- openstack-discuss - lists.openstack.org

[nova][glance] Image corruption during shelving
by Vladimir Prokofev 31 Oct '25

31 Oct '25

Hello everyone. I've discovered a bug in nova/glanceclient interoperation that leads to image corruption during shelving under some circumstances involving connection disruption. I was able to reproduce it in two different production environments running on xena and 2024.2 respectively, I'm also able to reproduce it in devstack though without image corruption - there it just ends up in a shelve failure due to detected corruption. My setup assumes LVM-backed QEMU VMs with backend in CEPH for Glance, but I believe this is applicable to a variety of nova/glance backends. When shelve is triggered, nova-compute creates an image file locally, and then initiates upload of said image file into Glance[0]. If something happens to the connection during the upload("broken pipe", "connection timeout") - nova-compute retries upload operation[1] while image object is removed from CEPH backend by Glance[2] Problem here is that the image_file object that is passed to glanceclient by nova-compute is a byte-stream created with an open()[3] call, and upon retry it resumes the upload from the point where it was interrupted. This is easily confirmed by calling image_data.tell() in glanceclient.v2.images.Controller.upload() function - it will be at zero initially and non-zero on retry. I haven't thoroughly checked protection offered in Glance master, I believe it may have been significantly improved, but in older releases such as 2024.2, this leads to a corrupted shelved image, because upon retry only part of an image object is uploaded, after which original VM is offloaded(removed) and you end up with lost data. Now, my issue here is where to submit this bug: glanceclient or nova? This problem is easily fixable in glanceclient by calling image_data.seek(0) in glanceclient.v2.images.Controller.upload(): it makes sense to always point byte-stream to the beginning before initiating upload, but should it really be responsibility of a client to perform such a sanity check? I'm also not sure if there're cases that this will break, for example if a non-seekable object is passed into glanceclient, but I'm not sure if this is even possible? [0] https://opendev.org/openstack/nova/src/branch/master/nova/virt/libvirt/driv… [1] https://opendev.org/openstack/nova/src/branch/master/nova/image/glance.py#L… [2] https://opendev.org/openstack/glance_store/src/branch/master/glance_store/_… [3] https://opendev.org/openstack/nova/src/branch/master/nova/virt/libvirt/driv…

2 2

[ptg] Image Encryption Session, Thursday 30th @ 16:00 UTC
by Markus Hentsch 30 Oct '25

30 Oct '25

Dear OpenStack community, in preparation for the vPTG discussion slot for the image encryption (Thursday 30th at 16:00 UTC) I collected a summary explaining the key points and state of the contribution and gathered some discussion topics below. Since this spans multiple projects (mainly Glance, Cinder and Nova) and has been ongoing for quite some years, I tried my best to briefly summarize the most important aspects of the current state so that all those who wish to participate have the latest information. The text below can also be found on the etherpad: https://etherpad.opendev.org/p/2026.1-ptg-glance-planning#L128 Summary: - historically, only Cinder has been able to create and use encrypted images (as a side effect) by dumping LUKS-encrypted volumes 1:1 into images, for exclusive use in Cinder - this contribution aims to introduce encrypted image functionality for the end user: images can be encrypted/decrypted outside of OpenStack and resulting (encrypted) image is stored in Glance and the key in Barbican - goal: standardize encrypted image formats and handling across Glance, Cinder and Nova - it introduces two formats: raw LUKS and qcow2-wrapped LUKS (native qcow2 feature) - it introduces new key handling: if Barbican secret is of type 'passphrase' it is used as the LUKS key as-is; if it is of any other secret type, it is assumed to be binary and converted via 'binascii.hexlify()' (preserves Cinder behavior and compatibility) - it makes use of the new secret consumer API in Barbican to prevent accidental key deletion (since keys may be managed by users, not OpenStack), registering images as consumers to their keys - note: the image encryption feature focuses on Glance and Cinder for now, Nova has been largely excluded so far due to ephemeral storage encryption not being ready yet Implementation State (note: aside from os-brick this is not merged yet!): - os-brick: implemented outsourced utility function to discern encryption between passphrase and binary (hexlify conversion) for shared usage by Nova and Cinder - Glance: implemented new encryption-specific image formats and properties as well as secret consumer handling - Cinder: implemented encrypted image usage for volumes: LUKS is handled as raw (like before) and qcow2+LUKS is converted; image creation from volume stays limited to raw LUKS - Nova: implemented only compatibility with os-brick and Cinder changes so far - barbican-tempest-plugin: full scenario tests (image > volume > server > SSH) for 4 permutations of the image encryption Patchsets: https://review.opendev.org/q/topic:%22LUKS-image-encryption%22 Discussion Topics: 1) Image inspection: related to CVE-2024-32498 concerns were brought up about encrypted image payload containing malicious formats triggering unintended QEMU behavior; how to screen encrypted image payload and reject undesired formats? 1a) limiting to specific formats has consequences for Cinder: attached (secondary) encrypted volumes might contain arbitrary binary data in VMs (user choice), when uploading as image to Glance it might be rejected as prohibited format; additionally, such image vanishes without trace because there is no error state for images (bad Glance <-> Cinder interaction) - how to address this? 1b) how deep do we want to look into encrypted image payload? decrypting a 1TB image might be very costly (CPU load, disk space) - problem: "qemu-img convert" cannot stream to stdout (see https://blogs.igalia.com/berto/2025/07/15/converting-qemu-qcow2-images-dire… ); in the worst case we have to wait for the full 1TB to be decrypted, consuming almost twice the amount of disk space in the process, instead of being able to only read the payload header and abort 2) Nova integration: how to approach future interoperability with ephemeral storage encryption? 2a) can we handle this as separate future expansion to this feature, i.e., merging Glance+Cinder functionality short-term with only compatibility changes in Nova for now and addressing full Nova integration as a next step with dedicated patchsets based on the current work? 3) Better organization: would there be any interest in reviving the image encryption popup-team meeting? https://meetings.opendev.org/#Image_Encryption_Popup-Team_Meeting Best regards, Markus Hentsch -- Markus Hentsch DevOps Engineer Cloud&Heat Technologies GmbH Königsbrücker Straße 96 | 01099 Dresden +49 351 479 367 00 markus.hentsch(a)cloudandheat.com | www.cloudandheat.com Green, Open, Efficient. Ihr Cloud-Service- und Cloud-Technologie-Provider aus Dresden. https://www.cloudandheat.com/ Commercial Register: District Court Dresden Register Number: HRB 30549 VAT ID No.: DE281093504 Managing Director: Nicolas Röhrs Authorized signatory: Dr. Marius Feldmann

