November 2020 - openstack-discuss

[all][tc][goals] Migrate RBAC Policy Format from JSON to YAML: Week R-20 Update
by Ghanshyam Mann 26 Nov '20

26 Nov '20

Hello Everyone, As you all know, 'Migrate RBAC Policy Format from JSON to YAML' is one of the community-wide goals for Wallaby development cycle. I am starting this thread to report the progress of this work. Tracking: https://etherpad.opendev.org/p/migrate-policy-format-from-json-to-yaml Gerrit Topic: https://review.opendev.org/q/topic:%22policy-json-to-yaml%22+(status:open%2… Updates: ======== * Common code of upgrade checks and policy.json file fallback logic is moved from nova to oslo.upgradechecks (in version 1.2.0) and oslo.policy(in version 3.6.0) respectively. ** For upgrade checks, you just need to enable it from the project side. Example: https://review.opendev.org/c/openstack/keystone/+/764240/4/keystone/cmd/sta… ** For olso.policy fallback logic, you just need to bump the min version to 3.6.0. For project who already change the policy_file default in previous releases (like Cinder ) then you can disable this fallback logic via flag 'fallback_to_json_file' * I have started few projects to propose the changes and will continue to do that for other projects too. If you are interested to help, please write it in tracking etherpad [1]. * I am updating the goal documents also for oslo side common code and the latest example. - https://review.opendev.org/c/openstack/governance/+/764261 - This is an example you can refer: https://review.opendev.org/c/openstack/keystone/+/764240 [1] https://etherpad.opendev.org/p/migrate-policy-format-from-json-to-yaml -gmann

1 0

[neutron] Drivers meeting - 27.11.2020
by Slawek Kaplonski 26 Nov '20

26 Nov '20

Hi, As it's Thanksgiving week and Black Friday so our US folks will probably not be there and lets cancel the meeting this week. But we have couple of new RFEs which needs to be triaged: * https://bugs.launchpad.net/neutron/+bug/1905391 * https://bugs.launchpad.net/neutron/+bug/1905295 * https://bugs.launchpad.net/neutron/+bug/1905115 * https://bugs.launchpad.net/neutron/+bug/1900934 So please take some time and help with triaging them so we will be able to discuss them next week hopefully :) Have a great weekend! -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[ptl][release][stable][EM] Extended Maintenance - Stein
by Előd Illés 26 Nov '20

26 Nov '20

Hi, As Victoria was released yesterday and we are in a less busy period, it is a good opportunity to call your attention to the following: In less than a month Stein is planned to enter into Extended Maintenance phase [1] (planned date: 2020-11-11). I have generated the list of *open* and *unreleased* changes in *stable/stein* for the follows-policy tagged repositories [2]. These lists could help the teams, who are planning to do a *final* release on Stein before moving stable/stein branches to Extended Maintenance. Feel free to edit and extend these lists to track your progress! * At the transition date the Release Team will tag the *latest* (Stein) releases of repositories with *stein-em* tag. * After the transition stable/stein will be still open for bugfixes, but there won't be any official releases. NOTE: teams, please focus on wrapping up your libraries first if there is any concern about the changes, in order to avoid broken releases! Thanks, Előd [1] https://releases.openstack.org [2] https://etherpad.openstack.org/p/stein-final-release-before-em

2 2

[oslo] py-amqp TLS peer authentication
by Moises Guimaraes de Medeiros 26 Nov '20

26 Nov '20

Hi all, This email is about a potential MITM attack, I would like to get some input on my proposed solution. *Disclaimer: I'm not an oslo.messaging expert or even versed in its codebase but I have a good* * number of hours working with TLS already.* Back in September, there was a fix[1] in py-amqp to stop to use deprecated method ssl.wrap_socket. Although I didn't follow anything about oslo.messaging, the PR was brought to my attention by Hervé, another oslo core, who sees me as an SME on TLS among the oslo cores. I didn't follow the entire conversation back then, I was only able to give some quick input, but Hervé was able to finish the PR with the help of another developer. Then earlier this month, another PR[2] was reintroducing a couple of parameters that got dropped in the deprecation fix. At that point it was raised the possibility of a MITM attack in an issue[3] and by reintroducing the dropped parameters, the problem should be fixed. A couple of days went by and I started to have a hunch that there could still be more to fix. I went to py-amqp codebase instead of just looking to the diffs on GitHub and noticed a not straightforward logic on how verify_mode and check_hostname were being set. Today I had time to go back to the py-amqp codebase and rework the _wrap_socket_sni() method. I've put up this PR[4] and it is already failing in my travis[5] for integration tests which make me believe that the client sockets were actually not validating the server certs. There are a few more comments on the fix in the description of PR[4]. [1]: https://github.com/celery/py-amqp/pull/327 [2]: https://github.com/celery/py-amqp/pull/344 [3]: https://github.com/celery/py-amqp/issues/342 [4]: https://github.com/celery/py-amqp/pull/347 [5]: https://travis-ci.com/github/moisesguimaraes/py-amqp/builds/204747399 Thanks, -- Moisés Guimarães Software Engineer Red Hat <https://www.redhat.com> <https://red.ht/sig>

