- Release-announce - lists.openstack.org

cinder 26.1.0 (epoxy)
by no-reply＠openstack.org 21 Jun '25

21 Jun '25

We are jazzed to announce the release of: cinder 26.1.0 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/cinder Download the package from: https://tarballs.openstack.org/cinder/ Please report issues through: https://bugs.launchpad.net/cinder/+bugs For more details, please see below. 26.1.0 ^^^^^^ Bug Fixes * Bug #2082587 (https://bugs.launchpad.net/cinder/+bug/2082587) Fixed backup restoration throwing TypeError on new volume. * NFS driver bug #2074377 (https://bugs.launchpad.net/cinder/+bug/2074377) Fixed regression caused by change I65857288b797 (the mitigation for CVE-2024-32498) that was preventing the creation of a new volume from the second and subsequent snapshots of an existing volume. Changes in cinder 26.0.0..26.1.0 -------------------------------- 8df631859 [docs] Extra spaces breaking rst->html rendering 1f9d111f8 Fix type passed to write function during backup restoration ca8290720 NFS driver: Fix fail creating volume with multiple snapshots 2889ee129 zuul: cinder-plugin-ceph-tempest: raise swap size Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 1 - cinder/backup/chunkeddriver.py | 2 +- cinder/image/image_utils.py | 64 +++++++++++++------ cinder/volume/drivers/nfs.py | 8 ++- ...-fix-type-passed-during-backup-restoration.yaml | 5 ++ ...fix-nfs-vol-from-snapshot-654a07d25a33bf7d.yaml | 8 +++ 8 files changed, 158 insertions(+), 35 deletions(-)

1 0

neutron-tempest-plugin 2.12.0 (flamingo)
by no-reply＠openstack.org 21 Jun '25

21 Jun '25

We exuberantly announce the release of: neutron-tempest-plugin 2.12.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/neutron-tempest-plugin Download the package from: https://tarballs.openstack.org/neutron-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. 2.12.0 ^^^^^^ Other Notes * The testing advanced image used in some jobs has been bumped from Ubuntu Focal 20.04 to Ubuntu Jammy 22.04. Changes in neutron-tempest-plugin 2.11.0..2.12.0 ------------------------------------------------ 32af0d5 Drop explicit dependency on python-subunit e5e80a7 [CI][2025.1] Skip failing test in ubuntu jammy ovn job a016f7a Add test job for address_group api backend Ml2/OVN 42ff621 Use only "ubuntu-22.04-minimal" advance image 20d0da0 Use infra mirrors for advanced image prepare 55b1e65 Increase the timeout for neutron-tempest-plugin-bgpvpn-bagpipe 33130ea Bump advance image to Ubuntu Jammy 22.04 20024c4 Cleanup not used job aliases f7b9597 Pin "designate-tempest-plugin" to yoga-last in Yoga branch 1f3f2b1 Pin "designate-tempest-plugin" to zed-last in Zed branch 06d902e Remove Bobcat 2023.2 jobs 6ebb27b Revert "Mark "neutron-tempest-plugin-designate-scenari" as non voting" ce5687b Mark "neutron-tempest-plugin-designate-scenari" as non voting f4fb68d Unset "router:external" in subnet tests e32b2e1 Add neutron-tempest-plugin-fwaas-ovn job c732e87 [FWaaS] Update icmp_reachability_test for OVN backend c30b23b Drop ubuntu jammy jobs for master(Flamingo) ec1c11a Revert "Mark test_subport_connectivity as unstable for now" 973995e Cleanup some of the zuul job definitions b6e254e Increase ``neutron-tempest-plugin-vpnaas*`` timeout 77eebcc Add zuul.d/2025_1_jobs.yaml to irrelevant-files 3382d9d Fix a neutron-tempest-plugin 2024.2 job definition 0ec2997 Add 2025.1 (Epoxy) stable jobs 6b4bf1e Disable n-d-r tempest scenario jobs for 2023.1 dff2282 Exclude VlanQinq tests in ovn ubuntu jammy job Diffstat (except docs and test files) ------------------------------------- neutron_tempest_plugin/api/test_subnets.py | 4 +- neutron_tempest_plugin/config.py | 4 + .../fwaas/scenario/test_fwaas_v2.py | 19 +- neutron_tempest_plugin/scenario/base.py | 2 +- .../scenario/test_security_groups.py | 17 +- neutron_tempest_plugin/scenario/test_trunk.py | 1 - ...e-image-ubuntu-jammy-2204-11b5ee414d665b66.yaml | 5 + test-requirements.txt | 1 - tools/customize_ubuntu_image | 12 + zuul.d/2023_1_jobs.yaml | 13 +- zuul.d/2024_1_jobs.yaml | 2 +- zuul.d/2024_2_jobs.yaml | 11 +- zuul.d/{2023_2_jobs.yaml => 2025_1_jobs.yaml} | 184 ++++------- zuul.d/master_jobs.yaml | 363 +++++++-------------- zuul.d/project.yaml | 62 ++-- zuul.d/victoria_jobs.yaml | 4 +- zuul.d/wallaby_jobs.yaml | 4 +- zuul.d/xena_jobs.yaml | 4 +- zuul.d/yoga_jobs.yaml | 13 +- zuul.d/zed_jobs.yaml | 17 +- 20 files changed, 323 insertions(+), 419 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index ebde755..924f9ae 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +4,0 @@ flake8-import-order>=0.18.0,<0.19.0 # LGPLv3 -python-subunit>=1.0.0 # Apache-2.0/BSD

