July 2019 - openstack-discuss - lists.openstack.org

[keystone] Keystone Team Update - Week of 15 July 2019
by Colleen Murphy 19 Jul '19

19 Jul '19

# Keystone Team Update - Week of 15 July 2019 ## News ### Returning core Welcome back, Guang![1] [1] http://lists.openstack.org/pipermail/openstack-discuss/2019-July/007918.html ### Midcycle next week The virtual midcycle will take place next week on Monday and Tuesday[2]. We will (try to) use Gotomeeting for the call, the details for which are in the etherpad. [2] http://lists.openstack.org/pipermail/openstack-discuss/2019-July/007593.html ### Train specs merged All specs proposed for the Train cycle are now merged! ## Open Specs Train specs: https://bit.ly/2uZ2tRl Ongoing specs: https://bit.ly/2OyDLTh ## Recently Merged Changes Search query: https://bit.ly/2pquOwT We merged 8 changes this week. ## Changes that need Attention Search query: https://bit.ly/2tymTje There are 40 changes that are passing CI, not in merge conflict, have no negative reviews and aren't proposed by bots. ## Bugs This week we opened 5 new bugs and closed 4. Bugs opened (5) Bug #1837061 (keystone:Wishlist) opened by Morgan Fainberg https://bugs.launchpad.net/keystone/+bug/1837061 Bug #1836568 (keystone:Undecided) opened by Attila Fazekas https://bugs.launchpad.net/keystone/+bug/1836568 Bug #1836650 (keystone:Undecided) opened by Rafael Weingartner https://bugs.launchpad.net/keystone/+bug/1836650 Bug #1836872 (keystone:Undecided) opened by Yang Youseok https://bugs.launchpad.net/keystone/+bug/1836872 Bug #1837010 (keystone:Undecided) opened by Yang Youseok https://bugs.launchpad.net/keystone/+bug/1837010 Bugs closed (3) Bug #1832267 (keystone:Undecided) https://bugs.launchpad.net/keystone/+bug/1832267 Bug #1836650 (keystone:Undecided) https://bugs.launchpad.net/keystone/+bug/1836650 Bug #1836872 (keystone:Undecided) https://bugs.launchpad.net/keystone/+bug/1836872 Bugs fixed (1) Bug #1813057 (keystone:Medium) fixed by Guang Yee https://bugs.launchpad.net/keystone/+bug/1813057 ## Milestone Outlook https://releases.openstack.org/train/schedule.html Next week is spec freeze, which we've already met. One month from now is feature proposal freeze, by which point all code for new features should be proposed and ready for review - no WIPs. This gives us four weeks to review and incorporate feedback before feature freeze. ## Help with this newsletter Help contribute to this newsletter by editing the etherpad: https://etherpad.openstack.org/p/keystone-team-newsletter

1 0

[tripleo] specs for removing Puppet from TripleO
by Emilien Macchi 19 Jul '19

19 Jul '19

As part of the Simplification of TripleO effort [1], I pushed a specification proposal to remove Puppet from TripleO. This is a *huge* effort and to be clear I'm still unsure it is really doable; but I would like our team to explore this path and see if there is enough value out of it. https://review.opendev.org/#/c/671563 HTML output with latest patchset: http://logs.openstack.org/63/671563/4/check/openstack-tox-docs/c511ace/html… Feel free to give feedback directly in the specs or here in this thread. If we agree to move forward, my hope is we can push for a first "tech-preview" interface in Train; but keep in mind this would be a multi-cycles effort. [1] https://docs.google.com/document/d/1vY9rsccgp7NHFXpLtCFTHQm14F15Tij7lhn5X_P… -- Emilien Macchi

1 0

How to restart DevStack
by Manula Thantriwatte 19 Jul '19

19 Jul '19

Hi All, When I shutdown my PC, how to restart devstack. Is it ok to run ./stack.sh again or do I need to do it from the beginning? Thanks ! -- Regards, Manula Chathurika Thantriwatte phone : (+94) 772492511 email : manulachathurika(a)gmail.com Linkedin : *http://lk.linkedin.com/in/manulachathurika <http://lk.linkedin.com/in/manulachathurika>* blog : http://manulachathurika.blogspot.com/