2 3

[skyline] possible small bug in skyline
by Taavi Ansper 30 Oct '25

30 Oct '25

Hi I have found a possible small bug in skyline. I didn't know where to post this in bugzilla. https://bugs.launchpad.net/skyline-apiserver/+bug/2129915 The bug comes from the placement API request to: //resource_providers/1ab32e69-ee87-4ccb-bd8a-b39abfa4a980/inventories The same UI view in horizon works nicely and it doesn't append the the double slash in the API request. Where might this come from the code? Something related to this is defined here, but it probably comes from the "Base" stuff: https://github.com/openstack/skyline-console/blob/stable/2025.1/src/client/… https://github.com/openstack/skyline-console/blob/stable/2025.1/src/client/… This issue appeared after upgrading from 2024.2 to 2025.1 Best regards -- ---- Taavi Ansper taavi.ansper(a)cyber.ee

1 0

[openstack][kolla-ansible]about group node config overwrite
by Nguyễn Hữu Khôi 30 Oct '25

30 Oct '25

Hello Koller. I want to ask if we can overwrite config for a group of nodes. For example, compute01 >> compute10 will have the same nova configuration compute11 >> compute20 will have the same nova configuration. It will be very nice if we support this way. Thank you. Regards Nguyen Huu Khoi

4 7

[nova][glance] Server rescue falls back to default image
by Francesco Di Nucci 29 Oct '25

29 Oct '25

Hi all, I am on OpenStack Caracal, trying to rescue a VM that's not booting: * I previously created a SystemRescueCD rescue image (with openstack image create --file ./systemrescue-12.02-amd64.iso --disk-format raw --container-format bare --property hw_rescue_bus=virtio --property hw_rescue_device=disk systemrescuecd_1202) - it works on VMs that still have their base images in Glance * tried to rescue the VM (with openstack server rescue --image systemrescuecd_1202 my-vm-id-here) * but the process fails as it tries to also use the base image used to create that VM, instead of the rescue image only (Instance my-vm-id-here cannot be rescued: Driver Error: Image b78cf456-b395-434f-bf50-a1f2f3684a37 could not be found. ; where b78cf456-b395-434f-bf50-a1f2f3684a37 was a Ubuntu cloud image used to create that VM, since deleted as it's an EOL version) Is it supposed to also try to use the base image or should the --image bypass it? In case, what could I do? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email:francesco.dinucci@na.infn.it

3 2

[kolla-ansible] Rabbitmq queue creation issues in "fresh" 2025.1 deploy
by Jonathan Proulx 28 Oct '25

