May 2019 - openstack-discuss - lists.openstack.org

[dev][keystone][ptg] Keystone team action items
by Colleen Murphy 07 May '19

07 May '19

Hi everyone, I will write an in-depth summary of the Forum and PTG some time in the coming week, but I wanted to quickly capture all the action items that came out of the last six days so that we don't lose too much focus: Colleen * move "Expand endpoint filters to Service Providers" spec[1] to attic * review "Policy Goals"[2] and "Policy Security Roadmap"[3] specs with Lance, refresh and possibly combine them * move "Unified model for assignments, OAuth, and trusts" spec[4] from ongoing to backlog, and circle up with Adam about refreshing it * update app creds spec[5] to defer access_rules_config * review app cred documentation with regard to proactive rotation * follow up with nova/other service teams on need for microversion support in access rules * circle up with Guang on fixing autoprovisioning for tokenless auth * keep up to date with IEEE/NIST efforts on standardizing federation * investigate undoing the foreign key constraint that breaks the pluggable resource driver * propose governance change to add caching as a base service * clean out deprecated cruft from keystonemiddleware * write up Outreachy/other internship application tasks [1] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/… [2] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [3] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [4] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [5] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/train/ca… Lance * write up plan for tempest testing of system scope * break up unified limits testing plan into separate items, one for CRUD in keystone and one for quota and limit validation in oslo.limit[6] * write up spec for assigning roles on root domain * (with Morgan) check for and add interface in oslo.policy to see if policy has been overridden [6] https://trello.com/c/kbKvhYBz/20-test-unified-limits-in-tempest Kristi * finish mutable config patch * propose "model-timestamps" spec for Train[7] * move "Add Multi-Version Support to Federation Mappings" spec[8] to attic * review and possibly complete "Devstack Plugin for Keystone" spec[9] * look into "RFE: Improved OpenID Connect Support" spec[10] * update refreshable app creds spec[11] to make federated users expire rather then app creds * deprecate federated_domain_name [7] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/… [8] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/… [9] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [10] https://bugs.launchpad.net/keystone/+bug/1815971 [11] https://review.opendev.org/604201 Vishakha * investigate effort needed for Alembic migrations spec[12] (with help from Morgan) * merge "RFE: Retrofit keystone-manage db_* commands to work with Alembic"[13] into "Use Alembic for database migrations" spec * remove deprecated [signing] config * remove deprecated [DEFAULT]/admin_endpoint config * remove deprecated [token]/infer_roles config [12] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/… [13] https://bugs.launchpad.net/keystone/+bug/1816158 Morgan * review "Materialize Project Hierarchy" spec[14] and make sure it reflects the current state of the world, keep it in the backlog * move "Functional Testing" spec[15] to attic * move "Object Dependency Lifecycle" spec[16] to complete * move "Add Endpoint Filter Enforcement to Keystonemiddleware" spec[17] to attic * move "Request Helpers" spec[18] to attic * create PoC of external IdP proxy component * (with Lance) check for and add interface in oslo.policy to see if policy has been overridden * investigate removing [eventlet_server] config section * remove remaining PasteDeploy things * remove PKI(Z) cruft from keystonemiddleware * refactor keystonemiddleware to have functional components instead of needing keystone to instantiate keystonemiddleware objects for auth [14] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/backlog/… [15] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [16] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing/… [17] http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddlewar… [18] http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddlewar… Gage * investigate with operators about specific use case behind "RFE: Whitelisting (opt-in) users/projects/domains for PCI compliance"[19] request * follow up on "RFE: Token returns Project's tag properties"[20] * remove use of keystoneclient from keystonemiddleware [19] https://bugs.launchpad.net/keystone/+bug/1637146 [20] https://bugs.launchpad.net/keystone/+bug/1807697 Rodrigo * Propose finishing "RFE: Project Tree Deletion/Disabling"[21] as an Outreachy project [21] https://bugs.launchpad.net/keystone/+bug/1816105 Adam * write up super-spec on explicit project IDs plus predictable IDs Thanks everyone for a productive week and for all your hard work! Colleen

2 1

[sahara] Cancelling Sahara meeting May 9
by Jeremy Freudberg 07 May '19

07 May '19

Hi all, There will be no Sahara meeting this upcoming Thursday, May 9. Holler if you need anything. Thanks, Jeremy

1 0

[cyborg] No meetings this week
by Nadathur, Sundar 07 May '19

07 May '19

Many of our developers are either jetlagged or have other conflicts, and prefer to reconvene later. Regards, Sundar

1 0

[keystone] reminder no irc meeting today, may 7
by Morgan Fainberg 07 May '19

07 May '19

This is a reminder that there will be no weekly irc Keystone meeting this week so that everyone can recover post Summit and PTG [1]. Meetings will resume normally next week on May 14th. [1] http://lists.openstack.org/pipermail/openstack-discuss/2019-April/005531.ht…

