============================
Wallaby Series Release Notes
============================

.. _Release Notes_23.2.2-32_wallaby-eom:

23.2.2-32
=========

.. _Release Notes_23.2.2-32_wallaby-eom_Upgrade Notes:

Upgrade Notes
-------------

.. releasenotes/notes/service-user-token-421d067c16257782.yaml @ b'5b4cb92aa8adab2bd3d7905e0b76eceab680ab28'

- Configuration of service user tokens is now **required** for all Nova services
  to ensure security of block-storage volume data.

  All Nova configuration files must configure the ``[service_user]`` section as
  described in the `documentation`__.

  See https://bugs.launchpad.net/nova/+bug/2004555 for more details.

  __ https://docs.openstack.org/nova/latest/admin/configuration/service-user-token.html


.. _Release Notes_23.2.2-32_wallaby-eom_Security Issues:

Security Issues
---------------

.. releasenotes/notes/libvirt-delegate-ovs-plugging-to-os-vif-6adc0398a0e0df58.yaml @ b'23a4b27dc0c156ad6cbe5260d518da3fd62294b8'

- In this release OVS port creation has been delegated to os-vif when the
  ``noop`` or ``openvswitch`` security group firewall drivers are
  enabled in Neutron. Those options, and others that disable the
  ``hybrid_plug`` mechanism, will now use os-vif instead of libvirt to plug
  VIFs into the bridge.  By delegating port plugging to os-vif we can use the
  ``isolate_vif`` config option to ensure VIFs are plugged securely preventing
  guests from accessing other tenants' networks before the neutron ovs agent
  can wire up the port. See `bug #1734320`_ for details.
  Note that OVN, ODL and other SDN solutions also use
  ``hybrid_plug=false`` but they are not known to be affected by the security
  issue caused by the previous behavior. As such the ``isolate_vif``
  os-vif config option is only used when deploying with ml2/ovs.


.. _Release Notes_23.2.2-32_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1829479-cd2db21526965e6d.yaml @ b'783598eec147223f41cc31e3488119bf0aeed656'

- `Bug #1829479 <https://bugs.launchpad.net/nova/+bug/1829479>`_: Now
  deleting a nova-compute service removes allocations of successfully
  evacuated instances. This allows the associated resource provider to be
  deleted automatically even if the nova-compute service cannot recover after
  all instances on the node have been successfully evacuated.

.. releasenotes/notes/bug-1948705-ff80ae392c525475.yaml @ b'b9feb05c2fd501b8695130402f2770b0f5d5cb6a'

- Amended the guest resume operation to support mediated devices, as
  libvirt's minimum required version (v6.0.0) supports the hot-plug/unplug of
  mediated devices, which was addressed in v4.3.0.

.. releasenotes/notes/bug-1960230-cleanup-instances-dir-resize-56282e1b436a4908.yaml @ b'bdbeb34a17f851fa7e6483e28cde951d26df7951'

- Fixed bug `1960230 <https://bugs.launchpad.net/nova/+bug/1960230>`_ that
  prevented resize of instances that had previously failed and not been
  cleaned up.

.. releasenotes/notes/bug-1970383-segment-scheduling-permissions-92ba907b10a9eb1c.yaml @ b'6dbe7b773b7a61380f9501ff6f0480baa87fed14'

- `Bug #1970383 <https://bugs.launchpad.net/nova/+bug/1970383>`_: Fixes a
  permissions error when using the
  'query_placement_for_routed_network_aggregates' scheduler variable, which
  caused a traceback on instance creation for non-admin users.

.. releasenotes/notes/bug-1978444-db46df5f3d5ea19e.yaml @ b'9b1c078112f11eafbd8e174efbd0e0f9d2c951ee'

- `Bug #1978444 <https://bugs.launchpad.net/nova/+bug/1978444>`_: Now nova
  retries deleting a volume attachment in case Cinder API returns
  ``504 Gateway Timeout``. Also, ``404 Not Found`` is now ignored and
  leaves only a warning message.

.. releasenotes/notes/libvirt-delegate-ovs-plugging-to-os-vif-6adc0398a0e0df58.yaml @ b'23a4b27dc0c156ad6cbe5260d518da3fd62294b8'

- In this release we delegate port plugging to os-vif for all OVS interface
  types. This allows os-vif to create the OVS port before libvirt creates
  a tap device during a live migration therefore preventing the loss of
  the MAC learning frames generated by QEMU. This resolves a long-standing
  race condition between Libvirt creating the OVS port, Neutron wiring up
  the OVS port and QEMU generating RARP packets to populate the vswitch
  MAC learning table. As a result this reduces the interval during a live
  migration where packets can be lost. See `bug #1815989`_ for details.

  .. _`bug #1734320`: https://bugs.launchpad.net/neutron/+bug/1734320
  .. _`bug #1815989`: https://bugs.launchpad.net/neutron/+bug/1815989


.. _Release Notes_23.2.2_wallaby-eom:

23.2.2
======

.. _Release Notes_23.2.2_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1958636-smm-check-and-enable.yaml @ b'3fe70981f85c5f2bd5765e35b61b5dfae501b0a0'

- [`bug 1958636 <https://bugs.launchpad.net/nova/+bug/1958636>`_]
  Explicitly check for and enable SMM when firmware requires it.
  Previously we assumed libvirt would do this for us but this is
  not true in all cases.

.. releasenotes/notes/fix-ironic-compute-restart-port-attachments-3282e9ea051561d4.yaml @ b'f210115bcba3436b957a609cd388a13e6d77a638'

- Fixes slow compute restart when using the ``nova.virt.ironic`` compute
  driver where the driver was previously attempting to attach VIFS on
  start-up via the ``plug_vifs`` driver method. This method has grown
  otherwise unused since the introduction of the ``attach_interface``
  method of attaching VIFs. As Ironic manages the attachment of VIFs to
  baremetal nodes in order to align with the security requirements of a
  physical baremetal node's lifecycle. The ironic driver now ignores calls
  to the ``plug_vifs`` method.

