July 2026 - Release-announce - lists.openstack.org

nova 33.0.2 (gazpacho)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We exuberantly announce the release of: nova 33.0.2 This release is part of the gazpacho release series. The source is available from: https://opendev.org/openstack/nova Download the package from: https://tarballs.openstack.org/nova/ Please report issues through: https://bugs.launchpad.net/nova/+bugs For more details, please see below. 33.0.2 ^^^^^^ Bug Fixes * Bug #2105896: Fix error when multiple security groups in a project share the same name. The security group resolution now checks UUIDs before names, ensuring that a request using a specific UUID is never blocked by a naming collision. When a security group is requested by name and multiple groups share that name, a "NoUniqueMatch" error is raised prompting the user to use a UUID instead. (https://launchpad.net/bugs/2105896) * Bug #2134375: Fix ports remain during creating instance with multiple network when error occurs updating first port. (https://launchpad.net/bugs/2134375) Changes in nova 33.0.1..33.0.2 ------------------------------ 32bd8471f8 Strip internal _nova-prefixed scheduler hints on create 55618908f4 Fix port remain while error on update port with multi network 0c79d8b17c Add regression test for bug #2134375 cf5b6e5d99 Increase wait retries for resize reschedule functional test 6663fafede [openstack-tox-cover]Increase timeout further 556ba4c9cc Fix error when multiple security group in a project with same name 909aa8c7fa Add reproducer test for bug 2105896 36dd74f681 Fix resize to unpermitted flavors 3176c483ce ironic: Abort build on fatal image validation errors 323ac51f69 Doc: add short doc section for mdev_class Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 +- nova/compute/api.py | 6 +- nova/network/neutron.py | 46 +++---- .../functional/regressions/test_bug_2134375.py | 81 ++++++++++++ nova/virt/ironic/driver.py | 19 ++- .../notes/bug-2105896-2bebad3d9eacd346.yaml | 11 ++ .../notes/bug-2134375-580c10cfefc279fd.yaml | 7 + 12 files changed, 412 insertions(+), 36 deletions(-)

1 0

python-designateclient 7.0.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We contentedly announce the release of: python-designateclient 7.0.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-designateclient Download the package from: https://pypi.org/project/python-designateclient Please report issues through: https://bugs.launchpad.net/python-designateclient/+bugs For more details, please see below. 7.0.0 ^^^^^ New Features ************ * Adds "--status" and "--zone-id" filter options to the "zone export list" command. * Adds "--status", "--zone-id", and "--message" filter options to the "zone import list" command. * Adds "--status" filter option to the "zone transfer accept list" command. * Adds a "--status" filter option to the "zone transfer request list" command, allowing users to filter zone transfer requests by status. * Zone task list methods ("zone_transfers.list_requests()", "zone_transfers.list_accepts()", "zone_exports.list()", and "zone_imports.list()") now support pagination parameters ("criterion", "marker", "limit"), matching the pattern used by other v2 controllers. * CLI list commands for zone exports, zone imports, and zone transfer accepts now automatically paginate through all results using "get_all()". * Adds a "dns limit list" CLI command to display the DNS service limits ("GET /limits"). * Added "--attributes" option to "openstack zone import create" command. This allows users to pass zone attributes (e.g. "pool_id") when importing a zonefile, using the same "key:value" format as "openstack zone create". When attributes are provided, the client sends the request as "application/json" instead of "text/dns". Existing behavior without "--attributes" is unchanged. * Adds a "zone nameservers list" CLI command to list the nameservers assigned to a zone ("GET /zones/{zone_id}/nameservers"). Upgrade Notes ************* * "zone_exports.list()" and "zone_imports.list()" now return a list of items directly instead of the raw API response dict. Code that previously accessed "result["exports"]" or "result["imports"]" should use the return value directly. This aligns these methods with all other v2 list controllers which already use "response_key". Bug Fixes ********* * Wires up the existing "--pattern" filter option in the "dns blacklist list" command so it is actually passed to the API. * Wires up the existing "--name" filter option in the "tld list" command so it is actually passed to the API. Removes the "-- description" filter which is not supported by the API. * "--email" is no longer an effectively required argument when creating zone. It is now only required for PRIMARY zone type, and is silently ignored for SECONDARY zone type. Changes in python-designateclient 6.4.0..7.0.0 ---------------------------------------------- 944e373 Add --status filter option to zone transfer request list 7016e57 Add Zone nameserver request to client c7dd3bf Add dns limit list CLI command 40385af Add --attributes flag to zone import create command 17f8a60 Add pagination support to zone task list methods ccf5e64 Fix tld list command filters not being applied 2853272 Add support for GET /v2/quotas/ endpoint 0c4f8cc Update packaging configuration b00e4bf Migrate setup configuration to pyproject.toml bb0cf42 Include status code and body in non-JSON error responses c59d894 Add missing filter options to list commands 9d1a86b Fix "floatingip" to "floating IP" in ptr record help text 2c730b4 Make email optional when creating zone 0dd5ca4 Update master for stable/2026.1 4b4cbb4 Drop redundant type/attribute check c176bd1 Remove old checks for Python 2-3 compatibility c3e434e Add unit tests for QuotasController Diffstat (except docs and test files) ------------------------------------- designateclient/hacking/checks.py | 17 ---- designateclient/v2/cli/blacklists.py | 9 +- designateclient/v2/cli/limits.py | 34 +++++++ designateclient/v2/cli/reverse.py | 8 +- designateclient/v2/cli/tlds.py | 8 +- designateclient/v2/cli/zones.py | 109 +++++++++++++++++---- designateclient/v2/client.py | 5 +- designateclient/v2/quotas.py | 4 +- designateclient/v2/zones.py | 42 +++++--- pyproject.toml | 105 ++++++++++++++++++++ .../notes/bug-1927892-a3f8c4e2b7d91065.yaml | 14 +++ .../notes/bug-1978713-1e1f6d9a991c2c4f.yaml | 4 + ...1519-zone-task-pagination-7e4a2b91c3d80f56.yaml | 17 ++++ .../dns-limit-list-command-b5fabebf76e7e8eb.yaml | 4 + ...l-is-optional-bug-2143824-71b816f91ce045b1.yaml | 6 ++ .../zone-import-attributes-1166c129d39186db.yaml | 9 ++ ...-nameservers-list-command-60b986968d714b2b.yaml | 4 + releasenotes/source/2026.1.rst | 6 ++ releasenotes/source/index.rst | 1 + setup.cfg | 105 -------------------- tox.ini | 2 - 26 files changed, 590 insertions(+), 167 deletions(-)

