- Release-announce - lists.openstack.org

cloudkitty 21.0.1 (dalmatian)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We are pleased to announce the release of: cloudkitty 21.0.1 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/cloudkitty Download the package from: https://pypi.org/project/cloudkitty Please report issues through: https://storyboard.openstack.org/#!/project/openstack/cloudkitty For more details, please see below. 21.0.1 ^^^^^^ Security Issues * Previously, cloudkitty-api recorded request token in plain text format when a request does not comply with policy rules or debug log is enabled. This has been fixed and now token is masked in logs. Changes in cloudkitty 21.0.0..21.0.1 ------------------------------------ b7a4be0 Hide credentials in contexts from logs 82b0d01 Correct release note formatting 0f9d990 Update TOX_CONSTRAINTS_FILE for stable/2024.2 63f5b19 Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + cloudkitty/common/policy.py | 15 ++++++++++----- ...ary-and-total-with-es-os-backend-9540741b80819672.yaml | 2 +- .../notes/hide-token-from-log-e29066d6c93f3ed4.yaml | 6 ++++++ tox.ini | 4 ++-- 5 files changed, 20 insertions(+), 8 deletions(-)

1 0

openstack-ansible 31.1.3 (epoxy)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We are stoked to announce the release of: openstack-ansible 31.1.3 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ Please report issues through: https://bugs.launchpad.net/openstack-ansible/+bugs For more details, please see below. 31.1.3 ^^^^^^ Bug Fixes * GPG key URLs for RabbitMQ and Erlang were updated to relevant ones for RPM-based distributions. This fixes RabbitMQ/Erlang installation for CentOS and Rocky Linux. Changes in openstack-ansible 31.1.2..31.1.3 ------------------------------------------- 6dbcf2cd0 Bump SHAs for Epoxy 1cc360a51 aio: fix octavia/trove when used with ovs 019a18849 Disable remaining rocky10 distro jobs Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 32 +++++++++++----------- .../openstack_user_config.yml.aio.j2 | 8 ++++++ inventory/group_vars/blazar_all/source_git.yml | 4 +-- inventory/group_vars/horizon_all/source_git.yml | 6 ++-- inventory/group_vars/ironic_all/source_git.yml | 4 +-- inventory/group_vars/keystone_all/source_git.yml | 4 +-- inventory/group_vars/manila_all/source_git.yml | 4 +-- inventory/group_vars/neutron_all/source_git.yml | 6 ++-- inventory/group_vars/nova_all/source_git.yml | 4 +-- inventory/group_vars/octavia_all/source_git.yml | 6 ++-- inventory/group_vars/placement_all/source_git.yml | 4 +-- inventory/group_vars/skyline_all/source_git.yml | 4 +-- inventory/group_vars/trove_all/source_git.yml | 4 +-- .../notes/rpm_gpg_url-ae026bf0b47b845c.yaml | 6 ++++ zuul.d/project-templates.yaml | 5 ++-- 15 files changed, 57 insertions(+), 44 deletions(-)

