October 2019 - openstack-discuss - lists.openstack.org

Cinder multi backend quota update
by M Ranga Swami Reddy 04 Nov '19

04 Nov '19

Hello, We use 2 types of volume, like volumes and volumes_ceph. I can update the quota for volumes quota using "cinder quota-update --volumes=20 project-id" But for volumes_ceph, the above CLI failed with volumes_ceph un recognised option.. Any suggestions here?

2 2

[ospurge] looking for project owners / considering adoption
by Adam Harwell 04 Nov '19

04 Nov '19

I haven't seen much activity on this project in a while, and it's been moved to opendev/x since the opendev migration... Who is the current owner of this project? Is there anyone who actually is maintaining it, or would mind if others wanted to adopt the project to move it forward? Thanks, --Adam Harwell

5 10

[ptg][neutron] Onboarding during the PTG
by Slawek Kaplonski 02 Nov '19

02 Nov '19

Hi all new (and existing) Neutrinos, During the PTG in Shanghai we are planning to organize onboarding session. It will take place on Wednesday in morning sessions. It is planned to be started at 9:00 am and finished just before the lunch on 12:30. See on [1] for details. All people who wants to learn about Neutron and contribution to it are welcome on this session. Also all existing team members are welcome to be there to show to new contributors and help them with onboarding process :) See You all in Shanghai! [1] https://etherpad.openstack.org/p/Shanghai-Neutron-Planning -- Slawek Kaplonski Senior software engineer Red Hat

1 1

[neutron][ptg] Team dinner
by Slawek Kaplonski 02 Nov '19

02 Nov '19

Hi neutrinos, Thanks to LIU Yulong who helped me a lot to choose and book some restaurant, we have now booked restaurant: Expo source B2, No.168, Shangnan Road, Pudong New Area, Shanghai, TEL: +86 21 58882117 书院人家(世博源店) 上海市浦东新区上南路168号世博源B2 The Dianping page: http://www.dianping.com/shop/20877292 Dinner is scheduled to Tuesday, 5th Nov at 6pm. Restaurant is close to the Expo center. It's about 15 minutes walk according to the Google maps: https://tinyurl.com/y2rc83ej -- Slawek Kaplonski Senior software engineer Red Hat

2 2

[openstack-dev][kuryr] Error in creating LB
by VeeraReddy 02 Nov '19

02 Nov '19

Hi, I am trying to install openstack & Kubernetes using devstack https://docs.openstack.org/kuryr-kubernetes/latest/installation/devstack/ba… Error Log : http://paste.openstack.org/show/785670/ Local.conf : Paste #785671 | LodgeIt! Regards, Veera.

4 4

[auto-scaling] SIG PTG schedule. please join us :)
by Rico Lin 02 Nov '19

02 Nov '19

Hi all PTG is right next week, so if you're interested in Auto-scaling features, please join us. Our session will be hosted on 11/6 for Half-day from 9:00 am to 12:30 pm in room 431. You can suggest PTG sessions in our etherpad: https://etherpad.openstack.org/p/PVG-auto-scaling-sig Feel free to join our IRC channel as well: #openstack-auto-scaling Also, you can check out our new documents for autoscaling: https://docs.openstack.org/auto-scaling-sig And provide any feedback/ bug report for any Auto-scaling issue related to OpenStack in https://storyboard.openstack.org/#!/project/openstack/auto-scaling-sig Here's my Wechat ID: RicoLinCloudGeek See you all in Shanghai! -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 2

[cinder] changing the weekly meeting time
by Brian Rosmaita 02 Nov '19

02 Nov '19

(Just to be completely clear -- we're only gathering information at this point. The Cinder weekly meeting is still Wednesdays at 16:00 UTC.) As we discussed at today's meeting [0], a request has been made to hold the weekly meeting earlier so that it would be friendlier for people in Asia time zones. Based on the people in attendance today, it seems that a move to 14:00 UTC is not out of the question. Thus, the point of this email is to solicit comments on whether we should change the meeting time to 14:00 UTC. As you consider the impact on yourself, if you are in a TZ that observes Daylight Savings Time, keep in mind that most TZs go back to standard time over the next few weeks. (I was going to insert an opinion here, but I will wait and respond in this thread like everyone else.) cheers, brian [0] http://eavesdrop.openstack.org/meetings/cinder/2019/cinder.2019-10-23-16.00…

