Reference
Look-up facts for OpenStack: release series and support phases, the SLURP upgrade matrix, tested runtimes, component versions, the service and port map, hypervisor and driver support, deployment tooling, retirements, security defaults and a hardening checklist. For how these pieces fit together see Explanation; for procedures see How-to Guides.
Primary data source
Release dates and phases come from the openstack/releases repository (data/series_status.yaml, the data behind releases.openstack.org), read on 2026-09-25. Retirement dates come from openstack/governance (reference/legacy.yaml). Ports come from the Kolla-Ansible stable/2026.1 defaults (ansible/group_vars/all/*.yml).
Release Series Matrix
OpenStack ships a coordinated release every six months (late March/early April and late September/early October). Since 2023.1, releases are named YYYY.N plus a code name. Releases ending in .1 are SLURP releases.
| Release |
Code name |
SLURP |
Initial release |
Status (2026-09-25) |
Next phase |
| 2027.1 |
Indri |
Yes |
2027-03-24 (planned) |
Future |
Development starts 2026-10-01 |
| 2026.2 |
Hibiscus |
No |
2026-09-30 (planned) |
Development (RC stage) |
Maintained from 2026-09-30 |
| 2026.1 |
Gazpacho |
Yes |
2026-04-01 |
Maintained |
Unmaintained from 2027-10-27 |
| 2025.2 |
Flamingo |
No |
2025-10-01 |
Maintained |
End of life 2027-04-28 |
| 2025.1 |
Epoxy |
Yes |
2025-04-02 |
Maintained |
Unmaintained from 2026-10-02 |
| 2024.2 |
Dalmatian |
No |
2024-10-02 |
End of life (2026-04-29) |
— |
| 2024.1 |
Caracal |
Yes |
2024-04-03 |
Unmaintained |
End of life (date TBD) |
| 2023.2 |
Bobcat |
No |
2023-10-04 |
End of life (2025-04-30) |
— |
| 2023.1 |
Antelope |
Yes |
2023-03-22 |
Unmaintained |
End of life (date TBD) |
| Zed |
Zed |
— |
2022-10-05 |
Unmaintained |
End of life (date TBD) |
| Yoga |
Yoga |
— |
2022-03-30 |
Unmaintained |
End of life (date TBD) |
| Xena / Wallaby / Victoria |
— |
— |
2021-10-06 / 2021-04-14 / 2020-10-14 |
End of life (2025-12-19) |
— |
2026.2 Hibiscus is days away
As of 2026-09-25, Hibiscus is in its release-candidate phase (for example Nova 34.0.0.0rc1, Neutron 29.0.0.0rc2) with the coordinated release planned for the week of 2026-09-28 (target date 2026-09-30). Re-check releases.openstack.org after that date and update the Key Facts on the hub.
Support Phases
| Phase |
What it means |
| Development |
Current cycle on master; milestones, feature freeze, RCs |
| Maintained |
Stable branch stable/YYYY.N; project teams backport fixes and cut point releases; about 18 months |
| Unmaintained |
Branch renamed unmaintained/YYYY.N; kept open only while volunteers keep CI working; SLURP releases enter this phase |
| End of life |
Branch deleted and tagged <series>-eol; no further changes |
- Non-SLURP releases go straight from Maintained to End of life (Dalmatian: released 2024-10-02, EOL 2026-04-29).
- SLURP releases move to Unmaintained after the maintained window (Epoxy: 2025-04-02 to 2026-10-02).
SLURP Upgrade Paths
| From |
To |
Supported |
| 2025.1 Epoxy |
2025.2 Flamingo |
Yes (adjacent) |
| 2025.1 Epoxy |
2026.1 Gazpacho |
Yes (SLURP to SLURP, skips Flamingo) |
| 2025.2 Flamingo |
2026.1 Gazpacho |
Yes (adjacent) |
| 2026.1 Gazpacho |
2026.2 Hibiscus |
Yes (adjacent) |
| 2026.1 Gazpacho |
2027.1 Indri |
Yes (SLURP to SLURP), once Indri ships |
| 2025.2 Flamingo |
2026.2 Hibiscus |
No (non-SLURP to non-SLURP skip is not tested) |
Source: TC resolution 2022-02-10 Release Cadence Adjustment.
