September 2019 - openstack-discuss

[Tacker] {TOSCA] Regarding attaching persistent volume to a VDU in Tosca Template
by Nehal Bansal 19 Sep '19

19 Sep '19

Hi, I want to keep a backup of the data that my VNF creates. For this, I wanted to create a persistent volume such that if a VNF gets deleted and a new one gets launched, it can access the data created by the previous VNF. Is there a way to do this? Thanks. Nehal

2 1

[mistral] cron triggers execution fails on identity:validate_token with non-admin users
by Francois Scheurer 19 Sep '19

19 Sep '19

Dear All We are using Mistral 7.0.1.1 with Openstack Rocky. (with federated users) We can create and execute a workflow via horizon, but cron triggers always fail with this error: { "result": "The action raised an exception [ action_ex_id=ef878c48-d0ad-4564-9b7e-a06f07a70ded, action_cls='<class 'mistral.actions.action_factory.NovaAction'>', attributes='{u'client_method_name': u'servers.find'}', params='{ u'action_region': u'ch-zh1', u'name': u'42724489-1912-44d1-9a59-6c7a4bebebfa' }' ] \n NovaAction.servers.find failed: You are not authorized to perform the requested action: identity:validate_token. (HTTP 403) (Request-ID: req-ec1aea36-c198-4307-bf01-58aca74fad33) " } Adding the role *admin* or *service* to the user logged in horizon is "fixing" the issue, I mean that the cron trigger then works as expected, but it would be obviously a bad idea to do this for all normal users ;-) So my question: is it a config problem on our side ? is it a known bug? or is it a feature in the sense that cron triggers are for normal users? After digging in the keystone debug logs (see at the end below), I found that RBAC check identity:validate_token an deny the authorization. But according to the policy.json (in keystone and in horizon), rule:owner should be enough to grant it...: "identity:validate_token": "rule:service_admin_or_owner", "service_admin_or_owner": "rule:service_or_admin or rule:owner", "service_or_admin": "rule:admin_required or rule:service_role", "service_role": "role:service", "owner": "user_id:%(user_id)s or user_id:%(target.token.user_id)s", Thank you in advance for your help. Best Regards Francois Scheurer Keystone logs: 2019-09-05 09:38:00.902 29 DEBUG keystone.policy.backends.rules [req-1a276b9d-8276-4ec3-b516-f51f86cd1df6 fsc fscproject - testdom testdom] enforce identity:validate_token: { 'service_project_id':None, 'service_user_id':None, 'service_user_domain_id':None, 'service_project_domain_id':None, 'trustor_id':None, 'user_domain_id':u'testdom', 'domain_id':None, 'trust_id':u'mytrustid', 'project_domain_id':u'testdom', 'service_roles':[], 'group_ids':[], 'user_id':u'fsc', 'roles':[ u'_member_', u'creator', u'reader', u'heat_stack_owner', u'member', u'load-balancer_member'], 'system_scope':None, 'trustee_id':None, 'domain_name':None, 'is_admin_project':True, 'token':<TokenModel (audit_id=0LAsW_0dQMWXh2cTZTLcWA, audit_chain_id=[u'0LAsW_0dQMWXh2cTZTLcWA']) at 0x7f208f4a3bd0>, 'project_id':u'fscproject' } enforce /var/lib/kolla/venv/local/lib/python2.7/site-packages/keystone/policy/backends/rules.py:33 2019-09-05 09:38:00.920 29 WARNING keystone.common.wsgi [req-1a276b9d-8276-4ec3-b516-f51f86cd1df6 fsc fscproject - testdom testdom] You are not authorized to perform the requested action: identity:validate_token.: *ForbiddenAction: You are not authorized to perform the requested action: identity:validate_token.* -- EveryWare AG François Scheurer Senior Systems Engineer Zurlindenstrasse 52a CH-8003 Zürich tel: +41 44 466 60 00 fax: +41 44 466 60 10 mail: francois.scheurer(a)everyware.ch web: http://www.everyware.ch

3 5

[tc] Results of the two TC CIVS polls
by Graham Hayes 19 Sep '19

19 Sep '19

Hi All, We had two votes running for the TC - V->Z naming, and the TC Chair. The results are as follows: Release Naming: 1. Tied: Do not change current model of geographic names - No review Name releases after major cities - https://review.opendev.org/#/c/677745/ 3. Name releases after the ICAO alphabet - https://review.opendev.org/#/c/677746/ Full results: https://civs.cs.cornell.edu/cgi-bin/results.pl?num_winners=1&id=E_0a9abdade… TC Chair: 1. JP Evrard - https://review.opendev.org/#/c/681285/ 2. Mohammed Naser - https://review.opendev.org/#/c/680414/ Full results: https://civs.cs.cornell.edu/cgi-bin/results.pl?num_winners=1&id=E_e6963bddd… Thanks all for taking the time to vote, and for the candidates and people who put forward the options for the naming poll. Thanks, Graham

