October 2020 - openstack-discuss - lists.openstack.org

[octavia] PTG planning
by Michael Johnson 07 Oct '20

07 Oct '20

Hello Octavia community! I have set up a time slot during the Wallaby PTG to discuss all things Octavia on October 27th and 28th, 13:00-17:00 UTC. There is an Octavia etherpad for PTG planning: https://etherpad.opendev.org/p/wallaby-ptg-octavia Please add your topics to the list and I will try to set a rough agenda. Michael

1 0

[designate] PTG planning
by Michael Johnson 07 Oct '20

07 Oct '20

Hello Designate community! I have set up a time slot during the Wallaby PTG to discuss all things Designate on October 29th, 13:00-15:00 UTC. I have also created an etherpad for PTG planning: https://etherpad.opendev.org/p/wallaby-ptg-designate Please add your topics to the list and I will try to set a rough agenda. Michael

1 0

[nova][ops] The need for healing instance info cache to base itself on neutron for its port list
by Jean-Philippe Méthot 07 Oct '20

07 Oct '20

Hi, This is related to bug https://bugs.launchpad.net/nova/+bug/1751923 <https://bugs.launchpad.net/nova/+bug/1751923> . I don’t see if this was fixed in more recent versions as we are running Rocky, but according to the different code reviews linked to the bug report, this was never committed into Openstack master. I apologize in advance if this was already fixed elsewhere (it’s marked as fixed in Stein, but the reviews say the code was never committed?). Essentially, we’re running into a production issue where sometimes, after being shutdown for a while, our VMs ports just straight up disappear from Nova. Obviously, since this is production, we have to scramble to link back the port to the VM to bring the VM back up. As a result, we have not identified yet the exact source of our issue. However, we do have tested Mohammed Naser’s patch linked to this issue and it has at the very least offered us a band-aid since the VMs appear to be keeping their ports now. Would it be possible to review and commit this patch or Matt Riedeman’s patch to master and backport it? Couldn’t it just have a configuration option to enable it? While I’m not convinced it can fix the root cause of our problem, it could at least contribute to the stability of our and other people’s Openstack cluster. Jean-Philippe Méthot Senior Openstack system administrator Administrateur système Openstack sénior PlanetHoster inc. 4414-4416 Louis B Mayer Laval, QC, H7P 0G1, Canada TEL : +1.514.802.1644 - Poste : 2644 FAX : +1.514.612.0678 CA/US : 1.855.774.4678 FR : 01 76 60 41 43 UK : 0808 189 0423

3 3

[requirements][all] requirements is unfrozen, cycle trailing beware
by Matthew Thode 07 Oct '20

07 Oct '20

Hi all, The requirements project just branched stable/victoria meaning that we are also now unfrozen and open for business. This also means that non-branched (cycle trailing) projects will need to watch out for constraints updates meant for wallaby (now master) could impact your development work on victoria. -- Matthew Thode

1 0

[tripleo][undercloud] use local container images in insecure repo
by Ruslanas Gžibovskis 06 Oct '20

06 Oct '20

Hi all, I have been trying to use containers from local container image repo which is insecure, but it is always trying to use TLS version, and I do not have https there. even if I would have, I would not have CERT signed, so still it is insecure. It is always trying to access over WWW:443. my registries.conf [1] and I am able to fetch image from the registry [1] and my container image prepare file contains updated repos, I have even added insecure: true any tips? I am following [2] and [3] [1] http://paste.openstack.org/show/cYQM2k77bIh14Zzr5Kjn/ [2] https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/deploym… [3] https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16… -- Ruslanas Gžibovskis +370 6030 7030