1 0

ironic-tempest-plugin 2.14.0 (flamingo)
by no-reply＠openstack.org 21 Jun '25

21 Jun '25

We joyfully announce the release of: ironic-tempest-plugin 2.14.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/ironic-tempest-plugin Download the package from: https://tarballs.openstack.org/ironic-tempest-plugin/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. Changes in ironic-tempest-plugin 2.13.0..2.14.0 ----------------------------------------------- d4e23cd Adding better error messages to microversion tests 385c83f Remove stable/2023.2 job 9ea0e36 Remove available nodes configuration 18e5dae Adding basic microversion tests to CI 296d164 fix: fail fast on deploy failure in Anaconda jobs 171c943 CI: Increment jobs for 2025.1 release 8c52bae Remove legacy standalone jobs from test execution 75ad897 remove duplicated rbac jobs eb9816c Make sure fixed IPs are different for multitenancy tests 9f0671e Replaced all punctuation with an underscore in the node resource class. Diffstat (except docs and test files) ------------------------------------- ironic_tempest_plugin/common/waiters.py | 17 +- ironic_tempest_plugin/config.py | 3 - .../services/baremetal/v1/json/baremetal_client.py | 15 + .../api/admin/test_microversion_enforcement.py | 1437 +++++++++++++++++++- zuul.d/project.yaml | 24 +- zuul.d/stable-jobs.yaml | 38 +- 10 files changed, 1451 insertions(+), 107 deletions(-)

1 0

octavia-lib 3.9.0 (flamingo)
by no-reply＠openstack.org 21 Jun '25

21 Jun '25

We eagerly announce the release of: octavia-lib 3.9.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/octavia-lib Download the package from: https://pypi.org/project/octavia-lib Please report issues through: https://storyboard.openstack.org/#!/project/openstack/octavia-lib For more details, please see below. 3.9.0 ^^^^^ Bug Fixes * Adds a "Conflict" exception drivers can raise when a resource conflict occurs. This is part of a fix for error reporting when the requested VIP address is already in use on the subnet. Changes in octavia-lib 3.8.0..3.9.0 ----------------------------------- 28fd6d5 Add a "Conflict" exception 87d8e2e Update master for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- octavia_lib/api/drivers/exceptions.py | 26 ++++++++++++++++++++++ .../Add-Conflict-exception-67bca85f9d660a36.yaml | 6 +++++ releasenotes/source/2025.1.rst | 6 +++++ releasenotes/source/index.rst | 1 + 5 files changed, 50 insertions(+)

1 0

oslo.service 4.2.1 (flamingo)
by no-reply＠openstack.org 17 Jun '25

17 Jun '25

We exuberantly announce the release of: oslo.service 4.2.1 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/oslo.service Download the package from: https://pypi.org/project/oslo.service Please report issues through: https://bugs.launchpad.net/oslo.service/+bugs For more details, please see below. 4.2.1 ^^^^^ Bug Fixes * The "threading" backend now accepts the "wait_interval" argument in "ProcessLauncher" for compatibility with services like Neutron. The parameter is still used in the "eventlet" backend to reduce CPU usage during child monitoring loops, but has no effect in "threading". A warning is logged if it is passed. In addition, multiple calls to "launch_service()" on the same "ProcessLauncher" instance are now supported, using a single "ServiceManager" internally. This makes the threading backend fully compatible with how the "eventlet" backend behaves. * Fixed a crash that occurred during service shutdown in the threading backend, caused by an incorrect call to the non-existent internal method "_terminate()" on "cotyledon.ServiceManager". The shutdown process now correctly uses the public "shutdown()" method, ensuring graceful and reliable termination of services. Changes in oslo.service 4.2.0..4.2.1 ------------------------------------ e196437 Fix crash during shutdown by using public shutdown() method 2bdf51f Accept wait_interval and support multiple launch_service() calls 0226960 Fix ServiceBase mapping when using threading backend 4aa4031 add pyproject.toml to support pip 23.1 Diffstat (except docs and test files) ------------------------------------- oslo_service/backend/threading/__init__.py | 2 +- oslo_service/backend/threading/service.py | 28 ++++++--- pyproject.toml | 3 + ...t-wait-interval-threading-fc02f76056cbaed4.yaml | 12 ++++ ...eading-shutdown-cotyledon-3aff6ca0eb0125f5.yaml | 8 +++ 6 files changed, 114 insertions(+), 10 deletions(-)

