March 2026 - openstack-discuss - lists.openstack.org

Update on RDO: A Shift to Containers
by Amy Marrich 05 Mar '26

05 Mar '26

*Dear RDO Community/Stakeholders,This email provides an important update regarding the RDO project and its future direction which marks a significant change in how RDO content will be delivered.End of RDO RPM BuildsHistorically, RDO provided RPM-based rebuilds of upstream OpenStack packages. Due to insufficient contributors, the continuous RDO rpm builds that were released through the CentOS Cloud SIG have been officially discontinued as of the Epoxy release.Introducing the New RDO: Container FocusThe future of RDO will be focused entirely on containers. This is a pivot from our traditional RPM delivery, as RDO did not previously focus on containers.RDO will be transitioning to Source-to-Image (S2I) builds for service containers. This work will be starting shortly within the github.com/openstack-k8s-operators <http://github.com/openstack-k8s-operators> organization, and these new container builds will essentially be the "new RDO".Timeline and Usage: - This transition work has not yet begun. The timeline is not committed, but the work is currently expected to be available for the Hibiscus release in late 2026. The final delivery location of those images is still to be determined.- These containers are primarily intended to be consumed via the operators provided in the openstack-k8s-operators GitHub organization.- While nothing explicitly prevents these containers from being used elsewhere, this is not currently part of the plan. Community involvement and feedback for broader usage are welcome including within OKD and the okderators.- Please note that the operators in this organization are currently only developed and tested on Red Hat OpenShift Container Platform.Thank you for your understanding and continued support as we make this important shift. We look forward to engaging with the community on this new path forward.Sincerely,* Amy

2 1

[Nova][Tacker][Issue Investigation] API Schema Inconsistency in Nova Microversion 2.100 - Impacting Tacker CI Jobs
by Shivam Shukla 05 Mar '26

05 Mar '26

Hi Nova Team, We are currently facing an issue in Tacker (master branch) caused by a bug in Nova microversion 2.100, where scheduler_hints.group is returned as a list instead of a string in the server GET API response. Problem Statement: The server GET API (microversion 2.100) returns scheduler_hints.group as a list, whereas the API schema requires it to be a string UUID. This type mismatch causes server rebuild operations to fail with a 400 Bad Request error. Root Cause: Nova stores scheduler hints internally using DictOfListOfStringsField, so all values are kept as lists. When microversion 2.100 exposes scheduler hints in the API response, the group field is returned in its raw internal form without being converted back to the string format required by the API spec. Impact: This bug is causing test case failures in Tacker CI jobs, making our pipeline unstable. Detailed information about the bug can be found in the reports linked below: Nova Bug: https://bugs.launchpad.net/nova/+bug/2139275 We'd appreciate your help in reviewing and fixing this bug at the earliest, as it is actively impacting Tacker CI stability. Please let us know if you need any additional details from our side. Thanks in advance for your support! Thanks & Regards, Shivam Shukla (シヴァム・シュクラ) Mobile: +91-9450053922 E-mail: shivam.shukla3(a)india.nec.com The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or NEC Corporation India Private Limited or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of NEC Corporation India Private Limited or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.

1 0

[requirements][horizon] Requirements freeze exception for XStatic-Font-Awesome
by Tatiana Ovchinnikova 05 Mar '26

05 Mar '26

Hello, I would like to request a requirements freeze exception to unpin XStatic-Font-Awesome and bump it from 4.7.0.0 to 6.2.1.2 [1]. This version doesn't use pkg_resources in build. From Horizon side we have worked around the required changes to use newer versions of the font [2], and after the requirements upgrade to 6.2 the hack can be safely removed. With kind regards, Tatiana [1] 977626: Bump XStatic-Font-Awesome to 6.2.1.2 and unpin it | https://review.opendev.org/c/openstack/requirements/+/977626 [2] 977249: A hack to make Horizon work with Font Awesome 6.2 | https://review.opendev.org/c/openstack/horizon/+/977249

2 1

[requirements][horizon] Requirements freeze exception for selenium
by Tatiana Ovchinnikova 05 Mar '26

05 Mar '26

Hello, I would like to request a requirements freeze exception to unpin Selenium and bump it from 3.141.0 to 4.41.0 [1]. Selenium 3.141.0 no longer works with modern urllib3. It needs to be updated to ensure compatibility with other libraries like urllib3. All required work has been done from Horizon side [2]. As a temporary workaround local upper-constraints.txt was created [3], and the follow up patch to remove it and roll back to global requirements is prepared [4]. With kind regards, Tatiana [1] 978157: Unpin selenium and use latest | https://review.opendev.org/c/openstack/requirements/+/978157 [2] 978177: Upgrade selenium to 4.41.0 | https://review.opendev.org/c/openstack/horizon/+/978177 [3] 978078: Create and use local upper-constraints to avoid Selenium failing | https://review.opendev.org/c/openstack/horizon/+/978078 [4] 978896: Remove local upper-constraints and go back to global one | https://review.opendev.org/c/openstack/horizon/+/978896

2 1

[requirements][sdk] Requirements freeze exception for 'testtools'
by Stephen Finucane 04 Mar '26