2 4

[Trove] Project udpate
by Lingxian Kong 06 Oct '20

06 Oct '20

Hi there, As the official Victoria release is approaching and it has been a long time silence for Trove in the upstream, I think it's good time for me as the Trove PTL for the last 3 dev cycles to have a project update. The things that will be described below have not been achieved in one single dev cycle, but are some significant changes since the 'dark time' of Trove project in the past. Tips hat to those who have made contributions to Trove project ever before. ## Service tenant configuration Service tenant configuration was added in Stein release, before that, it's impossible to deploy Trove in the public cloud (even not for some private cloud due to security concerns) because the user may have access to the guest instance which contains sensitive data in the config files, the users can also perform operations towards either storage or networking resources which may bring much management overhead and make it easy to break the database functionality. With service tenant configuration (which is currently the default setting in devstack), almost all the cloud resources(except the Swift objects for backup data) created for a Trove instance are only visible to the Trove service user. As Trove users, they can only see a Trove instance, but know nothing about the Nova VM, Cinder volume, Neutron management network, and security groups under the hood. The only way to operate Trove instances is to interact with Trove API. ## Message queue security concerns To do database operations, trove controller services communicate with trove-guestagent service inside the instance via message queue service (i.e. RabbitMQ in most environments). In the meantime, trove-guestagent periodically sends status update information to trove-conductor through the same messaging system. In the current design, the RabbitMQ username and password need to be configured in the trove-guestagent config file, which brought significant security concern for the cloud deployers in the past. If the guest instance is compromised, then guest credentials are compromised, which means the messaging system is compromised. As part of the solution, a security enhancement was introduced in the Ocata release, using encryption keys to protect the messages between the control plane and the guest instances. First, the rabbitmq credential should only have access to trove services. Second, even with the rabbitmq credential and the message encryption key of the particular instance, the communication from the guest agent and trove controller services are restricted in the context of that particular instance, other instances are not affected as the malicious user doesn't know their message encryption keys. Additionally, since Ussuri, trove is running in service tenant model in devstack by default which is also the recommended deployment configuration. Most of the cloud resources(except the Swift objects for backup data) created for a trove instance should only be visible to the trove service user, which also could decrease the attack surface. ## Datastore images Before Victoria, Trove provided a bunch of diskimage-builder elements for building different datastore images. As contributors were leaving, most of the elements just became unmaintained except for MySQL and MariaDB. To solve the problem, database containerization was introduced in Victoria dev cycle, so that the database service is running in a docker container inside the guest instance, trove guest agent is pulling container image for a particular datastore when initializing guest instance. Trove is not maintaining those container images. That means, since Victoria, the cloud provider only needs to maintain one single datastore image which only contains common code that is datastore independent. However, for backward compatibility, the cloud provider still needs to create different datastores but using the same Glance image ID. Additionally, using database container also makes it much easier for database operations and management. To upgrade from the older version to Victoria onwards, the Trove user has to create backups before upgrading, then create instances from the backup, so downtime is expected. ## Supported datastores Trove used to support several datastores such as MySQL, MariaDB, PostgreSQL, MongoDB, CouchDB, etc. Most of them became unmaintained because of a lack of maintainers in the community. Currently, only MySQL and MariaDB drivers are fully supported and tested in the upstream. PostgreSQL driver was refactored in Victoria dev cycle and is in experimental status again. Adding extra datastores should be quite easy by implementing the interfaces between trove task manager and guest agent. Again, no need to maintain separate datastore images thanks to the container technology. ## Instance backup At the same time as we were moving to use container for database services, we also moved the backup and restore functions out of trove guest agent code because the backup function is usually using some 3rd party software which we don't want to pre-install inside the datastore image. As a result, we are using container as well for database backup and restore. For more information about the backup container image, see https://lingxiankong.github.io/2020-04-14-database-backup-docker-image.html. ## Others There are many other improvements not mentioned above added to Trove since Train, e.g. * Access configuration for the instance. * The swift backend customization for backup. * Online volume resize support. * XFS disk format for database data volume. * API documentation improvement. * etc. By the way, Catalyst Cloud has already deployed Trove (in Alpha) in our public cloud in New Zealand, we are getting feedback from customers. I believe there are other deployers already have Trove in their production but running an old version because of previous upstream situation in the past. If you are one of them and interested in upgrading to the latest, please either reply to this email or send personal email to me, I would be very happy to provide any help or guidance. For those who are still in evaluation phase, you are also welcome to reach out for any questions. I'm always in the position to help in #openstack-trove IRC channel. --- Lingxian Kong Senior Software Engineer Catalyst Cloud www.catalystcloud.nz

2 1

[tripleo][ci] RFC, supported releases of TripleO
by Wesley Hayutin 06 Oct '20

06 Oct '20

Greetings, I just wanted to give folks the opportunity to speak up before we make any changes. Please review https://releases.openstack.org/ As we are branching master -> victoria it looks like we can definitely remove stable/rocky from both upstream and RDO software factory. Any comments about rocky? Stein is end of maintenance on 2020 November 11th. Any thoughts on dropping stein from upstream and rdo software factory? Thanks! Please be specific if you have comments as to which release you are referring to.

