April 2026 - openstack-discuss - lists.openstack.org

[cinder] NO festival of reviews friday 2026-05-01
by Brian Rosmaita 30 Apr '26

30 Apr '26

Given that tomorrow is a holiday in most parts of the world, and an "economic blackout" in the USA, we will NOT be holding the Festival of Reviews this week. cheers, brian

1 0

[Octavia] Loadbalancer keyerror
by Eduardo Morais 30 Apr '26

30 Apr '26

environment: kolla ansible 2025.1 deploy: all-in-one Hello everyone, I have a little problem with Octavia. When I create a load balancer, everything works; it creates an LB and becomes active and online. But, when I try to use it, it doesn't work. I was looking in the Octavia worker logs and I got this error, but I don't know what it means. I searched for everything: the amphora VM is working, the amphora agent is also working, the network looks fine, and the image is OK. Searching in the logs, the error occurred when Octavia tried to add a member to the pool. octavia worker logs: https://paste.openstack.org/show/832969/

2 2

[oslo] Proposal to add Ghanshyam Maan as core team
by Daniel Mats Niklas Bengtsson 30 Apr '26

30 Apr '26

Hi everyone, I hope you are all doing well. I would like to propose adding Ghanshyam Maan to the oslo core team. Ghanshyam has been actively contributing to the Oslo libraries for some time. He regularly participates in technical discussions, including work around multiprocessing, provides thoughtful and constructive code reviews, and has contributed several solid patches. He is also currently serving as the TACT-SIG liaison and has offered to take on the role of release liaison as well. His consistent involvement in reviews and project discussions demonstrates a strong commitment to the Oslo projects and to the OpenStack community. I believe he would be a great addition to the oslo core team. Please reply with your votes (+1 / 0 / -1). The vote will remain open for one week.

7 8

[OSSA-2026-008] Ironic: Command Injection in Ironic IPMI Console Implementations (CVE-2026-42510) - errata 1
by Goutham Pacha Ravi 29 Apr '26

29 Apr '26

======================================================================= OSSA-2026-008: Command Injection in Ironic IPMI Console Implementations ======================================================================= :Date: April 27, 2026 :CVE: CVE-2026-42510 Affects ~~~~~~~ - Ironic: >=4.3.0 <26.1.6, >=27.0.0 <29.0.5, >=30.0.0 <32.0.1, >=33.0.0 <35.0.1 Description ~~~~~~~~~~~ Dmitry Tantsur and Tuomo Tanskanen from the Metal3.io Security Team reported a vulnerability in Ironic's IPMI console backends. A project manager for the project marked as a ``node.owner`` can inject arbitrary commands which a conductor executes on console activation. No console backends are enabled by default in Ironic. Only installations which have set ``[conductor]/enabled_console_interfaces`` to enable either ``ipmitool-shellinabox`` or ``ipmitool-socat`` are vulnerable. Errata ~~~~~~ When the original advisory was published a CVE number was not assigned. CVE-2026-42510 was assigned on 2026-04-29. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/986418 (2023.1/antelope (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/986417 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/986363 (2024.2/dalmatian) - https://review.opendev.org/c/openstack/ironic/+/986362 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/986361 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/986235 (2026.1/gazpacho) Credits ~~~~~~~ - Dmitry Tantsur from Metal3.io Security Team - Tuomo Tanskanen from Metal3.io Security Team References ~~~~~~~~~~ - https://launchpad.net/bugs/2148331 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42510 Notes ~~~~~ - A CVE request was filed with MITRE on 2026-04-27. - Patches for unmaintained branches are provided as a courtesy. - The ``ipmitool-shellinabox`` console interface is already scheduled for removal from Ironic for lack of security support for shellinabox. Security sensitive operators are strongly encouraged to stop use of this console interface immediately. OSSA History ~~~~~~~~~~~~ - 2026-04-29 - Errata 1 - 2026-04-27 - Original Version -- Goutham Pacha Ravi (gouthamr) OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

[manila] Cancelling Apr 30th weekly meeting
by Carlos Silva 29 Apr '26

29 Apr '26

Hello, zorillas As we do traditionally, I would like to cancel tomorrow's meeting, as we're still going through our PTG action items and working on the feedback post discussions. We'll be back to our regular weekly meeting schedule next week (May 7th). Thank you, carloss

1 0

[policy] Removing the enforce_scope config option
by Ghanshyam Maan 29 Apr '26

29 Apr '26

Hello everyone, As planned in RBAC goal, the enforce_scope flag[1] was added temporarily to facilitate a smooth transition to the new RBAC and was deprecated for removal. This config was enabled by default in the 2024.2 (Dalmatian) release. As per goal timeline, we were supposed to remove this config option in 2025.2[2]. I know we are late, but I am targeting this cycle to remove this flag. What does this mean: ----------------------------- Once it is removed, the scope type will always be enforced (which is the end goal of SRBAC). If the policy rule defines the scope_type and the token does not match with that scope, then oslo.policy will raise the InvalidScope exception. Project can catch this exception and raise the modified error message similar to PolicyNotRegistered. Action item on projects: ------------------------------- 1. There are 5 projects (cinder, tacker, aetos, aodh, and barbican) that still have not enabled the scope enforcement by default (they override the enforce_Scope to false). These projects need to remove the enforce_scope override. I have proposed the change to remove it and would like to request that the project maintainer look into the changes/failure. 2. Projects need to modify their SRBAC tests because they test the scope enforcement by modifying the enforce_scope value. For example nova unit tests[3]. How to test your project: I have proposed the oslo.policy change to remove the config, and that can be used to test your project. For testing, add oslo.policy in your project jobs in 'required_project' field and depends-on the oslo.policy change (986475) oslo.policy change: https://review.opendev.org/c/openstack/oslo.policy/+/986475 nova testing change as an example: https://review.opendev.org/c/openstack/nova/+/986479 Tracking and deadline: ------------------------------ Please use the topic 'secure-rbac' and the hashtag 'remove-enforce-scope-flag' so we can track all dependencies. - https://review.opendev.org/q/hashtag:%22remove-enforce-scope-flag%22+(statu… I am targeting milestone-2 (July 3rd) as deadline to merge the oslo.policy change, make sure your project is good on removing enforce_scope. [1] https://docs.openstack.org/oslo.policy/latest/configuration/#oslo_policy.en… [2] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rb… [3] https://github.com/openstack/nova/blob/baee7c3a4f551135ca0e52fa176693a8b11a… -gmaan

