_origin" configuration value before appending the per-request "Host" header, preventing mutation of the shared oslo.config cached list object. See bug 2160548 (https://launchpad.net/bugs/2160548) Changes in ironic 37.0.0..38.0.0 -------------------------------- 6fffcf48d Enable `oslo_versionedobjects.mypy` plugin for mypy a6ea2f5e5 Power off before ejecting redfish virtual media on ramdisk cleanup ecdbab816 Another attempt to fix fast-track after inspection f82e8e157 Switch Metal3 functional jobs to 16GiB nodeset 281f1e191 Remove remaining referemce to python-dracclient 1b46c72bf doc: provide definitions of hardware types, drivers and interfaces 3efa8fa2d Add supports_deploy to AnsibleDeploy for autodetect 3e9f6b8eb Fix ironic-standalone-redfish POST_FAILURE 6984bfb24 Replace deprecated datetime.datetime.utcnow 08d285a8e Remove Python 3.10 support 351faac85 Add TLS hardening for kickstart configdrive and inspection rule connections 74ec2d48a Fix destroy_node race condition 299203f7a Maintain driver dependencies as optional dependencies 95cae9eb4 Fix Redfish firmware update handling of NEW task state 43cc6bb3e Fix autodetect deploy interface failing during node adoption 762cde0a0 security: Fix poisoning of the allowed origin list 27083f063 Use service auth for Neutron port operations 3330261e3 Drop unused bandit dec6a8a14 Remove disabling the scope enforcement c1fc50663 Ensure docker-buildx is installed on dpkg platforms 8ee65c75d Conditional check of remaining pending attributes dcfb2fa01 Remove setting of oslo_policy[enforce_scope] flag d7ad21698 CVE-2026-44918: Prevent rehoming resources to nodes with different owner e8faed84c Trivial: fix pep8 violations in redfish/firmware.py 7bbe5a2da security: block vendor.send_raw (CVE-2026-54423) 972e76481 Move RFB readiness wait to BaseConsoleContainer 495a587ea Fix BIOS firmware update not applied when TaskMonitor disappears 6071f482a add types to hardware types for supported interfaces 3421bfbe7 Only query Glance image members for shared images c92aa0037 add a mypy tox environment and CI job 9c1173694 add ironic-manage to CLI references doc section 6285b6a36 Limit LLDP TLV value length and interfaces 4419f8602 fix manual-management hardware type to use noop per the docs 9ff31d3f5 Add ironic-manage command for driver discoverability 1992a1e69 api: Add schema for volume API 4393baf91 api: Add schema for conductors API 4596f43a0 add type hints to arginfo for the steps and annotate step helpers 12a44fad2 annotate the base driver/interface methods as stubs c6961a133 add types to driver interfaces base class for steps and task 259f1814f Add a ParsedKernelCommandLine type 50a90e773 Fix release codename in webapi version history e1e81f8f0 Replace deprecated remotable_classmethod 7a26aef6c Modernize the Metal3 functional jobs 13d5e8d03 Switch jobs to build centos10 IPA images d9a577053 Fix METRICS logger not refreshed after spawn unpickle 5e550279f docs: Add a Getting Started map to the landing page dbea2cca3 fix broken project scoping e325fb79f Document the owner/lessee trust model 3b17f618d Fix autodetect ramdisk deploy with vmedia via Nova 882b345eb Add project field to node history 752bcc22a api: Add schema for volume_target/_connector API cfad89b81 api: Add schema for portgroups API ab6a22bdf Fix bootfile_name_by_arch to consider boot mode eeace5fde Clarify the ordering in [ipmi]cipher_suite_versions 4b5b9c144 Stop reimporting middleware modules 260e58e39 docs: Augment bootc docs 631074ed9 Add releasenote for disallow-steps feature 1069c0f1e Stop skipping Redfish vmedia insert on stale BMC state 