▤ Stackers Network

June 13, 2026

Stackers Network Digest — June 13, 2026

15 threads · 50 messages · openstack-discuss

The Big Picture

A heavy security backlog dominated the week: seven OSSAs and four OSSNs have shipped recently across Keystone, Ironic, Neutron, and Mistral, prompting fresh discussion about backports and the cost of maintaining old releases. Alongside that, the TC continues its push to modernize Python testing and the project build interface, Neutron is wrestling with an OVN regression and clarifying its BGP story, and operators are surfacing real-world pain upgrading from Epoxy to Gazpacho.

Security

Goutham Pacha Ravi's TC weekly summary thread is the must-read item this week. Since the last update, OSSA-2026-015 through 021 shipped, covering:

  • Keystone — five CVEs around credential delegation and RBAC bypass.
  • Ironic — script injection, path traversal, and file extraction on the conductor.
  • Neutron — tagging and port RBAC policy bypasses.
  • Mistral — policy enforcement bypass enabling arbitrary code execution.

Four security notes (OSSN-0096–0099) also landed, touching oslo.messaging RabbitMQ TLS hostname verification, Horizon RC-file metacharacter injection, Mistral auth-token exposure in workflow context, and an Ironic issue. Jeremy Stanley noted that oss-security traffic was roughly 5× last month versus a year ago, and the TC is observing that very old clouds are surfacing as vulnerable. The clear message: patch and plan upgrades now.

Thomas Goirand opened a related thread on Debian backports about the growing difficulty of keeping older releases secure across distributions — an early-stage discussion worth tracking if you maintain packages or LTS-style deployments.

Development & Technical Decisions

Python runtime policy split for libs vs. services. Stephen Finucane is proposing that OpenStack libraries and clients officially support the most recent stable Python (currently 3.14) — and ideally add a non-voting job for the next pre-release (3.15) — independently of the more conservative service runtime. The motivation: distros like Fedora 44 already ship 3.14 by default, leaving packagers and PyPI users effectively running "untested" code. Existing non-voting jobs aren't sufficient signal (see gmaan's concerns on oslo.policy review 992646). Likely path: a separate openstack-client-library-jobs template. Headed to the TC.

PTI rework lands. Stephen Finucane's project testing interface modernization series merged, standardizing pyproject.toml usage, build-dependency declaration, and bindep/dependency-group references. The TC also formally retired the outdated Golang PTI guide — not a policy against Go, just removal of dead documentation.

Neutron functional gate breakage. Terry Wilson flagged a breakage caused by an OVN branch-26.03 change that clears LSP tags lacking a tag_request (bug 2155789). A workaround is up in 991993. Terry also published a dep_version_diff.py tool to identify which dependency moved within a date range — useful for anyone hunting OVS/OVN regressions.

BGP in Neutron — two options, no clear winner yet. Tyler Wilson asked whether neutron-dynamic-routing or ovn-bgp-agent is the recommended path forward for OVN deployments, particularly for IPv4 FIP advertisement at scale (tens of /24s of /32s). The discussion did not produce a definitive direction, but it's a useful signal that operators want clarity from the Neutron team.

Bug deputy report (Neutron, Jun 1–8). Slawek Kaplonski reports a quiet week. One critical CI issue — random test_multiple_gws failures in neutron-tempest-plugin-ovn (bug 2154802) — remains unassigned.

Operator Signals

Two threads from operators upgrading from Epoxy to Gazpacho are worth watching:

Albert Braden also asked why the reader role isn't behaving as expected on an Antelope cluster with Kerberos auth and system scope — a recurring SRBAC rollout question.

Finally, an operator running ~1,000 instances asked for advice on cross-cluster greenfield migration tooling (os-migrate, Trilio, Coriolis). If you have battle scars, the thread is open.

Community & Contributor Health

Ildiko Vancsa published the next round of contributor/maintainer metrics analysis, now sourced from LFX Insights rather than Bitergia (so absolute numbers shift vs. prior rounds). Metrics include Review Efficiency Index, time-to-review, patchsets per review, and active maintainer counts across 23 project teams. Median/average time-to-merge had to be dropped this round due to data quality issues. Useful reading for anyone thinking about project sustainability.

The RDO community is reorganizing around RPM maintenance — Sherif Nagy and others are coordinating a meeting to share the build/mock/koji workload.

Heads Up / Action Needed

  • Hibiscus (2026.2) is 16 weeks out; Milestone 2 is ~3 weeks away. Mid-cycle deliverables are due.
  • Ironic mid-cycle: Julia Kreger is gauging interest and timing — vote in the Doodle poll and add topics to the etherpad.
  • Patch your clouds for OSSA-2026-015 through 021 and OSSN-0096 through 0099.
  • TC had no meeting this week (R-16).
  • Neutron drivers meeting on June 12 was cancelled; open specs are here.
  • Kolla weekly meeting on June 10 was also cancelled.
  • Feedback wanted on Stephen Finucane's proposal to officially test libraries/clients against the latest stable Python (and pre-release 3.15) before it goes to the TC.

This week in code · Week of 2026-06-13

Most active projects

See all active projects →