<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello Bodo.<div class="">Thanks a lot for this work.</div><div class="">Before doing a lot off mistakes…. </div><div class="">Impossible to start my test servers (with CentOS stream , Victoria, and Vpnaas working (I’m sure what it was working)), i’m on holidays….</div><div class=""><br class=""></div><div class="">So I start an VM with CentOS stream (installed with the same ISO file). Libreswan is 4.4.</div><div class="">OK…. i try do downgrade with dnf…. Libreswan is ….. 4.3.3….. so same problem.</div><div class=""><br class=""></div><div class="">I remove Libreswan, download <a href="https://download.libreswan.org/binaries/rhel/8/x86_64/libreswan-3.32-1.el8.x86_64.rpm" class="">https://download.libreswan.org/binaries/rhel/8/x86_64/libreswan-3.32-1.el8.x86_64.rpm</a> and install it.</div><div class="">Now, on my VM: ipsec pluto —help ——> -use-netkey is present…. like you say !! Maybe it’s the simple solution.</div><div class=""><br class=""></div><div class="">So, what do you think if i do that:</div><div class="">my multimode file:</div><div class=""><div class="">[network]</div><div class="">ops01</div><div class="">ops02</div><div class="">ops03</div></div><div class=""><br class=""></div><div class="">So…on my 3 servers:</div><div class="">dnf remove libreswan</div><div class="">wget <a href="https://download.libreswan.org/binaries/rhel/8/x86_64/libreswan-3.32-1.el8.x86_64.rpm" class="">https://download.libreswan.org/binaries/rhel/8/x86_64/libreswan-3.32-1.el8.x86_64.rpm</a></div><div class="">dnf install ./libreswan-3.32-1.el8.x86_64.rpm</div><div class=""><br class=""></div><div class="">Reboot maybe….. </div><div class=""><br class=""></div><div class="">do I risk breaking everything ?</div><div class=""><br class=""></div><div class="">it's really too stupid this story of librewan version and parameters that change</div><div class=""><br class=""></div><div class="">Thanks again</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><span style="color: rgb(31, 73, 125); font-family: Arial, sans-serif; font-size: 10pt; orphans: 2; widows: 2;" class="">Franck VEDEL</span></div></div></div><div class="" style="orphans: 2; widows: 2; margin: 0cm 0cm 0.0001pt;"><br class=""></div><div class="" style="orphans: 2; widows: 2; font-family: Calibri, sans-serif; font-size: 11pt; margin: 0cm 0cm 0.0001pt;"></div></div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">Le 27 juil. 2021 à 11:12, Bodo Petermann <<a href="mailto:b.petermann@syseleven.de" class="">b.petermann@syseleven.de</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello Franck,<div class=""><br class=""></div><div class="">I tried the ipsec pluto command the vpnaas plugin will use to start pluto on a CentOS 8 with libreswan 4.4 and the command fails:</div><div class=""><br class=""></div><div class=""><div class="">ipsec pluto --use-netkey --uniqueids</div><div class="">/usr/libexec/ipsec/pluto: unrecognized option '--use-netkey'</div><div class="">For usage information: /usr/libexec/ipsec/pluto --help</div><div class="">Libreswan 4.4</div></div><div class=""><br class=""></div><div class="">That means that the vpnaas plugin is not up-to-date I'm afraid. Since libreswan 4.0 the option "--use-netkey" is called "--use-xfrm".</div><div class=""><br class=""></div><div class="">The failing pluto command explains the error you copied: "Pluto is not running", but there should also be error messages about the failing ipsec pluto command. I don't know how it could have worked with Victoria and Stream though. Maybe there was an older libreswan? v3.32 might still work as it accepts the "--use-netkey" option.</div><div class=""><br class=""></div><div class="">Unfortunately the ipsec pluto command issued by the plugin can only be fixed in the plugin itself, not by configuration.</div><div class="">The only workaround I see for now is to try installing libreswan 3.32. Or switch to strongswan if that is available for CentOS.</div><div class=""><br class=""></div><div class="">Regards</div><div class="">Bodo</div><div class=""><br class=""></div><div class=""><div class=""><blockquote type="cite" class=""><div class="">Am 26.07.2021 um 20:54 schrieb Franck VEDEL <<a href="mailto:franck.vedel@univ-grenoble-alpes.fr" class="">franck.vedel@univ-grenoble-alpes.fr</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello Bodo, hello Radoslaw, thanks a lot for your help.