3 3

[keystone] Federated users who wish to use CLI
by Jason Anderson 31 Oct '19

31 Oct '19

Hi all, I'm in the process of prototyping a federated Keystone using OpenID Connect, which will place ephemeral users in a group that has roles in existing projects. I was testing how it felt from the user's perspective and am confused how I'm supposed to be able to use the openstacksdk with federation. For one thing, the RC files I can download from the "API Access" section of Horizon don't seem like they work; the domain is hard-coded to "Federated", and it also uses a username/password authentication method. I can see that there is a way to use KSA to use an existing OIDC token, which I think is probably the most "user-friendly" way, but the user still has to obtain this token themselves out-of-band, which is not trivial. Has anybody else set this up for users who liked to use the CLI? Is the solution to educate users about creating application credentials instead? Thank you in advance, -- Jason Anderson Chameleon DevOps Lead Consortium for Advanced Science and Engineering, The University of Chicago Mathematics & Computer Science Division, Argonne National Laboratory

4 8

Permamently delete double / wrong openflow entry from br-tun bridge in OpenvSwitch
by Pawel Konczalski 31 Oct '19

31 Oct '19

Hi, i have a VM with ARP entries in both OpenVswitch bridges br-tun and br-int on the compute node where is it executed: ovs-ofctl dump-flows br-int | egrep "arp.*10.20.0.34" cookie=0x117c25cd8a3f96, duration=47029.368s, table=24, n_packets=20, n_bytes=840, priority=2,arp,in_port="qvod9cdff27-9c",arp_spa=10.20.0.34 actions=resubmit(,25) ovs-ofctl dump-flows br-tun | egrep "arp.*10.20.0.34" cookie=0x1597c76aa2fd74f2, duration=47015.961s, table=21, n_packets=0, n_bytes=0, priority=1,arp,dl_vlan=27,arp_tpa=10.20.0.34 ... 3e:42:af:1d,IN_PORT The unnecassary / faulty entry can by deleted manually from br-tun with: ovs-ofctl --strict del-flows br-tun "priority=1,arp,dl_vlan=27,arp_tpa=10.20.0.34" but after the port is shutdown and up again the entry will by recreated again. When the VM is moved to another compute node, only the br-int entry is created, moving back to the initial host creates both again. Any idea how to remove permamenty this br-tun entry? Thanks Pawel

1 0

[nova] No meeting during summit/PTG week
by Eric Fried 31 Oct '19

31 Oct '19

And that's all I have to say about that. https://wiki.openstack.org/wiki/Meetings/Nova#Agenda_for_next_meeting

1 0

[security] Security SIG Newsletter - Oct 31st 2019
by Gage Hugo 31 Oct '19

31 Oct '19

Hello everyone, Due to a hectic October, this newsletter will have the updates for the month. The SIG meetings for the 07th, 21st, and 28th in November will be cancelled as well due to Summit/PTG & Holidays. Have a Happy Halloween! #Date: 31 Oct 2019 - Security SIG Meeting Info: http://eavesdrop.openstack.org/#Security_SIG_meeting - Weekly on Thursday at 1500 UTC in #openstack-meeting - Agenda: https://etherpad.openstack.org/p/security-agenda - https://security.openstack.org/ - https://wiki.openstack.org/wiki/Security-SIG #Meeting Notes (October) - fungi volunteers to be nova spec liaison for ussuri image encryption spec in nova: http://eavesdrop.openstack.org/meetings/image_encryption/2019/image_encrypt… - The Security SIG won't be meeting on the following dates in November due to the Summit/PTG & Holidays - Nov 07th, Nov 21st, Nov 28th #VMT Reports - A full list of publicly marked security issues can be found here: https://bugs.launchpad.net/ossa/ - OSSA-2019-005 was released this month: https://security.openstack.org/ossa/OSSA-2019-005.html - ceph backend, secret key leak: https://bugs.launchpad.net/cinder/+bug/1849624 - CSV Injection Possible in Compute Usage History: https://bugs.launchpad.net/horizon/+bug/1842749

1 0

[tc][all][goal]: Ussuri community goal candidate 3: 'Consistent and secure default policies'
by Ghanshyam Mann 31 Oct '19

