Current Series Release Notes

17.0.0-11

Upgrade Notes

  • The error_message field in API error responses has changed shape. Previously, ParsableErrorMiddleware double-encoded WSME fault bodies, so error_message was a JSON-encoded string that clients had to parse a second time. It is now a JSON object with faultcode, faultstring, and debuginfo keys. Clients that called json.loads() on the error_message value should access it directly as a dict (e.g. response['error_message']['faultstring']).

  • FPGA driver authors who subclass FPGADriver must rename their program(control_path, image_path) implementation to update(control_path, image_path). The agent now invokes driver.update() (the standard GenericDriver interface) instead of the FPGA-specific driver.program(). In-tree Intel and Xilinx drivers have been updated accordingly.

  • The cyborg-api console script and the eventlet-based standalone API server have been removed. Deploy the Cyborg API with a standard WSGI server using the cyborg.wsgi.api:application module.

    The standalone-server [api] options host_ip, port, api_workers, and enable_ssl_api have also been removed. The obsolete, unmaintained Ansible deployment playbook under setup/ is no longer provided.

Bug Fixes

  • Device profile groups that contained only trait: or accel: keys and no resources: key were previously accepted by POST /v2/device_profiles and stored successfully. Any attempt to bind an accelerator request against such a profile would then fail at runtime with an opaque InvalidParameterValue error inside the conductor, giving the user no actionable feedback at the point where the mistake was made. The API now rejects such requests immediately with HTTP 400 and a clear error message. (Bug #2168261)

  • The Intel NIC and NVIDIA GPU drivers now compare device_addresses allow-list entries against discovered PCI addresses case-insensitively. Previously, an entry that differed only in case from the discovered address was silently treated as not matching; for the GPU driver this could cause a configured vGPU-capable device to be registered as a plain pGPU instead.

17.0.0

Prelude

The 2026.2 release addresses two access-control vulnerabilities, CVE-2026-40213 and CVE-2026-40214, strengthening security, tenant isolation, and operational control for accelerator resources. Accelerator requests are now scoped to their owning projects. Operations on accelerator requests bound to instances require service-token validation, and access to hardware management APIs has been tightened.

The release also introduces opt-in persona-based policy defaults for the reader, member, manager, service, and admin roles. This aligns Cyborg with the OpenStack Consistent and Secure Default RBAC community goal and provides operators with a migration path before the new defaults are planned to become the default in 2027.1.

Operators also gain safer upgrade tooling for accelerator request ownership and device state, along with finer-grained control over which Intel SR-IOV NIC devices Cyborg manages. Standards-compliant API microversion handling has been restored for compatibility with OpenStack clients.

Testing and documentation were also major focuses of this release, improving release confidence and making Cyborg easier to deploy, upgrade, and use. As part of this work, the generic PCI driver has returned to fully supported status. The project also continued to pay down technical debt and improve code quality, strengthening long-term maintainability and reliability.