October 2020 - openstack-discuss - lists.openstack.org

[tripleo][core] gerrit breach and auditing all tripleo commits since Oct 01
by Marios Andreou 22 Oct '20

22 Oct '20

Hi folks, as you are undoubtedly aware, gerrit was down yesterday. There was this email to service-announce [1] with more information about what happened (kudos Julia Kreger who sent [2] where I saw that). There is a list of changes [3] since October 1st that we should audit out of precaution and to be responsible and accountable to our community and users. As you can expect there are a great number of changes. I put a full commit list at [5]. I mined those from [3] - see [4] for info about the 'mining' and even better if someone has time to verify that I didn't miss any repos or commits. Please I need help from all core reviewers. We need to check that the commits in [5] appear valid and correct - remember the concern is for any changes that may have been merged by a compromised account. I propose that we do this via Gerrit and that we leave a comment - 'CHECKED' - on each review that we check? Hopefully we can cover all of these before the end of the week by distributing our efforts. I am open to other suggestions though if folks feel this is better done via some document/spreadsheet etc. Of course as stated in [1] it is a good idea for everyone to double check their account activity and make sure nothing is off, Thank you in advance for your help, marios [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html [2] http://lists.openstack.org/pipermail/openstack-discuss/2020-October/018148.… [3] https://static.opendev.org/project/opendev.org/gerrit-diffs/ [4] https://gist.github.com/marios/a44a55998531354dc3d634dddeadf1c0 [5] https://gist.github.com/marios/d1b774c827769373b67d3988105140dd

4 7

[rpm-packaging] Gerrit breach and commit audit
by Javier Pena 22 Oct '20

22 Oct '20

Hi, Following the recent Gerrit breach report [1], I have gone through the changes in rpm-packaging, renderspec and pymod2pkg, and none of them look suspicious. If you see anything strange, please let me know and we will handle it. Regards, Javier [1] - http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html

1 0

[heat] Gerrit breach and commit audit
by Rico Lin 22 Oct '20

22 Oct '20

Hi All, As suggested by the recent announcement of gerrit breach [1], I have audited all commits for heat repos and confirmed that everything looks good. [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html Sorry for any inconvenience. Also feel free to ping me or any of our core reviewers and ask for review on your patches. Best Regards, -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 0

[tripleo][overcloud] setup 2 bonds for overcloud deployment tripleo
by dangerzone ar 22 Oct '20

22 Oct '20

Hi.. I'm looking help to deploy overcloud (openstack train) as per initial req below:- a) 3 controllers b) 5 computes c) 2 bonds (bond0 - all vlan except for tenant , bond1 - for tenant vlan only) *No external storage and dpdk computes for now as trying to deploy these 3 controllers and 5 computes first. I have gone through openstack web, blogs and some other resources and failed to deploy with success. One of my problems is to identify the right templates to use for my setup and config for 2 bonds above. I have struggled to deploy overcloud for a month without success...I really appreciate your help and support to guide me. Please your help and support is much appreciated. I request help from everybody. Thank you

3 4

packstack unable to handle team devices?
by lejeczek 22 Oct '20

22 Oct '20

Hi guys I'm trying to add a second node, both nodes have team devices for: CONFIG_NEUTRON_OVN_TUNNEL_IF=team1056 and I get packstack to keep failing: ... Preparing Nova Common entries [ DONE ] Preparing Neutron API entries [ ERROR ] ERROR : "Couldn't detect ipaddress of interface team1056 on node 172.24.154.201" Please check log file /var/tmp/packstack/20201021-230211-9q243gpi/openstack-setup.log for more information .. Is this by design or it's just my case and if the latter then how to troubleshoot/workaround it? many thanks, L

1 0

[magnum] Gerrit breach and commit audit
by feilong 21 Oct '20

21 Oct '20

Hi everyone, As per the announcement of the Gerrit breach [1], I have audited all repos under Magnum (magnum, python-magnumclient, magnum-ui and magnum-tempest-plugin) for 1. Suspicious commit 2. Core group list Everything looks OK for me, see https://etherpad.opendev.org/p/magnum-gerrit-breach-audit [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html -- Cheers & Best regards, Feilong Wang (王飞龙) ------------------------------------------------------ Senior Cloud Software Engineer Tel: +64-48032246 Email: flwang(a)catalyst.net.nz Catalyst IT Limited Level 6, Catalyst House, 150 Willis Street, Wellington ------------------------------------------------------

1 0

Keystone auth method v3oidcpassword throws RESP BODY: Omitted, Content-Type is set to text/html. Only application/json responses have their bodies logged.
by Robert Duncan 21 Oct '20

