Hi!
After some discussion with the folks taking care of the Debian LTS project, we decided that we will attempt to support OpenStack Rocky, running on Debian 10 (aka: Buster), for another 2 years, together with the rest of the distribution.
In the past, we decided that we wouldn't do it, and that OpenStack would be part of the list of unsupported packages, because it was too difficult to maintain. However, it is my opinion that this has changed, because: - The codebase is evolving slower - I do have all the tooling to re-do a Rocky deployment if needed - There's a lot less CVE per year than it used to be (10 years ago, it was 1 every 2 weeks on average, now we have like 2 grave issue per year...). - I'm confident that if there's a grave issue, I'll be able to find help from the this wonderful community (it happened in the past...).
Also, some sponsors of the Debian LTS project are actually running OpenStack Rocky on Debian. So it makes sense to help them.
It is to be noted that I will not be the person doing the actual security backports, but I'll be there in case the person doing it needs help from me (for example, to do a deployment and manual regression testing).
Hoping this will help OpenStack users running on Debian, Cheers,
Thomas Goirand (zigo)