August 2025 - openstack-discuss - lists.openstack.org

[keystone][ops] Upgrade to 2025.1 and "corner cases"
by Dmitriy Rabotyagov 25 Aug '25

25 Aug '25

Hey folks, I wanted to raise awareness of operators regarding Keystone upgrade to Epoxy (2025.1), as found that existing release notes are slightly more vague about corner case definition. During analysis, it appeared that a lot of users (and under "a lot" I mean 4 figures number) in my really old deployments (which were deployed during Newton), still in use passwords hashed with sha512_crypt which has been dropped in 2025.1 [1]. As this was referenced as a "corner case" in upgrade docs, it may not bring enough attention to this matter reading notes, while sha512_crypt removal is mentioned in "Other" section which I personally missed when analyzing upgrade requirements. So I would highly recommend to ensure that all your users are using supported hashing algorithms before the upgrade to Epoxy, and inform them to reset their passwords if they don't. You can list users who are using unsupported hashing algorithm using following MySQL query: SELECT distinct l_u.user_id FROM keystone.local_user AS l_u JOIN keystone.password AS hash ON l_u.id = hash.local_user_id WHERE (hash.password_hash LIKE '$6$%' OR hash.password_hash LIKE '$5$%') AND hash.expires_at i s null; Hope this helps somebody to save some time in the future. [1] https://opendev.org/openstack/keystone/commit/4a4137d5f77ced3f4f011846fb9c2…

2 2

[ops][largescale-sig][scientific-sig] Ops Radio Hour on August 22, 2025
by Ildiko Vancsa 23 Aug '25

23 Aug '25

Hi OpenStack community, I'm reaching out to you with a friendly reminder that the next OpenStack Ops Radio Hour[1] is scheduled to happen on __August 22nd, 2025 at 1300UTC.__ The call series is a casual setting for operators, engineers, and contributors to come together, share knowledge, and collaborate on the complexities of managing and deploying OpenStack environments. Topics the next gathering will dive into: - (SWIFT) Compliance processes - GPUs - VMware migration - vTPM (live migrations or not?): reboot, start - Keystone security param bug - https://bugs.launchpad.net/keystone/+bug/2117217 - Consolidating Ops IRC and Matrix channels What other topics should we add to the agenda? A few reminders: - The group on the call agreed to try out Matrix as a chat platform for more synchronous communication outside calls + You can access the Matrix room here: https://matrix.to/#/#openstack-ops:opendev.org<https://matrix.to/#/%23openstack-ops:opendev.org> + Further details are here: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… - If you would like to read and catch up on notes from previous calls, you can find them in this etherpad: https://etherpad.opendev.org/p/openstack_ops_radiohour See you on the call on August 22nd! Bets Regards, Ildikó [1] https://wiki.openstack.org/wiki/Operations/Meetups

1 1

[cinder-backup]cinder backup show progress percentage
by Nguyễn Hữu Khôi 23 Aug '25

23 Aug '25

Hello. I would like to know if we have some methods to show backup progress percentage. I see this but it is old and work only with Swift. https://specs.openstack.org/openstack/cinder-specs/specs/kilo/backup-notifi… Nguyen Huu Khoi

1 0

[freezer]backup with cindernative mode
by Nguyễn Hữu Khôi 23 Aug '25

23 Aug '25

Hello. I am using openstack 2025.1 and freezer 2025.1 to test. I can backup and restore using cinder. but I won't do it with cindernative, could you tell me that we need swiff to use this mode? This is my command: freezer-agent --mode cindernative --cindernative-vol-id fcc22b9f-ef01-4d16-bfde-83af6312bce9 --log-file k.log --debug Critical Error: Endpoint for object-store not found - have you specified a region? Thank much. Nguyen Huu Khoi

