openstack/octavia — Week of 2026-10-17

TLS and API fixes. The headline change reworks cipher configuration for TLSv1.3, correcting how ciphers are passed through to the data plane (1010617, ~300 lines). The LB graph API gained a fix for creating TLS-enabled pools, and l7rule values with a leading dash are now accepted — both landed on master and were backported to two stable branches each. A missing NetworkIpAvailabilityNotFound exception path was also plugged across three branches.

Stability and resource handling. The VIP port is now cleaned up when load balancer creation fails, closing a long-standing leak. The driver-agent no longer loops on client disconnect, member ports no longer get plugged on the wrong subnet, interface-to-netns allocation survives reboot correctly, and deadlock messages are no longer logged as errors. A missing keepalived PID file is downgraded to a warning, and octavia-db-manage fixes its log setup ordering.

Internals. The database layer swapped SQLAlchemy-Utils' ScalarListType for an in-tree implementation, and deprecated SQLAlchemy noload usage in the L7 policy path was replaced with get_all_orm. The old database entity-relationship diagram was removed.

Elsewhere. The gunicorn syslog socket now uses an absolute path (three branches), centos-10-stream and periodic FIPS jobs were dropped from stable branches, and functional tests skip on pre-commit-only updates.