Stackers Network Digest — May 23, 2026

The Big Picture

Two stories anchor the week. First, OVHcloud's Xavier Nicolle put down an unusually candid marker: the public-cloud operator wants to do all of its next round of networking engineering upstream from day one. The umbrella post covers three workstreams — a VPC object service (codename "Orion"), a modern VPN-as-a-Service, and a Web Application Firewall-as-a-Service — with a dedicated follow-up thread for Orion already posted. Nicolle is explicit that Neutron stays the networking implementation and Keystone stays the identity primitive; what is missing, he argues, is a first-class VPC object that can carry cross-region peering semantics. Expect Neutron drivers to be the venue for that conversation — the team has an agenda page and Nicolle is explicitly soliciting pointers to in-flight specs, retired projects, and prior art before OVHcloud commits a design.

Second, the gate is on fire. Ghanshyam Maan and Melanie Witt flagged that the tempest-slow-py3 job is failing 100% on test_server_volume_attachment, and the same bug is sinking nova-next as well. Cinder, Tempest and Nova gates are blocked. Hold rechecks and watch bug 2153382 until it's fixed.

Security

The Ironic team shipped OSSA-2026-013 (CVE-2026-44919), a denial-of-service in Ironic's image-handling code. An authenticated user with node.instance_info write access can request a special-file path such as file:///dev/zero as a deployment image; the auto-checksum logic happily reads the file forever, pinning a conductor thread. Repeat at scale to exhaust the conductor pool. The bug was introduced as the follow-up softening of CVE-2024-47211. Affected ranges are >=23.0.4 <29.0.6, >=30.0.0 <32.0.2, and >=33.0.0 <35.0.2. Patches are up across the full support matrix: Antelope and Caracal (unmaintained), 2025.1 Epoxy, 2025.2 Flamingo, 2026.1 Gazpacho, and 2026.2 Hibiscus, with bugfix branches 33.0 and 34.0. Credit to Erichen of the Institute of Computing Technology at the Chinese Academy of Sciences; tracker is bug 2150332.

On a related note, Dan Smith continued the "is there a safer way to handle untrusted disk images than qemu-img" thread, pushing back on a proposal to run inspection out-of-process and reiterating that Glance already does stream inspection (using oslo.utils' format_inspector) without ever landing a qcow2 on disk before flagging it.

Development & Technical Decisions

Kolla-Ansible dominated operator traffic. Johannes Kastl drove a string of practical questions worth surfacing: TLS-cert rotation with Let's Encrypt across the HA control plane (the docs cover the LE generation path and there's an existing haproxy-ssh update script); how to layer host-specific inventory cleanly when the multinode doc and quick-start contradict each other; a nova_libvirt failure on 2026.1 + RockyLinux 10.1 where nova-compute never registers; and what the inventory groups actually mean. Separately, Taavi Ansperr asked the community for the lowest-downtime path from 2025.1 to 2025.2 on combined compute+network nodes; respondents flagged the redis-to-valkey migration as the must-do prerequisite. There's also a known limitation on multiple Ceph pools in cinder.conf — fixed in Kolla-Ansible 20.0.0; on 18.8.0 you'll need to override the template.

Cinder is recruiting cores. Jon Bernard nominated Erlon R. Cruz and Anthony Gamboa for the Cinder core team; threads stay open one week. Cruz himself has a separate proposal to avoid redundant rescans on target-driven-rescan arrays in os-brick, soliciting vendor input on the trade-off between attachment speed and rescan correctness.

Nova governance. PTL René Ribaud restated his contributor-hat candidacy for Nova core reviewer after a values-and-process exchange with Julia Kreger, and used the moment to flag a wider issue: Nova has a review-capacity gap and needs a more deliberate path for growing the core team.

TC notes. Goutham Pacha Ravi's weekly TC summary marks R-19 to the 2026.2 "Hibiscus" release. Stephen Finucane has posted a batch of governance patches reworking the Python Testing Interface — dependency groups, release notes, the Python testing guide — that maintainers of tox configurations should review. Venus retirement and Vitrage deprecation are blocked on the TC lacking ACLs to empty the repos; Dmitriy Rabotyagov will update the project-team-guide retirement docs to clarify ordering. Ansible SIG co-chair changes reached lazy consensus.

Devstack. First-time contributor Ondrej Vaško is seeking review on devstack-plugin-ceph 978987, fixing the RadosGW code path and adding Ceph-version selection.

Heads Up / Action Needed

• Hold rechecks on tempest-slow-py3 and nova-next until bug 2153382 merges.
• Patch Ironic for CVE-2026-44919 across all supported branches.
• Neutron meetings cancelled: Drivers Fri May 22, CI Mon May 25 (holiday). Open specs list is here.
• Octavia weekly meeting cancelled next week.
• Nova upstream meeting cancelled Mon May 25.
• Neutron bug deputy Miro Tomaska reported one High (2152829, TaaS OVS agent), several Mediums, and a cluster of BGP-feature bugs being worked by Eduardo Olivares and Jakub Libosvar.

Community & Events

The Public Cloud SIG held its bi-weekly meeting on 20 May at meetpad.opendev.org/publiccloud-sig — Kees Meijs couldn't chair because he was off to the SCS Summit in Berlin and suggested zero-day exploit response as a discussion topic. Jay Faulkner published a video summary of Ironic's 2026.2 PTG work-items doc on the G-Research OSS YouTube channel — recommended viewing if you operate or contribute to bare metal.