- Release-announce - lists.openstack.org

watcher 14.1.0 (epoxy)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are gleeful to announce the release of: watcher 14.1.0 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/watcher Download the package from: https://tarballs.openstack.org/watcher/ Please report issues through: https://bugs.launchpad.net/watcher/+bugs For more details, please see below. 14.1.0 ^^^^^^ New Features ************ * A new module, "watcher.wsgi", has been added as a place to gather WSGI "application" objects. This is intended to ease deployment by providing a consistent location for these objects. For example, if using uWSGI then instead of: [uwsgi] wsgi-file = /bin/watcher-api-wsgi You can now use: [uwsgi] module = watcher.wsgi.api:application This also simplifies deployment with other WSGI servers that expect module paths such as gunicorn. Deprecation Notes ***************** * The watcher-api-wsgi console script is deprecated for removal in a future release. This artifact is generated using a setup-tools extension that is provide by PBR which is also deprecated. due to the changes in python packaging this custom extensions is planned to be removed form all OpenStack projects in a future PBR release in favor of module based wsgi applications entry points. Security Issues *************** * Watchers no longer forges requests on behalf of a tenant when swapping volumes. Prior to this release watcher had 2 implementations of moving a volume, it could use cinders volume migrate api or its own internal implementation that directly calls nova volume attachment update api. The former is safe and the recommend way to move volumes between cinder storage backend the internal implementation was insecure, fragile due to a lack of error handling and capable of deleting user data. Insecure: the internal volume migration operation created a new keystone user with a weak name and password and added it to the tenants project with the admin role. It then used that user to forge request on behalf of the tenant with admin right to swap the volume. if the applier was restarted during the execution of this operation it would never be cleaned up. Fragile: the error handling was minimal, the swap volume api is async so watcher has to poll for completion, there was no support to resume that if interrupted of the time out was exceeded. Data-loss: while the internal polling logic returned success or failure watcher did not check the result, once the function returned it unconditionally deleted the source volume. For larger volumes this could result in irretrievable data loss. Finally if a volume was swapped using the internal workflow it put the nova instance in an out of sync state. If the VM was live migrated after the swap volume completed successfully prior to a hard reboot then the migration would fail or succeed and break tenant isolation. see: https://bugs.launchpad.net/nova/+bug/2112187 for details. Bug Fixes ********* * When using prometheus datasource and more that one target has the same value for the "fqdn_label", the driver used the wrong instance label to query for host metrics. The "instance" label is no longer used in the queries but the "fqdn_label" which identifies all the metrics for a specific compute node. see Bug 2103451: https://bugs.launchpad.net/watcher/+bug/2103451 for more info. * Previously, when users attempted to create a new audit without providing a name and a goal or an audit template, the API returned error 500 and an incorrect error message was displayed. Now, Watcher displays a helpful message and returns HTTP error 400. For more info see: https://bugs.launchpad.net/watcher/+bug/2110947 * All code related to creating keystone user and granting roles has been removed. The internal swap volume implementation has been removed and replaced by cinders volume migrate api. Note as part of this change Watcher will no longer attempt volume migrations or retypes if the instance is in the *Verify Resize* task state. This resolves several issues related to volume migration in the zone migration and Storage capacity balance strategies. While efforts have been made to maintain backward compatibility these changes are required to address a security weakness in watcher's prior approach. see: https://bugs.launchpad.net/nova/+bug/2112187 for more context. * When running an audit with the *workload_stabilization* strategy with *instance_ram_usage* metric in a