Current Series Release Notes

22.0.0.0rc1-110

New Features

  • Added HAProxy HTTP health checks for Prometheus Alertmanager using the /-/healthy endpoint. HAProxy now verifies HTTP 200 responses to improve backend health detection.

  • Add support for VAST cinder driver.

  • Added support for the VAST storage backend in Manila.

  • Add support to schema_version in the federated attribute mapping API of Keystone.

  • Added a new variable enable_cinder_backend_privileged to control whether the Glance API container runs in privileged mode and has /dev bind-mounted from the host.

    By default this option is set to true when enable_cinder_backend_iscsi, cinder_backend_ceph or enable_cinder_backend_vast are enabled, and to false otherwise. Operators can override it manually for other Cinder backends that rely on os-brick (e.g., PowerFlex/ScaleIO, FibreChannel).

  • Adds support for serving architecture-specific Ironic Python Agent images for mixed x86_64 and aarch64 iPXE deployments.

  • The nova_libvirt container’s libvirtd.conf now raises libvirt’s connection processing limits above their stock defaults, which are tuned for a multi-tenant host rather than for Kolla’s single-privileged-client pattern. max_client_requests is raised from 5 to 20 and max_workers from 20 to 50. Both are exposed as the libvirt_max_client_requests and libvirt_max_workers variables so they can be tuned further.

  • Adds support for managing Nova host aggregates and availability zones via Kolla Ansible inventory variables. Set nova_compute_availability_zone per compute host or group to assign it to an AZ-backed host aggregate. Set nova_compute_aggregates (a list) to assign a host to one or more arbitrary host aggregates. Aggregates are created if they do not exist, and host memberships are reconciled on every deploy/reconfigure run.

  • The nova_libvirt container now runs virtlogd as a sidecar alongside libvirtd, and qemu.conf is configured with stdio_handler = "logd" so that libvirt routes instance console chardevs through virtlogd. This allows guest console logs to be rotated according to /etc/libvirt/virtlogd.conf (by default 2MB per file with 3 backups), instead of growing without bound as they did when stdio_handler was set to "file".

    Note that existing instances must be hard rebooted to pick up the new console handler, as the chardev mode is fixed at qemu launch.

  • Add Alertmanager container healthcheck support.

  • Removed obsolete configuration options from the Horizon local_settings.py template:

    • TEMPLATE_DEBUG: No longer supported

    • enable_lb, enable_firewall, and enable_vpn: These keys inside OPENSTACK_NEUTRON_NETWORK are now invalid.

Upgrade Notes

  • CentOS Stream 10 support has been dropped.

  • Deployments using Cinder backends other than iSCSI, Ceph or VAST may need to explicitly set enable_cinder_backend_privileged: true in globals.yml to ensure image upload works correctly.

  • The NFS/Quobyte mount point base for nova-compute moved from /var/lib/nova/mnt to /var/lib/nova-mnt (the same path on the host and in the containers). /var/lib/nova-mnt is a plain directory created automatically on the host - no dedicated filesystem is required. Operators who mounted a dedicated filesystem at /var/lib/nova/mnt should mount it at the new path before reconfiguring.

    The change is non-disruptive: running instances (including NFS boot-from-volume ones) survive the container recreation and keep using the old, still-mounted path. They switch to the new path on live migration or hard reboot. Afterwards the leftover mounts under /var/lib/nova/mnt (and the duplicated mount entries accumulated due to the leak) can be unmounted; mounts still held by running instances refuse to unmount (EBUSY), so the cleanup is safe to attempt at any time.

  • Users are now required to prepare certificate file named proxysql-ca.pem at kolla_certificates_dir if ProxySQL and database internal TLS are enabled.

    This file can be a copy of root CA of database internal TLS if intermediate certificates are not used. This file needs to be the intermediate certificate that signed the leaf certificate if there a chain of certificates is used.

  • om_rabbitmq_qos_prefetch_count has been changed to 50.

  • Support for networking-infoblox, to use Infblox as neutron’s IPAM backend, has been removed. The networking-infoblox project is unmaintained.

  • The legacy upgrade method for Neutron has been removed in favour of the rolling upgrade which has been the default since Ocata. neutron_enable_rolling_upgrade should no longer be set.

  • Support for running the Neutron DHCP agent in ML2/OVN deployments (neutron_ovn_dhcp_agent) has been removed. OVN now natively answers DHCP queries for bare metal ports (port type external), so the agent is no longer needed. neutron_ovn_dhcp_agent should no longer be set.