21 Oct '20

I'm trying to use openID with openstack --versionopenstack 5.2.0 keystoneauth1==3.17.3 keystonemiddleware==7.0.1 python-keystoneclient==3.21.0 I have created an RC file like so : export OS_INTERFACE="public" export OS_AUTH_URL="https://openstack:5000/v3" export OS_IDENTITY_PROVIDER="<my_idp>" export OS_PROTOCOL="openid" export OS_CLIENT_ID="<the -id >" export OS_CLIENT_SECRET="<the secret>" export OS_DISCOVERY_ENDPOINT="https://login.microsoftonline.com/<the-tenant-id>/v2.0/.well-known/openid-configuration" export OS_IDENTITY_API_VERSION="3" export OS_AUTH_TYPE="v3oidcpassword" export OS_USERNAME="<AzureAD user>" # this is the local openstack project id export OS_PROJECT_ID="<The project ID>" # set password by querying user export OS_PASSWORD="" echo "Please enter your O365 Password: " read -sr OS_PASSWORD_INPUT export OS_PASSWORD=$OS_PASSWORD_INPUT all is working on Horizon WebSSO- but I cannot access the API the openstack --debug output shows that I get a token from MS debug info (redacted) command: token issue -> openstackclient.identity.v3.token.IssueToken (auth=True) Auth plugin v3oidcpassword selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'baremetal_introspection_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'project_id': '516706052ebd4f9a89c0b7d7e075754d'}, 'additional_user_agent': [('osc-lib', '2.0.0')], 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'default_domain': 'default', 'timing': False, 'auth_url': 'https://openstack.*********:5000/v3', 'username': 'r********', 'password': '***', 'identity_provider': '*****', 'protocol': 'openid', 'client_id': '*******', 'client_secret': '***', 'discovery_endpoint': 'https://login.microsoftonline.com/*******/v2.0/.well-known/openid-configura…', 'beta_command': False, 'identity_api_version': '3', 'data_processing_api_version': '1.1', 'container_infra_api_version': '1', 'region_name': '', 'auth_type': 'v3oidcpassword', 'networks': []} Using auth plugin: v3oidcpassword Using parameters {'auth_url': 'https://openstack.******:5000/v3', 'project_id': '516706052ebd4f9a89c0b7d7e07575, 'identity_provider': '*****', 'protocol': 'openid', 'client_id': '********', 'client_secret': '***', 'discovery_endpoint': 'https://login.microsoftonline.com/*******/v2.0/.well-known/openid-configura…', 'username': '*****', 'password': '***'} Get auth_ref REQ: curl -g -i -X GET https://login.microsoftonline.com/*****/v2.0/.well-known/openid-configurati… -H "User-Agent: openstacksdk/0.46.0 keystoneauth1/4.0.0 python-requests/2.22.0 CPython/3.8.2" Starting new HTTPS connection (1): login.microsoftonline.com:443 https://login.microsoftonline.com:443 "GET /******/v2.0/.well-known/openid-configuration HTTP/1.1" 200 1651 RESP: [200] Access-Control-Allow-Methods: GET, OPTIONS Access-Control-Allow-Origin: * Cache-Control: max-age=86400, private Content-Length: 1651 Content-Type: application/json; charset=utf-8 Date: Wed, 21 Oct 2020 09:37:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Set-Cookie: fpc=AhupGfLmUQlEsKNlR-m0ATg; expires=Fri, 20-Nov-2020 09:37:14 GMT; path=/; secure; HttpOnly; SameSite=None, esctx=*****: domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly, stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff x-ms-ests-server: 2.1.11154.9 - NEULR2 ProdSlices x-ms-request-id: 0819033b-dcb3-409a-8115-54dc06a31900 RESP BODY: {"token_endpoint":"https://login.microsoftonline.com/*****/oauth2/v2.0/token","token_endpoint_auth_methods_supported":["client_secret_post","private_key_jwt","client_secret_basic"],"jwks_uri":"https://login.microsoftonline.com/****/discovery/v2.0/keys","response_modes_supported":["query","fragment","form_post"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256"],"response_types_supported":["code","id_token","code id_token","id_token token"],"scopes_supported":["openid","profile","email","offline_access"],"issuer":"https://login.microsoftonline.com/****/v2.0","request_uri_parameter_supported":false,"userinfo_endpoint":"https://graph.microsoft.com/oidc/userinfo","authorization_endpoint":"https://login.microsoftonline.com/****/oauth2/v2.0/authorize","device_authorization_endpoint":"https://login.microsoftonline.com/*****/oauth2/v2.0/devicecode","http_logout_supported":true,"frontchannel_logout_supported":true,"end_session_endpoint":"https://login.microsoftonline.com/****/oauth2/v2.0/logout","claims_supported":["sub","iss","cloud_instance_name","cloud_instance_host_name","cloud_graph_host_name","msgraph_host","aud","exp","iat","auth_time","acr","nonce","preferred_username","name","tid","ver","at_hash","c_hash","email"],"tenant_region_scope":"EU","cloud_instance_name":"microsoftonline.com","cloud_graph_host_name":"graph.windows.net","msgraph_host":"graph.microsoft.com","rbac_url":"https://pas.windows.net"} REQ: curl -g -i -X POST https://login.microsoftonline.com/******/oauth2/v2.0/token -H "User-Agent: openstacksdk/0.46.0 keystoneauth1/4.0.0 python-requests/2.22.0 CPython/3.8.2" -d '{'username': '*****', 'password': '*****', 'scope': 'openid profile', 'grant_type': 'password'}' https://login.microsoftonline.com:443 "POST /*****/oauth2/v2.0/token HTTP/1.1" 200 3764 RESP: [200] Cache-Control: no-store, no-cache Content-Length: 3764 Content-Type: application/json; charset=utf-8 Date: Wed, 21 Oct 2020 09:37:14 GMT Expires: -1 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma: no-cache Set-Cookie: fpc=****; expires=Fri, 20-Nov-2020 09:37:14 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly, stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff x-ms-ests-server: 2.1.11154.9 - WEULR1 ProdSlices x-ms-request-id: 92d66fde-6763-4be2-b1cf-00fd18bc1800 RESP BODY: {"token_type":"Bearer","scope":"email openid profile 00000003-0000-0000-c000-000000000000/User.Read","expires_in":3599,"ext_expires_in":3599,"access_token":"<the access token>","id_token":"<the id token>"} REQ: curl -g -i -X POST https://openstack***:5000/v3/OS-FEDERATION/identity_providers/***/protocols… -H "Authorization: {SHA256}aff774c8663ee647a08aefcea698f8c30e1d1cc8d85a3d55a17cae53defd8955" -H "User-Agent: openstacksdk/0.46.0 keystoneauth1/4.0.0 python-requests/2.22.0 CPython/3.8.2" Starting new HTTPS connection (1): openstack.****:5000 https://openstack.***:5000 "POST /v3/OS-FEDERATION/identity_providers/****/protocols/openid/auth HTTP/1.1" 200 541 RESP: [200] Content-Length: 541 Content-Type: text/html Date: Wed, 21 Oct 2020 09:37:14 GMT Server: Apache RESP BODY: Omitted, Content-Type is set to text/html. Only application/json responses have their bodies logged. Expecting value: line 1 column 1 (char 0) Traceback (most recent call last): File "/usr/lib/python3/dist-packages/cliff/app.py", line 393, in run_subcommand self.prepare_to_run_command(cmd) File "/usr/lib/python3/dist-packages/osc_lib/shell.py", line 493, in prepare_to_run_command self.client_manager.auth_ref File "/usr/lib/python3/dist-packages/osc_lib/clientmanager.py", line 202, in auth_ref self._auth_ref = self.auth.get_auth_ref(self.session) File "/usr/lib/python3/dist-packages/keystoneauth1/identity/v3/federation.py", line 65, in get_auth_ref auth_ref = self.get_unscoped_auth_ref(session) File "/usr/lib/python3/dist-packages/keystoneauth1/identity/v3/oidc.py", line 265, in get_unscoped_auth_ref return access.create(resp=response) File "/usr/lib/python3/dist-packages/keystoneauth1/access/access.py", line 36, in create body = resp.json() File "/usr/lib/python3/dist-packages/requests/models.py", line 897, in json return complexjson.loads(self.text, **kwargs) what's gone wrong? thanks, Rob. ________________________________ The information contained and transmitted in this e-mail is confidential information, and is intended only for the named recipient to which it is addressed. The content of this e-mail may not have been sent with the authority of National College of Ireland. Any views or opinions presented are solely those of the author and do not necessarily represent those of National College of Ireland. If the reader of this message is not the named recipient or a person responsible for delivering it to the named recipient, you are notified that the review, dissemination, distribution, transmission, printing or copying, forwarding, or any other use of this message or any part of it, including any attachments, is strictly prohibited. If you have received this communication in error, please delete the e-mail and destroy all record of this communication. Thank you for your assistance. ________________________________

