April 2019 - openstack-discuss - lists.openstack.org

[all][tc] Repository renames during OpenDev migration
by Jim Rollenhagen 12 Apr '19

12 Apr '19

Hi all, During the migration to OpenDev, we plan to change the way we organize some of our repositories. Before you ask, yes, there will be redirects. The TC has made some decisions about this[0]; this email is a re-iteration of the plan and a call for any last minute feedback. Here's how a repository's new namespace will be decided, as it stands today: - is the repo listed in projects.yaml[2]? If so, "openstack". - is the repo listed in legacy.yaml[3]? If so, "openstack". - is the repo listed in foundation-board-repos.yaml[4]? If so, "openstack". - is the repo listed in sigs-repos.yaml[5]? If so, "openstack". - is the repo listed in technical-committee-repos.yaml[6]? If so, "openstack". - is the repo listed in user-committee-repos.yaml[7]? If so, "openstack". - has the repo owner requested a new name(space) in the transition ethercalc sheet[1]? If so, use that. - anything else? A few of us from the TC will manually review the list to make sure we didn't miss anything that is an official OpenStack repo. Anything left will be moved to another namespace[8] unless/until the owner requests it to be moved elsewhere. [0] https://governance.openstack.org/tc/resolutions/20190322-namespace-unoffici… [1] https://ethercalc.openstack.org/opendev-transition [2] https://opendev.org/openstack/governance/src/branch/master/reference/projec… [3] https://opendev.org/openstack/governance/src/branch/master/reference/legacy… [4] https://opendev.org/openstack/governance/src/branch/master/reference/founda… [5] https://opendev.org/openstack/governance/src/branch/master/reference/sigs-r… [6] https://opendev.org/openstack/governance/src/branch/master/reference/techni… [7] https://opendev.org/openstack/governance/src/branch/master/reference/user-c… [8] I'm not even going to name it here, lest this thread devolves into a discussion about this name and nothing else. // jim

5 8

[Watcher] Proposing chenker and Dantalion for core
by li.canwei2＠zte.com.cn 12 Apr '19

12 Apr '19

Hi, Now Watcher need more active core reviewers, I'd like to propose adding chenker and Dantalion to core team. They all did a great contribution during the last six months [1]. [1]: https://www.stackalytics.com/report/contribution/watcher-group/90 Thanks! Canwei Li

3 2

[tc][telemetry] Asking core privileges on Telemetry projects
by Trinh Nguyen 12 Apr '19

12 Apr '19

Dear TC, As I am the new PTL for Telemetry in Train [1] and the current cores seem inactive, I would like to ask the TC team to grant myself < dangtrinhnt(a)gmail.com> and Lingxian Kong <anlin.kong(a)gmail.com> to the core team of these Telemetry managed projects: + ceilometer + aodh + panko Next step for me is to re-organize core members and meetings. Many thanks, [1] https://review.openstack.org/#/c/645122/ -- *Trinh Nguyen* *www.edlab.xyz <https://www.edlab.xyz>*

5 9

Unshelve in nova, cinder initialize_connection with user context
by Jordan Ansell 12 Apr '19

