From e3fcd99f68e145d5562be7a2d57d3f276f26078b Mon Sep 17 00:00:00 2001 From: OpenStack Release Bot Date: Thu, 3 Sep 2026 11:07:34 +0000 Subject: [PATCH 1/4] Update .gitreview for stable/2026.2 Change-Id: Ie9e531bb93025ef018128e42f8b5a3e62d82cabe Signed-off-by: OpenStack Release Bot Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/functions --- .gitreview | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitreview b/.gitreview index 4eee726db6..66a59950f6 100644 --- a/.gitreview +++ b/.gitreview @@ -2,3 +2,4 @@ host=review.opendev.org port=29418 project=openstack/python-openstackclient.git +defaultbranch=stable/2026.2 From 48fcea7f22a00beb8a3a8c24b93f1e1af986bfa0 Mon Sep 17 00:00:00 2001 From: OpenStack Release Bot Date: Thu, 3 Sep 2026 11:07:37 +0000 Subject: [PATCH 2/4] Update TOX_CONSTRAINTS_FILE for stable/2026.2 Update the URL to the upper-constraints file to point to the redirect rule on releases.openstack.org so that anyone working on this branch will switch to the correct upper-constraints list automatically when the requirements repository branches. Until the requirements repository has as stable/2026.2 branch, tests will continue to use the upper-constraints list on master. Change-Id: I778a0bbfd1929ce6186d2a8d9703b407b75bfdcf Signed-off-by: OpenStack Release Bot Generated-By: openstack/project-config:roles/copy-release-tools-scripts/files/release-tools/functions --- tox.ini | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tox.ini b/tox.ini index 5c3f49b626..49ab73e3a0 100644 --- a/tox.ini +++ b/tox.ini @@ -11,7 +11,7 @@ setenv = OS_STDERR_CAPTURE=1 OS_TEST_TIMEOUT=60 deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/test-requirements.txt -r{toxinidir}/requirements.txt commands = @@ -65,7 +65,7 @@ commands = description = Run specified command in a virtual environment with all dependencies installed. deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/requirements.txt -r{toxinidir}/doc/requirements.txt commands = @@ -95,7 +95,7 @@ commands = description = Build documentation in HTML format. deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/doc/requirements.txt commands = sphinx-build -a -E -W -d doc/build/doctrees -b html doc/source doc/build/html @@ -107,7 +107,7 @@ commands = description = Build release note documentation in HTML format. deps = - -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/master} + -c{env:TOX_CONSTRAINTS_FILE:https://releases.openstack.org/constraints/upper/2026.2} -r{toxinidir}/doc/requirements.txt commands = sphinx-build -a -E -W -d releasenotes/build/doctrees -b html releasenotes/source releasenotes/build/html From aa5dcf6f5206f58951298b30d47b24a4d9b0816c Mon Sep 17 00:00:00 2001 From: Rodolfo Alonso Hernandez Date: Mon, 14 Sep 2026 12:18:33 +0200 Subject: [PATCH 3/4] vpnaas: Remove deprecated sha1 and 3des algorithms Remove the deprecated ``sha1`` authentication algorithm and ``3des`` encryption algorithm from the VPN IKE and IPsec policy CLI choices. These algorithms were removed from neutron-vpnaas [1]. Update unit tests to use ``sha256`` instead of ``sha1``. [1]https://bugs.launchpad.net/neutron/+bug/2146531 Related-Bug: #2146531 Assisted-By: Composer 2.5 Signed-off-by: Rodolfo Alonso Hernandez Change-Id: I8fa41259616b8ce30c4d7cae949ca505bc111110 (cherry picked from commit 839c132db0c2d5576925a4e6b6e406605626da2f) --- openstackclient/network/v2/vpnaas/ikepolicy.py | 2 -- openstackclient/network/v2/vpnaas/ipsecpolicy.py | 2 -- .../tests/unit/network/v2/vpnaas/fakes.py | 4 ++-- .../tests/unit/network/v2/vpnaas/test_ikepolicy.py | 6 +++--- .../tests/unit/network/v2/vpnaas/test_ipsecpolicy.py | 12 ++++++------ 5 files changed, 11 insertions(+), 15 deletions(-) diff --git a/openstackclient/network/v2/vpnaas/ikepolicy.py b/openstackclient/network/v2/vpnaas/ikepolicy.py index 516a6beea2..d2d0e0da7e 100644 --- a/openstackclient/network/v2/vpnaas/ikepolicy.py +++ b/openstackclient/network/v2/vpnaas/ikepolicy.py @@ -60,7 +60,6 @@ } _auth_algorithms = [ - 'sha1', 'sha256', 'sha384', 'sha512', @@ -69,7 +68,6 @@ ] _encryption_algorithms = [ - '3des', 'aes-128', 'aes-192', 'aes-256', diff --git a/openstackclient/network/v2/vpnaas/ipsecpolicy.py b/openstackclient/network/v2/vpnaas/ipsecpolicy.py