Current Series Release Notes¶

26.0.0-45¶

Adds a config option SHOW_RESOURCE_PROVIDER_SUMMARY so one can disable the hypervisor resource provider overview in admin section. This can be useful in an environment with a lot of hypervisor nodes to keep the page small and useful. Default is True to keep current behaviour and show this section.

Added a new URL endpoint /auth/switch_name/<project-name> to Horizon that can be used to switch to another project by name, if domain_id query parameter is set that domain ID is used otherwise the domain for the current project scoped token is used.

This is the same functionality as is already provided by the /auth/switch/<project-id> endpoint that only works with an project ID (UUID).

Horizon now enables oslo.policy’s enforce_scope and enforce_new_defaults by default. The explicit overrides that kept them disabled in Horizon have been removed.

Deployments that have not yet adopted the new RBAC defaults should review their policy configuration before upgrading, as policy enforcement behaviour will change with this release.

The default value of key_pairs_panel in the ANGULAR_FEATURES setting has been changed from True to False. The Key Pairs panel now uses the Python/Django implementation by default instead of the AngularJS version. The Python implementation includes feature parity improvements: expandable chevron rows for key pair metadata display, a server-generated key pair create form with private key download, and a public key import form.

If you need to temporarily revert to the AngularJS version, set ANGULAR_FEATURES['key_pairs_panel'] = True in your local settings. The AngularJS version will be removed in a future release.

The OPENSTACK_KEYSTONE_PREFER_DOMAIN_TOKEN option is now deprecated. Changing this option is known to break operations of some of the resources in keystone such as identity provider.

The AngularJS version of the Key Pairs panel is now deprecated. Set ANGULAR_FEATURES['key_pairs_panel'] = False (now the default) to use the Python/Django implementation. The AngularJS implementation will be removed in a future release as part of the broader de-angularization effort.

Bug 2163088: several pages serialized API data with json.dumps() and embedded the result in an inline <script> block through the safe template filter. json.dumps() does not escape <, > or &, so a resource named with a literal </script> closed the script element early and the rest of the name was parsed as markup, running in the session of any user viewing the page. Flavor names in the Resize Instance dialog, volume type names and descriptions in the Create Volume dialog, and metadata definition resource types are now escaped. Creating these resources normally requires an administrator.

Default value of the OPENSTACK_KEYSTONE_PREFER_DOMAIN_TOKEN option has been changed to False, to fix some operations rejected by keystone due to its policy rules not permitting domain-scope access.

Downloaded file names are now built with Django’s content_disposition_header() instead of being interpolated into the header by hand. Names holding non ASCII characters were placed in the header as raw UTF-8 bytes and read back as latin-1 by browsers, so a Swift object, a project or an application credential named in anything other than ASCII was saved under a mangled name. They are now encoded per RFC 5987. A double quote in such a name also used to open a second filename parameter, letting the name that browsers picked differ from the intended one.

Python 3.14 is now officially supported. The openstack-tox-py314 unit test job runs as a voting job in the check and gate pipelines.

Security Groups panel now exposes an Edit Rule action. Security group rules can be modified directly without manually deleting and recreating them.

Added changing instance password directly from the dashboard. This requires the QEMU Guest Agent to be installed and running inside the guest operating system.

[bug 2134580] Fixed an issue where calling /api/keystone/svc-catalog/ could mutate request.user.service_catalog and cause follow-up API calls to fail with horizon.exceptions.ServiceCatalogException: Invalid service catalog: image.