6 5

vm guest creation
by Mauricio Tavares 19 Jul '19

19 Jul '19

If I am creating a kvm guest, I take it is doing something like virt-install \ --name desktop1 \ --disk path=./moocow.qcow2 \ --ram 4098 --vcpus 2 \ --os-type linux \ [....] --arch x86_64 Where does it do that? And, how much control per guest do I have? I am looking at https://docs.openstack.org/mitaka/config-reference/compute/hypervisor-kvm.h…. What I see is that I can only define across the border options in nova.conf. Also, are there any docs on configuring the libvirt besides https://wiki.openstack.org/wiki/LibvirtXMLConfigAPIs?

1 0

[goal][python3] Train unit tests weekly update (goal-8)
by Corey Bryant 19 Jul '19

19 Jul '19

This is the goal-8 weekly update for the "Update Python 3 test runtimes for Train" goal [1]. There are 8 weeks remaining for completion of Train community goals [2]. == What's the Goal? == To ensure (in the Train cycle) that all official OpenStack repositories with Python 3 unit tests are exclusively using the 'openstack-python3-train-jobs' Zuul template or one of its variants (e.g. 'openstack-python3-train-jobs-neutron') to run unit tests, and that tests are passing. This will ensure that all official projects are running py36 and py37 unit tests in Train. For complete details please see [1]. == Ongoing Work == Patches have been submitted for all applicable projects except for one, OpenStack Charms. The charms have a mid-cycle freeze this week. I hope to have those submitted next week. Open patches needing reviews: https://review.openstack.org/#/q/topic:python3-train+is:open Failing patches: https://review.openstack.org/#/q/topic:python3-train+status:open+(+label:Ve… Patch automation scripts needing review: https://review.opendev.org/#/c/666934 == Completed Work == Merged patches: https://review.openstack.org/#/q/topic:python3-train+is:merged == How can you help? == Please take a look at the failing patches and help fix any failing unit tests for your projects. Python 3.7 unit tests will be self-testing in Zuul. == Reference Material == [1] Goal description: https://governance.openstack.org/tc/goals /train/python3-updates.html [2] Train release schedule: https://releases.openstack.org/train/schedule.html (see R-5 for "Train Community Goals Completed") Storyboard: https://storyboard.openstack.org/#!/story/2005924 Porting to Python 3.7: https://docs.python.org/3/whatsnew/3.7.html#porting-to-python-3-7 Python Update Process: https://opendev.org/openstack/governance/src/branch/master/resolutions/2018… Train runtimes: https://opendev.org/openstack/governance/src/branch/master/reference/runtim… Thanks, Corey

1 0

Instructions for spooling up an instance
by Mauricio Tavares 19 Jul '19

19 Jul '19

I understand you create a flavor and an image (which can be customized with the properties from https://docs.openstack.org/glance/latest/admin/useful-image-properties.html) which can then be fed to openstack server create thingie. But, where is the script (think something like kickstart to see what I have in mind; if I am off, I am off) that defines how the hard drive will be partitioned and which interfaces (if more than one) will be turned on and which will be left untouched. You know, housekeeping things that are done before you feed the "--user-data" stuff. Where is that defined? Can I customize it?

4 4

[queens][cinder] emc fc driver
by Ignazio Cassano 19 Jul '19

19 Jul '19

Hello, Does anyone use cinder with emc san via FC ? Does it work ? Regards Ignazio

2 2

Octavia: Could not retrieve certificate when create HTTPS listener using application credentials
by Pawel Konczalski 19 Jul '19