28 Oct '25

Hi All, I'm putting "fresh" in quotes becuase I expect the issue is some home my deploy isn't as fresh as I belive it to be. I did have and older test environment which was serveral steps behind (and not quite workign for other reasons). The presenting issues is this error (and other similar ones for other services): 2025-10-24 11:44:07.840 1076 WARNING oslo.messaging._drivers.impl_rabbit [None req-4eff1f78-c16a-4bc9-b0da-9ce0a80b66ba - - - - - -] [83941886-4e9c-4d0c-b3b0-53c107f018e9] Queue conductor could not be declared probably because of conflicting configurations: Exchange.declare: (406) PRECONDITION_FAILED - inequivalent arg 'durable' for exchange 'nova' in vhost '/': received 'true' but current is 'false': amqp.exceptions.PreconditionFailed: Exchange.declare: (406) PRECONDITION_FAILED - inequivalent arg 'durable' for exchange 'nova' in vhost '/': received 'true' but current is 'false' 2025-10-24 11:44:07.841 1076 INFO oslo.messaging._drivers.impl_rabbit [None req-4eff1f78-c16a-4bc9-b0da-9ce0a80b66ba - - - - - -] [83941886-4e9c-4d0c-b3b0-53c107f018e9] Retrying to declare the exchange (nova) as non durable I'm puzzled since the services are deploying to recently reinstalled nodes (I'm sure that part is fresh) how the queues can be created with flags the services don't expect. my shell history tells me I'm using these versions (in a venev): pip3 install --upgrade git+https://opendev.org/openstack/kolla-ansible@stable/2025.1 pip3 install --upgrade git+https://opendev.org/openstack/kolla@stable/2025.1 pip3 install --upgrade 'ansible-core>=2.17,<2.18.99' The only bits I know are left over and "upgraded" from previous attempts are my configs in /etc/kolla. My deploy host wasn't reinstalled but I did delete and recreate the venv. Using Ubuntu 24.04 as the base OS Where do I go from here to find my wrong turn? Thanks, -Jon -- Jonathan "Some Day I'll Upgrade From Mitaka" Proulx (he/him) Sr. Technical Architect The Infrastructure Group MIT CSAIL

2 4

Re: [tc][all][security] Supporting Post-Quantum Cryptography in OpenStack code (all projects)
by Jean-Philippe Jung 28 Oct '25

28 Oct '25

Hi, Thanks for the comments, and let me try to group some & reply ahead of the PTG session. 1- Quantum computers are no threat, they are underpowered, so what’s the risk & why should we do anything now? * The issue is time. The day a quantum computer is powerful enough to break traditional cryptography (known as Q-day), it is too late. OpenStack lays naked and vulnerable. * We can argue about dates, and my current opinion is that to be on the safe side, any software product should implement PQC cryptography by 2029. * We have a large code base, and we need to give time to the community to review & adjust it then to openstack operators to implement quantum-safe cryptography. * There is no snake oil/panic-driven agenda here, either we protect access to OpenStack infrastructure & between services, preferably by 2028. Or we don’t. We have time, but we should start work now. 2- It’s a problem for Operating System vendors, we just consume their cryptography. * I wish it were true. But the initial analysis I made demonstrates we have libraries that do cryptographic operations, and maybe these libraries end up properly calling an OS cryptographic module. Maybe not. I know of paramiko, that does not call any OS layer, but its own copy of OpenSSL code. We cannot assume OpenStack has nothing to do until we analyse our cryptographic usage. * I totally support the idea of using OS cryptography as much as possible, because we offload the maintenance problem to OS vendors. * Then because new fancy cryptographic algorithms have been finalized (key encapsulation, ML-KEM), or near finalized (digital signature, ML-DSA) does not indeed mean they are available in all the protocols that uses them (IPsec, kerberos, dnssec…) in operating systems. 3- Some of the libraries listed might no longer be in used. * The code should be removed from OpenStack. We have customers doing Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST): these will flag those unsafe modules. * Other side of that point: some of these libraries are still used. Do they rely on an operating system cryptography, or do they pull their own cryptographic call? Are they maintained? Should we reduce the amount of cryptographic modules in OpenStack? 4- There is no plan proposed, what’s next? * Initial email was to express my concern about supporting PQC in OpenStack, understanding if my concern was shared, and raise awareness on this topic right ahead of the PTG. * The first step to solve a problem is to know there is a problem, I’d start with a per project effort starting with a simple question for projects: "Does your project do anything in relation to keys, encryption, or interaction of any encrypted data either at rest or while in transit?" * Next would be to use those results to plan for protecting OpenStack against the store-now, decrypt-later attacks, meaning protecting key exchanges relaying on ML-KEM (well hybrid X25519MLKEM768 to start with), ensuring symmetric keys are long enough (256 bits minimum), then deal later with digital signatures code (if any). 5- The goal is premature * I consider this a community goal because all OpenStack components must achieve support pretty much in the same time frame. I am not saying it should take precedence over any other critical work (e.g., eventlet removal), I think now is the time to scope the work and plan to meet the 2027/2028 deadline. * OpenStack customers planning to run it well into the 2030s are asking about the plans for PQC support. And new customers considering OpenStack are asking about PQC support plans. Either we have an answer, a roadmap, or OpenStack will not be part of the discussion, at some point (ask me how I know :-). Regards, JP

1 0

pip 25.3 removes support for legacy editable installs
by Stephen Finucane 28 Oct '25

