- openstack-discuss - lists.openstack.org

Making WIP patch Active (without owner)
by Nimesh Desai 08 Sep '25

08 Sep '25

After the resolving the merge conflict, the following IBM Cinder driver patch is now in ‘Work in Progress’ state. We want to now make it Active, but the owner of the patch is no longer working with the organisation. Thus, the Gerrit UI is not showing option to publish. How to make this patch Active again? The patch was reviewed and had multiple +1 votes earlier. Patch: https://review.opendev.org/c/openstack/cinder/+/879839

6 8

[qa] PTL/Tempest core on PTO
by Ghanshyam Maan 06 Sep '25

06 Sep '25

Hi All, I would like to let you know that I will be on PTO and will return after the 2025.2 release. I will try to check IRC occasionally for any urgent changes that require merging, particularly in Tempest (as there is no other active core). -gmaan

1 0

[release] Release countdown for week R-3
by Thierry Carrez 05 Sep '25

05 Sep '25

Development Focus ----------------- The Release Candidate (RC) deadline is next Friday, September 12th, 2025. Work should be focused on fixing any release-critical bugs. General Information ------------------- All deliverables released under a cycle-with-rc model should have a first release candidate by the end of the week, from which a stable/2025.2 branch will be cut. This branch will track the 2025.2 "Flamingo" release. Once stable/2025.2 has been created, the master branch will be ready to switch to 2026.1 "Gazpacho" development. While the master branch will no longer be feature-frozen, please prioritize any work necessary for completing 2025.2 "Flamingo" plans. Release-critical bugfixes will need to be merged in the master branch first, then backported to the stable/2025.2 branch before a new release candidate can be proposed. Actions ------- Early in the week, the release team will be proposing RC1 patches for all cycle-with-rc projects, using the latest commit from the master branch. If your team is ready to go for cutting RC1, please let us know by leaving a +1 on these patches. If there are still a few more patches needed before RC1, you can -1 the patch and update it later in the week with the new commit hash you would like to use. Remember, stable/2025.2 branches will be created with this, so you will want to make sure you have what you need included to avoid needing to backport changes from the master branch (which will technically then be 2026.1 "Gazpacho") to this stable branch for any additional RCs before the final release. The release team will also be proposing releases for any deliverable following a cycle-with-intermediary model that has not produced any 2025.2 "Flamingo" release so far. Finally, now is a good time to finalize release highlights. Release highlights help shape the messaging around the release and make sure that your work is properly represented. Upcoming Deadlines & Dates -------------------------- RC1 deadline: September 12th, 2025 (R-3 week) Final RC deadline: September 26th, 2025 (R-1 week) Final 2025.2 "Flamingo" release: October 1st, 2025 OpenInfra Summit Europe: October 17th-19th, 2025 -- Thierry Carrez (ttx)

1 0

[qa][ptg] Call for 2026.1 vPTG QA topic
by Ghanshyam Maan 05 Sep '25

05 Sep '25

Hi All, I have created the etherpad to collect the QA topics for the coming vPTG (2026.1 cycle). Based on the topics, we will decide if we need any slot in PTG. Feel free to add your topics before Sept 12th. - https://etherpad.opendev.org/p/qa-2026.1-ptg -gmann

1 0

[oslo] status of eventlet removal for oslo.service?
by Chris Friesen 05 Sep '25

05 Sep '25

Hi everyone, Looking at the "epoxy" spec for removing Eventlet from oslo.service (https://specs.openstack.org/openstack/oslo-specs/specs/epoxy/remove-eventle…) the very top line is a link to search blueprints.launchpad.net. Following that link it seems like there is no blueprint for removing eventlet from oslo.service, so does the spec itself (with the proposed milestones) represent the current plan? Separately, is there somewhere that shows the progress on the threading backend for oslo.service? I see it exists, are there any limitations on the current implementation? Thanks, Chris

2 1

[ops][nova][neutron] Routed provider networking and physnet port scheduling
by Nathan Harper 04 Sep '25