.. releasenotes/notes/greendns-34df7f9fba952bcd.yaml @ b'edb8bcb0294fb1488c49ad76f2422378d0c495eb'

- During the havana cycle it was discovered that eventlet
  monkey patching of greendns broke ipv6.
  https://bugs.launchpad.net/nova/+bug/1164822
  Since then nova has been disabling eventlet monkey patching
  of greendns. Eventlet addressed the ipv6 limitation in v0.17
  with the introduction of python 3 support in 2015. Nova
  however continued to disable it, which can result i slow dns
  queries blocking the entire nova api or other binary
  because socket.getaddrinfo becomes a blocking call into glibc
  see: https://bugs.launchpad.net/nova/+bug/1964149 for
  more details.

.. releasenotes/notes/ignore-instance-task-state-for-evacuation-e000f141d0153638.yaml @ b'0b8124b99601e1aba492be8ed564f769438bd93d'

- If compute service is down in source node and user try to stop
  instance, instance gets stuck at powering-off, hence evacuation fails with
  msg: Cannot 'evacuate' instance <instance-id> while it is in
  task_state powering-off.
  It is now possible for evacuation to ignore the vm task state.
  For more details see: `bug 1978983`_

  .. _`bug 1978983`: https://bugs.launchpad.net/nova/+bug/1978983


.. _Release Notes_23.2.1_wallaby-eom:

23.2.1
======

.. _Release Notes_23.2.1_wallaby-eom_New Features:

New Features
------------

.. releasenotes/notes/announce-self-post-live-migration-936721b1ab887514.yaml @ b'9609ae0bab30675e184d1fc63aec849c1de020d0'

- Added a new configuration option ``[workarounds]/enable_qemu_monitor_announce_self``
  that when enabled causes the Libvirt driver to send a announce_self QEMU
  monitor command post live-migration. Please see `bug 1815989 <https://bugs.launchpad.net/nova/+bug/1815989>`_
  for more details. Please note that this causes the domain to be considered
  tainted by libvirt.


.. _Release Notes_23.2.1_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1853009-99414e14d1491b5f.yaml @ b'cbbca58504275f194ec55eeb89dad4a496d98060'

- Fixes an issue with multiple ``nova-compute`` services used with Ironic,
  where a rebalance operation could result in a compute node being deleted
  from the database and not recreated. See `bug 1853009
  <https://bugs.launchpad.net/nova/+bug/1853009>`__ for details.


.. _Release Notes_23.2.0_wallaby-eom:

23.2.0
======

.. _Release Notes_23.2.0_wallaby-eom_Known Issues:

Known Issues
------------

.. releasenotes/notes/bug-1946729-wait-for-vif-plugged-event-during-hard-reboot-fb491f6a68370bab.yaml @ b'89c4ff5f7b45f1a5bed8b6b9b4586fceaa391bfb'

- The libvirt virt driver in Nova implements power on and hard reboot by
  destroying the domain first and unplugging the vifs then recreating the
  domain and replugging the vifs. However nova does not wait for the
  network-vif-plugged event before unpause the domain. This can cause
  the domain to start running and requesting IP via DHCP before the
  networking backend has finished plugging the vifs. The config option
  [workarounds]wait_for_vif_plugged_event_during_hard_reboot has been added,
  defaulting to an empty list, that can be used to ensure that the libvirt
  driver waits for the network-vif-plugged event for vifs with specific
  ``vnic_type`` before it unpauses the domain during hard reboot. This should
  only be used if the deployment uses a networking backend that sends such
  event for the given ``vif_type`` at vif plug time. The ml2/ovs and the
  networking-odl Neutron backend is known to send plug time events for ports
  with ``normal`` ``vnic_type``.  For more information see
  https://bugs.launchpad.net/nova/+bug/1946729

.. releasenotes/notes/libvirt-disable-apic-39599bdc2d110a1f.yaml @ b'80572cef67d691ff3f2de50ea2214f0d0c4725c4'

- Linux guest images that have known kernel bugs related to virtualized apic
  initialization previously would sporadically hang. For images where the
  kernel cannot be upgraded, a ``[workarounds]`` config option has been
  introduced:

  ``[workarounds]libvirt_disable_apic``

  This option is primarily intended for CI and development clouds as a bridge
  for operators to mitigate the issue while they work with their upstream
  image vendors.


.. _Release Notes_23.2.0_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1952941-request-spec-numa-topology-migration-c97dbd51b3c6c116.yaml @ b'dad566614c92841aba65d3f0a69e0c580457cb46'

- The `bug 1952941`_  is fixed where a pre-Victoria server with pinned
  CPUs cannot be migrated or evacuated after the cloud is upgraded to
  Victoria or newer as the scheduling fails with
  ``NotImplementedError: Cannot load 'pcpuset'`` error.

  .. _bug 1952941: https://bugs.launchpad.net/nova/+bug/1952941


.. _Release Notes_23.1.0_wallaby-eom:

23.1.0
======

.. _Release Notes_23.1.0_wallaby-eom_Upgrade Notes:

Upgrade Notes
-------------

.. releasenotes/notes/bug-1910466-max-vcpu-topologies-with-numa-9a9ceb1b0fc7c33d.yaml @ b'c9826ca6eb10fc36fb563a42f55715ff5ac51684'

- As part of the fix for bug 1910466, code that attempted to optimize VM CPU
  thread assignment based on the host CPU topology as it was determined
  to be buggy, undocumented and rejected valid virtual CPU topologies while
  also producing different behavior when CPU pinning was enabled vs disabled.
  The optimization may be reintroduced in the future with a more generic
  implementation that works for both pinned and unpinned VMs.