2 11

Keystone "TokenNotFound: Failed to validate token"
by Marc Vorwerk 23 Aug '25

23 Aug '25

Hi all, I am running into an issue with our OpenStack Kolla-Ansible deployment (Release 2024.1, Keystone 25.0.1) where Keystone logs are being flooded (18k per day) with TokenNotFound: Failed to validate token stack traces[1]. From the traceback, it seems these requests are attempting to validate tokens that have already been revoked. The majority of these come from Nova and Cinder, but the request_id from Keystone does not appear in their logs. Instead of finding the matching requests in Nova or Cinder logs, I only see InvalidToken: Token authorization failed messages[2]. Most of the time, the platform does not show any user-visible issues in these areas, although occasional failures can be observed. Could this indicate an issue with token caching or revocation list synchronization between services? Memcached looks fine. Any ideas what could be triggering this behavior are welcome. If you need more Information please let me know. Thanks in advance. Best regards, Marc [1] ERROR keystone.server.flask.application [None req-326cbeaa-a363-4a82-b45b-498d6f2ad338 b30e2d031b6a4851b69f9b1791716919 d977f9d63d3043288bed6e549e507c9a - - default default] Failed to validate token: keystone.exception.TokenNotFound: Failed to validate token ERROR keystone.server.flask.application Traceback (most recent call last): ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/flask/app.py", line 870, in full_dispatch_request ERROR keystone.server.flask.application rv = self.dispatch_request() ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/flask/app.py", line 855, in dispatch_request ERROR keystone.server.flask.application return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) # type: ignore[no-any-return] ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/flask_restful/__init__.py", line 489, in wrapper ERROR keystone.server.flask.application resp = resource(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/flask/views.py", line 110, in view ERROR keystone.server.flask.application return current_app.ensure_sync(self.dispatch_request)(**kwargs) # type: ignore[no-any-return] ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/flask_restful/__init__.py", line 604, in dispatch_request ERROR keystone.server.flask.application resp = meth(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/api/auth.py", line 285, in get ERROR keystone.server.flask.application ENFORCER.enforce_call(action='identity:validate_token') ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/rbac_enforcer/enforcer.py", line 422, in enforce_call ERROR keystone.server.flask.application subj_token_target_data = cls._extract_subject_token_target_data() ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/rbac_enforcer/enforcer.py", line 261, in _extract_subject_token_target_data ERROR keystone.server.flask.application token = PROVIDER_APIS.token_provider_api.validate_token( ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/manager.py", line 110, in wrapped ERROR keystone.server.flask.application __ret_val = __f(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/token/provider.py", line 147, in validate_token ERROR keystone.server.flask.application self._is_valid_token(token, window_seconds=window_seconds) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/token/provider.py", line 201, in _is_valid_token ERROR keystone.server.flask.application self.check_revocation(token) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/manager.py", line 110, in wrapped ERROR keystone.server.flask.application __ret_val = __f(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/token/provider.py", line 138, in check_revocation ERROR keystone.server.flask.application return self.check_revocation_v3(token_values) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/manager.py", line 110, in wrapped ERROR keystone.server.flask.application __ret_val = __f(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/decorator.py", line 232, in fun ERROR keystone.server.flask.application return caller(func, *(extras + args), **kw) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/cache/region.py", line 1632, in get_or_create_for_user_func ERROR keystone.server.flask.application return self.get_or_create( ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/cache/region.py", line 1092, in get_or_create ERROR keystone.server.flask.application with Lock( ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/lock.py", line 185, in __enter__ ERROR keystone.server.flask.application return self._enter() ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/lock.py", line 94, in _enter ERROR keystone.server.flask.application generated = self._enter_create(value, createdtime) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/lock.py", line 178, in _enter_create ERROR keystone.server.flask.application return self.creator() ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/dogpile/cache/region.py", line 1046, in gen_value ERROR keystone.server.flask.application created_value = creator( ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/token/provider.py", line 134, in check_revocation_v3 ERROR keystone.server.flask.application PROVIDERS.revoke_api.check_token(token_values) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/common/manager.py", line 110, in wrapped ERROR keystone.server.flask.application __ret_val = __f(*args, **kwargs) ERROR keystone.server.flask.application File "/var/lib/kolla/venv/lib/python3.10/site-packages/keystone/revoke/core.py", line 137, in check_token ERROR keystone.server.flask.application raise exception.TokenNotFound(_('Failed to validate token')) ERROR keystone.server.flask.application keystone.exception.TokenNotFound: Failed to validate token [2] $ grep f47b3827 */*log nova/nova-api.log: INFO nova.api.openstack.requestlog [None req-f47b3827-9070-4761-a9de-0f8c854ccc93 1f24a1c85bb24bc3aa83a22bc6b9a47e 2f764cefd79544f1959b3743281b072d - - 16cb1fce3b1b4842b3be2fb4e88c5c69 16cb1fce3b1b4842b3be2fb4e88c5c69] 10.70.142.1 "GET /v2.1/servers/72970654-cbaf-4e0e-94e0-70e7ba3e0db4" status: 200 len: 3747 microversion: 2.1 time: 0.104714 nova/nova-api.log: WARNING keystonemiddleware.auth_token [None req-f47b3827-9070-4761-a9de-0f8c854ccc93 1f24a1c85bb24bc3aa83a22bc6b9a47e 2f764cefd79544f1959b3743281b072d - - 16cb1fce3b1b4842b3be2fb4e88c5c69 16cb1fce3b1b4842b3be2fb4e88c5c69] Authorization failed for token: keystonemiddleware.auth_token._exceptions.InvalidToken: Token authorization failed nova/nova-api.log: INFO nova.api.openstack.requestlog [None req-f47b3827-9070-4761-a9de-0f8c854ccc93 1f24a1c85bb24bc3aa83a22bc6b9a47e 2f764cefd79544f1959b3743281b072d - - 16cb1fce3b1b4842b3be2fb4e88c5c69 16cb1fce3b1b4842b3be2fb4e88c5c69] 10.70.142.1 "GET /v2.1/servers/detail?name=shoot--system--mon" status: 401 len: 114 microversion: - time: 0.078451