1 0

[ops] ops meetups team meeting 2019-5-7
by Chris Morgan 07 May '19

07 May '19

Minute from todays meeting are linked below. A vote was taken to officially confirm acceptance of Bloomberg's offer to host the second ops meetup of 2019 and passed. There is also some news of possible further meetups in 2020 and discussion of how to structure ops events at future Open Infra Summits. reminder: key ops events are notified via : https://twitter.com/osopsmeetup Now up to 63 followers! Meeting ended Tue May 7 15:00:30 2019 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) 11:00 AM O<•openstack> Minutes: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2019/ops_meetup_tea… 11:00 AM Minutes (text): http://eavesdrop.openstack.org/meetings/ops_meetup_team/2019/ops_meetup_tea… 11:00 AM Log: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2019/ops_meetup_tea… Chris -- Chris Morgan <mihalis68(a)gmail.com>

1 0

[octavia] Error while creating amphora
by Volodymyr Litovka 07 May '19

07 May '19

Dear colleagues, I'm using Openstack Rocky and trying to launch Octavia 4.0.0. After all installation steps I've got an error during 'openstack loadbalancer create' with the following log: DEBUG octavia.controller.worker.tasks.compute_tasks [-] Compute create execute for amphora with id d037721f-2cf9-492e-99cb-0be5874da0f6 execute /opt/openstack/lib/python3.6/site-packages/octavia/controller/worker/tasks/compute_tasks.py:63 ERROR octavia.controller.worker.tasks.compute_tasks [-] Compute create for amphora id: d037721f-2cf9-492e-99cb-0be5874da0f6 failed: TypeError: can't concat str to bytes ERROR octavia.controller.worker.tasks.compute_tasks Traceback (most recent call last): ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/octavia/controller/worker/tasks/compute_tasks.py", line 94, in execute ERROR octavia.controller.worker.tasks.compute_tasks config_drive_files) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/octavia/common/jinja/user_data_jinja_cfg.py", line 38, in build_user_data_config ERROR octavia.controller.worker.tasks.compute_tasks return self.agent_template.render(user_data=user_data) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/jinja2/asyncsupport.py", line 76, in render ERROR octavia.controller.worker.tasks.compute_tasks return original_render(self, *args, **kwargs) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/jinja2/environment.py", line 1008, in render ERROR octavia.controller.worker.tasks.compute_tasks return self.environment.handle_exception(exc_info, True) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/jinja2/environment.py", line 780, in handle_exception ERROR octavia.controller.worker.tasks.compute_tasks reraise(exc_type, exc_value, tb) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/jinja2/_compat.py", line 37, in reraise ERROR octavia.controller.worker.tasks.compute_tasks raise value.with_traceback(tb) ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/octavia/common/jinja/templates/user_data_config_drive.template", line 29, in top-level template code ERROR octavia.controller.worker.tasks.compute_tasks {{ value|indent(8) }} ERROR octavia.controller.worker.tasks.compute_tasks File "/opt/openstack/lib/python3.6/site-packages/jinja2/filters.py", line 557, in do_indent ERROR octavia.controller.worker.tasks.compute_tasks s += u'\n' # this quirk is necessary for splitlines method ERROR octavia.controller.worker.tasks.compute_tasks TypeError: can't concat str to bytes ERROR octavia.controller.worker.tasks.compute_tasks WARNING octavia.controller.worker.controller_worker [-] Task 'STANDALONE-octavia-create-amp-for-lb-subflow-octavia-cert-compute-create' (06134192-def9-420c-9feb-0d08a068f3b2) transitioned into state 'FAILURE' from state 'RUNNING' Any advises where is the problem? My environment: - Openstack Rocky - Ubuntu 18.04 - Octavia installed in virtualenv using pip install: # pip list |grep octavia octavia 4.0.0 octavia-lib 1.1.1 python-octaviaclient 1.8.0 Thank you. -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison -- Volodymyr Litovka "Vision without Execution is Hallucination." -- Thomas Edison

2 5

[kolla] Denver summit summary
by Mark Goddard 07 May '19

07 May '19

Hi, Here are links to slides from the kolla project sessions at the summit. * Project update [1] * Project onboarding [2] There should be a video of the update available in due course. We also had a user feedback session, the Etherpad notes are at [3] Picking out some themes from the user feedback: * TLS everywhere * Nova Cells v2 * SELinux * podman & buildah support for CentOS/RHEL 8 I think we're in a good position to support the first two in the Train cycle since they have some work in progress. The latter two will require some investigation. [1] https://docs.google.com/presentation/d/1npG6NGGsJxdXFzmPLfrDsWMhxeDVY9-nBfm… [2] https://docs.google.com/presentation/d/11gGW93Xu7DQo_G1LiRDm6thfB5gNLm39SHu… [3] https://etherpad.openstack.org/p/DEN-train-kolla-feedback Cheers, Mark