2 6

[nova] Gerrit breach and commit audit
by Ghanshyam Mann 21 Oct '20

21 Oct '20

Hello Everyone, As per the announcement of the Gerrit breach [1], I have audited all repos under Nova for 1. Suspicious commit 2. Core group list and everything is fine. - https://etherpad.opendev.org/p/nova-gerrit-breach-audit [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html

1 0

[designate] Gerrit breach and commit audit
by Nicolas Bock 21 Oct '20

21 Oct '20

Hi, Herve's script [1] identified the following commits in the designate repository. I second Michael's assessment from earlier that all of those commits are legitimate. Best, Nick Commit to analyze: https://review.opendev.org/#/q/8459ed9460ab492adfd305875c717ebe31bf68f3 Files to analyze: - lower-constraints.txt ------------------------------- Commit to analyze: https://review.opendev.org/#/q/568b559b67b0d9a663172d681fe887bf06feea0a Files to analyze: - tox.ini ------------------------------- Commit to analyze: https://review.opendev.org/#/q/0d277e9cbb42404b1b1082afdfa5bcfc49691e6f Files to analyze: - lower-constraints.txt ------------------------------- Commit to analyze: https://review.opendev.org/#/q/53dcbe8584434c21b1a340763e9ee419dc58117f Files to analyze: - .zuul.yaml ------------------------------- Commit to analyze: https://review.opendev.org/#/q/348771951fa6e9740b629e81227cc0311751a471 Files to analyze: - lower-constraints.txt ------------------------------- Commit to analyze: https://review.opendev.org/#/q/1831a5b1016563681df6905114f0dc95efd24391 Files to analyze: - designate/locale/ko_KR/LC_MESSAGES/designate.po ------------------------------- Commit to analyze: https://review.opendev.org/#/q/19da5d79d5d24dfda31773f70971f640856b10b1 Files to analyze: - releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po ------------------------------- Commit to analyze: https://review.opendev.org/#/q/a0d20514c6ebbfe6b42b989b6192ae77312d3ba7 Files to analyze: - lower-constraints.txt ------------------------------- [1] https://gist.githubusercontent.com/4383/511359cc2080e06295944c5f40bd1033/ra…

1 0

[qa] Gerrit breach and commit audit
by Ghanshyam Mann 21 Oct '20

21 Oct '20

Hello Everyone, As per the announcement of the Gerrit breach [1], I have audited all repos under QA for 1. Suspicious commit 2. Core group list and everything is fine. - https://etherpad.opendev.org/p/qa-gerrit-breach-audit [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html -gmann

