▤ Stackers Network

November 22, 2025

Stackers Network Digest — November 22, 2025

33 threads · 71 messages · openstack-announce, openstack-discuss

The Big Picture

A quieter, more operator-flavored week, bracketed by the re-publication of the Keystone EC2/S3 advisory (now with a MITRE-assigned CVE) and a steady drumbeat of deprecation and cleanup work as teams settle into the Gazpacho cycle. The most interesting development threads were about thinning the codebase: dropping abandoned crypto dependencies as a first step toward post-quantum readiness, removing eventlet from neutron-dynamic-routing, and questioning whether little-used Keystone middlewares should survive. Operators, meanwhile, kept hammering on GPU/PCI passthrough, RabbitMQ packaging changes, and machine-identity gaps. We're at R-19 toward the 2026.1 "Gazpacho" release.

Security

OSSA-2025-002 (CVE-2025-65073) re-published with errata. Jeremy Stanley re-issued the Keystone EC2/S3 token endpoint advisory (also on openstack-announce). MITRE assigned CVE-2025-65073 after publication, the description was clarified about token ownership, and fixes for the unmaintained/2024.1 branches are now included. The flaw allows an unauthenticated attacker who can reach /v3/ec2tokens or /v3/s3tokens to use a valid AWS Signature (for example, from a presigned S3 URL) to obtain Keystone authorization for the signing user — ec2tokens can yield a fully scoped token. Affected: Keystone <26.0.1, ==27.0.0, ==28.0.0. Patches now cover Caracal Keystone and Swift, Dalmatian Keystone/Swift, Epoxy Keystone/Swift, Flamingo Keystone/Swift and Gazpacho Keystone/Swift. If those endpoints are exposed publicly, patch.

Post-Quantum Cryptography prep — drop abandoned deps. Artem Goncharov took the first concrete action toward Post-Quantum readiness by proposing to remove three unused or abandoned dependencies from openstack/requirements: passlib (968443 — already retired from Keystone, only transitively pulled by Kolla/OSA), scrypt (968444 — superseded by cryptography's scrypt) and python-gnupg (968445 — no longer used by codesearch). Action points are being tracked on the post-quantum wiki.

Releases & Announcements

The TC weekly (R-19) confirmed Milestone-1 has passed for Gazpacho, and the SIG governance cleanup — consolidating governance-sigs into the main governance repo — is wrapping up. A follow-up resolution documents the os-net-config handover after that project's maintainers removed OpenStack CI and corrected its PyPI author metadata. The Telemetry team welcomed Juan Larriba (jlarriba) back as PTL for the cycle. (Schedule)

Magnum PTG summary landed (slightly behind some others): Dale Smith's recap reiterated there's no migration path from Heat to Cluster API (rebuild your clusters), documentation will be rewritten without Heat references, and mnasiadka is on CI for CAPI drivers in Gazpacho. Labels work continues (943358, 955549).

Development & Technical Decisions

neutron-dynamic-routing needs help finishing eventlet removal. Rodolfo Alonso Hernández asked the list for users or developers of neutron-dynamic-routing to step up. After Neutron's eventlet cleanup removed helper methods the DR project depended on, the team has been refactoring the DR agent (similar to the DHCP/L3 agent work). However, the DR agent is still failing, possibly because of an os-ken implementation issue, and the Neutron team doesn't have bandwidth to debug it. (Neutron meeting log)

Hacking: relax H301/H303 for typing imports. Stephen Finucane proposed exempting collections.abc, types and typing from H301 (one-module-per-line) and H303 (no wildcard imports). Without the exception, type-hinted signatures become unreadable. The patch is up at hacking/+/967719, with Ghanshyam Maan and others discussing scope.

Watcher to deprecate the Prometheus datasource. Joan Gilabert announced deprecation of the Prometheus datasource in favor of Aetos, which provides the same functionality plus multi-tenancy and Keystone-based auth. Decision was made at the Gazpacho PTG; deprecation patch at watcher/+/966672.

Are EC2Token/S3Token middlewares in keystonemiddleware still used? Takashi Kajinami asked the community whether anyone uses the EC2Token or S3Token middlewares maintained in keystonemiddleware (distinct from Swift's S3Token). The s3token-middleware fix in +/926459 — which had been broken since the identity v2 API removal until 2024 — is taken as evidence of no usage. With CVE-2025-65073 now requiring authenticated access to those endpoints, the team is considering deprecating these middlewares this cycle and removing them in the 2026.2 "H" release. Arnaud Morin later confirmed OVH's setup isn't using the keystonemiddleware copy.

Horizon: stop inlining SCSS on every page. Radomir Dopieralski proposed moving Horizon's compiled SCSS from inline <style> blocks to linked stylesheets (horizon/+/966665). The change requires Horizon plugins to update _components.scss imports — feedback from plugin maintainers is being requested before merging.

Machine identities — still a gap. Ricardo Cano's question about an OpenStack equivalent to AWS IAM roles for EC2 / Azure managed identities drew the usual answer from Sean Mooney: no built-in support, only experiments with JWT issuance that were never upstreamed. Nathan Harper noted his organization has been discussing the same problem with users.

Heads Up / Action Needed

  • RabbitMQ repository URL change for Debian/Ubuntu. Dmitriy Rabotyagov explained that RabbitMQ has switched from ppa1.rabbitmq.com to deb1.rabbitmq.com, breaking existing OpenStack-Ansible deployments. He posted a workaround using rabbitmq_repo_url overrides plus a GPG-key import per RabbitMQ's docs; proper backports for maintained branches are in flight. Kolla 2023.1 users are seeing the same upstream change (Kolla bug 2131736, kolla/+/967475).
  • devstack and hacking core member updates. Ghanshyam Maan proposed adding gibi to devstack core and stephenfin and sean-k-mooney to hacking core; objections were due November 21.
  • OpenStack-Ansible operators: update RabbitMQ repo (see above) and watch for backported fixes.

Community & Events

The Ops Radio Hour for November 21 was hosted by Ildikó Váncsa (reminder); discussion topics centered on refactoring Ops activities (Thierry Carrez's earlier proposal) and the Matrix room the group has adopted for between-meeting chat. Manila's weekly meeting on Nov 27 was cancelled for quorum (Goutham Pacha Ravi expects more cancellations into year-end). The Cinder Festival of Reviews ran November 21. Public Cloud SIG met November 19.

The Nova bug triage volunteer roster is still open — René Ribaud is gathering names.