4 5

Modify devstack after basic deployment
by Md. Hejbul Tawhid MUNNA 06 Oct '20

06 Oct '20

Hi, I have deployed a basic openstack using devstack. now I want to install additional component like designate or magnum. What is the way to do that? Regards, Munna

2 1

[nova]: Separation of VM size and extra specs in flavors
by Csatari, Gergely (Nokia - FI/Espoo) 06 Oct '20

06 Oct '20

Hi, During some discussions about CNTT<https://cntt.readthedocs.io/>, where several flavor sizes and extra specs are specified we realized, that the combination of all flavor sizes and the different extra specs results in a very large number of flavors. One idea was to separate the size and the extra specs on the creation of flavors and just define some kind of rules do define how the different sizes and extra specs can be combined. The other idea was just to leave things as they are. Are there any opinions on which idea is better? Thanks, Gerg0

2 1

[tripleo][ussuri][release] bugfix stable/ussuri release for tripleo 'cycle-with-intermediary'
by Marios Andreou 06 Oct '20

06 Oct '20

o/ tripleo On request I made a bugfix stable/ussuri release for the tripleo 'cycle-with-intermediary' repos. If you are interested see [1] for the latest hashes. If you need a release for a different branch reach out to me. thanks, marios [1] https://review.opendev.org/#/c/755718/

1 0

[Neutron] Cancelled QoS team meeting October 6
by Rodolfo Alonso Hernandez 06 Oct '20

06 Oct '20

Hello: Due to the lack of agenda, the Neutron QoS meeting will be cancelled today. Next meeting will be held on October 20. Regards.

1 0

qemu ussuri can't launch instance
by ops＠clustspace.com 06 Oct '20

06 Oct '20

Hello, Does anyone know where to find the problem? Searched few days in google :) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [req-f16a5b6c-3475-4322-a664-45f3bd9c041a cb4c181d25a14dda958e40792968f97e 5242bcab73714ab192cca8d909b72e9a - default default] [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] Instance failed to spawn: libvirt.libvirtError: internal error: cannot load AppArmor$ 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] Traceback (most recent call last): 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/compute/manager.py", line 2614, in _build_resources 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] yield resources 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/compute/manager.py", line 2378, in _build_and_run_instance 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] accel_info=accel_info) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 3580, in spawn 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] power_on=power_on) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 6438, in _create_domain_and_network 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] destroy_disks_on_failure) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/oslo_utils/excutils.py", line 220, in __exit__ 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] self.force_reraise() 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/oslo_utils/excutils.py", line 196, in force_reraise 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] six.reraise(self.type_, self.value, self.tb) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/six.py", line 703, in reraise 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] raise value 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 6410, in _create_domain_and_network 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] post_xml_callback=post_xml_callback) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/driver.py", line 6351, in _create_domain 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] guest.launch(pause=pause) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/guest.py", line 142, in launch 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] self._encoded_xml, errors='ignore') 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/oslo_utils/excutils.py", line 220, in __exit__ 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] self.force_reraise() 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/oslo_utils/excutils.py", line 196, in force_reraise 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] six.reraise(self.type_, self.value, self.tb) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/six.py", line 703, in reraise 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] raise value 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/nova/virt/libvirt/guest.py", line 137, in launch 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] return self._domain.createWithFlags(flags) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/eventlet/tpool.py", line 193, in doit 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] result = proxy_call(self._autowrap, f, *args, **kwargs) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/eventlet/tpool.py", line 151, in proxy_call 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] rv = execute(f, *args, **kwargs) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/eventlet/tpool.py", line 132, in execute 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] six.reraise(c, e, tb) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/six.py", line 703, in reraise 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] raise value 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/eventlet/tpool.py", line 86, in tworker 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] rv = meth(*args, **kwargs) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] File "/usr/lib/python3/dist-packages/libvirt.py", line 1265, in createWithFlags 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] if ret == -1: raise libvirtError ('virDomainCreateWithFlags() failed', dom=self) 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f] libvirt.libvirtError: internal error: cannot load AppArmor profile 'libvirt-63bb4205-fcbb-4f2b-9ade-e055e7ff966f' 2020-10-05 23:11:04.054 1585 ERROR nova.compute.manager [instance: 63bb4205-fcbb-4f2b-9ade-e055e7ff966f]

