OpenStack Hibiscus adds DNS security features and confidential computing to the open-source cloud platform
Network World ·
AI is having an oversized impact on the open-source OpenStack cloud infrastructure platform. AI workloads are driving new hardware and storage requirements in OpenStack, while AI-assisted security research is driving up the number of vulnerability reports. Those are two of the prevailing themes in OpenStack 2026.2, code-named Hibiscus , which reaches general availability on Sept. 30. According to the OpenInfra Foundation, about 600 contributors delivered 11,500 code changes during the six-month cycle. Contributor count rose 21% and code changes rose 28% compared with OpenStack 2026.1 Gazpacho . The changes span the platform with multiple projects providing new security capabilities and fixes as well as scalability improvement to meet the growing demands of AI. The scale of security vulnerability that the OpenInfra Foundation , which manages the OpenStack project, has had to deal with is unprecedented in the project’s 16 year history. The project has reinforced its vulnerability management teams and is making sure each project has security contacts. “We had 42 security advisories in the first eight months of 2026, compared to 3.2 per year over the past five years, so it’s definitely driven a lot of pressure on the maintainers and the security teams that are working on that,” Thierry Carrez , general manager of the OpenInfra Foundation, told Network World . It’s always DNS: Designate DNS-as-a-Service gets a boost The Designate DNS-as-a-Service project is critical to networking in OpenStack. It has been stable for years with only incremental changes, but the impact of AI has changed that. Carrez noted that significant security issues found by AI reporters were fixed in Designate this cycle. He said he suspects it triggered new interest in the project. In the Hibiscus cycle, Designate gets a critical fix for OSSA-2026-034 , a cross-tenant zone ownership bypass vulnerability. A tenant could create a subzone, superzone, or duplicate of another tenant’s zone by scheduling it to a different pool. That could enable DNS traffic hijacking and denial of service. Ownership conflict checks now search across all pools, and mDNS record and NOTIFY lookups are scoped by pool. Beyond the vulnerability fix, there are a series of important security hardening improvements. DANE support: Designate can now store TLSA records, a type of DNS entry that ties a TLS certificate or public key to a service at a domain name. The records are used for DANE, short for DNS-based Authentication of Named Entities. “The DANE protocol, which lets the domain owners publish which TLS certificates are valid for their services, really reduces the reliance on certificate authority systems alone,” Carrez said. Split-horizon DNS: Split-horizon DNS returns different answers to the same query depending on who asks. Internal clients get one answer and external clients get another. Designate now supports it through a new backend built on BIND9. Neutron advertises tenant networks straight into the data center fabric Neutron is the OpenStack networking project. It provides the virtual networks that tenant VMs connect to. Neutron can build those networks with OVN, short for Open Virtual Network. In Hibiscus it gains a way to connect those virtual networks to the physical data center network. It also cuts the memory used to monitor high availability (HA) routers. BGP EVPN. EVPN is short for Ethernet VPN. A new EVPN service plugin and OVN agent extension advertise tenant network prefixes into the data center fabric. They do this through FRR, an open source routing suite, using BGP EVPN Type-5 routes. A prefix is the range of IP addresses a tenant network uses. Type-5 support is aimed at data center integration. “It lets the tenant network prefixes be advertised directly into the physical fabric, so that really that’s basically how modern data center networks are built,” Carrez explained. “So really helps OpenStack fit into those environments without extra gateway layers that we’ve seen in use before.” Routable tenant addresses: The OVN BGP integration gains a route leaking option. An operator turns it on with the leak_routes attribute of a subnet. The extended OVN features follow the same approach. “OVN BGP features that let the tenant addresses be routable directly from the underlay, and that again is exposing how modern data centers are built directly into OpenStack,” Carrez said. Lower memory use: In deployments that use Open vSwitch, a monitoring daemon tracked keepalived state changes for HA routers. Hibiscus replaces the daemon with a shell script. The change applies to every HA router, so the savings add up across a deployment. “The 15 times