1 0

[manila] Gerrit breach and commit audit
by Goutham Pacha Ravi 21 Oct '20

21 Oct '20

Hello Zorillas, I join the list of contributors to thank the infra team for their work in isolating, protecting and fixing the recent vulnerability. I looked through the code changes committed to repositories we maintain and didn't find any malicious code submissions or approvals. If you would like to take a look, here is an Ethercalc with the changes: https://ethercalc.openstack.org/uscp1x7i8ewn Please do respond here in case you notice anything amiss. Thank you! Goutham ---------- Forwarded message --------- From: Ian Wienand <iwienand(a)redhat.com> Date: Tue, Oct 20, 2020 at 5:33 PM Subject: [service-announce] October 20 Gerrit Outage Update To: <service-announce(a)lists.opendev.org> As of this mail, Gerrit access has been restored. Please read on for important information, especially around change verification. Background ----------- On 2020-10-20 at 01:30 a user unexpectedly added a workflow approval to a change that they were not expected to have access to. At 02:06 UTC an alert was raised via IRC. Administrators found the account had added themselves to a core group and made the +W vote. The account was disabled, and removed from the groups it had added itself to by 02:55 UTC. Administrators began to analyse the situation and Gerrit was taken offline at 04:02 UTC to preserve state and allow for analysis. >From this time, administrators were working on log collection and analysis, along with restoring backups for comparison purposes. By around 08:45 UTC it was clear that the privilege escalation had been achieved by gaining control of a Launchpad SSO account with Gerrit administrator privileges. By this time, we had ruled out software vulnerabilities. Logs showed the first unauthorized access of the administrator account in Gerrit on 2020-10-06. Communication with Launchpad admins agrees with this analysis. We saw one session opened as the administrator user to StoryBoard on this same day, but logs show no data was modified or hidden stories viewed. Analysis has been performed on the Gerrit database and git trees from October 1st, pre-dating any known unauthorized access. Access was restored at around 2020-10-21 00:00 UTC Outcomes ----------- The following has been verified: The administrator account used has been disabled and credentials updated We have verified that all group and user addition/removals since Oct 1 are valid. The only invalid additions were made by the compromised administrator account to add a single user account to the Administrators group; and then that account added itself to another known group. The account given administrator privilege has been removed from the groups it added itself to and is disabled. There is no evidence of any unauthorized access via methods other than Gerrit HTTP and Gerrit SSH access. No commits have been pushed to git trees bypassing code review. Every git tree has been compared to the Oct 1 version and all commits have been correctly inserted via Gerrit changes. The version of Gerrit we use stores HTTP API passwords in plain-text. We know that a limited number of passwords were gathered via the HTTP API and it is possible passwords were gathered via the database. We thus have assumed that all HTTP API passwords have been disclosed. This password needs to be explicitly enabled by users, and many users do not have it enabled. Remediation ----------- This leaves us with the following remediation actions: Users should double-check their Launchpad recent activity at https://login.launchpad.net/activity for any suspicious logins. If found, please notify the OpenDev admins in Freenode #opendev and Launchpad admins in #launchpad immediately. All HTTP API passwords have been cleared. If you push changes via HTTPS (instead of typical SSH), are a gertty user, or run a CI system or something else that communicates with the Gerrit HTTP API, you will need to regenerate a password. Any SSH keys added to accounts since 2020-10-01 have been removed. This affects only a limited number of accounts. This is done in an abundance of caution, and we do not believe any accounts had unauthorized SSH keys added We should audit all changes for projects since 2020-10-01. We have no evidence that any account had its ssh keys compromised, thus we can rule out any unauthorized changes being uploaded via SSH. However we can not conclusively rule out that compromised HTTP API passwords were used to push a change through Gerrit. For example, a change could be uploaded that looks like it came from a user, or the API key of a core team member may have been used to approve a change without authorization. Given our extensive analysis we consider it exceedingly unlikely that this vector was used. We have had no notifications of users seeing unexpected changes either uploaded by them, or approved by them in projects they work on. This said, we believe it is important to inform the community of this very unlikely, but still possible, vulnerability of the source code. To this end, we have prepared a list of all changes from the known affected period which should be audited for correctness. These are available at https://static.opendev.org/project/opendev.org/gerrit-diffs/ Team members should browse these changes and make sure they were correctly approved in Gerrit. If any change looks suspicious you should notify OpenDev administrators in Freenode #opendev immediately. Further actions ---------------- We are planning the following for the short term future: The Opendev administrators will be looking at alternative models for Gerrit admin account management. We are already well into planning and testing a coming upgrade to a version of Gerrit which does not store plain-text API keys. Longer term, we've written a spec for replacing Launchpad SSO as our authentication provider. We thank you for your patience during this trying time, and we look forward to returning to supporting the community doing what it does best -- working together to create great things. _______________________________________________ service-announce mailing list service-announce(a)lists.opendev.org http://lists.opendev.org/cgi-bin/mailman/listinfo/service-announce

1 0

[neutron] Same physical NIC for SR-IOV and other mechanism driver
by Gabriel Omar Gamero Montenegro 21 Oct '20

21 Oct '20

Dear all, Is it possible to use the same physical NIC with the SR-IOV mechanism driver together with other mechanism driver like Open vSwitch or Linux Bridge? If this is the case, how should I map the physical NIC for each agent? I only known how to map the NIC separately for each driver; for example: - for the Linux bridge agent: physnet1: eth3, - for the OvS agent: physnet1: br-provider (eth3 is a port of br-provider) - for the SR-IOV agent: physnet1: eth3 Any guide or sample reference about implementing multiple mechanism drivers would be highly appreciated. Thanks in advance, Gabriel Gamero

2 1

Octavia amphora missing network interface
by Dibbo, Alexander (STFC,RAL,SC) 21 Oct '20

