2025.1 Epoxy Series Release Notes

stackhpc/18.4.0.75-1

New Features

  • Bumps Ceph to Squid v19.2.5.

stackhpc/18.4.0.74

New Features

  • Rocky 10.2 repositories have been updated to bring in the latest kernel version, required to address recent security disclosures.

  • Rocky 10.2 host images have been rebuilt using the latest kernel version.

Known Issues

  • DOCA OFED is not yet supported in Rocky Linux 10.2. Consider setting stackhpc_pulp_repo_rocky_10_minor_version to '1' if using OFED is mandatory.

Security Issues

  • The latest Rocky 10.2 kernel (kernel-6.12.0-211.32.1.el10_2) is now available, which addresses CVE-2026-53359 (‘Januscape’) and CVE-2026-46242 (‘Bad Epoll’).

stackhpc/18.4.0.73

New Features

  • Rocky 9.8 repositories have been updated to bring in the latest kernel version, required to address recent security disclosures.

  • Rocky 9.8 host images have been rebuilt using the latest kernel version.

Known Issues

  • DOCA OFED is not yet supported in Rocky Linux 9.8. Consider setting stackhpc_pulp_repo_rocky_9_minor_version to '7' if using OFED is mandatory.

Security Issues

  • The latest Rocky 9.8 kernel (kernel-5.14.0-687.24.1) is now available, which addresses CVE-2026-53359 (‘Januscape’) and CVE-2026-46242 (‘Bad Epoll’).

stackhpc/18.4.0.72

New Features

  • Add two new playbooks to support enabling or disabling of KVM nested virtualisation.

Security Issues

  • Playbook added to support disabling of KVM nested virtualisation in response to CVE-2026-53359. This playbook acts as early mitigation to the vulnerability in lieu of kernel patches.

stackhpc/18.4.0.67

Security Issues

  • Updates all 2025.1 container images to address multiple vulnerabilities, including all OpenStack Security Advisories (OSSA) up to OSSA-2026-023.

Bug Fixes

  • Removes use of Ubuntu multiverse repositories which were deprecated in the StackHPC Release Train.

stackhpc/18.4.0.66

Bug Fixes

  • Bumps the Horizon container image to include a fix for slow Neutron port listing in Horizon.

stackhpc/18.4.0.62

New Features

  • The ci-multinode environment has been updated to support multinode testing with Rocky 10.

stackhpc/18.4.0.61

Bug Fixes

  • Using the AIO environment, with cpu_mode set to max instances would fail to launch on Rocky 10.2 (aarch64); cpu_mode has been set to none which instructs the hypervisor to choose the default CPU model and fixes instance launching.

stackhpc/18.4.0.59

New Features

  • cephadm deployment now supported in Rocky 10; The cephadm collection has been bumped to 1.22.1 which updates the Ceph repository URL for Squid on Rocky 10. The Rocky crypto policy in use during Ceph deployment is required to be downgraded to LEGACY in order to use Ceph’s release signing key. The policy is reverted after deployment or on deployment failure.

stackhpc/18.4.0.57

New Features

  • Adds support for PCI passthrough of NVIDIA H200 SXM 141GB devices.

stackhpc/18.4.0.56

New Features

  • Adds a definition for NVIDIA GA107GL A2 to the stackhpc_gpu_data.

stackhpc/18.4.0.54

New Features

  • Adds support for Rocky Linux 9.8 host packages.

  • 9.8 is now the default release for Rocky Linux 9.

Known Issues

  • DOCA OFED is not yet supported in Rocky Linux 9.8. Consider setting stackhpc_pulp_repo_rocky_9_minor_version to '7' if using OFED is mandatory.

Security Issues

  • Rocky Linux 9.8 addresses many recent Linux vulnerabilities:

    • CVE-2026-31431 (Copy Fail)

    • CVE-2026-43284 (Dirty Frag)

    • CVE-2026-46331 (pedit COW)

    • CVE-2026-46333 (ptrace flaw)

    • CVE-2026-23111 (nf_tables bug)

    • CVE-2026-46243 (CIFSwitch)

stackhpc/18.4.0.53

New Features

  • Added support for DOCA OFED on Rocky Linux 10 (x86_64 and aarch64).

stackhpc/18.4.0.52

Bug Fixes

  • Updates Ironic images to fix invalid cross device links when deploying baremetal images using the virtualmedia boot interface.

stackhpc/18.4.0.51

New Features

  • Valkey containers have been built for Rocky 9 and Ubuntu Noble, to facilitate migrations from redis.

stackhpc/18.4.0.47

New Features

  • Repositories for Rocky 10.2 have been added, and new host and container images have been built using them.

stackhpc/18.4.0.46

New Features

  • The ci-aio Kayobe environment has been split into two distinct environments:

    • aio: Designed for manual deployment, making it significantly easier for users to set up an environment for testing and development.

