October 2020 - openstack-discuss - lists.openstack.org

[tripleo] TripleO CI Summary: Unified Sprint 34
by Rafael Folco 23 Oct '20

23 Oct '20

Greetings, The TripleO CI team has just completed **Unified Sprint 34** (Oct 02 thru Oct 22). The following is a summary of completed work during this sprint cycle: In the last sprint we had two major goals: #1 OpenStack Victoria release preparation and #2 Docker.io removal from upstream CI #1 OpenStack Victoria release preparation Integration and component pipelines have been created and prepared for the stable/victoria branching. Periodic jobs, promotion, configuration and monitoring changes have been merged in order to run victoria pipelines and promote builds. Upstream jobs will be branched in the next sprint. https://hackmd.io/sasvoKjTSkabGlFOTkK_kw #2 Docker.io removal from upstream CI Standalone, multinode, undercloud and upgrade jobs have been converted in consumers of the new content provider job. With this new dependency relation, artifacts are not pulled from external sources like docker.io. Instead, container images and rpm packages are built in the provider job using local registries, pulled to the consumer, and then discarded. https://hackmd.io/vRMVeZXZRgK5Vxqi6ENUDg Jobs across all TripleO repositories have been switched to the new content provider job. There are still changes in flight to make this happen for stable branches and CentOS7 jobs. This work should be completed in the next week. Content provider changes (80+): https://review.opendev.org/#/q/topic:new-ci-job Upstream promotions [1] Ruck/Rover recorded notes [2]. The planned work for the next sprint is to complete the work started in the previous sprint, and focuses on: - Finish switching to content provider on stable branches and CentOS7 jobs. - Branch upstream stable/victoria jobs. The Ruck and Rover for this sprint are Sagi Shnaidman (sshnaidm) and Sandeep Yadav (ysandeep). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes to be tracked in hackmd [3]. Thanks, --rfolco [1] http://dashboard-ci.tripleo.org/d/HkOLImOMk/upstream-and-rdo-promotions?org… [2] https://hackmd.io/1qxCqYzATfudl1cKvaQ8-w [3] https://hackmd.io/a_PhAlijTr-KTWHzGuf3qQ

1 0

[CloudKitty][ptg] PTG next week
by Rafael Weingärtner 23 Oct '20

23 Oct '20

Hi, Thanks to all of you who proposed some topics for our meeting at the PTG. I hope you are all enjoying the virtual summit this week. Next week is the virtual PTG, an event where we will reflect on the past release cycle and look forward to the next release, Wallaby, and beyond. The CloudKitty discussions at the PTG are organized in Etherpad [1]. The PTG meeting is free to attend, but please register [2] and add your name to the Etherpad. If you can't make all of the sessions, but are interested in specific topics, add your name to the topic to request an IRC ping. I am looking forward to seeing you all next week. Cheers, Rafael [1] https://etherpad.opendev.org/p/cloudkitty-ptg-wallaby [2] https://october2020ptg.eventbrite.com -- Rafael Weingärtner

1 0

[Diversity][PTG] Diversity and Inclusion WG at the PTG - Divisive Language
by Amy Marrich 23 Oct '20

23 Oct '20

The Diversity and Inclusion WG will be holding a PTG session Monday from 15:00-17:00 UTC. We will be using Meetpad[0] atleast to start but will change to Zoom if needed. Based on feedback [2] during the Forum session we will be working on providing a more comprehensive list of words and possible alternatives vs the original plan to leave this aspect within the technical groups. Thanks, Amy Marrich (spotz) 0 - https://meetpad.opendev.org/wallaby-ptg-diversity 1 - https://etherpad.opendev.org/p/wallaby-ptg-diversity 2 - https://etherpad.opendev.org/p/vSummit2020__DivisiveLanguage

