▤ Stackers Network

April 11, 2026

Stackers Network Digest — April 11, 2026

32 threads · 49 messages · openstack-announce, openstack-discuss

The Big Picture

With OpenStack 2026.1 "Gazpacho" out the door on 1 April, the community pivoted hard toward two things this week: the virtual PTG (20–24 April) and the start of the 2026.2 "Hibiscus" cycle. TC chair Goutham Pacha Ravi's weekly summary set the tone: Gazpacho landed over ten thousand merged changes from 500+ contributors — three straight cycles of growth in both code and people. Underneath the celebration this was a heavy security week (two OSSAs, one Keystone privilege-escalation with a real CVE number), the TC formally moved to retire Venus and deprecate Vitrage, and an upgrade-induced oslo.messaging performance regression got a confirmed root cause.

Security

OSSA-2026-005 / CVE-2026-33551 — Restricted application credentials can create EC2 credentials. Maxence Bornecque (Orange Cyberdefense CERT) found that an authenticated user with only the reader role, calling the EC2 credential creation endpoint via a restricted application credential, can mint an EC2/S3 credential that carries the parent user's full S3 permissions — fully bypassing the application credential's role restrictions. Affected: Keystone >=14.0.0 <26.1.1, ==27.0.0, ==28.0.0, ==29.0.0. Only deployments combining restricted application credentials with the EC2/S3 compatibility API (swift3/s3api) are at risk. Patches across all supported branches plus 2026.2 Hibiscus: Caracal, Dalmatian, Epoxy, Flamingo, Gazpacho, Hibiscus. Tracker LP#2142138.

OSSA-2026-006 — DOM-based XSS in Skyline Console (CVE pending). The instance console-log viewer rendered untrusted log content into a new browser window via document.write() without sanitisation. Affected: skyline-console <5.0.1, ==6.0.0, ==7.0.0. Patches: Dalmatian, Epoxy, Flamingo, Gazpacho. Until upgraded, restrict or avoid the "View Full Log" feature for instances whose console output can be influenced by untrusted users. Credit Myunghyun Lee (Team Open the Window, Stealien SSL 6th); tracker LP#2138575.

Releases & Announcements

OpenStack 2026.1 "Gazpacho" shipped. The official release was 1 April; OpenInfra Live ran two episodes celebrating it on April 2 and April 9, with the second diving into Ironic features. A Gerrit upgrade to 3.12 was scheduled for 12 April; release-week embargo on risky infra changes lifted.

Venus retirement. Dmitriy Rabotyagov posted the formal notification: no PTL since Zed (positions have been appointment-only), marked Inactive since 2026.1, excluded from the 2026.1 release. The retirement proposal is 981959. All stable branches will be EOL'd; master will become a placeholder.

Vitrage deprecation (companion announcement). Several xstatic libraries — dagre, dagre-d3, graphlib, lodash, moment — were maintained under the Venus/Vitrage dashboards and will be deprecated alongside. Reach out to the TC if you depend on any of them.

R-24 release countdown. Thierry Carrez's first countdown email of the cycle — final 2026.2 release target is 30 September 2026.

Development & Technical Decisions

oslo.messaging delay after 2024.2 upgrade — root-caused. Max Lamprecht reported volume-attachment API time jumping from 0.4s to 2.3s and nova-metadata from 0.28s to 2.04s post-2024.2 upgrade. The culprit is oslo.messaging change 894731, which adds a time.sleep(0.5) per RPC call when heartbeat_in_pthread=True to fix bug 2035113. Arnaud Morin (the original patch author) confirmed the underlying issue and warned that simply reverting will resurrect the heartbeat bug under native threading. Likely path forward: only apply the sleep when the option is set. Worth tracking if you've seen mysterious latency after a Caracal-or-newer upgrade.