index 042aa492fa..4edeaf31e6 100644 --- a/openstackclient/network/v2/vpnaas/ipsecpolicy.py +++ b/openstackclient/network/v2/vpnaas/ipsecpolicy.py @@ -56,7 +56,6 @@ } _auth_algorithms = [ - 'sha1', 'sha256', 'sha384', 'sha512', @@ -65,7 +64,6 @@ ] _encryption_algorithms = [ - '3des', 'aes-128', 'aes-192', 'aes-256', diff --git a/openstackclient/tests/unit/network/v2/vpnaas/fakes.py b/openstackclient/tests/unit/network/v2/vpnaas/fakes.py index 2cbfbe8c6a..2ce1c6e999 100644 --- a/openstackclient/tests/unit/network/v2/vpnaas/fakes.py +++ b/openstackclient/tests/unit/network/v2/vpnaas/fakes.py @@ -80,7 +80,7 @@ def __init__(self): ( ('id', 'ikepolicy-id-' + uuid.uuid4().hex), ('name', 'my-ikepolicy-' + uuid.uuid4().hex), - ('auth_algorithm', 'sha1'), + ('auth_algorithm', 'sha256'), ('encryption_algorithm', 'aes-128'), ('ike_version', 'v1'), ('pfs', 'group5'), @@ -101,7 +101,7 @@ def __init__(self): ( ('id', 'ikepolicy-id-' + uuid.uuid4().hex), ('name', 'my-ikepolicy-' + uuid.uuid4().hex), - ('auth_algorithm', 'sha1'), + ('auth_algorithm', 'sha256'), ('encapsulation_mode', 'tunnel'), ('transform_protocol', 'esp'), ('encryption_algorithm', 'aes-128'), diff --git a/openstackclient/tests/unit/network/v2/vpnaas/test_ikepolicy.py b/openstackclient/tests/unit/network/v2/vpnaas/test_ikepolicy.py index 46fa1430fc..113f1fc8a5 100644 --- a/openstackclient/tests/unit/network/v2/vpnaas/test_ikepolicy.py +++ b/openstackclient/tests/unit/network/v2/vpnaas/test_ikepolicy.py @@ -127,7 +127,7 @@ def test_create_with_all_params(self): '--description', 'my-desc', '--auth-algorithm', - 'sha1', + 'sha256', '--encryption-algorithm', 'aes-128', '--phase1-negotiation-mode', @@ -142,7 +142,7 @@ def test_create_with_all_params(self): ] verifylist = [ ('description', 'my-desc'), - ('auth_algorithm', 'sha1'), + ('auth_algorithm', 'sha256'), ('encryption_algorithm', 'aes-128'), ('phase1_negotiation_mode', 'main'), ('ike_version', 'v1'), @@ -159,7 +159,7 @@ def test_create_with_all_params(self): ) self.network_client.create_vpn_ike_policy.assert_called_once_with( description='my-desc', - auth_algorithm='sha1', + auth_algorithm='sha256', encryption_algorithm='aes-128', phase1_negotiation_mode='main', ike_version='v1', diff --git a/openstackclient/tests/unit/network/v2/vpnaas/test_ipsecpolicy.py b/openstackclient/tests/unit/network/v2/vpnaas/test_ipsecpolicy.py index 50c7ef0d66..b276f131fb 100644 --- a/openstackclient/tests/unit/network/v2/vpnaas/test_ipsecpolicy.py +++ b/openstackclient/tests/unit/network/v2/vpnaas/test_ipsecpolicy.py @@ -123,7 +123,7 @@ def test_create_with_all_params(self): arglist = [ 'my-name', '--auth-algorithm', - 'sha1', + 'sha256', '--encapsulation-mode', 'tunnel', '--transform-protocol', @@ -139,7 +139,7 @@ def test_create_with_all_params(self): ] verifylist = [ ('name', 'my-name'), - ('auth_algorithm', 'sha1'), + ('auth_algorithm', 'sha256'), ('encapsulation_mode', 'tunnel'), ('transform_protocol', 'esp'), ('encryption_algorithm', 'aes-128'), @@ -151,7 +151,7 @@ def test_create_with_all_params(self): headers, data = self.cmd.take_action(parsed_args) self.network_client.create_vpn_ipsec_policy.assert_called_once_with( name='my-name', - auth_algorithm='sha1', + auth_algorithm='sha256', encapsulation_mode='tunnel', transform_protocol='esp', encryption_algorithm='aes-128', @@ -166,7 +166,7 @@ def test_create_with_all_params_name(self): arglist = [ 'new_ipsecpolicy', '--auth-algorithm', - 'sha1', + 'sha256', '--encapsulation-mode', 'tunnel', '--transform-protocol', @@ -182,7 +182,7 @@ def test_create_with_all_params_name(self): ] verifylist = [ ('name', 'new_ipsecpolicy'), - ('auth_algorithm', 'sha1'), + ('auth_algorithm', 'sha256'), ('encapsulation_mode', 'tunnel'), ('transform_protocol', 'esp'), ('encryption_algorithm', 'aes-128'), @@ -194,7 +194,7 @@ def test_create_with_all_params_name(self): headers, data = self.cmd.take_action(parsed_args) self.network_client.create_vpn_ipsec_policy.assert_called_once_with( name='new_ipsecpolicy', - auth_algorithm='sha1', + auth_algorithm='sha256', encapsulation_mode='tunnel', transform_protocol='esp', encryption_algorithm='aes-128', From 8bb083b838299d8c270d0f78a0d7b47e11a590f9 Mon Sep 17 00:00:00 2001 From: Veronika Fisarova