Current Series Release Notes¶

4.22.0-11¶

The SDK now checks client-side whether the selected API microversion meets a resource’s minimum requirements. If the version negotiated with the server or the configured default microversion is too low, the SDK raises the existing openstack.exceptions.NotSupported exception before sending the resource request, rather than relying on the server to reject it.

Adds the missing disable_ramdisk field to the bare metal Runbook resource. The bare metal service has accepted and returned this field since runbooks were introduced in API microversion 1.92.

find_domain can now resolve domains referenced by the cached authentication token when policy prevents listing domains. This allows non-admin users to resolve their user, project, or scoped domain without an additional API request. [bug 2145017]

Added openstack.key_manager.v1.secret.Secret.migrate_store and Proxy.migrate_secret_store to migrate an existing Barbican secret onto another secret store via path-based PUT /v1/secrets/{id}/secret-store/{secret-store-id} (key-manager microversion 1.3). The destination is a single required secret_store argument (UUID, URI, or SecretStore instance). Secret resources also expose computed secret_store_id and secret_store_ref from GET/list (may be null).

The block storage v3 proxy attachments API now supports a details parameter, allowing users to list volume attachments with or without additional details.

Fixed key-manager microversion negotiation against Barbican. Barbican’s unversioned discovery document never carries a microversion range (by design, for backward compatibility with pre-microversion clients), so openstack.utils.supports_microversion() / maximum_supported_microversion() could never detect support. Secret and SecretStore now negotiate via openstack.key_manager.v1._microversion, which probes discovery with an explicit OpenStack-API-Version header (the same workaround already used by python-barbicanclient).

Connection.connect_as() and Connection.connect_as_project() now use the project they are given when the parent connection was configured from OS_* environment variables. Since openstacksdk 2.0.0 the values of OS_PROJECT_ID and OS_PROJECT_NAME took precedence, so the new connection silently stayed scoped to the original project. Among other things this made openstack project cleanup --project <project> delete the resources of the project from the environment instead of the requested one. The same applies to domain_id/domain_name, token and passcode. Passing only one of project_id or project_name (and likewise for the domain, project domain and user domain) now also stops the other half of the pair from being inherited.

The status_code_retry_delay and retriable_status_codes options are now passed to the service adapter. Previously they were ignored, both in clouds.yaml and in oslo.config adapter options.

Add support for the Glance image-cache API POST /v2/cache/clean and POST /v2/cache/prune (clean invalid cache entries and prune cache size). This adds the clean_cache and prune_cache methods on the image v2 proxy and cache resource.

The precedence used when resolving statsd metrics configuration has changed. Values are now resolved in the following order, from highest to lowest priority: values passed explicitly (e.g. via the statsd_config argument), environment variables (STATSD_HOST, STATSD_PORT, STATSD_PREFIX) and finally the metrics.statsd section of clouds.yaml. Previously the configuration file took precedence over environment variables, which was inconsistent with how configuration is resolved elsewhere.

The statsd_host, statsd_port and statsd_prefix arguments of openstack.config.cloud_region.CloudRegion have been deprecated in favour of the new statsd_config argument, which accepts a single dict of statsd configuration. The legacy arguments continue to work but cannot be combined with statsd_config.

Remove incorrect TagMixin from Domain resource. The Keystone Identity API does not support tags on domains. [bug 2166512]

Connection no longer keeps itself alive for the lifetime of the process. Cleanup was registered with atexit.register(self.close), and because a bound method holds a strong reference to its instance, every Connection ever created stayed reachable from the atexit registry along with its keystoneauth1 session, that session’s urllib3 connection pools and their CA-loaded SSLContext objects. Applications that build a Connection per request, such as Horizon, grew by hundreds of kilobytes per request until the worker was restarted. Cleanup now uses weakref.finalize, which still runs at interpreter shutdown for connections that are still alive but does not prevent them from being garbage collected earlier.

Connection.close() now also releases the connection pool of the requests.Session held by the keystoneauth1 session. Previously the pooled (keep-alive) connections were only released when the keystoneauth1 session object was garbage collected, which could leave sockets open for the lifetime of the process. Externally supplied sessions are still left untouched.

The hw_boot_menu and os_require_quiesce image properties are now parsed as boolean strings, so a value of "false" is treated as False. These properties and hw_vif_multiqueue_enabled now interpret their values the same way as Nova: 1, t, true, on, y and yes (case-insensitively) are True, and any other value is False. An unrecognised value no longer raises an exception that prevents the image from loading. (bug 2169133)

Glance extra image properties such as hw_vif_multiqueue_enabled are returned as strings ("true" / "false"). The image resource now deserializes hw_vif_multiqueue_enabled with BoolStr so "false" is treated as False rather than True. (bug 1996033)

Added CloudRegion.clear_auth_cache, which discards any authentication cached for a cloud. Both the copy kept in the keyring and the state held in memory by the plugin are dropped, so that a connection already built from the region cannot keep using the credential or write it back when it closes. The next authentication starts from scratch, which for an interactive plugin means asking the user again. Use it when the cached credential is known to be unusable, such as after it has been revoked or when a different account is wanted. It works whether or not cache.auth is currently enabled and whether or not a keyring is available: the in-memory state is dropped regardless, and a credential cached while caching was on can still be removed once it has been turned off.