12 Apr '19

Hello, I have encountered what appears to be an edge-case instance shelving situation. I have to allow access to an internal API call to enable an "unprivileged" user to perform an instance operation. Specifically, I have a user with a "restricted permission" role in a project, who should only be able to start/stop/shelve/unshelve an existing instance. With sensible roles/actions in the nova policy, they are able to perform all actions, except /un/shelving. This should be controlled by a nova policy, however the user is unable to unshelve without permission to access the /cinder/ API call "initialize_connection() <https://developer.openstack.org/api-ref/block-storage/v3/?expanded=initiali…>". Without granting permission to the user, cinder rejects nova's request with an HTTP 403 status message. Outcomes of this situation are, curious and potentially unwanted. Curious being the user is able to /shelve/. Which leads to a point of no return for the user. But of particular concern is this API call exposes the backend storage driver's connection info to users. The RBD driver, as we use, does not even require a populated "connector" object before it replies. I was looking for advice/opinions on this issue, and hope someone here can help or direct me to the right place. My thoughts were that perhaps this is a bug or there's a configuration issue with our nova/cinder (note, i'm using mitaka, so maybe it's fixed upstream!). I am unable to check whether this is just a bug in nova, due to my lack of experience. But my rationale is nova is using the /user//'s/ context instead of an internal nova /admin/-like context to call the cinder API. As for configuration, I've been unable to pull up anything that seems relevant to this issue looking through /etc/{nova,cinder}/{nova,cinder}.conf, but maybe there's an option we've enabled that's led to this behavior. I'm happy to answer questions if anything is unclear. Sorry for verbosity, vagueness or inaccuracies -- I'm very new to Openstack, having started at zero a month ago and am using this task as a way to learn more. Any help is much appreciated :) Jordan

4 5

[placement][ptg] We like the perfload job, maybe we should rally?
by Chris Dent 12 Apr '19

12 Apr '19

>From the etherpad [1] * Or at least measure more things? Perfload has proven a useful (non-voting) test job for discovering when things are not behaving well under high writes and for having a rough understanding the performance of GET /allocation_candidates In a world of copious time we'd have more of this kind of measurement. Should we investigate Rally? It used to be the tool of choice for this kind of thing once upon a time. Is it still that time? Or should we continue using more focused and smaller setups, like perfload? If so, what should they be? Or is this something to worry about some other time? [1] https://etherpad.openstack.org/p/placement-ptg-train -- Chris Dent ٩◔̯◔۶ https://anticdent.org/ freenode: cdent tw: @anticdent

5 5

[placement][ptg] Placement Over The Parapet
by Chris Dent 12 Apr '19

12 Apr '19

>From the etherpad [1]: * What's going on in the rest of the world: * where placement can help * that can help placement It's a whole big world out there, people doing all sorts of things that maybe look a bit like what placement does. What can we learn from them? What can they learn from us? In what ways can we expand placement world dominance and improve its ecosystem diversity? We are often so busy in the depths of OpenStack that it is hard to remain aware of what is out there. What is? For example, would there be any purpose in experimenting with plugging placement into the pluggable scheduling concept in k8s? Is that totally crazy or intriguing? I don't know because it's hard to make the time, but it would be valuable to know. [1] https://etherpad.openstack.org/p/placement-ptg-train -- Chris Dent ٩◔̯◔۶ https://anticdent.org/ freenode: cdent tw: @anticdent

5 5

[all] New Zuul job to replicate a project's git repository to a remote git server
by David Moreau Simard 12 Apr '19

12 Apr '19

Hi, It is now possible for projects to replicate their git repository to a custom location by inheriting from the 'upload-git-mirror' job provided by Zuul. This job wraps around the 'upload-git-mirror' Ansible role that is part of the zuul-jobs library [1]. In order to use this job, you must supply a secret in the following format: === - secret: name: <name of your secret> data: user: <ssh user of the remote git server> host: <address of the remote git server> host_key: <ssh host key of the remote git server> ssh_key: <private key to authenticate with the remote git server> === The 'host_key' parameter can be retrieved from your known_hosts file or with a command like 'ssh-keyscan -H <host>' or 'ssh-keyscan -t rsa <host>'. For example, the 'host_key' when pushing to GitHub would be, on a single line: github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== The 'ssh_key' parameter should be encrypted before being committed to the git repository. Zuul provides a tool for easily encrypting files such as SSH private keys and you can find more information about it in the documentation [2]. For example, encrypting a key for the "openstack/ara" project would look like this: === zuul/tools/encrypt_secret.py --infile /home/dmsimard/.ssh/ara_git_key --tenant openstack https://zuul.openstack.org openstack/ara === You would then use the secret in a job inheriting from 'upload-git-mirror' as such: === - job: name: <project>-upload-git-mirror parent: upload-git-mirror description: Mirrors openstack/<project> to neworg/<project> vars: git_mirror_repository: neworg/<project> secrets: - name: git_mirror_credentials secret: <name of your secret> pass-to-parent: true === Finally, the job must be set to run in your project's 'post' pipeline which is triggered every time a new commit is merged to the repository: === - project: check: jobs: # [...] gate: jobs: # [...] post: jobs: - <project>-upload-git-mirror === Note that the replication would only begin *after* the change has merged, meaning that merging the addition of the post job would not trigger the post job itself immediately. The post job will only trigger the next time that a commit is merged. [1]: https://zuul-ci.org/docs/zuul-jobs/general-roles.html#role-upload-git-mirror [2]: https://zuul-ci.org/docs/zuul/user/encryption.html David Moreau Simard dmsimard = [irc, github, twitter]