2 3

[ironic][magnum][tacker][telemetry][venus][vitrage] broken gate on master branch
by Elõd Illés 22 Aug '25

22 Aug '25

Hi teams in $SUBJECT, The release team usually checks the gate health of deliverables that did not have merged patches recently and it seems you have a project with broken gate: https://review.opendev.org/q/topic:release-health-check-flamingo+is:open Could you please check and fix the gate so that we don't release 2025.2 Flamingo with a broken state. Thanks in advance, Előd Illés irc: elodilles @ #openstack-release

3 2

[release] Release countdown for week R-5
by Thierry Carrez 22 Aug '25

22 Aug '25

Development Focus ----------------- We are getting close to the end of the 2025.2 "Flamingo" cycle! Next week on August 28th, 2025 is the Flamingo-3 milestone, also known as feature freeze. It's time to wrap up feature work in the services and their client libraries, and defer features that won't make it to the 2026.1 "Gazpacho" cycle. General Information ------------------- This coming week is the deadline for client libraries: their last feature release needs to happen before "Client library freeze" on August 28th, 2025. Only bugfix releases will be allowed beyond this point. When requesting those library releases, you can also include the stable/2025.2 branching request with the review. As an example, see the "branches" section here: https://opendev.org/openstack/releases/src/branch/master/deliverables/pike/… August 28th, 2025 is also the deadline for feature work in all OpenStack deliverables following the cycle-with-rc model. To help those projects produce a first release candidate in time, only bugfixes should be allowed in the master branch beyond this point. Any feature work past that deadline has to be raised as a Feature Freeze Exception (FFE) and approved by the team PTL. Finally, feature freeze is also a good time for submitting a first version of your cycle-highlights. Cycle highlights are the raw data that helps shape what is communicated in press releases and other release activity at the end of the cycle, avoiding direct contacts from marketing folks. See https://docs.openstack.org/project-team-guide/release-management.html#cycle… for more details. Upcoming Deadlines & Dates -------------------------- Flamingo-3 milestone (feature freeze): August 28th, 2025 (R-5 week) RC1 deadline: September 12th, 2025 (R-3 week) Final RC deadline: September 25th, 2025 (R-1 week) 2025.2 "Flamingo" final release: October 1st, 2025 OpenInfra Summit Europe: October 17th-19th, 2025 -- Thierry Carrez (ttx)

1 0

[blazar] Blazar-dashboard contains non-free files (ie: minified Javascripts)
by Thomas Goirand 22 Aug '25

22 Aug '25

Hi, I've been trying to package Blazar, all is already in Debian, but I can't get blazar-dashboard in, because upstream source contains non-free files. Namely: https://github.com/openstack/blazar-dashboard/blob/master/blazar_dashboard/… is a minifed version of a much more complex package: https://github.com/apexcharts/apexcharts.js/tree/v3.31.0 Reminder: minified Javascripts are considered by most distributions (this includes Red Hat, Ubuntu, and in my case Debian) as non-free files that cannot be shipped in the distribution without the underlying source code, and packages must build from the not minified version. Could the Blazar team work on un-vendoring apexcharts.min.js, possibly removing it completely, or replacing it with a source-full version? Cheers, Thomas Goirand (zigo)

4 6

[ops] [all] One Week until 2025 OpenStack User Survey Deadline
by Allison Price 21 Aug '25

21 Aug '25

Hi everyone, I wanted to remind everyone that next Friday, August 29 is the deadline to complete this year’s OpenStack User Survey. If you haven’t taken it before, this is a great opportunity to help channel feedback to the upstream community while helping us understand the global OpenStack footprint better. It should only take ~20 minutes and is incredibly valuable. If you have taken it before, it’s still important to review and update your data. This should only take a few minutes. https://openstack.org/usersurvey Thank you all! Cheers, Allison

