2026.2 Series Release Notes

23.0.0.0rc1

Upgrade Notes

  • The following options are no longer loaded from the [DEFAULT] section. Use the [api] section instead.

    • user_alarm_quota

    • project_alarm_quota

    • alarm_max_actions

  • The deprecated aodh-config-generator command has been removed.

  • The deprecated [DEFAULT] event_alarm_topuc option has been removed. Use the [listener] event_alarm_topuc option instead.

  • The following deprecated options have been removed.

    • [service_credentials] os_region_name: Use [service_credentials] region_name instead.

    • [service_credentials] os_endpoint_type: Use [service_credentials] interface instead.

    • [service_credentials] os_cacert and [DEFAULT] os_cacert: Use [service_credentials] cacert instead.

  • The deprecated [oslo_policy] enforce_scope configuration option has been removed in oslo.policy version 6.0.0 which will impact Keystone as there is no longer any way to disable RBAC policy scope enforcement; scope checks are now always enforced regardless of configuration.

    If you are not upgrading the oslo.policy to 6.0.0, then there will not be any change in scope enforcement behaviour.

  • The deprecated [DEFAULT] heartbeat option has been removed. Use the [DEFAULT] heartbeat_interval option instead.

Security Issues

  • Bug #2161276: Fixed a vulnerability where passing all_projects=false in alarm queries bypassed project scope filtering. Previously, the presence of all_projects in the query caused the project scoping logic to be skipped entirely, allowing non-admin users to list alarms from all projects. Queries with all_projects=false or without all_projects now correctly restrict results to the caller’s project.

Bug Fixes

  • Fixed SRBAC policy definitions to align with the OpenStack-wide consistent and secure RBAC goal. The project admin persona has been removed in favor of the legacy non-project admin, and all policy rules now use project_member_or_admin or project_reader_or_admin composites so that legacy admin tokens continue to work alongside scoped project personas. The alarm creation endpoint now correctly retrieves the target project for policy enforcement.