21 Oct '20

Hi All, I'm having an issue with my Octavia deployment in Train. When a load balancer is created I can see the amphora get created with an interface on the management network. After a short while an interface is added for our external network. The external network interface never becomes responsive. If I ssh in to the amphora I can only see the management interface present. If I the reboot the amphora, the external interface appears and becomes responsive. Given this it seems like some kind of race condition. I have tried using all of the test amphora images that are published but the centos8 one seems the closest to working. Is anyone familiar with this issue or a fix? Thanks Alex Regards Alexander Dibbo - Cloud Architect / Cloud Operations Group Leader For STFC Cloud Documentation visit https://stfc-cloud-docs.readthedocs.io<https://stfc-cloud-docs.readthedocs.io/> To raise a support ticket with the cloud team please email cloud-support(a)gridpp.rl.ac.uk<mailto:cloud-support@gridpp.rl.ac.uk> To receive notifications about the service please subscribe to our mailing list at: https://www.jiscmail.ac.uk/cgi-bin/webadmin?A0=STFC-CLOUD To receive fast notifications or to discuss usage of the cloud please join our Slack: https://stfc-cloud.slack.com/ This email and any attachments are intended solely for the use of the named recipients. If you are not the intended recipient you must not use, disclose, copy or distribute this email or any of its attachments and should notify the sender immediately and delete this email from your system. UK Research and Innovation (UKRI) has taken every reasonable precaution to minimise risk of this email or any attachments containing viruses or malware but the recipient should carry out its own virus and malware checks before opening the attachments. UKRI does not accept any liability for any losses or damages which the recipient may sustain due to presence of any viruses. Opinions, conclusions or other information in this message and attachments that are not related directly to UKRI business are solely those of the author and do not represent the views of UKRI.

3 3

[designate][octavia] Gerrit breach and commit audit - OK
by Michael Johnson 21 Oct '20

21 Oct '20

I did not see any unusual commits on the lists for either the Octavia or Designate repositories. Thanks, Michael

1 0

[charms] Gerrit breach and commit audit
by Frode Nordahl 21 Oct '20

21 Oct '20

Hello all, On the back of the service announcement [0] from OpenDev admins this morning the OpenStack Charms team have performed an audit of the provided commit blobs. We have found everything to be in order for the repositories we manage. The sheet used for tracking has been made available for review [1]. I would like to thank everyone on the team for the prompt response in dealing with this issue, and we want to thank OpenDev for due diligence in handling the situation. Cheers! 0: http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html 1: https://docs.google.com/spreadsheets/d/1jxswC09mPCrtbAchNQBH5_RO95CTEOJ6VUr… -- Frode Nordahl

1 0

Fwd: [ops] [cinder] __DEFAULT__ volume type
by Rajat Dhasmana 21 Oct '20

21 Oct '20

---------- Forwarded message --------- From: Rajat Dhasmana <rdhasman(a)redhat.com> Date: Sat, Oct 17, 2020 at 12:31 AM Subject: Re: [ops] [cinder] __DEFAULT__ volume type To: Massimo Sgaravatto <massimo.sgaravatto(a)gmail.com> Hi Massimo, On Fri, Oct 16, 2020 at 7:42 PM Massimo Sgaravatto < massimo.sgaravatto(a)gmail.com> wrote: > I have recently updated my Cloud from Rocky to Train (I am running Cinder > v. 15.4.0) > I have a question concerning the __DEFAULT__ volume type, that I don't > remember to have seen before. > > Since Train, cinder has decided to discourage untyped volumes (volumes with None volume type) as it doesn't add any value to the volume attributes. To achieve this, we created the __DEFAULT__ type and migrated all untyped volumes to have the __DEFAULT__ type. > Since: > - I have no volumes using this volume type > - I defined in in the [DEFAULT] section of cinder.conf the attribute > "default_volume_type" to a value different than "__DEFAULT___" > > I assume that I can safely delete the __DEFAULT__ volume type > > Is this correct? > > Yes, as long as there are no volumes using it and there is a valid volume type defined with ``default_volume_type`` config in cinder.conf, you can safely delete it. NOTE: ``default_volume_type`` has a default value of ``__DEFAULT__`` to not allow users to further create untyped volumes, if you are deleting this, make sure there is always a valid volume type defined with ``default_volume_type`` in cinder.conf > Thanks, Massimo > Thanks and Regards Rajat Dhasmana

3 5

[glance] Gerrit breach and commit audit
by Abhishek Kekane 21 Oct '20

21 Oct '20

Hi All, As suggested by the recent announcement of gerrit breach [1], I have audited all commits for glance repo (glance, glance_store, glanceclient) and confirmed that everything looks good. [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html Thanks & Best Regards, Abhishek Kekane

1 0

[cinder] Gerrit breach and commit audit
by Brian Rosmaita 21 Oct '20

21 Oct '20

tl;dr The cinder deliverables repos look OK. Thanks to jungleboyj and smcginnis for help in looking them over. As you may have heard, there was a Gerrit breach in the 1 October to yesterday time frame. Here's a link to the analysis of the breach: http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html The infra team has cleared all Gerrit HTTP passwords and removed any ssh keys that were added after the breach. If you are super-paranoid, feel free to look over the commits to any of the cinder deliverables during the time frame of the breach. You can find them here: https://static.opendev.org/project/opendev.org/gerrit-diffs/ Like I said, some of us have looked them over and not noticed anything suspect. What you'd be looking for is that an approval you've made or your +2 vote on an approved patch may have been put there by someone other than you. So if you see your +2 or +W on a patch that you have no memory of actually looking at, that would be considered suspicious activity. (On many levels.) If you notice such a situation, please notify us immediately. cheers, brian

