openstack/octavia — Week of 2026-08-29

Security hardening. The dominant work this cycle was closing HAProxy config-injection vectors, with fixes landed for both the tls_ciphers field and L7 policy redirect URLs, each backported across three branches. A separate ~850-line change tightens amphora firewalling so VRRP and HAProxy peer ports are no longer open to 0.0.0.0/0 (review.opendev.org/c/openstack/octavia/+/971408). A trio of backports also corrects HAProxy configuration when cpu-map is combined with external-check.

Amphora reliability. A VRRP split-brain during failover in ACTIVE_STANDBY topologies was fixed, and amphora certificate generation now derives the AKI from the issuer's SKI rather than recomputing it. On the datapath side, interface allocation to the network namespace on reboot was corrected so amphorae come back up cleanly.

Tooling. Amphora image build jobs were switched to CI mirrors, and a devstack unstack failure when Redis/Valkey isn't installed was fixed.