Current Series Release Notes¶

9.0.0.0rc1-16¶

Add messaging: zaqar into service_mapping of skyline config. So that we will generate zaqar related endpoint into nginx file.

Add zaqar related policies. So that we provide policies of zaqar to skyline-console.

Users holding role assignments on a Keystone domain (the domain manager persona introduced with the Keystone 2024.2 default policies) now get a domain-scoped token at login, next to the project-scoped one. The profile exposes it as domain_scope_token together with domain and domain_roles; it is kept across switch_project/switch_region and revoked at logout. /policies and /policies/check evaluate the Keystone rules a second time with the domain scope, so the console can offer the identity self-service (users, groups, projects and role assignments of the user’s own domain) that Keystone allows. The new option openstack.domain_manager_roles (default ["manager"]) is exposed by /config.

Adds the sso_identity_providers configuration option. When set, the /sso endpoint returns one entry per configured identity provider, each pointing directly at its Keystone federation URL and carrying a label for display. Previously a single generic entry per protocol was returned, which left the identity provider selection to the federation endpoint. When the option is unset, the previous behaviour is preserved.

The bundled Keystone policy rules (policy/manager/keystone.py) were regenerated from Keystone 2026.1; they now include the manager role clauses of the domain manager persona.

Fixed image filters being ignored when listing images. Filters were passed to the OpenStack SDK nested under a filters key, but the SDK expects query parameters as direct arguments and silently drops unknown ones. As a result the identifier filter had no effect and every request listed all images visible to the service user instead of only those needed. Errors returned while listing images are now reported with the intended status code as well, instead of escaping the error handling because the results were fetched lazily. LP#2165992

Fixed the Glance client querying the wrong region. The endpoint resolved from the service catalog was passed to the OpenStack SDK connection as endpoint, which is not a valid parameter and was silently discarded. Since no region was given either, the SDK resolved the image endpoint on its own and could pick a different region than the one requested. In multi-region deployments this made the instance list show an empty image name and the generic operating system icon for every instance, because the image lookup returned nothing while the request still succeeded. LP#2165992

Fixed proxied OpenStack API calls failing with 426 Upgrade Required. The generated nginx reverse-proxy configuration did not set proxy_http_version, so nginx forwarded upstream requests using HTTP/1.0. Service front-ends that require HTTP/1.1 (for example an Apache httpd fronting Keystone) reject HTTP/1.0 requests with a 426 Upgrade Required response. This broke every request Skyline proxies to the OpenStack services, including Keystone role and project lookups, so functionality such as switching projects stopped working. The per-endpoint proxy blocks now set proxy_http_version 1.1.

The /sso endpoint now omits null label fields from its response, avoiding blank SSO option names when older UIs spread the API payload over computed labels.

The migration that adds primary keys to revoked_token and settings no longer fails with Multiple primary key defined on databases where a primary key was added by hand to work around bug 2108940 on Galera or Percona XtraDB Cluster. A table that already has a primary key is left as it is.

Documented sso_identity_providers in the settings reference, including the example format and that sso_protocols is ignored when identity providers are configured.

Added the default.secure_proxy_addr_header configuration option. When configured, Skyline uses the trusted header’s single sanitized client address for the Forwarded header on server-side OpenStack API requests. Otherwise, Skyline uses the direct ASGI peer address.

Deployments must configure their proxy to overwrite and sanitize this header. The option takes an HTTP header name such as X-Real-IP. Skyline does not resolve or forward a full X-Forwarded-For chain. See LP#2162817.