1 0

[Telemetry] Gerrit breach and commit audit
by Matthias Runge 21 Oct '20

21 Oct '20

Hi there, you may have seen the announcement of the gerrit breach[1]. I went through the changes we had in telemetry and I'm confident we were not affected. In any case, if you happen to see something suspicious, please let me know. Matthias [1] http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html

1 0

[nova][live-migration] Nova live-migration fails due to duplicate records in ml2_port_bindings table
by Zhi CZ Chang 21 Oct '20

21 Oct '20

2 1

[horizon] No meetings during the Summit and PTG
by Ivan Kolodyazhny 21 Oct '20

21 Oct '20

He team, As agreed on the last weekly meeting, we'll skip the next two meetings to allow everybody attend OpenInfra Summit and PTG. The next meeting will be on November, 4th Regards, Ivan Kolodyazhny, http://blog.e0ne.info/

1 0

[Ussuri] [horizon] Cannot Create Port with Fixed IP Address
by Lazuardi Nasution 21 Oct '20

21 Oct '20

Hi, With Ussuri on Ubuntu 20.04, I can create port with fixed IP address by CLI but I cannot do the same by Horizon GUI. I find some error like following on /var/log/apache2/error.log openstack_dashboard.dashboards.project.networks.ports.workflows Failed to create a port for network 91f04dfb-7f69-4050-8b3b-142ee555ae55: dictionary keys changed during iteration By more inspection, I can find that horizon never send that create port request to neutron. So I think it is horizon problem. Is this expected result or is this horizon bug? Is this related to policy? Best regards,

2 2

Re: packstack fails every time - pymysql.err.OperationalError: (1040, 'Too many connections')
by lejeczek 21 Oct '20

