▤ Stackers Network

August 30, 2025

Stackers Network Digest — August 30, 2025

21 threads · 48 messages · openstack-discuss

The Big Picture

This was feature-freeze week for Flamingo (2025.2) — Elod Illes posted the R-4 release countdown and Thierry Carrez followed with a list of cycle-with-intermediary deliverables that had not yet cut any 2025.2 release. Two structural stories dominated the discuss list: a Keystone-Epoxy upgrade trap that can silently strand thousands of users with unsupported password hashes, and the start of 2026.1 PTL/TC voting under new OpenInfra Foundation membership semantics that threaten to shrink the electorate.

Releases & Announcements

Six cycle-with-intermediary deliverables — bifrost, ironic-inspector, ironic-prometheus-exporter, ironic-ui, networking-generic-switch, and swift — had no Flamingo release as of late August, and Carrez asked teams to ship before September 12 so the final 2025.2 release has something current to cut.

Ian Y. Choi opened polls for the combined 2026.1 PTL and TC elections on August 27 — voting closes September 17 at 23:45 UTC. Four TC seats and the Horizon PTL race are on the ballot. Eligibility is tied to OpenInfra Foundation individual membership and contribution to an official project deliverable repo between Sep 13 2024 and Aug 20 2025; check spam for CIVS emails or opt in here. Goutham Pacha Ravi's TC R-5 summary noted that four project teams (Monasca, OpenStack Charms, Venus, Vitrage) have no PTL nominees — the TC will handle these via appointments after the election concludes. Rafael Weingärtner self-nominated for CloudKitty PTL again.

Security

The headline security item is OSSN-0094: Jay Faulkner announced an information-disclosure vulnerability in Nova and Watcher that affects all supported releases. The bug — Launchpad 2112187, full advisory at OSSN/OSSN-0094 — arises when Watcher's zone-migration strategy performs a Nova internal-only volume swap and then a live migration in sequence: in some error cases connection details fail to update, leaving two libvirt instances referencing the same block device. Exploitation requires admin rights on the project (the swap and live migration APIs are admin-only). The fix lands across Nova (rejecting swaps with empty migration_status) and Watcher (removing Watcher's bespoke Keystone-user creation and the Cinder volume-migration code that depended on it). Patches are in flight for both projects: nova/957759, nova/957762, nova/957764, watcher/957770, watcher/957773, watcher/957774. Audit Watcher usage and apply when available.

Development & Technical Decisions

The Keystone Epoxy (2025.1) upgrade footgun. Dmitriy Rabotyagov issued a sharp warning to operators: the removal of sha512_crypt and bcrypt support in Epoxy was documented as a "corner case" in upgrade notes, but in his fleet of old (Newton-era) deployments it affected four-figure numbers of users. After upgrade, those users simply can't log in. Until users reset their passwords with a supported algorithm, they're stranded. He included a MySQL query operators can use to find affected users before upgrading. If you maintain old deployments, run it before Epoxy.

eventlet-removal status check. Chris Friesen asked about the state of the oslo.service eventlet-removal spec — the Epoxy spec lists no blueprint, and Chris wanted to know whether the threading backend is the canonical plan and what limitations it has. Backend docs are here.

oslo.messaging QManager containers regression. Dmitriy Rabotyagov flagged an old issue blocking some upgrades: a regression introduced and backported to 2024.1 to fix QManager in containers doesn't account for os.getpgrp() returning 0 in edge cases, which breaks database syncs for Nova during upgrades. A fix has been pending since January, and Dmitriy proposed an alternative. Reviews are the ask.

Metalsmith heading toward retirement. Jay Faulkner proposed making the already-cut Flamingo release the final one ever for Metalsmith, with the master branch retired after Flamingo ships. Functionality has been folding into Ironic's API and standard clients for nearly two years.

Swift unmaintained-branch cleanup. Tim Burke proposes EOL'ing six Swift unmaintained branches (2023.1, zed, yoga, xena, wallaby, victoria). None has had real activity beyond CI maintenance; the release patch is up for objection.

Broken gates flagged. Elod Illes pinged ironic, magnum, tacker, telemetry, venus, and vitrage about broken gates on master ahead of 2025.2; the release-health-check-flamingo topic tracks open fixes. Yasufumi Ogawa quickly merged a fix for tacker-horizon.

The pagination http-vs-https href issue in Nova and Neutron API responses (Chang Xue) drew confirmation it's specific to those services — Keystone, Heat, and others return either https or schemaless paths. James Denton's logical port statistics question for ML2/OVN drew a suggestion from Rodolfo Alonso to extend OVN network logging (currently security-group focused) as an RFE.

Heads Up / Action Needed

  • OSSN-0094: audit Watcher usage; apply Nova/Watcher patches when available.
  • Before upgrading to Epoxy, run the Keystone hash query on your local_user table and reset passwords for users still on sha512_crypt or bcrypt.
  • Vote in the 2026.1 elections by Sep 17 23:45 UTC. Renew OpenInfra Foundation individual membership if it lapsed; opt in to CIVS emails.
  • bifrost, ironic-inspector, ironic-prometheus-exporter, ironic-ui, networking-generic-switch, swift: cut a Flamingo release before September 12.
  • Manila Flamingo bugsquash Sep 2–4 — etherpad, meetpad; kick-off Sep 2 at 1400 UTC.

Community & Events

The OpenStack User Survey deadline was August 29 (survey link); operators reported usability glitches in the ranking and i18n sections. The Public Cloud SIG met August 27 (meetpad). Ildiko Vancsa recapped the August 22 Ops Radio Hour, covering OVN migration (with CERN's LxB→OVN walkthrough blog post), GPU and Blazar reservation interest, VMware migration (whitepaper here), the vTPM live-migration spec, and the unassigned Keystone security param bug 2117217. Pierre Riteau also flagged that the Blazar dashboard contains non-free minified JavaScript — a packaging concern worth addressing. Jay Faulkner canceled the September 1 Ironic meeting for US Labor Day.