openstack/neutron — Week of 2026-10-24

EVPN provisioning. The biggest piece of the week is a new EvpnExecutor for EVPN provisioning, landing ~750 lines of new orchestration code (1006431). Synced EVPN routers now use a round-robin scheduler, and the LRP side gains a static redistribution option. Related ML2/OVS cleanup removes leftover tpi/spi patch ports from br-int, with that fix carried across three branches. Documentation also got a pass to clarify the split between in-tree BGP/EVPN and the ovn-bgp-agent implementations.

OVN backend. A cluster of fixes targets the OVN mech driver: MAC_Binding entries are now deleted when a floating IP's external_mac changes, LSP commands' run_idl becomes idempotent, floating IP port MAC is restored when a load balancer FIP is removed, and OVSDB lock checks switch from idl.is_lock_contended to idl.has_lock with the MaintenanceWorker lock set before connect. There's also a separate change to stop advertising router gateway and metadata server IPs. Most of these fixes were backported two or three branches deep.

Policy and API. RBAC for access_as_external is now restricted to admins (backported to two stable branches), a missing get_subnet:leak_routes rule was added, and support for setting the trusted key in binding:profile has been removed. The extra-gateways overlap check regained its duplicate subnet guard, and metadata response headers were cleaned up.

Stability. Several functional and unit tests were deflaked — OVN L3 ovsdb monitor HA chassis tests, a live-migration test after lsp_bind, test_find_listen_pids_namespace, and test_periodic_worker_lifecycle_contract — alongside a pbr >= 7.1.3 build-requirement bump.