1 0

osc-placement 4.9.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are ecstatic to announce the release of: osc-placement 4.9.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/osc-placement Download the package from: https://pypi.org/project/osc-placement Please report issues through: https://bugs.launchpad.net/placement-osc-plugin/+bugs For more details, please see below. 4.9.0 ^^^^^ Deprecation Notes * The "osc_placement.__version__" attribute has been deprecated for removal. Prefer use of "importlib.metadata" to inspect version information for installed packages. Changes in osc-placement 4.8.0..4.9.0 ------------------------------------- 59a1e5e zuul: Use openstack-python3-next-jobs template 83fccc5 Update support python versions 6bf27c9 Deprecate version attribute 876f0e7 Update master for stable/2026.1 28286b1 Remove MANIFEST.in Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 15 +++++++++------ MANIFEST.in | 6 ------ osc_placement/__init__.py | 15 +++++++++++++-- .../deprecate-version-attribute-150863e7fa273c8b.yaml | 6 ++++++ releasenotes/source/2026.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + setup.cfg | 5 ++--- 7 files changed, 37 insertions(+), 17 deletions(-)

1 0

os-vif 5.1.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are pleased to announce the release of: os-vif 5.1.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/os-vif Download the package from: https://pypi.org/project/os-vif Please report issues through: https://bugs.launchpad.net/os-vif/+bugs For more details, please see below. Changes in os-vif 5.0.0..5.1.0 ------------------------------ d414f87 zuul: Use openstack-python3-next-jobs template 3311871 pre-commit: Bump versions cb0b6d5 Make ``PyPyroute2._lookup_interface`` private 27cea68 Remove workaround for oslo.i18n ``translate`` method Diffstat (except docs and test files) ------------------------------------- .pre-commit-config.yaml | 2 +- .zuul.yaml | 3 +++ os_vif/i18n.py | 5 +---- os_vif/internal/ip/linux/impl_pyroute2.py | 12 ++++++------ requirements.txt | 2 +- 5 files changed, 12 insertions(+), 12 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 402bce4..aaefeac 100644 --- a/requirements.txt +++ b/requirements.txt @@ -8 +8 @@ oslo.log>=3.30.0 # Apache-2.0 -oslo.i18n>=3.15.3 # Apache-2.0 +oslo.i18n>=6.8.0 # Apache-2.0