28 Oct '25

o/ pip 25.3 was released on Friday (who does Friday releases?!) and had removed support for the legacy `setup.py develop` editable install method in setuptools [1]. Now, thankfully most services seem to have listened to me [2][3] and the shouty warnings from setuptools/pip and migrated away from 'wsgi_scripts'. However, there is a good chance that older stable branches are missing these migration patches and consequently now broken. For example, it seems keystone is missing these changes on stable/2024.2, and attempts to deploy that branch currently fail with: Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. Internal Server Error (HTTP 500) which, upon further inspection, will turn out to be a missing wsgi script: devstack(a)keystone.service[40466]: failed to open python file /opt/stack/data/venv/bin/keystone-wsgi-public We have already seen this pop up on the cluster-api-provider-openstack (CAPO) project [4], which is using the old stable/2024.2 (Dalmatian) release. I have proposed fixes to stable/2025.1 [5] and stable/2024.2 [6] to constrain pip on those older branches. This should fix the issue for everyone, provided you're not using a devstack plugin that re-updates pip. Individual services may also wish to backport the patches that added '$service.wsgi' modules if possible, to fix this for non-devstack use cases, but this won't be possible in all cases. Hope this helps, Stephen [1] https://pip.pypa.io/en/stable/news/#v25-3 [2] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [3] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [4] https://github.com/kubernetes-sigs/cluster-api-provider-openstack/issues/28… [5] https://review.opendev.org/c/openstack/devstack/+/965092 [6] https://review.opendev.org/c/openstack/devstack/+/965093

2 1

[keystone][ptg] Keystone PTG schedule is available (Tue and Wed)
by Artem Goncharov 28 Oct '25

28 Oct '25

Hey guys, The Keystone team is meeting today and tomorrow for the PTG. Today's focus are the federation topics, passkeys, service accounts and discussion of feature deprecation that depend on the software abandoned upstream (i.e. saml2). Tomorrow we are going to focus more on the cryptography used in Keystone, Horizon cross-session and certain cli aspects. You are very welcome to join us discussing the future of Keystone. TECHs of today put big challenges in front of us and we need to do rework no matter how hard and painful it is. https://etherpad.opendev.org/p/oct2025-ptg-keystone Regards and see you in already a bit Artem

1 0

[FOSDEM] Call for participation: Virtualization and Cloud infrastructure Room at FOSDEM 2026
by Piotr Kliczewski 28 Oct '25

28 Oct '25

We are excited to announce that the call for proposals is now open for the Virtualization and Cloud infrastructure devroom at the upcoming FOSDEM 2026, to be hosted on 31st of January. This devroom is a collaborative effort, and is organized by dedicated folks from projects such as OpenStack, Xen Project, KubeVirt, QEMU, KVM, and Foreman. We invite everyone involved in these fields to submit your proposals by 5th December 2025. About the Devroom The Virtualization & IaaS devroom will feature session topics such as open source hypervisors or virtual machine managers such as Xen Project, KVM, bhyve and VirtualBox as well as Infrastructure-as-a-Service projects such as KubeVirt, Apache CloudStack, OpenStack, QEMU and OpenNebula. This devroom will host presentations that focus on topics of shared interest, such as KVM, libvirt, shared storage, virtualized networking, cloud security, clustering and high availability, interfacing with multiple hypervisors, hyperconverged deployments and scaling across hundreds or thousands of servers. Presentations in this devroom will be aimed at developers working on these platforms who are looking to collaborate and improve shared infrastructure or solve common problems. We seek topics that encourage dialog between projects and continued work post-FOSDEM. Important Dates Submission deadline: 5th December 2025 Acceptance notifications: 10th December 2025 Final schedule announcement: 15th of December 2025 Devroom: 31st of January Submit Your Proposal During submission [1] please make sure to select Virtualization and Cloud infrastructure from the Track list. Please provide a meaningful abstract and description of your proposed session. Submission Guidelines We expect more proposals than we can possibly accept, so it is vitally important that you submit your proposal on or before the deadline. Late submissions are unlikely to be considered. All presentation slots are 30 minutes, with 20 minutes planned for presentations, and 10 minutes for Q&A. All presentations will be recorded and made available under Creative Commons licenses. In the Submission notes field, please indicate that you agree that your presentation will be licensed under the CC-By-SA-4.0 or CC-By-4.0 license and that you agree to have your presentation recorded. For example: "If my presentation is accepted for FOSDEM, I hereby agree to license all recordings, slides, and other associated materials under the Creative Commons Attribution Share-Alike 4.0 International License. Sincerely, Piotr Kliczewski and Tal Nisan In the Submission notes field, please also confirm that if your talk is accepted, you will be able to attend FOSDEM and deliver your presentation. We will not consider proposals from prospective speakers who are unsure whether they will be able to secure funds for travel and lodging to attend FOSDEM. (Sadly, we are not able to offer travel funding for prospective speakers.) Code of Conduct Following the release of the updated code of conduct for FOSDEM[2], we'd like to remind all speakers and attendees that all of the presentations and discussions in our devroom are held under the guidelines set in the CoC and we expect attendees, speakers, and volunteers to follow the CoC at all times. If you submit a proposal and it is accepted, you will be required to confirm that you accept the FOSDEM CoC. If you have any questions about the CoC or wish to have one of the devroom organizers review your presentation slides or any other content for CoC compliance, please email us and we will do our best to assist you. Questions? If you have any questions about this devroom, please send your questions to our devroom mailing list. You can also subscribe to the list to receive updates about important dates, session announcements, and to connect with other attendees. See you all at FOSDEM! [1] https://fosdem.org/submit [2] https://fosdem.org/2026/practical/conduct/

