Last week we covered VMware vCenter getting actively exploited — 361 systems compromised across 47 countries within five days of the patch release, because the proprietary patch cycle doesn't reach the people who need it most. The open-source alternative is not theoretical. It is 33 releases deep, it shipped four months ago, and 40% of the people who built it are European.

OpenStack 2026.1 (Gazpacho) is the latest release of the world's most widely deployed open source cloud infrastructure software. It is not a procurement vehicle. It is not a hyperscaler with a national flag painted on the data center. It is a community-built platform with a public codebase, a public issue tracker, and a patch cycle that does not require a vendor account manager's permission.

What Shipped

Gazpacho is a SLURP release — Skip Level Upgrade Release Process. That means operators on the previous SLURP release (2025.1 Epoxy, April 2025) can upgrade directly to Gazpacho without passing through the intermediate Flamingo (2025.2) release. For operators, that means one mandatory upgrade per year instead of two, while still receiving security patches on the branch. The next release, 2026.2 (Hibiscus), is expected September 2026.

The release was built by approximately 500 contributors from 100 organizations over a six-month cycle, delivering 9,000 code changes. The OpenDev Zuul CI system ran over a million jobs to build, test, and publish the software. That is what a mature open-source infrastructure community looks like — not a vendor roadmap, not a press release, but a CI pipeline that runs a million times in six months and produces something you can deploy.

Notably, 40% of contributions came from European contributors. The OpenInfra Foundation's own framing connects this to digital sovereignty initiatives driving adoption across the region. This is the sovereignty angle that matters: not contractual data residency, but communities of engineers building the infrastructure their institutions depend on.

The Features That Matter for Operators

Parallel live migrations in Nova

Previous releases processed live migrations one VM at a time per hypervisor. Maintenance windows scaled linearly with the number of workloads on a host. Gazpacho allows multiple VMs to migrate simultaneously by allowing multiple memory transfer connections.

For a host running 40 VMs, this is the difference between a 45-minute maintenance window and a 15-minute one. For a community infrastructure operator running Proxmox or OpenStack on a handful of nodes with limited after-hours access, that is the difference between patching this weekend and putting it off for another month.

vTPM live migration

VMs using virtual Trusted Platform Modules can now be live-migrated between hosts. Previously, vTPM workloads were pinned to their original host during migration events — creating an operational headache for security-sensitive deployments that require hardware-backed key storage and measured boot.

This matters because vTPM is increasingly the baseline for workloads that need attestation — confidential computing, regulated data, anything where you need to prove the boot state. If your cloud platform can't migrate those workloads, you're choosing between security and maintainability. Gazpacho removes the choice.

OVN BGP in Neutron

Neutron's OVN driver now integrates BGP capabilities directly, enabling dynamic route advertisement without external routing daemons. Combined with OVN BFD (Bidirectional Forwarding Detection) configuration, operators can tune HA failover timing to sub-second intervals. When a network path fails, traffic reroutes faster.

For a community network operating its own cloud infrastructure — the kind of deployment where a single uplink failure can take a town's services offline — native BGP in the networking layer means you don't need a separate routing daemon stack to get resilient connectivity. It is in the platform.

Async volume attach and per-VM IOThreads

Nova's async volume attach (microversion 2.101) decouples volume attachment from the synchronous API call path. Large-scale orchestration — deploying 50 instances with attached volumes — no longer blocks waiting for each attachment sequentially.

Nova also defaults to one IOThread per VM, isolating disk I/O processing onto a dedicated thread instead of sharing it with the VM's main emulation thread. Lower disk latency, more predictable storage performance, especially for database workloads and write-heavy applications.

Ironic: autodetect and standalone networking

Ironic — OpenStack's bare metal provisioning service — got the most operational attention. The autodetect deploy interface removes the need to choose deployment methods manually. Automatic protocol detection (NFS/CIFS for Redfish) simplifies boot configuration. Trait-based port scheduling automates network placement based on real infrastructure attributes. A noop deploy interface lets operators onboard and track existing workloads without redeploying.

For operators running bare metal alongside virtualized workloads — which is most community infrastructure, because you don't always have a hypervisor handy — Ironic becoming less manual is a real quality-of-life improvement.

The Eventlet Migration

The most significant cross-project effort in Gazpacho is the continued migration from eventlet to native Python threading. Eventlet is a cooperative concurrency library OpenStack adopted early. It works, but it introduces subtle bugs, makes debugging difficult, and conflicts with modern Python libraries that expect native threads.