1 0

keystone 26.1.0 (dalmatian)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We are gleeful to announce the release of: keystone 26.1.0 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/keystone Download the package from: https://tarballs.openstack.org/keystone/ Please report issues through: https://bugs.launchpad.net/keystone/+bugs For more details, please see below. 26.1.0 ^^^^^^ New Features ************ * A new module, "keystone.wsgi", has been added as a place to gather WSGI "application" objects. This is intended to ease deployment by providing a consistent location for these objects. For example, if using uWSGI then instead of: [uwsgi] wsgi-file = /bin/keystone-wsgi-public You can now use: [uwsgi] module = keystone.wsgi.api:application This also simplifies deployment with other WSGI servers that expect module paths such as gunicorn. Security Issues *************** * A potential security related issue is fixed where a token of the user from a read-only backend (i.e. LDAP) continues being accepted after the user is disabled in the backend. This is caused by the fact that Keystone does not receive any notification for that and is not able to revoke such tokens. See https://bugs.launchpad.net/keystone/+bug/2122615 for details. Changes in keystone 26.0.0..26.1.0 ---------------------------------- 489e170f8 Invalidate token of user disabled in readonly backend aea59e311 Add service user authentication to ec2 and s3 endpoints eaf73231a Add new keystone.wsgi module daaf698ba Ignore typing on the single import b6b480db9 Fix DB migrations after alembic integration 47891f4ae Update mod_openidc config for devstack 102821492 Update TOX_CONSTRAINTS_FILE for stable/2024.2 e3fa46811 Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + devstack/files/oidc/apache_oidc.conf | 8 +++-- httpd/keystone-uwsgi-admin.ini | 2 +- httpd/keystone-uwsgi-public.ini | 2 +- keystone/api/ec2tokens.py | 8 ++++- keystone/api/s3tokens.py | 7 ++++- keystone/cmd/cli.py | 2 +- keystone/common/policies/__init__.py | 4 +++ keystone/common/policies/ec2tokens.py | 34 ++++++++++++++++++++ keystone/common/policies/s3tokens.py | 36 ++++++++++++++++++++++ keystone/common/sql/upgrades.py | 17 ++++++++++ keystone/token/provider.py | 25 +++++++++++++++ keystone/wsgi/__init__.py | 0 keystone/wsgi/api.py | 22 +++++++++++++ .../add-keystone-wsgi-module-afae3f86df07eca9.yaml | 22 +++++++++++++ ...led-user-readonly-backend-5fa09c3e40e8d795.yaml | 8 +++++ tox.ini | 8 ++--- 24 files changed, 251 insertions(+), 29 deletions(-)

1 0

python-ironicclient 5.10.2 (epoxy)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We eagerly announce the release of: python-ironicclient 5.10.2 This release is part of the epoxy release series. The source is available from: https://opendev.org/openstack/python-ironicclient Download the package from: https://pypi.org/project/python-ironicclient Please report issues through: https://bugs.launchpad.net/python-ironicclient/+bugs For more details, please see below. Changes in python-ironicclient 5.10.1..5.10.2 --------------------------------------------- adb3f5f Stop using deprecated format_* from osc_utils Diffstat (except docs and test files) ------------------------------------- ironicclient/common/utils.py | 24 ++++++++++++++++++++++ ironicclient/osc/v1/baremetal_chassis.py | 2 +- ironicclient/osc/v1/baremetal_conductor.py | 3 ++- ironicclient/osc/v1/baremetal_node.py | 2 +- ironicclient/osc/v1/baremetal_port.py | 2 +- ironicclient/osc/v1/baremetal_portgroup.py | 2 +- ironicclient/osc/v1/baremetal_volume_connector.py | 2 +- ironicclient/osc/v1/baremetal_volume_target.py | 2 +- 10 files changed, 35 insertions(+), 10 deletions(-)

1 0

python-ironicclient 5.8.1 (dalmatian)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We contentedly announce the release of: python-ironicclient 5.8.1 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/python-ironicclient Download the package from: https://pypi.org/project/python-ironicclient Please report issues through: https://bugs.launchpad.net/python-ironicclient/+bugs For more details, please see below. 5.8.1 ^^^^^ Bug Fixes * Display correct field for the port name of the Port resource. Changes in python-ironicclient 5.8.0..5.8.1 ------------------------------------------- 11909b8 Stop using deprecated format_* from osc_utils 40cae66 fix port name in Port resource a8eb41c Replace outdated python job template c4740ae Update TOX_CONSTRAINTS_FILE for stable/2024.2 a543a91 Update .gitreview for stable/2024.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + ironicclient/common/utils.py | 24 ++++++++++++++++++++++ ironicclient/osc/v1/baremetal_chassis.py | 2 +- ironicclient/osc/v1/baremetal_conductor.py | 3 ++- ironicclient/osc/v1/baremetal_node.py | 2 +- ironicclient/osc/v1/baremetal_port.py | 2 +- ironicclient/osc/v1/baremetal_portgroup.py | 2 +- ironicclient/osc/v1/baremetal_volume_connector.py | 2 +- ironicclient/osc/v1/baremetal_volume_target.py | 2 +- ironicclient/v1/resource_fields.py | 3 +-- .../notes/fix-port-name-0d8190665b89c6d7.yaml | 4 ++++ tox.ini | 10 ++++----- zuul.d/project.yaml | 2 +- 15 files changed, 48 insertions(+), 19 deletions(-)

