2026.2 Series Release Notes

4.20.0

New Features

  • When cache.auth is enabled, the unscoped credential of a federated authentication plugin is now kept in the keyring alongside the scoped token. A federated plugin obtains an unscoped token and then rescopes it, and that unscoped token can be rescoped again to any project, domain or system. Keeping it means one authentication serves every scope, so a single cloud entry can be used against several projects without authenticating again for each.

    This only applies to plugins that report the authentication as needing the user, such as the OpenID Connect authorization code and device authorization flows. Where a plugin can authenticate again on its own, the credential is not stored, since doing so would put a token in the keyring to no purpose.

  • Added CloudRegion.clear_auth_cache, which discards any authentication cached for a cloud. Both the copy kept in the keyring and the state held in memory by the plugin are dropped, so that a connection already built from the region cannot keep using the credential or write it back when it closes. The next authentication starts from scratch, which for an interactive plugin means asking the user again. Use it when the cached credential is known to be unusable, such as after it has been revoked or when a different account is wanted. It works whether or not cache.auth is currently enabled and whether or not a keyring is available: the in-memory state is dropped regardless, and a credential cached while caching was on can still be removed once it has been turned off.

4.19.0

New Features

  • Add subnet_onboard to SubnetPool resource and onboard_network_subnets to network._proxy.Proxy

  • The identity v3 User resource now supports the federated attribute and the unique_id, idp_id and protocol_id query filters (Keystone API microversion 3.14).

  • Added the ip_availability_details field to the network NetworkIPAvailability resource. This exposes the attribute added by the Neutron network-ip-availability-details extension, which reports the total and used IP counts of a network separately for the subnet CIDRs and for the subnet allocation pools.

  • Adds support for bare metal API microversion 1.112, which adds a description field and a traits field to runbooks. Runbook traits are managed through the new add_runbook_trait, remove_runbook_trait and set_runbook_traits proxy methods.

  • Add support for the Glance image-cache API GET /v2/cache/nodes/{image_id} (list node reference URLs where an image is cached when centralized caching is enabled). This adds the cached_image_nodes method on the image v2 proxy and image_nodes on the cache resource.

  • Added project_cleanup support for the load_balancer (Octavia) and key_manager (Barbican) services. Load balancers are cleaned up with cascade=True before compute and network resources. Barbican secrets and containers are cleaned up independently.

Bug Fixes

  • Fixed the Group resource in the block storage service to support the add_volumes and remove_volumes body attributes. Previously these attributes were not declared on the resource, so values passed to update_group were silently discarded and an empty update request was sent to the block storage service. Volumes can now be added to or removed from an existing group by passing a comma-separated list of volume IDs, for example:

    conn.block_storage.update_group(group, add_volumes='vol-1,vol-2')
conn.block_storage.update_group(group, remove_volumes='vol-3')

  • Accessing a service proxy attribute on a Connection (for example conn.block_storage) no longer raises EndpointNotFound at attribute-access time when the service is enabled in configuration but not present in the cloud’s service catalog. Instead a disabled-service shim is returned and ServiceDisabledException is raised if and when the proxy is actually used. This prevents callers that fetch proxies for services they may never use – such as python-openstackclient’s server create, which touches the block-storage proxy unconditionally – from failing on clouds that do not deploy that service. Connections created with strict_proxies=True retain the previous fail-fast behaviour.

  • Fixed the expected provision state for the bare metal adopt verb. Adoption moves a node from manageable to active, but the SDK expected available, so set_node_provision_state and Node.set_provision_state called with wait=True waited for a state that is never reached and eventually failed with a ResourceTimeout.

  • Fixed block_storage.get_group to forward the list_volume argument as a request query parameter. Previously it was dropped, so the server never returned the group’s volume IDs and callers (including the openstack volume group show --volumes command) always saw an empty result. Requires block storage microversion 3.25 or later.

  • Deleting a static large object (SLO) now correctly removes the underlying segment objects in addition to the manifest object. Previously the multipart-manifest=delete instruction was sent to swift as an HTTP header rather than a query string parameter, so it was ignored and the segments were left behind, which could in turn prevent the containing container from being deleted.

4.18.0

New Features

  • Add support for passing image size to Glance API during upload and stage operations.

    • Add size parameter to Image.upload() and Image.stage() methods

    • Add size parameter to Proxy.stage_image() method

    • Add get_file_size() utility function to calculate file size from file-like objects

    • Automatically calculate and pass size header when size is not provided but data is available

    • Pass size as X-OpenStack-Image-Size header to Glance API

    • Add comprehensive unit tests for size parameter functionality

    This change allows users to explicitly specify the size of image data being uploaded, which can improve performance and reliability of image uploads. When size is not provided, the SDK will automatically calculate it from file-like objects that support seek/tell operations.

4.17.0

New Features

    • Add ability to add the location to an existing image.

    • Add ability to get the locations associated to an image.

  • The SDK now implements a new feature from the Glance API and allows users to pass a list of preferred stored when downloading an image.

Bug Fixes

4.16.0

New Features

  • Add support for QoS spec actions and associations to the block storage service. The following proxy methods are now available for both v2 and v3:

    • associate_qos_spec

    • disassociate_qos_spec

    • disassociate_all_qos_spec

    • delete_qos_spec_metadata

    • qos_spec_associations

  • Add support for retrieving resource usages via the fetch_resource_provider_usages method on the Placement proxy and the fetch_usages method on the ResourceProvider resource class.

