openstack/octavia — Week of 2026-10-31

API validation and tenancy fixes. A notable security-shaped fix landed across master and three stable branches to stop Pool POST from attaching to a Listener in any project, closing a cross-tenant attachment hole (1011815 and backports). L7 rule API requests now validate their parent L7 policy, and member subnets are checked during graph create and batch update rather than being accepted blindly. The load balancer availability_zone field also now correctly honors the configured default.

Amphora and control-plane stability. VRRP ports are cleaned up after VIP plug failures, and the VIP port itself is now deleted when a load balancer creation fails, trimming two long-standing orphan-resource paths. Keepalived reloads no longer transiently report invalid status, and the Amphorae agent API produces better HTTP 500 responses. On the ComputeRetry/AmpRetry path, the retry budget was made authoritative so retries actually stop when exhausted.

Jobboard driver. A ZooKeeper listener leak in the jobboard driver was fixed and backported four times, removing ~270 lines of accumulated workaround on each branch.

Auth and housekeeping. Inter-service calls move to a dedicated service user with hard-coded service name, devstack switches to the common keystoneauth helper, and load-balancer_* roles are skipped when keystone default roles are in use. Elsewhere: an api-ref update for 501s, a pep8 fix for O342 on namespaced exceptions, and re-enabling the octavia-grenade-skip-level job.