1 0

neutron 26.0.1 (epoxy)
by no-reply＠openstack.org 13 Jun '25

13 Jun '25

We are tickled pink to announce the release of: neutron 26.0.1 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/neutron Download the package from: https://tarballs.openstack.org/neutron/ Please report issues through: https://bugs.launchpad.net/neutron/+bugs For more details, please see below. 26.0.1 ^^^^^^ Known Issues ************ * The ML2/OVN Placement initial configuration is executed now in the Neutron API process and removed from the maintenance worker; since the migration to WSGI, now the API and the maintenance worker are different processes. When an OVN "Chassis" creation event is received, the configuration is read, a "PlacementState" object created and sent to the Placement API. Bug Fixes ********* * The OVN QoS floating IP rule has precedence over the OVN QoS router rule. If both are present in the same router and port (the one assigned to the floating IP), the floating IP rule will now apply. For more information, see bug 2110018 (https://bugs.launchpad.net/neutron/+bug/2110018) Other Notes *********** * The ML2/OVN Placement extension now removes any existing resource provider deleted from the updated local node configuration. If the resource provider has allocations, Placement will return an exception and it will not be deleted. Changes in neutron 26.0.0..26.0.1 --------------------------------- 28e0818b81 Fix nova notification on port unplug bceb866190 Add provider network resources filter for "network" b958f4e0c3 [OVN] OVN agent retrieval filter matching improvement dcd0d3e4c6 [FT] Match the correct event in ``test_subport_delete`` f873d55efc Initialize the network segment ranges only in first WSGI worker 4815390cdc Delete the metadata agent file from the eventlet directory 00130dc806 Fix ovn_db_sync for user defined flavor routers aadae909d7 [OVN] Create a HA_Chassis_Group without raising an exception b689e57899 [OVN] Only update the MTU of the router GW LRPs 9936955168 [OVN] Change the OVN QoS rule priority for floating IPs de8c3bf5cf [Stable Only][CI][fips jobs] Use stable constraints for tempest 05a719a3fb Subnet filter by "router:external" needs to be changed to "external" b204a06560 Return a HTTP404 message when the Metadata instance is not present e46b66635e Create a common method to encode a HTTP response 511d101f59 Create random named resources in ``TestOvnSbSync`` 4dcb039493 [OVN] Isolate test_ovn_client* Functional Tests 1ad48e2c4d Revert "[DHCP] Reduce to one single thread the event processing" 686f634a83 [OVN][QoS] Update the Logical_Swith_Port options with the QoS values af1453d1e0 [UT] Delete the OVN AgentCache instance in the cleanup aa6057914a fullstack: use shorter agent_down_time and report_interval f9275e6342 If OVS Manager creation failes retry to set values 9e0bd0a364 [OVN][Placement] Placement init config with Chassis create event 2489d8009e Revert the network IDs filter in ``_gen_router_port_options`` eef9e87991 [OVN] Delete a resource provider removed from the agent config Diffstat (except docs and test files) ------------------------------------- neutron/agent/common/placement_report.py | 27 ++++- neutron/agent/dhcp/agent.py | 22 +++- neutron/agent/metadata/agent.py | 46 +++---- neutron/agent/metadata/proxy_base.py | 9 +- neutron/agent/ovn/metadata/server_socket.py | 46 +++---- neutron/agent/ovsdb/native/helpers.py | 2 +- neutron/cmd/eventlet/agents/metadata.py | 24 ---- neutron/common/metadata.py | 29 +++++ neutron/common/ovn/constants.py | 5 + neutron/common/ovn/utils.py | 10 +- neutron/common/utils.py | 7 ++ neutron/common/wsgi_utils.py | 3 + neutron/db/db_base_plugin_v2.py | 35 ++++++ neutron/db/external_net_db.py | 11 +- neutron/objects/subnet.py | 16 --- neutron/plugins/ml2/drivers/helpers.py | 10 +- .../plugins/ml2/drivers/ovn/agent/neutron_agent.py | 23 +++- .../ml2/drivers/ovn/mech_driver/mech_driver.py | 2 +- .../ovn/mech_driver/ovsdb/extensions/placement.py | 60 ++++++--- .../ovn/mech_driver/ovsdb/extensions/qos.py | 26 +++- .../drivers/ovn/mech_driver/ovsdb/maintenance.py | 26 ++++ .../drivers/ovn/mech_driver/ovsdb/ovn_client.py | 36 +++--- .../drivers/ovn/mech_driver/ovsdb/ovn_db_sync.py | 5 +- neutron/plugins/ml2/drivers/type_tunnel.py | 44 ++++--- neutron/plugins/ml2/drivers/type_vlan.py | 47 ++++---- neutron/plugins/ml2/managers.py | 20 +-- neutron/plugins/ml2/plugin.py | 9 +- neutron/privileged/agent/ovsdb/native/helpers.py | 33 ++++- .../functional/agent/ovsdb/native/test_helpers.py | 26 ++++ .../mech_driver/ovsdb/extensions/test_placement.py | 31 +++++ .../ovn/mech_driver/ovsdb/test_maintenance.py | 27 +++++ .../ovn/mech_driver/ovsdb/test_ovn_client.py | 134 ++++++++++++++++++++- .../ovn/mech_driver/ovsdb/test_ovn_db_sync.py | 78 ++++++------ .../plugins/ml2/drivers/test_type_tunnel.py | 92 ++++++++++++++ .../trunk/drivers/ovn/test_trunk_driver.py | 21 ++-- .../unit/plugins/ml2/drivers/base_type_tunnel.py | 16 +-- .../ml2/drivers/ovn/agent/test_neutron_agent.py | 131 ++++++++++++++++++-- .../mech_driver/ovsdb/extensions/test_placement.py | 56 +++++++++ .../ovn/mech_driver/ovsdb/extensions/test_qos.py | 12 +- .../ovn/mech_driver/ovsdb/test_ovn_db_sync.py | 4 +- .../drivers/ovn/mech_driver/test_mech_driver.py | 16 ++- .../unit/plugins/ml2/drivers/test_type_vlan.py | 8 +- ...-delete-resource-provider-72c09b7df7238984.yaml | 7 ++ ...ovn-placement-init-config-6198f572e1dadcba.yaml | 8 ++ ...ovn-qos-fip-rule-priority-16ad3908790dfa7d.yaml | 8 ++ tox.ini | 2 +- zuul.d/tempest-singlenode.yaml | 4 + 52 files changed, 1076 insertions(+), 320 deletions(-)