1 0

[swift][ptg] Ops Feedback Session - 29th October at 1300 UTC
by Matthew Oliver 28 Oct '25

28 Oct '25

As we've done in PTGs past, we're getting devs and ops together to talk about Swift: what's working, what isn't, and what would be most helpful to improve. We're meeting in the gazpacho swift meetpad room ( https://meetpad.opendev.org/swift-ptg-gazpacho) on Wednesday at 13:00UTC -- if you run a Swift cluster, we hope to see you there! Even if you can't make it, we'd appreciate it if you can offer some feedback on the etherpad ( https://etherpad.opendev.org/p/swift-gazpacho-ops-feedback) This has always been a highlight at every PTG for us swift devs. Have your say and help make Swift even better! Matt

1 0

[tacker][ptg] 2025.10 vPTG Planning
by Yasufumi Ogawa 27 Oct '25

27 Oct '25

Hi tacker team, As we discussed in the previous meeting, we'll have two days sessions for the vPTG. I've fixed time slots for our vPTG session[1] and setup the etherpad[2]. Please add your items on the etherpad if you have any proposal. - 29th Oct. 8am-10am UTC (5pm-7pm JST/KST) - 31th Oct. 8am-10am UTC (5pm-7pm JST/KST) [1] https://ptg.opendev.org/ptg.html [2] https://etherpad.opendev.org/p/oct2025-ptg-tacker Regards, Yasufumi

1 0

[kolla][kolla-ansible][kayobe] Bifrost usage poll
by William Szumski 27 Oct '25

27 Oct '25

Hi all, I was just trying to get an idea for the number of operators relying on the Bifrost support in Kolla-Ansible as it was recently deprecated in Kolla[1]. We are planning the next steps for its replacement, and are not sure if it is is only Kayobe users that would be affected. If you you are using Bifrost and not using Kayobe, I would appreciate if you could reply to this message. We will also be discussing Bifrost as the first topic in the Kayobe/Kolla PTG session on Wednesday 19th November at 13:00 UTC and would encourage you to come along and discuss its future. Although, nominally it is the Kayobe session, we've made the first topic on the agenda so that you easily drop out if you aren't interested in the rest of the discussion. [1] https://review.opendev.org/c/openstack/kolla-ansible/+/945501 Thanks, Will

1 1

[tc][all][security] Supporting Post-Quantum Cryptography in OpenStack code (all projects)
by Jean-Philippe Jung 27 Oct '25

27 Oct '25

Hi, I am the OpenStack Security Product Manager at Red Hat. I also support Post Quantum Cryptography in OpenStack and k8s (well, OpenShift for us), and I cover some areas of confidential computing. I see one existential risk to OpenStack in the near future: support for post-quantum cryptography (PQC) [0] Based on my latest discussion with industry experts, I expect that around 2029 (likely) or 2030 (at best), there would be powerful enough Q-Computers to break traditional cryptography. Meaning we have to prepare OpenStack to support post-quantum crypto (ML-KEM urgently, ML-DSA as soon as possible) in the upstream code. As we also need to provide time for operators/customers to implement the "fixed" code, we are in early 2028 territory to achieve sufficient PQC coverage in OpenStack upstream. This would give OpenStack users time to implement this code. Time is running out; we’re already almost in 2026! A point to keep in mind is that the initial PQC algorithms might fall short and be replaced in the future. Thus, this PQC support exercise should also be a “cryptographic agility” exercise: we should have a few libraries we know how to call, and if a new crypto algorithm comes out, it should be easy to enable it in the code. I used AI engines to have a look at the OpenStack upstream code (not all projects, but a chunk of the most commonly used), and I came back with 17 different cryptographic modules, 7 of which received no commits in over 2 years. It might be directly in the code or in pulled dependencies. The first step to solving a problem is recognizing we have one. We have a problem. I am seeking help from the TC to raise the urgency of this work across all OpenStack projects and to help me lead an effort to reduce the number of cryptographic modules used in OpenStack (my personal opinion is that there should be no more than five). Doing this may involve work in each OpenStack Project team; and I can help organize this effort. I'm seeking the following from the TC and/or project teams: Portions of this work will be isolated to specific repositories managed by a project team, while others will involve "cross-project" synchronization. What vehicles can we use to have a "call-to-action" for project teams to get someone to look into their specific projects? How can we go about community wide collaboration? I've created a document [1] that I assembled from AI analysis of part of the OpenStack code. It gives an overall view of the problem we face. Looking forward to hearing from you and collaborating upstream to improve OpenStack. Regards, Jean-Philippe (JP) Jung jjung(a)redhat.com irc: jjung [0] Quantum what? Quantum computers will break current encryption algorithms like RSA and elliptic curve cryptography using Shor's algorithm, exposing all data encrypted today. Adversaries are already harvesting encrypted data to decrypt later once quantum computers mature. OpenStack powers critical cloud infrastructure globally. Deploying post-quantum cryptography (PQC) upstream is essential because downstream distributions and deployments inherit these security foundations. Without upstream PQC integration, the entire OpenStack ecosystem remains vulnerable, putting sensitive workloads, government systems, and enterprise data at risk. The migration takes years, so implementing PQC now in the codebase is operationally necessary, not optional. [1] https://wiki.openstack.org/wiki/Post_quantum_openstack

