October 2026 - openstack-discuss - lists.openstack.org

[release] Release countdown for week R-23
by Elõd Illés 09 Oct '26

09 Oct '26

Hi, Welcome back to the release countdown emails! These will be sent at major points in the 2027.1 "Indri" development cycle, which should conclude with a final release on 24 March, 2027. Development Focus ----------------- At this stage in the release cycle, focus should be on planning the 2027.1 "Indri" development cycle, assessing 2027.1 "Indri" community goals and approving 2027.1 "Indri" specs. General Information ------------------- This cycle is 25 weeks long. In case you haven't seen it yet, please take a look over the schedule for this release: https://releases.openstack.org/indri/schedule.html By default, the team PTL is responsible for handling the release cycle and approving release requests. This task can (and probably should) be delegated to release liaisons. Now is a good time to review release liaison information for your team and make sure it is up to date: https://opendev.org/openstack/governance/src/branch/master/reference/projec… By default, all your team deliverables from the 2026.2 "Hibiscus" release are continued in 2027.1 "Indri" with a similar release model. Upcoming Deadlines & Dates -------------------------- 2027.1 "Indri" virtual PTG: 12-16 October, 2026 (next week) Indri-1 milestone: 19 November, 2026 Előd Illés irc: elodilles @ #openstack-release

1 0

[openstack-ansible] Core group clean-up
by Dmitriy Rabotyagov 09 Oct '26

09 Oct '26

Hi folks, Following example of other projects and due to unmet any of criterias to the team's Core Reviewer Expectations [1] for more then 2 cycles in a row, I am proposing to remove following members from the openstack-ansible-core group: - David Wilde <dwilde(a)redhat.com> - ebbex <openstack(a)slipsprogrammor.no> - Georgina Shippey <georgina.shippey(a)outlook.com> - Guilherme Steinmüller <gsteinmuller(a)vexxhost.com> - Kevin Carter <kevin(a)cloudnull.com> - Logan V <logan2211(a)gmail.com> - Mohammed Naser <mnaser(a)vexxhost.com> In case you have any questions or suggestions - let me know until Oct 16 2026. With that being said, I want to thank contributors for their prior involvement in the project and bringing high plenty of value into its evolution. [1] https://docs.openstack.org/openstack-ansible/latest/contributors/core-revie…

1 0

[masakari] Indri PTG schedule
by 室井雅仁（共通プラットフォーム開発本部） - Muroi Masahito - 09 Oct '26

09 Oct '26

Hello Masakari folks, First of all, thank you for all your development. The etherpad page for the up-comming PTG is https://etherpad.opendev.org/p/oct2026-ptg-masakari . Sorry for the slow notification. If you have any additional topics feel free to add it. Our PTG time slot are following: - Tuesday: 7:00am-9:00am UTC - Wednesday: 7:00am-9:00am UTC (backup day) best regards, Masahito

1 0

[masakari] Team cleanup
by Takashi Kajinami 09 Oct '26

09 Oct '26

Hello, I've reviewed the current membership of our launchpad groups and gerrit groups and have removed the following members from these groups due to their inactivity for some time. Jegor van Opdorp SamP Tushar Patil In case you have any question or concern then please let me know. I'd like to take this opportunity to thank these persons for their work which helped us bring the project to the current state. -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

1 0

[cyborg] Cyborg weekly meeting cancelled - Oct 13th, 2026
by Joan Francesc Gilabert Navarro 09 Oct '26

09 Oct '26

Hi all, The next Cyborg weekly meeting (Oct 13th) is cancelled due to the vPTG. We will resume our regular meeting schedule the following week, on Oct 20th. You can find all information about the Cyborg PTG sessions at https://etherpad.opendev.org/p/cyborg-2027.1-ptg Regards, Joan

1 0

[neutron] Drivers meeting canceled Friday, October 9th
by Brian Haley 09 Oct '26

09 Oct '26

Hello Neutrinos: I am going to cancel tomorrow's Drivers meeting, we can discuss any RFE items at the PTG next week. Just a reminder that our open spec list is at [0]. Have a nice weekend! -Brian [0] https://review.opendev.org/q/status:open+project:openstack/neutron-specs

1 0

Clarification on oslo_messaging_rabbit config (prefetch_count) from RabbitMQ
by Sergey Korobitsin 09 Oct '26

09 Oct '26

Hi Arnaud, Thank you for your and Julien's excellent presentation "Who framed RabbitMQ" at OpenInfra Summit 2025 France on migrating OpenStack to RabbitMQ with stream and quorum queues. Me and my team recently transitioned our OpenStack infrastructure to this exact setup using the configuration you recommended: [oslo_messaging_rabbit] rabbit_quorum_queue = True rabbit_transient_quorum_queue = True rabbit_qos_prefetch_count = 1 use_queue_manager = True rabbit_stream_fanout = True I have a question specifically regarding rabbit_qos_prefetch_count = 1. Since the default value in Oslo Messaging is 0 (unlimited), setting it to 1 intuitively feels like it might become a bottleneck under load. Based on my research, tuning advice usually points to a value in the 10–30 range, especially for a deployment with around 100 compute nodes. Given your deep expertise in the OpenStack community, I assume there is a solid architectural reason for strictly recommending a prefetch count of 1 in this context. Could you elaborate on why this specific value is optimal? For instance, is it necessary to prevent specific message delivery issues with quorum queues, or does it help with consumer load balancing in a specific way? Any insights you could share would be greatly appreciated. -- Best regards, Sergey Korobitsin Cloud Team Lead PS Cloud Services

