2026.2 Series Release Notes¶

9.0.0.0rc1-6¶

Adds the sso_identity_providers configuration option. When set, the /sso endpoint returns one entry per configured identity provider, each pointing directly at its Keystone federation URL and carrying a label for display. Previously a single generic entry per protocol was returned, which left the identity provider selection to the federation endpoint. When the option is unset, the previous behaviour is preserved.

Fixed image filters being ignored when listing images. Filters were passed to the OpenStack SDK nested under a filters key, but the SDK expects query parameters as direct arguments and silently drops unknown ones. As a result the identifier filter had no effect and every request listed all images visible to the service user instead of only those needed. Errors returned while listing images are now reported with the intended status code as well, instead of escaping the error handling because the results were fetched lazily. LP#2165992

Fixed the Glance client querying the wrong region. The endpoint resolved from the service catalog was passed to the OpenStack SDK connection as endpoint, which is not a valid parameter and was silently discarded. Since no region was given either, the SDK resolved the image endpoint on its own and could pick a different region than the one requested. In multi-region deployments this made the instance list show an empty image name and the generic operating system icon for every instance, because the image lookup returned nothing while the request still succeeded. LP#2165992

Add TOTP (Time-based One-Time Password) two-factor authentication API support. The API server now detects when TOTP is required during login and provides a /login/totp endpoint to complete the second authentication step with a TOTP passcode.

Added the default.secure_proxy_addr_header configuration option. When configured, Skyline uses the trusted header’s single sanitized client address for the Forwarded header on server-side OpenStack API requests. Otherwise, Skyline uses the direct ASGI peer address.

Deployments must configure their proxy to overwrite and sanitize this header. The option takes an HTTP header name such as X-Real-IP. Skyline does not resolve or forward a full X-Forwarded-For chain. See LP#2162817.

Fixed the Skyline database schema for the revoked_token and settings tables by adding explicit primary keys through an Alembic migration. This restores compatibility with MySQL and Percona deployments that enforce primary-key requirements for DML. LP#2108940

Fixed handling of orphaned projects in resource listings. When a project is deleted but resources (snapshots, volumes, etc.) still exist, the API raised a KeyError when trying to resolve the project name. This fix uses .get() with project_id as fallback instead of direct dictionary access, preventing API errors when viewing resources from deleted projects. LP#2153555