1 0

neutron 27.0.3 (flamingo)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are thrilled to announce the release of: neutron 27.0.3 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/neutron Download the package from: https://tarballs.openstack.org/neutron/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. 27.0.3 ^^^^^^ Upgrade Notes ************* * Default RBAC policies for the port actions listed above no longer include "PROJECT_MANAGER". Deployments with customized policy files should review and update those rules if they rely on the previous behaviour. Security Issues *************** * Fixed overly permissive default RBAC policies for several port actions that require network ownership. Those policies previously included "PROJECT_MANAGER", which allowed any project manager to perform the action even when not owning the network (for example, on shared/RBAC networks). They now rely on "NET_OWNER_MEMBER" or "ADMIN_OR_NET_OWNER_MEMBER" only. Project managers who own the network remain authorized through the default Keystone role implication chain ("manager" implies "member"). Affected actions: "create_port:device_owner", "update_port:device_owner", "create_port:mac_address", "update_port:mac_address", "create_port:fixed_ips", "create_port:fixed_ips:ip_address", "create_port:fixed_ips:subnet_id", "update_port:fixed_ips", "update_port:fixed_ips:ip_address", "update_port:fixed_ips:subnet_id", "create_port:port_security_enabled", "update_port:port_security_enabled", "create_port:allowed_address_pairs", "create_port:allowed_address_pairs:mac_address", "create_port:allowed_address_pairs:ip_address", "update_port:allowed_address_pairs", "update_port:allowed_address_pairs:mac_address", and "update_port:allowed_address_pairs:ip_address". * Fixed an issue in the router conntrack helper API where a project member authorized on one router could read, update, or delete another project's conntrack helper by supplying an incorrect helper ID under their own router ID in the request URL. Singleton operations now verify that the conntrack helper belongs to the router specified in the URL. * Fixed a security issue where the tagging controller's single-tag write endpoints ("POST /v2.0/{resource}/{id}/tags" and "PUT /v2.0/{resource}/{id}/tags/{tag}") enforced policy action names using the plural collection key (e.g. "create_networks:tags") instead of the singular member name (e.g. "create_network:tags"). Because the plural names did not match any registered policy rule, they fell through to oslo.policy's default rule, allowing project readers to create and update tags on same-project resources. All tag-write endpoints now consistently use the singular policy action names that match the registered rules. Bug Fixes ********* * Fixed an issue where deleting a floating IP with "dns_name" and "dns_domain" set would fail with a 500 error when the associated Designate DNS records were managed. The Designate external DNS driver now passes "edit_managed=True" to the designateclient, allowing deletion of managed records. For more information see bug 2149807 (https://bugs.launchpad.net/neutron/+bug/2149807) * Fixed a 500 Internal Server Error when querying the quota details API ("GET /v2.0/quotas/{project_id}/details") while a service plugin package (e.g. "neutron-fwaas", "neutron-vpnaas", "networking-sfc") is installed but its service plugin is not configured in "service_plugins". The quota engine now gracefully skips resources whose service plugin is not loaded instead of raising a "NotImplementedError". * Fixed the "delete_floatingips:tags" policy rule name to use the correct singular form "delete_floatingip:tags", consistent with all other tag-related policy rules. Changes in neutron 27.0.2..27.0.3 --------------------------------- 6e846c1a2d Increase ``allowed_network_downtime`` to 7.0 40459d21c2 quota: Fix quota details API error with unloaded service plugins bdd6d1058f Fix ``update_router:enable_default_route_*`` policies f68dc69302 Fix cross-project access to router conntrack helpers 170743593d [OVS FW] Clean invalid conntrack entries after OF rules are applied d04e845d72 Fix tunnel network detection to use tunnel type driver ranges 586a7fa1f9 Fix port RBAC policies to require network ownership fd5fe9cd7b Fix PF GET/PUT parent floating IP validation 134148d5ae Fix VLAN network detection to use VlanTypeDriver ranges fa942dba49 Fix plural policy names in tagging controller and floatingip policy feca3f33e6 Fix deletion of floating IPs with managed DNS records bd4fa33be8 Fix return value of empty-MAC guard in metadata agent 9d2868096e Ignore designate NotFound errors during PTR delete e1d1d46284 Add logging decorator for OVN maintenance methods ba6c1c3176 Fix unbounded thread pool in OVN MaintenanceThread Diffstat (except docs and test files) ------------------------------------- .../agent/linux/openvswitch_firewall/firewall.py | 26 +- neutron/agent/ovn/metadata/agent.py | 2 +- neutron/conf/policies/base.py | 1 + neutron/conf/policies/floatingip.py | 2 +- neutron/conf/policies/port.py | 19 +- neutron/conf/policies/router.py | 4 +- neutron/db/quota/driver.py | 10 +- neutron/extensions/tagging.py | 24 +- .../drivers/ovn/mech_driver/ovsdb/maintenance.py | 143 +++++- neutron/plugins/ml2/extensions/dns_integration.py | 62 ++- neutron/services/conntrack_helper/plugin.py | 10 +- .../externaldns/drivers/designate/driver.py | 20 +- neutron/services/portforwarding/pf_plugin.py | 4 +- .../conntrack_helper/test_conntrack_helper.py | 27 + .../linux/openvswitch_firewall/test_firewall.py | 12 +- .../ovn/mech_driver/ovsdb/test_maintenance.py | 45 ++ .../plugins/ml2/extensions/test_dns_integration.py | 185 +++++++ .../unit/services/conntrack_helper/test_plugin.py | 49 +- .../externaldns/drivers/designate/test_driver.py | 81 +++ .../unit/services/portforwarding/test_pf_plugin.py | 27 + ...ip-delete-managed-dns-records-a1b2c3d4e5f6.yaml | 9 + ...bac-network-owner-manager-a4b8c2d1e3f56789.yaml | 31 ++ ...s-unloaded-service-plugin-f4c2a0766eb045b0.yaml | 10 + ...lper-cross-project-access-ba1425c06abc45d5.yaml | 8 + ...gging-policy-action-names-a59e17308f214600.yaml | 18 + zuul.d/tempest-multinode.yaml | 2 + 30 files changed, 886 insertions(+), 546 deletions(-)

