October 2020 - openstack-discuss - lists.openstack.org

[Security SIG] No meeting this week or next week
by Gage Hugo 20 Oct '20

20 Oct '20

Hello everyone, due to the summit and PTG there will be no meeting this week or next week. We will meet again on November 5th at the usual time, thanks!

1 0

Forum Etherpads
by Kendall Nelson 20 Oct '20

20 Oct '20

Hello All! I wanted to encourage you to add your etherpads to the wiki for the Forum[1] like we normally do. Sorry I didn't sooner! -Kendall Nelson [1] https://wiki.openstack.org/wiki/Forum/Virtual2020

1 0

[announce][debian][victoria] general availability of OpenStack Victoria in Debian
by Thomas Goirand 20 Oct '20

20 Oct '20

Hi! It's my pleasure to announce the general availability of OpenStack Victoria in Debian. I've just finished uploading everything to Debian Unstable today, and the Buster backports are available the usual way, for example using extrepo (which is in the official Debian backports): apt-get install extrepo extrepo enable openstack_victoria apt-get update ... or directly setting-up the buster-victoria.debian.net repository the usual way. New in this release =================== As all projects are deprecating the policy.json files, all of the services are now using a /etc/<PROJECT>/policy.d/00_default_policy.yaml. The normal /etc/<PROJECT>/policy.json will be automatically deleted, as it can be a problem if it remains. Looking backward, a sensible rename to get the file away would have been nicer to Debian users, so this will be implemented soonish. Implementation in openstack-cluster-installer ============================================= Victoria can already be installed by OCI. The only issue that remains to be fixed, is puppet-openstack setting-up a /etc/keystone/puppet.conf wrongly in the controllers. Once the file contains the correct things, deployment can go on. Also, it looks like LVM volume nodes still need some fixes. Apart from these early glitches, everything seems working smoothly so far, and of course, these will be addressed soon. I'll be testing upgrades using the usual oci-cluster-upgrade-openstack-release script. Testing Victoria over Bullseye and Python 3.9 ============================================= The day OpenStack was released, Python 3.9 was uploaded to Debian Unstable. I've already sent a few patches to address some problems, but I haven't yet fully deployed OpenStack on top of Bullseye. Since Victoria will be the release for Bullseye, I will spend time polishing all of this before the forthcoming freeze in February. Hopefully, I'll also be able to finish scripting for upgrading a cluster from Buster to Bullseye before the freeze, just like one was shipped in OCI for Stretch to Buster upgrades. Cheers, Thomas Goirand (zigo)

1 0

Re: CentOS 8 Ussuri can't launch instance /usr/libexec/qemu-kvm: Permission denied
by Oliver Weinmann 19 Oct '20

19 Oct '20

Ok, I will try to disable selinux and deploy one more compute node. I just stumbled across another issue, not sure if it is related. The instance seems to be deployed just fine but now I looked on the console and neither cirros nor centos 7 seem to be booting up correctly. on cirros i see an error: [ 0.846019] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) ]--- and on centos7: error: not a correct XFS inode. I tried to create with ephemeral and volume. Cheers, Oliver Am 19. Oktober 2020 um 16:09 schrieb Alex Schultz <aschultz(a)redhat.com>: On Mon, Oct 19, 2020 at 7:59 AM Oliver Weinmann <oliver.weinmann(a)me.com> wrote: First of all thanks a lot for the quick reply. I just checked and it seems that the package is really not available for centos8 from the upstream repo: https://centos.pkgs.org/8/centos-appstream-x86_64/podman-1.6.4-15.module_el… When you say it should be available via rdo, does this mean I have to add or use a different repo when deploying undercloud / overcloud? I have followed the tripleo guide to deploy it: I thought we shipped it, maybe we don't because we run with selinux disabled so it doesn't show up in CI. https://docs.openstack.org/tripleo-docs/latest/ And is there a way to disable selinux on all overcloud nodes by default? I guess it is the default to disable it? Set the following in an environment file as part of the deployment: parameter_defaults: SELinuxMode: permissive Cheers, Oliver Am 19. Oktober 2020 um 15:29 schrieb Alex Schultz <aschultz(a)redhat.com>: On Mon, Oct 19, 2020 at 7:09 AM Oliver Weinmann <oliver.weinmann(a)me.com> wrote: Hi all, I have successfully deployed the overcloud many many times, but this time I have a strange behaviour. Whenever I try to launch an instance it fails. I checked the logs on the compute node and saw this error: Failed to build and run instance: libvirt.libvirtError: internal error: process exited while connecting to monitor: libvirt: error : cannot execute binary /usr/libexec/qemu-kvm: Permission denied googling led me to the solution to disable selinux: setenforce 0 I have not made this change persistent yet, as I would like to know why I'm facing this issue right now. What is actually the default for the overcloud nodes SeLinux? Enforcing, permissive or disabled? I build the ipa and overcloud image myself as I had to include drivers. Is this maybe the reason why SeLinux is now enabled, but is actually disabled when using the default ipa images? From a TripleO perspective, we do not officially support selinux enabled when running with CentOS. In theory it should work, however it is very dependent on versions. I think you're likely running into an issue with the correct version of podman which is likely causing this. We've had some issues as of late which require a very specific version of podman in order to work correctly with nova compute when running with selinux enabled. You need 1.6.4-15 or higher which I don't think is available with centos8. It should be available via RDO. Related: https://review.opendev.org/#/c/736173/ Thanks and Best Regards, Oliver