9abf6a73e Default TLS minimum version to 1.3 40134c445 Fix send_sensor_data periodic with oslo.service spawn workers feb57cf25 follow-up: tls getattr cleanup d2b7cc15d api: Add schema for events API 3cf88f2a7 doc: highlight firmware interface and deprecate management for updates 75f2e20d8 Truncate node history event to avoid DB column overflow Diffstat (except docs and test files) ------------------------------------- bindep.txt | 1 + devstack/lib/ironic | 21 +- driver-requirements.txt | 10 - ironic/api/app.py | 4 +- ironic/api/controllers/v1/__init__.py | 1 - ironic/api/controllers/v1/allocation.py | 8 +- ironic/api/controllers/v1/conductor.py | 10 + ironic/api/controllers/v1/event.py | 76 +---- ironic/api/controllers/v1/node.py | 36 +-- ironic/api/controllers/v1/port.py | 18 +- ironic/api/controllers/v1/portgroup.py | 94 +++--- ironic/api/controllers/v1/utils.py | 80 +++-- ironic/api/controllers/v1/versions.py | 3 +- ironic/api/controllers/v1/volume.py | 5 + ironic/api/controllers/v1/volume_connector.py | 40 ++- ironic/api/controllers/v1/volume_target.py | 50 ++-- ironic/api/middleware/__init__.py | 28 -- ironic/api/schemas/__init__.py | 0 ironic/api/schemas/common/request_types.py | 2 + ironic/api/schemas/common/response_types.py | 10 + ironic/api/schemas/v1/__init__.py | 0 ironic/api/schemas/v1/conductor.py | 109 +++++++ ironic/api/schemas/v1/event.py | 50 ++++ ironic/api/schemas/v1/portgroup.py | 213 ++++++++++++++ ironic/api/schemas/v1/volume.py | 25 ++ ironic/api/schemas/v1/volume_connector.py | 145 +++++++++ ironic/api/schemas/v1/volume_target.py | 153 ++++++++++ ironic/api/validation/validators.py | 11 + ironic/command/manage.py | 157 ++++++++++ ironic/command/status.py | 37 +++ ironic/common/driver_factory.py | 4 +- ironic/common/glance_service/service_utils.py | 7 +- ironic/common/inspection_rules/actions.py | 26 +- ironic/common/kernel_parameters.py | 22 +- ironic/common/kickstart_utils.py | 14 +- ironic/common/neutron.py | 4 +- ironic/common/release_mappings.py | 4 +- ironic/common/rpc_service.py | 12 + ironic/common/wsgi_service.py | 4 +- ironic/conductor/base_manager.py | 2 + ironic/conductor/manager.py | 19 +- ironic/conductor/periodics.py | 65 +++- ironic/conductor/utils.py | 16 +- ironic/conf/agent.py | 4 +- ironic/conf/api.py | 10 +- ironic/conf/default.py | 4 +- ironic/conf/ipmi.py | 4 +- ironic/conf/json_rpc.py | 4 +- ironic/conf/pxe.py | 16 +- ironic/console/container/base.py | 44 +++ ironic/console/container/fake.py | 2 + ironic/console/container/kubernetes.py | 2 + ironic/console/container/systemd.py | 26 +- ironic/console/websocketproxy.py | 3 +- ironic/db/api.py | 13 +- .../16990309ad9d_add_project_to_node_history.py | 27 ++ ironic/db/sqlalchemy/api.py | 10 +- ironic/db/sqlalchemy/models.py | 47 ++- ironic/drivers/base.py | 326 ++++++++++++++------- ironic/drivers/generic.py | 6 + ironic/drivers/hardware_type.py | 76 +++-- ironic/drivers/modules/ansible/deploy.py | 13 + ironic/drivers/modules/deploy_utils.py | 30 +- .../drivers/modules/inspector/hooks/parse_lldp.py | 18 +- ironic/drivers/modules/inspector/interface.py | 20 +- ironic/drivers/modules/inspector/lldp_parsers.py | 12 + ironic/drivers/modules/inspector/lldp_tlvs.py | 3 + ironic/drivers/modules/redfish/bios.py | 7 +- ironic/drivers/modules/redfish/boot.py | 26 +- ironic/drivers/modules/redfish/firmware.py | 32 +- ironic/drivers/modules/redfish/management.py | 5 + ironic/objects/allocation.py | 18 +- ironic/objects/base.py | 1 - ironic/objects/bios.py | 21 +- ironic/objects/chassis.py | 12 +- ironic/objects/conductor.py | 15 +- ironic/objects/deploy_template.py | 15 +- ironic/objects/deployment.py | 9 +- ironic/objects/firmware.py | 6 +- ironic/objects/inspection_rule.py | 6 +- ironic/objects/node.py | 21 +- ironic/objects/node_history.py | 19 +- ironic/objects/node_inventory.py | 3 +- ironic/objects/port.py | 25 +- ironic/objects/portgroup.py | 21 +- ironic/objects/runbook.py | 30 +- ironic/objects/trait.py | 15 +- ironic/objects/volume_connector.py | 15 +- ironic/objects/volume_target.py | 18 +- .../unit/api/controllers/v1/test_allocation.py | 1 - .../console/securityproxy/test_websocketproxy.py | 65 ++++ .../unit/drivers/modules/ansible/test_deploy.py | 36 ++- .../modules/inspector/hooks/test_parse_lldp.py | 31 ++ .../unit/drivers/modules/redfish/test_bios.py | 39 ++- .../unit/drivers/modules/redfish/test_boot.py | 73 ++++- .../unit/drivers/modules/redfish/test_firmware.py | 72 ++++- .../drivers/modules/redfish/test_management.py | 6 +- .../unit/drivers/modules/test_agent_client.py | 11 +- .../unit/drivers/modules/test_deploy_utils.py | 56 ++++ playbooks/bmo-ci/post.yaml | 2 + playbooks/bmo-ci/pre.yaml | 46 +-- playbooks/bmo-ci/run.yaml | 2 + playbooks/irso-ci/post.yaml | 2 + playbooks/irso-ci/pre.yaml | 12 +- playbooks/irso-ci/run.yaml | 5 +- pyproject.toml | 81 ++++- .../notes/2150450-owners-b4019d5fa63a8bc1.yaml | 21 ++ .../notes/add-ironic-manage-3c45d8b1f7a01b81.yaml | 9 + .../notes/autodetect-adopt-c08aeabdb1345151.yaml | 4 + ...h-boot-mode-composite-key-2b0a10764f3b71a9.yaml | 13 + ...50456-step-disallow-lists-3053d47e014b08cf.yaml | 17 ++ ...-management-intf-firmware-8d808ba12cd5d524.yaml | 8 + .../notes/disable_send_raw-f92217bf07c3eb38.yaml | 20 ++ ...i-schema-validation-error-7c7a9b2f0c4e1a35.yaml | 7 + ...x-bios-update-silent-fail-5b14fa74108b3bfa.yaml | 9 + ...ix-broken-project-scoping-86c5d19912158085.yaml | 8 + ...destroy-node-release-race-b2de846007604f1c.yaml | 14 + ...are-update-new-task-state-ae20a293c30843ba.yaml | 16 + ...ce-member-list-non-shared-11a4d0edcb2be0dd.yaml | 8 + .../fix-manual-management-a694bf26fb99aba0.yaml | 8 + .../notes/fix-metrics-logger-909667ad20e3fb1d.yaml | 20 ++ ...-vmedia-stale-insert-skip-efb08f97ebd7b1b6.yaml | 12 + .../fix-set-bios-setting-9097a5447fb397de.yaml | 6 + .../harden-lldp-tlv-parsing-1583bbf1ff9131f3.yaml | 7 + .../notes/inspect-fast-track-76013246248e6a21.yaml | 6 + ...-inspection-tls-hardening-553b614b9ccfc1f4.yaml | 10 + ...-history-event-truncation-1ff1266dbedda269.yaml | 9 + ...edia-eject-cleanupramdisk-eb331db8a39d727c.yaml | 10 + ...ng-rbac-scope-enforcement-4dc79997f34b9f0c.yaml | 10 + .../notes/remove-py310-4d6556dcf0f9f66e.yaml | 5 + ...send-sensor-data-periodic-edd680131e9c50f7.yaml | 24 ++ .../notes/tls-default-1.3-9a5e3133cfc241b6.yaml | 18 ++ ...r-neutron-port-operations-03c8349ee5c06e3b.yaml | 6 + ...rigin-allowlist-poisoning-ba6ab2c92e006f58.yaml | 8 + requirements.txt | 4 +- test-requirements.txt | 1 - tox.ini | 28 +- zuul.d/ironic-jobs.yaml | 18 +- zuul.d/metal3-jobs.yaml | 62 ++-- zuul.d/project.yaml | 6 +- 185 files changed, 4297 insertions(+), 1207 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 52af16780..ae8638129 100644 --- a/requirements.txt +++ b/requirements.txt @@ -18 +18 @@ oslo.middleware>=3.31.0 # Apache-2.0 -oslo.policy>=4.5.0 # Apache-2.0 +oslo.policy>=6.0.0 # Apache-2.0 @@ -34 +34 @@ tenacity>=6.3.1 # Apache-2.0 -oslo.versionedobjects>=1.31.2 # Apache-2.0 +oslo.versionedobjects>=3.10.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index b46305fb8..30f7940ad 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10 +9,0 @@ WebTest>=2.0.27 # MIT -bandit>=1.1.0,<2.0.0 # Apache-2.0