1 0

openstack-ansible 30.1.4 (dalmatian)
by no-reply＠openstack.org 26 Jan '26

26 Jan '26

We are excited to announce the release of: openstack-ansible 30.1.4 This release is part of the dalmatian release series. The source is available from: https://opendev.org/openstack/openstack-ansible Download the package from: https://tarballs.openstack.org/openstack-ansible/ Please report issues through: https://bugs.launchpad.net/openstack-ansible/+bugs For more details, please see below. 30.1.4 ^^^^^^ Bug Fixes * Fixed RabbitMQ upgrade issue for older deployments which had previously used RabbitMQ Classic Queue mirroring (HA Queues) by implementing an upgrade check and disabling leftover policies on upgrade. * GPG key URLs for RabbitMQ and Erlang were updated to relevant ones for RPM-based distributions. This fixes RabbitMQ/Erlang installation for CentOS and Rocky Linux. Changes in openstack-ansible 30.1.3..30.1.4 ------------------------------------------- 4900fdc2d Bump SHAs for 2024.2 Diffstat (except docs and test files) ------------------------------------- ansible-role-requirements.yml | 4 ++-- inventory/group_vars/cinder_all/source_git.yml | 4 ++-- inventory/group_vars/horizon_all/source_git.yml | 4 ++-- inventory/group_vars/ironic_all/source_git.yml | 4 ++-- inventory/group_vars/keystone_all/source_git.yml | 4 ++-- inventory/group_vars/neutron_all/source_git.yml | 4 ++-- inventory/group_vars/nova_all/source_git.yml | 6 +++--- inventory/group_vars/octavia_all/source_git.yml | 4 ++-- inventory/group_vars/placement_all/source_git.yml | 4 ++-- .../notes/rabbitmq_ensure_no_queue_mirroring-c032f6e169f09c2d.yaml | 7 +++++++ releasenotes/notes/rpm_gpg_url-ae026bf0b47b845c.yaml | 6 ++++++ 11 files changed, 32 insertions(+), 19 deletions(-)

1 0

python-ironicclient 5.13.1 (flamingo)
by no-reply＠openstack.org 23 Jan '26

23 Jan '26

We are happy to announce the release of: python-ironicclient 5.13.1 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/python-ironicclient Download the package from: https://pypi.org/project/python-ironicclient Please report issues through: https://bugs.launchpad.net/python-ironicclient/+bugs For more details, please see below. 5.13.1 ^^^^^^ New Features ************ * Adds "vendor" field and "category" field support, which is introduced in ironic API 1.100 and 1.101 respectively. These field is used to store informational text about the port for trait based scheduling. Bug Fixes ********* * Update the Ironic API that the client supports to the 2025.2 release of Ironic. Changes in python-ironicclient 5.13.0..5.13.1 --------------------------------------------- b5125b4 fix: report compatibility with 2025.2 release of Ironic b2c1dfa feat: add 'vendor' and 'category' for port object d6eca39 Update TOX_CONSTRAINTS_FILE for stable/2025.2 5172375 Update .gitreview for stable/2025.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + ironicclient/common/http.py | 2 +- ironicclient/osc/v1/baremetal_port.py | 53 +++++++++- ironicclient/v1/port.py | 2 +- ironicclient/v1/resource_fields.py | 4 + .../add-port-vendor-category-4f046b55eec698bf.yaml | 6 ++ .../notes/fix-api-version-9542bf9df71f809e.yaml | 5 + tox.ini | 10 +- 10 files changed, 189 insertions(+), 9 deletions(-)