.. _Release Notes_23.1.0_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1910466-max-vcpu-topologies-with-numa-9a9ceb1b0fc7c33d.yaml @ b'c9826ca6eb10fc36fb563a42f55715ff5ac51684'

- The nova libvirt driver supports two independent features, virtual CPU
  topologies and virtual NUMA topologies. Previously, when
  ``hw:cpu_max_sockets``, ``hw:cpu_max_cores`` and ``hw:cpu_max_threads``
  were specified for pinned instances (``hw:cpu_policy=dedicated``)
  without explicit ``hw:cpu_sockets``, ``hw:cpu_cores``, ``hw:cpu_threads``
  extra specs or their image equivalent, nova failed to generate a valid
  virtual CPU topology. This has now been fixed and it is now possible to
  use max CPU constraints with pinned instances.
  e.g. a combination of  ``hw:numa_nodes=2``, ``hw:cpu_max_sockets=2``,
  ``hw:cpu_max_cores=2``, ``hw:cpu_max_threads=8`` and
  ``hw:cpu_policy=dedicated`` can now generate a valid topology using
  a flavor with 8 vCPUs.

.. releasenotes/notes/bug-1939604-547c729b7741831b.yaml @ b'aa5b8d12bcacc01e5f9be45cc1eef24ac9efd2fc'

- Addressed an issue that prevented instances with 1 vcpu using multiqueue
  feature from being created successfully when their vif_type is TAP.

.. releasenotes/notes/minimize-bug-1841481-race-window-f76912d4985770ad.yaml @ b'0c36bd28ebd05ec0b1dbae950a24a2ecf339be00'

- Minimizes a race condition window when using the ``ironic`` virt driver
  where the data generated for the Resource Tracker may attempt to compare
  potentially stale instance information with the latest known baremetal
  node information. While this doesn't completely prevent nor resolve the
  underlying race condition identified in
  `bug 1841481 <https://bugs.launchpad.net/nova/+bug/1841481>`_,
  this change allows Nova to have the latest state information, as opposed
  to state information which may be out of date due to the time which it may
  take to retrieve the status from Ironic. This issue was most observable
  on baremetal clusters with several thousand physical nodes.


.. _Release Notes_23.0.2_wallaby-eom:

23.0.2
======

.. _Release Notes_23.0.2_wallaby-eom_Security Issues:

Security Issues
---------------

.. releasenotes/notes/console-proxy-reject-open-redirect-4ac0a7895acca7eb.yaml @ b'470925614223c8dd9b1233f54f5a96c02b2d4f70'

- A vulnerability in the console proxies (novnc, serial, spice) that allowed
  open redirection has been `patched`_. The novnc, serial, and spice console
  proxies are implemented as websockify servers and the request handler
  inherits from the python standard SimpleHTTPRequestHandler. There is a
  `known issue`_ in the SimpleHTTPRequestHandler which allows open redirects
  by way of URLs in the following format::

    http://vncproxy.my.domain.com//example.com/%2F..

  which if visited, will redirect a user to example.com.

  The novnc, serial, and spice console proxies will now reject requests that
  pass a redirection URL beginning with "//" with a 400 Bad Request.

  .. _patched: https://bugs.launchpad.net/nova/+bug/1927677
  .. _known issue: https://bugs.python.org/issue32084


.. _Release Notes_23.0.2_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1821755-7bd03319e34b6b10.yaml @ b'8b62a4ec9bf617dfb2da046c25a9f76b33516508'

- Improved detection of anti-affinity policy violation when performing live
  and cold migrations. Most of the violations caused by race conditions due
  to performing concurrent live or cold migrations should now be addressed
  by extra checks in the compute service. Upon detection, cold migration
  operations are automatically rescheduled, while live migrations have two
  checks and will be rescheduled if detected by the first one, otherwise the
  live migration will fail cleanly and revert the instance state back to its
  previous value.

.. releasenotes/notes/bug-1851545-781c358939d96cea.yaml @ b'bf7254b794f2296cdb701a21abb9e5708c951542'

- `Bug 1851545 <https://bugs.launchpad.net/nova/+bug/1851545>`_, wherein
  unshelving an instance with SRIOV Neutron ports did not update the port
  binding's ``pci_slot`` and could cause libvirt PCI conflicts, has been
  fixed.

  .. important:: Constraints in the fix's implementation mean that it only
    applies to instances booted **after** it has been applied. Existing
    instances will still experience bug 1851545 after being shelved and
    unshelved, even with the fix applied.

.. releasenotes/notes/libvirt-event-based-device-detach-23ac037004d753b1.yaml @ b'30317e6b3f5ee5e7fd1e8c564a1d6f3e3a2fb91b'

- To fix `device detach issues`__ in the libvirt driver the detach logic has
  been changed from a sleep based retry loop to waiting for libvirt domain
  events. During this change we also introduced two new config options to
  allow fine tuning the retry logic. For details see the description of the
  new ``[libvirt]device_detach_attempts`` and
  ``[libvirt]device_detach_timeout`` config options.

  .. __: https://bugs.launchpad.net/nova/+bug/1882521


.. _Release Notes_23.0.0_wallaby-eom:

23.0.0
======

.. _Release Notes_23.0.0_wallaby-eom_Prelude:

Prelude
-------

.. releasenotes/notes/wallaby-prelude-94fb3c1494afebbb.yaml @ b'dd15a09af44117e667da4fe497eeed6f357aea0b'

The 23.0.0 release includes many new features and bug fixes. Please be
sure to read the upgrade section which describes the required actions to
upgrade your cloud from 22.0.0 (Victoria) to 23.0.0 (Wallaby).

There are a few major changes worth mentioning. This is not an exhaustive
list:

- The latest Compute API microversion supported for Wallaby is v2.88.
  Details on REST API microversions added since the 22.0.0 Victoria release
  can be found in the `REST API Version History`__ page.

  .. __: https://docs.openstack.org/nova/latest/reference/api-microversion-history.html

- `Support for accelerators`__ in Nova servers has been improved. Now
  shelving and unshelving instances using Cyborg accelerators is supported.