1 0

ironic-python-agent-builder 7.3.0 (hibiscus)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We are stoked to announce the release of: ironic-python-agent-builder 7.3.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/ironic-python-agent-builder Download the package from: https://tarballs.openstack.org/ironic-python-agent-builder/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent-builder/+bugs For more details, please see below. 7.3.0 ^^^^^ Bug Fixes * Fixes a delay of up to 30 seconds during boot when a node is deployed via virtual media without a configuration drive. The configuration drive resolution script now detects the Ironic boot device by its publisher id and, when that device has no "config-2" label, concludes immediately that no configuration drive is present instead of polling for the full timeout. A stale "config-2" partition left on a local disk no longer stalls boot. Changes in ironic-python-agent-builder 7.2.0..7.3.0 --------------------------------------------------- ab68ebc Remove debug kernel packages from IPA ramdisk 2d925c5 Remove GPU, WiFi and vendor laptop firmware from ramdisk 95f71b2 Prune additional paths from ramdisk to reduce initramfs size 7723cfb Uninstall unnecessary packages to reduce ramdisk size 89c6700 Fix IPA service not starting on CentOS 10 (systemd 257) a5d38a6 Mask dnf-makecache and fwupd-refresh services in ramdisk 012f3cf Fix codespell job 5cf1242 Skip config drive wait when none is present a39a26b Replace tabs with spaces ae43776 Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- .../environment.d/10-defaults.bash | 14 ++++++-- .../package-installs.yaml | 42 +++++++++++++++++++--- .../post-install.d/80-ironic-python-agent-ramdisk | 15 ++++++-- .../post-install.d/99-remove-extra-packages | 6 ++-- .../system-preset/90-ironic-python-agent.preset | 4 +++ .../bin/ironic-python-agent-resolve-configdrive.sh | 16 +++++++++ .../cleanup.d/99-ramdisk-create | 12 +++++++ .../fix-configdrive-no-wait-042e9d27164a3ef9.yaml | 10 ++++++ .../re-enable-simple-init-b1dd1edc2ba9d646.yaml | 2 +- releasenotes/source/2026.1.rst | 6 ++++ releasenotes/source/index.rst | 1 + 11 files changed, 115 insertions(+), 13 deletions(-)

1 0

ironic-prometheus-exporter 4.9.0 (hibiscus)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We are excited to announce the release of: ironic-prometheus-exporter 4.9.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/ironic-prometheus-exporter Download the package from: https://tarballs.openstack.org/ironic-prometheus-exporter/ Please report issues through: https://bugs.launchpad.net/ironic-prometheus-exporter/+bugs For more details, please see below. Changes in ironic-prometheus-exporter 4.8.0..4.9.0 -------------------------------------------------- f3d2a9c Disable neutron-ovn-agent bcb3ef7 Replace fixed sleep with active polling in DevStack plugin aeab784 parsers: fix KeyError on instance_uuid in redfish metrics 2b17d92 parsers: validate health field in redfish power/fan/drive metrics e87fc12 Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 +- devstack/plugin.sh | 122 ++++++++++++++++++--- ironic_prometheus_exporter/parsers/redfish.py | 23 +++- ironic_prometheus_exporter/utils.py | 4 +- releasenotes/source/2026.1.rst | 6 + releasenotes/source/index.rst | 1 + 7 files changed, 178 insertions(+), 22 deletions(-)