7 12

[Neutron] Bug deputy Oct 20-27
by Jakub Libosvar 27 Oct '25

27 Oct '25

Hi, I was the bug deputy last week. There was one bug reported by Rodolfo that was set to high priority but has no assignee. Here is the summary. High ---- * [OVN] Error when using tunnelled external networks and multihoming GW routers https://bugs.launchpad.net/neutron/+bug/2129750 Needs assignee Medium ------ * unittest test_ovsdb_monitor overwrites ovs.Stream module variables https://bugs.launchpad.net/neutron/+bug/2129284 Assigned to myself Patch proposed https://review.opendev.org/c/openstack/neutron/+/964493 * VPNaaS endpoint group creating with non-unique endpoints takes a long time to fail https://bugs.launchpad.net/neutron/+bug/2129681 Assigned to Sebastian Patch proposed: https://review.opendev.org/c/openstack/neutron-vpnaas/+/964686 Low --- * [OVN] Avoid creating session less admin context in the OVN client methods https://bugs.launchpad.net/neutron/+bug/2129674 Assigned to Rodolfo Patches proposed: - https://review.opendev.org/c/openstack/neutron/+/964788 - https://review.opendev.org/c/openstack/neutron/+/964679 Incomplete ---------- * Mixed port configuration native and tagged traffic whould not pass native vlan to trunk list https://bugs.launchpad.net/neutron/+bug/2129533 Needs an assignee to follow up with the reporter

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and PTG Agenda (2026.1/R-22)
by Goutham Pacha Ravi 27 Oct '25

27 Oct '25

Hello Stackers, Welcome to the Project Teams Gathering week [1][2]. Throughout the week, there are a lot of discussions planned over multiple tracks. The OpenStack Technical Committee will be meeting virtually as well as a part of this, and the meetings are between 1600 UTC and 1800 UTC on Tuesday, October 28, 2025, and between 1600 UTC and 1800 UTC on Friday, October 31, 2025. At 1600 UTC on Tuesday, October 28, 2025, we'll be meeting with maintainers across all project teams. If you are a PTL, a DPL liaison, or a core reviewer, please join us so we can have a productive discussion on impactful cross-project work that needs to happen in the 2026.1 "Gazpacho" release. The rest of the week is action-packed as well. I'd recommend that you consult the discussion Etherpads and stay plugged in via the #openinfra-events IRC channel on OFTC. If you'd like to propose new topics on the TC's PTG etherpad [3], please add them at the end of the pad under "Parking Lot," and I'll try to get them scheduled. === Weekly Meeting === The OpenStack Technical Committee held its last weekly IRC meeting on October 21, 2025 [4]. We confirmed the inactivity of the Vitrage and Venus project teams, noting they could face retirement before the M-2 milestone of the 2026.2 release if activity doesn't resume. A significant portion of the discussion focused on the long-standing inactive status of Monasca, with most present TC members strongly favoring proceeding with its retirement. There was also a preference for keeping it inactive for another cycle due to awareness of external interest in reviving it, though this interest has yet to materialize into active contributions. The consensus was to seek more votes on the retirement patch and close this out after the Project Teams Gathering. Other updates included the Skyline project's core reviewer self-nomination [5], where the Project Team Lead (PTL) welcomed the candidate, but the TC agreed that adding the person to the core reviewer group was premature given their lack of review history. Patches in the CI to reflect Gazpacho release runtime updates have merged [6], with only a patch for Grenade struggling with CI instability. Gate health is generally stable, though the recent outages of docker.io and quay.io highlighted a need for more autonomy in container image hosting. Finally, the committee discussed topics for the upcoming Project Team Gathering (PTG), including the need to address the use of unmaintained crypto libraries across OpenStack projects. The TC will not be meeting over IRC this week in lieu of the PTG. Weekly IRC meetings will resume next on November 4, 2025. === Governance Proposals === ==== Merged ==== - Require declaration of affiliation from TC Candidates | https://review.opendev.org/c/openstack/governance/+/949432 ==== Open For Review ==== - Propose jlarriba to Telemetry PTL | https://review.opendev.org/c/openstack/governance/+/964516 - Retire Monasca project | https://review.opendev.org/c/openstack/governance/+/953671 === Upcoming Events === - 2025-10-27: OpenInfra PTG: https://openinfra.org/ptg/ - 2025-11-04: OpenInfra Board meeting: https://board.openinfra.org/ - 2025-11-15: Celebrating 15 years of OpenStack, Montréal - 2025-11-15: KCD + OpenInfra Days, Hangzhou: https://sessionize.com/kcd-hangzhou-and-oicd-2025/ Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2026.1 "Gazpacho" Release Schedule: https://releases.openstack.org/gazpacho/schedule.html [2] 2026.1 PTG Etherpads: https://ptg.opendev.org/etherpads.html [3] OpenStack TC 2026.1 PTG Etherpad: https://etherpad.opendev.org/p/oct2025-ptg-os-tc [4] TC Meeting IRC Log, Oct 21, 2025: https://meetings.opendev.org/meetings/tc/2025/tc.2025-10-21-08.00.html [5] 2026.1 runtime update: https://review.opendev.org/q/hashtag:%222026-1-runtime-update%22+(status:op… [6] Skyline core contributor discussion: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack…