21 Oct '20

On 20/10/2020 11:02, Javier Pena wrote: > > Hi guys. > I'm trying to deploy with "packstack --allinone" and > it always (tried ~5 times) fails with: > ... > ERROR : Error appeared during Puppet > run:A.B.C.D_compute.pp > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > pymysql.err.OperationalError: (1040, 'Too many > connections') > You will find full trace in log > /var/tmp/packstack/20201018-183415-ik3ijyw7/manifests/172.24.154.202_compute.pp.log > Please check log file > /var/tmp/packstack/20201018-183415-ik3ijyw7/openstack-setup.log > for more information > > > If some expert might be interested then in > /var/tmp/packstack/20201018-183415-ik3ijyw7/manifests/172.24.154.202_compute.pp.log > .... > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[DEFAULT/compute_driver]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[vnc/server_listen]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[libvirt/virt_type]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[libvirt/cpu_mode]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[libvirt/inject_password]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[libvirt/inject_key]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt/Nova_config[libvirt/inject_partition]/ensure: > created > Notice: > /Stage[main]/Nova::Migration::Libvirt/Nova_config[libvirt/live_migration_uri]/ensure: > created > Notice: > /Stage[main]/Nova::Compute::Libvirt::Services/Service[libvirt]/ensure: > ensure changed 'stopped' to 'running' > Notice: > /Stage[main]/Neutron::Deps/Anchor[neutron::service::begin]: > Triggered 'refresh' from 2 events > Notice: > /Stage[main]/Nova::Deps/Anchor[nova::config::end]: > Triggered 'refresh' from 22 events > Notice: > /Stage[main]/Nova::Deps/Anchor[nova::service::begin]: > Triggered 'refresh' from 1 event > Notice: > /Stage[main]/Nova::Compute/Nova::Generic_service[compute]/Service[nova-compute]/ensure: > ensure changed 'stopped' to 'running' > Notice: > /Stage[main]/Nova::Deps/Anchor[nova::service::end]: > Triggered 'refresh' from 1 event > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > An error has occurred: > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > Traceback (most recent call last): > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 2262, in _wrap_pool_connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return fn() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 294, in unique_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return _ConnectionFairy._checkout(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 751, in _checkout > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > fairy = _ConnectionRecord.checkout(pool) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 483, in checkout > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > rec = pool._do_get() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/impl.py", > line 138, in _do_get > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self._dec_overflow() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/langhelpers.py", > line 68, in __exit__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > compat.reraise(exc_type, exc_value, exc_tb) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/compat.py", > line 129, in reraise > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > raise value > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/impl.py", > line 135, in _do_get > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return self._create_connection() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 299, in _create_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return _ConnectionRecord(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 428, in __init__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self.__connect(first_connect_check=True) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 630, in __connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > connection = pool._invoke_creator(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/strategies.py", > line 114, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return dialect.connect(*cargs, **cparams) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/default.py", > line 453, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return self.dbapi.connect(*cargs, **cparams) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/__init__.py", > line 94, in Connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return Connection(*args, **kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 325, in __init__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self.connect() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 599, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self._request_authentication() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 861, in _request_authentication > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > auth_packet = self._read_packet() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 684, in _read_packet > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > packet.check_error() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/protocol.py", > line 220, in check_error > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > err.raise_mysql_exception(self._data) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/err.py", > line 109, in raise_mysql_exception > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > raise errorclass(errno, errval) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > pymysql.err.OperationalError: (1040, 'Too many > connections') > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > The above exception was the direct cause of the > following exception: > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > Traceback (most recent call last): > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/nova/cmd/manage.py", > line 2777, in main > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > ret = fn(*fn_args, **fn_kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/nova/cmd/manage.py", > line 1144, in discover_hosts > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > by_service) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/nova/objects/host_mapping.py", > line 256, in discover_hosts > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > cell_mappings = objects.CellMappingList.get_all(ctxt) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_versionedobjects/base.py", > line 184, in wrapper > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > result = fn(cls, context, *args, **kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/nova/objects/cell_mapping.py", > line 256, in get_all > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > db_mappings = cls._get_all_from_db(context) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 1013, in wrapper > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > with self._transaction_scope(context): > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File "/usr/lib64/python3.6/contextlib.py", line 81, in > __enter__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return next(self.gen) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 1063, in _transaction_scope > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > context=context) as resource: > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File "/usr/lib64/python3.6/contextlib.py", line 81, in > __enter__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return next(self.gen) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 658, in _session > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > bind=self.connection, mode=self.mode) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 418, in _create_session > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self._start() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 510, in _start > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > engine_args, maker_args) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/enginefacade.py", > line 534, in _setup_for_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > sql_connection=sql_connection, **engine_kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/debtcollector/renames.py", > line 43, in decorator > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return wrapped(*args, **kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/engines.py", > line 201, in create_engine > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > test_conn = _test_connection(engine, max_retries, > retry_interval) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/oslo_db/sqlalchemy/engines.py", > line 376, in _test_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return engine.connect() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 2193, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return self._connection_cls(self, **kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 103, in __init__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > else engine.raw_connection() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 2293, in raw_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self.pool.unique_connection, _connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 2266, in _wrap_pool_connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > e, dialect, self > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 1534, in _handle_dbapi_exception_noconnection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > util.raise_from_cause(newraise, exc_info) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/compat.py", > line 383, in raise_from_cause > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > reraise(type(exception), exception, tb=exc_tb, > cause=cause) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/compat.py", > line 128, in reraise > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > raise value.with_traceback(tb) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/base.py", > line 2262, in _wrap_pool_connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return fn() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 294, in unique_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return _ConnectionFairy._checkout(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 751, in _checkout > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > fairy = _ConnectionRecord.checkout(pool) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 483, in checkout > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > rec = pool._do_get() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/impl.py", > line 138, in _do_get > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self._dec_overflow() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/langhelpers.py", > line 68, in __exit__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > compat.reraise(exc_type, exc_value, exc_tb) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/util/compat.py", > line 129, in reraise > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > raise value > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/impl.py", > line 135, in _do_get > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return self._create_connection() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 299, in _create_connection > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return _ConnectionRecord(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 428, in __init__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self.__connect(first_connect_check=True) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/pool/base.py", > line 630, in __connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > connection = pool._invoke_creator(self) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/strategies.py", > line 114, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return dialect.connect(*cargs, **cparams) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib64/python3.6/site-packages/sqlalchemy/engine/default.py", > line 453, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return self.dbapi.connect(*cargs, **cparams) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/__init__.py", > line 94, in Connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > return Connection(*args, **kwargs) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 325, in __init__ > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self.connect() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 599, in connect > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > self._request_authentication() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 861, in _request_authentication > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > auth_packet = self._read_packet() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/connections.py", > line 684, in _read_packet > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > packet.check_error() > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/protocol.py", > line 220, in check_error > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > err.raise_mysql_exception(self._data) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > File > "/usr/lib/python3.6/site-packages/pymysql/err.py", > line 109, in raise_mysql_exception > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > raise errorclass(errno, errval) > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > sqlalchemy.exc.OperationalError: > (pymysql.err.OperationalError) (1040, 'Too many > connections') > Notice: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]/returns: > (Background on this error at: http://sqlalche.me/e/e3q8) > Error: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]: > Failed to call refresh: 'nova-manage cell_v2 > discover_hosts' returned 255 instead of one of [0] > Error: > /Stage[main]/Nova::Cell_v2::Discover_hosts/Exec[nova-cell_v2-discover_hosts]: > 'nova-manage cell_v2 discover_hosts' returned 255 > instead of one of [0] > > Hi, > > This might happen if you have a lot of CPUs in your > machine, since Packstack will spawn by default 1 worker > per CPU on every service. In some cases, that is too much > for the default MariaDB open file parameters. > > Can you try adding "--service-workers=2" to your packstack > command-line? Alternatively, you can set the > CONFIG_SERVICE_WORKERS option in your answer file. > Yes! that seems to be the fix for my. Lots of cores in the box is my case. > Regards, > Javier > > Bit discouraging to fail at start but I trust you can > share some good advice. > I'm on Centos8 with ussuri. > Many thanks, L. > >