1 0

python-manilaclient 6.2.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are psyched to announce the release of: python-manilaclient 6.2.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-manilaclient Download the package from: https://pypi.org/project/python-manilaclient Please report issues through: https://bugs.launchpad.net/python-manilaclient/+bugs For more details, please see below. 6.2.0 ^^^^^ Prelude ******* * Share migration APIs have graduated from their experimental feature state (https://docs.openstack.org/manila/latest/contributor /experimental_apis.html) from API version "2.96". The share migration actions ("migration_start", "migration_complete", "migration_cancel", "migration_get_progress" and "reset_task_state") no longer require the inclusion of the "X-OpenStack-Manila-API- Experimental" header in API requests starting at version "2.96". Older microversions continue to send the experimental header for backward compatibility. New Features ************ * Added a "Properties" column to the "openstack share replica list" command output when using Manila API version 2.95 or newer. The column displays the metadata key/value pairs associated with each share replica, for example "replication_policy='Sync'". Changes in python-manilaclient 6.1.0..6.2.0 ------------------------------------------- 8b34b1b added properties column to share replica list command e1f84b7 Graduate share migration feature Diffstat (except docs and test files) ------------------------------------- manilaclient/api_versions.py | 2 +- manilaclient/common/constants.py | 2 + manilaclient/osc/v2/share_replicas.py | 13 +++ manilaclient/v2/shares.py | 105 ++++++++++++++++++++- ...es-column-to-replica-list-a3f7c91d28e05b4c.yaml | 7 ++ ...e-share-migration-feature-3b8fa72d4e91a517.yaml | 11 +++ 8 files changed, 176 insertions(+), 7 deletions(-)

1 0

python-zaqarclient 4.6.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are happy to announce the release of: python-zaqarclient 4.6.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/python-zaqarclient Download the package from: https://pypi.org/project/python-zaqarclient Please report issues through: https://bugs.launchpad.net/python-zaqarclient/+bugs For more details, please see below. 4.6.0 ^^^^^ Upgrade Notes * Support for Python 3.10 has been removed. Now Python 3.11 is the minimum version supported. Changes in python-zaqarclient 4.5.0..4.6.0 ------------------------------------------ ddd48e4 Remove Python 3.10 support 208e97c Fix lack of wss protocol support Diffstat (except docs and test files) ------------------------------------- releasenotes/notes/remove-py310-098a8537ccef4d28.yaml | 5 +++++ setup.cfg | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-)

