December 2025 - openstack-discuss

[openstack][octavia]Resize a Load Balancer
by Nguyễn Hữu Khôi 28 Jan '26

28 Jan '26

Hello. I see that patch https://review.opendev.org/c/openstack/octavia/+/890215 Could I ask why we cannot merge it? Nguyen Huu Khoi

3 6

[nova] Ephemeral storage potential features
by Karol Klimaszewski 26 Jan '26

26 Jan '26

Hello, In my company (CloudFerro) we have developed two features related to nova ephemeral storage (with libvirt virt driver) - "SPDK-based ephemeral storage backend" and "Multiple ephemeral storage backend handling" (both described below). Would these features be appropriate to be added to upstream? If yes, then should I start with creating a blueprint and proposing a spec for each of them so it is more clear what we want to introduce? Of course not both at once, since there is some code that makes one work with the other. For us it would probably be best if we upstreamed "SPDK-based ephemeral storage backend" first and then upstreamed "Multiple ephemeral storage backend handling" Description of SPDK-based ephemeral storage backend: We add a new possible value for [libvirt]/images_type in nova.conf: spdk_lvol. If this value is set then local disks of instances are handled as logical volumes (lvols). of locally run SPDK instance (on the same compute as VM). See https://spdk.io/doc/logical_volumes.html#lvol for docs on this subject. These are essentially a part of local NVMe disk managed by SPDK. We create and manage those lvols by making calls from nova-compute to SPDK instance with RPC (https://spdk.io/doc/jsonrpc.html) using provided python library (https://github.com/spdk/spdk/blob/master/python/README.md) We attach those lvols to instances by exposing them as vhost-blk devices (see https://spdk.io/doc/vhost.html) and specifying them as disks with source_type='vhostuser'. This method of exposing NVMe local storage allows for much better I/O performance than exposing them from local filesystem. We currently have working: creating, deleting, cold-migrating, shelving, snapshots, unshelving VMs with this storage backend. We don't have live migration working yet but have it in plans. This feature includes changes only to nova. Description of Multiple ephemeral storage backend handling: We add a new configuration option [libvirt]/supported_image_types to nova.conf of nova-compute and change the meaning of [libvirt]/images_type to mean default image type. If libvirt:image_type extra_spec is specified in flavor then VM is scheduled on compute with appropriate image type in its [libvirt]/supported_image_types. We use potentially multiple DISK_GB resource providers and construct appropriate request groups to handle this scheduling. This spec is also used to fill driver_info.libvirt.image_type field of BDMs with destination_type=local of this VM. (driver_info is new JSON serialized field of BDM) Then in compute if BDM specifies this field we use its value instead of [libvirt]/images_type to decide on imagebackend to use for it. This method of handling multiple backends only works after being enabled by administrators by setting libvirt:image_type on all their flavors and running nova-manage commands that update existing VMs. Without enabling everything works as it was before. This feature includes changes to nova and some new traits in os-traits (One per possible value of [libvirt]/images_type + one extra) Best regards, Karol Klimaszewski

2 7

[all][oslo][cinder][glance][nova][sdk][trove] Upcoming migration of whereto to PCRE2
by Takashi Kajinami 21 Jan '26

21 Jan '26

Hi ! I'm sending this email so that you'd be aware of an upcoming breaking change in the whereto library, because you might need to update your projects (especially their bindep.txt files) to adopt your projects to the change. The whereto library is a tiny library to generate redirect rules in Apache and has been used in documentation build in several projects. This library has been dependent on python-pcre, which requires the following packages. - libpcre3-dev in Debian-based operating systems (such as Debian or Ubuntu) - pcre-devel in RHEL-based operating systems (such as RHEL or CentOS Stream) However these packages are no longer provided by newer operating systems and we have to replace these by PCRE 2. - Debian removed libpcre3-dev because PCRE 3 is obsolete and it is recommended to replace it by PCRE 2 [1]. - RHEL 10 removed PCRE and PCRE 2 is a recommended replacement. I've already proposed the change[1] of whereto to replace python-pcre by pcre2 (which requires pcre2 packages from OS). I'll create a new release of whereto shortly after this change is merged. Once the new release hits the upper constraints, libpcre3-dev and pcre-devel in bindep.txt in each repository should be replaced. See [3] to learn how the change should look like. So far I'm planning to take care of this transition, but it'd be nice if I can ask for some attention about it. Please let me know if you have any question. Thank you, Takashi [1] https://lists.debian.org/debian-devel/2021/11/msg00176.html [2] https://review.opendev.org/c/openstack/whereto/+/970061 [3] https://review.opendev.org/c/openstack/whereto/+/970061/4/bindep.txt -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