1 0

Re: VM stuck in hard_reboot state
by Fabian Zimmermann 23 Oct '20

23 Oct '20

Hi, just forwarding your answer to the list - sorry for not using reply-all :( Is your nova-compute-agent on the hypervisor working as expected? (check the logs, restart) Are you able to reset the state? You should ensure the instance is not running somewhere else! https://docs.openstack.org/ocata/admin-guide/support-compute.html#reset-the… Fabian Am 23.10.20 um 14:16 schrieb Gregory SACRE: > Here they are: > > compute $ virsh list > Id Name State > -------------------- > > compute $ virsh list --all > Id Name State > ------------------------------------ > - instance-00000008 shut off > - instance-00000009 shut off > - instance-00000015 shut off > - instance-00000016 shut off > - instance-00000017 shut off > - instance-0000001c shut off > - instance-0000001d shut off > - instance-0000001e shut off > - instance-0000001f shut off > > controller $ openstack server show mediawiki > +-----------------------------+----------------------------------------------------------+ > | Field | Value > | > +-----------------------------+----------------------------------------------------------+ > | OS-DCF:diskConfig | AUTO > | > | OS-EXT-AZ:availability_zone | nova > | > | OS-EXT-STS:power_state | Running > | > | OS-EXT-STS:task_state | rebooting_hard > | > | OS-EXT-STS:vm_state | active > | > | OS-SRV-USG:launched_at | 2019-08-09T13:43:06.000000 > | > | OS-SRV-USG:terminated_at | None > | > | accessIPv4 | > | > | accessIPv6 | > | > | addresses | wiki-selfservice=172.16.1.54, > 192.168.150.154 | > | config_drive | > | > | created | 2019-08-09T13:32:49Z > | > | flavor | m2.large (7) > | > | hostId | > b8cbd9da0d28d67fff65b88405428269c97d8d27289e2f8ee35f5485 | > | id | 0e3eafb6-1b36-4e03-8548-8a3294d82c65 > | > | image | > | > | key_name | gsa-key > | > | name | mediawiki > | > | project_id | a5f2b77a4a8e499791ee981b991f2df3 > | > | properties | > | > | security_groups | name='teleport' > | > | | name='default' > | > | | name='global_http' > | > | status | HARD_REBOOT > | > | updated | 2020-10-23T08:50:09Z > | > | user_id | 16ea223cee1345dda504c8408c55fb2a > | > | volumes_attached | > id='bdfe4fc6-1e85-4b5d-b9b6-16147fbfc005' | > +-----------------------------+----------------------------------------------------------+ > > Thanks for the help! > > > Sorry for this question, but shouldn't I reply to the mailing list? > I'm new to this mailing list so I'm not 100% sure on the habits (I > have read the mailing list netiquette, but I prefer to ask first :-)) > > > On Fri, Oct 23, 2020 at 12:26 PM Fabian Zimmermann <dev.faz(a)gmail.com> wrote: >> >> Hi, >> >> could you dump the outputs of >> >> virsh list >> virsh list --all >> openstack server show >> >> Fabian >> >> Gregory SACRE <gregory.sacre(a)gmail.com> schrieb am Fr., 23. Okt. 2020, 12:16: >>> >>> Dear all, >>> >>> >>> I've been using Openstack (Ubuntu 18.04 install following Openstack documentation) for about a year in a lab at work. >>> I have one VM running 24/7 with Mediawiki on it (rest is for testing). >>> >>> It has been working fine until I updated packages yesterday. Here is the list of relevant packages that were updated: >>> >>> 2020-10-22 09:44:04 status installed neutron-common:all 2:14.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:06 status installed nova-common:all 2:19.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:12 status installed python3-nova:all 2:19.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:16 status installed python3-neutron:all 2:14.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:25 status installed neutron-linuxbridge-agent:all 2:14.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:29 status installed nova-compute-libvirt:all 2:19.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:44:35 status installed nova-compute-kvm:all 2:19.3.1-0ubuntu1~cloud0 >>> 2020-10-22 09:45:04 status installed nova-compute:all 2:19.3.1-0ubuntu1~cloud0 >>> >>> Since then, the VM does not respond (ping, ssh...). >>> I could list it (via Web interface or controller command line) and it showed as ACTIVE. >>> I rebooted the server thinking maybe something was stuck. The server came back online, the VM still ACTIVE but cannot connect to it. >>> My next step was to hard reboot the VM. Since then, the VM is in HARD_REBOOT state and would not move from there. I tried to shut it down, restart again the server, but no, nothing changes. When I try to shut it down it says it cannot as it is in hard reboot state. >>> >>> I would at least like to be able to save some stuff that's on it (I know, I should have backed it up before the update...). >>> My Google searches on "openstack vm stuck hard reboot" did not help... >>> >>> Do not hesitate if you need more info. >>> Any help would really be appreciated! >>> >>> >>> Kr, >>> >>> Gregory

1 0

[puppet] Gerrit breach and commit audit
by Takashi Kajinami 23 Oct '20

23 Oct '20

Hello, As suggested by the recent announcement[1], I started walking through the commits for puppet-openstack repos. [1] https://etherpad.opendev.org/p/puppet-gerrit-breach-audit You can find the progress in the etherpad below[2]. [2] https://etherpad.opendev.org/p/puppet-gerrit-breach-audit I'll update this thread once I complete checking all, but I would appreciate your help about some of the repos because we have so many repos here. Thank you, Takashi