Tested Runtimes
From the TC "Tested Runtimes" pages in openstack/governance (reference/runtimes/<series>.rst).
| Release |
Minimum Python |
Python versions tested |
Reference distributions |
| 2025.2 Flamingo |
3.10 |
3.10, 3.11, 3.12, 3.13 |
Ubuntu 24.04, Debian 12 |
| 2026.1 Gazpacho |
3.10 |
3.10, 3.11, 3.12, 3.13, 3.14 |
Ubuntu 24.04, Debian 13, Debian 12 (kept for the previous SLURP), CentOS Stream 10, Rocky Linux 10 |
| 2026.2 Hibiscus |
3.11 |
3.11, 3.12, 3.13, 3.14 |
Ubuntu 24.04, Debian 13 |
Component Versions: 2026.1 Gazpacho
Each project versions independently; the coordinated release groups them. Initial .0.0 tag and the latest stable point release recorded in deliverables/gazpacho/*.yaml on 2026-09-25.
| Project |
Gazpacho initial |
Latest Gazpacho point release |
| Nova |
33.0.0 |
33.0.2 |
| Neutron |
28.0.0 |
28.0.2 |
| Keystone |
29.0.0 |
29.1.0 |
| Cinder |
28.0.0 |
28.0.0 |
| Glance |
32.0.0 |
32.0.0 |
| Magnum |
22.0.0 |
22.0.0 |
| Ironic |
33.0.0 (intermediary releases; Ironic ships more than once per cycle) |
35.1.0 |
| Kolla-Ansible |
22.0.0 |
22.2.0 |
Release Highlights
2026.1 Gazpacho
| Area |
Highlight |
| Nova |
Parallel live migration via [libvirt] live_migration_parallel_connections (default 1) |
| Nova |
Live migration of vTPM instances with the hw:tpm_secret_security=host extra spec |
| Nova |
One IOThread per QEMU instance by default |
| Nova |
Microversion 2.101: volume attach becomes asynchronous (HTTP 202) |
| Nova |
UEFI firmware selection delegated to libvirt; full OpenAPI schema coverage |
| Nova |
nova-api, nova-scheduler and nova-metadata default to native threading (not eventlet) |
| Neutron |
OVN BGP capabilities integrated in the ML2/OVN driver; N/S routing for external (SR-IOV, bare metal) ports |
| Ironic |
NFS and CIFS/SMB virtual media with auto-detection; autodetect and noop deploy interfaces; standalone networking service; trait-based port scheduling |
2025.2 Flamingo
| Area |
Highlight |
| Neutron |
API, RPC workers and agents run in native threading mode instead of eventlet |
| Neutron |
OVN agent replaces the OVN metadata agent; optional stateless floating IP NAT |
| Nova |
Project-scoped manager role; service-to-service calls use the service role |
| Nova |
One-time-use PCI passthrough devices; memory balloon autodeflate and free page reporting |
2026.2 Hibiscus (release candidates)
| Area |
Highlight (subject to final release) |
| Nova |
AMD SEV-SNP and Intel TDX confidential-computing guests (hw:mem_encryption_model) |
| Nova |
Cyborg-managed mediated devices (vGPU) via an MDEV accelerator binding |
| Neutron |
EVPN service plugin (BGP EVPN Type-5 via FRR); Private VLAN plugin; per-project default security group statefulness |
Service and Project Map
| Service type |
Project |
Role |
Default API port |
| Identity |
Keystone |
Authentication, authorization, service catalog |
5000 |
| Compute |
Nova |
VM lifecycle, scheduling, live migration |
8774 (metadata 8775) |
| Placement |
Placement |
Resource inventories and allocations used by the Nova scheduler |
8778 upstream docs (Kolla-Ansible uses 8780) |
| Networking |
Neutron |
ML2/OVN, ML2/OVS, SR-IOV, BGP, security groups, floating IPs |
9696 |
| Block Storage |
Cinder |
Volumes, snapshots, backups, encryption |
8776 |
| Image |
Glance |
Image registry and distribution |
9292 |
| Object Storage |
Swift |
Object store (native API, S3 via s3api middleware) |
8080 (proxy, common default) |
| Shared File Systems |
Manila |
NFS/CephFS shares |
8786 |
| Orchestration |
Heat |
HOT templates, stacks (plus CloudFormation-compatible API) |
8004 (CFN 8000) |
| Dashboard |
Horizon |
Django web UI |
80 / 443 |
| Dashboard |
Skyline |
Newer web UI (API server + console) |
9998 / 9999 |
| Load Balancer |
Octavia |
LBaaS (amphora or OVN provider) |
9876 |
| Bare Metal |
Ironic |
Physical server provisioning (PXE, Redfish, virtual media) |
6385 |
| DNS |
Designate |
DNSaaS |
9001 (DNS 53) |
| Key Manager |
Barbican |
Secrets, keys, certificates |
9311 |
| Container Infrastructure |
Magnum |
Kubernetes cluster lifecycle |
9511 |
| Alarming |
Aodh (Telemetry) |
Alarms that drive Heat autoscaling |
8042 |
Infrastructure Ports
| Component |
Port(s) |
Notes |
| RabbitMQ |
5672 (AMQP), 5671 (AMQP over TLS), 15672 (management), 25672 (clustering), 4369 (epmd) |
Kolla-Ansible switches rabbitmq_port to 5671 when TLS is on |
| MariaDB / Galera |
3306 (SQL), 4567 (wsrep), 4568 (IST), 4444 (SST) |
|
| Memcached |
11211 |
Token and catalog caching |
| OVN databases |
6641 (Northbound), 6642 (Southbound) |
|
| Nova consoles |
6080 (noVNC proxy), 6082 (SPICE HTML5 proxy), 6083 (serial proxy) |
|
| Octavia health manager |
5555/udp |
Amphora heartbeats |
Service Port Reference
The ports above are defaults. Kolla-Ansible and other tools can override every one of them; the Keystone catalog (openstack endpoint list) is authoritative for a given cloud. Keystone's historic admin port 35357 is gone: Identity v3 serves everything on 5000.
