Stackers Network Digest

The Big Picture

With the Hibiscus PTG behind it, the community spent this week digesting the outcomes: a wave of detailed PTG summaries from Nova, the TC, Glance, Tacker, Cyborg, Watcher, and the cross-project eventlet-removal team set the technical agenda for the 2026.2 cycle. Two things demand immediate operator attention — an Ironic command-injection CVE that finally got its number, and a coordinated push to prune stale project security teams across OpenStack. Most regular meetings were in post-PTG recovery mode; Horizon, Kolla, OpenStack-Ansible and Manila all skipped a week.

The two structural threads worth tracking: Ghanshyam Maan's plan to remove the enforce_scope policy flag (originally meant to land in 2025.2) and the revival of the long-promised "global auditor/reader" persona discussed back at Vancouver 2023. Maan is calling for a volunteer to drive the Keystone manager-role spec (818603); the feedback etherpad is still relevant.

Security

OSSA-2026-008 (errata 1) / CVE-2026-42510 — Command injection in Ironic IPMI console implementations. The advisory was initially published 27 April without a CVE; CVE-2026-42510 was assigned 29 April. A project manager for a project marked as node.owner can inject commands that the conductor executes when activating console access. Default Ironic is not vulnerable — only deployments that have set [conductor]/enabled_console_interfaces to enable ipmitool-shellinabox or ipmitool-socat. Patches: Antelope, Caracal, Dalmatian, Epoxy, Flamingo, and Gazpacho. ipmitool-shellinabox is scheduled for removal anyway (no upstream security support for shellinabox); the VMT strongly urges operators to stop using it immediately. Credit Dmitry Tantsur and Tuomo Tanskanen (Metal3.io); tracker bug 2148331.

Coresec teams need pruning. Goutham Pacha Ravi opened a frank thread — private security bugs are up, but several Launchpad coresec teams are full of people who've moved on. Specific call-outs: oslo-coresec (8 members, half inactive — Ben Nemec, Moises Guimaraes, Sean McGinnis, Vipin Balachandran), designate-coresec (4 of 7 inactive — Graham Hayes, Kiall Mac Innes, Nicolas Bock, Tim Simmons), and swift-coresec (9 is too many; notmyname, Alistair Coles, Thiago da Silva may be inactive). PTLs and security liaisons: treat this as a recurring part of the role. See the VMT process. Daniel Bengtsson opened a parallel oslo core review thread.

Releases & Announcements: PTG Summaries

Nova (summary, etherpad). Gazpacho landed 11 accepted blueprints with 9.33 implemented (84%, up from 64% in Flamingo). The Hibiscus schedule: spec review days 21 May and 4 June; soft spec freeze 28 May; hard spec freeze 11 June; M2 2 July; feature review days 4 and 20 August; FF at M3 27 August; release end-September/early-October. René Ribaud's follow-up thread confirms the spec freezes explicitly cover specless blueprints — that ambiguity bit teams during Gazpacho. Cycle-wide commitments: core +2 on a spec implies reviewing the implementation; eventlet-removal work tracked by Launchpad tag.

TC (summary, R-22 weekly). TC PTG met 20 and 24 April; recordings on the TC YouTube channel.

Glance (summary). Eventlet removal progressing; glance_store still depends via oslo.rootwrap (Cinder path). Image inspection ("Glance as defender") is a focus. S3 location credentials are coming out of the database. Parallel multi-store image import lands this cycle. Zip and LHA image decompression stay but become second-class to gzip. Ironic and Glance will discuss temp-URL generation for images. Markus Hentsch joined to discuss Nova-specific image-encryption issues.

Cyborg (summary). Full notes on etherpad.

Watcher (summary, etherpad). Native threading is the default for 2026.2; eventlet code removal scheduled for early 2027.1 (around November 2026). Prometheus deprecation in Gazpacho stays; removal deferred to align with Cloudkitty and Aodh. New work on Aetos jobs in devstack-plugin-prometheus and Application Credentials testing. Network throughput and disk-latency metrics on the planning list (bug 2142219, audit pipeline etherpad).

Eventlet Removal (summary, guide). Gazpacho added Designate, Neutron, and Cyborg to the fully-migrated list — joining Octavia, Mistral, Ironic, Heat, Barbican. Nova has five of seven services defaulting to threading; the remaining console-proxy work (noVNC, spice, serial) is the Hibiscus priority. Ubuntu 26.04 releases 29 April, so Python 3.14 testing rolls out across projects. Manila's reusable Rally-based perf framework showed no meaningful eventlet-vs-threading delta — strong evidence for the migration.

Tacker (summary), Ops Radio Hour (recap, video). Next Ops Radio Hour 29 May at 1300 UTC.

Development & Technical Decisions

Neutron Tap-as-a-Service. Brian Haley added Miro Tomaska to tap-as-a-service-core and pruned five inactive members.

Oslo + Ghanshyam. Takashi Kajinami proposed adding Ghanshyam Maan to Oslo core.

Operator bugs. Eugen Block reported a Horizon enable_dhcp checkbox desync after the Epoxy upgrade — the dashboard shows the wrong value until you toggle twice. Melanie Witt's nova-live-migration-ceph job is failing intermittently on a Module 'orchestrator' is not enabled/loaded error after mgr restart (bug 2149965); pointers to devstack-plugin-ceph install code welcomed. Taavi Ansperr filed dual bug reports (Designate 2150205, Neutron 2149807) for a floating-IP-can't-be-released issue. Joel McLean continued the disk-corruption-on-evacuate thread on Kolla 2024.1 + Ceph RBD without STONITH.

Heads Up / Action Needed

Patch Ironic for CVE-2026-42510 if you've enabled IPMI console interfaces. Plan to leave ipmitool-shellinabox behind.
SRBAC: enforce_scope removal targets milestone-2 (3 July). Cinder, Tacker, Aetos, Aodh, Barbican on the hook.
Nova spec calendar: review days 21 May & 4 June; soft freeze 28 May; hard freeze 11 June.
Neutron Drivers meeting cancelled 1 May: no agenda (open specs).
No Cinder Festival of Reviews this Friday 1 May.
Project mentors wanted for the University Partnership Program: Carnegie Mellon summer cohort starts week of 11 May, NDSU fall cohort starts 24 August. Add projects to the etherpad by 6 May.

Community & Events

The TC's R-22 summary marks the resumption of regular meetings after PTG; the bulk Launchpad ownership transfer to openstack-admins is complete. Kelvin Asante posted a correction on their Outreachy submissions (the work was intended for "Extend Ironic node deployment history API", not Manila client integration) — see the Gerrit sandbox patch and asciinema recording. Manila's weekly meeting 30 April was cancelled; regular schedule resumes 7 May.