1 1

Upcoming metrics dashboard changes
by Ildiko Vancsa 14 Jan '26

14 Jan '26

Hi OpenStack community, Since the OpenInfra Foundation joined the Linux Foundation, we have been looking into opportunities to take advantage of the frameworks and tool sets that the Linux Foundation has, and some of you and your organizations are already familiar with. While the dashboards are still being built I would like to let you know that, as part of that effort, we will switch to LFX Insights[1] as the metrics dashboard for OpenInfra projects, including OpenStack, starting on __January 15, 2026.__ A couple things to note: - The new OpenStack metrics dashboard[2] is already available, but it is __still under active construction.__ - The set of metrics that is displayed on the new dashboard will not be identical with the metrics on the dashboard provided by Bitergia. - LFX Insights does not display affiliation information for individuals who are listed on the dashboard as contributors, for privacy reasons. However, if you already have an LF account[3], you will be able to check and update your affiliation information. Or, you can create a new LF account[4]. - You can learn more about the dashboard in the LFX Insights documentation[5]. - If your organization is an OpenInfra Foundation / Linux Foundation member already, the LF Organization Dashboard[6] is also available for a more company-centric view. The OpenStack Bitergia metrics dashboard[7] remains available __until January 14, 2026.__ Please let me know if you have any questions. Best Regards, Ildikö [1] https://insights.linuxfoundation.org/ [2] https://insights.linuxfoundation.org/project/OpenStack/ [3] https://openprofile.dev/ [4] https://docs.linuxfoundation.org/lfx/sso/create-an-account [5] https://insights.linuxfoundation.org/docs/introduction/what-is-insights/ [6] https://lfx.linuxfoundation.org/tools/organization-dashboard/ [7] https://openstack.biterg.io/ ——— Ildikó Váncsa Director of Community OpenInfra Foundation

4 7

[ceilometer] ceilometer metrics for list fields in event payloads
by NITIN GUPTA 12 Jan '26

12 Jan '26

Hello Ceilometer Team! Good Day! Could you please suggest, how to create ceilometer metrics for list fields in event payloads when creating Gnocchi resources? Looks like Ceilometer doesn't iterate over list fields in event payloads when creating Gnocchi resources. Is this a known issue? From the below Sample payload, I'm looking to create a separate metric for "vcpus" field (for example) from each item in "reservations", which is a list of dictionary type of data in the payload. 'payload': { 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'user_id': '2cf63f4ecf7740f5ac9ef4adfa4cdf5e', 'project_id': '07f1a09ab11543bb9080d260a98d812c', 'trust_id': '0037eb9121f04cdc94c39628a8354dde', 'start_date': '2025-12-15T16:18:00.000000', 'end_date': '2025-12-15T16:22:00.000000', 'status': 'PENDING', '*reservations*': [ { 'id': '1fffeb17-599d-441a-80e0-ca6d9044fd36', 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'resource_id': 'c9daade3-4a85-4122-bec2-f34b7a849a01', 'resource_type': 'virtual:instance', 'status': 'pending', 'missing_resources': False, 'resources_changed': False, 'created_at': '2025-12-15 16:18:07', 'updated_at': '2025-12-15 16:18:10', '*vcpus*': 1, 'memory_mb': 1024, 'disk_gb': 20, 'amount': 1, 'affinity': None, 'resource_properties': '', 'flavor_id': '1fffeb17-599d-441a-80e0-ca6d9044fd36', 'aggregate_id': 292, 'server_group_id': None }, { 'id': '97df8162-d756-44c0-a27f-c832101577e8', 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'resource_id': '4a3e20b1-5f63-46b1-a61b-13a267fd829a', 'resource_type': 'virtual:instance', 'status': 'pending', 'missing_resources': False, 'resources_changed': False, 'created_at': '2025-12-15 16:18:05', 'updated_at': '2025-12-15 16:18:07', '*vcpus*': 1, 'memory_mb': 1024, 'disk_gb': 20, 'amount': 1, 'affinity': None, 'resource_properties': '', 'flavor_id': '97df8162-d756-44c0-a27f-c832101577e8', 'aggregate_id': 291, 'server_group_id': None } ], 'events': [{'id': '4cea5a4f-53f4-4a69-969b-74a5869c7ab1', 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'event_type': 'end_lease', 'time': '2025-12-15T16:22:00.000000', 'status': 'UNDONE', 'created_at': '2025-12-15 16:18:10', 'updated_at': None}, {'id': '63b51fc9-5eca-4729-8f5e-a3659e7db24b', 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'event_type': 'start_lease', 'time': '2025-12-15T16:18:00.000000', 'status': 'UNDONE', 'created_at': '2025-12-15 16:18:10', 'updated_at': None}, {'id': 'bba382f6-47d8-4bb0-b3aa-0a65c6959ed9', 'lease_id': 'f94182be-70e2-4f3f-bc8d-a1d1c2eea0aa', 'event_type': 'before_end_lease', 'time': '2025-12-15T16:18:00.000000', 'status': 'UNDONE', 'created_at': '2025-12-15 16:18:10', 'updated_at': None}], 'name': 'lease-short-ins', 'created_at': '2025-12-15 16:18:05', 'updated_at': '2025-12-15 16:18:10', 'degraded': False } Best regards. -- NITIN GUPTA

3 12

SECURITY BUG
by Umbrella Corporation 09 Jan '26

09 Jan '26

i found a vulnerability in your git repo so if i reported bugs and vulnerabilities can i get a reward bounty ?

