Current Series Release Notes

5.0.0

New Features

  • The new floating-ip-router-writable extension API definition has been added as neutron_lib.api.definitions.floatingip_router_writable. The extension makes the floating IP router_id attribute writable on create and update so callers can explicitly select the hosting router for NAT. When router_id is omitted, Neutron continues to compute it using the existing direct-connectivity logic. Plugins supporting the new extension are expected to also support the core L3 router extension.

Upgrade Notes

  • The deprecated [oslo_policy] enforce_scope configuration option has been removed in oslo.policy version 6.0.0 which will impact Neutron as there is no longer any way to disable RBAC policy scope enforcement; scope checks are now always enforced regardless of configuration.

    If you are not upgrading the oslo.policy to 6.0.0, then there will not be any change in scope enforcement behaviour.

Bug Fixes

  • Several API attributes were not declared as nullable, although Neutron returns null for them. Their validators now accept None, so that tooling generating schemas from the attribute maps (such as OpenAPI specifications) no longer rejects real Neutron responses:

    • ipv4_address_scope and ipv6_address_scope of the network resource use type:string_or_none. They are null when the network is not associated with any address scope.

    • ipv6_ra_mode and ipv6_address_mode of the subnet resource accept None in addition to constants.IPV6_MODES. They are always null for IPv4 subnets.

    • resource_request of the port resource uses type:dict_or_none. This read-only attribute is null unless the port requests Placement resources.

    • binding:vif_details of the port resource and vif_details of the port binding sub-resource use type:dict_or_none.

  • The mac_address provided when creating or updating a port is now sanitized to the canonical xx:xx:xx:xx:xx:xx format when the port-mac-address-regenerate extension is enabled. Previously that extension overrode the base port converter with convert_to_mac_if_none, which returned the provided MAC address verbatim, so the API did not enforce the canonical format on that path. Both paths now behave consistently.

  • Added is_filter to all scalar DB-backed attributes in the VPN API definitions (vpnservices, ipsec_site_connections, ipsecpolicies, ikepolicies, endpoint_groups, and the vpn-flavors, vpn-no-sha1-3des, vpn-aes-ctr extensions). Previously, no VPN attribute was declared as filterable, which caused list operations with query filters (e.g. ?name=foo) to return HTTP 400. This also broke openstack vpn service show <name> because the client falls back to filtering by name when the initial UUID-based lookup returns 404.

4.1.0

New Features

  • Extend the L2AgentExtension API with a new optional method: handle_switch_restart(). This is needed if an agent extension needs (partial) re-initialization when the switch managed by the agent is restarted. If your agent extension is not affected, there is nothing to do.

  • Introduced the following constrants to the neutron_lib.constants module, which can be used to define the desired setprotitle behavior of neutron_lib.worker.BaseWorker .

    • SETPROCTITLE_ON

    • SETPROCTITLE_OFF

    • SETPROCTITLE_BRIEF

4.0.0

New Features

  • Add the security-groups-default-statefulness API extension definition in neutron_lib.api.definitions.security_groups_default_statefulness. This extension introduces a top-level resource at /security-groups-default-statefulness that allows configuring the default value of the stateful attribute for new security groups, on a per-project or system-wide basis.

  • Added context_if_transaction and safe_creation helper functions to neutron_lib.db.utils. These were previously in neutron.db._utils and are now available for all networking projects to consume from neutron-lib.

Upgrade Notes

  • The fip64 API definition and documentation have been removed. This extension was only used by networking-midonet, which is no longer maintained. The API definition module neutron_lib.api.definitions.fip64, its unit test, and the corresponding api-ref documentation have all been deleted.

  • The logging-resource API definition and documentation have been removed. This extension was only used by networking-midonet, which is no longer maintained. The API definition module neutron_lib.api.definitions.logging_resource, its unit test, and the corresponding api-ref documentation (logging_resource.inc, firewall_log.inc, and related sample files) have all been deleted.