3 4

[horizon] exception for the allow-users-change-expired-password blueprint
by Radomir Dopieralski 19 Sep '19

19 Sep '19

Hello y'all, I would like to ask for an FEE for the allow-users-change-expired-password blueprint ( https://blueprints.launchpad.net/horizon/+spec/allow-users-change-expired-p…). The feature is important for users, and the code is reviewed and ready to merge. There are three patches, of which one, containing the form itself, is already merged, one contains the redirect on login failure, and one contains the documentation: https://review.opendev.org/#/c/672315/ https://review.opendev.org/#/c/676167/ Thank you, -- Radomir Dopieralski

1 1

[neutron]IPv6 Prefix Delegation could not be activated in newest version Neutron
by Shuai Zhao 18 Sep '19

18 Sep '19

Hi All, I'm working on validate the IPv6 PD in newest Neutron. What I want is to offer the Global Unified address to the VM and I find PD is the good solutions for me. I follow the guide *https://docs.openstack.org/neutron/latest/admin/config-ipv6.html <https://docs.openstack.org/neutron/latest/admin/config-ipv6.html> *to setup PD and dibbler-server and devstack, but I find I could not to trigger the PD process. *The Dibbler server print nothing when attach the Subnet to router has external gateway.* All procedure has recorded to the bug: https://bugs.launchpad.net/neutron/+bug/1844123. Thanks for your action and help in advance!

1 1

Nova causes MySQL timeouts
by Albert Braden 18 Sep '19

18 Sep '19

It looks like nova is keeping mysql connections open until they time out. How are others responding to this issue? Do you just ignore the mysql errors, or is it possible to change configuration so that nova closes and reopens connections before they time out? Or is there a way to stop mysql from logging these aborted connections without hiding real issues? Aborted connection 10726 to db: 'nova' user: 'nova' host: 'asdf' (Got timeout reading communication packets)

9 14

[cinder][FFE] Feature Freeze Exceptions agreed to in Weekly Meeting ....
by Jay Bryant 18 Sep '19

18 Sep '19

All, In our weekly meeting we discussed patches that required an FFE and decided to approve them there. This note is just to document that the FFE's were approved. The patches: * https://review.opendev.org/#/c/668825/(ZhengMa) - Leverage hw accelerator in image compression * https://review.opendev.org/#/c/673013 PowerMax Driver - Volume & Snapshot Metadata * https://review.opendev.org/#/c/677945/3Par -- Add Peer Persistence Support Please let us know if there are any concerns with these planned FFEs. Thanks! Jay (irc: jungleboyj)

1 0

[i18n][mogan][neutron][swift][tc][valet] Cleaning up IRC logging for defunct channels
by Jeremy Stanley 18 Sep '19

18 Sep '19

Freenode imposes a hard limit of 120 simultaneously joined channels for any single account. We've once again reached that limit with our channel-logging meetbot. As a quick measure, I've proposed a bit of cleanup: https://review.opendev.org/682500 Analysis of IRC channel logs indicates the following have seen 5 or fewer non-bot comments posted in the past 12 months and are likely of no value to continue logging: 5 #openstack-vpnaas 2 #swift3 2 #openstack-ko 1 #openstack-deployment 1 #midonet 0 #openstack-valet 0 #openstack-swg 0 #openstack-mogan Please let me know either here on the ML or with a comment on the review linked above if you have a reason to continue logging any of these channels. I'd like to merge it later this week if possible. Thanks! -- Jeremy Stanley

5 8

Re: [zuul3] zuul2 -> zuul3 migration
by Aditi Dukle1 18 Sep '19

18 Sep '19

Hi Lenny, Even I am working on zuulv2 to v3 migration for IBM PowerKVM - https://wiki.openstack.org/wiki/ThirdPartySystems/IBMPowerKVMCI and so far we have setup a test VM wherein we have installed zuulv3 and Nodepool version: 3.7.2 and have migrated 4 of our jenkins jobs to ansible to work with zuulv3. Zuulv3 doesn't have much info online apart from the official documentation but I found the following blogs quite useful while doing the migration: https://zuul-ci.org/docs/zuul/admin/quick-start.html - This is a very good installation tutorial to get a hang of zuulv3 that needs a single VM and it installs different components in docker containers. I started with this which helped me to understand how different components are configured. Also, the following articles are good read. 1. https://www.softwarefactory-project.io/cicd-workflow-offered-by-zuulnodepoo… 2. https://www.softwarefactory-project.io/zuul-hands-on-part-2-your-first-gate… 3. https://www.softwarefactory-project.io/zuul-hands-on-part-3-use-the-zuul-jo… Openstack has migrated to zuulv3, so you can also check out their project configuration here - https://opendev.org/openstack/project-config I am planning to write my experience of migration in a blog which I will let you know once complete. Let me know if you got any doubts while setting up zuulv3 Thanks and Regards, Aditi Dukle

