[repo-status] Week of 2026-09-27: steady delivery across security, networking, storage, and virtualization

[github-actions]

Weekly status: 2026-09-27 to 2026-10-04

Apache CloudStack had a focused, constructive week with meaningful engineering activity across core infrastructure and the contributor review queue. 🌟

Highlights

• Core repository changes: two direct commits landed: the ASF Allowlist check workflow, strengthening project compliance automation, and a targeted revert of the VMware-to-KVM migration change while the follow-up restoration is prepared.
• Active feature work: #14205 proposes a generic OIDC provider with issuer discovery, JWT/JWKS validation, replay protection, schema changes, and UI support. It includes substantial unit and Keycloak integration coverage and deserves careful security-focused review.
• Virtual networking: #14294 addresses stale DHCP leases on redundant routers, a concrete reliability fix for IP reuse after VM expunging.
• Migration progress: #14256 restores VMware-to-KVM cold/warm migration work and adds focused CBT, cutover-failure, and import-template fixes. Historical acceptance is strong, but fresh functional validation for the latest commits is still in progress.
• User-facing quality: active PRs cover network-offering UI improvements (#12951), the missing backup resource-limit label (#14163), default isolated-network egress behavior (#14286, #14300), and API discovery/refactoring work.
• Fresh operational feedback: #14295 reports four related NAS backup/quiescing failure modes, while #14302 reports implausibly high Ceph IOPS values with possible performance impact. #14303 requests decoupling account creation from mandatory user creation.

Project status and goals

• The project remains actively maintained across the main, 4.22, and 4.20 lines, with a healthy stream of fixes and enhancements under review.
• The latest published release is 4.23.0.0, published on 2026-09-02; no release was published during this reporting window.
• Current goals remain clear: protect release quality, keep security-sensitive authentication work rigorous, maintain stable LTS branches, and turn field reports into reproducible fixes.

Recommended next steps

1. Prioritize validation for high-impact work: complete fresh multi-cycle VMware-to-KVM migration acceptance for #14256 and run targeted redundant-router DHCP regression coverage for #14294.
2. Review security boundaries before merging #14205: verify discovery, issuer/audience/expiry checks, key rotation behavior, registration authorization, replay handling, and upgrade compatibility.
3. Triage field reports quickly: reproduce #14295 against supported KVM/libvirt combinations and split its four failure modes into testable fixes; confirm whether #14302 is telemetry-only or reflects real Ceph throttling.
4. Keep the review queue moving: assign reviewers and close the loop on the UI/API improvements and default-network behavior PRs, especially those targeting maintained branches.
5. Plan release communication: since 4.23.0.0 is the latest release, keep upgrade guidance and backport decisions visible as fixes mature.

Thanks to all contributors and reviewers keeping CloudStack moving forward! 🚀

Generated by Weekly Repo Status · gpt56 271.8K · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-status.md@main