4.15.0

New Features

  • Added router_routes field to the network Quota, QuotaDefault and QuotaDetails resources. This exposes the new Neutron router_route per-project quota that controls the total number of extra routes across all routers in a project.

  • Adds support for Private VLAN (PVLAN) attributes to the networking service Users can now specify whether pvlan is enabled in a network, and set pvlan_type and pvlan_community properties in a port when managing these Neutron objects.

  • Added support to list services associated with the shared file system service.

  • Added support to list, get, create, update, and delete share network subnet metadata from shared file system service.

  • Added reset_status and force_delete methods to the Share and ShareSnapshot shared file system resources.

  • Added list, show, update, delete and create methods for Share Types to Shared File Systems service.

  • Added SDK resource ServerExternalEvents and proxy method create_server_external_events to send server external events to the Nova API (POST /os-server-external-events).

4.14.0

New Features

  • Add support for key manager quota API

  • Added support for key manager secret ACL operations.

  • Added support list, get, update, delete, and create to share transfers from share file system service.

Upgrade Notes

  • A number of proxy APIs used parameters with _id suffixes despite accepting resources instances. These have now been renamed to drop this suffix. Backwards-compatible shims have been provided but these will be removed in the next major release.

  • Support for Python 3.10 has been dropped. The minimum version of Python now supported in 3.11.

  • The following accelerator proxy API methods have been renamed:

    • update_accelerator_request (to patch_accelerator_request)

    • update_deployable (to patch_deployable)

    Backwards-compatible shims are provided for all methods, but these are deprecated and will be removed in the next major release.

  • The folllowing metadata-related proxy methods have been renamed:

    Block Storage (v2)

    • get_snapshot_metadata (to fetch_snapshot_metadata)

    • get_volume_metadata (to fetch_volume_metadata)

    Block Storage (v3)

    • get_backup_metadata (to fetch_backup_metadata)

    • get_snapshot_metadata (to fetch_snapshot_metadata)

    • get_volume_metadata (to fetch_volume_metadata)

    Clustering (v1)

    • get_cluster_metadata (to fetch_cluster_metadata)

    Compute (v2)

    • set_image_metadata (to fetch_image_metadata)

    • set_server_metadata (to fetch_server_metadata)

    Placement (v1)

    • get_resource_provider_aggregates (to fetch_resource_provider_aggregates)

    Shared File System (v2)

    • get_share_metadata (to fetch_share_metadata)

    • get_share_metadata_item (to fetch_share_metadata_item)

    • create_share_metadata (to set_share_metadata)

    • update_share_metadata (to set_share_metadata)

    Backwards-compatible shims are provided for all methods, but these are deprecated and will be removed in the next major release.

    In addition, the set_aggregate_metadata compute API proxy method now expects metadata to be provided as keyword arguments. A backwards compatible shim is also provided for this.

Deprecation Notes

  • The ignore_missing option provided to all find_* proxy methods has been deprecated for removal. This option, and its default value of True, has been the source of many bugs and its use is almost always unintentional. Users are requested to explicitly pass False and to catch the openstack.exceptions.NotFoundException if the ignore missing behavior was indeed intentional.

4.13.0

New Features

  • Add vip_sg_ids attribute to the load balancer resource, which contains a list of security group IDs for the VIP port.

Deprecation Notes

  • The openstack.version module and associated objects has been deprecated for removal. Prefer use of importlib.metadata to inspect version information for installed packages.

4.12.0

New Features

  • Add update_password method to the identity proxy to support user self-service password reset.

  • Added ha_chassis_priority attribute to the network Agent resource. This field is populated by the Neutron l3-agent-scheduler-ha-priority API extension and indicates the OVN HA_Chassis failover priority for each gateway chassis hosting a router. The value is None for non-OVN mechanism drivers.

  • Added update_router_in_agent method to the network proxy and the Agent resource. This allows updating properties (such as ha_chassis_priority) of a router already associated with an L3 agent, using a PUT request on the l3-agent-scheduler API.

Bug Fixes

  • Fixed the ZoneImport resource base_path from /zones/tasks/import to /zones/tasks/imports to match the Designate API endpoint.

4.11.0

New Features

  • The 2.97 API microversion is now supported for the compute service. This adds a new API to manage shares, represented by the openstack.compute.v2.server_share.ShareMapping resource.

Deprecation Notes

  • Support for reporting metrics to InfluxDB has been deprecated for removal. The implementation relied on an EOL Python library and only supported InfluxDB v1.

Bug Fixes

  • Fixed port binding activation and deletion methods to correctly pass the host parameter as a path parameter instead of in the request body. The Neutron API expects the host in the URL path for these endpoints:

    • PUT /v2.0/ports/{port_id}/bindings/{host}/activate

    • DELETE /v2.0/ports/{port_id}/bindings/{host}

    Previously, the SDK was incorrectly sending the host parameter in both the URL path and the request body, which caused a TypeError in Neutron. The methods now correctly pass only the host identifier as a positional parameter, matching the Neutron API specification.

    For more information see bug 2146296

  • Session.connect_retry_delay is now configurable via clouds.yaml using the <service type>_connect_retry_delay and connect_retry_delay options.