▤ Stackers Network

April 18, 2026

Stackers Network Digest — April 18, 2026

37 threads · 87 messages · openstack-announce, openstack-discuss

The Big Picture

This was the calm-before-the-storm week: the community was packing for the 2026.2 "Hibiscus" Virtual PTG (20–24 April). Nearly every project team — Nova, Neutron, Kolla, Cinder, Tacker, Masakari, Keystone, Watcher — cancelled its regular meeting and pointed people at PTG etherpads. The most consequential threads were the ones that set the agenda for those sessions, a Keystone LDAP security advisory operators must not miss, and the formal deprecation of the Vitrage project. The headline debate of the week was Sean Mooney's proposal to standardise a minimal agentic-coding scaffold across OpenStack projects — 25 messages, 8 participants, and easily the most discussed thread of the cycle.

Security

OSSA-2026-007 — Keystone LDAP identity backend does not convert the enabled attribute to boolean (CVE pending). Benedikt Trefzer and Andrew Bogott independently found that when user_enabled_invert=False (the default), Keystone misinterprets the LDAP enabled attribute, allowing users disabled in LDAP to authenticate anyway. Deployments using the LDAP identity backend without user_enabled_invert=True or user_enabled_emulation are affected. Affected: Keystone >=8.0.0 <25.0.1, >=26.0.0 <26.1.1, >=27.0.0 <27.0.1, >=28.0.0 <28.0.1. Patches: Dalmatian, Epoxy, Flamingo, Gazpacho master fix (merged before the 2026.1 branch cut, so no separate 2026.1 backport — fix ships in 29.0.0). Workaround: set user_enabled_invert=True with an inverted-semantics attribute (e.g. nsAccountLock) or use user_enabled_emulation. Credit Benedikt Trefzer (Cirrax), Andrew Bogott (Wikimedia Foundation), and Grzegorz Grasza (Red Hat). Trackers LP#2121152 and LP#2141713.

Releases & Announcements

2024.2 Dalmatian moves to EOL in two weeks. Előd Illés posted the heads-up: stable/2024.2 tips will be tagged 2024.2-eol and the branches deleted. Tagging patches are queued on topic:dalmatian-eol.

Vitrage deprecation. Dmitriy Rabotyagov announced the TC's decision to deprecate Vitrage: no PTL, marked Inactive since 2026.1, excluded from the 2026.1 release. The retirement proposal is governance 982869. Several xstatic libraries under Vitrage governance — dagre, dagre-d3, graphlib, lodash, moment — go with it; Venus dashboard is the only known external consumer. If your project depends on any of these, contact the TC.

RDO shifts to containers. Mike Burns updated the community: no further Epoxy RPM updates unless community volunteers pick up maintenance; no RPMs for Hibiscus. The intent is Source-to-Image containers for Hibiscus. 16+ volunteers have signed up at the rdo-volunteers etherpad including folks from Rocky Linux, OSUOSL, CERN, INFN, and CSC Finland; scope, mentorship and the fate of rdo-deps are still being worked out.

Development & Technical Decisions

Agentic coding scaffold for OpenStack — the week's biggest debate. Sean Mooney posted a proposal — built on Sylvain Bauza's openstack-agentic-workflows (nova knowledge, rules.md) — to standardise a minimal, AI-tool-agnostic scaffold for OpenStack projects: a way to ship knowledge files and review rules that work with agents.md, Cursor, Claude Code, etc. Reference implementations are in flight for Nova (more complete) and Watcher Dashboard (earlier). 25 messages, broad participation, lots of nuance — expect this to be a continued PTG topic on the TC etherpad and Nova etherpad.

Cinder encryption performance — heading to the PTG. Brian Rosmaita routed the QEMU-vs-librbd LUKS overhead conversation to the Cinder Hibiscus PTG etherpad, with pointers to a similar Ussuri-era issue tracked via Nova workaround 708030, deprecated in Wallaby (778004), and removed in Xena (805647).