reduction in memory footprint for the high availability router monitoring is, I think, really interesting,” Carrez said. Isolation and failover control : Neutron adds a Private VLAN plugin that provides an alternative model for port isolation. It also supports the L3 Agent Scheduler API in deployments that use OVN, including a field that sets the order of gateway failover. Nova adds hardware-backed protection for virtual machines Nova is the OpenStack compute service. It creates and manages the VMs that tenants run. In Hibiscus it adds two hardware-based ways to protect VMs from the hypervisor and other privileged software. Operators request either one with the hw:mem_encryption_model setting in a flavor extra spec or image property. AMD SEV-SNP. SEV-SNP is short for Secure Encrypted Virtualization with Secure Nested Paging. It encrypts VM memory in hardware and protects the integrity of that memory. It also produces signed attestation reports that a VM owner can use to check that the VM has not been altered. Nova already supported the earlier AMD SEV-ES, short for Secure Encrypted Virtualization with Encrypted State. Of attestation, Carrez said, “That really makes sure that the guest owners can make sure that the VMs have not been tampered with. Instead of just having to trust the provider.” Intel TDX. TDX is short for Trust Domain Extensions. It requires 5th Gen Xeon Scalable processors or later. It encrypts VM memory and isolates CPU state. Attestation runs through the Quote Generation Service. “It really removes a major barrier for regulated industries having to move sensitive workloads to shared or private clouds,” Carrez said. vGPU management. A vGPU is a share of a physical GPU assigned to a VM. Nova can now use vGPUs managed by Cyborg, the OpenStack accelerator project, as well as vGPUs it manages itself. Both can run on the same system, and a new trait prevents scheduling collisions between the two. What’s next: AI agents as OpenStack users? Looking forward, the demands of AI are likely to only grow as AI agents are increasingly deployed. Carrez noted that there have been some discussion about how to build and setup OpenStack in a world where only agents exist. How that manifests in future capabilities remains to be seen. Beyond agents, he said the project’s direction depends on what its users need. “That’s where the project is going to go, matching the demand of its users,” Carrez said. OpenInfra Foundation
AI is having an oversized impact on the open-source OpenStack cloud infrastructure platform. AI workloads are driving new hardware and storage requirements in OpenStack, while AI-assisted security research is driving up the number of vulnerability reports. Those are two of the prevailing themes in OpenStack 2026.2, code-named Hibiscus , which reaches general availability on Sept. 30. According to the OpenInfra Foundation, about 600 contributors delivered 11,500 code changes during the six-month cycle. Contributor count rose 21% and code changes rose 28% compared with OpenStack 2026.1 Gazpacho . The changes span the platform with multiple projects providing new security capabilities and fixes as well as scalability improvement to meet the growing demands of AI. The scale of security vulnerability that the OpenInfra Foundation , which manages the OpenStack project, has had to deal with is unprecedented in the project’s 16 year history. The project has reinforced its vulnerability management teams and is making sure each project has security contacts. “We had 42 security advisories in the first eight months of 2026, compared to 3.2 per year over the past five years, so it’s definitely driven a lot of pressure on the maintainers and the security teams that are working on that,” Thierry Carrez , general manager of the OpenInfra Foundation, told Network World . It’s always DNS: Designate DNS-as-a-Service gets a boost The Designate DNS-as-a-Service project is critical to networking in OpenStack. It has been stable for years with only incremental changes, but the impact of AI has changed that. Carrez noted that significant security issues found by AI reporters were fixed in Designate this cycle. He said he suspects it triggered new interest in the project. In the Hibiscus cycle, Designate gets a critical fix for OSSA-2026-034 , a cross-tenant zone ownership bypass vulnerability. A tenant could create a subzone, superzone, or duplicate of another tenant’s zone by scheduling it to a different pool. That could enable DNS traffic hijacking and denial of service. Ownership conflict checks now search across all pools, and mDNS record and NOTIFY lookups are scoped by pool. Beyond the vulnerability fix, there are a series of important security hardening improvements. DANE support: Designate can now store TLSA