  .. __: https://docs.openstack.org/api-guide/compute/accelerator-support.html

- Attaching `neutron ports with QoS minimum bandwidth rules`__ to existing
  instances is now possible.

  .. __: https://docs.openstack.org/api-guide/compute/port_with_resource_request.html

- The nova-scheduler service now verifies which compute nodes can be used
  for instances having `requested networks or ports`__ by looking at the
  network segments related to the compute nodes.

  .. __:  https://docs.openstack.org/neutron/latest/admin/config-routed-networks.html

- The Hyper-V virt driver can now attach Cinder RBD volumes.

- The libvirt virt driver now supports new features :

  - You can `change the default machine type`__ on a compute node safely

    .. __: https://docs.openstack.org/nova/latest/admin/hw-machine-type.html

  - You can enable `UEFI secure boot`__ for new instances

    .. __: https://docs.openstack.org/nova/latest/admin/secure-boot.html

  - `vDPA (vHost data path acceleration)`__ usage is now possible

    .. __: https://specs.openstack.org/openstack/nova-specs/specs/wallaby/approved/libvirt-vdpa-support.html


.. _Release Notes_23.0.0_wallaby-eom_New Features:

New Features
------------

.. releasenotes/notes/add-hw_input_bus-image-metadata-prop-059bea459dec618e.yaml @ b'3f63c68195d296ad44cff615a470cd11518a41df'

- A new image metadata property, ``hw_input_bus``, has been added. This
  allows you to specify the bus used for input devices - a pointer and
  keyboard - which are attached to the instance when graphics are enabled
  on compute nodes using the libvirt virt driver. Two values are currently
  accepted: ``usb`` and ``virtio``. This image metadata property effectively
  replaced the ``hw_pointer_model`` image metadata property, which is
  nonetheless retained for backwards compatibility purposes.

.. releasenotes/notes/allow-disabling-cpu-flags-cc861a3bdfffadf8.yaml @ b'bcd6b42047ea9422a58a4273d831e23f2ea27092'

- The libvirt driver now allows explicitly disabling CPU flags for
  guests via the ``[libvirt]cpu_model_extra_flags`` config attribute.
  This is possible via a ``+`` / ``-`` notation, where if you specify
  a CPU flag prefixed with a ``+`` sign (without quotes), it will be
  enabled for the guest, while a prefix of ``-`` will disable it.  If
  neither ``+`` nor ``-`` is specified, the CPU flag will be enabled,
  which is the default behaviour.

  Refer to the ``[libvirt]cpu_model_extra_flags`` documentation for
  more information.

.. releasenotes/notes/bp-cyborg-rebuild-and-evacuate-97bba59988b8b072.yaml @ b'7fbd787b1b5106f3c4143b9de51980ede0167d3e'

- Add Cyborg shelve/unshelve support.

  After shelve the ARQs are still kept bound to the instance.

  After shelve offload the ARQs of the instance will be feered
  in Cyborg.

  During unshelve the ARQs will be reallocated and bound to
  the instance if needed.

.. releasenotes/notes/bp-libvirt-driver-ip-metadata-8754c623dbd13126.yaml @ b'838370a49014351051bbef2d1c2ada1f47ac2bfb'

- Added IP addresses to the metadata in libvirt XML. If an instance has more
  than one IP address, enumerate those IP addresses. The port attach or
  detach is performed dynamically after the creation of the instance. Every
  time there is a change, it is reflected in the contents of the XML.

.. releasenotes/notes/custom-api-unexpected-exception-1bfc5e174ee5b6a7.yaml @ b'd23cf26ec779658e208f4d5710fea9dabf21b7b3'

- The "API unexpected exception" message can now be configured by the cloud
  provider to point to a custom support page.
  By default it continues to show "http://bugs.launchpad.net/nova/".
  It can be configured using the release file.

.. releasenotes/notes/image-type-exclusion-list-dac61a747a1140a3.yaml @ b'cf0e519a0e300879cb0e83d1aa02e649d82c0c92'

- A ``[compute]image_type_exclusion_list`` configuration option was
  added to remove supported image types from being advertised by a
  compute node as supported. This is to be used in conjunction with
  ``[scheduler]query_placement_for_image_type_support`` to prevent
  instances from booting on a compute node with a given image type,
  even if the underlying hypervisor supports it.

.. releasenotes/notes/port-numa-affinity-policy-f51a74065a1e4369.yaml @ b'5cd1acc3bfbd70e18258d832d0910b250b1adb3e'

- Support was added to specify a port NUMA affinity policy
  for SR-IOV ports. This feature allows users to set a NUMA affinity
  policy between a neutron port and a NUMA guest's CPUs and memory.
  This feature supports the same policies as the existing VM Scoped
  PCI NUMA Affinity policy and take precedence over the
  flavor and image policy. This allows operators to set a default
  affinity policy in the flavor or image while end users can
  express a more granular affinity policy.
  To use this feature operators must enable the
  ``port-numa-affinity-policy`` neutron extension and configure the
  service plugin in neutron. By default the extension
  is listed as available but is not enabled.

.. releasenotes/notes/rbd-hyperv-support-672a34b1d87e68eb.yaml @ b'f0eeba5c8c63cf78b2433df05cae90c0d9f28785'

- The Hyper-V driver can now attach Cinder RBD volumes. The minimum
  requirements are Ceph 16 (Pacific) and Windows Server 2016.

.. releasenotes/notes/routed_networks_filter-3d274e827449a144.yaml @ b'a1673d31180f3f7c90af1447573f362424c95e48'

- The scheduler can now verify if the requested networks or the port are
  related to Neutron `routed networks`_ with some specific segments to use.
  In this case, the routed networks prefilter will require the related
  aggregates to be reported in Placement, so only hosts within the asked
  aggregates would be accepted.
  In order to support this behaviour, operators need to set the
  ``[scheduler]/query_placement_for_routed_network_aggregates`` configuration
  option which defaults to ``False``.