1 0

regarding rabbitmq suspicious processes.
by Navid Bin Sakhawat 18 Sep '19

18 Sep '19

Hi! We are getting below status from rabbitmq. [root@controller1 ~]# rabbitmqctl eval 'rabbit_diagnostics:maybe_stuck().' 2019-09-18 18 <callto:2019-09-18 18>:08:55 There are 12374 processes. 2019-09-18 18 <callto:2019-09-18 18>:08:55 Investigated 2 processes this round, 5000ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:56 Investigated 2 processes this round, 4500ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:56 Investigated 2 processes this round, 4000ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:57 Investigated 2 processes this round, 3500ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:57 Investigated 2 processes this round, 3000ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:58 Investigated 2 processes this round, 2500ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:58 Investigated 2 processes this round, 2000ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:59 Investigated 2 processes this round, 1500ms to go. 2019-09-18 18 <callto:2019-09-18 18>:08:59 Investigated 2 processes this round, 1000ms to go. 2019-09-18 18 <callto:2019-09-18 18>:09:00 Investigated 2 processes this round, 500ms to go. 2019-09-18 18 <callto:2019-09-18 18>:09:00 Found 2 suspicious processes. 2019-09-18 18 <callto:2019-09-18 18>:09:00 [{pid,<10698.8499.10 <callto:10698.8499.10>>}, {registered_name,[]}, {current_stacktrace, [{timer,sleep,1,[{file,"timer.erl"},{line,153}]}, {rabbit_amqqueue,'-with/4-fun-0-',5, [{file,"src/rabbit_amqqueue.erl"},{line,469}]}, {rabbit_channel,handle_method,3, [{file,"src/rabbit_channel.erl"},{line,1323}]}, {rabbit_channel,handle_cast,2, [{file,"src/rabbit_channel.erl"},{line,470}]}, {gen_server2,handle_msg,2, [{file,"src/gen_server2.erl"},{line,1050}]}, {proc_lib,init_p_do_apply,3, [{file,"proc_lib.erl"},{line,247}]}]}, {initial_call,{proc_lib,init_p,5}}, {message_queue_len,2}, {links,[<10698.8496.10 <callto:10698.8496.10>>]}, {monitors, [{process,<10876.617.0>}, {process,<10698.3225.0 <callto:10698.3225.0>>}, {process,<10877.3228.0 <callto:10877.3228.0>>}]}, {monitored_by, [<10698.3225.0 <callto:10698.3225.0> >,<10877.293.0>,<10876.293.0>, <10698.8491.10 <callto:10698.8491.10>>,< 10698.21564.0 <callto:10698.21564.0>>,<10698.8670.0 <callto:10698.8670.0> >]}, {heap_size,4185}] 2019-09-18 18 <callto:2019-09-18 18>:09:00 [{pid,<10698.8521.10 <callto:10698.8521.10>>}, {registered_name,[]}, {current_stacktrace, [{timer,sleep,1,[{file,"timer.erl"},{line,153}]}, {rabbit_amqqueue,'-with/4-fun-0-',5, [{file,"src/rabbit_amqqueue.erl"},{line,469}]}, {rabbit_channel,handle_method,3, [{file,"src/rabbit_channel.erl"},{line,1323}]}, {rabbit_channel,handle_cast,2, [{file,"src/rabbit_channel.erl"},{line,470}]}, {gen_server2,handle_msg,2, [{file,"src/gen_server2.erl"},{line,1050}]}, {proc_lib,init_p_do_apply,3, [{file,"proc_lib.erl"},{line,247}]}]}, {initial_call,{proc_lib,init_p,5}}, {message_queue_len,2}, {links,[<10698.8518.10 <callto:10698.8518.10>>]}, {monitors, [{process,<10698.3225.0 <callto:10698.3225.0>>}, {process,<10876.617.0>}, {process,<10877.3228.0 <callto:10877.3228.0>>}]}, {monitored_by, [<10698.8513.10 <callto:10698.8513.10>>,< 10698.3225.0 <callto:10698.3225.0>>,<10877.293.0>, <10876.293.0>,<10698.8670.0 <callto:10698.8670.0> >,<10698.21564.0 <callto:10698.21564.0>>]}, {heap_size,4185}] Regards, *Navid Bin Sakhawat* Former Manager IT E.G Salary Ltd Mobile +880161559955 *5th Floor BGMEA Complex, Kawran Bazar, Dhaka. * *Former Engineer NOC* Mos 5 Tel Ltd. Plot-59, 61, Lotus Kamal Tower-2, Level-11, Gulshan-1, Dhaka-1212. *www.mos5tel.com <http://www.mos5tel.com>*

1 0