Current Series Release Notes

22.0.0-36

Upgrade Notes

• The following options are no longer loaded from the [DEFAULT] section. Use the [api] section instead.

  • user_alarm_quota

  • project_alarm_quota

  • alarm_max_actions

• The deprecated aodh-config-generator command has been removed.

• The deprecated [DEFAULT] event_alarm_topuc option has been removed. Use the [listener] event_alarm_topuc option instead.

• The following deprecated options have been removed.

  • [service_credentials] os_region_name: Use [service_credentials] region_name instead.

  • [service_credentials] os_endpoint_type: Use [service_credentials] interface instead.

  • [service_credentials] os_cacert and [DEFAULT] os_cacert: Use [service_credentials] cacert instead.

• The deprecated [DEFAULT] heartbeat option has been removed. Use the [DEFAULT] heartbeat_interval option instead.

Security Issues

• Bug #2161276: Fixed a vulnerability where passing all_projects=false in alarm queries bypassed project scope filtering. Previously, the presence of all_projects in the query caused the project scoping logic to be skipped entirely, allowing non-admin users to list alarms from all projects. Queries with all_projects=false or without all_projects now correctly restrict results to the caller’s project.

Bug Fixes

• Fixed SRBAC policy definitions to align with the OpenStack-wide consistent and secure RBAC goal. The project admin persona has been removed in favor of the legacy non-project admin, and all policy rules now use project_member_or_admin or project_reader_or_admin composites so that legacy admin tokens continue to work alongside scoped project personas. The alarm creation endpoint now correctly retrieves the target project for policy enforcement.