<div class="">My situation is:</div><div class="">In June: 3 test servers. CentOS Stream (8.4). </div><div class="">Victoria + Vpnaas: OK</div><div class="">Wallaby + Vpnaas: NOT OK</div><div class=""><br class=""></div><div class="">In July: 3 new (different) servers: Rocky OS (8.4) (I changed /etc/system.release to install Openstack)</div><div class="">Wallaby + Vpnaas: NOT OK (1), all is working except VPNaaS</div><div class="">Victoria + Vpnaas: NOT OK (2), all is working except VPNaaS (thanks Radoslaw for horizon !!)</div><div class=""><br class=""></div><div class="">Error messages for </div><div class="">1): <font color="#e32400" class="">Neutron-l3-agent logs says: Command: ['ipsec', 'whack', '--status'] Exit code: 33 Stdout: Stderr: whack: Pluto is not running (no "/run/pluto/pluto.ctl »)</font></div><div class=""><br class=""></div><div class="">2): More complete</div><div class=""><div class=""><font color="#e32400" class="">2021-07-26 20:24:23.352 34 ERROR neutron.agent.linux.utils [-] Exit code: 33; Cmd: ['sudo', 'neutron-rootwrap', '/etc/neutron/rootwrap.conf', 'ip', 'netns', 'exec', 'qrouter-a63770d5-edad-425d-8330-7d12c2cbf3e4', '/var/lib/kolla/venv/bin/neutron-vpn-netns-wrapper', '--mount_paths=/etc:/var/lib/neutron/ipsec/</font><font color="#371a94" class="">a63770d5-edad-425d-8330-7d12c2cbf3e4</font><font color="#e32400" class="">/etc,/var/run:/var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/var/run', '--rootwrap_config=/etc/neutron/rootwrap.conf', '--cmd=ipsec,whack,--status']; Stdin: ; Stdout: 2021-07-26 20:24:23.163 39401 INFO neutron.common.config [-] Logging enabled!</font></div><div class=""><font color="#e32400" class="">2021-07-26 20:24:23.164 39401 INFO neutron.common.config [-] /var/lib/kolla/venv/bin/neutron-vpn-netns-wrapper version 17.1.3.dev54</font></div><div class=""><font color="#e32400" class="">Command: ['mount', '--bind', '/var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/etc', '/etc'] Exit code: 0 Stdout: Stderr: 2021-07-26 20:24:23.186 39401 INFO neutron_vpnaas.services.vpn.common.netns_wrapper [-] /var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/etc has been bind-mounted in /etc</font></div><div class=""><font color="#e32400" class="">Command: ['mount', '--bind', '/var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/var/run', '/var/run'] Exit code: 0 Stdout: Stderr: 2021-07-26 20:24:23.195 39401 INFO neutron_vpnaas.services.vpn.common.netns_wrapper [-] /var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/var/run has been bind-mounted in /var/run</font></div><div class=""><font color="#e32400" class="">Command: ['ipsec', 'whack', '--status'] Exit code: 33 Stdout: Stderr: whack: Pluto is not running (no "/run/pluto/pluto.ctl")</font></div><div class=""><br class=""></div></div><div class="">So… I tried what you say:</div><div class="">« docker exec -it /bin/bash »</div><div class="">« ps aux |grep pluto » ———> no pluto running</div><div class=""><br class=""></div><div class=""><div class=""><font color="#669c35" class="">You could also check if the configuration has been created properly:</font></div><div class=""><font color="#669c35" class="">/var/lib/neutron/ipsec/{router-id}/etc with ipsec.conf and ipsec.secrets</font></div></div><div class=""><br class=""></div><div class="">Yes, configuration is created (i think…..)</div><div class=""><div class=""><font color="#b92d5d" class="">[neutron@iut1r-srv-ops01-i01 /var/lib/neutron/ipsec/a63770d5-edad-425d-8330-7d12c2cbf3e4/etc]$ ls -l</font></div><div class=""><font color="#b92d5d" class="">total 8</font></div><div class=""><font color="#b92d5d" class="">-rw-r--r--. 1 neutron neutron 0 Jul 26 09:49 hosts</font></div><div class=""><font color="#b92d5d" class="">-rw-r--r--. 1 neutron neutron 1948 Jul 26 09:49 ipsec.conf</font></div><div class=""><font color="#b92d5d" class="">drwxr-xr-x. 11 neutron neutron 135 Jul 26 09:49 ipsec.d</font></div><div class=""><font color="#b92d5d" class="">-rw-------. 