1 0

neutron 26.0.4 (epoxy)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are happy to announce the release of: neutron 26.0.4 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/neutron Download the package from: https://tarballs.openstack.org/neutron/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. 26.0.4 ^^^^^^ New Features ************ * Updated RBAC rules so that they allow the "service" role to pass the following policies by default: * "get_subnet" * "get_network_ip_availability" * "create_port:allowed_address_pairs" * "create_port:allowed_address_pairs:mac_address" * "create_port:allowed_address_pairs:ip_address" * "update_port:allowed_address_pairs" * "update_port:allowed_address_pairs:mac_address" * "update_port:allowed_address_pairs:ip_address" This allows for integration with the Octavia project using the "service" role instead of the "admin" role for integration with Neutron. * Added "service" role to the "create_port:device_id" and "update_port:device_id" policies to allow service users for other OpenStack projects to complete Secure RBAC. Upgrade Notes ************* * Default RBAC policies for the port actions listed above no longer include "PROJECT_MANAGER". Deployments with customized policy files should review and update those rules if they rely on the previous behaviour. * Default RBAC policies for "get_subnet", "get_network_ip_availability", "create_port:allowed_address_pairs", "create_port:allowed_address_pairs:mac_address", "create_port:allowed_address_pairs:ip_address", "update_port:allowed_address_pairs", "update_port:allowed_address_pairs:mac_address" and "update_port:allowed_address_pairs:ip_address" have been updated to allow the "service" role. Security Issues *************** * Fixed overly permissive default RBAC policies for several port actions that require network ownership. Those policies previously included "PROJECT_MANAGER", which allowed any project manager to perform the action even when not owning the network (for example, on shared/RBAC networks). They now rely on "NET_OWNER_MEMBER" or "ADMIN_OR_NET_OWNER_MEMBER" only. Project managers who own the network remain authorized through the default Keystone role implication chain ("manager" implies "member"). Affected actions: "create_port:device_owner", "update_port:device_owner", "create_port:mac_address", "update_port:mac_address", "create_port:fixed_ips", "create_port:fixed_ips:ip_address", "create_port:fixed_ips:subnet_id", "update_port:fixed_ips", "update_port:fixed_ips:ip_address", "update_port:fixed_ips:subnet_id", "create_port:port_security_enabled", "update_port:port_security_enabled", "create_port:allowed_address_pairs", "create_port:allowed_address_pairs:mac_address", "create_port:allowed_address_pairs:ip_address", "update_port:allowed_address_pairs", "update_port:allowed_address_pairs:mac_address", and "update_port:allowed_address_pairs:ip_address". * Fixed an issue in the router conntrack helper API where a project member authorized on one router could read, update, or delete another project's conntrack helper by supplying an incorrect helper ID under their own router ID in the request URL. Singleton operations now verify that the conntrack helper belongs to the router specified in the URL. * Fixed a security issue where the tagging controller's single-tag write endpoints ("POST /v2.0/{resource}/{id}/tags" and "PUT /v2.0/{resource}/{id}/tags/{tag}") enforced policy action names using the plural collection key (e.g. "create_networks:tags") instead of the singular member name (e.g. "create_network:tags"). Because the plural names did not match any registered policy rule, they fell through to oslo.policy's default rule, allowing project readers to create and update tags on same-project resources. All tag-write endpoints now consistently use the singular policy action names that match the registered rules. Bug Fixes ********* * Fixed an issue where deleting a floating IP with "dns_name" and "dns_domain" set would fail with a 500 error when the associated Designate DNS records were managed. The Designate external DNS driver now passes "edit_managed=True" to the designateclient, allowing deletion of managed records. For more information see bug 2149807 (https://bugs.launchpad.net/neutron/+bug/2149807) * Fixed a 500 Internal Server Error when querying the quota details API ("GET /v2.0/quotas/{project_id}/details") while a service plugin package (e.g. "neutron-fwaas", "neutron-vpnaas", "networking-sfc") is installed but its service plugin is not configured in "service_plugins". The quota engine now gracefully skips resources whose service plugin is not loaded instead of raising a "NotImplementedError". * Fixed the "delete_floatingips:tags" policy rule name to use the correct singular form "delete_floatingip:tags", consistent with all other tag-related policy rules. Changes in neutron 26.0.3..26.0.4 --------------------------------- 68346f102f Increase ``allowed_network_downtime`` to 7.0 477ae240eb quota: Fix quota details API error with unloaded service plugins 6f31cdad12 Fix ``update_router:enable_default_route_*`` policies 9db3b6c388 Fix cross-project access to router conntrack helpers 7c9b264a93 Fix port RBAC policies to require network ownership 67f9d4dc26 Allow service role more RBAC access for Octavia d78d001630 Allow service role to create/update port device_id fb5604b5a8 [OVS FW] Clean invalid conntrack entries after OF rules are applied ef7740ebcd Fix tunnel network detection to use tunnel type driver ranges 2f084e8188 [stable 2025.1 only][CI][fullstack] Skip failing tests c6c4e1473f [stable 2025.1] Delete all the grenade jobs from the CI 0413452273 Fix VLAN network detection to use VlanTypeDriver ranges a40814d48b Fix PF GET/PUT parent floating IP validation a7c53a4468 [Fullstack] Kill processes during cleanup phase dee29b2b32 [CI][stable 2025.1][jammy] Use stable constraints for tempest 8170fa8d98 Fix plural policy names in tagging controller and floatingip policy 1a22739c1b Fix deletion of floating IPs with managed DNS records d57e150e6d Fix return value of empty-MAC guard in metadata agent bf6d3d3d13 Add logging decorator for OVN maintenance methods 23ddb57792 Ignore designate NotFound errors during PTR delete 389f7f48f3 Fix unbounded thread pool in OVN MaintenanceThread Diffstat (except docs and test files) ------------------------------------- .../agent/linux/openvswitch_firewall/firewall.py | 26 +- neutron/agent/ovn/metadata/agent.py | 2 +- neutron/conf/policies/base.py | 1 + neutron/conf/policies/floatingip.py | 2 +- neutron/conf/policies/network_ip_availability.py | 2 +- neutron/conf/policies/port.py | 53 +- neutron/conf/policies/router.py | 4 +- neutron/conf/policies/subnet.py | 1 + neutron/db/quota/driver.py | 10 +- neutron/extensions/tagging.py | 24 +- .../drivers/ovn/mech_driver/ovsdb/maintenance.py | 131 +++- neutron/plugins/ml2/extensions/dns_integration.py | 62 +- neutron/services/conntrack_helper/plugin.py | 10 +- .../externaldns/drivers/designate/driver.py | 20 +- neutron/services/portforwarding/pf_plugin.py | 4 +- .../conntrack_helper/test_conntrack_helper.py | 27 + .../linux/openvswitch_firewall/test_firewall.py | 12 +- .../conf/policies/test_network_ip_availability.py | 8 +- .../ovn/mech_driver/ovsdb/test_maintenance.py | 45 ++ .../plugins/ml2/extensions/test_dns_integration.py | 185 +++++ .../unit/services/conntrack_helper/test_plugin.py | 49 +- .../externaldns/drivers/designate/test_driver.py | 81 +++ .../unit/services/portforwarding/test_pf_plugin.py | 27 + ...ip-delete-managed-dns-records-a1b2c3d4e5f6.yaml | 9 + ...bac-network-owner-manager-a4b8c2d1e3f56789.yaml | 31 + ...s-unloaded-service-plugin-f4c2a0766eb045b0.yaml | 10 + ...lper-cross-project-access-ba1425c06abc45d5.yaml | 8 + ...gging-policy-action-names-a59e17308f214600.yaml | 18 + .../octavia-service-role-b8ee74e5cb52ea30.yaml | 33 + ...rvice-role-port-device-id-61eb7b781b3b01ca.yaml | 6 + tox.ini | 14 +- zuul.d/base.yaml | 1 + zuul.d/grenade.yaml | 447 ------------ zuul.d/job-templates.yaml | 18 - zuul.d/project.yaml | 5 - zuul.d/tempest-multinode.yaml | 3 + 42 files changed, 1121 insertions(+), 1093 deletions(-)