19 Jul '19

Hi, i try to create a Octavia HTTPS listener by using application credentials but get this error: Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…'] (HTTP 400) (Request-ID: req-088d6eb0-a285-4089-bc11-ff0c3097123e) # openstack secret list +--------------------------------------------------------------------------------------+-------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | Secret href | Name | Created | Status | Content types | Algorithm | Bit length | Secret type | Mode | Expiration | +--------------------------------------------------------------------------------------+-------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ | https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58… | cert2 | 2019-07-19T13:42:21+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes | 256 | opaque | cbc | None | | https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7… | cert1 | 2019-07-19T13:42:12+00:00 | ACTIVE | {u'default': u'application/octet-stream'} | aes | 256 | opaque | cbc | None | +--------------------------------------------------------------------------------------+-------+---------------------------+--------+-------------------------------------------+-----------+------------+-------------+------+------------+ # openstack loadbalancer listener create foo-lb1 \ --name foo-lb1-https-listener \ --protocol-port 443 \ --protocol TERMINATED_HTTPS \ --insert-headers X-Forwarded-For=true,X-Forwarded-Proto=true \ --default-tls-container=https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7-9cd155e3dc09 \ --sni-container-refs https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7… https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58… -------------------------------- Starting new HTTPS connection (1): octavia.service.dev.example.com:443 https://octavia.service.dev.example.com:443 "GET /v2.0/lbaas/loadbalancers HTTP/1.1" 200 779 RESP: [200] Connection: keep-alive Content-Length: 779 Content-Type: application/json Date: Fri, 19 Jul 2019 13:56:24 GMT Server: WSGIServer/0.1 Python/2.7.15rc1 x-openstack-request-id: req-50b5a3bb-21ec-4a46-8d5c-61035afd3423 RESP BODY: {"loadbalancers": [{"provider": "amphora", "description": "", "admin_state_up": true, "pools": [{"id": "169722d1-0a73-4283-bb42-aee5b662e2e2"}], "created_at": "2019-07-19T13:34:52", "provisioning_status": "ACTIVE", "updated_at": "2019-07-19T13:39:34", "vip_qos_policy_id": null, "vip_network_id": "2064c61c-64a1-466f-983a-af435ae1d51c", "listeners": [{"id": "169a91f9-ef5c-4d38-8449-e24b64cf082d"}], "tenant_id": "9646533a8d834978a868e81c9b9a39cf", "vip_port_id": "dcfc6e44-4092-4f2b-bd50-24e02abb078f", "flavor_id": "", "vip_address": "10.0.1.4", "vip_subnet_id": "787035dc-add4-4227-844a-1cf803625abc", "project_id": "9646533a8d834978a868e81c9b9a39cf", "id": "e2ed48ab-3261-422f-b9b5-a5aa63486ae7", "operating_status": "OFFLINE", "name": "foo-lb1"}], "loadbalancers_links": []} GET call to https://octavia.service.dev.example.com/v2.0/lbaas/loadbalancers used request id req-50b5a3bb-21ec-4a46-8d5c-61035afd3423 REQ: curl -g -i -X POST https://octavia.service.dev.example.com/v2.0/lbaas/listeners -H "Content-Type: application/json" -H "User-Agent: openstacksdk/0.19.0 keystoneauth1/3.11.1 python-requests/2.20.1 CPython/2.7.15+" -H "X-Auth-Token: {SHA256}6414e14f4e78940902b11c89567689e3cc0d3ea62227b87a1e19361685c83584" -d '{"listener": {"insert_headers": {"X-Forwarded-For": "true", "X-Forwarded-Proto": "true"}, "protocol": "TERMINATED_HTTPS", "name": "foo-lb1-https-listener", "default_tls_container_ref": "https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…", "sni_container_refs": ["https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…", "https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…"], "admin_state_up": true, "protocol_port": 443, "loadbalancer_id": "e2ed48ab-3261-422f-b9b5-a5aa63486ae7"}}' https://octavia.service.dev.example.com:443 "POST /v2.0/lbaas/listeners HTTP/1.1" 400 357 RESP: [400] Connection: keep-alive Content-Length: 357 Content-Type: application/json Date: Fri, 19 Jul 2019 13:56:27 GMT Server: WSGIServer/0.1 Python/2.7.15rc1 x-openstack-request-id: req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca RESP BODY: {"debuginfo": null, "faultcode": "Client", "faultstring": "Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…']"} POST call to https://octavia.service.dev.example.com/v2.0/lbaas/listeners used request id req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca Request returned failure status: 400 Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…'] (HTTP 400) (Request-ID: req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca) Traceback (most recent call last): File "/usr/lib/python2.7/dist-packages/cliff/app.py", line 400, in run_subcommand result = cmd.run(parsed_args) File "/home/foo/.local/lib/python2.7/site-packages/osc_lib/command/command.py", line 41, in run return super(Command, self).run(parsed_args) File "/usr/lib/python2.7/dist-packages/cliff/display.py", line 116, in run column_names, data = self.take_action(parsed_args) File "/home/foo/.local/lib/python2.7/site-packages/octaviaclient/osc/v2/listener.py", line 168, in take_action json=body) File "/home/foo/.local/lib/python2.7/site-packages/octaviaclient/api/v2/octavia.py", line 38, in wrapper request_id=e.request_id) OctaviaClientException: Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…'] (HTTP 400) (Request-ID: req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca) clean_up CreateListener: Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…'] (HTTP 400) (Request-ID: req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca) Traceback (most recent call last): File "/home/foo/.local/lib/python2.7/site-packages/osc_lib/shell.py", line 136, in run ret_val = super(OpenStackShell, self).run(argv) File "/usr/lib/python2.7/dist-packages/cliff/app.py", line 279, in run result = self.run_subcommand(remainder) File "/home/foo/.local/lib/python2.7/site-packages/osc_lib/shell.py", line 176, in run_subcommand ret_value = super(OpenStackShell, self).run_subcommand(argv) File "/usr/lib/python2.7/dist-packages/cliff/app.py", line 400, in run_subcommand result = cmd.run(parsed_args) File "/home/foo/.local/lib/python2.7/site-packages/osc_lib/command/command.py", line 41, in run return super(Command, self).run(parsed_args) File "/usr/lib/python2.7/dist-packages/cliff/display.py", line 116, in run column_names, data = self.take_action(parsed_args) File "/home/foo/.local/lib/python2.7/site-packages/octaviaclient/osc/v2/listener.py", line 168, in take_action json=body) File "/home/foo/.local/lib/python2.7/site-packages/octaviaclient/api/v2/octavia.py", line 38, in wrapper request_id=e.request_id) OctaviaClientException: Could not retrieve certificate: ['https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…', 'https://barbican.service.dev.example.com/v1/secrets/593cc231-92ee-4b0a-8c58…', 'https://barbican.service.dev.example.com/v1/secrets/cb28220c-1339-4fc0-83f7…'] (HTTP 400) (Request-ID: req-5eef99bf-45c9-43eb-b7c7-2dacaff980ca) ------------------------------ This issue occurs only when application credentials are used. Creation of HTTP listener with applications credentials works fine, also creation of HTTPS listener when user are authenticated by user / password. Does somebody know which additional ACLs / permissions are required to fix this? BR Pawel

