openstack/neutron — Week of 2026-06-20

API surface. The big functional addition is the new security-groups-default-statefulness API extension, ~770 lines that let operators control the default stateful/stateless behavior of security groups (review.opendev.org/c/openstack/neutron/+/984356). On the policy side, OwnershipValidationHook was removed and the create_port rule updated, and _exclude_attributes_by_policy was optimized for list responses in the pecan path. Several config knobs and exceptions were retired as dead code, including api_workers, ha_keepalived_state_change_server_threads, and UnknownNetworkType/InvalidAddressRequest/IPAllocationFailed.

EVPN and FRR driver. A sizable round of work on the FRR-based EVPN stack: Port_Binding event handling was fixed (~260 lines), FrrDriver's vtysh invocation now accepts --vty_socket, frrinit.sh was reworked to spawn background daemons, rootwrap filters for vtysh landed, and the FrrFixture now explicitly creates its log directories. A vrf-delete test is skipped on CentOS 9 / FRR 8.5.

Stability and bug fixes. A quota-details API error with unloaded service plugins was fixed and backported to three stable branches. Other fixes: FloatingIPDNS rows are now deleted on FIP disassociation, an OVN FIP-deletion race was closed, tun_br is guarded in _restore_local_vlan_map when there is no br-tun, extension flows are reinstalled after an OVS restart, allowed_address_pairs are included in CT_MARK_INVALID conntrack cleanup, the maintenance worker lock is now scoped to the worker, and metadata response headers were cleaned up.

Tooling. A new ~890-line Neutron dependency change detection tool landed; elsewhere, pylint superfluous-parens warnings were cleared, os-ken bumped to 4.2.1, and some unused OVN metadata grenade and zuul jobs removed.