1 0

networking-baremetal 6.6.0 (flamingo)
by no-reply＠openstack.org 13 Jun '25

13 Jun '25

We jubilantly announce the release of: networking-baremetal 6.6.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/networking-baremetal Download the package from: https://pypi.org/project/networking-baremetal Please report issues through: https://bugs.launchpad.net/networking-baremetal/+bugs For more details, please see below. 6.6.0 ^^^^^ Other Notes * Add support for using pre-commit to run checks more easily for contributors. Changes in networking-baremetal 6.5.0..6.6.0 -------------------------------------------- 4fab2a6 Remove explicit use of eventlet 4a33028 Use new syntax for neutron enablement 4e46b5a Drop redundant allowlist_externals 9ca3503 Fix failing genconfig target b66252c add pre-commit and adjust tox to utilize it b610783 fix sphinx-lint issues a95db99 fix awkward logic that the linter didn't like 64490b6 fix spelling mistakes 25928fc Update master for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- .gitignore | 3 ++ .pre-commit-config.yaml | 61 ++++++++++++++++++++++ .../configuration/ironic-neutron-agent/index.rst | 2 +- .../ironic-neutron-agent/sample-config.rst | 2 +- .../ml2/device_drivers/common_config.rst | 8 +-- .../ml2/device_drivers/netconf-openconfig.rst | 2 +- .../contributor/quickstart-netconf-openconfig.rst | 4 +- networking_baremetal/agent/ironic_neutron_agent.py | 7 +-- pyproject.toml | 30 +++++++++++ .../notes/pre-commit-a3de910e07fde16e.yaml | 4 ++ releasenotes/source/2025.1.rst | 6 +++ releasenotes/source/index.rst | 1 + requirements.txt | 15 +++--- setup.cfg | 1 + test-requirements.txt | 1 - tox.ini | 36 ++++--------- zuul.d/networking-baremetal-jobs.yaml | 20 +++---- zuul.d/project.yaml | 2 - 21 files changed, 145 insertions(+), 66 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index d344cb8..f31da62 100644 --- a/requirements.txt +++ b/requirements.txt @@ -6,6 +6,6 @@ neutron-lib>=1.28.0 # Apache-2.0 -oslo.config>=5.2.0 # Apache-2.0 -oslo.i18n>=3.15.3 # Apache-2.0 -oslo.log>=3.36.0 # Apache-2.0 -oslo.utils>=3.40.2 # Apache-2.0 -oslo.messaging>=5.29.0 # Apache-2.0 -oslo.service>=1.40.2 # Apache-2.0 +oslo.config>=9.7.1 # Apache-2.0 +oslo.i18n>=6.5.1 # Apache-2.0 +oslo.log>=7.1.0 # Apache-2.0 +oslo.utils>=8.2.0 # Apache-2.0 +oslo.messaging>=16.1.0 # Apache-2.0 +oslo.service[threading]>=4.2.0 # Apache-2.0 @@ -14 +14 @@ openstacksdk>=0.31.2 # Apache-2.0 -tooz>=2.5.1 # Apache-2.0 +tooz>=6.3.0 # Apache-2.0 @@ -18 +17,0 @@ keystoneauth1>=3.14.0 # Apache-2.0 - diff --git a/test-requirements.txt b/test-requirements.txt index 95fbab7..114c44b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +6,0 @@ testscenarios>=0.4 # Apache-2.0/BSD -ncclient>=0.6.9 # Apache-2.0

1 0

ironic-python-agent-builder 6.1.0 (flamingo)
by no-reply＠openstack.org 13 Jun '25

13 Jun '25

We joyfully announce the release of: ironic-python-agent-builder 6.1.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/ironic-python-agent-builder Download the package from: https://tarballs.openstack.org/ironic-python-agent-builder/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent-builder/+bugs For more details, please see below. 6.1.0 ^^^^^ Other Notes * Due to the deprecation of Python 3.9 support in OpenStack and the evolution of python dependencies, CI test jobs for TinyIPA have been removed. Overall code to build the test images should expect to be removed from Ironic projects and tools as time progresses. Changes in ironic-python-agent-builder 6.0.0..6.1.0 --------------------------------------------------- daf8da3 Build CS9 DIB IPA ramdisk with python 3.12 016b28f Update pip version in dib source install 800ebcd Remove tinyipa CI testing 8b246c2 Don't install biosdevname in arm64/aarch64 arches a996402 Convert README.md to README.rst 9b22773 Create Podman DIB Element for container-based cleaning 334fd79 Update master for stable/2025.1 Diffstat (except docs and test files) ------------------------------------- dib/element/ironic-python-agent-podman/README.rst | 191 +++++++++++++++++++++ .../ironic-python-agent-podman/element-deps | 2 + .../environment.d/10-setup.bash | 21 +++ .../package-installs.yaml | 2 + .../pre-finalise.d/10-ipa-podman-config | 10 ++ .../pre-finalise.d/20-ipa-config | 17 ++ .../pre-finalise.d/30-ipa-steps | 10 ++ dib/extra-hardware/package-installs.yaml | 2 +- .../60-ironic-python-agent-ramdisk-install | 13 +- dib/ironic-python-agent-ramdisk/pkg-map | 12 +- .../tinyipa-ci-testing-ends-8748513e6512cf8f.yaml | 7 + releasenotes/source/2025.1.rst | 6 + releasenotes/source/index.rst | 1 + zuul.d/ironic-python-agent-builder-jobs.yaml | 12 -- zuul.d/project.yaml | 6 - 15 files changed, 284 insertions(+), 28 deletions(-)