  .. _`routed networks`: https://docs.openstack.org/neutron/latest/admin/config-routed-networks.html

.. releasenotes/notes/socket-pci-numa-affinity-policy-70b95b57b9f8f0c4.yaml @ b'b2471dd5780ae4173aeea9229645bbe5116fa817'

- A new PCI NUMA affinity policy is available. The
  ``hw:pci_numa_affinity_policy`` flavor extra spec and
  ``hw_pci_numa_affinity_policy`` image metadata property now accept a
  ``socket`` policy value. This value indicates that the PCI device must be
  affined to the same host socket as at least one of the guest NUMA nodes.
  For more information, see the `PCI Passthrough`__ guide.

  .. __: https://docs.openstack.org/nova/latest/admin/pci-passthrough.html

.. releasenotes/notes/support-interface-attach-with-qos-port-22eb452202eb92fd.yaml @ b'5af28c4de5eeace702cb76aa8540533ef77b9016'

- The ``POST /servers/{server_id}/os-interface`` API now supports
  attaching neutron ports with QoS minimum bandwidth rules attached.

.. releasenotes/notes/support-sys.argv-in-wsgi-app-2dc5006f9e9e5f9e.yaml @ b'd38b7e13a6c3c2f8a932f9a55305502b47f2e0b2'

- Now nova-api and nova-api-metadata WSGI services support command line
  arguments similarly to other nova services. For example these services
  now support specifying multiple config files via --config-file parameter.
  Please note that passing command line arguments to WSGI apps depends on
  the given WSGI runner. For example uwsgi supports this via the --pyargv
  parameter of the uwsgi binary.

.. releasenotes/notes/vdpa-cc2300d2c46c150b.yaml @ b'7326e46aaecd1f6c8a3cfaca7b90c2ada1634509'

- The libvirt driver has added support for hardware-offloaded OVS
  with vDPA (vhost Data Path Acceleration) type interfaces.
  vDPA allows virtio net interfaces to be presented to the guest while
  the datapath can be offloaded to a software or hardware implementation.
  This enables high performance networking with the portablity of standard
  virtio interfaces.


.. _Release Notes_23.0.0_wallaby-eom_Known Issues:

Known Issues
------------

.. releasenotes/notes/cros-scell-resize-not-supported-with-ports-having-resource-request-a8e1029ef5983793.yaml @ b'1c056c384d1b89dd877e1aa3108b1797d7881223'

- When the tempest test coverage was added for resize and cold migrate
  with neutron ports having QoS minimum bandwidth policy rules we
  discovered that the cross cell resize code path cannot handle such ports.
  See bug https://bugs.launchpad.net/nova/+bug/1907522 for details. A fix
  was implemented that makes sure that Nova falls back to same-cell resize if
  the server has such ports.

.. releasenotes/notes/dnspython-2.0.0-not-supported-by-eventlet-b8adf73ed9e14817.yaml @ b'f2ebe107d148e6fccad566f65c1e41c8d5955e2a'

- The dnspython 2.0.0 package is incompatible with even the latest eventlet
  package version. This makes nova-novncproxy service to fail if the version
  of the dnspython package is equal or greater than 2.0.0. See `eventlet
  issue 619`_ for more details

  .. _eventlet issue 619: https://github.com/eventlet/eventlet/issues/619

.. releasenotes/notes/vdpa-cc2300d2c46c150b.yaml @ b'7326e46aaecd1f6c8a3cfaca7b90c2ada1634509'

- Nova currently does not support the following lifecycle operations when
  combined with a instance using vDPA ports: shelve, resize, cold migration,
  live migration, evacuate, suspend or interface attach/detach.
  Attempting to use one of the above operations will result in a HTTP 409
  (Conflict) error. While some operations like "resize to same host",
  shelve or attach interface technically work, they have been blocked since
  unshelve and detach interface currently do not. Resize to a different
  host has been blocked since its untested, evacuate has also been blocked
  for the same reason. These limitation may be removed in the future as
  testing is improved. Live migration is currently not supported with vDPA
  interfaces by QEMU and therefore cannot be enabled in openstack at this
  time.

  Like SR-IOV, vDPA leverages DMA transfer between the guest and hardware.
  This requires the DMA buffers to be locked in memory. As the DMA buffers
  are allocated by the guest and can be allocated anywhere in the guest RAM,
  QEMU locks **all** guest RAM. By default the ``RLIMIT_MEMLOCK`` for a
  normal QEMU instance is set to 0 and qemu is not allowed to lock guest
  memory. In the case of SR-IOV, libvirt automatically set the limit to guest
  RAM + 1G which enables QEMU to lock the memory. This does not happen today
  with vDPA ports. As a result if you use VDPA ports without enabling locking
  of the guest memory you will get DMA errors. To workaround this issues
  until libvirt is updated, you must set ``hw:cpu_realtime=yes`` and define a
  valid ``CPU-REALTIME-MASK`` e.g ``hw:cpu_realtime_mask=^0`` or define
  ``hw:emulator_threads_policy=share|isolate``. Note that since we are just
  using ``hw:cpu_realtime`` for its side-effect of locking the guest memory,
  this usage does not require the guest or host to use realtime kernels.
  However, all other requirements of ``hw:cpu_realtime`` such as requiring
  hw:cpu_policy=dedicated still apply. It is also strongly recommended that
  hugpages be enabled for all instance with locked memory. This can be done
  by setting ``hw:mem_page_size``. This will enable nova to correctly account
  for the fact that the memory is unswapable.


.. _Release Notes_23.0.0_wallaby-eom_Upgrade Notes:

Upgrade Notes
-------------

.. releasenotes/notes/bug-1552042-remove-non-libguestfs-injection-fallback-2bd22422df05d99d.yaml @ b'd06a10f09699ef260002cc3474b33f08aca06583'

- Be sure to read the **Security** release notes about upgrade impacts for
  resolving bug 1552042.

