openstack/nova — Week of 2026-08-29

Confidential computing on libvirt. The bulk of the week's ~1,600 lines of feature code went to Intel TDX support on the libvirt driver: host capability detection, launch security wiring, a generalized memory-encryption config path shared with SEV, a TDX-specific memory encryption block, an os_firmware_secure image trait, a reject_mem_enc_instances guard, an x86_64 arch check, and a full documentation page. Adjacent SEV work stubbed the kernel support check in tests, added release information for SEV-ES and SEV-SNP, and made file-backed memory plus memory reservation a hard failure.

Cyborg and accelerators. The libvirt driver gained MDEV ARQ support for Cyborg, and the Cyborg client was ported off keystoneauth1 onto openstacksdk, letting an older ServiceAuthTokenWrapper get_endpoint_data() workaround be removed (https://review.opendev.org/c/openstack/nova/+/1002540).

Graceful shutdown. Thread pool executors are now shut down during graceful shutdown, a race between RPC method completion and task-tracking updates was fixed, the nova-graceful-shutdown job was rewired to use the service shutdown config options, and docs, release notes, and several test stabilizations landed alongside a functional test for cleanup_host cancelling queued live migrations.

Performance and stability. An O(N²) ProviderTree deepcopy at ironic startup was eliminated (https://review.opendev.org/c/openstack/nova/+/980676), build-timeout scanning now filters out deleted instances, and a batch of flaky live-migration and notification-sample functional tests were stabilized.

Elsewhere. PEP-765 syntax warnings, log-format cleanups, a mypy bump to Python 3.11, contributor-guide updates for Gazpacho and Hibiscus, and the OVN Metadata-agent-to-OVN-agent rename round out the week.