1 0

[neutron] Drivers meeting canceled Friday, August 22nd
by Brian Haley 21 Aug '25

21 Aug '25

Hello Neutrinos: I am going to cancel tomorrow's Drivers meetings as there will not be quorum. Just a reminder there are still open specs that need updates and/or review, list is at [0]. Have a nice weekend! -Brian [0] https://review.opendev.org/q/status:open+project:openstack/neutron-specs

1 0

[all] Keeping old unmaintained branches open for longer time, but with no CI, instead of EOL tags
by Thomas Goirand 21 Aug '25

21 Aug '25

Hi, It's our policy that we maintain only a few branches, currently, from Caracal to Epoxy (so, 3 stable branches). Currently, when a Stable branch becomes unsuported, we rename that branch as: unmaintained/2023.1 which is fine, as we can still commit there. Though after some times, the branches are deleted, and instead, we just do a tag such as: zed-EOL Jeremy Stanley just wrote to me on IRC: "workflows, processes and policies are built around many years of an assumption that unused branches will be deleted" Keeping unmaintained branches "has put a lot of additional strain on project maintainers and our systems" (still quoting Jeremy). Though each time there's a new (grave?) security problem, this topic comes back, as we still have no solution for these cases. As a downstream, I still need to write backports for these important patches, sometimes long after the branches are EOL. Red Hat too... While I agree with all what Jeremy told me on IRC, and I don't think we should attempt to maintain the CI for too long (as this takes too much of our time), I still believe we should keep a way to share patches. Downstream (like myself for Debian) run their own CI based on packages, and it's always better if we can share patches. It doesn't have to be with a maintained CI. Just having opened branches would be enough. Your thoughts? Cheers, Thomas Goirand (zigo)

6 6

[all][elections][tc] TC Election Campaigning Kickoff
by Ian Y. Choi 20 Aug '25

20 Aug '25

Developers, The TC Election Campaigning Period has now started[1]. During the next couple days, you are all encouraged to ask the candidates questions about their platforms[2], opinions on OpenStack, community governance, and anything else that will help you to better determine how you will vote. This is the time to raise any issues you wish the future TC to consider, and to evaluate the opinions of the nominees prior to their election. Candidates, Each of you has posted a platform[2], and announced your nomination to the developers. From this point, you are encouraged to ask each other questions about the posted platforms, and begin discussion of any points that you feel are particularly important during the next cycle. While you are not yet TC members, your voices and opinions about the issues raised in your platforms and questions raised by the wider community will help ensure that the future TC has the widest possible input on the matters of community concern, and the electorate has the best information to determine the ideal TC composition to address these and other issues that may arise. [1] https://governance.openstack.org/election/ [2] https://opendev.org/openstack/election/src/branch/master/candidates/2026.1/… Ian Y. Choi & Slawek Kaplonski, on behalf of election officials.

1 0

[all][elections][ptl][tc] Combined PTL/TC 2026.1 cycle Election Nominations End
by Ian Y. Choi 20 Aug '25

20 Aug '25

The PTL and TC Nomination period is now over. The official candidate lists for PTLs [0] and TC seats [1] are available on the election website. -- PTL Election Details -- There are 4 projects without candidates, so according to this resolution[2], the TC will have to decide how the following projects will proceed: Monasca, OpenStack_Charms, Venus, Vitrage There are 1 project that will have elections: Horizon. -- TC Election Details -- The official candidate list is available on the election website[1]. Now begins the campaigning period where candidates and electorate may debate their statements. Polling will start Aug 27, 2025 23:45 UTC. Thank you, [0] https://governance.openstack.org/election/#ptl-candidates [1] https://governance.openstack.org/election/#tc-candidates [2] https://governance.openstack.org/resolutions/20141128-elections-process-for…

1 0

OSSN-0094: Ensuring Volume Safety with Nova and Watcher
by Jay Faulkner 20 Aug '25

