Ussuri Series Release Notes


Security Issues

  • An open redirect has been fixed, that could redirect users to arbitrary addresses from certain views by specifying a “next” parameter in the URL. Now the redirect will only work if the target URL is in the same domain, and uses the same protocol.


New Features

  • Added support for Keystone locking user option. Locked user can’t change own password using the self-service password change API. By default, users are unlocked and can change their own passwords. In case of older Keystone not supporting this feature, all users treated as unlocked.

  • Adds options to gui to allow user to select which storage policy container will use and displays the container’s storage policy in the container information.

Deprecation Notes

  • The legacy way to retrive neutron resource usages is deprecated. In future, horizon will require quota_details neutron extension. In the legacy way, horizon list all related resources to count resource usage. It is not efficient and quota_details neutron extension was added to address it. It was implemented in Pike release and the enough migration period has passed, so we deprecate the legacy way.


New Features

  • Introduced a new DEFAULT_BOOT_SOURCE config option to allow operators to configure a default instance boot source.


New Features

  • Added support to retrieve supported disk formats from glance, so you can adjust disk_formats only inside glance-api.conf. You still can use IMAGE_BACKEND_SETTINGS to adjust format naming.

Upgrade Notes

  • Django 1.11 support was dropped. Django 1.11 ends its extended support in April 2020 which is before Ussuri release. Considering this, horizon dropped Django 1.11 support and use Django 2.2 as default.

  • Python 2.7 support has been dropped. Last release of horizon to support python 2.7 is OpenStack Train. The minimum version of Python now supported by horizon is Python 3.6.

Deprecation Notes

  • OPENSTACK_NOVA_EXTENSIONS_BLACKLIST option is deprecated. All of the nova API extensions have been mainlined several releases ago and there is no potential performance issue in the nova API. This option is used only to toggle features in horizon and there seems no performance issues controlled by the option in horizon. Considering this situation, this option is deprecated now.


New Features

  • Adds support for access rules for application credentials. Fine-grained restrictions can now be applied to application credentials by supplying a list of access rules upon creation. See the keystone documentation for more information.

Bug Fixes

  • The missing nova’s os-aggregates policy rules are added to the dashboard.

  • The missing nova’s os-flavors policy rules are added to the dashboard.

Other Notes

  • The default OPENSTACK_KEYSTONE_URL value has been changed to "http://%s/identity/v3" % OPENSTACK_HOST from "http://%s:5000/v3" % OPENSTACK_HOST.


Upgrade Notes

  • Glance API V1 support has been dropped in Ussuri release. Glance V1 API support was deprecated in Stein release.

  • enable_quotas in OPENSTACK_NEUTRON_NETWORK is now enabled by default. Neutron provides the quotas API for long and most horizon deployments are expected to enable this, so the feature is enabled by default. If your deployment disables the neutron quotas support, make sure to set this value to False.

Other Notes

  • The default values of the settings listed in in past releases have been moved to openstack_dashboard/ By doing this, horizon can now provide the definitions of the default settings more explicitly. For the available settings, see openstack_dashboard/ and the horizon setting reference found at

    Note that Django related settings and HORIZON_CONFIG still exist in in this release and they will be revisited in upcoming releases.