3 7

[manila] 2027.1 Indri PTG Schedule
by Carlos Silva 09 Oct '26

09 Oct '26

Hello zorillas and interested stackers, First, thank you for adding your topics to the PTG planning etherpad. The PTG is next week and we have plenty to work through. As usual, I'm sharing the official PTG etherpad with a tentative schedule with you ahead of time [1]. We will be meeting on: - Wednesday: 13:00 - 17:00 UTC - Thursday: 14:00 - 17:00 UTC - Friday: 14:00 - 16:00 UTC Additionally, we will have two cross-project sessions with: - Nova: VirtioFS next steps - Monday 16:00 - 17:00 UTC - Cinder: Sovereign clouds - Thursday 17:00 - 18:00 UTC The topics on the etherpad already have a proposed time slot that addresses the requests you shared. If you'd like to request a time slot change, please let me know as soon as possible. [1] https://etherpad.opendev.org/p/indri-ptg-manila I'm looking forward to it. Thank you, carloss

1 0

[OSSN-0110] Ironic can leak basic auth credentials to image server
by Jay Faulkner 08 Oct '26

08 Oct '26

============================================================= OSSN-0110: Ironic can leak basic auth credentials to image server (2026-10-08) ============================================================= Summary ~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io security team reported a vulnerability in Ironic. When ``[deploy]/image_server_auth_strategy`` option is configured for HTTP(S) Basic Authentication, the operator's image server username and password are sent to every host from which image data is requested. Any tenant with access to perform a deployment can set ``instance_info/image_source`` or ``instance_info/image_checksum`` to a host they control, triggering this vulnerability. Affected Services / Software ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - ironic ('>=24.0.0 <29.1.1, >=30.0.0 <32.1.1, >=33.0.0 <35.1.1, >=36.0.0 <39.0.0') Discussion ~~~~~~~~~~ The fix adds a ``[deploy]/image_server_auth_hosts`` option allowing operators to restrict the hosts to which credentials are sent, along with a ``[deploy]/image_server_auth_permit_unknown_hosts`` option. Deployments of OpenStack-integrated Ironic typically use Glance for image management and are not impacted by this vulnerability. Recommended Actions ~~~~~~~~~~~~~~~~~~~ Operators utilizing the basic auth feature for image retrieval should: * Apply the relevant patch for their release * set ``[deploy]/image_server_auth_hosts`` to a list of acceptable hosts to pass authentication credentials to * set ``[deploy]/image_server_auth_permit_unknown_hosts`` to ``False`` Ironic intends to change the default of ``[deploy]/image_server_auth_permit_unknown_hosts`` to ``False`` in the 2027.1 release. See https://review.opendev.org/999907 for more information. **Patches** * **2027.1/indri**: The fix for this CVE was merged before 2027.1 was branched. * **2026.2/hibiscus**: https://review.opendev.org/999744 * **2026.1/gazpacho**: https://review.opendev.org/1003587 * **2025.2/flamingo**: https://review.opendev.org/1003597 * **2025.1/epoxy**: https://review.opendev.org/1003598 * **bugfix/38.0**: https://review.opendev.org/1003577 * **bugfix/37.0**: https://review.opendev.org/1003579 **Credits:** * Tuomo Tanskanen, Metal3.io Security Team (Ericsson Software Technology) * Dmitry Tantsur, Metal3.io Security Team (Red Hat) Contacts / References ~~~~~~~~~~~~~~~~~~~~~ **Author:** Jay Faulkner (G-Research OSS) * Original bug : https://launchpad.net/bugs/2162816 * This OSSN : https://docs.openstack.org/security-notes/OSSN-0110.html * Mailing List : openstack-discuss(a)lists.openstack.org * OpenStack Security : https://security.openstack.org/ * CVE-2026-90461 : https://nvd.nist.gov/vuln/detail/CVE-2026-90461

1 0

[all][glance] uwsgi: broken Transfer-Encoding: chunked when TLS is enabled
by Thomas Goirand 08 Oct '26

08 Oct '26

Hi, I've found a *very* long standing issue that was blocking us from using uwsgi for Glance. It was broken when TLS and Transfer-Encoding: chunked. Details are on the pull request: https://github.com/unbit/uwsgi/pull/2781 I thought it would be nice to share, because I know the Glance team is using mod_proxy in front of uwsgi, which I was not. So far, we've been using the Eventlet server, with haproxy doing the TLS front, so we could do re-encryption to localhost and keep Glance as it was. Though since Hibiscus, I was forced to flip the switch and make it use uwsgi. That's how I had to investigate, since basically, server backups were broken for us (with Swift as a back-end). Anyways, that's fixed. I'd love to have this fixed upstream first, and I'll try to get the patch in Debian unstable and into Debian Trixie too. Hoping this also helps the Glance team, Cheers, Thomas Goirand (zigo)

4 6