July 2026 - openstack-discuss - lists.openstack.org

[heat][stable][unmaintained] Proposal to add heat-stable-maint to unmaintained branch maintenance
by Takashi Kajinami 22 Jul '26

22 Jul '26

Hello, The heat project historically didn't opt in to maintenance of unmaintained branches, when the unmaintained branches were implemented, and we now leave these branches to unmaintained-core now. The decision was made because of quite limited interest in the project at that time. However we've been seeing the interest arising recently, for example because of more security issues being discovered by AI. So I'm wondering we can opt-in to the unmaintained branch maintenance at this point. I had a chat with Rabi (He and I are only active and around these days) and he also showed interest in providing help. I don't know what the process should look like, but would appreciate any guidance or feedback to the proposal. Thank you, Takashi -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

3 2

[glance] Weekly meeting cancelled
by Abhishek Kekane 21 Jul '26

21 Jul '26

Hi Team, Since the PTL is unavailable and most members are away, we are cancelling this week's meeting. Ping us on the openstack-glance channel if anything is urgent and requires attention. Thanks & Best Regards, Abhishek Kekane

1 0

[neutron] Next week CI meeting cancelled
by Yatin Karel 21 Jul '26

21 Jul '26

Hello Neutron Team !! As discussed in the last CI meeting cancelling the next Monday CI meeting. We will now have our next CI meeting on 03rd August. -- Thanks and Regards Yatin Karel

1 0

[neutron] [nova] HTTP 502/504 errors when listing servers
by İzzettin Erdem 21 Jul '26

21 Jul '26

Hi, I have an OpenStack Epoxy environment deployed with Kolla Ansible. Around 20% of my requests to list servers (openstack server list --all-projects --limit -1) fail with HTTP 502 or 504. The only error I can find in nova-api.log is: neutronclient.common.exceptions.MalformedResponseBody: Malformed response body: Cannot understand JSON I have not been able to determine what triggers this issue. I also have several production OpenStack environments running Yoga, Antelope, and Ussuri, where the same command works without any similar errors. Error log: https://paste.openstack.org/show/b23ql5N3NhXHDEMYfwgA/ Versions: - neutron-server: 26.0.4.dev5 - nova-api: 31.3.1 Has anyone encountered a similar issue or have any suggestions on what might be causing it? I would appreciate any help or pointers. Thanks in advance, İzzettin

3 3

[release] Planned 2027.1 "Indri" release schedule
by Elõd Illés 21 Jul '26

21 Jul '26

Hi, This is just a heads-up that 2027.1 "Indri" release schedule is proposed [1] (see PS3's generated page [2]). Feel free to review & comment. Note that we have to finalize the schedule by next Friday, July 31st. [1] https://review.opendev.org/c/openstack/releases/+/996808 [2] https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/… Thanks, Előd Illés IRC: elodilles @ #openstack-release

1 0

[security-sig][OSSN-0102] Neutron sub-resource APIs do not verify parent ownership
by Goutham Pacha Ravi 21 Jul '26