1 0

[all][tc] Re: divisive language discussion
by Brian Rosmaita 21 Oct '20

21 Oct '20

Hi Ryan, Thank you for your thoughtful email. Apologies for top posting, but I simply want to make a general observation. Hegel postulated a master/slave, not a master/apprentice, dialectic. I think Western culture, at least, has been tainted to the point where on a word association test, the most common association to "master" would be "slave", even if you took the test in a recording studio. (But that's an empirical question and I haven't done any research, it's just a guess.) But what it comes down to for me, is that "master" in "master tape", "headmaster", "master of my domain", etc., is being used metaphorically and not accurately. A "master tape" isn't really a master of all the other tapes, etc. I think the "master" metaphor encourages sloppy thinking, and here I do have some empirical evidence. Take a look at the discussion on this OpenStack Glance review from 2017: https://review.opendev.org/#/c/424752 The original code was using master/slave, and everybody sort of understood what was going on, but it was not in fact accurate, and in addition to purging Hegelianism from Glance, the patch does improve the code and make the relationship more clear. So what's not to like? I don't have a problem removing language whose related metaphors are offensive or exclusionary if it results in a better technical solution. I don't think anyone is proposing that we put up general patches simply replacing 'master' with some other term; the ask is that we do this in a thoughtful way (which will be fought out in gerrit in the usual manner). At least that's how I look at this issue. One more thing and then I will shut up. OpenStack is written in Python partially because it was seen as having a lower barrier to entry than other languages, and would encourage participation and make the community more inclusive. Thus the TC or other appropriate body saying that it's preferred not to use wording identified as oppressive, racist, and sexist by members of our communities doesn't strike me as significantly different from core contributors asking for revisions on patches that write Python code in a non-Pythonic way (that is, using code patterns common in some other programming language, but which are non-idiomatic for Python). I don't mean to minimize your censorship concerns, but I do think they are misplaced. cheers, brian On 10/21/20 12:01 AM, Ryan Taylor wrote: > Hello, > > I was unable to join the session on divisive language today, and there > did not seem to be a recording of the video session, but I wanted to > share some thoughts. I hope you will forgive me for contacting this > email address from the etherpad page. > > Fundamentally, all meaning is symbolic and relational. A word or concept > only has meaning, and can only be defined, in terms of other words and > concepts. That is to say, the meaning of words is highly context-dependent. > > To illustrate my point, please consider the word "owner", and ownership > as a concept: > - generally inoffensive and innocuous > - it is an important meaning that we must be able to express in a > functional language in order to communicate with each other > - has different connotations in different contexts (like most words), > most of which are unrelated to slavery > - not realistically censorable (more to the point, it would be misguided > and futile to attempt to remove it from use) > > However, a slave master and a slave owner are the same thing. Every > logical argument for or against censorship of the word "master" applies > equally to the word "owner", but a reasonable rational person would not > consider "owner" to be an objectionable word. Please genuinely > contemplate this. You may get that "ick" feeling thinking about > ownership of a human being while simultaneously recognizing that this > does not irrevocably taint the word "owner" or the concept of ownership > in general. Careful consideration of this point will reveal that it is > not the words "owner" or "master", nor the concepts of ownership or > mastery, that are problematic - it is the /context/ of these concepts in > relation to slavery that is problematic, when what is owned or mastered > is a human being. > > To further illustrate this point, please consider e.g. master tape, > master copy, digital masters > (https://en.wikipedia.org/wiki/Digital_master > <https://en.wikipedia.org/wiki/Digital_master>), audio mastering, master > of ceremonies, master key, master of arts or science, postmaster, > headmaster/schoolmaster, mastery of a language or musical instrument, > etc. These terms use the general meaning of "master" or "mastery", > which is to have control, authority, importance, or skill, and are not > related to slavery. > > We work in technical and knowledge-based fields. We need concise, rich > technical language to be able to express a wide range of relationships > and interactions in highly complex systems in order to be able to > communicate effectively, without further overloading terms or creating > ambiguity. And our work relies on intelligent rational thought and > decision making. > > Students of history know that anything resembling censorship > (self-censorship or otherwise) or expunging a word from use must be > considered, if at all, with great care and deliberation. > It would be a fallacy to believe that because slavery involved slave > masters, all uses and connotations of the term "master" involve slavery. > Similarly, considering and discussing the terms "master" and "slave" > together on the same basis and in the same context of slavery brings an > implicit bias to the discussion; they should be considered separately. > > I believe the best course of action is to remove the term "slave" and > the context of slavery from code and documentation, while carefully > assessing the context of usage of other words and evaluating them on a > case by case basis. For example, "master node" or "master branch", when > there are no slave nodes or slave branches and no context or implication > of slavery, constitute a valid and accurate non-slavery-related use of > the English word "master" and must be accepted as legitimate uses of > language. > > I hope this may clarify where to draw the line between a genuine effort > to avoid using terms with negative historical connotations that may > cause offense, and censorship in the form of designating words as "bad" > or "problematic" regardless of intent, context or meaning. > > Sincerely, > -rt >

1 0

[tc] weekly update
by Mohammed Naser 21 Oct '20

21 Oct '20

Hi everyone, Here's an update for what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Add gmann liaison preference https://review.opendev.org/758602 - Resetting projects' TC liaisons empty https://review.opendev.org/758600 - Adopting the DPL governance model for oslo https://review.opendev.org/757906 - Implement distributed leadership in tools and schema https://review.opendev.org/757966 - Update TC size https://review.opendev.org/758168 - Add nomination for TC chair https://review.opendev.org/758181 - Appoint Adam Harwell as Octavia PTL https://review.opendev.org/758121 - Appoint XueFeng Liu as Senlin PTL https://review.opendev.org/758122 - Appoint Rafael Weingartner as CloudKitty PTL https://review.opendev.org/758120 - Appoint Frode Nordahl as OpenStack Charms PTL https://review.opendev.org/758119 - Add election schedule exceptions in charter https://review.opendev.org/751941 - Clarify impact on releases for SIGs https://review.opendev.org/752699 - Add assert:supports-standalone https://review.opendev.org/722399 - Select Prvisep as the Wallaby Goal https://review.opendev.org/755590 - Add danms liaison preferences https://review.opendev.org/758822 ## General Changes - Record Wallaby Cycle PTL and TC election results https://review.opendev.org/757971 # Other Reminders - PTG Brainstorming: https://etherpad.opendev.org/p/tc-wallaby-ptg - PTG Registration: https://october2020ptg.eventbrite.com Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0