1 0

blazar 15.1.0 (epoxy)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We are psyched to announce the release of: blazar 15.1.0 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/blazar Download the package from: https://tarballs.openstack.org/blazar/ Please report issues through: https://bugs.launchpad.net/blazar/+bugs For more details, please see below. 15.1.0 ^^^^^^ New Features ************ * A new module, "blazar.wsgi", has been added as a place to gather WSGI "application" objects. This is intended to ease deployment by providing a consistent location for these objects. For example, if using uWSGI then instead of: [uwsgi] wsgi-file = /bin/blazar-api-wsgi You can now use: [uwsgi] module = blazar.wsgi.api:application This also simplifies deployment with other WSGI servers that expect module paths such as gunicorn. Upgrade Notes ************* * The WSGI script "blazar-api-wsgi" has been removed. Deployment tooling should instead reference the Python module path for the wsgi module in Blazar, "blazar.wsgi.api:application" if their chosen WSGI server supports this (gunicorn, uWSGI, etc.) or implement a .wsgi script themselves if not (mod_wsgi). Security Issues *************** * Fixes a bug where any user could update/delete a lease from any project, provided that they had the lease ID. When using the default policy configuration, there is no way for a regular user to see lease IDs of another project. However, operators that are running the Resource Availability Calendar may have overridden this policy, and so may be vulnerable without this fix. LP#2120655 Bug Fixes ********* * Fixes an issue where the amount of instances in an instance reservation could not be updated when the lease is active. LP#2138386 Changes in blazar 15.0.0..15.1.0 -------------------------------- 5c67ccd Fix updating amount in active instance leases adc8d63 Fix owner policy enforcement e2a95ee Fix lease date 870f1ea Add wsgi module to blazar f071f97 Update TOX_CONSTRAINTS_FILE for stable/2025.1 089c15e Update .gitreview for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + blazar/plugins/instances/instance_plugin.py | 3 +- blazar/policy.py | 19 ++++- blazar/wsgi/__init__.py | 0 blazar/wsgi/api.py | 24 +++++++ devstack/plugin.sh | 2 +- devstack/settings | 2 +- ...-owner-policy-enforcement-57a6d71c37ffec3d.yaml | 10 +++ ...-in-instance-reservations-52e6e3a413a0176f.yaml | 6 ++ .../remove-wsgi-scripts-1e2011c1d40df1c7.yaml | 29 ++++++++ tox.ini | 4 +- 13 files changed, 156 insertions(+), 47 deletions(-)

1 0

ironic-ui 6.9.0 (hibiscus)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We are tickled pink to announce the release of: ironic-ui 6.9.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/ironic-ui Download the package from: https://pypi.org/project/ironic-ui Please report issues through: https://bugs.launchpad.net/ironic-ui/+bugs For more details, please see below. Changes in ironic-ui 6.8.0..6.9.0 --------------------------------- bce74ad Imported Translations from Zanata bd78e6d Fix for issue with translations d399aee Drop workaround for old devstack 6ac29d8 Restore explicit package list for module detection 595d2c1 Update Babel configuration 01b3f83 Update packaging configuration 4c752e9 Drop Python 3.10 4a5b672 Imported Translations from Zanata 2737805 Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- babel-django.cfg | 2 ++ babel-djangojs.cfg | 2 ++ devstack/plugin.sh | 10 +--------- ironic_ui/locale/ru/LC_MESSAGES/django.po | 9 +++++---- pyproject.toml | 7 +++---- releasenotes/source/2026.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po | 7 +++++-- releasenotes/source/locale/ru/LC_MESSAGES/releasenotes.po | 8 ++++++-- setup.py | 4 +--- 10 files changed, 32 insertions(+), 24 deletions(-)

