openstack/neutron — Week of 2026-08-29

Security groups and RBAC. Default security group creation moved to the RBAC API policy path, landing on master and a stable backport of the same change. A separate fix tightens FIP-with-QoS handling to verify the QoS policy is actually visible to the requesting user before association.

OVN and segments. The OVN revision tracker gained TYPE_SEGMENTS plus dependent_resource support, and DB synchers picked up a _sync_order attribute to make sync ordering explicit (1001147). On the ML2 side, operators can now shrink a segment range down to an already-allocated boundary rather than being blocked by existing allocations.

L3, DHCP and privsep. The EVPN router path now raises an explicit error when a second advertise-host subnet is added, and vtysh invocations migrated off rootwrap onto oslo_privsep. DHCP port deletion learned to clean up stranded HAProxy processes from the namespace, and a gateway test was reworked to reduce its privsep load.

AI tooling and CI. The .agents/ directory was reorganized into rules and skills, with a new "testing patches" skill added (~340 lines). CI churn was limited to reverting a CentOS 10 skip and temporarily skipping equivalent failing tests on CentOS 9 Stream on master and one stable branch.