04 Sep '25

Hi all, We have been looking at building some routed provider networks, following this documentation: https://docs.openstack.org/neutron/latest/admin/config-routed-networks.html In this scenario we have 4 racks, and have defined physnets for each rack and assigned SRIOV interfaces for each. We then have created a multisegment network, with a segment associated with each physnet. We get the expected resource provider in placement containing only these hypervisors. When scheduling instances onto this network, the allocation candidates are any hypervisors in racks 1-4 (openstack filters the hypervisors using the aggregates for each segment that neutron creates). However, during instance build the pci device request sent to nova-compute always contains the physnet of the same segment. Debugging the builds, we ended up here: https://opendev.org/openstack/nova/src/branch/master/nova/network/neutron.p…, with: # TODO(vladikr): Additional work will be required to handle the # case of multiple vlan segments associated with different # physical networks. Which originates from this commit: https://opendev.org/openstack/nova/commit/b9d9d96a407db5a2adde3aed81e61cc95… This suggests that despite the documentation describing using multiple VLAN backed segments in this fashion, this has never worked? Or are we missing something? Has anyone successfully used routed provider networks? -- Regards, Nathan Harper Principal Engineer – Cloud Development Platform Engineering nathanh(a)graphcore.ai<mailto:nathanh@graphcore.ai> www.graphcore.ai →<http://www.graphcore.ai/> ** We have updated our privacy policy, which contains important information about how we collect and process your personal data. To read the policy, please click here<http://www.graphcore.ai/privacy> ** This email and its attachments are intended solely for the addressed recipients and may contain confidential or legally privileged information. If you are not the intended recipient you must not copy, distribute or disseminate this email in any way; to do so may be unlawful. Any personal data/special category personal data herein are processed in accordance with UK data protection legislation. All associated feasible security measures are in place. Further details are available from the Privacy Notice on the website and/or from the Company. Graphcore Limited (registered in England and Wales with registration number 10185006) is registered at, 1 Maple Road, Bramhall, Stockport, Cheshire, UK, SK7 2DH. This message was scanned for viruses upon transmission. However Graphcore accepts no liability for any such transmission.

3 7

[release][horizon][ironic] Deliverables potentially needing a refresh before final Flamingo release
by Thierry Carrez 04 Sep '25

04 Sep '25

Quick reminder that for deliverables following the cycle-with-intermediary model, the release team will use the latest Flamingo release available on release week. The following deliverables have done a Flamingo release, but it was not refreshed in the last two months: - horizon (25.4.0 was released 2025-05-27) - ironic-python-agent-builder (6.1.0 was released 2025-06-10) - networking-baremetal (6.6.0 was released 2025-06-10) You should consider making a new one very soon, so that we don't use an outdated version for the final release. -- Thierry Carrez (ttx)

1 0

#eventlet-removal - Progress & Updates - Flamingo Past Milestone 3
by Herve Beraud 03 Sep '25