04 Mar '26

o/ I would like to request a requirements freeze exception to bump `testtools` from 2.8.4 to 2.8.5, as proposed here [1]. testtools 2.8.5 includes a small type hint fix [2] that resolves pep8 failures currently seen in the gates of a number of SDK deliverables [3][4][5]. It carries effectively zero risk and bumping it would be both easier and safer than updating the affected projects across both master and stable/2026.1 to add `type: ignore` comments or disable the check. Cheers, Stephen [1] https://review.opendev.org/c/openstack/requirements/+/978329 [2] https://github.com/testing-cabal/testtools/compare/2.8.4...2.8.5 [3] https://review.opendev.org/c/openstack/osc-lib/+/978668 [4] https://review.opendev.org/c/openstack/cliff/+/978659 [5] https://review.opendev.org/c/openstack/python-openstackclient/+/978670

2 1

[requirements][sdk] Requirements freeze exception for 'fixtures'
by Stephen Finucane 04 Mar '26

04 Mar '26

o/ I would like to request a requirements freeze exception to bump `fixtures` from 4.3.0 to 4.3.1, as proposed here [1]. As with my earlier testtools request, fixtures 4.3.1 includes a small type hint fix [2] that resolves pep8 failures currently seen in the gates of a number of SDK deliverables. Once again, the bump carries effectively zero risk and bumping it would be both easier and safer than updating the affected projects across both master and stable/2026.1 to add `type: ignore` comments or disable the check. Cheers, Stephen [1] https://review.opendev.org/c/openstack/requirements/+/978871 [2] https://github.com/testing-cabal/fixtures/compare/4.3.0...4.3.1

2 1

[CloudKitty] Core Reviewer Nominations of Juan Larriba and Jaromir Wysogla
by Rafael Weingärtner 04 Mar '26

04 Mar '26

Hello team, I am writing to nominate Juan Larriba (<jlarriba(a)redhat.com>) and Jaromir Wysogla (<jwysogla(a)redhat.com>) as core reviewers for the CloudKitty project. Over the past months they have made significant contributions to the project. We have discussed their nomination in the last bi-weekly meeting, and we will move on with the addition. -- Rafael Weingärtner

1 0

[election][barbican] PTL Candidacy for the 2026.2 Release Cycle
by Mauricio Harley 04 Mar '26

04 Mar '26

Hi, everyone. I would like to continue serving as PTL for Barbican during the 2026.2 cycle. Over the past cycle, I worked to keep the project healthy and aligned with OpenStack's evolving standards. Key achievements include dropping the unmaintained repoze.profile dependency, adopting oslo.middleware's common RequestId implementation, fixing CI nodeset configurations for the Dogtag functional tests, and maintaining release notes across stable branches. I have also ensured alignment with upstream tooling and supported ongoing maintenance across barbican-ui, barbican-tempest-plugin, and openstack-ansible-os_barbican. As the current PTL, I am familiar with the project's codebase, its integration points with other OpenStack services, and our operator community's needs. I am committed to continuing this work, ensuring Barbican remains a reliable secrets management solution, and fostering collaboration with contributors and downstream consumers. I respectfully ask for your support in the upcoming election. Maurício Harley (mharley)

2 1

[neutron][OVN] North South wont work
by Nguyễn Hữu Khôi 04 Mar '26

04 Mar '26

Hello, I have the following issue: My router has an external interface and an internal interface. An instance can ping the router’s external interface, but it cannot ping the external provider network gateway. I am using distributed floating IPs. I created another router using the same provider network, and instances connected to that router can reach the external gateway without any issues. Could you please suggest how I can debug this problem? Openstack Env: 2025.1 Thank you. Regards Nguyen Huu Khoi

2 5

[OSSA-2026-003] OpenStack Vitrage: Remote code execution through Vitrage query parser (CVE-2026-28370)
by Jeremy Stanley 04 Mar '26

04 Mar '26

================================================================= OSSA-2026-003: Remote code execution through Vitrage query parser ================================================================= :Date: March 03, 2026 :CVE: CVE-2026-28370 Affects ~~~~~~~ - Vitrage: <12.0.1, ==13.0.0, ==14.0.0, ==15.0.0 Description ~~~~~~~~~~~ Khalil Lemtaffah (Nokia) reported a vulnerability in the Vitrage query parser. A user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise of the Vitrage service. All deployments exposing the Vitrage API are affected. Patches ~~~~~~~ - https://review.opendev.org/962671 (2023.1/antelope) - https://review.opendev.org/962713 (2024.1/caracal) - https://review.opendev.org/962712 (2024.2/dalmatian) - https://review.opendev.org/962646 (2025.1/epoxy) - https://review.opendev.org/962658 (2025.2/flamingo) - https://review.opendev.org/962617 (2026.1/gazpacho) Credits ~~~~~~~ - Khalil Lemtaffah from Nokia (CVE-2026-28370) References ~~~~~~~~~~ - https://storyboard.openstack.org/#!/story/2011539 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28370 Notes ~~~~~ - The stable/2023.1 branch is unmaintained and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0