31 Oct '19

Hello Everyone, This is 3rd proposal candidate for the Ussuri cycle community-wide goal. The other two are [1]. Colleen proposed this idea for the Ussuri cycle community goal. Projects implemented/plan to implement this: *Keystone already implemented this with all necessary support in oslo.policy with nice documentation. * We discussed this in nova train PTG to implement it in nova [2]. Nova spec was merged in Train but could not implement. I have re-proposed the spec for the Ussuri cycle [3]. This is nice idea as a goal from the user perspective. Colleen has less bandwidth to drive this goal alone. We are looking for a champion or co-champions (1-2 people will be much better) this goal along with Colleen. Also, let us know what do you think of this as a community goal? Any query or Improvement Feedback? You can refer the detailed on etherpad or I am copying the same here too to get feedback/queries in each item. Existing policy defaults suffer from three major faults: #1: the admin-ness problem: use of policy rules like 'is_admin' or hard-coded is-admin checks results in the admin-anywhere-admin-everywhere problem and drastically inhibits true multitenancy since by default customers cannot have admin rights on their own projects or domains #2: insecure custom roles: many policy rules simply use "" as the rule, which means there is no rule: anyone can perform that action. This means creation of a custom role (say, "nova-autoscaler" requires editing every policy file across every service to block users with such a rule from performing actions unrelated to their role #3: related to #2, no support for read-only roles: keystone now has a "reader" role that comes out of the box when keystone is bootstrapped, but it currently has very little value because of the use of empty rules in service policies: users with the "reader" role can still perform write actions on services if the policy rule for such an action is empty. The keystone project has migrated all of its default policies to 1) use oslo.policy's scope_types attribute, which allows the policy engine to understand "system scope" and distinguish between an admin role assignment on a project versus an admin role assignment on the entire system, 2) ensure all rules use one of the default roles (admin, member, and reader) which both ensures support for a read-only role and prevents custom roles from accidental over-permissiveness. Although the problems being solved are slightly different, the keystone team found it was easiest to migrate everything at once. The rest of the OpenStack services can use this migration as a template for securing their own policies. [1] http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010287.… http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010290.… [2] https://etherpad.openstack.org/p/ptg-train-xproj-nova-keystone [3] https://review.opendev.org/#/q/topic:bp/policy-defaults-refresh+(status:ope… -gmann

3 4

[SIGs][meta-sig] Encourage SIG Chairs to join `Meet the project leaders` opportunities in Shanghai
by Rico Lin 31 Oct '19

31 Oct '19

Dear SIG chairs There will be two `Meet the project leaders` event in Shanghai summit. And SIG chairs are definitely part of it. I'm here to encourage you to sign up [1] and join that event so people might get more chances to meet with you. They're scheduled on Monday marketplace mixer (5:30pm-7:00pm) and Wednesday lunch (12:20pm-1:40pm). [1] https://etherpad.openstack.org/p/meet-the-project-leaders -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 0

[openstack-dev][kuryr] Error in creating LB
by VeeraReddy 31 Oct '19

31 Oct '19

Hi, I am trying to install openstack & Kubernetes usingdevstack https://docs.openstack.org/kuryr-kubernetes/latest/installation/devstack/ba… ErrorLog : http://paste.openstack.org/show/785670/ Local.conf : http://paste.openstack.org/show/785671/ Regards, Veera.

1 0

[scientific-sig] OpenStack maintenance planning
by Sebastian Luna Valero 31 Oct '19

31 Oct '19

Hi All, At our Institute we have secured funding to buy a small infrastructure. We have surveyed the computational requirements of researchers and we came to the conclusion that we need to deploy OpenStack on-prem. No one at our Institute has worked with OpenStack before so there is no local expertise. I have been looking around at the available options. Given the complexity of OpenStack and the tight time-frame that we have to get the infrastructure up and running, we would like to go with one of the OpenStack distributions offered by vendors to minimize the time it takes to go into production. Over the initial period, we would need to learn from the vendor how to operate and troubleshoot OpenStack properly, but in the long run we would like to be autonomous. On the other hand, funding in academia is complex and there is no guarantee that we'll be successful in all future funding calls. So in the scenario where we start off with an OpenStack distribution offered by a vendor, and 3 years down the line we run out of budget, can we continue operating/upgrading our OpenStack deployment without issues? Best regards, Sebastian

1 0

[openstack-dev][kuryr] Error in creating LB
by Veera.reddy B 31 Oct '19

31 Oct '19

Hi, I am trying to install openstack & Kubernetes using devstack https://docs.openstack.org/kuryr-kubernetes/latest/installation/devstack/ba… Error Log : http://paste.openstack.org/show/785670/ Local.conf : http://paste.openstack.org/show/785671/ Thanks, Veera.

