Stackers Network Digest — August 29, 2026

The Big Picture

The 2026.2 "Hibiscus" release is in the home stretch: Milestone-3 / feature freeze landed on Thursday August 27, and the mailing lists reflect it — a wave of FFE requests, a Manila FFE roundup, and R-4 countdown chatter. Alongside that, Keystone shipped a significant security advisory covering delegated-token scope escapes (OSSA-2026-037), the 2027.1 PTL slate was announced, TC voting opened, and Doug Goldstein kicked off two substantive governance debates on scope semantics and core-reviewer processes.

Security

OSSA-2026-037 (Keystone, CVE-2026-80182 and CVE-2026-80184) was published August 25 and then re-issued as errata 1 the same day to fill in the assigned CVE numbers. Grzegorz Grasza (Red Hat) and Tim Shephard (roiai.ca) reported that tokens obtained via OAuth1 access tokens, application credentials, or trusts could (a) create new long-lived credentials or delegations that outlive the originating credential, and (b) be re-submitted to the token-method auth path to escape their project scope — an unscoped application-credential token would be re-issued against the owner's default project. Affected versions: Keystone >=13.0.0 <27.0.3, >=28.0.0 <28.0.3, >=29.0.0 <29.0.3. Patches are up for Epoxy, Flamingo, Gazpacho and master/Hibiscus — see the advisory thread and Launchpad bug 2153453 / bug 2158538. Any deployment permitting delegated auth should patch.

Separately, Jay Faulkner announced that OSSNs have finally been migrated out of the wiki into the security-doc repo, rendered alongside the rest of OpenStack docs. The canonical index is now docs.openstack.org/security-notes, and there's a documented OSSN process. Update your bookmarks — old wiki.openstack.org/wiki/OSSN/OSSN-#### URLs are no longer canonical.

Releases & Hibiscus Milestone-3

Thierry Carrez's R-4 countdown marks the transition into RC territory for cycle-with-rc deliverables, following the August 27 feature freeze. FFEs are the dominant traffic:

• Manila PTL Carlos Silva published the approved FFE list: Dell PowerScale/PowerStore manage/unmanage, QoS and revert-to-snapshot (pending public Dell CI); the share-server-replica work with NetApp; and the privsep migration — targeted to land within the following week.
• Nova: Goutham Pacha Ravi requested an FFE to land cold-migration/resize for instances with virtiofs (Manila share) attachments — gerrit series. Additive API version bump, no schema/DB changes; teed up for future rebuild/shelve/live-migrate work in Indri.
• keystoneauth: Doug Goldstein asked for a library FFE for the v3websso plugin — purely additive federated web-SSO support.

Governance, Elections & Community

The 2027.1 PTL results are in — 34 project teams, no contested PTL races. Notable changes: René Ribaud takes over Nova, Erkin Mussurmankulov becomes Trove PTL, Sean Mooney picks up Cyborg, and Juan Larriba leads Telemetry. Longtime PTLs Brian Rosmaita (Cinder), Brian Haley (Neutron), Tim Burke (Swift), Takashi Kajinami (Heat/Puppet/Storlets), and Michal Nasiadka (Kolla/Magnum) continue.

The combined TC/PTL election opened for voting on August 26 and closes September 16, 2026 23:45 UTC. Five candidates are contesting four TC seats: Artem Goncharov, Bartosz Bezak, Christian Berendt, Doug Goldstein, and Jens Harbott. Because of a new CIVS policy, eligible voters must have opted in by email; if you didn't see a ballot, use the CIVS opt-in page with your Gerrit-preferred address.

Two big governance discussions started this week, both from Doug Goldstein:

• "System scope is a resource scope, not a privilege level" — proposes reopening the scope conversation (without reverting project-scope standardization) by reframing system scope as access to a different class of objects (hypervisors, agents, deployment catalog like flavors/volume types/public images), à la Kubernetes namespaced vs. cluster-scoped resources. An ongoing debate, not a decision.
• "Document the path to core status" — following an August 18 TC meeting, a proposal to require each project team to write down its own criteria for becoming (and remaining) a core reviewer. Not mandating uniformity, just transparency. Goutham Pacha Ravi's TC weekly summary captures the room's mixed reactions.

On the community side, OpenInfra Live is relaunching as a podcast hosted by Kendall Nelson and Wes Wilson, distributed on Spotify, Apple Podcasts, YouTube and LinkedIn, with occasional live streams retained for major releases.

Development & Technical Decisions

• Neutron/OVN Network Log RFE — Chanyeol Yoon (KT Cloud) proposed letting each Network Log pick packet_log (today's behaviour) or flow_sample (native OVN ACL sampling via Sampling_App/Sample_Collector), with Neutron managing only the NB sampling lifecycle. Filed as bug 2165306; related to the broader flow-log request 2071323. Feedback wanted before it moves to a Neutron spec. Note: Friday's Neutron drivers meeting was cancelled for lack of quorum.
• Ironic + NPU firmware — Sungho Kim asked whether accelerator firmware management should live in a hardware manager (à la MellanoxDeviceHardwareManager) or go through Ironic's RedfishFirmware interface, and whether IPA can shell out to vendor closed-source flashing tools. Worth watching if you run AI hardware under Ironic.
• Octavia deployment guidance — Eugen Block flagged that the install docs still recommend octavia-api under systemd (which now logs a deprecation warning) rather than WSGI, and still reference linuxbridge-agent; tracked as bug 2163755.

Operator Corner

Several fresh operator threads worth watching if you deploy these services:

• Trove on 2026.1 — Andrei Corduneanu opened three threads this week: a guest agent failing to start due to a missing /etc/trove/controller.conf on the built guest image, multi-user/multi-database creation silently failing during instance create (both API and Heat), and a question about whether user roles are supported at create time. First-hand operator feedback for the incoming Trove PTL.
• Swift S3 API — a SignatureDoesNotMatch on a fresh OSA AIO 2026.1, with a note that the middleware docs still link to a nine-year-old sample config in the archived swift3 repo.
• Nova memory reclaim — an ongoing thread with Sean Mooney on QEMU/guest memory not being released to the host, touching on cache pressure and disk_cachemodes tuning.
• OSProfiler + Jaeger — the tracing thread continued, with Thamanna Farhath reporting the kolla-otel approach from FPT's Superuser article is now producing traces, but with excessive span cardinality and weak cross-service context propagation.

Heads Up / Action Needed

• Patch Keystone for OSSA-2026-037 (delegated-token scope). Backports available for Epoxy, Flamingo, Gazpacho, and Hibiscus.
• Vote in the TC election by September 16, 2026 23:45 UTC; opt-in via CIVS if your ballot didn't arrive.
• Manila / Nova / keystoneauth FFEs need to merge in the next ~week to make Hibiscus.
• Update OSSN links away from the wiki to docs.openstack.org/security-notes.
• Ops Radio Hour met August 28 at 13:00 UTC — etherpad for topics; and the i18n team's IRC meeting now alternates Tue 13:00 UTC / Wed 23:15 UTC by ISO week parity.