Cinder CBT. Inyong Hong proposed a Changed-Block-Tracking interface for backup drivers, letting Ceph's rbd diff and NetApp's SnapDiff replace SHA256 full scans on incremental backups, with a hashing fallback.

Tox guidance. Stephen Finucane posted a PSA: stop overriding install_command for constraints, use the [testenv] constraints option he added two years ago. Especially important if you're switching to tox-uv (which doesn't install pip into the venv). Reference patches for Nova and Cinder.

Nova-API performance regression after Caracal→Epoxy. Federica Fanzago reported nova-api workers pegging 100% CPU after upgrading, only resolved by disabling the response_body_schema and query_schema validators. HAProxy OPTIONS health probes seem to be enough to trigger it. See LP#2121607.

Oslo.messaging regression risk. Arnaud Morin warned that removing his old block=True patch could resurrect bug 2035113 under native threading because heartbeats won't fire while the thread is blocked. Eventlet path is fine; native-threading path is not.

Attestation tooling — operator input wanted. Julia Kreger is collecting operator experience on attestation tooling ahead of joint Nova/Ironic PTG sessions. Questions: what tools are you using? How much do you measure beyond PCR0–7? What response do you want when attestation fails? How much state should OpenStack surface? Etherpads at Nova and Ironic.

Core-team movement. Manila completed its core cleanup; thanks went to vkmc and haixin, and new cores got powers. OpenStack-Ansible introduced an openstack-ansible-power-reviewers Gerrit group as an intermediate tier (Core-Review +2 and Backport-Candidate), with Ivan Anfimov as the first proposed member. Jay Faulkner proposed Clif Houck for ironic-reviewer (54 reviews this cycle, #8 overall). OpenStack-Helm nominated Mathieu Gagné.

OVN BGP agent issues. ajouhdy filed a substantive review of OVN-BGP-agent route-cleanup bugs on 2024.2 underlay mode: routes not removed when external gateways are cleared (prefix-length forced to /32, missing route scope), crashes removing non-existent neighbours, missing device on wire.py, and a withdraw-order bug where the LRP port is removed before its subnets/load-balancers. Looks like upstream master is similarly affected.

neutron-l2gw. Thomas Goirand asked for a Gazpacho release since 21.0.0 ships looping unit tests; the master tip works.

Heads Up / Action Needed

  • Patch Keystone (or set user_enabled_invert=True) for OSSA-2026-007 if you're on LDAP.
  • Dalmatian EOL in two weeks — get final backports merged.
  • Fill the contributor and maintainer surveys for 2026.1/Gazpacho by 30 April.
  • PTG schedule highlights: TC/Operators Hour Mon 20 Apr 1700 UTC; Ops Radio Hour Fri 24 Apr 1300 UTC (focus: observability); see PTG etherpads for project-specific sessions (Nova, Neutron, Kolla, Cinder, Masakari, Tacker, Ironic).
  • Cinder Festival of Reviews Friday 17 Apr 1400–1600 UTC, last one before the PTG (etherpad).

Community & Events

The TC's R-24 weekly summary reports that AI crawlers have been overwhelming opendev.org services (docs, mailing list, gitea); OpenDev sysadmins have rolled out mitigations. Gerrit was upgraded over the weekend — expect UI changes. The TC switched governance proposal tracking from topics to hashtags. Masakari planned two PTG slots (21 and 23 April, 06:00–08:00 UTC) covering scope redefinition (process-monitor deprecation, STONITH decoupling), testability, and cold migration. Watcher's weekly 23 Apr is cancelled, Nova's Monday 20 Apr upstream meeting is cancelled, all Neutron meetings cancelled next week, Kolla weekly cancelled, Tacker has booked PTG slots, and Ildiko Vancsa is coordinating the Ops sessions (Matrix room: #openstack-ops:opendev.org).