deployment with prometheus datasource, the host metric for the ram usage was wrongly reported with the incorrect unit which lead to incorrect standard deviation and action plans due to the application of the wrong scale factor in the algorithm. The host ram usage metric is now properly reported in KB when using a prometheus datasource and the strategy *workload_stabilization* calculates the standard deviation properly. For more details: https://launchpad.net/bugs/2113776 * Host maintenance strategy should migrate servers based on backup node if specified or rely on nova scheduler. It was enabling disabled hosts with watcher_disabled reason and migrating servers to those nodes. It can impact customer workload. Compute nodes were disabled for a reason. Host maintenance strategy is fixed now to support migrating servers only on backup node or rely on nova scheduler if no backup node is provided. * Previously, if an action failed in an action plan, the state of the action plan was reported as SUCCEEDED if the execution of the action has finished regardless of the outcome. Watcher will now reflect the actual state of all the actions in the plan after the execution has finished. If any action has status FAILED, it will set the state of the action plan as FAILED. This is the expected behavior according to Watcher documentation. For more info see: https://bugs.launchpad.net/watcher/+bug/2106407 * Bug #2110538 (https://bugs.launchpad.net/watcher/+bug/2110538) Corrected the HTTP error code returned when watcher users try to create audits with invalid parameters. The API now correctly returns a 400 Bad Request error. Changes in watcher 14.0.0..14.1.0 --------------------------------- ffec800f use cinder migrate for swap volume defd3953 Configure watcher tempest's microversion in devstack ba417b38 Fix audit creation with no name and no goal or audit_template 38622442 Set actionplan state to FAILED if any action has failed c7fde924 Add unit test to check action plan state when a nested action fails e5b5ff5d Return HTTP code 400 when creating an audit with wrong parameters fb85b27a Use KiB as unit for host_ram_usage when using prometheus datasource 53872f9a Aggregate by label when querying instance cpu usage in prometheus c0ebb8dd Drop code from Host maintenance strategy migrating instance to disabled hosts 1d7f1636 Added unit test to validate audit creation with no goal and no name c6ceaacf Add a unit test to check the error when creating an audit with wrong parameters f4bfb105 [host_maintenance] Pass des hostname in add_action solution 8a99d4c5 Add support for pyproject.toml and wsgi module paths ce9f0b4c Skip real-data tests in non-real-data jobs e385ece6 Aggregate by fqdn label instead instance in host cpu metrics c6505ad0 Query by fqdn_label instead of instance for host metrics 64f70b94 Drop sg_core prometheus related vars 68c9ce65 Update TOX_CONSTRAINTS_FILE for stable/2025.1 5fa09265 Update .gitreview for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 17 +-- devstack/lib/watcher | 96 ++++---------- devstack/plugin.sh | 3 + pyproject.toml | 3 + .../add-wsgi-module-support-597f479e31979270.yaml | 30 +++++ ...ries-with-multiple-target-0e65d20711d1abe2.yaml | 8 ++ releasenotes/notes/bug-2110947.yaml | 10 ++ .../notes/bug-2112187-763bae283e0b736d.yaml | 47 +++++++ .../notes/bug-2113776-4bd314fb46623fbc.yaml | 14 +++ ...trategy-on-disabled-hosts-24084a22d4c8f914.yaml | 10 ++ ...ion-plan-state-on-failure-69e498d902ada5c5.yaml | 13 ++ ...ror-400-on-bad-parameters-bb964e4f5cadc15c.yaml | 7 ++ setup.cfg | 2 +- tox.ini | 13 +- watcher/api/controllers/v1/audit.py | 19 +-- watcher/applier/action_plan/default.py | 22 +++- watcher/applier/actions/volume_migration.py | 98 ++++----------- watcher/common/keystone_helper.py | 34 ----- watcher/common/utils.py | 8 +- watcher/decision_engine/datasources/base.py | 2 +- watcher/decision_engine/datasources/prometheus.py | 135 ++++++++++---------- .../strategy/strategies/host_maintenance.py | 26 +--- .../strategy/strategies/zone_migration.py | 55 ++++---- .../action_plan/test_default_action_handler.py | 27 ++++ .../datasources/test_prometheus_helper.py | 140 +++++++++++++++------ .../strategy/strategies/test_host_maintenance.py | 13 +- .../strategies/test_workload_stabilization.py | 62 ++++++++- .../strategy/strategies/test_zone_migration.py | 5 +- watcher/wsgi/__init__.py | 0 watcher/wsgi/api.py | 18 +++ 34 files changed, 652 insertions(+), 422 deletions(-)