03 Sep '25

TL;DR: We just recently passed Flamingo's milestone 3 and since the last ML update we observed tremendous progress. Ironic, Barbican, Heat completed their migration. Futurist has been improved with new useful features for threading mode. The migration timeline has been adjusted to match Nova's dual mode support. PTG is under preparation. Statistics show good progress. Eventlet now supports Python 3.14. ## OpenStack Updates From a statistical perspective: - almost 17% of the occurences of the runtime code initially impacted by Eventlet have been tackled — outside of code dedicated to test, doc, releasenotes, etc; - if we include all the spectrum of occurrences to migrate — code, tests, doc, examples — it represent ~14% of the entire code base already migrated; - more than 40% of all impacted repositories have made some progress in link with the migration; - 13 projects have been fully migrated since the beginning; - more than 332 patches related to the eventlet migration have been submitted to gerrit. From the teams perspective, we can highlight Ironic completed its migration, for the occasion wrote an excellent write-up [1] — thanks Julia — I strongly encourage you to read it. Barbican [2] and heat [3] successfully completed their migrations too. They are now fully threading based. Dmitry in collaboration with the Ironic team implemented a DynamicPoolExecutor in Futurist [4]. It helps replace dynamic GreenPool. Oslo.service's backend system is now documented [5]. There is still ongoing work on several OpenStack deliverables: Neutron, Nova, Manila, Magnum, Mistral, Watcher, Designate, Trove, etc. All these teams demonstrated awesome progress. The migration timeline has been adjusted at the governance level to match Nova's dual mode support [6]. There is ongoing preparation of the PTG sessions. I think there will be a short slot during one of the TC sessions, and surely a fully dedicated one hour slot to host cross team open discussions. ## Eventlet Updates The support of Python 3.14 has been introduced within Eventlet 0.40.2. A vulnerability (CVE-2025-58068, CVSS 6.3) in Eventlet’s WSGI parser allowing HTTP Request Smuggling (bypass controls, cache poisoning, user targeting) has been found. It has been fixed within Eventlet 0.40.3. A security advisory has been published [7]. ## Call to Action That would be worth considering introducing small experiments as opportunities to identify or learn any weaknesses in new threading architectural models. That could start by preparing and performing some perf scale testing at your deliverables levels. That will help you to define the right scaling configuration for your deliverables. You can draw inspiration from Neutron's rally jobs [8] and from Ironic's scripting created for benchmark purposes [9]. More than a year ago, Dan sparked the performance testing topic idea [10], that's the right time to consider it more deeply. If you do not start the migration of your deliverables, I'd encourage you to plan and prioritize it as soon as possible. Time flies and the later your migration starts the harder it will be. Python 3.15 comes with its share of breaking changes [11] so I'd not suggest waiting for that time. If you are scheduling a PTG session on your side about Eventlet, then please let us know by updating the eventlet removal wiki page [12]. If your service is now migrated, I'd invite you to tag the launchpad bugs which were related to Eventlet, and, if it makes sense to close them. You are now entering a clean phase. ## Final Thoughts During Flamingo we observed tremendous progress, and we are now going straight toward the final release of Flamingo. The PTG, and Gazpacho that will be the logical continuation of the jobs already done. Flamingo will mark a significant release due to the fully migrated bricks and services. They will allow us to enter a beneficial feedback loop. The migration path is now well cleared by all the previous actions and changes applied into OpenStack. Postponing the beginning of the migration will make your life harder. We want to prevent this from happening to you. Your journey start here https://removal.eventlet.org/ If you need information join-us on the #openstack-eventlet-removal OFTC channel. Thanks to all the people who made this migration possible until now. Thanks for your attention. [1] https://ironicbaremetal.org/blog/coming-soon-threading/ [2] https://review.opendev.org/c/openstack/barbican/+/955301 [3] https://review.opendev.org/c/openstack/heat/+/952651 [4] https://docs.openstack.org/futurist/latest/reference/index.html#futurist.Dy… [5] https://docs.openstack.org/oslo.service/latest/user/backend.html [6] https://review.opendev.org/c/openstack/governance/+/952903 [7] https://github.com/advisories/GHSA-hw6f-rjfj-j7j7 [8] https://opendev.org/openstack/neutron/src/branch/master/rally-jobs [9] https://opendev.org/openstack/ironic/src/branch/master/tools/benchmark [10] https://review.opendev.org/c/openstack/governance/+/902585/comment/979db3f6… [11] https://docs.python.org/es/dev/whatsnew/3.15.html#threading [12] https://wiki.openstack.org/wiki/Eventlet-removal#Project-specific_events -- Hervé Beraud Principal Software Engineer at Red Hat irc: hberaud https://github.com/4383/

1 0

[keystone][ops] Upgrade to 2025.1 and "corner cases"
by Dmitriy Rabotyagov 03 Sep '25

03 Sep '25

Hey folks, I wanted to raise awareness of operators regarding Keystone upgrade to Epoxy (2025.1), as found that existing release notes are slightly more vague about corner case definition. During analysis, it appeared that a lot of users (and under "a lot" I mean 4 figures number) in my really old deployments (which were deployed during Newton), still in use passwords hashed with sha512_crypt which has been dropped in 2025.1 [1]. As this was referenced as a "corner case" in upgrade docs, it may not bring enough attention to this matter reading notes, while sha512_crypt removal is mentioned in "Other" section which I personally missed when analyzing upgrade requirements. So I would highly recommend to ensure that all your users are using supported hashing algorithms before the upgrade to Epoxy, and inform them to reset their passwords if they don't. You can list users who are using unsupported hashing algorithm using following MySQL query: SELECT distinct l_u.user_id FROM keystone.local_user AS l_u JOIN keystone.password AS hash ON l_u.id = hash.local_user_id WHERE (hash.password_hash LIKE '$6$%' OR hash.password_hash LIKE '$5$%') AND hash.expires_at i s null; Hope this helps somebody to save some time in the future. [1] https://opendev.org/openstack/keystone/commit/4a4137d5f77ced3f4f011846fb9c2…

7 13

[Nova&Neutron] pagination returns an http, not https href link
by Chang Xue 03 Sep '25

03 Sep '25

Hello, we just migrated using new openstack CLI tools, and when using pagination for both Nova and Neutron, we noticed that they are returning http href link although they are expecting https, causing failure: ``` openstack port list Failure: Unable to establish connection to http://openstack....example.com:9696/v2.0/ports: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')). Retrying in 0.5s.1 retries left Unable to establish connection to http://openstack.....example.com:9696/v2.0/ports: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')) ``` Is this a bug in Nova/Neutron? I tried other services like Heat, Keystone, etc, and they either returning https href links or just take relative path without schema/host. Thanks, Chang

3 10