Ceph encryption: the gap is real. Ravi Sasi Tilak framed the trade-off cleanly: Cinder LUKS gives you per-tenant keys and Castellan/OpenBao KMS integration but encryption stays at the QEMU block layer (he sees 60–80% IOPS reduction); librbd-native LUKS encrypts at the right layer but rbd_encryption_load() wants the passphrase directly, no KMS. Asking the community for the right path — and offering to contribute. This dovetails into Brian Rosmaita's PTG-bound discussion of the same problem.

Manila core growth. Carlos Silva nominated Anoop Shukla (NetApp/VMware expertise) and Maurice Escher (SAP, real-world deployment perspective) to manila-core. Carlos also moved haixin and vkmc out of manila-core reflecting their shifted focus.

Nova-core candidacy. Balazs Gibizer replied to René Ribaud's earlier core-reviewer candidacy thread — the thread that becomes a more prominent discussion later in the month.

Nova-network removal in python-openstackclient. Brian Haley's cleanup patch 981613 sits at -2 over concerns that some clouds may still expose nova-network APIs (Rackspace docs). Brian opened the question — is 2013-Havana-to-2026 a long enough deprecation window?

Keystone "rewrite-in-Rust" thread. Dmitriy Rabotyagov pushed back on the in-flight idea of rewriting Keystone in a different language: he argues it should be treated as a separate emerging-technology project (per governance) rather than a replacement, and that missing features can be added to the Python Keystone directly. The discussion presaged the more formal Rust-as-an-OpenStack-language proposal that appears a month later.

Glance volume-backup-based images. Yunho Kim proposed a blueprint for a backup-volume-based image type that depends on object storage rather than the volume backend, removing the multi-AZ migration friction of snapshot-based templates.

oslotest/testtools type-stub fallout. Stephen Finucane warned that the latest upper-constraints bump pulls in typed oslotest and testtools, which break assertRaises calls and TIMEOUT_SCALING_FACTOR types in many SDK/Oslo deliverables. Hold rechecks until testtools 2.7.0 releases.

Operator pain points. İzzettin Erdem reported a Kolla-Ansible Ussuri live-migration "split-brain" — the VM ends up on the destination, Nova still thinks it's on the source, Neutron ports get stuck in migrating. 80% reproduction rate via Connection reset by peer in _live_migration_monitor. Kiran Pawar flagged that Barbican UI in Horizon is broken on devstack/Ubuntu 24.04. Lajos Katona's Neutron bug deputy report flags one High (2146769 OVN LRP claim from wrong chassis, fix 982630), a Medium on OVN security-group rule perf when network logging is enabled, and an unsupported-but-silently-accepted multicast-addresses-in-Allowed-Address-Pairs gap.

Heads Up / Action Needed

  • Patch Keystone for CVE-2026-33551 if you use restricted application credentials with EC2/S3.
  • Upgrade or restrict Skyline Console for OSSA-2026-006.
  • PTG cross-project sessions should be on Monday–Tuesday only; Goutham Pacha Ravi asked PTLs to keep project-only discussions to Wednesday onward.
  • TC/Operators Hour Monday 20 April 1700 UTC (etherpad). Drop topics even if you can't attend live.
  • Manila/Nova VirtioFS cross-project session proposed for PTG: implementation state, live-migration, hotplug, CI.
  • Ironic + Nova / Neutron sessions tentatively on Tuesday (Neutron) and Thursday (Nova).
  • Neutron Drivers meetings cancelled 10 and 17 April. When they resume, the slot moves to 1300 UTC Friday.
  • Octavia weekly meeting cancelled 15 April (thread); next meeting is the PTG session 22 April.

Community & Events

PTG registration is free; the schedule is filling fast. LFX Insights now lets you filter OpenStack project metrics by team via Repository Groups (Ildiko Vancsa shared the update; see Ironic example, bug reports here). Nguyễn Hữu Khôi shared an Instance Monitor Horizon plugin built with Codex. The Public Cloud SIG met 8 April. Horizon's 8 April weekly was cancelled.