openstack/octavia — Stackers Network

openstack/octavia — Week of 2026-09-12

Sat, 12 Sep 2026 00:00:00 +0000

TLS configuration. The largest change of the week reworks cipher handling so that TLSv1.3 is configured correctly on listeners, a ~300-line fix across the amphora TLS path (review.opendev.org/c/openstack/octavia/+/919846). Complementing it, the deprecated ssl_version option is replaced with ssl_minimum_version, aligning Octavia with the modern SSL context API.

Bug fixes. Two data-path issues landed: neutron client sockets were being leaked and are now released explicitly, and members were being plugged onto the wrong subnet in certain topologies. Both are small, targeted patches against long-standing behavior.

Maintenance. The legacy Upstart init configuration was removed outright (-169 lines), retiring support for a boot system Octavia no longer needs to carry. A typo fix rounds out the cleanup.

Tooling and CI. Most of the remaining activity is CI plumbing: three patches repair mirror usage on stable branches, DIB_PIP_RETRIES=0 is dropped when the CI mirror is in use, and the grenade skip-level job is disabled for the 2026.2 cycle.

openstack/octavia — Week of 2026-08-29

Sat, 29 Aug 2026 00:00:00 +0000

Security hardening. The dominant work this cycle was closing HAProxy config-injection vectors, with fixes landed for both the tls_ciphers field and L7 policy redirect URLs, each backported across three branches. A separate ~850-line change tightens amphora firewalling so VRRP and HAProxy peer ports are no longer open to 0.0.0.0/0 (review.opendev.org/c/openstack/octavia/+/971408). A trio of backports also corrects HAProxy configuration when cpu-map is combined with external-check.

Amphora reliability. A VRRP split-brain during failover in ACTIVE_STANDBY topologies was fixed, and amphora certificate generation now derives the AKI from the issuer's SKI rather than recomputing it. On the datapath side, interface allocation to the network namespace on reboot was corrected so amphorae come back up cleanly.

Tooling. Amphora image build jobs were switched to CI mirrors, and a devstack unstack failure when Redis/Valkey isn't installed was fixed.

openstack/octavia — Week of 2026-08-01

Sat, 01 Aug 2026 00:00:00 +0000

Taskflow and worker reliability. The largest change rewrites the ZookeeperTaskFlowDriver to eliminate session churn (993556, ~294 lines), and the worker now honors the configured retry count for taskflow persistence instead of hardcoded values. Sensitive keys are masked in taskflow logging so credentials no longer leak through job state, and the AbstractNetworkDriver.update_vip signature is aligned across implementations.

Python 3.14 readiness. Two changes overhaul multiprocessing usage — one for octavia-worker specifically and a broader fix across the codebase — to work under 3.14's stricter defaults. Hacking and pyupgrade were bumped in step to keep linting green on the new interpreter.

Image and platform surface. ARM64 is now an accepted architecture for amphora image builds, expanding the set of hosts that can produce official images.

Cleanup and CI. The unused [DEFAULT] octavia_plugins option was dropped, along with a stray devstack token, a redundant Pygments dep, and an explicit None choice on a config option. On the CI side, the failing centos-9-stream job was removed and periodic FIPS jobs on stable branches were disabled.