The migration has been underway for several releases. Gazpacho makes substantial progress, particularly in Nova, where native threading improves both performance and long-term maintainability. This is the kind of work that doesn't make press releases but determines whether the platform is still deployable in five years. Technical debt that compounds until the project either pays it down or becomes unmaintainable. OpenStack is paying it down.

Nova also achieved full OpenAPI schema coverage — every API endpoint now has a machine-readable specification. Infrastructure-as-code tools, custom integrations, and API clients can validate requests before sending them. Less "deploy and hope" debugging.

Breaking Changes

Two things operators need to know before upgrading:

  • WSGI script removal. Several services removed legacy WSGI entry-point scripts. Operators using Apache or nginx as a reverse proxy with these scripts need to update service configurations to use newer uwsgi or direct-serve patterns. For Kolla-Ansible deployments, this is handled in the tooling.
  • Windows host support removed from Cinder. Cinder storage services can no longer run on Windows hosts. This does not affect Windows guest VMs — those continue to work. It means the Cinder service itself won't run on a Windows server, which was already uncommon in production.

What "Sovereign Cloud" Actually Means

The same week OpenStack shipped Gazpacho, SAP announced "sovereign AI on Delos Cloud" — which is Azure underneath, with German governance layered on top. The Register's headline from May 2026: "Europe built sovereign clouds to escape US control. Then forgot about the processors." Gaia-X launched in 2019 as Europe's answer to cloud dominance. In 2026, over 180 data spaces are in development. A handful are operational.

This is the pattern. "Sovereign cloud" as a procurement category means: you sign a contract with a domestic corporation to host workloads inside national borders, on hardware owned by someone else, managed by someone else, with a software stack controlled by someone else. The sovereignty is contractual. It exists as long as the contract exists, and it extends exactly as far as the vendor's terms of service allow.

OpenStack is a different category. The codebase is Apache 2.0 licensed. The governance is the OpenInfra Foundation — a nonprofit, part of the Linux Foundation. The contributors are 500 people from 100 organizations who work in public. The patches are published in the public repository. There is no subscription gate, no license check, no vendor deciding whether you're allowed to remediate.

When the OpenInfra Foundation says 40% of Gazpacho contributions came from European contributors, that is sovereignty in the structural sense — not a data residency clause, but engineers in the jurisdiction building the infrastructure their institutions will run on. That is the model we advocate for communities: the people who depend on the infrastructure are the people who can read, modify, and patch it.

The VMware Exit Is Real

The OpenStack community's own framing for Gazpacho leads with workload migration and the VMware alternative. Thierry Carrez, general manager of the OpenInfra Foundation, said it directly: the release advances "capabilities needed to support modern workloads" as organizations "look at freeing themselves from dependency to proprietary platforms."

This is not marketing. Broadcom's VMware acquisition has been a forced migration event since November 2023: killed the free tier, raised prices, cut the partner ecosystem, and now — as we covered last week — a CVSS 9.8 vCenter vulnerability with no workaround, exploited in the wild within five days of the patch release. Organizations that can't patch because their subscription lapsed are running a known-exploitable RCE.

OpenStack Gazpacho is the platform that absorbs that migration. The SLURP upgrade path means you don't chase six-month releases. Parallel live migration means you can evacuate hosts for patching in minutes, not hours. vTPM migration means you don't lose security posture when you move workloads. OVN BGP means your network fails over fast. The code is public. The patches are public. No one can decide you're not allowed to fix it.

For Community Operators

Most readers of this site are not running OpenStack at hyperscaler scale. You're running Proxmox on a few nodes in a fire hall, a community center, a town office. That's the right tool for that scale, and we recommend it.

But the pattern is the same, and the principle is the same. Open-source infrastructure — whether it's Proxmox for a single-node deployment or OpenStack for a regional cloud — is infrastructure you can audit, patch, and operate without a vendor's permission. The Gazpacho release is a reminder that the community building this software is large, active, and shipping real improvements on a predictable cadence. It is not a hobby project. It is 33 releases into being the most widely deployed open source cloud infrastructure software in the world.

If your community is outgrowing Proxmox — if you need multi-tenant isolation, self-service provisioning for multiple organizations, or a platform that scales to a regional cloud — OpenStack is the next step, and Gazpacho is a good release to land on. The SLURP upgrade path means you can adopt on a yearly cadence. The operator-focused improvements mean less time on maintenance and more time on the work that actually matters.

The sovereignty is in the code, not the contract.