ec2-api — Change history

Change history — ec2-api — branch 17.0.0

Branch 17.0.0 @ 32740781f605 — repository https://opendev.org/openstack/ec2-api (retired; local branch pre-retirement) — analysed on 2026-10-29

Raw facts: _inventory/history_17.0.0.{md,json} (history.py --since 15.0.0.0rc1).

Range

• Range covered: 15.0.0.0rc1..17.0.0 (299c898cf4af..32740781f605), 12 non-merge commits from 2022-07 to 2023-06, i.e. the two last development cycles (2023.1 "Antelope" → 16.0.0, 2023.2 "Bobcat" → 17.0.0).
• **Why not the requested 2023.1-eol..17.0.0**: 2023.1-eol is the end of the stable/2023.1 branch; its merge base with 17.0.0 is 27c479ab0cc6 (just after 16.0.0), so that range contains a single commit (#12). The automatic range (16.0.0..17.0.0) is the same single commit. The wider range is given so that the history is useful; the 2023.2 cycle alone is commit #12.
• Target project: none given. The changes are evaluated against the rewrite (openkeel-ec2-api): "carried over" means "the specification in files 01–07 already describes the new behaviour".
• No commit of the range has a release note, a DB migration, a configuration option change or a bug trailer. There is no API version concept to bump.

Change specifications

1. CreateKeyPair generates the key in ec2-api — af83b082163e

• What changed, functionally: before, CreateKeyPair asked Nova to generate the key pair (nova.keypairs.create(name)) and returned Nova's private_key. After, ec2-api generates a 2048-bit RSA key with cryptography, sends only the OpenSSH public key to Nova (nova.keypairs.create(name, public_key)), and returns the PEM private key (TraditionalOpenSSL, i.e. -----BEGIN RSA PRIVATE KEY-----, unencrypted) in keyMaterial (ec2api/api/key_pair.py:89, ec2api/api/key_pair.py:107). The keyFingerprint is still Nova's fingerprint of the public key (MD5 colon-hex) [inferred: Nova computes it on import].
• Why: Nova microversion 2.92 removed server-side key generation; ec2-api must work whatever microversion Nova negotiates. (ec2-api pins 2.32, ec2api/clients.py:59, where generation still exists; the change makes it independent of that pin.)
• Hidden second change in the same commit: the DB facade is now created with autocommit=True (ec2api/db/sqlalchemy/api.py:47), with a FIXME saying it is incompatible with SQLAlchemy 2.0. This keeps the per-statement commit behaviour that 03 § 1.3 describes, with newer oslo.db versions that changed the default. It is why ec2-api 17.0.0 requires SQLAlchemy < 2.0 (07 header: 1.4.41).
• Impact on the specification: 01 § 2.4 already describes the new behaviour; 03 § 1.3 (autocommit). No error code changes: Nova OverLimit → ResourceLimitExceeded, Conflict → InvalidKeyPair.Duplicate (ec2api/api/key_pair.py:113).
• Upgrade / operational impact: private keys are generated on the ec2-api host (entropy source of that host); the key type is fixed (RSA 2048; AWS's KeyType=ed25519 and KeyFormat=ppk are not accepted, 500 TypeError, see _rewrite/botocore-compat_17.0.0.md).
• Carrying it over: in the Go rewrite, generate the key with crypto/rsa + crypto/x509.MarshalPKCS1PrivateKey (PEM type RSA PRIVATE KEY) and golang.org/x/crypto/ssh for the public key; send only the public key to Nova. Tests: ec2api/tests/unit/test_key_pair.py (changed in the commit). Status in the spec: carried over (07 checklist "key pairs" is covered by 01 § 2.4).

12. RunInstances rejects KernelId and RamdiskId — 32740781f605

• What changed, functionally: before, KernelId/RamdiskId were resolved to Glance images and passed to nova.servers.create(kernel_id=…, ramdisk_id=…). novaclient's create does not accept these arguments, so such requests failed with an unexpected TypeError (500). After, RunInstances rejects them up front with 400 InvalidAttribute "Attribute not supported: ramdisk_id" / "…: kernel_id" (ramdisk checked first) (ec2api/api/instance.py:88, ec2api/exception.py:176); _parse_image_parameters only checks the AMI (ec2api/api/instance.py:879).
• Why: novaclient never supported these parameters on server create; kernel/ramdisk must come from the AMI's properties (kernel_id, ramdisk_id Glance properties set by RegisterImage, ec2api/api/image.py:264).
• Impact on the specification: 01 § 2.1 step 1 and 02 § 3 describe the new behaviour. Instances still report kernelId/ramdiskId from Nova's OS-EXT-SRV-ATTR:kernel_id/ramdisk_id (ec2api/api/instance.py:1498).
• Upgrade impact: clients that sent explicit kernel/ramdisk IDs (EC2-era paravirtual images, euca2ools run-instances --kernel/--ramdisk) now get a clear 400 instead of a 500. Note the attribute name in the message is the Python name.
• Carrying it over: Go: validate before any OpenStack call, same code and message. Tests: ec2api/tests/unit/test_instance.py (changed in the commit). Status: carried over.

8 and 9. Install script fixes — a17f4bdcfa9b, 0ae0b9ab477c

The same change was proposed twice under two Change-Ids (I7e9bd8b3… and I7c46a3e8…) and merged twice in parallel (merge commits e213c49 and 45ea70a); the second one brings no new content. It touches only install.sh and tools/db/ec2api-db-setup: package-manager selection, a retry loop for the MySQL root password, MySQL 8 syntax (CREATE USER … IDENTIFIED BY then GRANT, since MySQL 8 refuses GRANT … IDENTIFIED BY), mysqlclient instead of MySQL-python. The database is still created with DEFAULT CHARACTER SET utf8 (consistent with 03 § 1.1). Not part of the service; nothing to carry over except, for OpenKeel's Helm chart, creating the ec2api database with a utf8 case-insensitive collation (07 § 5).

5. Drop Babel from requirements — 750bc48c88e7

Removes Babel from requirements.txt, babel.cfg and its setup.cfg reference; translations are no longer compiled at install time. No runtime impact (messages are English, ec2api/i18n.py). Nothing to carry over.

Maintenance (not worth carrying over)

Carry-over plan

There is no target repository. For openkeel-ec2-api, both behavioural changes (#1, #12) are already part of the specification (01 § 2.1, 01 § 2.4, 02 § 3, 03 § 1.3); the install-script changes only inform the database creation of the Helm chart. If the Python tree itself had to be patched (for example an internal fork older than 16.0.0), apply in this order, with git cherry-pick -x: af83b082163e (needs cryptography, already a requirement; drop its .zuul.yaml hunk if #7 is absent), 0ae0b9ab477c (#8 is identical, pick one), 32740781f605. _inventory/history_17.0.0.md lists the generated commands.

Source: reverse-spec-ec2-api/06-change-history_17.0.0.md. The _rewrite/ and _inventory/ files are not published on the site.