3 2

[neutron] Security groups with SR-IOV as a second ML2 mechanism driver
by GABRIEL OMAR GAMERO MONTENEGRO 06 Oct '20

06 Oct '20

Dear all, I'm planning to use the SR-IOV Networking L2 Agent with another L2 Agent as Open vSwitch or Linux Bridge (a configuration with multiple ML2 mechanism drivers). Does anybody know if I can use the Open vSwitch or Linux Bridge L2 agents with security group feature (implemented with iptables firewall driver or Native Open vSwitch firewall driver)? Or am I restricted to apply no security to my instances because SR-IOV L2 agent is being used as a second mechanism driver in the same OpenStack deployment? Thanks in advance, Gabriel Gamero

3 2

[tc] weekly update
by Mohammed Naser 06 Oct '20

06 Oct '20

Hi everyone, Here's an update for what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Select Prvisep as the Wallaby Goal https://review.opendev.org/755590 - Add assert:supports-standalone https://review.opendev.org/722399 - Add Ironic charms to OpenStack charms https://review.opendev.org/754099 - Clarify impact on releases for SIGs https://review.opendev.org/752699 - Add election schedule exceptions in charter https://review.opendev.org/751941 ## Project Updates - Retire devstack-plugin-pika project https://review.opendev.org/748730 - Retire openstack/os-loganalyze https://review.opendev.org/753834 ## General Changes - Define TC-approved release in a resolution https://review.opendev.org/752256 - Reorder repos alphabetically https://review.opendev.org/754097 - Remove tc:approved-release tag https://review.opendev.org/749363 - Migrate rpm-packaging to a SIG https://review.opendev.org/752661 # Other Reminders - PTG Brainstorming: https://etherpad.opendev.org/p/tc-wallaby-ptg - PTG Registration: https://october2020ptg.eventbrite.com Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0

[tc][all][interop] Removed the 'tc:approved-release' tag in favor of projects.yaml
by Ghanshyam Mann 06 Oct '20

06 Oct '20

Hello Everyone, TC has merged the recent change to remove the 'tc:approved-release' tag[1]. This tag was used as the superset of projects used by the OpenStack Foundation when creating commercial trademark programs. Basically, this tag was used to know if the project under OpenStack governance is mature and follows the defined release model so that it can be considered as a possible candidate for trademark programs. This situation was in the early stage of OpenStack when we used to have incubated vs integrated project status but now everything in projects.yaml[2] file is considered as mature, following release, active. We do not need any changes in the bylaw as all projects listed in projects.yaml file is applicable as bylaw term "OpenStack Technical Committee Approved Release" which is made clear in the resolution also[3]. Interop group can refer to the OpenStack governed projects list for possible candidates for the trademark program. [1] https://review.opendev.org/#/c/749363/ [2] https://governance.openstack.org/tc/reference/projects/ [3] https://governance.openstack.org/tc/resolutions/20200920-tc-approved-releas… -gmann

1 0

[cloudkitty] Joining the "CloudKitty Drivers" Launchpad team
by Pierre Riteau 05 Oct '20

05 Oct '20

Hello, While CloudKitty has moved to Storyboard to track its bugs [1], there is still a lot of content under the Launchpad project [2], including years of bug reports, blueprints, etc. As PTL, I would like to be able to administer the CloudKitty Launchpad project. I have requested access to the "CloudKitty Drivers" Launchpad team [3], but haven't heard back. I see some people have been on the waiting list for years [4]. Since the "OpenStack Administrators" team [5] is the owner "CloudKitty Drivers", would one of its members be able to grant me access? Many thanks, Pierre Riteau (priteau) [1] https://storyboard.openstack.org/#!/project/890 [2] https://launchpad.net/cloudkitty [3] https://launchpad.net/~cloudkitty-drivers [4] https://launchpad.net/~cloudkitty-drivers/+members#proposed [5] https://launchpad.net/~openstack-admins

