heat — Change history

Change history — heat — branch stable/2026.2

Branch stable/2026.2 @ 5872396e548c (27.0.1) — range 2a59df07c8e9..5872396e548c (automatic: where stable/2026.2 left master), 3 non-merge commits — no target project given (presence not computed) — analysed on 2026-10-29. Raw facts: [_inventory/history_stable-2026.2.md](_inventory/history_stable-2026.2.md).

The branch is young: between the branch point (27.0.0, before rc1) and 27.0.1 it received the two release-bot commits every stable branch gets and one security backport. Everything else in 01–05 is the behaviour of 27.0.0.

3. Validate access to config_id in software deployment — security

• Commit: 5872396e548c9532bd15bd62dfb27d9dc73a67be (backport of master 21d77cc23148) — review https://review.opendev.org/q/Ie415da0add79387a04815a567f3e8de54ab09837 — story 2011905, task 55802.
• Before / after: software configs are project-scoped (a non-admin only sees configs whose tenant is their project, heat/db/api.py:1515-1525), but software_deployment_create and software_deployment_update only relied on the config_id foreign key: any config id that existed, in any project, was accepted, so a user who learned another project's config id could attach it to their own server and receive its script, inputs and possibly secrets through the deployment metadata. A non-existent id raised DBReferenceError, turned into Invalid → 400 Config with id <id> not found. Now both functions first load the config through _software_config_get with the caller's context (heat/db/api.py:1561-1567, heat/db/api.py:1636-1643): a config that does not exist or belongs to another project (non-admin caller) raises NotFound → 404 Software config with id <id> not found (FaultWrapper maps NotFound to 404, heat/api/middleware/fault.py:60). Admins still reach every config.
• Why: missing authorisation check on a cross-project reference (release note releasenotes/notes/story-2011905-8493f4c11d9d869b.yaml, section security).
• Impact on the specification: 01 software deployments (POST now lists 404; text updated); error status for an unknown config_id changes from 400 to 404 and the message from Config with id … to Software config with id …. No new exception class, policy rule, RPC version or table change. The OS::Heat::SoftwareDeployment resource calls the same RPC methods, so a deployment resource pointing at another project's config now fails with NotFound in the stack's status_reason [inferred].
• Upgrade / operations: no migration, no option. Existing deployments already referencing a foreign config are not touched; updating them with the same config_id will now fail for a non-admin caller [inferred]. Clients that matched the old 400 text must accept 404.
• For OpenKeel: the Go engine must load the config with the caller's project scope before creating or updating a deployment and answer 404 with the new message — the rewrite pack's error table already lists NotFound → 404.
• Carrying it over: no prerequisite; self-contained change in heat/db/api.py (+6/−13); tests heat/tests/engine/service/test_software_config.py (test_create_software_deployment_invalid_config_id, test_create_software_deployment_unauthorized_config_id, test_update_software_deployment_invalid_config_id, test_update_software_deployment_unauthorized_config_id); clean backport (no conflict note). Older branches whose software_deployment_create still has the DBReferenceError block take it as is; branches without that block (before its introduction) need the two _software_config_get lines only.

git cherry-pick -x 5872396e548c9532bd15bd62dfb27d9dc73a67be   # security: Validate access to config_id in software deployment

Maintenance-only changes

Source: reverse-spec-heat/06-change-history_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.