1 0

[neutron] Drivers meetings cancelled
by Slawek Kaplonski 31 Oct '19

31 Oct '19

Hi, Due to public holiday on November 1st and PTG on November 8th, lets cancel drivers meetings at those days. Next drivers meeting will take place at November 15th. -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[neutron] CI meeting cencelled November 5th
by Slawek Kaplonski 31 Oct '19

31 Oct '19

Hi, Due to summit next week, lets cancel our CI meeting on November 5th. We will resume this meeting after the PTG on November 12th. -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[neutron] Neutron team meeting cancelled
by Slawek Kaplonski 31 Oct '19

31 Oct '19

Hi, Due to the PTG/Summit next week, and public holiday in Poland on 11th Nov, lets cancel neutron team meetings in next 2 weeks. We will get back to this meeting as usuall on Tuesday, 19th Nov. See You in Shanghai :) -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[ptg][nova][neutron][ironic][cinder][keystone][cyborg] Cross-project sessions
by Eric Fried 30 Oct '19

30 Oct '19

All- Time to coordinate cross-project sessions at the PTG. slaweq approached me about a nova/neutron session so I penciled it in on the nova etherpad [1]. If anyone has conflicts/objections with that time, please speak up and we'll try to coordinate. Other teams (including nova): If cross-project meetings are necessary, please suggest times in the etherpad and/or on this thread and/or by grabbing me (efried) on IRC. (Note that stephenfin (I think) will be running the room, but he's on vacation until the event.) Thanks, efried [1] https://etherpad.openstack.org/p/nova-shanghai-ptg

2 1

[octavia] Octavia weekly IRC meeting cancelled November 6th.
by Michael Johnson 30 Oct '19

30 Oct '19

As many of the cores are travelling to Shanghai and our meeting time would be at midnight, we are cancelling the November 6th Octavia IRC meeting. Safe travels everyone, Michael

1 0

Where do we support running tripleoclient
by Dougal Matthews 30 Oct '19

30 Oct '19

Hi all, Pretty much as the subject says. Do we specify where we support running tripleoclient? In theory it should run anywhere with the correct environment variables. However, as far as I understand most users run it on the undercloud itself. Is this something we have a position on? To give a little more context, this is relevant when replacing Mistral with Ansible. Can we assume that we are running ansible only against localhost or do we need to create an inventory for the undercloud? Cheers, Dougal

2 1

[neutron][ptg] Agenda for PTG
by Slawek Kaplonski 30 Oct '19

30 Oct '19

Hi neutrinos, I prepared agenda for our PTG sessions in Shanghai. It's available at [1]. Please check that and let me know if You need to add/change anything. [1] https://etherpad.openstack.org/p/Shanghai-Neutron-Planning -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[ops][nova] Different quotas for different SLAs ?
by Massimo Sgaravatto 30 Oct '19

30 Oct '19

Dear all I would like to set different overcommitments factors for the compute nodes. In particular I would like to use some compute nodes without overcommitments, and some compute nodes with a cpu_allocation_ratio equals to 2.0. To decide if an instance should go to a compute node with or without overcommitment is easy; e.g. it could be done with host aggregates + setting metadata to the relevant flavors/images. But is it in some way possible to decide that a certain project has a quota of x VCPUs without overcommitment, and y VCPUs with overcommitments ? Or the only option is using 2 different projects for the 2 different SLAs (which is something that I would like to avoid) ? Thanks, Massimo

5 6

[PTG][interviews] We Want To Talk With YOU!
by Rain Leander 30 Oct '19

30 Oct '19

I am attending OIS and PTG and will conduct interviews on Friday 08 November in room Liberty. If you're keen and able, I'd love to talk with you. [0] These interviews have several purposes. Please consider all of the following when thinking about what you might want to say in your interview: * Tell the users/customers/press what you've been working on in Rocky * Give them some idea of what's (what might be?) coming in Stein * Put a human face on the OpenStack project and encourage new participants to join us * You're welcome to promote your company's involvement in OpenStack but we ask that you avoid any kind of product pitches or job recruitment In the interview I'll ask some leading questions and it'll go easier if you've given some thought to them ahead of time: * Who are you? (Your name, your employer, and the project(s) on which you are active.) * What did you accomplish in Rocky? (Focus on the 2-3 things that will be most interesting to cloud operators) * What do you expect to be the focus in Stein? (At the time of your interview, it's likely that the meetings will not yet have decided anything firm. That's ok.) * Anything further about the project(s) you work on or the OpenStack community in general. Finally, note that there are only 33 interview slots available, so please consider coordinating with your project to designate the people that you want to represent the project, so that we don't end up with 12 interview about Neutron, or whatever. It's fine to have multiple people in one interview - Maximum 3, probably. Interview slots are 30 minutes, in which time we hope to capture somewhere between 10 and 20 minutes of content. It's fine to run shorter, but 15 minutes is probably an ideal length. [0] https://docs.google.com/spreadsheets/d/1XwRC_nHm2hZs37Hlrb5fUl4zGtOGgekj1oH… -- K Rain Leander OpenStack Community Liaison Open Source Program Office https://www.rdoproject.org/ http://community.redhat.com

3 2