53 Things to look for in OpenStack Train

Cinder - Block Storage service

1. A number of drivers have added support for new features such as multi-attach and consistency groups.
2. Cinder now has upgrade checks for possible compatibility issues when upgrading to Train.

Designate - DNS service

3. Designate now provides full IPv6 Support for the API control plane and the DNS data plane

Glance - Image service

4. The Glance multi-store feature is now considered to be stable.
5. Cache prefetching is now done as a periodic task by the glance-api, removing the requirement to add it in cron.

Horizon - Dashboard

6. Volume multi-attach is now supported.
7. Horizon now supports the optional automatic generation of a Kubernetes configuration file.

Ironic - Bare Metal service

8. Ironic now provides basic support for building software RAID.
9. Ironic includes a new tool for building ramdisk images: ironic-python-agent-builder.

Keystone - Identity service

10. All keystone APIs now use the default reader, member, and admin roles in their default policies. This means that it is now possible to create a user with finer-grained access to keystone APIs than was previously possible with the default policies. For example, it is possible to create an “auditor” user that can only access keystone’s GET APIs. Please be aware that depending on the default and overridden policies of other OpenStack services, such a user may still be able to access creative or destructive APIs for other services.
11. All keystone APIs now support system scope as a policy target, where applicable. This means that it is now possible to set [oslo_policy]/enforce_scope to true in keystone.conf, which, with the default policies, will allow keystone to distinguish between project-specific requests and requests that operate on an entire deployment. This makes it safe to grant admin access to a specific keystone project without giving admin access to all of keystone’s APIs, but please be aware that depending on the default and overridden policies of other OpenStack services, a project admin may still have admin-level privileges outside of the project scope for other services.
12. Keystone domains can now be created with a user-provided ID, which allows for all IDs for users created within such a domain to be predictable. This makes scaling cloud deployments across multiple sites easier as domain and user IDs no longer need to be explicitly synced.
13. Application credentials now support access rules, a user-provided list of OpenStack API requests for which an application credential is permitted to be used. This level of access control is supplemental to traditional role-based access control managed through policy rules.
14. Keystone roles, projects, and domains may now be made immutable, so that certain important resources like the default roles or service projects cannot be accidentally modified or deleted. This is managed through resource options on roles, projects, and domains. The keystone-manage bootstrap command now allows the deployer to opt into creating the default roles as immutable at deployment time, which will become the default behavior in the future. Roles that existed prior to running keystone-manage bootstrap can be made immutable via resource update.

Manila - Shared File Systems service

15. Manila share networks can now be created with multiple subnets, which may be in different availability zones.
16. NetApp backend added support for replication when DHSS=True.
17. GlusterFS back end has added support for extend/shrink for directory layout.
18. The Infortrend driver with support for NFS and CIFS shares has been added.
19. The CephFS backend now supports IPv6 exports and access lists.
20. The Inspur Instorage driver with support for NFS and CIFS shares has been added.
21. Support for modifying share type name, description and/or public access fields has been added.

Neutron - Networking service

22. OVN can now send ICMP “Fragmentation Needed” packets, allowing VMs on tenant networks using jumbo frames to access the external network without any extra routing configuration.
23. When different subnet pools participate in the same address scope, the constraints disallowing subnets to be allocated from different pools on the same network have been relaxed. As long as subnet pools participate in the same address scope, subnets can now be created from different subnet pools when multiple subnets are created on a network. When address scopes are not used, subnets with the same ip_version on the same network must still be allocated from the same subnet pool.
24. A new API, extraroute-atomic, has been implemented for Neutron routers. This extension enables users to add or delete individual entries to a router routing table, instead of having to update the entire table as one whole
25. Support for L3 conntrack helpers has been added. Users can now configure conntrack helper target rules to be set for a router. This is accomplished by associating a conntrack_helper sub-resource to a router.