1 0

neutron 28.0.1 (gazpacho)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We are tickled pink to announce the release of: neutron 28.0.1 This release is part of the gazpacho release series. The source is available from: https://opendev.org/openstack/neutron Download the package from: https://tarballs.openstack.org/neutron/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. 28.0.1 ^^^^^^ Upgrade Notes ************* * Default RBAC policies for the port actions listed above no longer include "PROJECT_MANAGER". Deployments with customized policy files should review and update those rules if they rely on the previous behaviour. Security Issues *************** * Fixed overly permissive default RBAC policies for several port actions that require network ownership. Those policies previously included "PROJECT_MANAGER", which allowed any project manager to perform the action even when not owning the network (for example, on shared/RBAC networks). They now rely on "NET_OWNER_MEMBER" or "ADMIN_OR_NET_OWNER_MEMBER" only. Project managers who own the network remain authorized through the default Keystone role implication chain ("manager" implies "member"). Affected actions: "create_port:device_owner", "update_port:device_owner", "create_port:mac_address", "update_port:mac_address", "create_port:fixed_ips", "create_port:fixed_ips:ip_address", "create_port:fixed_ips:subnet_id", "update_port:fixed_ips", "update_port:fixed_ips:ip_address", "update_port:fixed_ips:subnet_id", "create_port:port_security_enabled", "update_port:port_security_enabled", "create_port:allowed_address_pairs", "create_port:allowed_address_pairs:mac_address", "create_port:allowed_address_pairs:ip_address", "update_port:allowed_address_pairs", "update_port:allowed_address_pairs:mac_address", and "update_port:allowed_address_pairs:ip_address". * Fixed an issue in the router conntrack helper API where a project member authorized on one router could read, update, or delete another project's conntrack helper by supplying an incorrect helper ID under their own router ID in the request URL. Singleton operations now verify that the conntrack helper belongs to the router specified in the URL. * Fixed a security issue where the tagging controller's single-tag write endpoints ("POST /v2.0/{resource}/{id}/tags" and "PUT /v2.0/{resource}/{id}/tags/{tag}") enforced policy action names using the plural collection key (e.g. "create_networks:tags") instead of the singular member name (e.g. "create_network:tags"). Because the plural names did not match any registered policy rule, they fell through to oslo.policy's default rule, allowing project readers to create and update tags on same-project resources. All tag-write endpoints now consistently use the singular policy action names that match the registered rules. Bug Fixes ********* * Fixed an issue where deleting a floating IP with "dns_name" and "dns_domain" set would fail with a 500 error when the associated Designate DNS records were managed. The Designate external DNS driver now passes "edit_managed=True" to the designateclient, allowing deletion of managed records. For more information see bug 2149807 (https://bugs.launchpad.net/neutron/+bug/2149807) * Fixed a 500 Internal Server Error when querying the quota details API ("GET /v2.0/quotas/{project_id}/details") while a service plugin package (e.g. "neutron-fwaas", "neutron-vpnaas", "networking-sfc") is installed but its service plugin is not configured in "service_plugins". The quota engine now gracefully skips resources whose service plugin is not loaded instead of raising a "NotImplementedError". * Fixed the "delete_floatingips:tags" policy rule name to use the correct singular form "delete_floatingip:tags", consistent with all other tag-related policy rules. * The ML2/OVN mechanism driver now validates that virtual MAC addresses in allowed address pairs conform to the RFC 5798 VRRP ranges ("00:00:5e:00:01:XX" for IPv4 or "00:00:5e:00:02:XX" for IPv6). Previously, non-conforming virtual MACs were silently accepted by the Neutron API but discarded by ovn-controller, leading to confusing behavior. For more information see bug 2144371 (https://bugs.launchpad.net/neutron/+bug/2144371) * The "OVNL3RouterPlugin._post_fork_initialize" method now returns early when the worker is not a Neutron API "WorkerService" instance. This prevents "MechanismDriverOVNNotReady" errors in the "neutron- periodic-workers" and other non-API processes, where the OVN IDL connections are not initialized. * The "OVNL3RouterPlugin" now registers OVN OVSDB events ("LogicalRouterPortEvent" and "RouterHAChassisGroupEvent") only in Neutron API workers ("WorkerService" instances). Previously these events were registered by every worker type that called "_post_fork_initialize", which could lead to unexpected event processing in maintenance or other non-API workers. * Fixed a race condition in the OVS agent where "port_alive" and "port_dead" could issue OpenFlow