1 0

ironic-python-agent 11.0.0 (flamingo)
by no-reply＠openstack.org 13 Jun '25

13 Jun '25

We are psyched to announce the release of: ironic-python-agent 11.0.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/ironic-python-agent Download the package from: https://tarballs.openstack.org/ironic-python-agent/ Please report issues through: https://bugs.launchpad.net/ironic-python-agent/+bugs For more details, please see below. 11.0.0 ^^^^^^ Security Issues *************** * The "agent_token_required" configuration option has been removed. This was a knob to help ease the upgrade process by enabling operators to express if their environment was requiring an agent token. This was key to help navigate possible upgrade cases, however that was for the migration *to* the Victoria release, and such an upgrade is outside of the version support matrix of Ironic. Bug Fixes ********* * Eventlet support in OpenStack is deprecated, and the oslo libraries used by Ironic Python Agent is deprecating support for eventlet in 2026.2. This change removes the use of eventlet directly and ensures none of our libraries are using eventlet-based code. * Fixes IPA collecting the effective MAC address of NICs instead of the pesistent MAC address. In case it fails to fetch the persistent address falls back to effective MAC address. See https://bugs.launchpad.net/ironic-python-agent/+bug/2103450 for details. Changes in ironic-python-agent 10.2.0..11.0.0 --------------------------------------------- 883e3cf0 Remove unused tinyipa CI job 2e35dfc7 Remove TinyIPA jobs 48422a53 netutils: Use ethtool ioctl to get permanent mac address c03021fe Remove eventlet from Ironic Python Agent 9b03ca7d Remove unnecessary +x mode f359c81c trivial: Fix missing extra space in logging a709e6fb Base standalone job on redfish standalone 7e6bc5cb Implement manual cleaning for ContainerHardwareManager c3e9266f Ironic Config Intergration for IPA 7efe3dfc Fix test_timeout on Python3.13 228033e9 Run UT of metricis_lib 5d3192e9 Remove eventlet greendns patching a3a2b835 Add ContainerHardwareManager aa65b8c1 Missing 'interface' in Clean Step ac85195b Update master for stable/2025.1 94fde4b3 Remove agent_token_required upgrade knob Diffstat (except docs and test files) ------------------------------------- examples/business-logic/example_business_logic.py | 1 + examples/vendor-device/example_device.py | 1 + ironic_python_agent/__init__.py | 19 -- ironic_python_agent/agent.py | 27 +- ironic_python_agent/api/app.py | 52 ++-- ironic_python_agent/config.py | 38 ++- ironic_python_agent/errors.py | 9 + ironic_python_agent/hardware.py | 7 + ironic_python_agent/hardware_managers/container.py | 152 ++++++++++++ ironic_python_agent/netutils.py | 43 +++- .../unit/hardware_managers/nvidia/__init__.py | 0 ironic_python_agent/utils.py | 2 +- .../notes/eventlet-removal-1bd8c6c2d5f8a765.yaml | 6 + .../notes/fix-mac-permaddr-0bc7d688eee4b814.yaml | 9 + ...move-agent-token-required-808e99b83b4456a1.yaml | 9 + releasenotes/source/2025.1.rst | 6 + releasenotes/source/index.rst | 1 + requirements.txt | 12 +- setup.cfg | 1 + zuul.d/ironic-python-agent-jobs.yaml | 11 +- zuul.d/project.yaml | 3 - 29 files changed, 623 insertions(+), 268 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index a639a50d..81e2ee54 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,6 +2,5 @@ pbr>=6.0.0 # Apache-2.0 -eventlet>=0.18.2 # MIT -oslo.config>=5.2.0 # Apache-2.0 -oslo.concurrency>=3.26.0 # Apache-2.0 -oslo.log>=4.6.1 # Apache-2.0 -oslo.service>=1.24.0 # Apache-2.0 -oslo.utils>=8.0.0 # Apache-2.0 +oslo.config>=9.7.1 # Apache-2.0 +oslo.concurrency>=7.1.0 # Apache-2.0 +oslo.log>=7.1.0 # Apache-2.0 +oslo.service>=4.1.1 # Apache-2.0 +oslo.utils>=8.2.0 # Apache-2.0 @@ -17,0 +17 @@ zeroconf>=0.24.0 # LGPL +cheroot>=10.0.1 # BSD