1 0

keystonemiddleware 10.12.1 (flamingo)
by no-reply＠openstack.org 19 Jan '26

19 Jan '26

We are tickled pink to announce the release of: keystonemiddleware 10.12.1 This release is part of the flamingo release series. The source is available from: https://opendev.org/openstack/keystonemiddleware Download the package from: https://pypi.org/project/keystonemiddleware Please report issues through: https://bugs.launchpad.net/keystonemiddleware/+bugs For more details, please see below. Changes in keystonemiddleware 10.12.0..10.12.1 ---------------------------------------------- a44297c Fix privilege escalation via spoofed identity headers 3b9736a Update TOX_CONSTRAINTS_FILE for stable/2025.2 5372d7f Update .gitreview for stable/2025.2 Diffstat (except docs and test files) ------------------------------------- .gitreview | 1 + keystonemiddleware/external_oauth2_token.py | 7 +- .../unit/test_external_oauth2_token_middleware.py | 76 ++++++++++++++++++++++ tox.ini | 6 +- 4 files changed, 85 insertions(+), 5 deletions(-)

1 0

os-ken 4.1.1 (gazpacho)
by no-reply＠openstack.org 19 Jan '26

19 Jan '26

We are tickled pink to announce the release of: os-ken 4.1.1 This release is part of the gazpacho release series. The source is available from: https://opendev.org/openstack/os-ken Download the package from: https://pypi.org/project/os-ken Please report issues through: https://storyboard.openstack.org/#!/project/openstack/os-ken For more details, please see below. Changes in os-ken 4.1.0..4.1.1 ------------------------------ fb26aaec Fix Timeout context Diffstat (except docs and test files) ------------------------------------- os_ken/lib/hub.py | 26 ++++++++++++++------------ 2 files changed, 34 insertions(+), 12 deletions(-)

1 0

python-cloudkittyclient 6.0.0 (gazpacho)
by no-reply＠openstack.org 19 Jan '26

19 Jan '26

We are ecstatic to announce the release of: python-cloudkittyclient 6.0.0 This release is part of the gazpacho release series. The source is available from: https://opendev.org/openstack/python-cloudkittyclient Download the package from: https://pypi.org/project/python-cloudkittyclient Please report issues through: https://storyboard.openstack.org/#!/project/openstack/python- cloudkittyclient For more details, please see below. 6.0.0 ^^^^^ Upgrade Notes * The default API version has been changed from v1 to v2. Users who want to continue using the v1 API must now explicitly specify the API version using the "--os-rating-api-version 1" CLI option or by setting the "OS_RATING_API_VERSION=1" environment variable. If no version is specified, the client will now use the v2 API by default. * Support for Python 3.9 has been removed. Now Python 3.10 is the minimum version supported. Changes in python-cloudkittyclient 5.4.0..6.0.0 ----------------------------------------------- 2d965f9 Use v2 API by default e1408eb Fix docs job ab5b02d Update supported python versions c26fc95 Update master for stable/2025.2 f8da9da Add support to rating rules with start and end 2240208 Replace os-client-config 826297e CI: enable ceilometer plugin Diffstat (except docs and test files) ------------------------------------- .zuul.yaml | 2 + cloudkittyclient/osc.py | 2 +- cloudkittyclient/shell.py | 6 +-- cloudkittyclient/v1/rating/hashmap.py | 20 +++++++++ cloudkittyclient/v1/rating/hashmap_cli.py | 14 ++++++ cloudkittyclient/v1/rating/pyscripts.py | 19 +++++++- cloudkittyclient/v1/rating/pyscripts_cli.py | 11 +++++ ...default-api-version-to-v2-6d4bb5bfa234ed13.yaml | 8 ++++ .../notes/remove-py39-8c71acfb47b84070.yaml | 5 +++ releasenotes/source/2025.2.rst | 6 +++ releasenotes/source/index.rst | 1 + requirements.txt | 2 +- setup.cfg | 5 +-- tox.ini | 1 - 20 files changed, 213 insertions(+), 36 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 1cdc556..00a9bcb 100644 --- a/requirements.txt +++ b/requirements.txt @@ -12 +12 @@ jsonpath-rw-ext>=1.2.0 # Apache-2.0 -os-client-config>=2.1.0 # Apache-2.0 +openstacksdk>=0.10.0 # Apache-2.0

1 0