2 2

VM stuck in hard_reboot state
by Gregory SACRE 23 Oct '20

23 Oct '20

Dear all, I've been using Openstack (Ubuntu 18.04 install following Openstack documentation) for about a year in a lab at work. I have one VM running 24/7 with Mediawiki on it (rest is for testing). It has been working fine until I updated packages yesterday. Here is the list of relevant packages that were updated: 2020-10-22 09:44:04 status installed neutron-common:all 2:14.3.1-0ubuntu1~cloud0 2020-10-22 09:44:06 status installed nova-common:all 2:19.3.1-0ubuntu1~cloud0 2020-10-22 09:44:12 status installed python3-nova:all 2:19.3.1-0ubuntu1~cloud0 2020-10-22 09:44:16 status installed python3-neutron:all 2:14.3.1-0ubuntu1~cloud0 2020-10-22 09:44:25 status installed neutron-linuxbridge-agent:all 2:14.3.1-0ubuntu1~cloud0 2020-10-22 09:44:29 status installed nova-compute-libvirt:all 2:19.3.1-0ubuntu1~cloud0 2020-10-22 09:44:35 status installed nova-compute-kvm:all 2:19.3.1-0ubuntu1~cloud0 2020-10-22 09:45:04 status installed nova-compute:all 2:19.3.1-0ubuntu1~cloud0 Since then, the VM does not respond (ping, ssh...). I could list it (via Web interface or controller command line) and it showed as ACTIVE. I rebooted the server thinking maybe something was stuck. The server came back online, the VM still ACTIVE but cannot connect to it. My next step was to hard reboot the VM. Since then, the VM is in HARD_REBOOT state and would not move from there. I tried to shut it down, restart again the server, but no, nothing changes. When I try to shut it down it says it cannot as it is in hard reboot state. I would at least like to be able to save some stuff that's on it (I know, I should have backed it up before the update...). My Google searches on "openstack vm stuck hard reboot" did not help... Do not hesitate if you need more info. Any help would really be appreciated! Kr, Gregory

1 0

Keystone with AzureAD as openid provider - JWT token could not be validated
by Robert Duncan 23 Oct '20

23 Oct '20

Found this when trying OS_AUTH_TYPE="v3oidcpassword" For anybody using AzureAD as idp in Keystone, it is not OIDC compliant - surprised? keystone will not validate tokens as they are signed for MS graph API essentially it results in "Apache WWW-Authenticate: Bearer error="invalid_token", error_description="JWT token could not be validated" keystone attempts to validate the tokens from the metadata using whatever if finds in https://login.microsoftonline.com/<tenant-guid>/v2.0/.well-known/openid-configuration<https://login.microsoftonline.com/6edb49c1-bf72-4eea-8b3f-a7fd0a25b68c/v2.0…> or using an Apache variable in wsgi-keystone.conf called OIDCOAuthVerifyJwksUri for example - it will reach here https://login.microsoftonline.com/<tenant-guid>/discovery/v2.0/keys<https://login.microsoftonline.com/6edb49c1-bf72-4eea-8b3f-a7fd0a25b68c/disc…> and find keys - however it won't be able to validate the token as MS inserts a nonce before signing them - i.e. the tokens can only be validated by ms graph additionally, if you try to validate the tokens locally on keystone using Apache variable OIDCOAuthVerifyCertFiles the keys can rotate without warning. The solution is using the app registration portal in Azure and modify the app registration by selecting 'expose an API' and add a scope - then request this scope on the client using apache variable 'OIDCScope' https://medium.com/@abhinavsonkar/making-azure-ad-oidc-compliant-5734b70c43… Rob Duncan. ________________________________ The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance. ________________________________

1 0

[kuryr][ptg] virtual PTG
by Maysa De Macedo Souza 23 Oct '20

23 Oct '20

Hello, With the PTG approaching, I would like to encourage you to look at the PTG etherpad [1] and add any topics you want to discuss (please mention your name and IRC nickname). Even if you won't be able to attend the PTG, feel free to add the topic so it gets discussed. The Kuryr meeting[2] will happen at 7 UTC-8 UCT on October 27 at the Grizzly room. Cheers, Maysa Macedo [1] https://etherpad.openstack.org/p/wallaby-ptg-kuryr [2] http://ptg.openstack.org/ptg.html

1 0

[manila] PTG Schedule has been updated
by Goutham Pacha Ravi 23 Oct '20

23 Oct '20

Hello Zorillas and all interested stackers, Thanks for making your topic proposals on the planning etherpad [1]. You will notice that [1] has the re-arranged list of topics by their intended time slots. Please take a look and call out any issues you may have against your topics, or topics that may interest you. As is tradition, we won't have time to accommodate the whole schedule, but we'll try to pick up any new topics and languishing issues that haven't made it to the schedule with best effort. If we cannot address them at the PTG, i'll make sure to bring them to our weekly IRC meetings. Please save the bookmark to the live PTG schedule: http://ptg.openstack.org/ptg.html and subscribe to PTG bot updates so you don't miss the action! Looking forward to seeing you all there! Thanks, Goutham [1] https://etherpad.opendev.org/p/wallaby-ptg-manila-planning

1 1

[puppet] Gerrit breach and commit audit
by Tobias Urdin 23 Oct '20

23 Oct '20

Hello, As per the announcement in [1] I have audited all changes to Puppet OpenStack repositories. [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html

1 0