1 0

oslo.service 4.3.0 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We exuberantly announce the release of: oslo.service 4.3.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/oslo.service Download the package from: https://pypi.org/project/oslo.service Please report issues through: https://bugs.launchpad.net/oslo.service/+bugs For more details, please see below. 4.3.0 ^^^^^ Upgrade Notes * Internal backend modules have been renamed to **explicitly indicate that they are** private: * "oslo_service.backend.common" → "oslo_service.backend._common" * "oslo_service.backend.threading" → "oslo_service.backend._threading" * "oslo_service.backend.eventlet" → "oslo_service.backend._eventlet" These modules were never intended to be used directly. **This change makes it clearer** that they are internal to "oslo_service.backend". Projects should only interact with the backend system via the public interface provided in "oslo_service.backend.__init__"—**specifically through functions like** "get_component()", "get_backend()", and "init_backend()". **If your project was** directly importing any of these modules, please update the imports to use the public API instead. Changes in oslo.service 4.2.2..4.3.0 ------------------------------------ bfc7798 Fix signal lookup to only include singals. 89026fd Merge common files in one service file. caacdc8 Add comprehensive backend system documentation. Diffstat (except docs and test files) ------------------------------------- oslo_service/backend/__init__.py | 11 +- .../backend/{common => _common}/__init__.py | 0 .../backend/{common => _common}/constants.py | 0 oslo_service/backend/_common/service.py | 80 +++++++ .../backend/{eventlet => _eventlet}/__init__.py | 18 +- .../backend/{eventlet => _eventlet}/loopingcall.py | 0 .../backend/{eventlet => _eventlet}/service.py | 21 +- .../backend/{eventlet => _eventlet}/threadgroup.py | 2 +- .../backend/{threading => _threading}/__init__.py | 18 +- .../{threading => _threading}/loopingcall.py | 0 .../backend/{threading => _threading}/service.py | 12 +- .../{threading => _threading}/threadgroup.py | 2 +- oslo_service/backend/common/daemon_utils.py | 33 --- oslo_service/backend/common/signal_utils.py | 38 ---- oslo_service/backend/common/singleton.py | 26 --- oslo_service/backend/common/validation_utils.py | 23 -- ...end-submodules-to-private-63bfa674677c3854.yaml | 19 ++ 20 files changed, 383 insertions(+), 162 deletions(-)

1 0

watcher 13.1.0 (dalmatian)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are pumped to announce the release of: watcher 13.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/watcher Download the package from: https://tarballs.openstack.org/watcher/ Please report issues through: https://bugs.launchpad.net/watcher/+bugs For more details, please see below. 13.1.0 ^^^^^^ Security Issues *************** * Watchers no longer forges requests on behalf of a tenant when swapping volumes. Prior to this release watcher had 2 implementations of moving a volume, it could use cinders volume migrate api or its own internal implementation that directly calls nova volume attachment update api. The former is safe and the recommend way to move volumes between cinder storage backend the internal implementation was insecure, fragile due to a lack of error handling and capable of deleting user data. Insecure: the internal volume migration operation created a new keystone user with a weak name and password and added it to the tenants project with the admin role. It then used that user to forge request on behalf of the tenant with admin right to swap the volume. if the applier was restarted during the execution of this operation it would never be cleaned up. Fragile: the error handling was minimal, the swap volume api is async so watcher has to poll for completion, there was no support to resume that if interrupted of the time out was exceeded. Data-loss: while the internal polling logic returned success or failure watcher did not check the result, once the function returned it unconditionally deleted the source volume. For larger volumes this could result in irretrievable data loss. Finally if a volume was swapped using the internal workflow it put the nova instance in an out of sync state. If the VM was live migrated after the swap volume completed successfully prior to a hard reboot then the migration would fail or succeed and break tenant isolation. see: https://bugs.launchpad.net/nova/+bug/2112187 for details. Bug Fixes ********* * All code related to creating keystone user and granting roles has been removed. The internal swap volume implementation has been removed and replaced by cinders volume migrate api. Note as part of this change Watcher will no longer attempt volume migrations or retypes if the instance is in the *Verify Resize* task state. This resolves several issues related to volume migration in the zone migration and Storage capacity balance strategies. While efforts have been made to maintain backward compatibility these changes are required to address a security weakness in watcher's prior approach. see: https://bugs.launchpad.net/nova/+bug/2112187 for more context. Changes in watcher 13.0.0..13.1.0 --------------------------------- b5b1bc54 Configure watcher tempest's microversion in devstack c049a533 use cinder migrate for swap volume dbc06d15 Skip real-data tests in non-real-data jobs 54b3b584 Further database refactoring 8b0f1dbf Replace deprecated LegacyEngineFacade 238bb50f Run watcher-db-manage in grenade testing from venv db85f326 Update TOX_CONSTRAINTS_FILE for stable/2024.2 f6015fd6 Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + .zuul.yaml | 1 + devstack/lib/watcher | 16 ++ devstack/plugin.sh | 3 + devstack/upgrade/upgrade.sh | 2 +- .../notes/bug-2112187-763bae283e0b736d.yaml | 47 +++++ tox.ini | 2 +- watcher/applier/actions/volume_migration.py | 98 +++-------- watcher/common/context.py | 3 + watcher/common/keystone_helper.py | 34 ---- watcher/common/utils.py | 8 +- watcher/db/sqlalchemy/alembic/env.py | 4 +- watcher/db/sqlalchemy/api.py | 195 ++++++++++----------- watcher/db/sqlalchemy/migration.py | 6 +- watcher/db/sqlalchemy/models.py | 8 - watcher/decision_engine/audit/continuous.py | 2 +- .../strategy/strategies/zone_migration.py | 55 +++--- .../decision_engine/audit/test_audit_handlers.py | 14 +- .../strategy/strategies/test_zone_migration.py | 5 +- 21 files changed, 274 insertions(+), 323 deletions(-)