2 1

[Manila] CephFS deferred deletion
by Jose Castro Leon 19 Jul '19

19 Jul '19

Dear all, Lately, one of our clients stored 300k files in a manila cephfs share. Then he deleted the share in Manila. This event make the driver unresponsive for several hours until all the data was removed in the cluster. We had a quick look at the code in manila [1] and the deletion is done first by calling the following api calls in the ceph bindings (delete_volume[1] and then purge_volume[2]). The first call moves the directory to a volumes_deleted directory. The second call does a deletion in depth of all the contents of that directory. The last operation is the one that trigger the issue. We had a similar issue in the past in Cinder. There, Arne proposed to do a deferred deletion of volumes. I think we could do the same in Manila for the cephfs driver. The idea is to continue to call to the delete_volume. And then inside a periodic task in the driver, asynchronously it will get the contents of that directory and trigger the purge command. I can propose the change and contribute with the code, but before going to deep I would like to know if there is a reason of having a singleton for the volume_client connection. If I compare with cinder code the connection is established and closed in each operation with the backend. If you are not the maintainer, could you please point me to he/she? I can post it in the mailing list if you prefer Cheers Jose Castro Leon CERN Cloud Infrastructure [1] https://github.com/openstack/manila/blob/master/manila/share/drivers/cephfs… [2] https://github.com/ceph/ceph/blob/master/src/pybind/ceph_volume_client.py#L… [2] https://github.com/ceph/ceph/blob/master/src/pybind/ceph_volume_client.py#L… PS: The issue was triggered by one of our clients in kubernetes using the Manila CSI driver

3 4

Linstor volume driver
by Jyoti Dahiwele 19 Jul '19

19 Jul '19

Dear Team, Does stein cinder support drbd linstor driver?

3 2