1 0

[tacker] Cancelling IRC meeting
by Yasufumi Ogawa 27 Oct '25

27 Oct '25

Hi team, Sorry for the late notice. Due to the vPTG, I'd like cancel the IRC meeting this week. Yasufumi

1 0

Keystone+Keycloak OIDC 403 Error on openstack CLI test
by Tyler Wilson 25 Oct '25

25 Oct '25

Hello All, I'm trying to get a test idp setup going via this document: https://docs.openstack.org/kolla-ansible/latest/contributor/setup-identity-… and everything seems to be configured correctly however I am getting a 403 when I try to use the openstack CLI to test. # openstack token issue You are not authorized to perform the requested action. (HTTP 403) (Request-ID: req-be79246b-ccc1-4fbd-ba3f-fa98b9cae7ba) # openstack user show customer01 You are not authorized to perform the requested action. (HTTP 403) (Request-ID: req-4e385968-796e-44a0-8003-351188c202ba) In the keystone log I see a traceback with handle_unscoped_token and apply_mapping_filter (full output here: https://pastebin.com/xZ2qeCPW ) so maybe I'm missing something with permissions? I have the attribute mapping exactly as it is in the documentation, and im getting this when replicate the POST to userinfo with the bearer token; {"sub":"$UUID","email_verified":true,"name":"CustomerFirst CustomerLast","preferred_username":"customer01","given_name":"CustomerFirst","openstack-default-project":"customers","openstack-user-domain":"cloud.ld","family_name":"CustomerLast","email":"customer01(a)example.com"} I also checked keycloak and the user event log shows green authentications. Both domain and project exist in identity as well # openstack domain list | grep cloud.ld | $UUID | cloud.ld | True | | # openstack project list | grep customers | $UUID | customers | I'm using these exports for the client export OS_AUTH_URL=http://$KEYSTONE_IP:5000/v3 export OS_PROJECT_NAME="customers" export OS_PROJECT_DOMAIN_NAME="cloud.ld" export OS_USERNAME="customer01" export OS_PASSWORD="$USER_PASSWORD" export OS_INTERFACE=public export OS_IDENTITY_API_VERSION=3 export OS_CACERT=/etc/ssl/certs/ca-certificates.crt export OS_AUTH_TYPE=v3oidcpassword export OS_CLIENT_ID=Keystone export OS_CLIENT_SECRET=$SECRET_ALTHOUGH_DOESNT_MATTER export OS_IDENTITY_PROVIDER=cloud.ld export OS_PROTOCOL=openid export OS_ACCESS_TOKEN_ENDPOINT=https://$KEYCLOAK_IP:8443/realms/cloud.ld/protocol/openid-connect/token Is there anything I might be missing here? Thanks for any help!

3 3

[PTG][neutron] Neutron schedule
by Brian Haley 24 Oct '25

24 Oct '25

Hi Neutrinos and stackers, I have added a rough schedule to our etherpad [0] for next week's vPTG meetings, please check it and make sure the times work if you had added a topic. Based on my estimates we will only meet on Tuesday and Wednesday and not have anything on Thursday, subject to change based on how long discussions take. There are cross-projects with Ironic and Nova on Wednesday. Room info is all at [1]. See you then, -Brian [0] https://etherpad.opendev.org/p/oct2025-ptg-neutron [1] https://ptg.opendev.org/ptg.html

1 0

[PTG][Horizon][outreachy][all] A story of OpenInfra User Group Kenya
by Tatiana Ovchinnikova 24 Oct '25

24 Oct '25

Hello all, Horizon is proudly hosting the PTG session of our former outreachy intern, Agnes Nduta, now the main organizer of OpenInfra User Group Kenya. Please join us in icehouse room on Tuesday, October 28, 2025 @ 16:30 UTC - 17:00 UTC Horizon etherpad link: https://etherpad.opendev.org/p/horizon-gazpacho-ptg With kind regards, Tatiana

1 0

[PTG][Horizon][Manila][Plugins] Upcoming PTG session on integration tests for Horizon and plugins
by Tatiana Ovchinnikova 24 Oct '25

24 Oct '25

Hello all, Horizon team is hosting a session on integration tests for Horizon in general and for Manila UI plugin in particular. Manila is the first plugin we are covering, so other Horizon plugins could take it as an example and get some ideas on how they could use some general fixtures implemented in Horizon. The session is scheduled on Tuesday 28th at 16:00 UTC, icehouse room. Here is the etherpad link: https://etherpad.opendev.org/p/horizon-gazpacho-ptg Feel free to join us! With kind regards, Tatiana