1 0

[neutron][horizon] Dashboard falsely shows enable_dhcp=true for subnet
by Eugen Block 28 Apr '26

28 Apr '26

Hi, We upgraded to Epoxy last year (package based), Ubuntu 24.04 on all nodes. Last week I created a new project with new networks and all. The VMs in a specific subnet didn't get an IP (nor their hostname) from neutron, so I checked the subnet config in the dashboard and all looked good, but it still didn't work. So I checked in CLI, and enable_dhcp was set to false (while the checkbox in the dashboard was checked). So I unchecked the box, committed the change, then checked it again, but the flag didn't change in the CLI output. When I disable enable_dhcp in CLI the dashboard still shows a checked box. When I uncheck and check the box again, enable_dhcp is finally enabled via dashboard. Does this behaviour ring a bell to anyone? I searched for a bit but couldn't find anything relevant. I feel like we've been facing that already some time ago, but I can't recall details and it doesn't seem to occur regularly. I'd appreciate any pointers. Thanks! Eugen

2 4

[horizon] Cancelling Horizon weekly meeting on April 29
by Tatiana Ovchinnikova 28 Apr '26

28 Apr '26

Hello team, Since most of the people are recovering from PTG, I'm cancelling our weekly meeting tomorrow. See you all on May 6! Regards, Tatiana

1 0

[PTL] University Partnership Program Project Proposals Collection
by Kendall Nelson 28 Apr '26

28 Apr '26

Hello folks! For those who couldn't attend last Monday's TC session at the PTG, I talked about the mentorship/student opportunities we have coming up shortly and how to get involved with those: - Carnegie Mellon over the northern hemisphere's summer (11 weeks starting the week of May 11; students will have 40 hours a week to commit; students will work in teams of 5 on their chosen project) - North Dakota State University over the northern hemisphere's fall (16 weeks starting the week of August 24th; students will have a full course load + this; students will work in teams of 3-5 on chosen project) So, what am I asking of you all? Consider adding a project to mentor students through to this etherpad <https://etherpad.opendev.org/p/UPP-Projects%26Mentors>. Ideally, we will have *2-4 projects there by May 6th*. If you don't have a project idea to submit for this round, you are welcome (and encouraged!) to add your name as a potential mentor and I can reach out to you in the future when it's time to submit a project proposal. If you have any additional questions about either of these partnerships with universities or are interested in connecting with the professor; please feel free to ask here! -Kendall

1 0

[Neutron] Bug deputy report April 20 - 27
by Jakub Libosvar 28 Apr '26

28 Apr '26

Hi all, apologies for the belated report. There are is a bunch of new bugs but nothing critical that would require an immediate action. Kuba Medium ------ * OVN metadata agent crashes on ports with mac=['unknown'] during datapath provisioning https://bugs.launchpad.net/neutron/+bug/2150434 In progress, assigned to Eduardo Patch proposed: https://review.opendev.org/c/openstack/neutron/+/986344 * OVS metadata_path signs mutable Neutron device_id as Nova instance identity https://bugs.launchpad.net/neutron/+bug/2150389 * OVN db-sync tool has empty AgentCache, causing incorrect host synchronization https://bugs.launchpad.net/neutron/+bug/2150109 * ML2 Port Binding can silently hide errors which should be fatal to binding operations https://bugs.launchpad.net/neutron/+bug/2149843 In progress, assigned to Julia Patch proposed: https://review.opendev.org/c/openstack/neutron/+/985732 * Can't delete floating ip addresses with dns_name and dns_domain set https://bugs.launchpad.net/neutron/+bug/2149807 In progress, assigned to Omer Patch proposed: https://review.opendev.org/c/openstack/neutron/+/986349 Low --- * [OVN] ``NAT`` registers search suboptimal https://bugs.launchpad.net/neutron/+bug/2149797 In progress, assigned to Rodolfo Patch proposed: https://review.opendev.org/c/openstack/neutron/+/984408 * [OVN] `` ovn-db-sync-util`` tool automation https://bugs.launchpad.net/neutron/+bug/2149785 Wishlist -------- * Switch networking-bgpvpn/bagpipe to use OVO objects https://bugs.launchpad.net/neutron/+bug/2150210 * Switch tap-as-a-service to use OVO objects https://bugs.launchpad.net/neutron/+bug/2150209 * Switch networking-sfc to use OVO objects https://bugs.launchpad.net/neutron/+bug/2150208 * Switch neutron-dynamic-routing to use OVO objects https://bugs.launchpad.net/neutron/+bug/2150207 * Switch neutron-vpnaas to use OVO objects https://bugs.launchpad.net/neutron/+bug/2150206 Invalid ------- * ovn-northd connects to wrong NB port (16642) instead of 6641 causing nb_cfg=0 across all chassis https://bugs.launchpad.net/neutron/+bug/2150151

1 0