1 0

ironic 30.0.0 (flamingo)
by no-reply＠openstack.org 13 Jun '25

13 Jun '25

We are stoked to announce the release of: ironic 30.0.0 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/ironic Download the package from: https://tarballs.openstack.org/ironic/ Please report issues through: https://bugs.launchpad.net/ironic/+bugs For more details, please see below. 30.0.0 ^^^^^^ New Features ************ * Adds NVIDIA A10/A40/L40S/L20 to known accelerators that can be reported when present in bare metals. * It is now possible to filter by conductor groups when listing ports and portgroups. For example, the following request returns only the ports for nodes in conductor groups "bear" and "metal": GET /v1/ports?conductor_groups=bear,metal * If *allow_image_access_via_auth_token* is set to *True*, Ironic allows access to Glance images if an auth_token is present in the request context. * Add a new configuration group [agent_containers] that allows users to dynamically configure container-based cleaning via Ironic conductor. * Adds a new configuration option "bootloader_by_arch", a dictionary value that maps architecture names to a Glance ID, http:// or file:// URL of an EFI system partition image containing EFI boot loader, to support architecture-specific images for virtual media boot in mixed-architecture clouds. * Adds a new boolean configuration option "[neutron]fail_on_port_binding_failure" and corresponding node "driver_info" setting "fail_on_binding_failure" to control whether deployment should fail or continue if Neutron port binding fails. With a default of "true", if your network is not configured properly, this will likely cause deployment failures. To maintain the previous behavior, explicitly set this option to False in your configuration. * A new "description" field has been added to the Port object. This field allows operators to provide human-readable descriptions to easily identify physical ports on bare metal hosts. * The "ipmitool-socat" console interface is now available for users of the "redfish" hardware type. This was done as an enablement action for operators to be able to leverage IPMI based Serial-over- Lan connections. This option requires the IPMI parameters to be configured on the baremetal node in addition to the "redfish" hardware type. * Adds a new option "[json_rpc]client_use_ssl". It can be set to True in situations where server-side TLS is handled by a reverse proxy, and thus "[json_rpc]use_ssl" is set to False. * Add support for a node in "service wait" state can be unprovisioned via the "delete" provision action. * The Ironic conductor can now access images that are shared with its project, in addition to those it owns. To use the feature, ensure the images are shared with the project associated with the conductor's credentials. Upgrade Notes ************* * CONF.allow_image_access_via_auth_token is set to *True* in this Ironic release. OpenStack integrated operators should ensure images for Ironic use are using image visibility "public" or "community" for the most reliable results. Deprecation Notes ***************** * While never supported outside of the Ironic project's CI testing, use of the TinyIPA ramdisk image is in the process of being discontinued. Any users who chose to utilize TinyIPA for any reasons should leverage ironic-python-agent-builder images. Security Issues *************** * Fixes OSSA-2025-001, where Ironic did not properly filter file:// paths when used as image sources. This would permit any file accessible by the conductor to be used as an image to attempt deployment. Ironic now unconditionally forbids paths that provide access to system configuration (/dev, /sys, /proc, /boot, /run, and /etc). Adds "CONF.conductor.file_url_allowed_paths", an allowlist configuration defaulting to "/var/lib/ironic", "/shared/html", "/opt/cache/files", "/vagrant", and "/templates", permits operators to further restrict where the conductor will fetch images for when provided a file:// URL. This default value was chosen based on known usage by projects downstream of Ironic, including Metal3, Bifrost, and OpenShift. These defaults may change to be more restrictive at a later date. Operators using file:// URLs are encouraged to explicitly set this value even if the current default is sufficient. Operators wishing to fully disable the ability to deploy with a file:// URL should set this configuration to "" (empty). This issue only poses a significant security risk when Ironic's automated cleaning process is disabled and the service is configured in such a way that permits direct deployment by an untrusted API user, such as standalone Ironic installations or environments granting ownership of nodes to projects. Bug Fixes ********* * In the redfish inspector, use condition to control whether the pxe_enabled field of a port is updated during inspection. [inspector]update_pxe_enabled is used to control this so it behaves like all other inspection interfaces. The default value for this configuration is True. * Fixes loop functionality to align more closely with the spec where, with *loop* present, *args* reference loop items using '{item}' placeholder to support direct array iteration; plus, separately handle list and dict loop item types. * Fixes an issue with the "neutron" "network_interface" driver where validate calls by "member" scoped API users, triggered through a port update or explicit node interface validation action would fail due to the user being unable to resolve provisioning or cleaning networks because the networks are in a different project. * Fixes interface binding logic as it relates to Neutron VIF attachments, such that an initial neutron port update occurs to ensure Neutron performs any necessary address assignments, which will now result in the port entering an "ACTIVE" state. The state may change later on as the port is updated as part of any workflow actions with supplied port configuration information to allow ML2 plugins to finalize any port binding actions, when appropriate. The base bug which identified this issue is bug 2106073 (https://bugs.launchpad.net/nova/+bug/2106073) which will require additional work to completely fix. Related, this logic *also* detaches any previously bound VIF which might have been supplied to Ironic. To have done so in advance of attachment is erroneous, yet understandable behavior. * Fixes an issue with agent startup where the workflow from the first agent heartbeat interaction could fail due to a transient networking issue leaving the Agent and Ironic in a state where the node cannot be deployed and continues to record errors upon each additional heartbeat operation. Logic