operations with an invalid "in_port" value when a VIF port had an unassigned or error ofport (e.g. "[]" or "-1"). The malformed OpenFlow message caused the os- ken "send_msg" call to hang until the 300-second "of_request_timeout" expired, which blocked the agent's "rpc_loop" and prevented all subsequent port processing for the remainder of the timeout period. The functions now validate the ofport before performing any OpenFlow operations and log a warning so the port is retried on the next iteration. Changes in neutron 28.0.0..28.0.1 --------------------------------- bc7852faa0 Increase ``allowed_network_downtime`` to 7.0 a34e7b2eab [metadata] cleanup response headers 0b06dc038b Guard tun_br in _restore_local_vlan_map when no br-tun a9d80557f3 quota: Fix quota details API error with unloaded service plugins e97c10f238 ovs: defer ports with invalid ofport in ``_process_port`` 50aa8f7360 ovs: skip OF operations for ports with invalid ofport 88d6c7979d Fix ``update_router:enable_default_route_*`` policies 57f12d99d1 Fix cross-project access to router conntrack helpers 27e972e439 Handle invalid MAC in metadata agent port provisioning 895376b513 [OVS FW] Clean invalid conntrack entries after OF rules are applied 1941988ae2 Fix tunnel network detection to use tunnel type driver ranges 1c9bad3b6d Skip OVNL3 post-fork init in non-API workers 8ab37df704 Fix port RBAC policies to require network ownership d540e9df0b Fix PF GET/PUT parent floating IP validation f3b7d64eab Fix VLAN network detection to use VlanTypeDriver ranges d825eaf817 Fix plural policy names in tagging controller and floatingip policy 05dd00c849 OVNL3RouterPlugin register events in Neutron API workers f06ab80f77 Fix deletion of floating IPs with managed DNS records 59a352a6df Populate OVN AgentCache in the db-sync tool ba8d7720bf Revert "[eventlet-removal] Remove logger mechanism from functional tests" 133048faa1 Fix return value of empty-MAC guard in metadata agent 07853af83f Ignore designate NotFound errors during PTR delete 61f100d4b9 Add logging decorator for OVN maintenance methods 461e7ac4ac Fix unbounded thread pool in OVN MaintenanceThread 6f49b3bbef Fix AttributeError on DeletedChassis missing other_config 8f161f4e75 [stable-only] Set default ``MAC_Binding`` age threshold to 0 3c14b7abfa Update OVN doc about 'ovn-nbctl' command usage regarding the Gateway_Chassis registers 6caa2cc386 [OVN] Check the APP virtual MAC, RFC5798 supported format 0c898557a5 Add docstrings for filter_dynamic parameter Diffstat (except docs and test files) ------------------------------------- .../agent/linux/openvswitch_firewall/firewall.py | 26 +- neutron/agent/ovn/metadata/agent.py | 7 +- neutron/common/metadata.py | 31 +- neutron/common/ovn/constants.py | 13 +- neutron/common/ovn/exceptions.py | 6 + neutron/common/ovn/utils.py | 25 + neutron/conf/policies/base.py | 1 + neutron/conf/policies/floatingip.py | 2 +- neutron/conf/policies/port.py | 19 +- neutron/conf/policies/router.py | 4 +- neutron/db/quota/driver.py | 10 +- neutron/db/segments_db.py | 20 + neutron/extensions/tagging.py | 24 +- .../drivers/openvswitch/agent/ovs_neutron_agent.py | 45 +- .../plugins/ml2/drivers/ovn/agent/neutron_agent.py | 30 ++ .../ml2/drivers/ovn/mech_driver/mech_driver.py | 5 + .../drivers/ovn/mech_driver/ovsdb/maintenance.py | 143 +++++- .../drivers/ovn/mech_driver/ovsdb/ovn_db_sync.py | 7 +- neutron/plugins/ml2/extensions/dns_integration.py | 60 ++- neutron/services/conntrack_helper/plugin.py | 10 +- .../externaldns/drivers/designate/driver.py | 20 +- neutron/services/ovn_l3/plugin.py | 13 +- neutron/services/portforwarding/pf_plugin.py | 4 +- .../ovn/mech_driver/ovsdb/test_ovn_db_sync.py | 4 + .../conntrack_helper/test_conntrack_helper.py | 27 + .../services/ovn_l3/test_ovsdb_monitor.py | 7 +- .../linux/openvswitch_firewall/test_firewall.py | 12 +- .../openvswitch/agent/test_ovs_neutron_agent.py | 91 +++- .../ml2/drivers/ovn/agent/test_neutron_agent.py | 108 ++++ .../ovn/mech_driver/ovsdb/test_maintenance.py | 45 ++ .../ovn/mech_driver/ovsdb/test_ovn_db_sync.py | 7 +- .../drivers/ovn/mech_driver/test_mech_driver.py | 73 ++- .../plugins/ml2/extensions/test_dns_integration.py | 185 +++++++ .../unit/services/conntrack_helper/test_plugin.py | 49 +- .../externaldns/drivers/designate/test_driver.py | 81 +++ .../unit/services/portforwarding/test_pf_plugin.py | 27 + ...ip-delete-managed-dns-records-a1b2c3d4e5f6.yaml | 9 + ...bac-network-owner-manager-a4b8c2d1e3f56789.yaml | 31 ++ ...s-unloaded-service-plugin-f4c2a0766eb045b0.yaml | 10 + ...lper-cross-project-access-ba1425c06abc45d5.yaml | 8 + ...gging-policy-action-names-a59e17308f214600.yaml | 18 + ...validate-vrrp-virtual-mac-b9405bd0fb5d4f8d.yaml | 10 + ...init-skip-non-api-workers-b2c3d4e5f6a78901.yaml | 8 + ...gister-events-api-workers-4444a36464c3390b.yaml | 9 + ...kip-of-ops-invalid-ofport-a1b2c3d4e5f6a7b8.yaml | 13 + zuul.d/tempest-multinode.yaml | 2 + 55 files changed, 1524 insertions(+), 619 deletions(-)