.. releasenotes/notes/drop-libvirt-uml-support-8ba9311b4cfc8ca6.yaml @ b'd02ce3c4f0efe6c437b0d22ea17afdd713e45d43'

- Support for the libvirt+UML hypervisor model has been removed. This has not
  been validated in some time and was never intended for production use.

.. releasenotes/notes/drop-libvirt-xen-support-aef7e97b8491af69.yaml @ b'3a390c2c8238409c00acc08fad725d46fa02c0ad'

- Support for the libvirt+xen hypervisor model has been removed. This has
  not been validated in some time and was not supported.

.. releasenotes/notes/drop-libvirt-xen-support-aef7e97b8491af69.yaml @ b'3a390c2c8238409c00acc08fad725d46fa02c0ad'

- The ``[libvirt] xen_hvmloader_path`` config option has been removed. This
  was only used with the libvirt+xen hypervisor, which is no longer
  supported.

.. releasenotes/notes/libvirt-store-and-change-default-machine-type-bf86b4973c4dee4c.yaml @ b'8cddd243bfaac4454b088d49ba65d4fb3c42211a'

- The libvirt virt driver will now attempt to record the machine type of an
  instance at startup and when launching an instance if the machine type is
  not already recorded in the image metadata associated with the instance.

  This machine type will then be used when the instance is restarted or
  migrated as it will now appear as an image metadata property associated
  with the instance.

  The following new ``nova-manage`` commands have been introduced to help
  operators manage the ``hw_machine_type`` image property:

  ``nova-manage libvirt get_machine_type``

  This command will print the current machine type if set in the image
  metadata of the instance.

  ``nova-manage libvirt set_machine_type``

  This command will set or update the machine type of the instance assuming
  the following criteria are met:

  * The instance must have a ``vm_state`` of ``STOPPED``, ``SHELVED`` or
    ``SHELVED_OFFLOADED``.

  * The machine type is supported. The supported list includes alias and
    versioned types of ``pc``, ``pc-i440fx``, ``pc-q35``, ``q35``, ``virt``,
    ``s390-ccw-virtio``, ``hyperv-gen1`` and ``hyperv-gen2`` as supported by
    the hyperv driver.

  * The update will not move the instance between underlying machine types.
    For example, ``pc`` to ``q35``.

  * The update will not move the instance between an alias and versioned
    machine type or vice versa. For example, ``pc`` to ``pc-1.2.3`` or
    ``pc-1.2.3`` to ``pc``.

  A ``--force`` flag is provided to skip the above checks but caution
  should be taken as this could easily lead to the underlying ABI of the
  instance changing when moving between machine types.

  ``nova-manage libvirt list_unset_machine_type``

  This command will list instance UUIDs that do not have a machine type
  recorded. An optional cell UUID can be provided to list on instances
  without a machine type from that cell.

  A new ``nova-status`` check has been introduced to help operators
  identify if any instances within their environment have ``hw_machine_type``
  unset before they attempt to change the ``[libvirt]hw_machine_type``
  configurable.

.. releasenotes/notes/prevent-starting-services-with-old-compute-fc80b4ff58a2aaea.yaml @ b'aa7c6f87699ec1340bd446a7d47e1453847a637f'

- Nova services only support old computes if the compute is not
  older than the previous major nova release. To prevent compatibility
  issues at run time nova services will refuse to start if the deployment
  contains too old compute services.

.. releasenotes/notes/remove-customer-filters-95ab8c7a3aff058d.yaml @ b'9d53f366ff8c9a29c4ddbf0fa27febbce7442fc9'

- Support for custom scheduler drivers, deprecated since the 21.0.0 (Ussuri)
  release, has been removed. The default ``filter_scheduler`` is now
  considered performant enough to suit all use cases. Users with specific
  requirements that they feel are not met by the filter scheduler should
  contact the nova developers to discuss their issue.

.. releasenotes/notes/remove-customer-filters-95ab8c7a3aff058d.yaml @ b'9d53f366ff8c9a29c4ddbf0fa27febbce7442fc9'

- The ``[scheduler] scheduler_driver`` config option has been removed, along
  with the ``nova.scheduler.driver`` setuptools entrypoint.

.. releasenotes/notes/remove-customer-filters-95ab8c7a3aff058d.yaml @ b'9d53f366ff8c9a29c4ddbf0fa27febbce7442fc9'

- The ``[scheduler] periodic_task_interval`` config option has been removed.
  It was no longer used by any supported scheduler drivers.

.. releasenotes/notes/remove-deprecated-libvirt-use_usb_tablet-opt-b01058905240b8ce.yaml @ b'5b0343d3e131aadfd0e51a91f0671b57aac23662'

- The ``[libvirt] use_usb_tablet`` config option, which was first deprecated
  in the 14.0.0 (Newton) release, has now been removed. It has been replaced
  by the ``[DEFAULT] pointer_model`` config option.

.. releasenotes/notes/remove-glance-allowed_direct_url_schemes-93d34d95dd84d2c8.yaml @ b'f9901ca92770a879a28c17f28814f6c93204f2fc'

- The ``[glance]/allowed_direct_url_schemes`` config option, which was first
  deprecated in the 17.0.0 (Queens) release has now been removed.

.. releasenotes/notes/remove-nova-manage-db-ironic_flavor_migration-810e75def824d7bb.yaml @ b'35b58a503565213b4ef84845242e76730d11aa43'

- The ``nova-manage db ironic_flavor_migration`` command has been removed.
  This command could be used to assist users skipping the 16.0.0 (Pike)
  release, which is now in the distant past.

.. releasenotes/notes/remove-nova-manage-db-ironic_flavor_migration-810e75def824d7bb.yaml @ b'35b58a503565213b4ef84845242e76730d11aa43'

- The ``Ironic Flavor Migration`` upgrade check has been removed. It is no
  longer necessary.

