Current Series Release Notes

16.0.0.0rc1-59

New Features

• New base policy rules have been added: project_manager_or_admin, project_member_or_service, service_api, and project_manager_api.

• The non-standard role:administrator alias has been removed from the admin_api base rule, aligning Cyborg with the Keystone bootstrap role set used by Nova and other services.

• Accelerator request (ARQ) policies have been migrated to DocumentedRuleDefault with persona-based defaults as part of the OpenStack TC’s Consistent and Secure RBAC community goal. New personas for ARQ endpoints:

  • reader – read-only access to ARQs within the caller’s project.

  • member and service – ARQ write operations (create, delete, update), supporting both Nova’s current token-forwarding and future service-credential presentation.

  • admin – full access to all ARQ operations via implied roles.

• Device policies have been migrated to DocumentedRuleDefault with persona-based defaults. New personas for device endpoints:

  • manager – read access to device inventory (list, show) for capacity planning and troubleshooting.

  • admin – full access including device disable and enable.

• Deployable policies have been migrated to DocumentedRuleDefault with persona-based defaults. New personas for deployable endpoints:

  • manager – read access to deployable inventory (list, show).

  • admin – full access including FPGA programming.

Upgrade Notes

• A new cyborg-dbsync online_data_migrations subcommand backfills the project_id column on existing accelerator requests (ARQs). Expected operator order:

  1. Upgrade the cyborg-dbsync package (and related shared code) so cyborg-dbsync upgrade can apply pending schema migrations.

  2. Run cyborg-dbsync online_data_migrations to backfill project_id on existing ARQ rows using Nova instance data.

  3. Upgrade Cyborg services, starting with conductor and API, then agents.

  The cyborg-conductor service also heals remaining NULL project_id values on startup as a safety net.

  Nova GET /servers/{id} calls for this migration pass microversion 2.82 explicitly so the tenant_id field shape used for backfill stays consistent.

• The authorize_wsgi helper no longer accepts the need_target argument. It now always builds the policy target from the request context’s project_id and user_id. Out-of-tree API controllers that pass a third argument to authorize_wsgi must remove it.

• Nova must be configured with [service_user] send_service_user_token = true for Cyborg to accept bound-ARQ operations (bind, unbind, delete). This is the same requirement as for Cinder volume attachments since OSSA-2023-003.

  Cyborg now defaults [keystone_authtoken] service_token_roles_required to true so that keystonemiddleware validates the service token roles. Operators who have not already set this should ensure the service user has the service role in Keystone.

• Cyborg API policies now declare scope_types=['project'] and reject Keystone system-scoped tokens via oslo.policy scope enforcement. Use project-scoped tokens for Cyborg APIs; prefer custom policy rules if you need different access behavior.

• Cyborg no longer supports disabling policy scope enforcement. oslo.policy always enforces scope_types when they are defined on policy rules. Cyborg APIs continue to declare project scope, so callers must use project-scoped tokens instead of system-scoped tokens. Operators should audit any callers that relied on system-scoped tokens or enforce_scope=False and migrate them to project-scoped tokens before upgrading.

• The [glance] debug option has been removed. This option has not been actually used.

• The broken image signature verification feature and its associated configuration options have been removed. As noted in bug 2144308, the signature verification code has not worked since it was introduced in the Stein release (2018). The implementation referenced components from Nova (self.show() method and objects.ImageMeta) that were never implemented in Cyborg. Given that no one has reported this feature working in that time, it is simply removed.

  The following configuration options in the [glance] section have been removed:

  • verify_glance_signatures

  • default_trusted_certificate_ids

  • enable_certificate_validation

  If image signature verification is needed in the future, it will be re-implemented as a new feature with proper test coverage, key manager integration, and documentation.

• The [keystone] group has been removed from the config files. This group has not been actually used.

• Cyborg now overrides enforce_new_defaults to False in its default configuration. During the transition window, both legacy and new authorization paths are accepted. Operators may opt in to the new persona-based defaults by setting [oslo_policy] enforce_new_defaults = True in cyborg.conf.

  The transition timeline is:

  • 2026.2 – new defaults available, enforce_new_defaults defaults to False. Operators may opt in early.

  • 2027.1 – the override will be removed and new defaults will be enforced by default. Operators not yet ready can set enforce_new_defaults = False explicitly.

  • 2027.2 – the deprecated legacy rules and bridges will be removed.

• The manager and service roles must exist in Keystone (both available by default since 2023.2 (Bobcat)). The service role must be assigned to Nova’s service account for the service-token gate to function.

• Operators relying on the non-standard administrator role for Cyborg admin access must either assign the standard admin role or provide custom policy overrides before deploying this change.

Deprecation Notes

• The legacy ARQ, device, and deployable policy defaults formerly defined in cyborg/common/policy.py have been replaced by DocumentedRuleDefault entries in cyborg/policies/. Backward compatibility is preserved through deprecated-rule bridges until 2027.2, when the bridges will be removed.

Security Issues

• This issue is assigned CVE-2026-40214.

  Fixed a cross-tenant access control vulnerability in accelerator request (ARQ) management. The project_id field was never populated on ARQ records, which meant non-admin users could list, view, and delete ARQs belonging to other projects. This could lead to information disclosure (leaking instance UUIDs across tenants) and denial of service (deleting another tenant’s ARQ prevents their instance from restarting).

  ARQs are now scoped to the requesting project. Non-admin users can only see and manage their own project’s ARQs.

  Additionally, binding, unbinding, and deleting bound ARQs now require a service token. Only Nova, identified by a valid service token with the service role, may set or clear the instance_uuid on an ARQ or delete a bound ARQ. This prevents users from directly manipulating ARQs that Nova is managing, following the same pattern as the Cinder OSSA-2023-003 fix.

• This issue is assigned CVE-2026-40213.

  Replaced permissive rule:allow defaults with rule:admin_api on device, deployable, and attribute API policies so authenticated low-privilege users cannot read or change hardware topology and management data without the admin role. System-scoped tokens are not supported by Cyborg. Deployments that relied on the old defaults must grant admin or define custom policy rules for these APIs.

Bug Fixes

• Restored support for the standard OpenStack-API-Version header format that includes the service type prefix (OpenStack-API-Version: accelerator 2.1), as specified by the API-WG microversion guideline. A previous change inadvertently removed parsing of the service type prefix, causing clients that follow the standard (including keystoneauth and openstacksdk) to always fall back to the minimum API version. Both the prefixed and bare version formats are now accepted; a deprecation warning is logged when the service type prefix is omitted.

• The PCI driver now includes the standard OWNER_CYBORG trait in the trait list reported for PCI devices, consistent with the existing NVIDIA GPU driver behaviour. This trait is a standard os-traits marker (os_traits.OWNER_CYBORG) that signals the resource provider is managed by Cyborg and is stored in both the Cyborg attributes table and reported to Placement as a resource provider trait. It has no effect on Nova VM scheduling unless a device profile explicitly requires it. OWNER_CYBORG is now also defined as a named constant in cyborg.common.constants to prevent typos and improve consistency across all drivers.