21 Jul '26

## Summary ## Several Neutron APIs that operate on sub-resources (port forwardings under floating IPs, conntrack helpers under routers) authorize the request using the parent resource ID from the URL but load the child resource by its own ID without verifying it belongs to that parent. A project member can read or modify another project's sub-resource by substituting their own parent resource ID in the URL. For conntrack helpers, deletion is also possible. The attack requires knowing the victim's sub-resource UUID, which is a random UUIDv4 that cannot be enumerated through the API. ## Affected Services / Software ## * neutron: >=13.0.0 <26.0.4, >=27.0.0 <27.0.3, ==28.0.0 ## Discussion ## The affected endpoints follow this pattern: * GET/PUT /floatingips/{fip_id}/port_forwardings/{pf_id} (DELETE is not affected; it already validates the parent) * GET/PUT/DELETE /routers/{router_id}/conntrack_helpers/{ct_id} Policy checks authorize against the parent (floating IP or router) from the URL. The plugin then loads the child by bare UUID without checking that the child's parent matches the URL parent. This allows a caller who owns one floating IP or router to operate on port forwardings or conntrack helpers belonging to a different project's floating IP or router. The mitigating factor is that the victim's sub-resource UUID cannot be discovered through the API. The list endpoints are scoped to the caller's own parent resources. An attacker would need to obtain the UUID through other means. ## Recommended Actions ## Upgrade Neutron to a version containing the fixes. ## Patches ## The following reviews contain the fixes: ### Port Forwarding (LP#2150121) ### * 2026.2/hibiscus (development): https://review.opendev.org/989624 * 2026.1/gazpacho: https://review.opendev.org/990125 * 2025.2/flamingo: https://review.opendev.org/990126 * 2025.1/epoxy: https://review.opendev.org/990127 ### Conntrack Helpers (LP#2152109) ### * 2026.2/hibiscus (development): https://review.opendev.org/991586 * 2026.1/gazpacho: https://review.opendev.org/991776 * 2025.2/flamingo: https://review.opendev.org/991777 * 2025.1/epoxy: https://review.opendev.org/991778 ## Credits ## Tim Shephard, roiai.ca ## References ## Author: Goutham Pacha Ravi, Red Hat This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0102 Original Launchpad bugs: - https://bugs.launchpad.net/neutron/+bug/2150121 - https://bugs.launchpad.net/neutron/+bug/2152109 Mailing List: [security-sig] tag on openstack-discuss(a)lists.openstack.org OpenStack Security: https://security.openstack.org/ CVE: none

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2026.2/R-10)
by Goutham Pacha Ravi 20 Jul '26

