▤ Stackers Network

May 16, 2026

Stackers Network Digest — May 16, 2026

24 threads · 83 messages · openstack-announce, openstack-discuss

The Big Picture

One thread dominated the week: JP Jung's formal proposal to add Rust as an official OpenStack language. 32 messages, 16 participants — by far the busiest discussion — and it touches strategic nerves about where OpenStack's hot paths live. The case is framed around Keystone: every Nova, Neutron, or Swift request requires token validation, and operators are calling that overhead an "identity tax." With Eventlet on its way out as part of the Hibiscus removal initiative, asyncio constrained by the GIL for CPU-bound work, and WSGI fundamentally unable to do application-level mTLS (a requirement now arriving with PCI-DSS 4.0 and NIST 800-207), Jung argues the existing Python options have run out. Rust, by contrast, has PyO3 for incremental adoption (pyo3.rs), an experimental Keystone implementation already running, and prior community work like gtema's openstack project, codegenerator's Rust SDK, and dtantsur's rust-openstack. This is Step 1 of the new-language-requirements process; a formal TC resolution will follow. Whatever you think of Rust, expect a long conversation.

The week's other theme: security at every layer — a fresh Ironic CVE, a process discussion about how to even work on embargoed fixes, and a new IRC channel for the post-quantum migration.

Security

OSSA-2026-012 / CVE-2026-44916 — Remote code execution in the Ironic conductor when the Anaconda deploy interface is enabled. Users who can set node.instance_info['ks_template'] can execute code on the conductor because the template is rendered without sandboxing. The default configuration is not vulnerable; operators who explicitly added anaconda to [conductor]/enabled_deploy_interfaces and let untrusted users write node.instance_info are at risk. Affected ranges: >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2. Patches are landed for 2023.1 Antelope, 2024.1 Caracal, 2025.1 Epoxy, 2025.2 Flamingo, 2026.1 Gazpacho, and bugfix branches 31.0, 33.0, 34.0. Credit to Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson) from the Metal3.io security team; tracker is bug 2148307.

A new #openstack-pqc IRC channel is live on OFTC (also at #openstack-pqc:oftc.net via Matrix). Barbican PTL Mauricio Harley announced it as the coordination point for Post-Quantum Cryptography work across Barbican, Keystone, Castellan, Oslo, openstacksdk and friends — covering crypto-agility, TLS hardening, key management, image signing, and Keystone token security. The PQC popup team was approved by the TC in the same cycle.

Security process discussion. Artem Goncharov opened a thoughtful thread about how painful it is to ship security fixes under embargo: no way to run full CI against an embargoed change, and backports become "surgical chess." He flagged Gerrit's private-changes feature as a possible enabler if Zuul could be made safe for it. Relatedly, Dan Smith and Artem continued the long-running "safer way to handle untrusted disk images than qemu-img" thread.

TLS controls in Ironic. Julia Kreger floated a proposal to add TLS version and cipher knobs to Ironic, with TLS 1.3 as the default for API, JSON-RPC conductor, IPA, and oci:///https:// artifact paths; Redfish BMC access would have no default (vendors still ship TLS 1.2 and even 1.1). Outbound connections to other OpenStack services would be operator-managed via keystoneauth. Feedback wanted.

Development & Technical Decisions

TC: SRBAC moves toward closure. Goutham Pacha Ravi's R-20 weekly summary (milestone-1 of 2026.2 "Hibiscus") reports that Ghanshyam Maan plans to remove the enforce_scope configuration option by milestone-2 (July 3). Five projects still have it disabled — Cinder, Tacker, Aetos, Aodh, and Barbican — and all need help to make the transition. Maan also kicked off a "global reader/auditor" persona conversation for system-wide read-only audit access; not in the current goal, but interest is real. Venus retirement and Vitrage deprecation are progressing. The TC also confirmed Sylvain Bauza's TaCT SIG agentic-workflows repository merged, while Bauza abandoned his AGENTS.md community goal proposal after pushback that agentic tooling sharing should remain opt-in.

Contributor experience: review attention is the #1 pain. Ildiko Vancsa shared survey-round-three results. Maintainer experience trended less positive between Flamingo and Gazpacho; getting review attention is the biggest challenge across the board, and contributors reported new friction figuring out where their changes sit on team priorities. AI use is growing, with the qualifier "with caution."

Nova. PTL René Ribaud continued his core-candidacy thread asking the team for a concrete decision and concrete feedback on what would close any review-depth gap. Pavlo Shchelokovskyy is picking up the local-disk-encryption patch chain (Melanie Witt's original on Gerrit); he has a rebased version with most unit and functional tests green and wants the OK to push. Benedikt Trefzer also flagged an apparent docs error in cell0 initialization where nova-manage db sync --database_connection is rejected as an unrecognized argument.

Neutron. Lajos Katona responded to Jay See's report of DHCP-agent state-report MessagingTimeout errors with the split neutron-rpc-server services on 2026.1: the rpc-server is complaining about missing monkey patches even though DHCP, L3, and server were all moved to threading. Lajos asks for a Launchpad bug and double-check that all packages — neutron and oslo — are actually on 2026.1.

Kolla / Kolla-Ansible. Eduardo Morais (UFCG-LSD) is proposing a Kolla-Ansible OVS→OVN migration utility (code on GitHub) as an upstream contribution. Aydin Tabatabaei is interested in adding a Dell Unity Cinder backend to Kolla-Ansible and separately flagged the long-standing gap that VLAN network_vlan_ranges is undocumented and disabled-by-default in ml2_conf.ini (bug 2130725, bug 1707211). Eugen Block confirmed the multi-Ceph-pool Cinder limitation in 2024.1 — fixed from 2025.1 / Kolla-Ansible 20.0.0 onward. Michal Arbet (Ultimum) accepted his kolla-core membership downgrade graciously, attributing it to a heavy operations year (VMware→OpenStack migrations) and pledging to return to active development.

Octavia. Richard Cruise is trialling AI-agent code review on Octavia changes (agents repo). Bots can't have accounts yet, so feedback will post under his name marked AI-generated, with voting disabled.

Ironic. Afonne-Cid is retiring VirtualPDU; tracking on this etherpad and Gerrit topic.

Heads Up / Action Needed

  • Patch Ironic for CVE-2026-44916 if you've enabled the Anaconda deploy interface.
  • SRBAC enforce_scope removal target: milestone-2, 3 July. Cinder, Tacker, Aetos, Aodh, Barbican still need work.
  • Cinder Festival of Reviews Friday 15 May, 1400–1600 UTC (etherpad, ICS).
  • Horizon weekly meeting cancelled 20 May; resumes 27 May.

Community & Events

The new #openstack-pqc channel is the place to coordinate quantum-resistant crypto work. The TC R-20 summary also points to a Nigeria user-group meetup, Open Source Summit North America, and the Sweden OpenInfra user-group event in coming weeks.