1 0

networking-baremetal 8.0.0 (hibiscus)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We are satisfied to announce the release of: networking-baremetal 8.0.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/networking-baremetal Download the package from: https://pypi.org/project/networking-baremetal Please report issues through: https://bugs.launchpad.net/networking-baremetal/+bugs For more details, please see below. 8.0.0 ^^^^^ New Features ************ * L2VNI trunk subports now include the Neutron VLAN segment UUID in "binding:profile['segment_id']". This enables ML2 mechanism drivers like networking-generic-switch to use segment-based cleanup logic instead of parsing switch port configurations, allowing static trunk port configurations on physical switches. See bug 2144875 (https://bugs.launchpad.net/networking-generic-switch/+bug/2144875) Upgrade Notes ************* * The following deprecated options in the "[ironic]" section have been removed. * "auth_strategy" * "ironic_url" * "os_region" * "max_retries" * "retry_interval" * Support for Python 3.10 has been removed. Now Python 3.11 is the minimum version supported. * Deployments that have been running the ironic-neutron-agent with quorum queues ("rabbit_quorum_queue = True") may have stale RabbitMQ queues named "ironic-neutron-agent-member-manager.<hostname>.ironic- neutron-agent-member-manager-pool-<uuid>". These queues can be safely deleted manually after upgrading. Bug Fixes ********* * Fixed AttributeError in L2VNI trunk manager when accessing "ha_chassis_group" on logical router ports. The code was incorrectly treating "ha_chassis_group" as a single object when it is actually a list (with 0 or 1 element) in the OVN IDL schema. The fix now properly accesses "ha_chassis_group[0]" to get the HA_Chassis_Group object before iterating over its chassis members, matching the pattern used throughout the upstream Neutron codebase. See bug 2145014 (https://bugs.launchpad.net/networking- baremetal/+bug/2145014). * Fixed an issue in the router HA binding manager ("enable_router_ha_binding", default enabled) where router interface ports ("Logical_Router_Port") on networks with **no** external (baremetal/SR-IOV) ports were still being bound to that network's "HA_Chassis_Group". This pinned the router's east-west traffic to a single chassis, breaking basic default-gateway reachability and Distributed Floating IP traffic for regular VMs hosted on any chassis other than the one referenced by the "HA_Chassis_Group", in Neutron OVN deployments using "enable_distributed_floating_ip". Router interface ports are now only bound to a network's "HA_Chassis_Group" when that network actually contains at least one external port. See bug 2160270 (https://bugs.launchpad.net /networking-baremetal/+bug/2160270). * Fixes an issue where the driver attempted to set "requested- chassis" on localnet ports, which is not a valid option for this port type. See bug 2145148 (https://bugs.launchpad.net/networking- baremetal/+bug/2145148). * Fixed L2VNI trunk subport creation to avoid ML2 ERROR log spam. Previously, setting "binding:host_id" on subports before adding them to trunks caused unnecessary binding attempts that would fail. See bug 2148720 (https://bugs.launchpad.net/networking- baremetal/+bug/2148720). * The ironic-neutron-agent notification listener pool name now uses the agent hostname instead of a per-process UUID. Previously, each agent restart created a new permanent RabbitMQ queue named after the UUID, leaving behind stale queues with unconsumed messages when running with quorum queues ("rabbit_quorum_queue = True"). With quorum queues, "auto_delete" is not supported, so old UUID-named queues were never removed. Using the hostname as the pool name ensures the same queue is reused across restarts on the same host. Changes in networking-baremetal 7.2.0..8.0.0 -------------------------------------------- 305dfda Remove Python 3.10 support 24e09ee Clean up deprecated [ironic] options c682b64 Hide password option from logs fd22046 Drop unnecessary import/register error handling 3e59314 Restrict range of the port option 36422c5 Replace BaseEvent 421b515 use agent hostname for notification listener pool name f78f689 router_ha_binding: Skip networks without external ports 26a4705 docs: fix docs build 200e90a Clean up example local.conf fd52b22 Disable ovn-metadata-agent 6ee6023 Guard rabbit config access in _get_notification_transport_url f327f91 Remove binding:host_id setting for L2VNI subports 4e2df5a Remove invalid requested-chassis opt for localnet ports 7da1ef6 Remove redundant IDL table existence checks 33356f8 Optimize L2VNI trunk manager with caching and DRY f013387 Fix ha_chassis_group list access in trunk manager 7f12733 Use get_chassis_and_physnets from ovn_client ad3c982 Optimize router HA binding with chunked queries 90b06d2 Simplify conditional logging for link information 13df8a9 Refactor to use guard clauses and early returns c1dd686 Add segment_id to subport binding profiles 89b218e Update master for stable/2026.1 Diffstat (except docs and test files) ------------------------------------- networking_baremetal/agent/ironic_neutron_agent.py | 35 +- networking_baremetal/agent/l2vni_trunk_manager.py | 572 +++++++++++---------- networking_baremetal/agent/ovn_events.py | 11 +- networking_baremetal/agent/router_ha_binding.py | 135 ++++- networking_baremetal/drivers/netconf/openconfig.py | 9 +- networking_baremetal/ironic_client.py | 34 +- .../plugins/ml2/baremetal_l2vni_mapping.py | 179 +------ .../unit/plugins/ml2/test_baremetal_l2vni_mech.py | 58 +-- pyproject.toml | 4 +- ...o-subport-binding-profile-e70ed6b17c88760a.yaml | 9 + ...up-list-access-bug2145014-8976351990f2bbb0.yaml | 11 + ...binding-no-external-ports-c1c7d911b50a840e.yaml | 15 + ...ve-deprecated-ironic-opts-d17b4775af479804.yaml | 11 + ...ocalnet-requested-chassis-122cdaa8244cfc79.yaml | 6 + .../notes/remove-py310-9e5bb1241918e49c.yaml | 5 + ...inding-host-id-bug2148720-aa4c59bafb997540.yaml | 7 + .../switch_to_agent_host-18bd49692e02ffeb.yaml | 18 + releasenotes/source/2026.1.rst | 6 + releasenotes/source/index.rst | 1 + zuul.d/networking-baremetal-jobs.yaml | 1 - 27 files changed, 1297 insertions(+), 753 deletions(-)

