Current Series Release Notes¶

9.0.0.0rc1-7¶

Adds the sso_identity_providers configuration option. When set, the /sso endpoint returns one entry per configured identity provider, each pointing directly at its Keystone federation URL and carrying a label for display. Previously a single generic entry per protocol was returned, which left the identity provider selection to the federation endpoint. When the option is unset, the previous behaviour is preserved.

Fixed image filters being ignored when listing images. Filters were passed to the OpenStack SDK nested under a filters key, but the SDK expects query parameters as direct arguments and silently drops unknown ones. As a result the identifier filter had no effect and every request listed all images visible to the service user instead of only those needed. Errors returned while listing images are now reported with the intended status code as well, instead of escaping the error handling because the results were fetched lazily. LP#2165992

Fixed the Glance client querying the wrong region. The endpoint resolved from the service catalog was passed to the OpenStack SDK connection as endpoint, which is not a valid parameter and was silently discarded. Since no region was given either, the SDK resolved the image endpoint on its own and could pick a different region than the one requested. In multi-region deployments this made the instance list show an empty image name and the generic operating system icon for every instance, because the image lookup returned nothing while the request still succeeded. LP#2165992

The /sso endpoint now omits null label fields from its response, avoiding blank SSO option names when older UIs spread the API payload over computed labels.

Documented sso_identity_providers in the settings reference, including the example format and that sso_protocols is ignored when identity providers are configured.

Added the default.secure_proxy_addr_header configuration option. When configured, Skyline uses the trusted header’s single sanitized client address for the Forwarded header on server-side OpenStack API requests. Otherwise, Skyline uses the direct ASGI peer address.

Deployments must configure their proxy to overwrite and sanitize this header. The option takes an HTTP header name such as X-Real-IP. Skyline does not resolve or forward a full X-Forwarded-For chain. See LP#2162817.