records, a type of DNS entry that ties a TLS certificate or public key to a service at a domain name. The records are used for DANE, short for DNS-based Authentication of Named Entities. “The DANE protocol, which lets the domain owners publish which TLS certificates are valid for their services, really reduces the reliance on certificate authority systems alone,” Carrez said. Split-horizon DNS: Split-horizon DNS returns different answers to the same query depending on who asks. Internal clients get one answer and external clients get another. Designate now supports it through a new backend built on BIND9. Neutron advertises tenant networks straight into the data center fabric Neutron is the OpenStack networking project. It provides the virtual networks that tenant VMs connect to. Neutron can build those networks with OVN, short for Open Virtual Network. In Hibiscus it gains a way to connect those virtual networks to the physical data center network. It also cuts the memory used to monitor high availability (HA) routers. BGP EVPN. EVPN is short for Ethernet VPN. A new EVPN service plugin and OVN agent extension advertise tenant network prefixes into the data center fabric. They do this through FRR, an open source routing suite, using BGP EVPN Type-5 routes. A prefix is the range of IP addresses a tenant network uses. Type-5 support is aimed at data center integration. “It lets the tenant network prefixes be advertised directly into the physical fabric, so that really that’s basically how modern data center networks are built,” Carrez explained. “So really helps OpenStack fit into those environments without extra gateway layers that we’ve seen in use before.” Routable tenant addresses: The OVN BGP integration gains a route leaking option. An operator turns it on with the leak_routes attribute of a subnet. The extended OVN features follow the same approach. “OVN BGP features that let the tenant addresses be routable directly from the underlay, and that again is exposing how modern data centers are built directly into OpenStack,” Carrez said. Lower memory use: In deployments that use Open vSwitch, a monitoring daemon tracked keepalived state changes for HA routers. Hibiscus replaces the daemon with a shell script. The change applies to every HA router, so the savings add up across a deployment. “The 15 times reduction in memory footprint for the high availability router monitoring is, I think, really interesting,” Carrez said. Isolation and failover control : Neutron adds a Private VLAN plugin that provides an alternative model for port isolation. It also supports the L3 Agent Scheduler API in deployments that use OVN, including a field that sets the order of gateway failover. Nova adds hardware-backed protection for virtual machines Nova is the OpenStack compute service. It creates and manages the VMs that tenants run. In Hibiscus it adds two hardware-based ways to protect VMs from the hypervisor and other privileged software. Operators request either one with the hw:mem_encryption_model setting in a flavor extra spec or image property. AMD SEV-SNP. SEV-SNP is short for Secure Encrypted Virtualization with Secure Nested Paging. It encrypts VM memory in hardware and protects the integrity of that memory. It also produces signed attestation reports that a VM owner can use to check that the VM has not been altered. Nova already supported the earlier AMD SEV-ES, short for Secure Encrypted Virtualization with Encrypted State. Of attestation, Carrez said, “That really makes sure that the guest owners can make sure that the VMs have not been tampered with. Instead of just having to trust the provider.” Intel TDX. TDX is short for Trust Domain Extensions. It requires 5th Gen Xeon Scalable processors or later. It encrypts VM memory and isolates CPU state. Attestation runs through the Quote Generation Service. “It really removes a major barrier for regulated industries having to move sensitive workloads to shared or private clouds,” Carrez said. vGPU management. A vGPU is a share of a physical GPU assigned to a VM. Nova can now use vGPUs managed by Cyborg, the OpenStack accelerator project, as well as vGPUs it manages itself. Both can run on the same system, and a new trait prevents scheduling collisions between the two. What’s next: AI agents as OpenStack users? Looking forward, the demands of AI are likely to only grow as AI agents are increasingly deployed. Carrez noted that there have been some discussion about how to build and setup OpenStack in a world where only agents exist. How that manifests in future capabilities remains to be seen. Beyond agents, he said the project’s direction depends on what its users need. “That’s where the project is going to go, matching the demand of its users,” Carrez said. OpenInfra Foundation