Stein バージョンのリリースノート



  • Horizen で以前使用されていた pyScss 1.3.4 が setuptools 46 では機能しないという非互換性が原因で、pyScss 1.3.7 が必須となりました。

  • pyScss が 1.3.7 にアップグレードされたのにともなって、マテリアルデザインテーマが適切に機能するための回避策が追加されました。詳しくは [bug 1771559] を参照してください。



  • publicize_image policy now has the same name both for image create and edit features and corresponds to the same one in Glance. If you changed the policy name manually to get feature working you have to rollback your changes before Horizon update.


  • [bug 1859041] image:publicize_image ポリシーの名前は、 Glance と同じ publicize_image に変更されました。



  • [bug 1840465] ルールが設定されていないセキュリティーグループが 1 つ以上ある場合に、セキュリティーグループの一覧表示が機能しないバグが修正されました。



  • python-cinderclient >=4.0.1 is now required to fix bug 1824017. Cinder API 3.55 or later does not accept additional properties but python-cinderclient older than 4.0.0 sends additional properties like used_id, status and so on. Horizon uses Cinder API 3.58 to create a volume, and this means the volume creation fails if python-cinderclient <4.0.0 is used. To handle this, the minimum requirement of python-cinderclient was bumped to 4.0.1.



  • 管理/ネットワーク/ルーターのパネルに「ルーターの作成」ボタンが追加されました。

  • With the fixes in Rocky that allow using Django's recursive template inheritance we have added new blocks in our base.html template to allow a better means of customizing through your themes. For details see the customizing docs.

  • [blueprint mitigate-breach-attacks] Adding Django-debreach module to mitigate breach attacks. Enabling the RandomCommentMiddleware to counter breach attack by randomising the content length of each response.

  • [blueprint neutron-rbac-policies] This blueprint adds RBAC policies panel to the Admin Network group. This panel will be enabled by default when the RBAC extension is enabled. Remove this panel by setting "'enable_rbac_policy': False" in ''. RBAC policy supports the control of two resources: networks and qos policies, because qos policies is an extension function of neutron, need to enable this extension if wants to use it.

  • [bug 1785263] Modify the project detail view in a multi tabbed view, composed of:

    • Overview tab displaying general information about the project.

    • Users tab displaying all users which have roles on the project (and their roles on it), including users which have roles on the project throw their membership to a group.

    • グループ タブには、プロジェクト上にロールがある全部グループ (およびプロジェクト上のロール) が表示されるようになりました。

  • [bug 1792524] Modify the user detail view in a multi tabbed view, composed of:

    • Overview tab displaying general information about the user.

    • Roles assignments tab displaying all the roles that the users have on project or domain, directly or throw their membership to a group. When the role comes from a membership to a group this will be indicated into the role column.

    • ユーザーがメンバーになっているすべてのグループが ``グループ``タブ に表示されるようになりました。

  • [blueprint cinder-generic-volume-groups] Cinder generic groups is now supported for admin panel. Admin is now able to view all groups and group snapshots for differenet users. Also group-type and group-type-spec support added to admin panel. Admin is able to create group-type and group-type-spec now.

  • New setting SESSION_REFRESH (defaults to True) that allows the user session expiry to be refreshed for every request until the token itself expires. SESSION_TIMEOUT acts as an idle timeout value now.

  • LAUNCH_INSTANCE_DEFAULTS ディクショナリーに hide_create_volume 設定が新しく追加されました。この設定により、"Launch Instance" フォームの "Create New Volume" オプションを非表示にして、代わりに create_volume でデフォルト値を選択し、ユーザーにとって最も適切なオプションを表示することができます。

  • [bug 1795851] Operators now can control whether the links of "Download OpenRC" and "Download clouds.yaml" are displayed or not via new settings SHOW_OPENRC_FILE and SHOW_OPENSTACK_CLOUDS_YAML. openrc and clouds.yaml files provided by horizon now assume the basic simple deployment and do not cover keystone authentication like saml2, openid and so on. The default openrc and clouds.yaml from horizon do not make sense for such environments.