20 Aug '25

OSSN-0094: Ensuring Volume Safety with Nova and Watcher == Summary == A vulnerability has been identified in OpenStack Nova and OpenStack Watcher in conjunction with volume swap operations performed by the Watcher service. Under specific circumstances, this can lead to a situation where two Nova libvirt instances could reference the same block device, allowing accidental information disclosure to the unauthorized instance. == Affected Services / Software == Services: Nova,Watcher Releases: all supported releases == Discussion == The issue occurs when Watcher's zone migration strategy performs the following sequence of events: 1. Watcher initiates a volume swap using Nova's internal-only volume swap API 2. Watcher initiates a live migration of the same instance 3. In some error cases connection details may have failed to update storage references. These invalid details are used during the live migration. === Required Access === The swap volume, live migration and all Watcher APIs are admin only so with default policy is only possible to create the inconsistent state described in this OSSN if you have admin rights on the relevant OpenStack project. === Further Watcher Hardening === The Watcher service, when first created, often implemented its own means to perform operations. Many of those operations can now be done natively via other OpenStack services. In the specific context of OSSN-0094, the ability to migrate Cinder volumes between storage backends is such an example. Additionally, the Cinder volume migration in Watcher created a new Keystone user with the admin role assigned for the instance owners' project and then used that user to perform API requests on behalf of the project. This code has been removed. Finally, due to limited error handling and no validation that the objects involved were migrated properly, some error scenarios could have led to a source volume being deleted despite not having been migrated properly. === Resolution === Nova will now reject any request to swap a volume that has an empty migration status, effectively restricting the usage of this API to Cinder. This brings the API validation in line with the documentation. Watchers internal implementation of swap volume has been deleted and updated to use Cinder's native volume migration as a replacement. Watcher no longer creates temporary Keystone users in normal operation. === Patches === Patches for Nova and Watcher have been backported to all supported stable branches and committed to master branch. stable/2025.1: * Watcher: https://review.opendev.org/c/openstack/watcher/+/957770 * Nova: https://review.opendev.org/c/openstack/nova/+/957759 stable/2024.2: * Watcher: https://review.opendev.org/c/openstack/watcher/+/957773 * Nova: https://review.opendev.org/c/openstack/nova/+/957762 stable/2024.1: * Watcher: https://review.opendev.org/c/openstack/watcher/+/957774 * Nova: https://review.opendev.org/c/openstack/nova/+/957764 == Recommended Actions == * Operators using Watcher's zone migration strategy should apply the provided Watcher and Nova patches as soon as possible. * Operators should refrain from using the swap volume migration action in Watcher. The compatibility code for swap volume that uses a Cinder-based migration may be removed in a future API version. * Operators should audit all users with the admin role and ensure no temporary Watcher-created users remain. * Operators using custom policy for volume attachment (''/servers/{server_id}/os-volume_attachments/{volume_id}'') or live migration API should review the state of existing instances which have had volume migrations. Any instance in an inconsistent state can be resolved by hard rebooting the instance using Nova's API. == Contacts / References == * Author: Sean Mooney <smooney(a)redhat.com>, Jay Faulkner <jay(a)jvf.cc> * This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0094 * Original LaunchPad Bug : https://bugs.launchpad.net/nova/+bug/2112187 * Mailing List : [Security] tag on openstack-discuss(a)lists.openstack.org * OpenStack Security Project : https://launchpad.net/~openstack-ossg * CVE: None

1 0

[vitrage][tc] Project status
by Takashi Kajinami 20 Aug '25

20 Aug '25

Hi, Some of you might be aware of this, but tempest jobs in vitrage repo have been broken for some time (I remember I saw consistent failures early in this cycle and I'm afraid that the situation hasn't been improved.) I spent some time to dig into these failures and found out a few problems. However I'm afraid I can't fix these all with my limited knowledge about vitrage. # I've helped its project maintenance for some time but I've never looked into # its implementations quite in detail. So I'm sharing my observations here hoping someone who know better about it can look into these. 1. Usage of removed oslo_context.context.RequestContext interfaces This is the most trivial and can be fixed easily. https://review.opendev.org/c/openstack/vitrage/+/957004/2/vitrage/api/hooks… 2. Usage of asyncore modules from pysnmp-lextudio Recent release of pysnmp-lextudio no longer provides these modules, likely due to removal of asyncore in Python 3.12 . I was drafting the migration to asyncio version in https://review.opendev.org/c/openstack/vitrage/+/957004 but learned simple replacement does not work and we need more careful assessment. This might be the most tricky problem atm. 3. Some tempest test failures I can no longer see old CI results, but as far as I'm aware, CI jobs were blocked by a few tests consistently failing early in this cycle so we may have to dig into these, too. You may find some tempest tests failures in https://review.opendev.org/c/openstack/vitrage/+/957004 though I'm unsure if these are related to broken snmp service, which is caused by incomplete migration to asyncio (which I described in 2). I'm adding the tc tag, to notify them of the current status. Thank you, Takashi Kajinami -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

