Stein Series Release Notes¶
An open redirect has been fixed, that could redirect users to arbitrary addresses from certain views by specifying a “next” parameter in the URL. Now the redirect will only work if the target URL is in the same domain, and uses the same protocol.
pyScss 1.3.7 is now required due to the incompatibility that pyScss 1.3.4 used before in horizon does not work with setuptools 46.
Along with the upgrade of pyScss to 1.3.7, a workaround for the material design theme is added to make it work properly. See [bug:1771559] for detail.
publicize_imagepolicy now has the same name both for image create and edit features and corresponds to the same one in Glance. If you changed the policy name manually to get feature working you have to rollback your changes before Horizon update.
image:publicize_imagepolicy is renamed to
publicize_imageto be the same as Glance has.
[bug:1840465] Fixed a bug where listing security groups did not work if one or more security groups had no rules in them.
>=4.0.1is now required to fix bug:1824017. Cinder API 3.55 or later does not accept additional properties but python-cinderclient older than 4.0.0 sends additional properties like used_id, status and so on. Horizon uses Cinder API 3.58 to create a volume, and this means the volume creation fails if python-cinderclient <4.0.0 is used. To handle this, the minimum requirement of python-cinderclient was bumped to 4.0.1.
Add “Create Router” button to Admin/Network/Routers panel.
With the fixes in Rocky that allow using Django’s recursive template inheritance we have added new blocks in our
base.htmltemplate to allow a better means of customizing through your themes. For details see the
[blueprint:mitigate-breach-attacks] Adding Django-debreach module to mitigate breach attacks. Enabling the RandomCommentMiddleware to counter breach attack by randomising the content length of each response.
[blueprint neutron-rbac-policies] This blueprint adds RBAC policies panel to the Admin Network group. This panel will be enabled by default when the RBAC extension is enabled. Remove this panel by setting “‘enable_rbac_policy’: False” in ‘local_settings.py’. RBAC policy supports the control of two resources: networks and qos policies, because qos policies is an extension function of neutron, need to enable this extension if wants to use it.
[blueprint:instance-rescue-horizon-support] Support instance rescue feature
[bug:1785263] Modify the project detail view in a multi tabbed view, composed of:
Overviewtab displaying general information about the project.
Userstab displaying all users which have roles on the project (and their roles on it), including users which have roles on the project through their membership to a group.
Grouptab displaying all groups which have roles on the project (and their roles on it).
[bug:1792524] Modify the user detail view in a multi tabbed view, composed of:
Overviewtab displaying general information about the user.
Roles assignmentstab displaying all the roles that the users have on project or domain, directly or through their membership to a group. When the role comes from a membership to a group this will be indicated into the role column.
Groupstab displaying all groups where the user is a membership to.
[blueprint:cinder-generic-volume-groups] Cinder generic groups is now supported for admin panel. Admin is now able to view all groups and group snapshots for differenet users. Also group-type and group-type-spec support added to admin panel. Admin is able to create group-type and group-type-spec now.
True) that allows the user session expiry to be refreshed for every request until the token itself expires.
SESSION_TIMEOUTacts as an idle timeout value now.
Added a new
hide_create_volumesetting under the
LAUNCH_INSTANCE_DEFAULTSdict. This allows you to hide the “Create New Volume” option in the “Launch Instance” form and instead rely on the default value you select with
create_volumeis the best suitable option for your users.
[bug:1795851] Operators now can control whether the links of “Download OpenRC” and “Download clouds.yaml” are displayed or not via new settings
clouds.yamlfiles provided by horizon now assume the basic simple deployment and do not cover keystone authentication like saml2, openid and so on. The default
clouds.yamlfrom horizon do not make sense for such environments.
Custom templates for
openrcfiles can be configured now via
OPENRC_CUSTOM_TEMPLATEsettings. For more detail, see the Settings Reference.
ADD_TEMPLATE_DIRSsetting is also added so that operators can place custom templates for
clouds.yamlat deployment-specific paths.
Added an upgrade_check management command, that checks the configuration files for any settings that may potentially be problematic in the next version. The command is available as
Adds the possibility to redirect the login to an identity provider by default. For that purpose the following variables have been added,
To allow certain views to optionally disable analytics tracking when handling sensitive data, don’t use the
custom_head_jsblock, or the now deprecated template
horizon/_custom_head_js.htmlfor analytics tracking. Please read the
customizingdocs and instead use the dedicated
custom_analyticsblock so Horizon or its plugins can when needed disable tracking on a given view.
PKI token support has been dropped from horizon. PKI token was removed from keystone in Ocata release which was released two years ago. It is a good timing to drop its support.
OPENSTACK_TOKEN_HASH_ALGORITHMsetting was removed because it was used only for PKI token check. Unless you use PKI token before upgrading, there is no affect and you can safely drop it from your local_settings.py.
SESSION_TIMEOUTnow by default acts as an idle timeout rather than a hard timeout limit. If you wish to retain the old hard timeout functionality set
policy.json files for Cinder, Keystone Neutron and Nova are generated according to Policy file maintenance. Keystone changes to policy rules <https://docs.openstack.org/releasenotes/keystone/stein.html#prelude>__, are not compatible with the Horizon so we keystone_policy.json is not updated. Please, be sure that new Keystone policies are compatible with your deployment before syncing them.
The default value of
SESSION_ENGINEis changed to
django.contrib.sessions.backends.cacheso that a cache-based session backend is used.
The default cache back-end is set to the memcached backend
django.core.cache.backends.memcached.MemcachedCachefrom the local-memory backend considering multi-process web server deployments.
They are settings which horizon recommends for a long time but we have not use them by default.
If your deployment uses the signed-cookies as a session engine, ensure that
SESSION_ENGINEis configured to
django.contrib.sessions.backends.signed_cookiesbefore upgrading horizon to Stein release. If your deployment uses the cached session engine and your cache backend depends on horizon default setting, ensure to
CACHESsetting to use the local-memory backend.
The default value of
SHOW_KEYSTONE_V2_RCsetting is changed to
Falsein favor of the deprecation of keystone v2 API support in horizon.
The customization override templates have been deprecated in favor of using recursive inheritance in your themes. The following templates have been deprecated and are slated for removal in the U release: *
Keystone v2 API support in horizon will be dropped in Train release. It was was removed from keystone in Queens release.
Cinder consistency group support in horizon will be dropped in Train release or later. It was deprecated in Pike release in Cinder and was superseded by the generic group feature. Horizon supports the generic group since Rocky release.
Volume v2 API support is now deprecated. The API has been marked as deprecated in cinder in favor of volume v3 API. Horizon will drop volume v2 API support in a same release where cinder drops it.
Glance v1 API support is now deprecated and will be dropped in Train release at earliest. It was removed from glance in Rokcy release.
Nova-network support will be dropped in Train release completely. Horizon dropped nova-network floating IP and security gruop supports in Queens release, but we still supports operations on server instances created with nova-network. This deprecation means such support will be dropped in the near future and horizon will assume neutron is deployed.
SHOW_KEYSTONE_V2_RCsetting is deprecated in favor of the deprecation of keystone v2 API support in horizon.
Fixed a bug where non-admin users would be shown the “Change Password” button for users listed under the Identity panel.
[bug:1544703] Add a new optional WEBSSO_KEYSTONE_URL property to facilitate WEBSSO deployments where network segmentation is used per security requirement. In this case, the controllers are not reachable from public network. Therefore, user’s browser will not be able to access OPENSTACK_KEYSTONE_URL if it is set to the internal endpoint.