to check the state of the agent has been adjusted to ignore retry operations which were recorded by the agent. More information on this issue can be found in bug 2110698 (https://bugs.launchpad.net/ironic/+bug/2110698) * Fixes an issue where a Nova, or other consumer attempting to send network data to Ironic can send grossly invalid network metadata which needs to be replaced. Ironic now identifies the condition, and regenerates the network metadata utilizing the attached VIF records. This results in some minor data differences, such as Nova's internal VIF tap naming which is redundant, and MTUs to be included in the Network data when they might not have been included previously. More information about this bug can be found in bug 2106073 (https://bugs.launchpad.net/ironic/+bug/2106073) This logic does *not* attempt to patch or modify configuration drive URLs which are supplied by tools like Bifrost, which is unaffected by this issue. This fix can be disabled by setting "[conductor]disable_configdrive_check" to "True". * Updates the patch validation logic to support special characters ("~" and "/") in field keys, provided they align with the escaping rules defined in RFC 6901 (JSON Pointer) as required for the *path* field specified in RFC 6902 (JSON Patch). * Fixes an error that node does not move to failed state when removing vif failed due to unexpected errors during tear down. Other Notes *********** * Ironic is in the process of removing testing and use of TinyIPA, which was originally developed as a lightweight low memory IPA image to simplify upstream testing and had no use outside of that context. Due to the OpenStack move away from Python3.9, TinyIPA cannot continue to be maintained, and as such all testing and use of images will be discontinued by the Ironic community. Changes in ironic 29.0.0..30.0.0 -------------------------------- ea8b3fcc3 Patch configdrive metadata 6d1195481 Add a new configuration option, ``bootloader_by_arch`` b476c1bc2 re-framing this as an explicit bugfix to backport 8f7d5d817 ci: remove the partition image upload 72c208f76 ci: Expand the multinode job -- remove tinyipa usage d33c981dc CI: remove legacy devstack baremetal admin and observer role usage b7efcda9e Update devstack-guide to use neutron- not q- 5a9efa070 Control port updates with update_pxe_enabled flag 9406b4465 Replace license classifier 65f1396d1 Add port/portgroup list conductor groups filter 95294caa6 [ci] Restore ovn-ipv6 job to voting 1cc44809a Remove warning filter for old oslo.db 8b3e8c87d Drop duplicate logic b744e2ed0 [CI] metal3 job back to voting 241d296b5 [CI] Fix libvirt network names in metal3 job logs collection 9211ab629 Replace eventlet usage in `pxe_filter` 9a0de989a Replace `eventlet.spawn_n` in Inspector Interface c7ccec9d8 Revert "Fix redfish driver URL parsing" 56d43ff56 ci: Remove code which has been long-dead 94af5f161 CI: Remove the multinode grenade job 6c0b015a0 CI: Reconfigure jobs to minimize tinyipa usage d3ff85fb8 doc: Make port binding failure configurably fatal e1835827e [CI] metal3 non voting for investigation 7358559e1 Inspection throws exception on CPU-less systems a43d615e1 trivial: add missing exception to agent code path docstrings 85456f788 Fix unhandled exception during node tear down 034312e6e CI: cleanup outdated rbac scope enforce jobs c52b1a874 Set an explicit neutron endpoint for grenade 5730b0405 api: Add schema for node firmware API 91c04035e api: Ensure parameter transform happens early 91b28bc43 Fix agent get_XXX_steps retries from being treated as not fresh agents 5731f4faf remove explicit eventlet usage around time.sleep d7b5c6eb4 doc: A possible improvement around multi-arch config options 5f7c7dcd0 Fix redfish driver URL parsing 80f97ae27 Auto-detect the RPC executor instead of hardcoding eventlet 5146e0a0f provide host_id to neutron early on 42be33b52 CI: Fix anaconda job post OSSA-2025-001 8363404ef Make metal3 job voting again 5fddef982 OSSA-2025-001: Disallow unsafe image file:// paths 58062d55d Revert "Add an index on ports.node_id" cd23ae477 Trivial: Fix gap in microversion sequence 3be31c13d Remove tags from README 538ac164e Make metal3 job non-voting temporarily e37c58220 Allow to unprovision instance from service wait states a5750a432 Add an index on ports.node_id cd5d0f8be docs: update openstackdocstheme version to 3.5.0 f597e9e4e Trivial: Fix spelling issue in configuration desc 39fc3d9fe Update some docs a39f11cec Add shared image support 915e50cee CI: Coverage for neutron with automated cleaning 876a9d402 Make port binding failure (configurably) fatal 5fccd55c9 Allow special characters in patch field keys a463ee864 Add several NV GPU types 52e090b60 Release notes title to "unreleased" for in-progress 854f059b8 Improve is_image_available 9cfb693be Fix ISO+GPT image handling 80ffd07df ci: restrict multinode job to multinode tests cbde488bc Update documentation to retain relevant terms b7cc916dd Remove compatibility for oslo.versionedobjects < 0.10.0 5b372dd9e A new 'description' field to the port object 4a02db984 Add image build method for verified OS. 3e0f6ed24 Rename ironic cmd module 55364fcb0 [devstack] Allow deploy environment with portgroups d2bd781a2 redfish: permit ipmitool-socat console for redfish usage 47e87d649 devstack: network simulator support for sonic d2fb4cbc4 Fix passing vtep fields to neutron 34bc26b55 api: Correct types for validation decorators b43d74a8f Do not silence the actual error in prepare_instance_boot ee7e1ac43 Ironic Container Config for IPA Integration 399a6c12d doc: Migrate Inspection Rules 282dd1eba Trivial: Fix Doc8 D000 errors by adjusting title 99ebf632c Fix mismatch in expected loop functionality b939c24fa docs: Clarify physical_network should be a name 3a705a59d Allow configuring RPC client TLS separately from server 86334496b De-duplicate two WSGIService's 95b999413 Fix confusing logs on tenant network configuration e7f677fdd Imported Translations from Zanata 5f911ad68 Follow up to unprovision service failed e2fa72652 network simulator support for Cisco Nexus 9k 803a96913 docs: detail network switch simulator support 7ef39b8cc Add network simulator support for force10 OS 10 fe35cb238 network testing: hooking in an external network simulator 92f30dc5a Create Support Resources Page fbb5d5a41 metal3: Use zuul user for logs, fix remote node ip, reduce timeout 3e453a376 Update master for stable/2025.1 1f5755ec1 Only try and do deep network config validate if admin 55c0a060c [Trivial] Fix typo of exception error message b31a109db devstack bindep - [platform:rpm] 2c472dfa8 Fix default IRONIC_DEFAULT_TRAITS setting e443ddcb9 Update DRAC RAID module import logic dc0dd2399 