3 3

[designate] Question about NS record update restriction in multi-region PRIMARY/SECONDARY setup
by Sylvain 08 Jan '26

08 Jan '26

Hi everyone, I hope this email finds you well. I'm reaching out to the community because I'm encountering a limitation with Designate that I don't fully understand, and I'm hoping someone can shed some light on the reasoning behind it or suggest alternative approaches. My Setup I'm running a multi-region Designate deployment with: - 3 independent Designate instances (one per region) - Each instance has its own pool with a single nameserver: - Region 1: ns.region1.net. - Region 2: ns.region2.net. - Region 3: ns.region3.net. This default configuration works perfectly for most of our use cases where zones are region-specific. What I'm Trying to Achieve For certain domains, I need to set up a PRIMARY/SECONDARY configuration across all three regions: - Region 1: PRIMARY zone for example.com - Region 2: SECONDARY zone for example.com - Region 3: SECONDARY zone for example.com For this to work correctly, the PRIMARY zone needs to have NS records pointing to all three nameservers so that: 1. DNS clients can query any of the three nameservers 2. Zone transfers are properly configured between primary and secondaries The Problem When I try to update the NS recordset on the primary zone, I get the error: Updating a root zone NS record is not allowed Steps I'm following: # List recordsets to get the NS recordset ID openstack recordset list example.com. # Attempt to update the NS recordset openstack recordset set example.com. <ns-recordset-id> \ --record ns.region1.net. \ --record ns.region2.net. \ --record ns.region3.net. This happens even when authenticated as an admin user. Why the Default Workaround Doesn't Work I understand that one typical solution is to modify the pool configuration to include all three nameservers. However, this doesn't work in my case because: - I don't want to change the default pool settings since most zones should only use their local regional nameserver - Modifying the pool in Region 1 would affect *all zones* created there, not just the ones I want to replicate My Questions I'm trying to understand the design decisions here, and I'd really appreciate any insights: 1. What's the reasoning behind blocking NS record updates on root zones? I'm not seeing the security or technical concern that this protects against. 2. Is this restriction something that could potentially be made configurable via policy? For example, allowing zone owners to update their own NS records when they have legitimate multi-region or high-availability requirements. 3. Are there any alternative approaches I should be considering for this multi-region PRIMARY/SECONDARY setup that I might be missing? 4. Would the community be open to discussing a potential enhancement that makes this more flexible? I understand if there are concerns, but I'd love to understand them better. Use Case Context This is a fairly standard DNS architecture for high availability and geographic distribution. Many organizations need to run primary and secondary nameservers across different regions or datacenters, and being able to configure the NS records accordingly seems like it should be a supported use case. Thank you very much for taking the time to read this, and I appreciate any guidance or feedback the community can provide! Best regards, Sylvain.

2 2

[puppet-cinder,glance,manila] Resigning from core team
by Alan Bishop 05 Jan '26

05 Jan '26

Hello, Due to a change in my work status, I am no longer able to fulfill my obligations as a core reviewer. With this in mind, I am resigning from the core team on the puppet-cinder, puppet-glance and puppet-manila projects. Alan Bishop

3 2

[Keystone][ldap] Keystone bind request to ldap not able to interpret if the user's password is expired.
by Sharath Ck 05 Jan '26

05 Jan '26

Hi, I have configured Keystone with 389ds as backend. 389ds server is configured with password policy and pwdmustchange is set to true. However on first login attempt from keystone to request token for user in 389ds is resulting in successful bind request. Perhaps, 389ds is providing control ID - control: 2.16.840.1.113730.3.4.4 in the response. But keystone is not able to interpret the control ID and provide a token with full access. Is it not possible for keystone to respond token with minimum scope to only change password? Or any response attribute to specify password is expired and needs to be changed? Kindly help with any configuration that may interpret the password expiry of ldap user and can be used in token response. P.S: configuring user_enabled_attribute to check nsAccountLock will not work as ldap user's password would be expired but not locked. user_enabled_attribute = nsAccountLock user_enabled_mask = 0 user_enabled_invert = true user_enabled_default = true Regards, Sharath

3 2

need help in managing production openstack cluster
by Tarun 31 Dec '25

31 Dec '25

Hi, I am migrating from VMware to Openstack 2025.2 Please help me to validate my production cluster to avoid any future issue Thanks Tarun

3 3