The Big Picture

With the coordinated 2026.1 "Gazpacho" release locked in for April 1, this week was dominated by end-game release mechanics and a sobering structural shift in how OpenStack gets packaged for Enterprise Linux. The Technical Committee's R-4 update confirmed the cycle is past feature freeze and teams are now in bug-fix-and-release-candidate mode. But the bigger story for operators was RDO formally announcing the end of its RPM builds — a change that ripples outward to the Puppet OpenStack project, CentOS Stream users, and anyone running OpenStack on Enterprise Linux.

Releases & Announcements

The Gazpacho release countdown reached week R-3 (Thierry Carrez's countdown post), with the release team pushing teams to finalize work. Jeremy Stanley issued repeated reminders to merge 2026.1/Gazpacho cycle highlights into the openstack/releases repo as soon as possible — Foundation marketing is assembling a press package and is especially interested in highlights around AI, digital sovereignty, security, and VMware feature parity. PTLs and liaisons need to resolve Gerrit comments and +1 outstanding highlight drafts now.

Kendall Nelson published the official April 2026 PTG team list (PTG runs April 20–24). Confirmed teams include Blazar, Cinder, Cloudkitty, Cyborg, Designate, Glance, Horizon, Ironic, Keystone, Kolla, Manila, Masakari, Neutron, Nova, Octavia, OpenStack-Ansible, OpenStack-Helm, Tacker, Telemetry, and Watcher, plus the TC, i18n, and adjacent communities. Yaook is attending its first PTG. Teams not on the list were told to contact ptg@openinfra.org immediately, and registration remains open.

Security

Two advisories landed this week, both worth attention:

• OSSA-2026-003 / CVE-2026-28370 (Vitrage): A remote code execution flaw in the Vitrage query parser, reported by Khalil Lemtaffah of Nokia. An authenticated user with Vitrage API access can execute code on the Vitrage host as the service user. All deployments exposing the Vitrage API are affected (Vitrage <12.0.1, ==13.0.0, ==14.0.0, ==15.0.0). Patches are available across antelope through gazpacho; the unmaintained stable/2023.1 branch received a courtesy patch but no point release.

If you run Vitrage and expose its API, treat this as a priority patch.

Development & Technical Decisions

The RDO RPM sunset is the week's most consequential operational news. Amy Marrich's "Update on RDO: A Shift to Containers" confirmed that the continuous RDO RPM builds delivered through the CentOS Cloud SIG are officially discontinued as of the Epoxy release due to insufficient contributors. RDO's future is container-focused, pivoting to Source-to-Image (S2I) builds within the openstack-k8s-operators GitHub org, expected (uncommitted) for the Hibiscus release in late 2026. These containers are primarily intended for consumption via those operators and are currently only tested on Red Hat OpenShift. Francesco Di Nucci floated whether AlmaLinux or Rocky Linux communities might pick up RPM builds; the early steer was that interested parties should engage with upstream RDO rather than fork.

Puppet OpenStack is now openly at risk. Takashi Kajinami opened a frank "[puppet][tc] Future of the project" thread laying out two existential challenges: (1) RDO's RPM discontinuation removes CentOS Stream + RDO as the project's primary (and only voting) test architecture, since it relied on trunk packages to test in-development code; and (2) upstream Puppet has effectively stalled since Perforce's acquisition of Puppetlabs, and the OpenVox fork lacks several core modules (puppetlabs-apache, puppetlabs-mysql) needed to move off it. Switching the test platform to Ubuntu/Debian would force the project out of coordinated release timing. This is an ongoing discussion, not a resolved one — operators relying on Puppet OpenStack should follow it closely.

On the Nova/Ceph front, the recurring RBD-backed instance I/O error threads continued. Sean Mooney reiterated that Nova will not monitor Ceph status or auto-pause VMs when storage goes down — guest I/O errors are the intended back-pressure mechanism, and Nova only acts on VMs via explicit API calls. Operators experiencing persistent I/O errors after compute or OSD node failures are looking for documented recovery procedures, but the upstream stance is that this is by-design behavior requiring manual or external automation.

A Nova microversion 2.100 bug surfaced via Tacker: scheduler_hints.group is returned as a list rather than the spec-required string, causing server rebuilds to fail with 400 errors and destabilizing Tacker CI (Nova bug 2139275). The Tacker team is asking Nova for a prompt fix.

The community also hit a broad CI breakage ("Another day another CI failure") where a recent tox commit caused AttributeError: 'Parsed' object has no attribute 'config_format' across pep8/docs/unit jobs; Brian Haley advised holding rechecks and filed tox issue 3866. A separate testresources/fixtures breakage was also reported.

Heads Up / Action Needed

• Requirements freeze exceptions piled up ahead of Gazpacho: Tatiana Ovchinnikova requested exceptions to unpin XStatic-Font-Awesome (4.7.0 → 6.2.1.2) and Selenium (3.141 → 4.41) for Horizon; Stephen Finucane requested low-risk bumps of testtools (2.8.4 → 2.8.5) and fixtures (4.3.0 → 4.3.1) to fix pep8 failures across SDK deliverables.
• Manila feature freeze exception: Rose Kimondo requested an FFE to land the Resource Locks panel in the Manila UI before her Outreachy internship ended March 6 (no API microversion bump or new requirements).
• Masakari leadership: With the PTL nomination window closed without a candidate, the team (Sei Sano) is asking whether Masakari can continue as an active project for 2026.2 while it develops future leadership — an open conversation with the TC.

Community & Events

The Digital Sovereignty WG is polling for its next meeting (March 17–19) and seeking volunteers for thought-leadership pieces, a comparison sheet, and a best-practices guide. The Ops Radio Hour recapped its Feb 27 session on HA architectures and backups (noting Freezer appears dormant), with the next session set for March 27 and OVN migration flagged as a top requested topic. CloudKitty nominated Juan Larriba and Jaromir Wysogla as core reviewers, and the Public Cloud SIG held its bi-weekly meeting. Five TC seats were renewed, with thanks to outgoing member Artem Goncharov (gtema).