    • ci-aio: Dedicated to CI testing.

    The aio environment contains the core logic, while ci-aio inherits from it and applies CI-specific overrides.

    Note that the aio environment continues to use StackHPC Release Train content, and therefore still requires credentials for ark.stackhpc.com to run.

stackhpc/18.4.0.43

Bug Fixes

  • The HighAvailability repository URL has been corrected for Rocky 10

stackhpc/18.4.0.32

New Features

  • Uses the StackHPC Ironic fork to include diskless boot support and architecture-specific virtual media ESP bootloader selection.

stackhpc/18.4.0.30

New Features

  • Bumps Ceph to Squid v19.2.4.

stackhpc/18.4.0.28

New Features

  • Adds Cinder support for VAST storage backends and Manila support for VAST multitenancy.

stackhpc/18.4.0.27

Security Issues

  • Fixes CVE-2026-42998, CVE-2026-42999, CVE-2026-43000, CVE-2026-43001 and CVE-2026-44394 with updated Keystone images.

stackhpc/18.4.0.26

New Features

  • Adds Rocky Linux aarch64 all-in-one CI jobs.

stackhpc/18.4.0.24

New Features

  • The smartmon exporter now treats historical SMART temperature and airflow threshold breaches as non-critical when calculating the smartmon_device_smart_healthy metric. This prevents disks with only a past over-temperature event from being reported as actively unhealthy.

    A new smartmon_device_historical_temperature_failure metric is exported so these historical temperature or airflow threshold breaches can still be viewed and alerted on separately as a warning if required.

stackhpc/18.4.0.21

Bug Fixes

  • Support use of pulp_enable_tls in combination with the newer pulp collection by configuring requests to use CA bundle where internal PKI is configured.

stackhpc/18.4.0.20

New Features

  • Updates to IPA image selection to continue using the CentOS Stream 9 images with Rocky 10, until Rocky 10 IPA images are stable.

  • IPA building now uses the Kayobe ipa_build_distro and ipa_build_release overrides to build, in preparation for building pure Rocky IPA images.

stackhpc/18.4.0.18

Bug Fixes

  • Fix for pulp artifact promotion playbook following on from updates to pulp.squeezer collection - the base_path attribute cannot be used when querying a file distribution.

stackhpc/18.4.0.14

Bug Fixes

  • Updates Nova container images to fix LP#2140347, where persistent disk detach could incorrectly log a failure warning.

stackhpc/18.4.0.13

New Features

  • Adds support for the Rocky Linux security repository. This repository is disabled by default, like in Rocky Linux. It can be enabled by setting dnf_enable_rocky_security to true.

stackhpc/18.4.0.11

New Features

  • Container images for Epoxy can now be built on Rocky 10.

stackhpc/18.4.0.10

New Features

  • Added four playbooks for migrating secret store from Hashicorp Vault to OpenBao.

    vault-bao-migration-seed.yml does Vault to OpenBao migration on seed node. This is single node migration, so API calls to seed secret-store can be disruptive for short period of time.

    vault-bao-migration-overcloud.yml does Vault to OpenBao migration on overcloud. (Default: controller nodes) This is HA migration, so no downtime is expected.

    vault-bao-migration-change-config.yml automatically update SKC to target OpenBao. It is recommended to use this playbook after all Vault deployments are migrated to OpenBao.

    vault-bao-migration-all.yml runs all other three playbooks in order.

    As Hashicorp Vault will no longer be supported from OpenStack 2026.1, it is strongly recommended to migrate to OpenBao before upgrading.

stackhpc/18.4.0.9

New Features

  • The pulp.squeezer collection has been updated to the latest version (0.3.0), with dependencies added and updated as required. The stackhpc.pulp collection has also been updated to it’s latest version (0.6.0). Combined, these two updates drastically improve the time taken for artifacts to be pushed to and pulled from Ark.

Upgrade Notes

  • New versions of pulp.squeezer (0.3.0) and stackhpc.pulp (0.6.0) are available, these collections and their dependencies can be updated by running a control host bootstrap.

stackhpc/18.4.0.7

Bug Fixes

  • DNF repository URLs now use $basearch instead of kolla_base_arch so hosts and build containers resolve the repository architecture locally.

stackhpc/18.4.0.3

Security Issues

  • Bumps repository versions to includes fixes for CVE-2026-31431 (Copy Fail).

stackhpc/18.4.0.2

New Features

  • Adds support for syncing x86_64 and aarch64 RPM repositories from StackHPC Ark into local Pulp using stackhpc_pulp_rpm_architectures.

stackhpc/18.4.0.1

New Features

  • Added support for DOCA OFED on Rocky Linux 9 aarch64.