1 0

glance_store 5.6.0 (hibiscus)
by no-reply＠openstack.org 01 Jul '26

01 Jul '26

We joyfully announce the release of: glance_store 5.6.0 This release is part of the hibiscus release series. The source is available from: https://opendev.org/openstack/glance_store Download the package from: https://pypi.org/project/glance_store For more details, please see below. 5.6.0 ^^^^^ New Features ************ * S3 location URIs are now credential-free, containing only the scheme, host, bucket, and object key. Credentials are resolved at runtime from configured backend options ("s3_store_access_key" / "s3_store_secret_key") instead of being embedded in the URI. Existing images with legacy credential-bearing S3 URIs are migrated automatically on first access. No bulk migration or downtime is required. Admins must update Glance as well — "glance_store" writes the new format, "glance" handles lazy migration of existing URIs. Bug Fixes ********* * Bug #2115906 (https://bugs.launchpad.net/glance/+bug/2115906) Fixed race condition causing mount/umount operations to fail in multi- worker Glance deployment with uWSGI. * Bug #2154211 (https://bugs.launchpad.net/glance- store/+bug/2154211): Fixed issue with the volume iterator detaching the volume after the get image call is finished causing the volume to be in transitional state and deletion fails if attempted immediately. Changes in glance_store 5.5.0..5.6.0 ------------------------------------ 122e4a0 S3 store: store location without credentials in the URI 96c1007 Imported Translations from Zanata 22e0bb5 Cinder: Fix volume iterator logic 4dbe4ee Remove traces of eventlet 0e3cdfb Add pyproject.toml to support pip 23.1 1060760 Cinder: Fix race conditions on mount/umount operations Diffstat (except docs and test files) ------------------------------------- glance_store/_drivers/cinder/store.py | 42 +- glance_store/_drivers/s3.py | 71 +-- glance_store/common/fs_mount.py | 359 +++++++-------- glance_store/common/utils.py | 74 ---- .../locale/en_GB/LC_MESSAGES/glance_store.po | 6 +- .../locale/ko_KR/LC_MESSAGES/glance_store.po | 6 +- pyproject.toml | 3 + ...s-mount-umount-operations-a2fb4054b9f8e8e2.yaml | 6 + ...cinder-fix-iterator-close-f919665aa23cfb7d.yaml | 7 + ...ation-without-credentials-7d276443d4de3cc8.yaml | 12 + .../locale/en_GB/LC_MESSAGES/releasenotes.po | 173 +++++++- requirements.txt | 3 +- 20 files changed, 1001 insertions(+), 524 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index a203215..4605211 100644 --- a/requirements.txt +++ b/requirements.txt @@ -11 +10,0 @@ stevedore>=1.20.0 # Apache-2.0 -eventlet!=0.18.3,!=0.20.1,>=0.18.2 # MIT @@ -18 +17 @@ retrying!=1.3.0,>=1.2.3 # Apache-2.0 -futurist>=1.2.0 # Apache-2.0 \ No newline at end of file +futurist>=1.2.0 # Apache-2.0

1 0