20 Jul '26

Hello Stackers, We're ten weeks away from the date of the coordinated release of OpenStack 2026.2 "Hibiscus" [1]. Two weeks from now, on August 3, nominations open for the 2027.1 "Indri" cycle elections [2]; four TC seats and several PTL positions will be up for a vote. I've posted patches to reset the DPL Liaisons for five teams [3] (Release Management, Requirements, Ironic, Freezer, and Oslo), clearing the way for fresh nominations, or electing a new PTL. If you've been thinking about stepping up, now's the time to start pulling your thoughts together. Please feel free to submit a nomination already if you will be away during the official nomination window. A reminder to PTLs and DPLs: we're now tracking "security" and "release" liaisons on the governance repository. We have a patch seeding security liaison data [4] and still need about 20 teams to nominate security liaison/s. The OpenStack VMT and the Security SIG will use this information to communicate security sensitive information with. If you haven't checked your project's entry on that review yet, please do. === Weekly Meeting === The last weekly meeting of the OpenStack Technical Committee was held on July 14, 2026 [5]. We discussed the RISC-V SIG proposal in detail [6], and the proposal has since merged. Beyond the TC's support, there were practical questions about CI resources that the SIG will need to work through. Jeremy Stanley (fungi) noted a chicken-and-egg problem: OpenDev CI consumes test nodes through an OpenStack cloud API, and if Nova doesn't yet support RISC-V hypervisor hosts, there's no way to plumb any donated hardware into the CI system. The ARM experience is instructive here; we've lost providers in the past when companies maintaining the cloud or hosting the hardware lost interest. Michal Nasiadka (mnasiadka) offered that StackHPC has a cloud in Iceland and would be willing to host donated RISC-V hardware, which is a welcome option. We then discussed if routine liaison updates require a TC "roll-call" vote at all. That turned into a concrete proposal to update our house rules [7]. We then touched on barbican-ui, where unit tests are being added to the revival patches and Dmitriy Rabotyagov (noonedeadpunk) will seed a mailing list discussion about proposing a separate core team. The meeting wrapped up by introducing a TC vision scatter-gather exercise. TC members have begun to jot down what they are proud OpenStack has accomplished, and will "hot pen" a vision that we hope to realize in 2031. I'll share more details on openstack-discuss soon for the wider community to participate in this exercise. Our goal is to adopt this vision after our October 2026 PTG. The next meeting of the OpenStack TC is Tuesday July 21, 2026, at 1700 UTC. This meeting will be hosted on the #openstack-tc channel on OFTC. Please see the agenda on the meeting's wiki page [8]. I hope to see you there. === Governance Proposals === ==== Merged ==== - Add RISC-V | https://review.opendev.org/c/openstack/governance/+/988896 - Add security liaison tracking to projects | https://review.opendev.org/c/openstack/governance/+/993696 - Update Telemetry release liaison to Emma Foley | https://review.opendev.org/c/openstack/governance/+/995834 ==== Open for Review ==== - Seed security liaison data from VMT wiki | https://review.opendev.org/c/openstack/governance/+/996563 - Move schemas into their own directory | https://review.opendev.org/c/openstack/governance/+/993955 - Add schemas for other reference files | https://review.opendev.org/c/openstack/governance/+/993956 - Define testing runtime for 2027.1 release | https://review.opendev.org/c/openstack/governance/+/996925 - Establish Contributor Experience Working Group | https://review.opendev.org/c/openstack/governance/+/994046 - Allow liaison changes without roll call votes | https://review.opendev.org/c/openstack/governance/+/997284 - Reset the DPL model for Freezer, Ironic, Oslo, Release Management, Requirements | https://review.opendev.org/q/project:openstack/governance+message:%22Reset+… - Add reviewers as Active Contributors | https://review.opendev.org/c/openstack/governance/+/995535 - Retire puppet-vitrage | https://review.opendev.org/c/openstack/governance/+/996036 - Retire barbican's ansible roles | https://review.opendev.org/c/openstack/governance/+/995081 - Start testing pre-release versions for clients and libraries | https://review.opendev.org/c/openstack/governance/+/992767 - Distinguish between tested runtimes for clients and libraries | https://review.opendev.org/c/openstack/governance/+/992765 === Upcoming Events === - 2026-07-25: KCD x OpenInfra Day Vietnam: https://2026.vietopeninfra.org/ - 2026-07-29: KubeCon + CloudNativeCon Japan: https://events.linuxfoundation.org/kubecon-cloudnativecon-japan/ - 2026-08-11: OpenInfra Board Meeting: https://board.openinfra.org/ - 2026-08-29: OpenInfra Day Nigeria: https://www.meetup.com/openstack-nigeria-user-group/events/313525373/ - 2026-09-01: KCD x Ceph x OpenInfra Day Korea: https://community2.cncf.io/events/details/cncf-kcd-south-korea-presents-kcd… Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2026.2 "Hibiscus" Release Schedule: https://releases.openstack.org/hibiscus/schedule.html [2] 2027.1 Election Timeline: https://governance.openstack.org/election/ [3] DPL Reset Patches: https://review.opendev.org/q/project:openstack/governance+message:%22Reset+… [4] Seed Security Liaison Data from VMT Wiki: https://review.opendev.org/c/openstack/governance/+/996563 [5] TC Meeting IRC Log, July 14 2026: https://meetings.opendev.org/meetings/tc/2026/tc.2026-07-14-17.02.html [6] RISC-V SIG Proposal: https://review.opendev.org/c/openstack/governance/+/988896 [7] Allow Liaison Changes Without Roll-Call Votes: https://review.opendev.org/c/openstack/governance/+/997284 [8] TC Meeting Agenda, July 21 2026: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[neutron] goodbye
by Bence Romsics 20 Jul '26

20 Jul '26

Dear Neutron team members, I have recently started working on a different project, so I have no time left to allocate to OpenStack. I have not been very active lately, but even the low activity level I maintained, will have to end now (please remove my name from the deputy roaster). Working with you has a been a long and interesting journey! I learned a lot. Thank you all! I wish you all the best! If we happen to meet on a conference come and say hello! Best regards, Bence bence.romsics(a)gmail.com