1 0

python-glanceclient 4.10.0 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are glad to announce the release of: python-glanceclient 4.10.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-glanceclient Download the package from: https://pypi.org/project/python-glanceclient Please report issues through: https://bugs.launchpad.net/python-glanceclient/+bugs For more details, please see below. Changes in python-glanceclient 4.9.0..4.10.0 -------------------------------------------- d46a9bf Python 3.13: fix tests 90d15f6 Add support for passing image size to Glance API b78fdc3 Replace oslo_utils.encodeutils.exception_to_unicode Diffstat (except docs and test files) ------------------------------------- glanceclient/shell.py | 2 +- glanceclient/v2/images.py | 14 +- glanceclient/v2/metadefs.py | 18 +- glanceclient/v2/shell.py | 43 ++++- glanceclient/v2/tasks.py | 2 +- 9 files changed, 403 insertions(+), 40 deletions(-)

1 0

python-keystoneclient 5.7.0 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are happy to announce the release of: python-keystoneclient 5.7.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-keystoneclient Download the package from: https://pypi.org/project/python-keystoneclient Please report issues through: https://bugs.launchpad.net/python-keystoneclient/+bugs For more details, please see below. 5.7.0 ^^^^^ Upgrade Notes * Support for Python 3.9 has been removed. Now Python 3.10 is the minimum version supported. Changes in python-keystoneclient 5.6.0..5.7.0 --------------------------------------------- be6c5069 Remove Python 3.9 support 18b5f422 Update master for stable/2025.1 851c8856 Update default envlist cf8ce5db reno: Update master for unmaintained/2023.1 Diffstat (except docs and test files) ------------------------------------- releasenotes/notes/remove-py39-a294c2d7335b646e.yaml | 5 +++++ releasenotes/source/2023.1.rst | 2 +- releasenotes/source/2025.1.rst | 6 ++++++ releasenotes/source/index.rst | 1 + setup.cfg | 3 +-- tox.ini | 2 +- 6 files changed, 15 insertions(+), 4 deletions(-)

1 0

python-aodhclient 3.9.1 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are excited to announce the release of: python-aodhclient 3.9.1 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-aodhclient Download the package from: https://pypi.org/project/python-aodhclient Please report issues through: https://bugs.launchpad.net/python-aodhclient/+bugs For more details, please see below. Changes in python-aodhclient 3.9.0..3.9.1 ----------------------------------------- 89f1235 Replace os-client-config 1db6158 Drop reference to ceilometerclient Diffstat (except docs and test files) ------------------------------------- test-requirements.txt | 2 +- 3 files changed, 6 insertions(+), 13 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 213d060..662e7b7 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1 +0,0 @@ -os-client-config>=1.28.0 # Apache-2.0 @@ -2,0 +2 @@ coverage>=3.6 # Apache-2.0 +openstacksdk>=0.10.0 # Apache-2.0

1 0

python-observabilityclient 1.2.0 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We are jazzed to announce the release of: python-observabilityclient 1.2.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-observabilityclient Download the package from: https://pypi.org/project/python-observabilityclient Please report issues through: https://bugs.launchpad.net/python-observabilityclient/+bugs For more details, please see below. Changes in python-observabilityclient 1.1.0..1.2.0 -------------------------------------------------- bcadbfe Fix PrometheusAPIClient set_client_cert Diffstat (except docs and test files) ------------------------------------- observabilityclient/prometheus_client.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