3 9

Re: [charms] Zaza bundle tests
by Aurelien Lourot 05 Oct '20

05 Oct '20

Wasn't one of the reasons for this that we're striving to have stand-alone / complete bundles? So that we could "just give" the one-file bundle to someone and it would "just work". Anyway I'm also in favour of any solution leading to less repetition, i.e. what was suggested by Xav. Aurelien

1 0

[ptl][release] Wrapping up Victoria
by Sean McGinnis 05 Oct '20

05 Oct '20

Hey everyone, We are getting close to being done with the Victoria development cycle. This is one more reminder that there are just a few days left to finish up any critical work. This Thursday, October 8, is the deadline for any new release candidate releases for any cycle-based services. After Thursday, no new releases should occur for Victoria development until the final coordinated release next Wednesday. After this Thursday, the release team will be proposing a patch to re-tag the last RC release of each deliverable to be the final version for Victoria. We encourage PTLs to +1 this patch to capture that metadata with the release. This is not the time to -1 the patch and ask for more time to push anything final in. After this Thursday, we should basically be done with Victoria development. Only if there is a very, very critical issue discovered will we allow any updates after Thursday and before the final release next Wednesday. Any other bugfixes and important updates will need to wait until after next week's coordinated release to be part of a stable release off of the stable/victoria branch. Please let us know if you have any questions as we wrap things up. --- Sean McGinnis and the entire Release Management Team

1 0

[neutron] Bug deputy report for week of September 28th
by Lajos Katona 04 Oct '20

04 Oct '20

Hi, I was Neutron bug deputy the week before, below is a short summary of the week's reported bugs. - Critical Bugs - https://bugs.launchpad.net/neutron/+bug/1897713 (networking-ovn-tempest-dsvm-ovs-release job fails on stable/train) *Fixed* - https://bugs.launchpad.net/neutron/+bug/1897898 (Scenario test test_multiple_ports_portrange_remote is unstable ) *Unassigned* - https://bugs.launchpad.net/neutron/+bug/1898211 (OVN scenario jobs are failing on Ubuntu Focal due to ebtables-nft used by default ) *In Progress* - High Bugs - https://bugs.launchpad.net/neutron/+bug/1897796 (Scenario test test_subport_connectivity failing from time to time) *Assigned, in Progress* - https://bugs.launchpad.net/neutron/+bug/1897637 (explicity_egress_direct prevents learning of local MACs and causes flooding of ingress packets ) *In Progress*, perhaps duplicate of https://bugs.launchpad.net/neutron/+bug/1884708 - Medium Bugs - https://bugs.launchpad.net/neutron/+bug/1897921 ([OVN] "test_agent_show" failing, chassis not found ) *Fixed* - https://bugs.launchpad.net/neutron/+bug/1897928 (TestOvnDbNotifyHandler test cases failing due to missing attribute "_RowEventHandler__watched_events" ) *Fixed on Master* - Low Bugs - https://bugs.launchpad.net/neutron/+bug/1897546 (binding_levels property is missing from openstack port show command) - Not fully confirmed Bugs - https://bugs.launchpad.net/neutron/+bug/1897580 (SG rules aren't properly applied if CIDR of the tenant network is also matches the host network CIDR), I check it next week again. Iwas a much relaxed week in numbers. One critical bug is unassigned: https://bugs.launchpad.net/neutron/+bug/1897898 Regards Lajos Katona (lajoskatona)

1 0

[all][dev] Python.h not found after openstack-tox-py36 is switch to CentOS8
by Akihiro Motoki 04 Oct '20

04 Oct '20

Hi, openstack-tox-py36 is now run on CentOS-8 after commit 31c4a7a18e2bd43d2893563b992c683c95baed6f was merged. I noticed Python.h is not installed so we cannot install python modules which require compilation. An example is found at [1]. Do individual projects explicitly install python-dev or will we handle it in the common zuul job? Before proposing a fix, I would like to hear our direction. [1] https://zuul.opendev.org/t/openstack/build/696978c5614c41bd88b5b2a1d6c2174a… Thanks, Akihiro Motoki (irc: amotoki)