2 1

[neutron] Bug triage July 13 to July 19
by Helen Chen 20 Jul '26

20 Jul '26

This report was generated using https://review.opendev.org/c/openstack/neutron/+/996231/(``neutron-lp-bug-t… agent), with some human edits for the undecided bug. (Thanks, Rodolfo!) Neutron Launchpad bug summary for 2026-07-13 to 2026-07-19 (inclusive). Total bugs: 6. Overview: Critical 0, High 3, Medium 1, Low 1, Undecided 1. With active patch: 4. Unassigned: 1. Undecided: * Bug 2161076 - [OVN] Overlapping LB VIP across isolated Geneve tenant networks causes routers to cross-learn each other's amphora MAC in MAC_Binding. Created 2026-07-17. Status New. Assignee Unassigned. Link https://bugs.launchpad.net/neutron/+bug/2161076. Active patch: No. - Undecided whether this should be triaged in the reported release, 2024.1 , which is an unmaintained branch according to https://releases.openstack.org . Asked reporter if this is observed in newer releases. - Also asked to reporter to verify observation, since the logs provided do not show incorrect output based on the reporter's logic. * Bug 2161077 - (not counted, since it is now marked as duplicate of 2161076) [OVN] Overlapping LB VIP across isolated Geneve tenant networks causes routers to cross-learn each other's amphora MAC in MAC_Binding. Created 2026-07-17. Status New. Assignee Unassigned. Link https://bugs.launchpad.net/neutron/+bug/2161077. Active patch: No. Critical: None. High: * Bug 2160551 - [ovn-octavia-provider] OVN LB can not be created with a pre-existing port as LB VIP. Created 2026-07-13. Status In Progress. Assignee Fernando Royo. Link https://bugs.launchpad.net/neutron/+bug/2160551. Active patch: Fix LB creation with --vip-port-id. https://review.opendev.org/c/openstack/ovn-octavia-provider/+/997099 * Bug 2161232 - [OVN] Restarting ovn-controller pins a distributed router to a chassis via the unified network HA_Chassis_Group. Created 2026-07-19. Status In Progress. Assignee amirabbas8. Link https://bugs.launchpad.net/neutron/+bug/2161232. Active patch: ovn: Ignore network HCGs in HAChassisGroupRouterEvent. https://review.opendev.org/c/openstack/neutron/+/997867 * Bug 2161095 - neutron-ovn-db-sync-util don't set external_mac if distributed floating ip is enabled. Created 2026-07-17. Status In Progress. Assignee yatin. Link https://bugs.launchpad.net/neutron/+bug/2161095. Active patch: [OVN] Set external_mac for bound distributed Floating IPs. https://review.opendev.org/c/openstack/neutron/+/997993 Medium: * Bug 2160992 - OVN-EVPN VNIs should only be created for OVN flavor routers. Created 2026-07-16. Status Triaged/Incomplete. Assignee jlibosvar. Link https://bugs.launchpad.net/neutron/+bug/2160992. Active patch: No. Low: * Bug 2160689 - Move VPNaaS table creation from Neutron to neutron-vpnaas. Created 2026-07-15. Status In Progress. Assignee Rodolfo Alonso. Link https://bugs.launchpad.net/neutron/+bug/2160689. Active patch: db: Create VPN tables in start migration if missing. https://review.opendev.org/c/openstack/neutron-vpnaas/+/997343. Active patch: db: Remove VPNaaS dead migration code. https://review.opendev.org/c/openstack/neutron/+/997344 Wishlist: None.

1 0

[tacker] Skip IRC meeting
by Yasufumi Ogawa 19 Jul '26

19 Jul '26

Hi Tacker team, Due to public holiday in Japan, I would like to skip today's IRC meeting. Thanks, Yasufumi

1 0