v0.45.0

Features

• network,compute: extended port bindings and request IDs of migrations (#76)

Build & tooling

• release: dry-run builds the tag's source but runs the helper scripts from its own ref (#75)
• release: gate releases on green mainline CI, pin the toolchain, anchor the signing identity (#74)

Full Changelog: v0.44.0...v0.45.0

Build inputs

Input	Value
Tag	v0.45.0
Commit	5507fa766d819d761e5236bb07b0a61ea54fa646
Commit time (UTC)	2026-11-11T18:42:39Z
Go (pinned)	1.27.4
Go (ran)	go version go1.27.4 linux/amd64
GoReleaser (pinned)	v2.20.1
cosign (pinned)	v3.1.4
cosign (ran)	GitVersion: v3.1.4
syft (pinned)	v1.54.0
syft (ran)	syft 1.54.0
Runner image	ubuntu26 20261101.186.1
Build flags	GOFLAGS=-mod=vendor GOPROXY=off CGO_ENABLED=0
go.sum sha256	30205f04999cc77eb7a4e19ca9be41e1a46ad005003fee8bd808a1d49cd78988
vendor/modules.txt sha256	58bab83b3a04eefa76424ed51196a30ce4fb0c0a289c1ff75a5231f97cfa45b0

Rebuild: check out the tag, install the pinned Go and GoReleaser, run
make completions, then HOMEBREW_TAP_TOKEN=unused goreleaser release --clean --skip=publish,sign.
Binaries, archives and packages are pinned to the commit time and are expected to match
checksums.txt; the signature never will (it is keyless), and the SBOM bundle also
depends on the syft version above.

v0.44.0

Features

• auth: reach OpenStack through a unix-socket CONNECT proxy (#73)

Build & tooling

• deps: Bump the go-modules group with 2 updates (#71)
• deps: Bump the github-actions group with 2 updates (#72)

Full Changelog: v0.43.0...v0.44.0

v0.43.0

⚠️ Breaking changes

• rename the module to github.com/ftarasenko/koc (#70)

Features

• keymanager: add barbican secret, container, order and acl commands

Bug fixes

• kochome: refuse an embedded home another local user could control

Refactoring

• keymanager: move barbican to pkg (#69)
• baremetal: move baremetal to pkg (#68)
• placement: move placement to pkg (#67)
• dns: move designate to pkg (#66)
• loadbalancer: move octavia to pkg (#65)
• network: move BGP VPNs, FWaaS and VPNaaS to pkg (#64)
• network: move agents, service providers, extensions, BGP and tap mirrors to pkg (#63)
• network: move QoS, address scopes, subnet pools, trunks, RBAC, segments and port forwarding to pkg (#62)
• network: move networks, subnets, ports and routers to pkg (#61)
• network: move lookups, body extension, tags, floating IPs and security groups to pkg (#60)
• quota: move quotas, limits, zones, usage and extensions behind pkg/openstack (#59)
• volume: move transfers, services, pools and clusters behind pkg/openstack/volume (#58)
• volume: move snapshots, backups, types and qos behind pkg/openstack/volume (#57)
• volume: move volumes, waits and attachments behind pkg/openstack/volume (#56)
• identity: move the role, role assignment and application credential calls behind pkg/openstack/identity (#55)
• identity: move the domain, project, user, group, region, service, endpoint, catalog and token calls behind pkg/openstack/identity (#54)
• compute: move server groups, volume attachments, events and password behind pkg/openstack/compute (#53)
• compute: move the server lifecycle calls behind pkg/openstack/compute (#52)
• compute: move the migration, evacuation and host-drain calls behind pkg/openstack/compute (#51)
• compute: move the server action, interface and wait calls behind pkg/openstack/compute (#50)
• compute: move the aggregate, hypervisor and compute service calls behind pkg/openstack/compute (#49)
• compute: move the flavor and keypair calls behind pkg/openstack/compute (#48)

Tests

• kochome: cover the embedded home's error paths
• cancel the contexts three tests create

Build & tooling

• deps: Bump SonarSource/sonarqube-scan-action
• deps: Bump goreleaser/goreleaser-action
• devstack: install pip from a wheel only on the runner
• scripts: use [[ ]] for the tests in release-notes.sh and api-compat.sh
• lint: refuse a plain-HTTP redirect when downloading golangci-lint
• sonar: scan pushes to claude/** branches too
• sonar: scan on SonarQube Cloud from a workflow instead of by hand

Full Changelog: v0.42.0...v0.43.0

v0.42.0

Features

• auth: add --debug-format curl to print requests as curl commands like openstack --debug

Bug fixes

• auth: redact ironic driver passwords, json-patch values, transfer auth keys and cookies from --debug

Refactoring

• auth: name the unreadable-body placeholder and test --debug-format curl's body edge cases
• cli: share the read-twice password prompt of user --password-prompt and server --root-password