  • The [redis:children] inventory group, redis_master_password password, and all Redis-to-Valkey migration code, which were kept for migration purposes since the Gazpacho (2026.1) release, have now been removed. Operators should remove redis_master_password from their passwords.yml file.

  • The default value of update_keystone_service_user_passwords has changed from true to false. Previously, service user passwords were updated on every reconfigure run, which invalidated existing Keystone tokens and could cause service disruptions. With the new default, passwords are only set at user creation time. Operators who wish to force password rotation on reconfigure must explicitly set update_keystone_service_user_passwords to true in globals.yml.

Bug Fixes

  • Fixes nova-compute failing to start after /var/lib/nova content has been wiped, for example following a reprovisioning. LP#2051011

  • Fixes overly restrictive permissions on certificates in /var/lib/kolla/share/ca-certificates path in containers that require access to these certificates.

  • Fixed a stray trailing quote in the barbican_api healthcheck command that caused containers to be falsely reported as unhealthy. LP#2157639

  • Fixed instance snapshot hanging indefinitely. LP#2158974

  • Fixed VPN traffic forwarding in OVN VPNaaS deployments. LP#2160208

  • This resolves an issue in Glance multinode deployments with internal TLS enabled. Some concurrent image operations, such as deleting an image while it is actively uploading or staging, could fail with an HTTP 500 Internal Server Error. LP#2160218

  • Fixes OpenSearch 503 errors on Create OpenSearch Dashboards Index Pattern task during service upgrade. LP#2161333

  • Fixes service-to-service authentication between Cinder and Glance. This resolves HTTP 403 Forbidden errors during fetch_image_location and restores fast volume cloning (Copy-on-Write) for backends like RBD, preventing an unnecessary fallback to slow image downloads. LP#2161971

  • Fixes cinder external Ceph configuration tasks failing when enable_cinder_backup is disabled but cinder_backup_driver remains set to ceph. The cinder role no longer evaluates cinder_backup_ceph_backend for external Ceph config and keyring loops unless cinder-backup is enabled. LP#2148771

  • Fixes the Ironic temp directory causing invalid cross device links when deploying baremetal images using the virtualmedia boot interface.

  • Fixes an issue in the Docker container worker where reconfiguring containers with cpuset_cpus or cpuset_mems dimensions could fail with an IndexError when the existing container had no explicit cpuset constraint configured.

  • Fernet key distribution is now delegated to a host in the correct group when run on existing deployments. LP#2163158

  • Fixes Prometheus blackbox exporter checks for Grafana when external Grafana access is disabled. The public Grafana endpoint is now only monitored when enable_grafana_external is enabled, while the internal endpoint continues to be monitored when appropriate.

  • Fixes kolla-ansible prechecks (and deploy/reconfigure) failing with 'cinder_enabled_backends' is undefined in the iscsi role when a Cinder iSCSI/LVM backend is enabled. The cinder_enabled_backends and related backend variables are now defined in group_vars/all so that they are in scope for the iscsi role, whose play runs before the cinder play. LP#2158120

  • Fixes an issue where mount points would leak from Nova containers when using the Cinder NFS backend. LP#1783978

  • Fixes the OIDCXForwardedHeaders directive in the Keystone Apache configuration. The value was previously wrapped in double quotes, which caused Apache to treat the whole list as a single argument and prevented configuring more than one forwarded header. See LP#2155147.

  • Fixes bug LP#2150449 where ProxySQL’s database internal TLS fails when users use chain of certificates (e.g. use of intermediate certificates).

    Users are now required to prepare certificate file named proxysql-ca.pem at kolla_certificates_dir if ProxySQL and database internal TLS are enabled.

    This file can be a copy of root CA of database internal TLS if intermediate certificates are not used. This file needs to be the intermediate certificate that signed the leaf certificate if there a chain of certificates is used.

  • Fixes deployment of Valkey service containers, which was different to other services. LP#2161716

  • Fixed intermittent instance build failures (Cannot recv data: Input/output error during defineXML, leading to instances in ERROR state) that occurred when several instances were built concurrently. nova-compute is effectively the sole client of libvirtd, and libvirt’s default per-client request cap of 5 was being exceeded by concurrent builds plus periodic tasks, starving keepalive responses until libvirtd dropped the connection.

Other Notes

  • This release exposes additional configuration options for OpenStack Compute consoles which utilize the SPICE protocol. You can now require that such consoles use channels secured by TLS using the nova_spice_require_secure configuration option. This option defaults to false as it implies that TLS certificates have been distributed to your nova-compute nodes.