2 2

[cinder] PTG reminder and schedule
by Jon Bernard 24 Oct '25

24 Oct '25

Hello all, We covered the schedule [1] in this week's meeting but I wanted to post it here for reference. We will be meeting Tuesday, Wednesday, Thursday, and Friday of this week starting at 14:00 UTC. We technically have 4 hours each day to cover topics. Historically we have not needed all of that time, so I expect there will be some variability in end time. Two notable things to keep in mind: * We begin on Tuesday, not Monday - though there are some other sessions that day you may find interesting. See [2] for the full schedule * We have 4 cross team sessions with Eventlet, Nova, Glance, and Ironic. Keep those time slots in mind of those topics are of interest to you. Hope to see you all there! [1] https://etherpad.opendev.org/p/cinder-gazpacho-ptg [2] https://ptg.opendev.org/ptg.html -- Jon

1 0

[ptg][nova][ironic][cinder]cross-project sessions
by Iury Gregory 24 Oct '25

24 Oct '25

Hello nova and cinder folks, In the preparation for the upcoming PTG, we have some topics that we would like to discuss - *[ironic][nova] *Graphical Console follow-up https://etherpad.opendev.org/p/ironic-ptg-2026.1#L137 - *[ironic][nova][cinder] *NVMe over TCP https://etherpad.opendev.org/p/ironic-ptg-2026.1#L75 Next week we will be booking some time slots for ironic, feel free to reachout to us on #openstack-ironic with the time slots that would work for all teams. Best regards, -- *Att[]'s* *Iury Gregory Melo Ferreira * *MSc in Computer Science at UFCG* *Ironic Core* *Senior Software Engineer at Red Hat Brazil* *Social*: https://www.linkedin.com/in/iurygregory *E-mail: iurygregory(a)gmail.com <iurygregory(a)gmail.com>*

2 3

[PTG][ironic][neutron] cross-project session
by Iury Gregory 24 Oct '25

24 Oct '25

Hello neutron folks, In the preparation for the upcoming PTG, we would like to have a cross-project section to discuss about the VXLAN attachments [1] , we can book a slot that would work for the people that are interested in the topic. Next week we will be booking some time slots for ironic, feel free to reachout to us on #openstack-ironic with the time slots that would work for the neutron team. [1] https://etherpad.opendev.org/p/ironic-ptg-2026.1#L97 Best regards, -- *Att[]'s* *Iury Gregory Melo Ferreira * *MSc in Computer Science at UFCG* *Ironic Core* *Senior Software Engineer at Red Hat Brazil* *Social*: https://www.linkedin.com/in/iurygregory *E-mail: iurygregory(a)gmail.com <iurygregory(a)gmail.com>*

2 3

[PTG][ironic] Ironic Schedule
by Iury Gregory 24 Oct '25

24 Oct '25

Hello ironicers and stackers. We have our schedule for the PTG: =============================== Monday 27 13:00 UTC - 17:00 UTC =============================== - Flamingo Retrospective ~ 30min - Should we move back to a PTL model as a central driver standpoint, or something else. ~ 30min - Improving review process ~ 30min - In-project SIG to focus on aspects where operators are demanding a greater depth to Ironic's capabilities ~ 15min - AZ modeling in our Docs ~15min - Docs cleanup ~15min - Retrie irmc ~ 15min - Abort friendliness ~ 30min - Emergency Bulk Operations ~ 30 min - Diskimage-builder 20min ================================= Thuesday 28 13:00 UTC - 17:00 UTC ================================= - Post Eventlet world ~ 1h30min - Deferred tasks ~ 20min - Scaling Ironic Prometheus Exporter and generally hardware metrics ~ 20min - Async/await in ironic ~ 50mim - (JayF) More flexibility in sushy/redfish interfaces ~ 1h - Let's stop maintaining sushy as a separate project? ~ 30min - Redfish Virtual Media via NFS and SMB shares ~ 20min - Agent Virtual Media Image sizes ~ 20min ================================== Wednesday 29 13:00 UTC - 17:00 UTC ================================== - Snapshooting ~ 30min - Toggling port behavior from Network to Storage and back ~ 30min - Status of Trait Based Networking 20min # 14:30 - 15:30 - VXLAN attachements | Cross-Project with Neutron ~ 1h # 15:30 - 17:00 - Graphical Console follow-up | Cross-Project with Nova ~ 30min - As a infrastucture operator, I want to boot the machines from NVMe-over-TCP (over Ethernet) | Cross-Project with Cinder/Nova ~ 1h ================================== Thursday 30 13:00 UTC - 17:00 UTC ================================== - Should we keep PreP partition support in IPA 15min - Handling fast-track support w/ standalone networking ~ 45min - DCIM Integration ~ 20min - CentOS usage -20min - DHCP-Less Revisit 30min - Brainstorming/Revisiting Concurrent Action Limit? 25min - Has anyone looked into making project specific resource scheduling mapping? 25min - Metal3 25min Best regards, -- *Att[]'s* *Iury Gregory Melo Ferreira * *MSc in Computer Science at UFCG* *Ironic Core* *Senior Software Engineer at Red Hat Brazil* *Social*: https://www.linkedin.com/in/iurygregory *E-mail: iurygregory(a)gmail.com <iurygregory(a)gmail.com>*

1 1