1 root root 107 Jul 26 09:49 ipsec.secrets</font></div><div class=""><font color="#b92d5d" class="">drwxr-xr-x. 3 neutron neutron 19 Jul 26 09:49 pki</font></div><div class=""><font color="#b92d5d" class="">-rw-r--r--. 1 neutron neutron 0 Jul 26 09:49 resolv.conf</font></div></div><div class=""><br class=""></div><div class="">for exemple, the file /var/lib/neutron/ipsec/<span style="caret-color: rgb(55, 26, 148); color: rgb(55, 26, 148);" class="">a63770d5-edad-425d-8330-7d12c2cbf3e4</span><span style="caret-color: rgb(55, 26, 148);" class="">/etc/ipsec.conf</span><span style="caret-color: rgb(55, 26, 148); color: rgb(55, 26, 148);" class=""> is</span></div><div class=""><span style="caret-color: rgb(55, 26, 148); color: rgb(55, 26, 148);" class=""><br class=""></span></div><div class=""><span style="caret-color: rgb(55, 26, 148);" class=""><font color="#b51a00" class=""><div class=""># Configuration for 2a1446f5-4618-4927-883a-7a8b702e13c1</div><div class="">config setup</div><div class=""> nat_traversal=yes</div><div class=""> virtual_private=%v4:10.0.1.0/24,%v4:10.0.2.0/24</div><div class="">conn %default</div><div class=""> keylife=60m</div><div class=""> keyingtries=%forever</div><div class="">conn 6b588921-a120-402a-bed2-38c55879a432</div><div class=""> # NOTE: a default route is required for %defaultroute to work...</div><div class=""> leftnexthop=%defaultroute</div><div class=""> rightnexthop=%defaultroute</div><div class=""> left=172.16.203.154</div><div class=""> leftid=172.16.203.154</div><div class=""> auto=start</div><div class=""> # NOTE:REQUIRED</div><div class=""> # [subnet]</div><div class=""> leftsubnet=10.0.1.0/24</div><div class=""> # [updown]</div><div class=""> # What "updown" script to run to adjust routing and/or firewalling when</div><div class=""> # the status of the connection changes (default "ipsec _updown").</div><div class=""> # "--route yes" allows to specify such routing options as mtu and metric.</div><div class=""> leftupdown="ipsec _updown --route yes"</div><div class=""> ######################</div><div class=""> # ipsec_site_connections</div><div class=""> ######################</div><div class=""> # [peer_address]</div><div class=""> right=172.16.201.79</div><div class=""> # [peer_id]</div><div class=""> rightid=172.16.201.79</div><div class=""> # [peer_cidrs]</div><div class=""> rightsubnets={ 10.0.2.0/24 }</div><div class=""> # rightsubnet=networkA/netmaskA, networkB/netmaskB (IKEv2 only)</div><div class=""> # [mtu]</div><div class=""> mtu=1500</div><div class=""> # [dpd_action]</div><div class=""> dpdaction=hold</div><div class=""> # [dpd_interval]</div><div class=""> dpddelay=30</div><div class=""> # [dpd_timeout]</div><div class=""> dpdtimeout=120</div><div class=""> # [auth_mode]</div><div class=""> authby=secret</div><div class=""> ######################</div><div class=""> # IKEPolicy params</div><div class=""> ######################</div><div class=""> #ike version</div><div class=""> ikev2=never</div><div class=""> # [encryption_algorithm]-[auth_algorithm]-[pfs]</div><div class=""> ike=aes128-sha1;modp1536</div><div class=""> # [lifetime_value]</div><div class=""> ikelifetime=3600s</div><div class=""> # NOTE: it looks lifetime_units=kilobytes can't be enforced (could be seconds, hours, days...)</div><div class=""> ##########################</div><div class=""> # IPsecPolicys params</div><div class=""> ##########################</div><div class=""> # [transform_protocol]</div><div class=""> phase2=esp</div><div class=""> # [encryption_algorithm]-[auth_algorithm]-[pfs]</div><div class=""> phase2alg=aes128-sha1;modp1536</div><div class=""> # [encapsulation_mode]</div><div class=""> type=tunnel</div><div class=""> # [lifetime_value]</div><div class=""> lifetime=3600s</div><div class=""> # lifebytes=100000 if lifetime_units=kilobytes (IKEv2 only)</div></font></span></div><div class="">...</div><div class="">I don’t know if you could see something wrong…</div><div class="">but it is really very nice to help me with this problem.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><span style="color: rgb(31, 73, 125); font-family: Arial, sans-serif; font-size: 10pt; orphans: 2; widows: 2;" class="">Franck</span></div></div></div><div class="" style="orphans: 2; widows: 2; font-family: Calibri, sans-serif; font-size: 11pt; margin: 0cm 0cm 0.0001pt;"></div></div>