.. releasenotes/notes/remove-nova-manage-db-null_instance_uuid_scan-f34494b316ff181c.yaml @ b'2d4eff0ef789957fe5498640015a6cccff43a2c3'

- The ``nova-manage db null_instance_uuid_scan`` command has been removed.
  A blocking migration has been in place since the 12.0.0 (Liberty) release
  making this check unnecessary.

.. releasenotes/notes/wallaby-libvirt-version-bump-6fd35d03d7f3df28.yaml @ b'95724bbaef617315cafdbef474dddc7965ad623b'

- The minimum required version of libvirt used by the ``nova-compute`` service
  is now 6.0.0. The next minimum required version to be used in a future
  release is 7.0.0.

  The minimum required version of QEMU used by the ``nova-compute`` service is
  now 4.2.0. The next minimum required version to be used in a future release
  is 5.2.0.

  Failing to meet these minimum versions when using the libvirt compute
  driver will result in the ``nova-compute`` service not starting.


.. _Release Notes_23.0.0_wallaby-eom_Deprecation Notes:

Deprecation Notes
-----------------

.. releasenotes/notes/deprecate-tunnelled-live-migration-81c06a04627724ec.yaml @ b'064349a888cf8dc5075d27fc0ae3199146a17fe3'

- The ``[libvirt]live_migration_tunnelled`` option is deprecated as of
  Wallaby (23.0.0) release.

  The "tunnelled live migration" has two inherent limitations: (a) it
  cannot handle live migration of disks in a non-shared storage setup,
  and (b) it has a huge performance overhead and latency, because it
  burns more CPU and memory during live migration.

  Both these problems are addressed by the QEMU-native support in Nova
  -- this is the recommended approach for securing all live migration
  streams (guest RAM, device state, and disks).  Assuming TLS
  environment is setup, this can be enabled by setting the config
  attribute ``[libvirt]live_migration_with_native_tls``.

.. releasenotes/notes/libvirt-workarounds-deprecate-rbd_volume_local_attach-and-disable_native_luksv1-39680763607b5a59.yaml @ b'98713d69acd2fcc83f1f7589ac722c4c16f6976c'

- The ``[workarounds]rbd_volume_local_attach`` and
  ``[workarounds]disable_native_luksv1`` options have been deprecated as of
  the 23.0.0 release ahead of removal in the future as the underlying
  ``libgcrypt`` performance regressions that prompted their introduction have
  been resolved.

  Any remaining users of these workarounds should plan to disable these
  workarounds as soon as possible. Note that this requires that any instances
  on compute hosts using the workaround be shutdown ahead of the value of the
  workaround changing, before being restarted.

.. releasenotes/notes/microversion-2-88-7063636ed9c11a5d.yaml @ b'1f67ce24961a156dba56cacc75cbdd0800a7feee'

- The 2.88 API microversion has been added. This microversion removes a
  number of fields have been removed from the ``GET /os-hypervisors/detail``
  (detailed list) and ``GET /os-hypervisors/{hypervisor_id}`` (show) APIs::

  - ``current_workload``
  - ``cpu_info``
  - ``vcpus``
  - ``vcpus_used``
  - ``free_disk_gb``
  - ``local_gb``
  - ``local_gb_used``
  - ``disk_available_least``
  - ``free_ram_mb``
  - ``memory_mb``
  - ``memory_mb_used``
  - ``running_vms``

  The fields have been removed as the information they provided was
  frequently misleading or outright wrong, and more accurate information can
  now be queried from placement.

  In addition, the ``GET /os-hypervisors/statistics`` API, which provided a
  summary view with just the fields listed above, has been removed entirely
  and will now raise a HTTP 404 with microversion 2.88 or greater.

  Finally, the ``GET /os-hypervisors/{hypervisor}/uptime`` API, which
  provided a similar response to the ``GET /os-hypervisors/{hypervisor}`` API
  but with an additional ``uptime`` field, has been removed in favour of
  including this field in the primary ``GET /os-hypervisors/{hypervisor}``
  API.


.. _Release Notes_23.0.0_wallaby-eom_Security Issues:

Security Issues
---------------

.. releasenotes/notes/bug-1552042-remove-non-libguestfs-injection-fallback-2bd22422df05d99d.yaml @ b'd06a10f09699ef260002cc3474b33f08aca06583'

- When using the *libvirt* compute driver, the **libguestfs** package is now
  **required** for file injection, if you are supporting that in your cloud
  (see the ``[libvirt]/inject_partition`` config option).

  Previously, if the libguestfs package was not installed, the nova-compute
  service would fallback to mounting to the local compute host file system
  which is a security exposure. This has been discussed for years in several
  forums:

  http://lists.openstack.org/pipermail/openstack-dev/2014-September/046764.html

  http://lists.openstack.org/pipermail/openstack-dev/2016-July/098703.html

  http://lists.openstack.org/pipermail/openstack-dev/2016-November/107233.html

  Furthermore, the `2.57 compute REST API microversion`_ deprecated the use
  of personality files for file injection. For more history on deprecating
  file injection, see the `spec`__.

  There are some known caveats with this:

  * If running on s390x, you will need libguestfs >= 1.37.14.
  * At this time, FreeBSD does not have a libguestfs package, therefore
    file injection cannot be supported with the libvirt driver on a FreeBSD
    compute host.
  * ``[libvirt]/virt_type`` config option values other than ``kvm`` or
    ``qemu`` may be impacted, like ``lxc``, where libguestfs was not
    previously required.

  For more background on this change, see
  https://bugs.launchpad.net/nova/+bug/1552042.

  .. _2.57 compute REST API microversion: https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#id51
  .. __: https://specs.openstack.org/openstack/nova-specs/specs/queens/implemented/deprecate-file-injection.html


.. _Release Notes_23.0.0_wallaby-eom_Bug Fixes:

Bug Fixes
---------

.. releasenotes/notes/bug-1581977-310e5f218ccb1d16.yaml @ b'9046f0fff4be424eda25401a3f9b8752964de775'

- Nova will now replace periods (``.``) with dashes (``-``) when sanitizing an
  instance's display name for use as a hostname.