2 2

[swift] Unmaintained branch cleanup
by Tim Burke 20 Aug '25

20 Aug '25

Swift currently has six unmaintained branches: - unmaintained/2023.1 - unmaintained/zed - unmaintained/yoga - unmaintained/xena - unmaintained/wallaby - unmaintained/victoria Half of them have not been updated this year. For all of them, the only patches since the transition to unmaintained status were to try to maintain CI. While two of them have open patches, they all seem to revolve around maintaining CI and none of them currently pass. I propose transitioning all of these to end-of-life. If you have any objections, please respond here on the mailing list or at https://review.opendev.org/c/openstack/releases/+/958101 which makes the change. Tim

1 0

[horizon] Today's weekly meeting is cancelled
by Tatiana Ovchinnikova 20 Aug '25

20 Aug '25

Hello team, A reminder that today's meeting is cancelled since more than a half of the team is busy with downstream activities. With kind regards, Tatiana

1 0

[masakari] Add a rpc api for ping check
by do-gyun kim 20 Aug '25

20 Aug '25

Similar to Nova, I think it would be good to add ping api to masakari engine for rpc health check. This can be used for reading business and lifestyle check in Masakari distributed to Kubernetes through OpenStack Helm. Currently, there is no health check for masakari-engine in openstack-helm project, but it would be good to add it. Blueprint: https://blueprints.launchpad.net/masakari/+spec/add-a-rpc-api-for-ping

1 1

[all][elections][ptl][tc] Combined PTL/TC 2026.1 cycle Election Nominations Last Days
by Sławek Kapłoński 19 Aug '25

19 Aug '25

Hi, A quick reminder that we are in the last hours for declaring PTL and TC candidacies. Nominations are open until Aug 20, 2025 23:45 UTC. If you want to stand for election, don't delay, follow the instructions at[1] to make sure the community knows your intentions. Make sure your nomination has been submitted to the openstack/election repository and approved by election officials. All members of the community are encouraged to confirm their email address and opt in to the CIVS election as described at: https://governance.openstack.org/election/#electorate Election statistics[2]: Nominations started @ 2025-08-06 23:45:00 UTC Nominations end @ 2025-08-20 23:45:00 UTC Nominations duration : 14 days, 0:00:00 Nominations remaining : 1 day, 9:36:15 Nominations progress : 90.00% --------------------------------------------------- Projects[1] : 38 Projects with candidates : 18 ( 47.37%) Projects with election : 1 ( 2.63%) --------------------------------------------------- Need election : 1 (Horizon) Need appointment : 20 (Adjutant Barbican Blazar Cloudkitty Cyborg Glance Magnum Manila Masakari Mistral Monasca OpenStackAnsible OpenStack_Ch arms Quality_Assurance Rally Swift Tacker Trove Venus Vitrage) --------------------------------------------------- TC Candidates : 2 (4 Required) =================================================== Stats gathered @ 2025-08-19 14:08:45 UTC This means that with approximately 2 days left, 20 projects will be deemed leaderless. In this case the TC will oversee PTL selection as described by [3]. Thank you, [1] https://governance.openstack.org/election/#how-to-submit-a-candidacy [2] Any open reviews at https://review.opendev.org/q/project:openstack/election+is:open+file:candid… have not been factored into these stats. [3] https://governance.openstack.org/resolutions/20141128-elections-process-for… -- Slawek Kaplonski Principal Software Engineer Red Hat

2 1

[election][cloudkitty] PTL candidacy for the 2026.1 release cycle
by Rafael Weingärtner 19 Aug '25

19 Aug '25

Hi all, I would like to self-nominate for the role of PTL of CloudKitty for the 2026.1 release cycle. I have been PTL since the Victoria cycle and I am willing to continue in this role. I will keep working with existing contributors to maintain CloudKitty for their use cases and encourage the addition of new functionalities. I have opened the patch with my candidacy: https://review.opendev.org/c/openstack/election/+/957871 -- Rafael Weingärtner

1 0

[openstack-client|keystone] API calling behavior for fetching by id or name
by Niklas Schwarz 19 Aug '25