3 4

[Deploy problem] deploy openstack+monasca with kolla-ansible 8.0.0.0rc1.
by Ming-Che Liu 07 May '19

07 May '19

Hello, I deployed openstack+monasca with kolla-ansible 8.0.0.0rc1. I follow the steps as mentioned in https://docs.openstack.org/kolla-ansible/latest/user/quickstart.html The setting in my computer's globals.yml as same as [Quick Start] tutorial (attached file: globals.yml is my setting). My machine environment as following: OS: Ubuntu 16.04 Kolla-ansible verions: 8.0.0.0rc1 ansible version: 2.7 When I execute [bootstrap-servers] and [prechecks], it seems ok (no fatal error or any interrupt). But when I execute [deploy], it will occur some error about rabbitmq(when I set enable_rabbitmq:yes) and nova compute service(when I set enable_rabbitmq:no). I have some detail screenshot about the errors as attached files, could you please help me to solve this problem? Thank you very much. [Attached file description]: globals.yml: my computer's setting about kolla-ansible As mentioned above, the following pictures show the errors, the rabbitmq error will occur if I set [enable_rabbitmq:yes], the nova compute service error will occur if I set [enable_rabbitmq:no]. [image: docker-version.png] [image: kolla-ansible-version.png] [image: nova-compute-service-error.png] [image: rabbitmq_error.png]

3 9

[placement][nova][ptg] Summary: Nested Magic With Placement
by Chris Dent 07 May '19

07 May '19

This message is an attempt to summarize some of the discussions held yesterday during the nova-placement cross project session [1] that were in some way related to the handling of nested providers. There were several individual topics: * NUMA Topology with placement * Subtree affinity with placement * Request group mapping * Resourceless trait filters But they are all closely inter-related, so summarizing the discussion here as a lump. There was some discussion raised about whether representing NUMA topology in placement was worth pursuing as it is not strictly necessary and dang it is sure taking us a long time to get there and will replace an existing set of worms with a new set of worms. The conversation to resolved to: It's worth trying. To make it work there are some adjustments required to how placement operates: * We need to implement a form of the can_split feature (as previously described in [2]) to allow some classes of resource to be satisfied by multiple providers. * The `group_policy=same_tree[...]` concept is needed (as initially proposed in [3]) for affinity (and anti). Some discussion on implementation has started at [4] and there will be in-person discussion in the placement PTG room tomorrow (Saturday) afternoon. * trait and aggregate membership should "flow down" when making any kind of request (numbered or unnumbered). This is closely tied to the implementation of the previous point. * Being able to express 'required' without a 'resources' is required when making an allocation candidates query. * There are several in-flight nova patches where some hacks to flavors are being performed to work around the current lack of this feature. These are okay and safe to carry on with because they are ephemeral. * The number required and resources query parameters need to accept arbitrary strings so it is possible to say things like 'resources_compute' and 'resources_network' to allow conventions to emerge when multiple parties may be involved in manipulating a RequestGroup. * A 'mappings' key will be added to the 'allocations' object in the allocation_candidates response that will support request group mapping. * There will be further discussion on these features Saturday at the PTG starting at 13:30. Actions: * This (Friday) afternoon at the PTG I'll be creating rfe stories associated with these changes. If you'd like to help with that, find me in the placement room (109). We'll work out whether those stories needs specs in the normally processing of the stories. We'll also need to find owners for many of them. * Gibi will be updating the request group mapping spec. [1] https://etherpad.openstack.org/p/ptg-train-xproj-nova-placement [2] https://review.opendev.org/#/c/560974/ [3] http://lists.openstack.org/pipermail/openstack-discuss/2019-April/005673.ht… [4] http://lists.openstack.org/pipermail/openstack-discuss/2019-May/005815.html [5] https://review.opendev.org/#/c/597601/ -- Chris Dent ٩◔̯◔۶ https://anticdent.org/ freenode: cdent tw: @anticdent

2 3

[kolla] Virtual PTG scheduling poll
by Mark Goddard 07 May '19

07 May '19

Hi, Since most of the Kolla team aren't attending the PTG, we've agreed to hold a virtual PTG. We agreed to start with two 4 hour sessions. We can finish early or schedule another session, depending on how we progress. We'll use some video conferencing software TBD. I've created a Doodle poll here [2], please fill it in if you hope to attend. Times are in UTC. Please continue to fill out the planning Etherpad [1]. Thanks, Mark [1] https://etherpad.openstack.org/p/kolla-train-ptg [2] https://doodle.com/poll/adk2smds76d8db4u

1 2