Nova - Compute service

26. Nova now includes live migration support for servers with a NUMA topology, pinned CPUs and/or huge pages, and/or SR-IOV ports attached when using the libvirt compute driver.
27. Support for cold migrating and resizing servers with bandwidth-aware Quality of Service ports attached has been added.
28. This release includes mproved multi-cell resilience with the ability to count quota usage using the Placement service and API database.
29. A new framework supporting hardware-based encryption of guest memory to protect users against attackers or rogue administrators snooping on their workloads when using the libvirt compute driver has been added. Currently this framework only has basic support for AMD SEV (Secure Encrypted Virtualization).
30. Nova now has improved operational tooling for tasks such as archiving the database and healing instance resource allocations in Placement.
31. Coordination with the baremetal service during external node power cycles has been improved.
32. Support for VPMEM (Virtual Persistent Memory) when using the libvirt compute driver. This provides data persistence across power cycles at a lower cost and with much larger capacities than DRAM, especially benefitting HPC and memory databases such as redis, rocksdb, oracle, SAP HANA, and Aerospike.

Octavia - Load-balancer service

33. You can now apply an Access Control List (ACL) to the load balancer listener. Each port can have a list of allowed source addresses.
34. Octavia now supports Amphora log offloading. Operators can define syslog targets for the Amphora administrative logs and for the tenant load balancer connection logs.
35. Amphorae can now be booted using Cinder volumes.
36. The Amphora images have been optimized to reduce image size and memory consumption.

Placement - Placement service

37. Placement now includes support for forbidden aggregates, which allows groups of resource providers to only be used for specific purposes, such as reserving a group of compute nodes for licensed workloads.
38. Support has been added for a suite of features which, combined, enable targeting candidate providers that have complex trees modeling NUMA layouts, multiple devices, and networks where affinity between and grouping among the members of the tree are required. These features will help to enable NFV and other high performance workloads in the cloud.

Swift - Object Storage service

39. Log formats are now more configurable and include support for anonymization.
40. Swift-all-in-one Docker images are now built and published to https://hub.docker.com/r/openstackswift/saio.

Tacker - NFV Orchestration service

41. Tacker now includes support for force deleting VNF and Network Service instances.
42. Partial support of VNF packages has been added.

Blazar - Resource reservation service

43. Blazar now includes support for a global request ID which can be used to track requests across multiple OpenStack services.

Cyborg - Accelerator resources for AI and ML

44. Cyborg (previously known as Nomad) is an OpenStack project that aims to provide a general purpose management framework for acceleration resources (i.e. various types of accelerators such as GPU, FPGA, ASIC, NP, SoCs, NVMe/NOF SSDs, ODP, DPDK/SPDK and so on).

Karbor - Data Protection Orchestration Service

45. Karbor now includes event notifications for plan, checkpoint, restore, scheduled and trigger operations.
46. Karbor now enables users to backup image boot servers with the new added data which is located on the root disk.

Kolla

47. This release Introduces images and playbooks for Masakari, which supports instance High Availability, and Qinling, which provides Functions as a Service.

Kuryr

48. Support has been added for tagging all the Neutron and Octavia resources created by Kuryr.

Senlin - Clustering service

49. Senlin now has support for webhook v2: previously the webhook API introduced microversion 1.10 to allow callers to pass arbritary data in the body along with the webhook call.

Trove - Database service

50. The cloud administrator can now define the management resources for the trove instance, such as keypair, security group, network, etc., Creating a trove guest image is also now much easier for the cloud administrator or developer by using trovestack script, and users can expose the trove instance to the public with the ability to limit source IP addresses access to the database.

Vitrage - RCA (Root Cause Analysis) service

51. This release adds new datasources for Kapacitor and Monasca, a new API for Vitrage status and templates versions, and support database upgrades for Vitrage with the alembic tool.

Watcher - Infrastructure Optimization service

52. This release adds a ‘force’ field to Audit. The user can set –force to enable the new option when launching audit. In addition, Grafana has been added as datasource that can be used for collecting metrics, and Watcher can get data from Placement to improve its compute data model.

Zun - Containers service

53. The Zun compute agent now reports local resources to the Placement API, and the Zun scheduler gets allocation candidates from the placement API and claim container allocation.