▤ Stackers Network

April 25, 2026

Stackers Network Digest — April 25, 2026

33 threads · 49 messages · openstack-announce, openstack-discuss

The Big Picture

This was PTG week. The 2026.2 "Hibiscus" Virtual PTG ran Monday 20 April through Friday 24 April, so the mailing list was quiet on day-to-day operations and busy with planning. The substantive news falls into three buckets: a Neutron security note operators must act on, several governance/core-team shifts, and the first wave of decisions coming out of PTG sessions. The most-watched governance thread of the week was Stephen Finucane's four-option vote on the future shape of nova-core — an approval-voting exercise to break a deadlock on whether to introduce Ironic-style nova-approver/nova-reviewer tiers.

Security

OSSN-0095 — OVN security-group rules created before address-group support may be ineffective. This is an operator-side action item, not a CVE. In Neutron OVN ML2 deployments, security-group rules that referenced remote address groups before OVN address-group support was added were silently no-ops: the Neutron API accepted them, but the OVN driver dropped the reference, producing ACLs with no source-address constraint (effectively allowing 0.0.0.0/0). New rules work fine after upgrade, but pre-existing ones aren't fixed, neutron-ovn-db-sync-util repair mode doesn't correct them, and deleting an affected rule orphans the ACL in OVN — which continues to pass traffic. Affected: neutron OVN ML2 driver <25.2.3, >=26.0.0 <26.0.3, >=27.0.0 <27.0.2. Fix: Gerrit 976832 adds a maintenance task that auto-creates the missing address sets and updates affected ACLs on service restart. Upgrade, restart Neutron, then verify orphaned ACLs from previously deleted rules are gone. Credit James Denton (Rackspace); tracker LP#2141589. Full OSSN at the wiki.

Releases & Announcements

Kolla images: pre-Zed removal. Michał Nasiadka announced that all pre-Zed Kolla container images in the quay.io/openstack.kolla organisation will be permanently removed on 1 June 2026. If you still depend on those tags, migrate now.

Development & Technical Decisions

Nova-core governance: four-option vote. Stephen Finucane filed four parallel Gerrit changes — 986141, 986142, 986143, 986144 — capturing four proposals for the future of nova-core, inspired by Sean Mooney's earlier idea to introduce nova-approver and nova-reviewer groups (Ironic-style) so cross-project SMEs can land integration features faster. Cores +1 the options they're OK with and -1 ones they're not; +0 is neutral. The winning proposal runs through the H cycle and gets evaluated at the next PTG (October 2026). Patches should not be merged during voting.

Kolla core team changes. Michał Nasiadka proposed moving Christian Berendt (cberendt) to emeritus, moving Michal Arbet (kevko) from kolla-core to kolla-reviewers, and promoting Bertrand Lanson (blanson) from kolla-reviewers to kolla-core. Other nominations the same week: Clif Houck as ironic-reviewer, Mathieu Gagné as openstack-helm core, and Ghanshyam Maan to Oslo core (Stephen Finucane's belated +1). Dmitriy Rabotyagov added Ivan to the OSA Power Reviewers group.

Python 3.14 testing — early signal. Sean Mooney's DevStack + uv + Python 3.14 experiment is producing real results ahead of Ubuntu 26.04. The DNM patch 985735 uses uv to provide the interpreter and isolates DevStack venvs from host Python; several substantial jobs already pass, including tempest-multinode-full-py3 — a wide-cross-section run that boots, migrates, resizes and multi-attaches. swift-dsvm-functional also passes. A known noVNC-proxy pickle issue still breaks several jobs. Project teams wanting a baseline can crib his nova DNM patch.

PTG Summaries already posted (others arrive next week). - Cinder (summary). - Magnum (summary, etherpad) — the community continues to position Magnum as a wrapper for third-party drivers, with the Heat-based driver deprecated. Vexxhost's magnum-cluster-api is actively maintained; magnum-capi-helm has seen no activity since Dec 2025. Long-term goal: support running both drivers side-by-side in one installation. New bi-weekly meeting at 13:00 UTC. Zuul CI for drivers and ubuntu-noble-32GB nested-virt labels for devstack-plugin-container/Sonobuoy smoke tests are on the roadmap. - i18n (summary, etherpad) — Weblate migration progressing; virtual sprint proposed around 3 June (14–16 UTC). KNU AI-translation PoC supports 44 languages with an Ollama-based 4-step pipeline that preserves human translations.

Operator issues. Dmitriy Rabotyagov flagged that Zun is broken in 2026.1 under the constrained oslo.db, because the service still uses the legacy engine facade removed in 2026.1; Gerrit 982362 has been waiting for Zun-core review for a month. Lajos Katona will release neutron-l2gw for Gazpacho this week. Joshua Cornutt is asking for review attention on five small Barbican bugfixes sitting in Gerrit since 3 April — notably 983320 which fixes LP#2147221 (P-521 EC curves rejected by order validator). Jiatong Shen asked how to remove orphaned Cyborg GPU devices (LP#2150086).

Neutron bug deputy. Helen Chen's report 13–20 April flags several High-priority unassigned bugs: ovn_maintenance_worker deleting a healthy router external gw LRP (can leave FIPs unusable), Chassis_Private record desync after Chassis deletion, and an OVSDB-race infinite-retry loop creating ovn_ipsec VPN. Also: a BatchNotifier thread leak post-eventlet-removal regression with a fix in test.

Heads Up / Action Needed

  • Apply OSSN-0095 fix to Neutron (or upgrade to 25.2.3 / 26.0.3 / 27.0.2) and audit OVN ACLs.
  • Vote on Nova-core proposals (986141–986144) if you're a Nova core.
  • Migrate off pre-Zed Kolla images before 1 June 2026.
  • Fill in the maintainer and contributor experience surveys for Gazpacho — they now include AI-tool questions.
  • Zun-cores: please review 982362 before more operators trip over the broken 2026.1 release.

Community & Events

The TC R-23 weekly summary lays out the TC's PTG agenda (Monday TC/PTL forum + Operators' forum, Friday user-survey/AI-contribution-guidelines/PQC-popup/Contributor-Experience-WG sessions) and notes that 12 project Launchpad teams were still owned by individual contributors rather than ~openstack-admins. The Ops Radio Hour ran 24 April and is now penciled for 29 May; topics raised: barriers to upstream contribution, the future of the legacy operations-guide and arch-design docs, day-2 challenges. Horizon hosted OpenInfra User Group Kenya's session at the PTG, led by former Outreachy intern Agnes Nduta. The Public Cloud SIG met 22 April. Matthew Oliver invited operators to the Swift Ops Feedback session (etherpad). And the OpenInfra Jobs Board has moved to LF GitJobs — if you're hiring, post there.