Current Series Release Notes

18.2.0-1

New Features

  • Added OpenTelemetry distributed tracing support for RPC calls. When enabled, producer spans are created for call() and cast() on the client side, and consumer spans are created on the server side during message dispatch. Trace context is propagated across services via the W3C traceparent header carried inside the message context, allowing full end-to-end trace correlation from HTTP request through RabbitMQ to the RPC backend. The feature is disabled by default and can be enabled with:

    [oslo_messaging_tracing]
tracing_enabled = true
tracing_service_name = nova
otel_exporter_otlp_endpoint = http://localhost:4318
otlp_protocol = http/protobuf

    The OTLP transport protocol can be set to http/protobuf (default) or grpc. The corresponding exporter package must be installed:

    pip install oslo.messaging[tracing-http]   # for HTTP/protobuf
pip install oslo.messaging[tracing-grpc]   # for gRPC

18.2.0

Upgrade Notes

  • The RabbitMQ driver now enforces verification of the broker hostnames when ssl_ca_file is set and transport_url contanims muleiple RabbitMQ servers. The [oslo_messaging_rabbit] oslo_messaging_rabbit has no effect now.

18.1.0

Deprecation Notes

  • The oslo_messaging.version module and associated objects has been deprecated for removal. Prefer use of importlib.metadata to inspect version information for installed packages.

Security Issues

  • Under TLS with ssl_ca_file, oslo.messaging validated the broker certificate chain but did not verify the RabbitMQ broker hostname. A man-in-the-middle attacker with a certificate trusted by that CA could impersonate the broker.

    The RabbitMQ driver now verifies the broker hostname when ssl_ca_file is set and [oslo_messaging_rabbit] ssl_enforce_hostname_verification is enabled. Using ssl=true without ssl_ca_file still does not verify the broker hostname.

    The ssl_enforce_hostname_verification option is deprecated and scheduled for removal after deployments finish migrating; hostname verification should remain enabled.

    For transport URLs with multiple brokers and hostname verification enabled, Kombu 5.2.0 or newer substitutes the active broker hostname for TLS. Older Kombu versions log a warning and use the first configured broker hostname as a best effort; operators should upgrade Kombu or use a certificate (SAN or wildcard) that covers all configured broker hostnames.

18.0.0

Upgrade Notes

  • The deprecated heartbeat_in_pthread option in the [oslo_messaging_rabbit] section has been removed. Operators should remove this option from their configuration files.