19 Aug '25

Hey there I have observed that the keystone logs are flooded with error messages and a stack trace that resources are not found. When investigating on the issue I noticed that the resources do exist but the behavior of the openstack-client is a bit confusing. I will describe the behavior for the openstack-client in the interaction with the kestone api. As know the openstack-cli which uses the openstack-client has the functionality to show a user either by passing an id or the name of the user. The requests when executing the command with the name of the user will be 1. v3/user/<name_or_id> - v3/user?name=<name_or_id> The first request is issued to the endpoint which expects the rout parameter to be an id of the user and in the case of the keystone api a db query is executed with the name as an id and no user will be found which results in the log message and the stack trace in the keyston logs. Because no user was found the openstack-client issues a second request to the api with the name as a query-parameter instead of a rout-parameter which will issue the db-query at the keystone api to search by the username. On some deployments this can and will be additional load on the database and on the api which can be reduced just by sending the correct request to the api instead of "guessing" and trying for the correct request and hoping there will be an answer. The issue with keystone is that the openstack-client will issue also requests to the keystone api when listing, e.g. networks but only for a specific project (openstack network list --project <name_or_id>). The client will first search for the project and in the worst case these are two requests. In my opinion this behavior can be prevented to send multiple requests to the keystone api (or any other api), either by checking on the client if a the passed parameter is an id or by handling the passed route-parameter accordingly in the keystone api and executing the correct db-query to prevent multiple requests. I have decided on implementing a change [1] on the client side and have adjusted the openstack-client. As artem pointed out in the review that in some services there are places where the id cannot be really identified as such I wanted to ask/I was asked to discuss the issue on the mailing list since there might be multiple projects involved in such a change to reduce the calls to the api (when handling on the client side) or db (when handling on the server side) when a search by an id or name is issued. Are there an plans on tackling this issue or any other options and opinions? The post by marc [2] might also be a result of the openstack-client issuing multiple requests to the api and polluting the logs. So in some cases this is a realy issue. Best regards Niklas [1] https://review.opendev.org/c/openstack/python-openstackclient/+/933644 [2] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack…

3 4

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2025.2/R-6)
by Goutham Pacha Ravi 18 Aug '25

18 Aug '25

Hello Stackers, We're six weeks away from the release date for the 2025.2 "Flamingo" release [1]. We will observe a feature freeze for this release on August 28th. Nominations for TC and PTL elections are due by August 20th at 23:45 UTC [2]. Please remember that you must be a member of the OpenInfra Foundation to contest these elections. The OIF's recent move under the Linux Foundation meant that any prior member is not automatically considered a member unless they accept this change by renewing their membership [3]. To run as a Project Team Lead, one must also have contributed to the project in the one-year period prior to the nomination deadline. We check this by matching the data between the candidate's OIF profile and their contributions on Gerrit. I understand that several well-meaning candidacies could hit roadblocks because of these requirements. We'd be happy to respond to concerns in the #openstack-election channel on OFTC. Ghanshyam Maan (gmaan), a long-serving member of the TC, would like to take a break and will not be contesting the upcoming elections. I'd like to thank him for his many years of service on the TC, including as its chair. I'm excited to see other community members step up to join the TC in his stead. In the past week, the OpenStack Technical Committee worked with several project teams (Oslo, Requirements, Release Management, Freezer, and Ironic) to reaffirm their distributed leadership model and confirm their liaisons for the upcoming release. We also made some progress on retiring repositories owned by the Monasca project team. The governance proposal [4] to that effect is under the community's review. The community is requested to review the proposed runtime (Python versions and Linux distributions) update for the Gazpacho/2026.1 release cycle [5]. === Weekly Meeting === The last weekly meeting of the OpenStack Technical Committee was hosted in OFTC's #openstack-tc channel on August 12th, 2025 [6]. We checked on the progress of retiring the Monasca project team. We also discussed the retirement of the refstack-server in the opendev namespace, noting that while the server has been deleted, a desire remains within the community for a lightweight "certification" process to promote interoperability among providers. However, no one has yet committed to leading this effort. If you're reading this and are interested in working on this, please chime in on this list, or within the #openstack-tc IRC channel on OFTC. The conversation then shifted to the health of the gate and the future supported runtimes [5]. Infra administrators noted that the OpenMetal provider is back online in Zuul and that they are working on adding Debian Trixie and dropping older content like Xenial. As for the runtime for Gazpacho, there was a detailed discussion about dropping Python 3.10 and Ubuntu 22.04, with a consensus to drop the latter but a more cautious approach to Python 3.10, which will remain a minimum supported version for now. The group also agreed to include Python 3.13 as a maximum supported version, as recent bug fixes in eventlet make it viable for testing. The next meeting of the TC is today, August 19th, 2025, at 1700 UTC. This meeting will be hosted over IRC, in OFTC's #openstack-tc channel. Please find the meeting's agenda in the wiki [7]. I hope you'll be able to join us. === Governance Proposals === ==== Open For Review ==== - Reset watcher project leadership from DPL back to PTL | https://review.opendev.org/c/openstack/governance/+/956913 - Require declaration of affiliation from TC Candidates | https://review.opendev.org/c/openstack/governance/+/949432 - Define testing runtime for 2026.1 release | https://review.opendev.org/c/openstack/governance/+/957199 - Retire Monasca project | https://review.opendev.org/c/openstack/governance/+/953671 === Upcoming Events === - 2025-08-20: Nominations close for OpenStack elections: - 2025-08-26: OpenInfra Days, Korea: https://2025.openinfradays.kr/ - 2025-08-28: Feature Freeze deadline, Milestone-3 of the Flamingo release [1] - 2025-08-29: Colombia OpenInfra User Group Meetup: https://www.meetup.com/colombia-openinfra-user-group/events/307096751/ - 2025-09-09: OIF Board Monthly meeting: https://board.openinfra.org/ - 2025-10-17: OpenInfra Summit, Paris-Saclay: https://summit2025.openinfra.org/ Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2025.2 "Flamingo" Release Schedule: https://releases.openstack.org/flamingo/schedule.html [2] Contesting elections: https://governance.openstack.org/election/#how-to-submit-a-candidacy [3] Renew OIF membership: https://openinfra.org/a/renew-membership [4] Retiring Monasca: https://review.opendev.org/c/openstack/governance/+/953671 [5] Runtime update for 2026.1: https://review.opendev.org/c/openstack/governance/+/957199 [6] TC Meeting IRC Log, Aug 12th 2025: https://meetings.opendev.org/meetings/tc/2025/tc.2025-08-12-17.00.html [7] TC Meeting Agenda, Aug 19th 2025: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[openstack]backup as a service
by Nguyễn Hữu Khôi 18 Aug '25

