openstack/octavia — Week of 2026-10-10

TLS and cert handling. The largest piece of work this cycle rewrote cipher configuration for TLSv1.3, which uses a separate ciphersuite list from TLSv1.2 and had not been wired through correctly (1004617). LocalCertManager was hardened against path traversal, and creation of TLS-enabled pools through the load balancer graph API was fixed so single-call LB provisioning no longer trips on pool TLS settings.

Amphora stability. Several longstanding amphora driver bugs landed: keepalived reloads no longer leave the VIP port in an invalid status, AllocateVIP.revert was corrected in the amphorav2 flow, and health-update error handling now resolves the load balancer ID properly instead of crashing on the error path. L7 rules can now carry values with a leading dash, and a missing NetworkIpAvailabilityNotFound exception was added for the Neutron interaction layer.

OVN provider. SOURCE_IP is now advertised as a complete lb-algorithm for the OVN provider driver — a one-line feature-matrix update, but a user-visible capability change.

Maintenance. Deprecated bits were cleaned out: the amphora_udp_driver option, upstart support knobs, a keepalived <2.0.14 workaround, testrepository, and a stray win32 marker. Tox and pre-commit configs were tidied, CI job templates moved to the 2027.1 tested runtimes, stable/2026.2 picked up its constraints update, driver-agent functional tests now enforce fork context, and the docs build switched to pydot.