Enable atop on jobs 5c285047a ci: set a longer nova tempest build interval 861034679 Don't log PXE when your not doing PXE. f1cad5260 refactor: split glance handling into it's own method Diffstat (except docs and test files) ------------------------------------- README.rst | 4 - api-ref/source/baremetal-api-v1-get-vmedia.inc | 6 +- .../source/baremetal-api-v1-inspection-rules.inc | 260 +++++++ .../source/baremetal-api-v1-node-management.inc | 8 +- api-ref/source/baremetal-api-v1-nodes-ports.inc | 2 +- api-ref/source/baremetal-api-v1-ports.inc | 24 +- api-ref/source/index.rst | 1 + api-ref/source/parameters.yaml | 135 ++++ .../samples/inspection-rule-create-request.json | 34 + .../samples/inspection-rule-create-response.json | 21 + .../samples/inspection-rule-detail-response.json | 43 ++ .../samples/inspection-rule-list-response.json | 55 ++ .../samples/inspection-rule-show-response.json | 39 + .../samples/inspection-rule-update-request.json | 28 + .../samples/inspection-rule-update-response.json | 43 ++ api-ref/source/samples/port-create-request.json | 1 + api-ref/source/samples/port-create-response.json | 1 + .../source/samples/port-list-detail-response.json | 1 + api-ref/source/samples/port-update-response.json | 1 + devstack/files/bindep.txt | 4 + devstack/lib/ironic | 852 ++++++++++++++++++--- devstack/settings | 2 +- devstack/tools/ironic/scripts/configure-vm.py | 3 + devstack/tools/ironic/scripts/create-node.sh | 41 +- devstack/tools/ironic/templates/vm.xml | 8 + .../contributor/ironic-multitenant-networking.rst | 44 ++ ironic/api/controllers/v1/firmware.py | 16 +- ironic/api/controllers/v1/port.py | 68 +- ironic/api/controllers/v1/portgroup.py | 45 +- ironic/api/controllers/v1/ramdisk.py | 9 + ironic/api/controllers/v1/utils.py | 24 +- ironic/api/controllers/v1/versions.py | 9 +- ironic/api/schemas/v1/firmware.py | 69 ++ ironic/api/validation/__init__.py | 56 +- ironic/{cmd => command}/__init__.py | 0 ironic/{cmd => command}/api.py | 0 ironic/{cmd => command}/conductor.py | 0 ironic/{cmd => command}/dbsync.py | 0 ironic/{cmd => command}/novncproxy.py | 0 ironic/{cmd => command}/pxe_filter.py | 0 ironic/{cmd => command}/singleprocess.py | 2 +- ironic/{cmd => command}/status.py | 2 +- ironic/common/args.py | 17 +- ironic/common/console_factory.py | 2 - ironic/common/dhcp_factory.py | 2 - ironic/common/exception.py | 8 +- ironic/common/glance_service/service_utils.py | 75 +- ironic/common/image_service.py | 34 +- ironic/common/images.py | 35 +- ironic/common/inspection_rules/actions.py | 25 +- ironic/common/inspection_rules/base.py | 87 ++- ironic/common/inspection_rules/engine.py | 4 +- ironic/common/inspection_rules/operators.py | 66 +- ironic/common/json_rpc/client.py | 2 +- ironic/common/json_rpc/server.py | 4 +- ironic/common/json_rpc/wsgi.py | 77 -- ironic/common/neutron.py | 153 +++- ironic/common/release_mappings.py | 6 +- ironic/common/rpc.py | 1 - ironic/common/states.py | 5 +- ironic/common/wsgi_service.py | 69 +- ironic/conductor/base_manager.py | 4 +- ironic/conductor/configdrive_utils.py | 452 +++++++++++ ironic/conductor/deployments.py | 7 + ironic/conductor/manager.py | 27 +- ironic/conductor/periodics.py | 4 +- ironic/conductor/utils.py | 2 + ironic/conf/__init__.py | 2 + ironic/conf/agent_containers.py | 58 ++ ironic/conf/conductor.py | 40 +- ironic/conf/default.py | 6 + ironic/conf/json_rpc.py | 6 + ironic/conf/neutron.py | 4 + ironic/conf/types.py | 55 ++ ironic/db/api.py | 20 +- .../versions/1c14278d6e33_port_description.py | 31 + ironic/db/sqlalchemy/api.py | 48 +- ironic/db/sqlalchemy/models.py | 1 + ironic/drivers/base.py | 6 + ironic/drivers/modules/agent.py | 4 +- ironic/drivers/modules/agent_base.py | 16 +- ironic/drivers/modules/agent_client.py | 4 + ironic/drivers/modules/deploy_utils.py | 97 +-- ironic/drivers/modules/drac/raid.py | 5 +- ironic/drivers/modules/image_utils.py | 5 + .../inspector/hooks/known_accelerators.yaml | 18 +- ironic/drivers/modules/inspector/interface.py | 8 +- ironic/drivers/modules/network/common.py | 94 ++- ironic/drivers/modules/network/flat.py | 4 + ironic/drivers/modules/network/neutron.py | 11 +- ironic/drivers/modules/network/noop.py | 2 + ironic/drivers/modules/redfish/boot.py | 3 + ironic/drivers/modules/redfish/inspect.py | 8 +- ironic/drivers/redfish.py | 5 +- ironic/drivers/utils.py | 25 +- ironic/objects/indirection.py | 9 - ironic/objects/port.py | 118 +-- ironic/objects/portgroup.py | 19 +- ironic/pxe_filter/service.py | 24 +- .../unit/api/controllers/v1/test_portgroup.py | 43 ++ .../unit/drivers/modules/network/test_common.py | 67 +- .../unit/drivers/modules/network/test_flat.py | 1 + .../unit/drivers/modules/network/test_neutron.py | 37 +- .../unit/drivers/modules/network/test_noop.py | 1 + .../unit/drivers/modules/redfish/test_bios.py | 4 - .../unit/drivers/modules/redfish/test_boot.py | 6 - .../unit/drivers/modules/redfish/test_firmware.py | 2 - .../unit/drivers/modules/redfish/test_inspect.py | 36 + .../unit/drivers/modules/redfish/test_raid.py | 2 - playbooks/ci-workarounds/pre.yaml | 1 + playbooks/metal3-ci/post.yaml | 31 +- .../notes/add-nv-gpus-7fd4b9cacb029596.yaml | 5 + ...up-conductor-group-filter-2fe67c18f5a99265.yaml | 9 + ...age_access_via_auth_token-1b5869f1c0999bea.yaml | 14 + .../agent-containers-config-4388e266d5f0192e.yaml | 7 + ...ootloader-by-arch-support-b69eae5b30bc211f.yaml | 8 + ...y-on-port-binding-failure-e4c9749a84bd947f.yaml | 10 + ...-enabled-field-inspection-206f67c6638a0bdb.yaml | 7 + ...ality-in-inspection-rules-9bf61e8355297804.yaml | 7 + ...access-around-port-update-86118701989d8a61.yaml | 8 + .../notes/initial-port-bind-5a1ffb083f6631d4.yaml | 16 + ...sallow-unsafe-image-paths-670fdcfe3e4647d4.yaml | 26 + ...etries-with-agent-startup-aebfc36a775794c3.yaml | 11 + .../notes/port-description-4b68b22cac2e35a5.yaml | 6 + ...permit-ipmi-socat-console-9ede51ab0bc9f17d.yaml | 8 + .../remove-tinyipa-testing-c85bdb7e4d130e59.yaml | 15 + ...ace-metadata-when-invalid-c10a8c5add9151c8.yaml | 15 + .../notes/rpc-client-ssl-63b0d8ccaf88dae5.yaml | 6 + .../service-wait-unprovision-dacfa468824335b7.yaml | 5 + .../support-shared-images-8279f7ecd66b7218.yaml | 8 + ...characters-in-patch-field-e077fb994661362c.yaml | 7 + ...dled-remove-vif-exception-89fd332d0c1feea7.yaml | 5 + releasenotes/source/2025.1.rst | 6 + releasenotes/source/index.rst | 1 + .../locale/en_GB/LC_MESSAGES/releasenotes.po | 11 +- .../source/locale/ja/LC_MESSAGES/releasenotes.po | 159 ++++ releasenotes/source/unreleased.rst | 1 + setup.cfg | 16 +- zuul.d/ironic-jobs.yaml | 416 +++++----- zuul.d/metal3-jobs.yaml | 2 +- zuul.d/project.yaml | 2 +- 197 files changed, 6617 insertions(+), 1412 deletions(-)

1 0