Stackers Network Digest — June 27, 2026

The Big Picture

With the 2026.2 "Hibiscus" release fourteen weeks out, this week's traffic centered on two themes: tightening security posture (a fresh Swift SSRF advisory plus a community-wide call to action on security documentation), and finishing long-deferred policy and API cleanups before milestone-2. Operators also surfaced real pain around EC2 credential UX, Cinder HA, and RabbitMQ quorum queues, while the TC continued tidying up retired projects and contributor recognition.

Releases & Announcements

The release team marked week R-13 in the 2026.2 Hibiscus countdown. The next major checkpoint is Membership Freeze and Milestone-2 on July 2 — PTLs and DPL liaisons should make sure release-worthy deliverables are registered, and prune any that won't ship this cycle (countdown, TC summary).

Security

OSSA-2026-024 / CVE-2026-50221 — Tim Shephard reported a server-side request forgery in Swift's proxy-server triggered via header injection: an authenticated user can coerce object servers into outbound HTTP requests to attacker-chosen hosts. The advisory affects Swift ≥2.0.0 with patches landing across Hibiscus, Gazpacho, Flamingo, and Epoxy. Operators should update promptly (OSSA-2026-024, LP #2150261).

Security documentation crisis. Jay Faulkner sent a wide-ranging call to arms arguing that OpenStack's recent OSSA volume (more this year than in any year of the past decade) is hiding a deeper problem: drivers — particularly several Cinder and Manila backends — that are not, or cannot be, configured securely by default in a modern threat model where dedicated storage networks are no longer a given. He cites six recent OSSAs and a kolla-ansible bug as evidence that operators aren't being given the documentation or tools to assess risk, and asks the community to prioritize fixing this the way it prioritized de-eventletizing services (thread). The TC is meanwhile moving to track security liaisons directly in projects.yaml — PTLs should confirm their entries are accurate.

Development & Technical Decisions

Policy: removing enforce_scope. Stephen Finucane opened a discussion on dropping the enforce_scope config option, and Ghanshyam Maan followed up with a cross-project note on the operator impact of enabling RBAC new defaults across cinder, barbican, and horizon (thread). Deployers still relying on legacy policy behavior should engage now, before this lands.

openstackclient API deprecations. Finucane also flagged the removal of block storage v2 and identity v2 APIs in openstackclient (thread). Tooling, scripts, and CI that still pin to these API versions will break — audit now.

Horizon: EC2 credentials regression. Massimo Sgaravatto reported that with the ec2-api project retired, the Flamingo Horizon release no longer exposes EC2 credential download in the dashboard — a problem for operators using Ceph RGW + Keystone integration, where users need those credentials for S3 access entirely unrelated to ec2-api. Tracked as LP #2157967; other affected sites should weigh in (thread).

networking-sfc seeks maintainers. Brian Haley announced that networking-sfc has no active maintainers and will start the deprecation/retirement path if nobody steps up by the 2026.2 milestone-2 deadline (next week). If your environment depends on SFC, now is the time (thread).

Operator threads. Takashi Kajinami walked through the requirements for cinder-volume active/active (cluster option, etcd/redis coordination, driver support — rbd works) versus active/passive with backend_host. Eugen Block hit nova-compute and neutron-ovs-agent failures after switching to rabbit_quorum_queue = true post-Gazpacho upgrade. And a Heat upgrade to Gazpacho is throwing "request signature does not conform to AWS standards" — worth watching if you depend on Heat's CFN-compatible API.

Heads Up / Action Needed

• July 2 (R-13): 2026.2 Membership Freeze and Milestone-2.
• July 2 (R-13): Last day for networking-sfc maintainers to come forward before retirement proceedings begin.
• August 13: Extra-AC deadline — PTLs, recognize your non-code contributors (docs, triage, translation, meetings) via a governance change.
• Patch now: Swift SSRF (OSSA-2026-024 / CVE-2026-50221).
• Audit your scripts/CI for upcoming removal of block-storage v2 and identity v2 in openstackclient, and the removal of policy enforce_scope.

Community & Events

The TC weekly summary (Goutham Pacha Ravi) reported that Venus has been formally retired, with Dmitriy Rabotyagov driving the cleanup. Zun is the new project-health concern: its Gazpacho release shipped without the legacy engine facade change, making it essentially undeployable, and Kolla has dropped it. The TC also discussed Ildiko Vancsa and Jeremy Stanley's "Bridging the Gap" contributor-metrics work using LFX Insights data across 23 project teams and six cycles, and is reviewing a proposed Contributor Experience Working Group (governance #994046).

Meeting changes: - Watcher moves its weekly IRC meeting one hour later to 13:00 UTC Thursdays, effective July 2 (change). - Kolla cancels both the July 1 and July 8 weekly meetings. - Ironic skips its June 29 meeting, returning July 6.

Ops Radio Hour ran on June 26 at 13:00 UTC, continuing the conversation on the Operator's Contributor Guide (etherpad). Operators looking for a low-friction way to plug in should check the Matrix room.