1 0

oslo.messaging 16.1.2 (epoxy)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We jubilantly announce the release of: oslo.messaging 16.1.2 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/oslo.messaging Download the package from: https://pypi.org/project/oslo.messaging Please report issues through: https://bugs.launchpad.net/oslo.messaging/+bugs For more details, please see below. 16.1.2 ^^^^^^ Security Issues * Under TLS with "ssl_ca_file", oslo.messaging validated the broker certificate chain but did not verify the RabbitMQ broker hostname. A man-in-the-middle attacker with a certificate trusted by that CA could impersonate the broker. The RabbitMQ driver now verifies the broker hostname when "ssl_ca_file" is set and "[oslo_messaging_rabbit] ssl_enforce_hostname_verification" is enabled. Using "ssl=true" without "ssl_ca_file" still does not verify the broker hostname. The "ssl_enforce_hostname_verification" option defaults to "false" to preserve existing behavior until operators opt in. When enabled together with "ssl_ca_file", hostname verification is enforced for RabbitMQ TLS connections. For transport URLs with multiple brokers and hostname verification enabled, Kombu 5.2.0 or newer substitutes the active broker hostname for TLS. Older Kombu versions log a warning and use the first configured broker hostname as a best effort; operators should upgrade Kombu or use a certificate (SAN or wildcard) that covers all configured broker hostnames. Changes in oslo.messaging 16.1.1..16.1.2 ---------------------------------------- 5ae4ef69 Fix RabbitMQ TLS hostname verification Diffstat (except docs and test files) ------------------------------------- oslo_messaging/_drivers/impl_rabbit.py | 45 +++++ .../rabbit-ssl-hostname-verification-option.yaml | 24 +++ 3 files changed, 248 insertions(+), 2 deletions(-)

1 0

oslo.service 4.1.2 (epoxy)
by no-reply＠openstack.org 28 Jul '26

28 Jul '26

We exuberantly announce the release of: oslo.service 4.1.2 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/oslo.service Download the package from: https://pypi.org/project/oslo.service Please report issues through: https://bugs.launchpad.net/oslo.service/+bugs For more details, please see below. 4.1.2 ^^^^^ Upgrade Notes * The "oslo_service.wsgi" module has been undeprecated. It contains many utilities besides the eventlet-based "Server" class. Instead, only the "Server" class itself is now deprecated. Changes in oslo.service 4.1.1..4.1.2 ------------------------------------ 5e5f4f2 Don't deprecate the entire oslo_service.wsgi module b6a2e24 Update TOX_CONSTRAINTS_FILE for stable/2025.1 84f9549 Update .gitreview for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + oslo_service/wsgi.py | 21 +++++++++------------ .../notes/undeprecate-wsgi-7e5306403625b8c6.yaml | 6 ++++++ tox.ini | 6 +++--- 4 files changed, 19 insertions(+), 15 deletions(-)

1 0