Compatibility Matrix
| Dimension |
Supported (Gazpacho) |
Removed or not supported |
| Nova compute drivers |
libvirt.LibvirtDriver, ironic.IronicDriver, vmwareapi.VMwareVCDriver, zvm.ZVMDriver (plus fake for tests) |
Hyper-V driver (removed; gone by 2024.1), PowerVM, XenAPI |
libvirt virt_type |
kvm (default), qemu, lxc, parallels |
xen, uml |
| Neutron ML2 |
OVN (DevStack default), Open vSwitch, SR-IOV, macvtap, vendor drivers |
Linux bridge driver and agent (removed in 2025.1 Epoxy) |
| Storage backends |
Ceph RBD, LVM, NFS, iSCSI/FC arrays via vendor Cinder drivers (NetApp, Pure Storage, Dell and many more) |
— |
| Kolla-Ansible host OS (2026.1) |
Ubuntu 24.04, Debian 13, Rocky Linux 10, CentOS Stream 10 |
— |
| OpenStack-Helm (README) |
2025.1, 2025.2 and 2026.1 on Ubuntu 24.04 images, Kubernetes 1.33 to 1.35 |
— |
| CPU architectures |
x86_64, aarch64 widely deployed; ppc64le and s390x (z/VM driver) are niche |
— |
| Tool |
Model |
Governance |
Status (2026-09) |
| Kolla-Ansible |
Ansible deploys Kolla container images to hosts |
Official (Kolla team) |
Active; 22.x for 2026.1. Swift role removed in 20.0.0 (2025.1) |
| Kayobe |
Bare metal provisioning + Kolla-Ansible |
Official (Kolla team) |
Active |
| OpenStack-Ansible |
Ansible roles, LXC or bare metal |
Official |
Active |
| OpenStack-Helm |
Helm charts on Kubernetes (openstack-helm-infra merged in, retired 2025-04-15) |
Official |
Active; charts at tarballs.opendev.org |
| Sunbeam |
Canonical charms/snaps on Kubernetes (Canonical OpenStack) |
Official deliverable sunbeam-charms |
Active |
| Genestack |
Rackspace; Kustomize + Helm on Kubernetes, reuses OpenStack-Helm charts |
Vendor (rackerlabs, Apache 2.0) |
Active; release branch release-2026.1 |
| Red Hat OpenStack Services on OpenShift (RHOSO 18) |
Operators on OpenShift |
Vendor |
Active; based on 2023.1 Antelope at its 2024 GA (per third-party reviews) |
| DevStack |
Scripts for a development cloud |
Official (QA) |
Development only, not production |
| TripleO |
Heat-based "OpenStack on OpenStack" |
— |
Retired 2024-01-09 |
| OpenStack Chef |
Chef cookbooks |
— |
Retired 2024-01-10 |
Retired Projects
Teams and deliverables retired since 2023 (source: openstack/governance reference/legacy.yaml).