1 0

python-barbicanclient 7.2.0 (flamingo)
by no-reply＠openstack.org 28 Aug '25

28 Aug '25

We exuberantly announce the release of: python-barbicanclient 7.2.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-barbicanclient Download the package from: https://tarballs.openstack.org/python-barbicanclient/ Please report issues through: https://bugs.launchpad.net/python-barbicanclient/+bugs For more details, please see below. Changes in python-barbicanclient 7.1.0..7.2.0 --------------------------------------------- 5c53121 Cleanup py27 support Diffstat (except docs and test files) ------------------------------------- setup.py | 9 --------- 1 file changed, 9 deletions(-)

1 0

mistral 18.1.0 (caracal)
by no-reply＠openstack.org 25 Aug '25

25 Aug '25

We are tickled pink to announce the release of: mistral 18.1.0 This release is part of the caracal release series. The source is available from: https://opendev.org/openstack/mistral Download the package from: https://pypi.org/project/mistral Please report issues through: https://bugs.launchpad.net/mistral/+bugs For more details, please see below. 18.1.0 ^^^^^^ New Features * Added mutually exclusive config options "[action_providers]/allowlist" and "[action_providers]/denylist" that can be used to filter what action providers is loaded. * Added mutually exclusive config options "[legacy_action_provider]/allowlist" and "[legacy_action_provider]/denylist" that can be used to filter what actions is loaded by the legacy action provider. Changes in mistral 18.0.1..18.1.0 --------------------------------- 82c573e2 Support fnmatch glob for allow/deny lists 9a961a83 Add legacy action group to list_opts 985ed5db Add allowlist and denylist for action providers and actions 3c16d9d5 Update TOX_CONSTRAINTS_FILE for stable/2024.1 84354f15 Update .gitreview for stable/2024.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + mistral/actions/legacy.py | 7 ++ mistral/config.py | 46 ++++++++++ mistral/engine/base.py | 6 +- mistral/services/actions.py | 9 ++ .../unit/actions/test_legacy_action_provider.py | 102 +++++++++++++++++++++ mistral/utils/__init__.py | 21 ----- mistral/utils/expr_utils.py | 37 ++++++++ mistral/utils/filter_utils.py | 26 ++++++ ...ctions-allowlist-denylist-57c033279e27772e.yaml | 10 ++ tox.ini | 6 +- 12 files changed, 334 insertions(+), 27 deletions(-)

1 0

mistral 20.1.0 (epoxy)
by no-reply＠openstack.org 25 Aug '25

25 Aug '25

We are thrilled to announce the release of: mistral 20.1.0 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/mistral Download the package from: https://pypi.org/project/mistral Please report issues through: https://bugs.launchpad.net/mistral/+bugs For more details, please see below. 20.1.0 ^^^^^^ New Features * Added mutually exclusive config options "[action_providers]/allowlist" and "[action_providers]/denylist" that can be used to filter what action providers is loaded. * Added mutually exclusive config options "[legacy_action_provider]/allowlist" and "[legacy_action_provider]/denylist" that can be used to filter what actions is loaded by the legacy action provider. Changes in mistral 20.0.0..20.1.0 --------------------------------- 32e37047 Support fnmatch glob for allow/deny lists 953e5b9a Add legacy action group to list_opts 9e5d9c6b Add allowlist and denylist for action providers and actions 40c63aa8 Update TOX_CONSTRAINTS_FILE for stable/2025.1 dc0b20a5 Update .gitreview for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + mistral/actions/legacy.py | 7 ++ mistral/config.py | 46 ++++++++++ mistral/engine/base.py | 6 +- mistral/services/actions.py | 9 ++ .../unit/actions/test_legacy_action_provider.py | 102 +++++++++++++++++++++ mistral/utils/__init__.py | 22 +---- mistral/utils/expr_utils.py | 37 ++++++++ mistral/utils/filter_utils.py | 26 ++++++ ...ctions-allowlist-denylist-57c033279e27772e.yaml | 10 ++ tox.ini | 2 +- 12 files changed, 333 insertions(+), 25 deletions(-)

1 0