  • The router-interface-fip API definition and documentation have been removed. This extension was only used by networking-midonet, which is no longer maintained. The API definition module neutron_lib.api.definitions.router_interface_fip, its unit test, and the corresponding api-ref documentation have all been deleted.

  • In version 3.16.0 of neutron-lib, in the 2025.1 release cycle, the tenant_id argument in the ContextBase class was marked deprecated, and a warning was printed if it was used. That argument is now removed, callers should be using project_id instead when accessing the contents of a context object, for example context.project_id.

Bug Fixes

  • Added is_filter and is_sort_key to the attributes of the SFC API definitions for port_pairs, port_pair_groups and port_chains.

  • neutron_lib.worker.BaseWorker.start now passes self (the worker instance) as the trigger argument when publishing the PROCESS/AFTER_INIT registry event, instead of the start method reference. This allows registry callbacks to identify the concrete worker class that triggered the event (e.g. WorkerService vs MaintenanceWorker) and act accordingly.

Other Notes

  • Clarified the contract for MechanismDriver.check_vlan_transparency() and MechanismDriver.check_vlan_qinq() in neutron_lib.plugins.ml2.api. Each method may return True (explicit support), False (explicit non-support), or None (abstain / no opinion). Neutron’s ML2 plugin aggregates driver responses and accepts the capability only when at least one driver returns True and none return False. This is a documentation-only clarification; default base behavior remains abstention.

3.25.0

New Features

  • Added the l3-agent-scheduler-ha-chassis-priority API extension definition. This extension adds an ha_chassis_priority attribute to the agent resource in the L3 Agent Scheduler API, exposing the OVN HA_Chassis priority that determines gateway failover ordering. The attribute is readable (GET), optionally settable when scheduling a router to a chassis (POST), and updatable for an existing chassis assignment (PUT).

  • New extension pvlan: Adds support for Private VLANs (PVLANs), enabling a new way of port isolation within a shared VLAN. With PVLAN, users can define networks that allow selective communication between ports using modes such as promiscuous, isolated, and community. The extension introduces new port and network attributes: pvlan_type, pvlan_community, and pvlan.

Upgrade Notes

  • Now all service plugins, inheriting from ServicePluginBase class, will have the extension “filter-validation” enabled by default. That enforces the API filter validation in the queries, returning a HTTPBadRequest in case of using an invalid attribute. This extension can be enabled or disabled using the Neutron configuration variable [DEFAULT]filter_validation.

Deprecation Notes

  • A new method was added to the TypeDriver and ML2TypeDriver API classes called allocate_project_segment. It take the same arguments as allocate_tenant_segment just uses a different name. By default, it calls the allocate_tenant_segment method to avoid any compatibility issues, but callers are expected to change to the new method, after which allocate_tenant_segment will be deprecated.

Bug Fixes

  • Fixed API reference documentation for port binding activation and deletion endpoints. The host parameter is now correctly documented as a path parameter instead of a body parameter for the following endpoints:

    • PUT /v2.0/ports/{port_id}/bindings/{host}/activate

    • DELETE /v2.0/ports/{port_id}/bindings/{host}

    This fixes the issue where clients (like openstacksdk) were incorrectly sending the host parameter in both the path and the body, causing a TypeError. For more information see bug 2146294

Other Notes

  • API policy rules SERVICE, ADMIN, PROJECT_MANAGER, PROJECT_MEMBER, PROJECT_READER, ADMIN_OR_SERVICE, ADMIN_OR_PROJECT_MANAGER, ADMIN_OR_PROJECT_MEMBER, ADMIN_OR_PROJECT_READER, RULE_PARENT_OWNER, PARENT_OWNER_MANAGER, PARENT_OWNER_MEMBER, PARENT_OWNER_READER, ADMIN_OR_PARENT_OWNER_MANAGER, ADMIN_OR_PARENT_OWNER_MEMBER, ADMIN_OR_PARENT_OWNER_READER are moved from neutron.conf.policy.base module to neutron_lib and are now available in neutron_lib.policy.rules module.