Tests

• identity: run the role and user verbs through RunE

Full Changelog: v0.41.0...v0.42.0

v0.41.0

Features

• identity: add --role/--system filters, system grants, access rules and --password-prompt

Bug fixes

• shell: Meta keys and a lone Escape no longer freeze the prompt

Full Changelog: v0.40.0...v0.41.0

v0.40.0

Features

• release: document koc shell and the embedded profile
• shell: write an audit event per line to KOC_AUDIT_FD or KOC_AUDIT_FILE
• cli: add the embedded profile for console terminals
• shell: hand over and rotate the scope with KOC_SCOPE_FILE
• shell: add koc shell, an interactive REPL over the command tree
• kochome: confine config lookups to KOC_HOME
• pkg: add public paging and endpoint-keyed name resolution
• pkg: add openstack.Session with per-region service clients
• auth: layer OS_* over a named cloud and add osc's remaining auth options

Bug fixes

• shell: record a refused line's audit event in the session's scope
• watch: stop reading the keyboard when the watch ends
• auth: honour OS_PASSWORD under OS_CLOUD and match osc's OS_* handling

Refactoring

• say why three functions and blocks are empty
• baremetal: name repeated literals and group inspection rule create's flags
• resolve: pass byName one lookup value instead of four arguments
• cli: run each invocation on a fresh tree with per-run state
• image: move the glance calls behind pkg/openstack/image
• keyvrm: move the typed request layer to pkg/keyvrm

Documentation

• proposals: record the owner's decisions on the public API's scope
• document the public Go API, its rules and the plan for the rest

Tests

• baremetal: run the deploy template, inspection rule, port group, volume and runbook verbs through RunE
• auth: keep the developer's clouds.yaml out of the auth tests

Build & tooling

• release: list Deprecated: footers under their own release-notes heading
• supply-chain: add the importer module check and apidiff
• lint: guard the public pkg/ tree against CLI imports and process state

Full Changelog: v0.39.0...v0.40.0

v0.39.0

Features

• baremetal: add --owner and --lessee to node set and unset
• baremetal: add node network show, a node's wiring across ironic and neutron
• baremetal: add shard list and node set/unset --shard
• baremetal: add volume connector and volume target verbs
• baremetal: add inspection rule create/list/show/set/unset/delete
• baremetal: add --local-link-connection to port create and set
• network: accept upstream's top-level extension list/show
• network: add provider physical network and segment columns to network list
• baremetal: add runbook create/list/show/set/unset/delete and runbook trait add/list/remove
• baremetal: add deploy template create/list/show/set/unset/delete
• baremetal: add node vmedia attach/detach
• baremetal: add node passthru list/call
• baremetal: add node history list/get and node children list
• baremetal: add node console show/enable/disable and secure boot on/off
• baremetal: add node trait list/add/remove
• baremetal: add port group create/list/show/set/unset/delete
• baremetal: show every port field and filter port list by port group or physnet
• volume: add --property filter to volume list

Bug fixes

• devstack: purge the runner's podman dnsname plugin before stacking ironic
• server: escape quotes in key='value' list cells
• baremetal: treat 1.80 as Zed's ironic cap and explain inventory below 1.81
• auth: qualify an unqualified username with --os-default-domain, as osc-lib does
• baremetal: list deploy templates and runbooks in detail with ?detail=True
• baremetal: show service_step and shard on every node view
• network: name the missing segments plugin when a segment verb gets a 404
• baremetal: read node list --long from /nodes/detail and show every node field

Documentation

• coverage: list the remaining ironic gaps by name

Tests

• functional: accept 2025.1 ironic refusing to patch a runbook's disable_ramdisk
• devstack: stack ironic API-only with fake-hardware for the baremetal tests
• functional: run ironic tests system-scoped, as ironic's defaults expect
• functional: gate ironic tests on the cloud's advertised API version

Build & tooling

• deps: Bump the go-modules group with 2 updates
• deps: Bump actions/upload-artifact
• lint: pin golangci-lint v2.14.0, which reads go1.27.2's export data
• deps: Bump anchore/sbom-action/download-syft

Full Changelog: v0.38.0...v0.39.0

v0.38.0

Features

• server: add server volume list/set and delete-on-termination on add volume

Bug fixes

• dns: qualify relative recordset names with the zone on create

Full Changelog: v0.37.1...v0.38.0

v0.37.1

Bug fixes

• server: make --wait wait for nova's task to finish, not just the status

Build & tooling

• release: leave already-released commits out of rebase-merged release notes

Full Changelog: v0.37.0...v0.37.1

v0.37.0

⚠️ Breaking changes

• server: match upstream's server list columns and name images
• server: check server create's -c before creating, and render show's columns

Bug fixes

• server: parse aggregate create's --property before creating it
• output: check --sort-column with -c before a write verb sends anything
• check -c on every write verb before it sends anything

Full Changelog: v0.36.1...v0.37.0