5 5

Ussuri Octavia load balancer on OVS
by pwm 04 Oct '20

04 Oct '20

Hi, I using the following setup for Octavia load balancer on OVS Ansible openstack_user_config.yml - network: container_bridge: "br-lbaas" container_type: "veth" container_interface: "eth14" host_bind_override: "eth14" ip_from_q: "octavia" type: "flat" net_name: "octavia" group_binds: - neutron_openvswitch_agent - octavia-worker - octavia-housekeeping - octavia-health-manager user_variables.yml octavia_provider_network_name: "octavia" octavia_provider_network_type: flat octavia_neutron_management_network_name: lbaas-mgmt /etc/netplan/50-cloud-init.yaml br-lbaas: dhcp4: no interfaces: [ bond10 ] addresses: [] parameters: stp: false forward-delay: 0 bond10: dhcp4: no addresses: [] interfaces: [ens16] parameters: mode: balance-tlb brctl show bridge name bridge id STP enabled interfaces br-lbaas 8000.d60e4e80f672 no 2ea34552_eth14 bond10 However, I am getting the following error when creating the load balance octavia.amphorae.drivers.haproxy.rest_api_driver [-] Could not connect to instance. Retrying.: requests.exceptions.ConnectionError: HTTPSConnectionPool(host='172.29.233.47', port=9443 The Octavia api container unable to connect to the amphora instance. Any missing configuration, cause I need to manually add in the eth14 interface to the br-lbaas bridge in order to fix the connection issue brctl addif br-lbaas eth14 Thanks

2 9

[neutron][requirements] RFE requested for neutron-lib
by Lajos Katona 03 Oct '20

03 Oct '20

Hi, I would like to ask Requirements Freeze Exception for neutron-lib 2.6.1 for Neutron Victoria. neutron-lib 2.6.1 contains a bug fix for Neutron which solves a nova gate issue (on Victoria) coming from a new feature in neutron, see [1]. [1] https://bugs.launchpad.net/neutron/+bug/1882804 (RFE: allow replacing the QoS policy of bound port) Thanks in advance Lajos Katona (lajoskatona)

4 3

[tripleo] TripleO CI Summary: Unified Sprint 33
by Rafael Folco 03 Oct '20

03 Oct '20

Greetings, The TripleO CI team has just completed **Unified Sprint 33** (Sept 11 thru Oct 01). The following is a summary of completed work during this sprint cycle: - Added more jobs to RHOS 16.2 pipelines. - Applied new promoter configuration engine changes to consolidate all promoters into the same code. - Started a PoC implementation of the new dependency pipeline: - https://hackmd.io/iA6AyTn8Rn2ximODx6FmKg - Started elastic-recheck containerization work: - https://hackmd.io/HQ5hyGAOSuG44Le2x6YzUw - Created upstream parent jobs a.k.a content-provider to build containers for multiple jobs: - https://hackmd.io/vRMVeZXZRgK5Vxqi6ENUDg#QampA - Ruck/Rover recorded notes [1]. The planned work for the next sprint puts on hold the work started in the previous sprint and focuses on the following: - Add content-provider jobs to all CI layouts and templates. - Start prep work for stable/victoria branching in RDO. - Continue investigations to fix broken upgrade jobs. The Ruck and Rover for this sprint are Ronelle Landy (rlandy) and Soniya Vyas (soniya29). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes to be tracked in hackmd [2]. Thanks, rfolco [1] https://hackmd.io/7Q0YO5JKS0agcf9qwoD4IQ <https://hackmd.io/7Q0YO5JKS0agcf9qwoD4IQ> [2] https://hackmd.io/1qxCqYzATfudl1cKvaQ8-w -- Folco

1 0

[oslo] PTO next week
by Ben Nemec 02 Oct '20

02 Oct '20

I will be on PTO next week so I won't be around to run the meeting. This might be a good time to start implementing our DPL approach, if someone else wants to pick up the job of meeting coordinator. I believe Herve had mentioned some interest in that. Anyway, I won't be here and I'm stepping down as PTL so y'all can do what you want. ;-) -Ben

2 1

Neutron DVR, service subnets and public IPs
by Taltavull Jean-Francois 02 Oct '20

02 Oct '20

Hi All, Has someone already used successfully neutron service subnets, in a DVR deployment, in order to save internet public IP addresses ? Regards, Jean-Francois

1 0