Date: Tue, 13 Oct 2026 14:22:52 +0200 Subject: [PATCH 4/4] Identity: Fix federation protocol create and set SDK args The migration of federation protocol commands to SDK (I4f1303b7b6c7ea2e67e5770745db060f08ba7761 / d1359947) passed the protocol identifier as name= on create. openstacksdk's FederationProtocol maps name to Body('id'), but Resource.id also maps to the same body key, so name= is silently dropped when constructing the resource. PUT create then fails with "Request requires an ID but none was found". The same migration called update_federation_protocol with idp_id= and name= kwargs instead of the required idp and protocol parameters, so set fails with a TypeError before any API request. Pass id= on create and idp=/protocol= on set, matching sibling identity provider, mapping, and service provider commands. Depends-On: https://review.opendev.org/c/openstack/python-openstackclient/+/1010170 Change-Id: Iedf8aca33e87078557daa8de1dd7591d42a2d37a (cherry picked from commit 56bc1f9e1392d823fa59bf083dbab85fb4911f0c) Signed-off-by: Veronika Fisarova Co-authored-by: Cursor --- openstackclient/identity/v3/federation_protocol.py | 12 +++++++----- .../tests/unit/identity/v3/test_protocol.py | 8 ++++---- ...ederation-protocol-sdk-args-d034c5728927d0ac.yaml | 9 +++++++++ 3 files changed, 20 insertions(+), 9 deletions(-) create mode 100644 releasenotes/notes/fix-federation-protocol-sdk-args-d034c5728927d0ac.yaml diff --git a/openstackclient/identity/v3/federation_protocol.py b/openstackclient/identity/v3/federation_protocol.py index 2dbfac10a4..5c90682c2f 100644 --- a/openstackclient/identity/v3/federation_protocol.py +++ b/openstackclient/identity/v3/federation_protocol.py @@ -80,7 +80,7 @@ def take_action( ) protocol = identity_client.create_federation_protocol( - name=parsed_args.federation_protocol, + id=parsed_args.federation_protocol, idp=parsed_args.identity_provider, mapping_id=parsed_args.mapping, ) @@ -209,13 +209,15 @@ def take_action( self.app.client_manager.sdk_connection.identity, '3' ) - kwargs = {'idp_id': parsed_args.identity_provider} - if parsed_args.federation_protocol: - kwargs['name'] = parsed_args.federation_protocol + kwargs = {} if parsed_args.mapping: kwargs['mapping_id'] = parsed_args.mapping - protocol = identity_client.update_federation_protocol(**kwargs) + protocol = identity_client.update_federation_protocol( + idp=parsed_args.identity_provider, + protocol=parsed_args.federation_protocol, + **kwargs, + ) return _format_protocol(protocol) diff --git a/openstackclient/tests/unit/identity/v3/test_protocol.py b/openstackclient/tests/unit/identity/v3/test_protocol.py index a0351e385e..acd78a6d0d 100644 --- a/openstackclient/tests/unit/identity/v3/test_protocol.py +++ b/openstackclient/tests/unit/identity/v3/test_protocol.py @@ -48,7 +48,7 @@ def test_create_protocol(self): parsed_args = self.check_parser(self.cmd, argslist, verifylist) columns, data = self.cmd.take_action(parsed_args) self.identity_sdk_client.create_federation_protocol.assert_called_with( - name=self.proto.id, + id=self.proto.name, idp=self.proto.idp_id, mapping_id=self.proto.mapping_id, ) @@ -167,9 +167,9 @@ def test_set_new_mapping(self): columns, data = self.cmd.take_action(parsed_args) self.identity_sdk_client.update_federation_protocol.assert_called_with( - idp_id=self.proto.idp_id, - name=self.proto.name, - mapping_id=self.mapping.id, + idp=self.proto.idp_id, + protocol=self.proto.name, + mapping_id=self.mapping.name, ) collist = ('id', 'identity_provider', 'mapping') diff --git a/releasenotes/notes/fix-federation-protocol-sdk-args-d034c5728927d0ac.yaml b/releasenotes/notes/fix-federation-protocol-sdk-args-d034c5728927d0ac.yaml new file mode 100644 index 0000000000..c8f227558a --- /dev/null +++ b/releasenotes/notes/fix-federation-protocol-sdk-args-d034c5728927d0ac.yaml @@ -0,0 +1,9 @@ +--- +fixes: + - | + Fixed ``federation protocol create`` and ``federation protocol set`` + after the migration to SDK. Create now passes the protocol identifier + as ``id`` (required for the Keystone PUT create URL) instead of + ``name``, which was silently ignored by openstacksdk. Set now calls + ``update_federation_protocol`` with the required ``idp`` and + ``protocol`` arguments.