18 Aug '25

Hello. I am curious that why dont have a complete backup solution for Openstack. I used Cinder backup but It cannot schedule time to backup and wont display how long to complete backup. I found Freezer and Raksha but it was abadonned. Currently, we use Ceph and do snapshot and rbd export to backup Ceph volumes. Nguyen Huu Khoi

2 11

[dev][infra][qa][tact-sig] Updating Zuul to Ansible 11
by Jeremy Stanley 18 Aug '25

18 Aug '25

Just a heads up for those not following OpenDev's service-announce mailing list, today OpenDev is switching Zuul's default Ansible version in the openstack tenant from 9 to 11. See this announcement for further details: https://lists.opendev.org/archives/list/service-announce@lists.opendev.org/… If you notice any new behavior changes in your jobs, double-check that it's not related to the Ansible version update. -- Jeremy Stanley

1 0

[all][elections][ptl][tc] Combined PTL/TC 2026.1 cycle Election Nominations Last Days
by Sławek Kapłoński 18 Aug '25

18 Aug '25

Hi, A quick reminder that we are in the last hours for declaring PTL and TC candidacies. Nominations are open until Aug 20, 2025 23:45 UTC. If you want to stand for election, don't delay, follow the instructions at[1] to make sure the community knows your intentions. Make sure your nomination has been submitted to the openstack/election repository and approved by election officials. All members of the community are encouraged to confirm their email address and opt in to the CIVS election as described at: https://governance.openstack.org/election/#electorate Election statistics[2]: Nominations started @ 2025-08-06 23:45:00 UTC Nominations end @ 2025-08-20 23:45:00 UTC Nominations duration : 14 days, 0:00:00 Nominations remaining : 2 days, 14:27:12 Nominations progress : 81.41% --------------------------------------------------- Projects[1] : 38 Projects with candidates : 8 ( 21.05%) Projects with election : 1 ( 2.63%) --------------------------------------------------- Need election : 1 (Horizon) Need appointment : 30 (Adjutant Barbican Blazar Cloudkitty Cyborg Glance Heat Keystone Magnum Manila Masakari Mistral Monasca Neutron Nova Octavia OpenStackAnsible OpenStackSDK OpenStack_Charms Puppet_OpenStack Quality_Assurance Rall y Storlets Sunbeam Swift Tacker Telemetry Trove Venus Vitrage) --------------------------------------------------- TC Candidates : 2 (4 Required) =================================================== Stats gathered @ 2025-08-18 09:17:48 UTC This means that with approximately 2 days left, 30 projects will be deemed leaderless. In this case the TC will oversee PTL selection as described by [3]. Thank you, [1] https://governance.openstack.org/election/#how-to-submit-a-candidacy [2] Any open reviews at https://review.opendev.org/q/project:openstack/election+is:open+file:candid… have not been factored into these stats. [3] https://governance.openstack.org/resolutions/20141128-elections-process-for… -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0