  Nova publishes hostnames for instances via the metadata service and config
  drives. This hostname is based on a sanitized version of the instance name
  combined with the domain value specified in ``[api] dhcp_domain``. The
  previous sanitization of the hostname included the replacement of whitespace
  and underscores with dashes and the stripping of unicode characters along
  with leading and trailing periods and dashes. It did not, however, include
  the removal of periods in the name. Periods are not valid in the hostname
  or, more specifically, in the host-specific or leaf label (the ``host`` in
  ``host.example.com``) and their presence can cause conflicts when ``[api]
  dhcp_domain`` is configured, leading to instances being mistakenly
  configured with hostnames like ``host.example.com.example.com``. More
  pressingly, their use can result in a failure to boot instances if DNS
  integration is enabled in neutron, likely via designate, as the hostname is
  identified as a FQDN (fully-qualified domain name) by neutron and reasonable
  instance names like ``test-ubuntu20.04`` will be rejected as invalid FQDNs,
  in this case because the name would yield a TLD (top-level domain) of ``04``
  and TLDs cannot be entire numerical. To avoid these issues, periods are now
  replaced with dashes.

.. releasenotes/notes/bug-1892361-pci-deivce-type-update-c407a66fd37f6405.yaml @ b'b8695de6da56db42b83b9d9d4c330148766644be'

- Fixes `bug 1892361`_ in which the pci stat pools are not updated when an
  existing device is enabled with SRIOV capability. Restart of nova-compute
  service updates the pci device type from type-PCI to type-PF but the pools
  still maintain the device type as type-PCI. And so the PF is considered for
  allocation to instance that requests vnic_type=direct. With this fix, the
  pci device type updates are detected and the pci stat pools are updated
  properly.

  .. _bug 1892361: https://bugs.launchpad.net/nova/+bug/1892361

.. releasenotes/notes/bug-1894804-bef8703f8364f9af.yaml @ b'c716e7608ea21847c9fa7c8a001144c54520b385'

- `bug 1882521`_ has now been resolved by increasing the incremental
  and max sleep times between device detach attempts. This works around some
  undefined QEMU behaviour documented in `bug 1894804`_ where overlapping
  ``device_del`` requests would cancel the initial call leading to a
  situation where the device was never detached fully.

  .. _bug 1882521: https://bugs.launchpad.net/nova/+bug/1882521
  .. _bug 1894804: https://bugs.launchpad.net/qemu/+bug/1894804

.. releasenotes/notes/bug-1911924-6e93d8a5038d18c1.yaml @ b'534b4f38958af2fbf4392e445ddb1b2bad4179ed'

- The `os-resetState`_ API will now log an instance action when called. The
  resulting instance action being visible via the `os-instance-actions`_ API
  to users and admins, resolving `bug 1911924`_.

  .. _bug 1911924: https://launchpad.net/bugs/1911924
  .. _os-instance-actions: https://docs.openstack.org/api-ref/compute/?expanded=reset-server-state-os-resetstate-action-detail,list-actions-for-server-detail
  .. _os-resetState: https://docs.openstack.org/api-ref/compute/?expanded=reset-server-state-os-resetstate-action-detail

.. releasenotes/notes/bug_1902925-351f563340a1e9a5.yaml @ b'8d9f298f4c48e32bc625c7e2f47d47e4277ec064'

- When upgrading compute services from Ussuri to Victoria each by one, the
  Compute RPC API was pinning to 5.11 (either automatically or by using
  the specific rpc version in the option) but when rebuilding an instance,
  a TypeError was raised as an argument was not provided. This error is
  fixed by `bug 1902925`_.

  .. _bug 1902925: https://bugs.launchpad.net/nova/+bug/1902925/

.. releasenotes/notes/bug_1905701-fdc7402ffe70d104.yaml @ b'a107a5099e86c3da80a6feeca6f840d5a3ad11b9'

- The libvirt virt driver will no longer attempt to fetch volume
  encryption metadata or the associated secret key when attaching ``LUKSv1``
  encrypted volumes if a libvirt secret already exists on the host.

  This resolves `bug 1905701`_ where instances with ``LUKSv1`` encrypted
  volumes could not be restarted automatically by the ``nova-compute``
  service after a host reboot when the
  ``[DEFAULT]/resume_guests_state_on_host_boot`` configurable was enabled.

  .. _bug 1905701: https://launchpad.net/bugs/1905701

.. releasenotes/notes/libvirt-no-usb-controller-2556e3f0881a538f.yaml @ b'c34a17db6f1ed4469d963a4e6426594602939912'

- Previously, when using the libvirt driver on x86 hosts, a USB controller
  was added by default to all instances even if no guest device actually
  required this controller. This has been resolved. A USB controller will
  now only be added if an input or disk device requires a USB bus.

.. releasenotes/notes/unplug-vifs-in-resize_instance-fcd98ea44e4b8725.yaml @ b'66c7f00e1d9d7c0eebe46eb4b24b2b21f7413789'

- Support for cold migration and resize between hosts with different network backends
  was previously incomplete. If the os-vif plugin for all network backends available
  in the cloud are not installed on all nodes unplugging will fail during confirming
  the resize. The issue is caused by the VIF unplug that happened during the resize
  confirm action on the source host when the original backend information of the VIF
  was not available. The fix moved the unplug to happen during the resize action
  when such information is still available. See `bug #1895220`_ for more details.

  .. _`bug #1895220`: https://bugs.launchpad.net/nova/+bug/1895220


.. _Release Notes_23.0.0_wallaby-eom_Other Notes:

Other Notes
-----------

.. releasenotes/notes/remove_bindir_option-dd164cd623a325b6.yaml @ b'033a32557864fccea87a2d97cdbb9af8f7e52131'

- Remove the old config option ``bindir`` since it was used for
  *nova-network* which had been removed.