    Custom templates for clouds.yaml and openrc files can be configured now via OPENSTACK_CLOUDS_YAML_CUSTOM_TEMPLATE and OPENRC_CUSTOM_TEMPLATE settings. For more detail, see the Settings Reference.

    ADD_TEMPLATE_DIRS setting is also added so that operators can place custom templates for clouds.yaml at deployment-specific paths.

  • 次のバージョンで問題となる可能性のある設定ファイルをチェックする upgrade_check 管理コマンドが追加されました。このコマンドは、./ upgrade_check として提供されています。



  • To allow certain views to optionally disable analytics tracking when handling sensitive data, don't use the custom_head_js block, or the now deprecated template horizon/_custom_head_js.html for analytics tracking. Please read the customizing docs and instead use the dedicated custom_analytics block so Horizon or its plugins can when needed disable tracking on a given view.

  • PKI token support has been dropped from horizon. PKI token was removed from keystone in Ocata release which was released two years ago. It is a good timing to drop its support.

    OPENSTACK_TOKEN_HASH_ALGORITHM setting was removed because it was used only for PKI token check. Unless you use PKI token before upgrading, there is no affect and you can safely drop it from your

  • SESSION_TIMEOUT now by default acts as an idle timeout rather than a hard timeout limit. If you wish to retain the old hard timeout functionality set SESSION_REFRESH to False.

  • policy.json files for Cinder, Keystone Neutron and Nova are generated according to Policy file maintenance. Keystone changes to policy rules <>__, are not compatible with the Horizon so we keystone_policy.json is not updated. Please, be sure that new Keystone policies are compatible with your deployment before syncing them.

  • The default value of SESSION_ENGINE is changed to django.contrib.sessions.backends.cache so that a cache-based session backend is used.

    The default cache back-end is set to the memcached backend django.core.cache.backends.memcached.MemcachedCache from the local-memory backend considering multi-process web server deployments.

    これらは、Horizen で長い間推奨されている設定ですが、デフォルトでは使用しません。

    If your deployment uses the signed-cookies as a session engine, ensure that SESSION_ENGINE is configured to django.contrib.sessions.backends.signed_cookies before upgrading horizon to Stein release. If your deployment uses the cached session engine and your cache backend depends on horizon default setting, ensure to CACHES setting to use the local-memory backend.

  • The default value of SHOW_KEYSTONE_V2_RC setting is changed to False in favor of the deprecation of keystone v2 API support in horizon.


  • The customization override templates have been deprecated in favor of using recursive inheritance in your themes. The following templates have been deprecated and are slated for removal in the U release: * _footer.html' * _login_footer.html * _login_form_footer.html * horizon/_custom_head_js.html * horizon/_custom_meta.html

  • Horizon における Keystone v2 API は、Train リリースからサポートされなくなります。これは、Queens リリースで Keystone から削除されました。

  • Cinder consistency group support in horizon will be dropped in Train release or later. It was deprecated in Pike release in Cinder and was superseded by the generic group feature. Horizon supports the generic group since Rocky release.

  • Volume v2 API support is now deprecated. The API has been marked as deprecated in cinder in favor of volume v3 API. Horizon will drop volume v2 API support in a same release where cinder drops it.

  • Glance v1 API のサポートは非推奨となり、早ければ Train リリースで削除される予定です。これは、 Rocky リリースで Glance から削除されています。

  • Nova-network support will be dropped in Train release completely. Horizon dropped nova-network floating IP and security gruop supports in Queens release, but we still supports operations on server instances created with nova-network. This deprecation means such support will be dropped in the near future and horizon will assume neutron is deployed.

  • Horizon で Keystone v2 API が非推奨となったことに対応して、SHOW_KEYSTONE_V2_RC 設定は非推奨となりました。


  • Fixed a bug where non-admin users would be shown the "Change Password" button for users listed under the Identity panel.

  • [bug 1544703] Add a new optional WEBSSO_KEYSTONE_URL property to facilitate WEBSSO deployments where network segmentation is used per security requirement. In this case, the controllers are not reachable from public network. Therefore, user's browser will not be able to access OPENSTACK_KEYSTONE_URL if it is set to the internal endpoint.