Stackers Network Your weekly OpenStack TL;DR

The Big Picture

The dominant story this week is security hygiene across the Cinder, Aodh, and Ironic ecosystems — including a confirmed remote code execution in Cinder's SSH-based drivers that is deliberately shipping without an OSSA. On the development side, we're 19 weeks out from 2027.1 "Indri" (Milestone-1 is Nov 16), 2025.1 "Epoxy" has reached end-of-maintenance, and a quietly impressive test-infrastructure finding in Nova/Neutron/Cinder/Mistral surfaced 34 cross-test state leaks that had been lurking for years. PTG prep and OpenInfra Day North America also start showing up on calendars.

Security

Cinder SSH-driver command injection (bug 2163356). Brian Rosmaita disclosed that Sami Yessou found a 2013 input-sanitization fix in Cinder's SSH injection sanitizer was incomplete. Remote command execution was confirmed on IBM Storwize/SVC, and the flawed sanitizer is also used by Inspur InStorage, TOYOU ACS5000, the generic SAN driver base class, and the Brocade/Cisco FC zone managers. Manila inherits the same sanitizer from its Cinder fork but is not exposed to the RCE path. Following the 2013 precedent, no CVE or OSSA will be issued; patches are on Gerrit under topic bug/2163356 and details are on Launchpad #2163356. Operators running any of the affected backends should track those patches.

Aodh alarm-action SSRF proposal. Daniel Gines (Estabilis, Brazil) flagged that aodh-notifier typically runs with host networking on controllers, so any tenant able to create an alarm can aim REST actions at loopback, link-local, or management-network services — a blind SSRF. He is proposing a rest_notifier_denied_networks option (checked post-DNS-resolution to defeat rebinding/redirect tricks), plus the ability to disable schemes like trust+*. Four other 2026.1-cycle fixes are also up for review, including an authorization check against Gnocchi resources, a REST notifier timeout, a quota-vs-user bug, and a PUT-nulls-evaluate_timestamp bug (966682 / 1014682 series). See the thread — security-conscious operators should weigh in.

Ironic coresec. Jay Faulkner announced that Doug Goldstein (cardoe), already an Ironic core and TC member, has been formally added to the ironic-coresec team.

Development & Technical Decisions

Finding test-suite landmines with stestr --dynamic. Thomas Goirand made the case that running stestr's dynamic scheduler (instead of the deterministic default) exposes cross-test state leaks that stay invisible under normal CI ordering. Debian's packaging runs have turned up 34 such leaks across Nova, Neutron, Cinder, and Mistral, all fixed by small patches (copy-before-use, restoring globals in cleanup, mock.patch.object, etc.) — not product bugs, but ordering-fragile tests. Example Nova fixes: 1012432, 1012433, 1012434. Worth project teams considering as a periodic CI job.

networking-sfc deprecation moves forward. Brian Haley confirmed the Neutron team is proceeding with deprecation of networking-sfc; related patches are gathered under the networking-sfc-deprecation topic. Users of SFC need to speak up now or plan a migration — the call for new maintainers is explicit.

Neutron/OVN operator pain points. Nguyễn Hữu Khôi re-raised a production-impacting 2026.1 issue where Keepalived VIPs become unreachable with port security enabled on OVN. Separately, the Neutron bug deputy report (Nov 2–8) surfaced several significant OVN issues: bug 2169482 (all router gateway ports share one HA_Chassis_Group, misscheduling multi-physnet gateways), bug 2169459 (redirect-type=bridged routing loop on multi-gateway routers), and three new ovn-octavia-provider health-check bugs (2169831/2/3) around member identification and lifecycle.

Octavia security groups in 2025.1. Vincent Godin reported a production cluster where the LB security group (lb-xxxx) on amphorae has no egress rules — breaking backend reachability — while a test cluster on the same version is fine. No resolution yet; a good one for Octavia operators to compare notes on.

Releases & Announcements

• R-18 countdown. Elõd Illés posted the standard countdown reminder for 2027.1 "Indri".
• 2025.1 "Epoxy" is EOM. Per the TC summary, Epoxy has reached end-of-maintenance; project teams may need to fix or drop grenade (regular and SLURP) upgrade jobs that still reference stable/2025.1.
• Key upcoming dates: Indri-1 milestone on November 16; the 2026.2 "Hibiscus" cycle-trailing release deadline is November 30.

Governance

Goutham Pacha Ravi's TC weekly summary covered a lot of ground:

• Unmaintained branch policy change coming. Jeremy Stanley (fungi) will propose amending policy so that stable branches of retired deliverables go straight to EOL rather than transitioning to unmaintained — triggered by venus retirement blocking release automation on stale ACLs.
• The cross-project SRBAC goal was marked complete and its pop-up team disbanded.
• eventlet-removal and rootwrap-to-privsep are being treated as sharing a sunset timeline; Michael Still's investigation into memory wasted on never-executed code is highlighting service-side privsep work that still needs doing.
• Artem Goncharov (gtema) continues iterating on the Rust use-case analysis.
• Michal Nasiadka (mnasiadka) is leading the restoration of wiki.openstack.org — help wanted via Gerrit and OpenDev's Matrix room.

Heads Up / Action Needed

• Ops Radio Hour needs a host or topics by Friday Nov 13, or the November call is skipped — see the etherpad.
• Kolla PTG sessions (Kolla/Kolla-Ansible Dec 2, Kayobe Dec 3) — agenda at kolla-indri-ptg etherpad. The next three Kolla IRC meetings (Nov 11/18/25) are cancelled around US holidays and SC/OpenInfra Day North America.
• Kolla user forum at OpenInfra Day North America in Chicago.
• Cinder driver review backlog. Prasant Padhi (NetApp) escalated 11 driver patches open since Hibiscus or earlier — features, customer-impacting defects, and UT improvements — with CI green. Cinder reviewers, worth a pass on this list.
• Octavia cancelled its weekly meeting this week (Gregory Thiemonge unavailable).