| Project |
Service |
Retired on |
| Winstackers (Hyper-V support) |
Windows libraries |
2023-06-23 |
| TripleO |
Deployment |
2024-01-09 |
| OpenStack Chef |
Deployment |
2024-01-10 |
| Murano |
Application catalog |
2024-05-10 |
| Sahara |
Data processing |
2024-05-10 |
| Senlin |
Clustering |
2024-05-10 |
| Solum |
Software lifecycle automation |
2024-05-10 |
| EC2-API |
EC2 compatibility layer |
2024-05-10 |
| networking-ovn (merged into Neutron long before) |
ML2 driver repo |
2024-05-15 |
| Kuryr (incl. kuryr-kubernetes) |
Container networking |
2024-10-17 |
| openstack-helm-infra (merged into openstack-helm) |
Helm charts |
2025-04-15 |
| networking-midonet |
Neutron plugin |
2025-07-18 |
| Monasca |
Monitoring |
2025-08-11 |
| metalsmith, python-ironic-inspector-client |
Ironic tooling |
2025-10-08 |
| shade |
SDK (superseded by openstacksdk) |
2025-10-01 |
| Venus |
Log management |
2026-06-02 |
| cinderlib |
Cinder library |
2026-06-18 |
As of 2026-09-25 the governance projects.yaml lists 42 official project teams.
Security Defaults
Keystone
| Setting |
Value |
| Token providers |
fernet (default) and jws; neither needs token persistence |
[token] expiration |
3600 seconds (1 hour) |
admin_token |
Exists but documented as "NOT recommended"; use keystone-manage bootstrap and leave it unset |
| Auth methods |
password, token, application credentials, TOTP, federation (SAML 2.0, OpenID Connect via mapping), LDAP identity backend |
| Default roles |
admin, member, reader, plus manager (project-level) and service (service-to-service) |
| Scopes |
project, domain, system |
Barbican Backends
| Plugin |
Type |
Notes |
simple_crypto |
Crypto (software) |
Default; one KEK in config |
p11_crypto |
Crypto (PKCS#11 HSM) |
Documented for Thales Luna Network HSM, nCipher nShield Connect XC, ATOS Bull, Utimaco |
kmip_plugin |
Secret store |
KMIP devices store the secret directly |
vault_plugin |
Secret store |
HashiCorp Vault |
dogtag_crypto |
Secret store |
Dogtag KRA (FreeIPA / Red Hat Certificate System) |
Encryption at Rest
| Service |
Encryption Method |
| Cinder |
LUKS volume encryption via encrypted volume types; keys in Barbican |
| Swift |
At-rest encryption middleware with a root secret (can be held in Barbican via KMS keymaster) |
| Nova |
Ephemeral storage encryption (LUKS) with keys from the key manager |
| Glance |
Image encryption is rare; rely on Cinder for volume-backed instances |
Hardening Checklist
Known Pitfalls
| Pitfall |
Risk |
Mitigation |
admin_token set |
Unauthenticated admin access |
Leave unset in production |
| Unencrypted RabbitMQ |
Inter-service credential interception |
Enable TLS on AMQP connections |
| Overly broad security groups |
VM exposure to unauthorized traffic |
Explicit allow rules, avoid 0.0.0.0/0 on management ports |
| Unrotated Fernet keys |
Long-lived token encryption keys |
Regular key rotation schedule |
| Shared MySQL credentials |
Database access escalation |
Per-service accounts with least privilege |
| No audit logging |
Undetected unauthorized actions |
Enable CADF events, centralize logs |
| Skipping a non-SLURP release |
Untested upgrade path |
Only skip from a SLURP to the next SLURP |
Benchmarks
Unsourced performance data
The figures below were carried over from an earlier version of this page. They are estimates from vendor documentation, community reports and engineering judgment, not controlled benchmarks with documented hardware, versions or methods. Treat them as rough orders of magnitude and benchmark your own workload.
| Operation |
Time |
Notes |
| VM boot (local image cache) |
10-30s |
Depends on image size |
| VM boot (Ceph RBD) |
15-45s |
Copy-on-write clone avoids a full image download |
| Live migration |
5-60s |
Depends on memory size and dirty rate |
| Snapshot |
10-120s |
Copy-on-write with Ceph |
| Dimension |
Order of magnitude |
Notes |
| Compute nodes per cloud |
Hundreds to thousands |
Nova cells v2 shards the database and message bus |
| VMs per compute host |
100+ |
Depends on host resources and allocation ratios |
| Total VMs |
50,000+ |
Large public and research clouds |
| API requests/sec |
1,000+ |
Keystone token validation is the usual bottleneck; Memcached caching matters |
| Neutron operation |
ML2/OVS |
ML2/OVN |
| Port creation |
5-10s |
2-5s |
| Network create |
1-3s |
1-2s |
| Floating IP |
2-5s |
1-3s |
| East-west throughput |
8-9 Gbps |
9-10 Gbps |
Sources