1 0

Introducing the Open Infrastructure Foundation
by Kendall Nelson 19 Oct '20

19 Oct '20

Hello Everyone, If you’re not watching the Open Infrastructure Summit keynotes right now, you just missed some big news (and it’s not too late to tune in <https://www.youtube.com/watch?v=wNNOFfDBB0o&ab_channel=OpenStackFoundation>!). Jonathan Bryce just announced the Open Infrastructure Foundation (OIF) <http://openinfra.dev> as the successor to the OpenStack Foundation (OSF). The name change reflects all of our community’s work building open infrastructure with dozens of open source components, and we could not have done it without your help. We look forward to continuing to collaborate with you over the next decade to build open source communities that write software for production. The Summit keynotes <https://www.youtube.com/watch?v=wNNOFfDBB0o&ab_channel=OpenStackFoundation> are still going on the YouTube live stream, so login now to hear more about this announcement and how OpenStack and other open source projects fit into the next decade of open infrastructure. You can also watch Imtiaz present an update today on what the community is doing and support them in the chat as they encourage Summit attendees to participate. Tomorrow Dawson Coleman and myself will also be presenting on the community and the last two releases. And if you haven’t already, join as an individual member <http://openinfra.dev/join> so you can get involved! Let’s get started! -Kendall Nelson (diablo_rojo) Upstream Developer Advocate The Open Infrastructure Foundation

1 0

Summit issues
by Kanevsky, Arkady 19 Oct '20

19 Oct '20

I was able to join summit. But I am perpetually stuck in "checking credentials..." Any recommendations? Thanks, Arkady

7 6

Re: CentOS 8 Ussuri can't launch instance /usr/libexec/qemu-kvm: Permission denied
by Oliver Weinmann 19 Oct '20

19 Oct '20

First of all thanks a lot for the quick reply. I just checked and it seems that the package is really not available for centos8 from the upstream repo: https://centos.pkgs.org/8/centos-appstream-x86_64/podman-1.6.4-15.module_el… When you say it should be available via rdo, does this mean I have to add or use a different repo when deploying undercloud / overcloud? I have followed the tripleo guide to deploy it: https://docs.openstack.org/tripleo-docs/latest/ And is there a way to disable selinux on all overcloud nodes by default? I guess it is the default to disable it? Cheers, Oliver Am 19. Oktober 2020 um 15:29 schrieb Alex Schultz <aschultz(a)redhat.com>: On Mon, Oct 19, 2020 at 7:09 AM Oliver Weinmann <oliver.weinmann(a)me.com> wrote: Hi all, I have successfully deployed the overcloud many many times, but this time I have a strange behaviour. Whenever I try to launch an instance it fails. I checked the logs on the compute node and saw this error: Failed to build and run instance: libvirt.libvirtError: internal error: process exited while connecting to monitor: libvirt: error : cannot execute binary /usr/libexec/qemu-kvm: Permission denied googling led me to the solution to disable selinux: setenforce 0 I have not made this change persistent yet, as I would like to know why I'm facing this issue right now. What is actually the default for the overcloud nodes SeLinux? Enforcing, permissive or disabled? I build the ipa and overcloud image myself as I had to include drivers. Is this maybe the reason why SeLinux is now enabled, but is actually disabled when using the default ipa images? From a TripleO perspective, we do not officially support selinux enabled when running with CentOS. In theory it should work, however it is very dependent on versions. I think you're likely running into an issue with the correct version of podman which is likely causing this. We've had some issues as of late which require a very specific version of podman in order to work correctly with nova compute when running with selinux enabled. You need 1.6.4-15 or higher which I don't think is available with centos8. It should be available via RDO. Related: https://review.opendev.org/#/c/736173/ Thanks and Best Regards, Oliver