</div>
<div class=""><br class=""><blockquote type="cite" class=""><div class=""><br class=""></div><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""><br class=""></div><div class="">There are no relevant differences in the VPNaaS plugin between Victoria and Wallaby.</div><div class="">Maybe there actually is a difference between Rocky and Stream: the pid directory expected by pluto. At least your error message (no "/run/pluto/pluto.ctl") suggests that.</div><div class="">The libreswan driver in the VPNaaS plugin works under the assumption that the run-files reside in /var/run.</div><div class="">ipsec commands are run via a wrapper to call the actual command inside a namespace, with /etc/ and /var/run/ bind-mounted.</div><div class=""><br class=""></div><div class="">The real paths are /var/lib/neutron/ipsec/{router-id}/... and in there .../etc and ..,/var/run.</div><div class="">In a working setup you should find /var/lib/neutron/ipsec/{router-id}/var/run/pluto/pluto.ctl</div><div class=""><br class=""></div><div class="">So it may be a problem if pluto wants to use /run (not bind-mounted), but the plugin only provides for /var/run (bind-mounted).</div><div class=""><br class=""></div><div class="">Bodo Petermann</div><div class=""><span style="font-size: 11px;" class="">SysEleven GmbH</span></div><div class=""><div class=""><div style="letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="text-align: start; text-indent: 0px;" class=""><br class=""></div></div></div></div></div></div></div><div class=""><blockquote type="cite" class=""><div class="">Am 26.07.2021 um 15:12 schrieb Radosław Piliszek <<a href="mailto:radoslaw.piliszek@gmail.com" class="">radoslaw.piliszek@gmail.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">On Mon, Jul 26, 2021 at 10:39 AM Franck VEDEL</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class=""><</span><a href="mailto:franck.vedel@univ-grenoble-alpes.fr" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">franck.vedel@univ-grenoble-alpes.fr</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">> wrote:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="">Hello.<br class="">unfortunately, despite the good functioning of Victoria, the VPNAAS service is not working.<br class="">Same error as for wallaby:<br class=""><br class="">Command: ['ipsec', 'whack', '--status'] Exit code: 33 Stdout: Stderr: whack: Pluto is not running (no "/run/pluto/pluto.ctl")<br class="">; Stderr:<br class=""><br class="">I think it's my fault. I didn't want to install CentOS Stream (not knowing what happened with this distribution), I put Rocky. This is a big mistake.<br class="">I will start all over again, put CentOS Stream (VPNaas worked with Victoria and CentOS Stream in my tests).<br class="">Thanks again.<br class="">I'm still disgusted with all this wasted time.<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Hello Franck,</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Before you go wrecking your infra - I am pretty sure that Rocky vs</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Stream does not make a difference here.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">I thought Victoria worked because you said so but it seems it has</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">always broken in Kolla Ansible and we have a bug to fix:</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://bugs.launchpad.net/kolla-ansible/+bug/1869491" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://bugs.launchpad.net/kolla-ansible/+bug/1869491</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">VPNaaS is not the most popular enabled option to be honest.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Do you remember how you got it working back then?</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">That could help here.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">-yoctozepto</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br class="">Franck<br class=""><br class="">Le 25 juil. 2021 à 21:25, Radosław Piliszek <<a href="mailto:radoslaw.piliszek@gmail.com" class="">radoslaw.piliszek@gmail.com</a>> a écrit :<br class=""><br class="">On Sun, Jul 25, 2021 at 9:18 PM Franck VEDEL<br class=""><<a href="mailto:franck.vedel@univ-grenoble-alpes.fr" class="">franck.vedel@univ-grenoble-alpes.fr</a>> wrote:<br class=""><br class=""><br class="">Oh !! Thanks a lot, really.