▤ Stackers Network

November 08, 2025

Stackers Network Digest — November 08, 2025

44 threads · 117 messages · openstack-announce, openstack-discuss

The Big Picture

The week after the 2026.1 Gazpacho PTG flooded the list with summaries — Nova, Ironic, Glance, Keystone, i18n, Watcher, TC, Eventlet Removal — and one quietly significant security advisory. The Keystone retrospective doubles as a manifesto: a Rust-based optional v4 extension is being introduced because the architecture and ecosystem of the v3 era can no longer carry the load. Around it, contributors floated a new oslo.wsgi library, Glance announced a glanceclient freeze, and the TC opened a fresh debate over whether Horizon plugins should be allowed to follow pytest instead of the PTI's unittest mandate. Meanwhile operators wrestled with LXB-to-OVN migrations and Ubuntu 24.04's older OpenStack packages.

Security

OSSA-2025-002 — Unauthenticated Keystone access via EC2/S3 token endpoints (CVE pending). Reported by "kay" and announced by Jeremy Stanley on November 4: any deployment exposing /v3/ec2tokens or /v3/s3tokens to unauthenticated clients can hand out scoped Keystone tokens to attackers presenting a valid AWS signature (e.g. a presigned S3 URL). Affected: Keystone <26.0.1, 27.0.0, 28.0.0. Patches landed across Dalmatian, Epoxy, Flamingo and Gazpacho for both Keystone and Swift (Swift fixes preserve its optional S3 API). The MITRE CVE assignment has been pending since September; an errata revision is planned once issued. See Launchpad bug 2119646. Operators should audit Keystone exposure now.

PTG Summaries — What Was Decided

Keystone's Rust pivot. Artem Goncharov's update is the most consequential read of the week. The team is introducing an optional Rust extension that runs alongside Python Keystone and introduces a v4 API focused on what cloud providers need today: proper federation with self-service, passkey support, hardened security, and escape from a Python ecosystem that "broke us on setuptools, eventlet, passlib…" mod_auth_mellon being archived in CentOS/RHEL is cited as one trigger. Repos: openstack-experimental/keystone and gtema/keystone. Full notes on the PTG etherpad.

Nova 2026.1 summary. Flamingo closed with 14 blueprints accepted, 9 implemented (64% completion, down from Epoxy's 71%). Eventlet removal stays the headline goal for Gazpacho. Some 180 untriaged bugs need attention; the case-by-case post-RC1 merge policy was clarified, with Bauzas to update the contributor process docs. Cross-project sessions averaged 25–30 attendees.

Ironic 2026.1 work items are published. Jay Faulkner separately proposed promoting Afonne-CID (GR-OSS) and Doug "cardoe" Goldstein (Rackspace) to ironic-approvers, adding Jakub Jelinek (CERN, RAID expert) to ironic-reviewers, and moving Mark Goddard to emeritus.

TC PTG summary. The FIPS compliance goal may be reclassified from "selected" to "proposed" because no stable CI base remains — Rocky 10 and Alma 10 are being explored as CentOS Stream alternatives. Secure RBAC has slowed in several teams. Cross-project liaison data will migrate from a stale wiki into openstack/governance, and the OpenInfra AI contribution policy needs clearer guidance for reviewers. Recordings on the TC YouTube channel.

Eventlet removal crossed 50%: 19 deliverables fully migrated, 32 in progress. Ironic, Heat, Barbican, and Mistral are done; Neutron is one step away; Nova-api/metadata/conductor/scheduler can run in threading mode. Gazpacho focus: an opt-in H905 hacking rule, defaulting multiprocessing to spawn in oslo.service to fix known Manila/Cinder fork-deadlock bugs, and accelerating Cyborg and Magnum. Projects needing urgent attention: Blazar, Venus, Tacker, Masakari, Zun. Venus and Vitrage have been marked inactive.

Glance, i18n, and Ops Radio Hour also posted summaries. i18n is mid-migration from Zanata to Weblate (15 dashboard projects retried) with zuul-jobs and project-config patches in flight. The Ops group is consolidating under the monthly Ops Radio Hour banner; next session November 21 at 1300 UTC.

Development & Technical Decisions

Proposing oslo.wsgi. Stephen Finucane wants to spin a new oslo library out of oslo_service.wsgi to host the WSGI routing and OpenAPI validation code that services like Nova, Manila, Cinder and Ironic have been copy-pasting. The proposal also targets minimally-maintained dependencies paste.deploy and routes. Prototype: stephenfin/oslo.wsgi.

Horizon plugins vs the Python PTI. Chandan Kumar asked the TC how to resolve a contradiction: the Python PTI mandates stdlib unittest, but Horizon has built reusable pytest-based Selenium fixtures that manila-ui already consumes. Watcher's team wants to rewrite watcher-dashboard's broken tests without duplicating Horizon's framework. The TC is being asked whether the PTI itself should be relaxed for plugins.

Glanceclient freeze in the I cycle. Cyril Roelandt put 20 projects on notice that python-glanceclient enters maintenance mode after Gazpacho — switch to OpenStack SDK / OSC. Migration patches with topic remove-glanceclient already exist for ceilometer, manila, skyline-apiserver, and venus.

Tempest gate was blocked when requirements dropped Python 3.9 constraints. Ghanshyam Maan's drop-py3.9 patch plus Yatin's stable-branch fix are landing; hold rechecks until they merge. Tempest master can still target a Python 3.9 environment if installed under 3.10+.

Heads Up / Action Needed

  • 2025.2 Flamingo cycle-trailing deadline December 4. Thierry Carrez pinged Kolla (ansible-collection-kolla, kayobe, kolla-ansible, kolla) and OpenStack-Ansible (openstack-ansible, openstack-ansible-roles) — final releases pending. Schedule. stable/2025.2 branch requests come next week.
  • Release week R-20: Nov 10–14 — countdown to Gazpacho continues.
  • os-net-config — Karthik Sundaravel proposed cleaning up references to OpenDev now that development has moved to github.com/os-net-config, and asked whether the TC wants the original OpenDev repo formally retired.
  • PTG attendance numbers still wanted by Kendall Nelson (Barbican, Blazar, Cinder, Cloudkitty, Designate, Eventlet Removal, Glance, Heat, Horizon, i18n, Ironic, Keystone, Kolla, Magnum, Neutron, OSA, Helm, Sunbeam, Swift, Tacker, Telemetry, Watcher) — email ptg@openinfra.org.
  • Watcher unmaintained branch removal patch proposed after no objections.

Community & Field Notes

The list this week reminded everyone how rough OpenStack day-one still is. A new operator asked why Ubuntu 24.04's OpenStack packages are stuck on Nova 29 (Bobcat) — the answer being the Ubuntu Cloud Archive. Ricardo Matheus, after a broken Kolla-Ansible dashboard deploying 2025.2 on master, suggested the docs more clearly steer beginners toward the latest stable release. Operators continued sharing notes on the LXB-to-OVN migration (CERN's blog series and Jimm Denton's writeup remain the best starting points). Pavlo Shchelokovskyy described a working approach to scheduling NVLink-paired GPU passthrough using placement:same_subtree, custom traits, and reshaped PCI resource provider trees (review 966205). Thomas Goirand revived a long-running suggestion to fold sushy into Ironic. And a quiet thread on making core teams more accessible launched by Sean Mooney is worth watching alongside the broader contributor-experience conversation.