2 1

Divisive Language stance final(?) draft and Forum session
by Amy Marrich 19 Oct '20

19 Oct '20

Hi everyone, Below is what we hope is the final draft of the OSF's stance on Divisive Language. If you have any comments please place them on the etherpad[0] and/or join us this Tuesday during the forum[1]. Please note that decisions related to what words should be replaced with are being left with the project's technical leadership with the knowledge that context is important to determine the best alternative. That said, the Diversity and Inclusion WG will be available to assist these groups. Thanks, Amy Marrich (spotz) 0 - https://etherpad.opendev.org/p/divisivelanguage 1- https://www.openstack.org/summit/2020/summit-schedule/events/24778/divisive… 1a - https://zoom.us/j/94295083896?pwd=VmZCTFN3eERDK1ltRHRyWDl0eG1hZz09 1b - https://etherpad.opendev.org/p/vSummit2020__DivisiveLanguage ------------------ The OpenStack Foundation (OSF) Board of Directors supports removal of wording identified as oppressive, racist and sexist by members of our communities from the software and documentation they produce. While we know there will be challenges, both technical and non-technical, this is an action we feel is important. These efforts are the responsibility of the various technical leadership groups within our communities, and we trust them to make appropriate decisions about applicability, timelines, minimizing impact to users and operators, and choosing the changes that make the most sense for their projects. Contributors will take care to make changes to software in the least disruptive way possible. While standardized wording is a laudable goal, we recognize that different implementation contexts might require different solutions. In many cases the work is also complicated by external dependencies for these projects, and their capacity to make necessary changes before we can implement ours. Terminology to which special attention should be paid includes: 1. The use of "slave," or "master" in reference to slavery-oriented relationships, as is currently found in databases, the domain name system, etc. 1. The terms "blacklist" and "whitelist" in various contexts (which might require a variety of different replacements to make sense for those contexts) 1. The use of "master" in non-slavery-related contexts such as revision control branches and documentation builds (pending feedback from our community members) We shall continue to be vigilant for other language areas that cause challenges and work with the community to evolve this policy.

2 1

CentOS 8 Ussuri can't launch instance /usr/libexec/qemu-kvm: Permission denied
by Oliver Weinmann 19 Oct '20

19 Oct '20

Hi all, I have successfully deployed the overcloud many many times, but this time I have a strange behaviour. Whenever I try to launch an instance it fails. I checked the logs on the compute node and saw this error: Failed to build and run instance: libvirt.libvirtError: internal error: process exited while connecting to monitor: libvirt: error : cannot execute binary /usr/libexec/qemu-kvm: Permission denied googling led me to the solution to disable selinux: setenforce 0 I have not made this change persistent yet, as I would like to know why I'm facing this issue right now. What is actually the default for the overcloud nodes SeLinux? Enforcing, permissive or disabled? I build the ipa and overcloud image myself as I had to include drivers. Is this maybe the reason why SeLinux is now enabled, but is actually disabled when using the default ipa images? Thanks and Best Regards, Oliver

2 1

[tripleo][ironic] fails to introspect: my fsm encountered an exception
by Ruslanas Gžibovskis 19 Oct '20

19 Oct '20

Hi all, I have a clean undercloud deployment. but when I add a node, it fails to introspect. in ironic logs I see interesting lines about FSM (what is it?) [1] and in the same paste, I have provided/pasted, how openstack overcloud node import instack.json looks like. [1] http://paste.openstack.org/show/uPwWVYlO3UQbrF0WzDFH/ -- Ruslanas Gžibovskis +370 6030 7030

3 14