▤ Stackers Network

August 23, 2025

Stackers Network Digest — August 23, 2025

26 threads · 60 messages · openstack-announce, openstack-discuss

The Big Picture

Two stories defined the week. The headline is OSSN-0094, a Nova/Watcher volume-safety vulnerability that affects all supported releases, posted by Jay Faulkner to both openstack-discuss and openstack-announce. The other is a substantive community debate over how long to keep old unmaintained branches open versus EOL'ing them, with downstream packagers arguing they're essential for sharing security backports. Behind both: feature freeze for 2025.2 "Flamingo" arrives August 28, and 2026.1 "Gazpacho" PTL/TC nominations have just closed.

Releases & Announcements

Thierry Carrez posted the R-5 release countdown. Goutham Pacha Ravi's TC R-6 summary confirmed feature freeze for cycle-with-rc projects on August 28, the tested-runtimes definition for 2026.1 has been landed, and Ghanshyam Maan — long-serving TC member and former chair — will not stand for re-election this cycle.

Ian Y. Choi confirmed nominations closed Aug 20 at 23:45 UTC and TC campaigning kicked off, with platforms posted on the election site and candidate statements in the elections repo. Goutham Pacha Ravi asked candidates how they'd handle struggling-but-essential project teams — a pointed question given Monasca, Charms, Venus, and Vitrage status.

The 2025 OpenStack User Survey deadline was August 29 (survey link) — Allison Price reminded operators to update entries for existing deployments too.

Security

OSSN-0094 is the most consequential operator-facing item. Under specific Watcher zone-migration error conditions, a Nova internal volume swap followed by a live migration can leave two libvirt instances pointing at the same block device. Both the security wiki page and Launchpad bug 2112187 carry the full write-up. Exploitation requires admin rights on the project (the swap and live-migration APIs are admin-only), so the practical exposure is limited to clouds running Watcher's zone-migration strategy. Fixes are landing across both projects: nova/957759, nova/957762, nova/957764, watcher/957770, watcher/957773, watcher/957774. Nova will reject swap requests with empty migration_status (restricting that internal API to Cinder, in line with the docs), and Watcher's bespoke admin-user Keystone creation has been removed. If you're running Watcher, audit and patch.

Development & Technical Decisions

The unmaintained-branch debate. Thomas Goirand reopened a long-running question: today, branches transition from stable to unmaintained/<release>, then eventually get deleted and replaced with <release>-EOL tags. Downstream packagers (Debian, Red Hat) still write backports for serious security issues long after EOL, and an open branch — even one without CI — makes sharing those patches easier. Jeremy Stanley argued from the infra side that workflows and processes are built on the assumption that unused branches will be deleted. Six replies dug into options for keeping a lightweight patch-sharing venue without burdening project maintainers — no consensus yet, but worth following.

Related: Tim Burke's parallel proposal to EOL six Swift unmaintained branches (2023.1, zed, yoga, xena, wallaby, victoria) — all have only seen CI-maintenance patches since transition. Release patch up here.

Zuul moves to Ansible 11. Jeremy Stanley posted a heads-up: Zuul's openstack tenant switched the default Ansible version from 9 to 11 on August 18 — see the service-announce thread. Watch for new behaviors in your jobs.

Freezer / "backup as a service" thread (12 messages). Nguyễn Hữu Khôi pushed on Freezer's cindernative mode requirements and the broader backup-as-a-service question — concerns about Glance-based bottlenecks at scale, and confusion about whether Freezer agents/schedulers run client- or server-side. The centralized scheduler spec is the relevant in-flight design.

openstack-client API double-fetch behavior. Niklas Schwarz noticed the client issues two requests when looking up resources by name or ID, generating spurious stack traces in Keystone logs (~18k/day in his deployment). The first request hits v3/user/<name> (which logs a not-found), and only then does the client fall back to v3/user?name=<name>. He's proposed a client-side fix. Worth following if you operate large Keystone deployments noisy with TokenNotFound noise — and see also Marc Vorwerk's separate Keystone TokenNotFound flood report (18k/day) which may be related.

Vitrage maintenance progress. Dmitriy Rabotyagov, working on the leaderless Vitrage project, reported progress — replaced pysnmp-lextudio (no longer maintained) with pysnmp, and is debugging four Tempest test failures. Takashi Kajinami's earlier observations of three categories of breakage (oslo_context, asyncore/pysnmp, Tempest) shaped the work plan.

Broken-gate roundup. Elod Illes pinged ironic, magnum, tacker, telemetry, venus, vitrage about gate health ahead of release. Tracking is on the release-health-check-flamingo topic.

Masakari RPC ping API. do-gyun kim proposed adding a ping-style health-check RPC to masakari-engine, similar to Nova's, for use with openstack-helm in Kubernetes. Blueprint here.

Manila share-network subnet cleanup fix. Rico Lin posted a fix for subnet teardown leaving stale records when no router info is provided — important for Manila CSI users on Kubernetes (thread).

Heads Up / Action Needed

Community & Events

The Public Cloud SIG met August 27 (meetpad). Ildiko Vancsa announced the August 22 Ops Radio Hour with agenda items including Swift compliance, OVN migration, GPUs/Blazar, VMware migration, and the unassigned Keystone security bug 2117217. Tatiana Ovchinnikova cancelled the Horizon weekly meeting, and Brian Haley cancelled the Aug 22 Neutron drivers meeting for lack of quorum — open neutron-specs still need attention.