1 0

[octavia] Proposal to change the Octavia IRC meeting time.
by Michael Johnson 11 Apr '19

11 Apr '19

As the composition of the Octavia team has changed over time, it was proposed at today's meeting that we may want to change our weekly IRC meeting time to accommodate more participants from around the world. Seven time slots were proposed during the meeting and I have created a doodle poll to help us find a time that works for most of the team. Please note, the intent is to pick a new UTC time. Doodle attempts to adapt the times to your local timezone. The proposed times are Tuesday-Friday at 15:00 or 16:00 UTC. We have also included the current meeting time of 20:00 UTC on Wednesday. Please vote your preferences at the following Doodle poll: https://doodle.com/poll/9sxbzfhwirqiyqe8 We will discuss the results at next week's regularly scheduled IRC meeting, Wednesday at 20:00 UTC. Please reply to this e-mail or to me directly if you have trouble with the poll or would like to propose additional time slots. Michael

1 1

[placement][ptg] code refactoring constraints and goals
by Chris Dent 11 Apr '19

11 Apr '19

>From the etherpad [1] * We got a lot of value out of the ovo-ectomy and de-list. We're now at a stage where there is plenty more that could be done, but the choices are more subject to personal preference. * How (and should) we further split and shrink objects/resource_provider.py We got a lot of value out of the big refactoring the removed OVO and split objects/resource_provider.py into smaller files. It's also a stated goal that we should continue refactoring and continuously revisit existing code. However, we started to stumble because we had some disagreements on how to proceed. We should resolve those disagreements so we can proceed (he said, obviously). Questions that have come up (plus other ones I can think off the top of my head): * Is it worth reordering methods to some kind of arbitrary ordering? * If a method or module is "long" (by some definition) does that make it bad? * Where is the balance between backport hurting churn and keeping the mix fresh? * Should there be a more cleanly defined boundary between the methods that marshal data (the top-level methods in objects/*.py) and those that talk to the persistence layer (also in objects/*.py)? * Do we need to define (better) or document the layers/boundaries in the system? * How can we encourage a similar refactor/revisit-often attitude to the docs? There are plenty of other refactoring related thoughts too. Have at. -- Chris Dent ٩◔̯◔۶ https://anticdent.org/ freenode: cdent tw: @anticdent

4 11

[glance] Listing all images with a set of custom properties
by Nadathur, Sundar 11 Apr '19

11 Apr '19

I am looking for a way to programmatically get all images that have been associated with a set of custom properties. Ideally, I should be able to say 'give me all images that have key1=value1, key2=value2, etc. Failing that, at least get all images that have the named keys key1, key2, etc. irrespective of their values, so I can filter for the values myself. I was looking at [1], specifically [2], and came up short. Any recommendations? [1] https://github.com/openstack/python-glanceclient/tree/master/glanceclient/v2 [2] https://github.com/openstack/python-glanceclient/blob/master/glanceclient/v… Regards, Sundar

2 2