<br class=""><br class="">Indeed, I installed kolla-ansible 12.0, install wallaby (it works perfectly… expect Vpnaas), then I changed "wallaby" to « victoria » in globals.yml.<br class=""><br class="">And in Wallaby's notes, there is the sentence:<br class="">The Karbor project is no longer maintained and retired since the Wallaby cycle. Its support and roles are also removed since Wallaby cycle.<br class="">So, it's not normal that it doesn't work. I understand…. There is a lot of things, it’s not easy to do the right thing the first time.<br class=""><br class="">On the other hand ... and I hope not to abuse, I am not sure I understand "clone <a href="https://opendev.org/openstack/kolla-ansible" class="">https://opendev.org/openstack/kolla-ansible</a>".<br class="">Do you have to uninstall kolla-ansible 12 before putting 11?<br class="">How do you do "pip install that directory then"? Really sorry for these stupid questions, but I'm afraid to mess things up.<br class=""><br class=""><br class="">Sure thing.<br class="">I meant to use Git.<br class="">Try these commands:<br class=""><br class="">git clone --branch stable/victoria \<br class=""> <a href="https://opendev.org/openstack/kolla-ansible" class="">https://opendev.org/openstack/kolla-ansible</a><br class="">pip install ./kolla-ansible<br class=""><br class="">-yoctozepto<br class=""><br class="">Franck<br class=""><br class=""><br class="">Le 25 juil. 2021 à 18:00, Radosław Piliszek <<a href="mailto:radoslaw.piliszek@gmail.com" class="">radoslaw.piliszek@gmail.com</a>> a écrit :<br class=""><br class="">On Sun, Jul 25, 2021 at 2:52 PM Franck VEDEL<br class=""><<a href="mailto:franck.vedel@univ-grenoble-alpes.fr" class="">franck.vedel@univ-grenoble-alpes.fr</a>> wrote:<br class=""><br class=""><br class="">Hello<br class=""><br class=""><br class="">Hello Franck,<br class=""><br class="">Having had no help with my Vpnaas (centos wallaby) problem, I came back to Victoria because I know from having tested that Vpnaas works as it should under Victoria.<br class="">A few weeks ago, I had the opportunity to use 3 test servers, I had set up Victoria (with Centos and kolla-ansible). No problem, everything was working as I wanted it to.<br class="">I have since set up 3 new servers to set up an Openstack for my students.<br class="">if i install Wallaby, no Vpnaas, and I need VPNaaS…. So Victoria.<br class=""><br class="">if I install Victoria, and this is the 1st time that this happens to me, horizon does not work. The horizon docker does not start.<br class="">The "docker logs horizon" command ends with the following 3 lines:<br class="">++ config_karbor_dashboard<br class="">++ for file in $ {SITE_PACKAGES} / karbor_dashboard / enabled / _ * [^ __]. py<br class="">/ usr / local / bin / kolla_extend_start: line 121: ENABLE_KARBOR: unbound variable<br class=""><br class=""><br class="">This error suggests you are using Kolla Ansible Wallaby or later to<br class="">deploy Victoria.<br class="">You probably just set "openstack_release" to "Victoria" without<br class="">downgrading Kolla Ansible to a supported version.<br class="">There is a reason why "openstack_release" is commented with "Do not<br class="">override this unless you know what you are doing.". ;-)<br class="">It is only really meant to be used for very specific tasks, not really<br class="">meant for regular users.<br class="">Please have a look at<br class=""><a href="https://docs.openstack.org/releasenotes/kolla-ansible/victoria.html" class="">https://docs.openstack.org/releasenotes/kolla-ansible/victoria.html</a><br class="">The latest release for Victoria is 11.0.0 but there are lots of<br class="">unreleased fixes so I advise you to just clone<br class=""><a href="https://opendev.org/openstack/kolla-ansible" class="">https://opendev.org/openstack/kolla-ansible</a><br class="">checkout stable/victoria<br class="">and pip install that directory then.<br class="">It will fix your current issue.<br class=""><br class="">-yoctozepto</blockquote></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></div></body></html>