1 0

SFC for OVN
by Lazuardi Nasution 26 Nov '20

26 Nov '20

Hi, By https://docs.openstack.org/neutron/ussuri/admin/config-sfc.html, it is stated that SFC essentially is the SDN version of PBR. On the other side, PBR is supported by OVN. Is there any initiative of Neutron SFC driver for OVN which utilize native PBR support of OVN without having to alternate the OVN itself? For example, for having a port pair of port A to port B for flow classifier of HTTP traffic, we might make PBR which match HTTP traffic from port A address and set the next hop to port B address. The other way which might be used is destination NATing (redirection) on port A for HTTP traffic to port B address. OVN has native support for NAT too, but I think the PBR way is better. Best regards,

1 1

[tc] weekly update & agenda
by Mohammed Naser 26 Nov '20

26 Nov '20

Hi everyone, Here's an update for what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Clarify the requirements for supports-api-interoperability https://review.opendev.org/c/openstack/governance/+/760562 - Add election schedule exceptions in charter https://review.opendev.org/c/openstack/governance/+/751941 - Add Resolution of TC stance on the OpenStackClient https://review.opendev.org/c/openstack/governance/+/759904 - Add assert:supports-standalone https://review.opendev.org/c/openstack/governance/+/722399 - Remove assert_supports-zero-downtime-upgrade tag https://review.opendev.org/c/openstack/governance/+/761975 - Add Magpie charm to OpenStack charms https://review.opendev.org/c/openstack/governance/+/762820 - Propose Kendall Nelson for vice chair https://review.opendev.org/c/openstack/governance/+/762014 - Clarify impact on releases for SIGs https://review.opendev.org/c/openstack/governance/+/752699 ## General Changes - Move Placement under Nova's governance https://review.opendev.org/c/openstack/governance/+/760917 ## Other Reminders - Our next [TC] Weekly meeting is scheduled for November 26. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, November 26th, at 0000 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 1

[Freezer][Keystone][Mistral][Monasca][Murano][Openstack-Chef][Openstack-Helm][Openstacksdk][Trove][Watcher][Zun] Action required: Gerrit code audit
by Mohammed Naser 26 Nov '20

26 Nov '20

Hello there, As per the `service-announce` on October 20 regarding Gerrit Outage Update email http://lists.opendev.org/pipermail/service-announce/2020-October/000011.html, all project teams are required to audit changes for projects from 2020-10-01 to 2020-10-21. I'm reaching out to those projects in particular who the TC believes have not completed their audit yet. Let us know if you need any type of assistance in completing the audit. In case you didn’t know you needed to do this, feel free to reach out for support. Regards, Mohammed -- Mohammed Naser VEXXHOST, Inc.

13 14

[all][healthcheck]
by Lajos Katona 26 Nov '20

26 Nov '20

Hi, I send this mail out to summarize the discussion around Healthcheck API on Neutron PTG, and start a discussion how we can make this most valuable to the operators. On the Neutron PTG etherpad this topic is from L114: https://etherpad.opendev.org/p/neutron-wallaby-ptg . Background: oslo_middleware provides /healthcheck API path(see [1]), which can be used to poll by services like haproxy, and gives a plugin mechanism to add some more complicated checks, which can be switched on/off from config. The main questions: - Some common guidance what to present to the operators (if you check [2] and [3] in the comments there are really good questions/concerns) - Perhaps the API SIG has something about healtcheck, just I can't find it. - What to present with and without authentication (after checking again, I am not sure that it is possible to use authentication for the healthcheck) - A way forward can be to make it configurable with default to authenticated, and give the decision to the admin. - During the discussion the agreement was to separate the frontend health from the backend health and use direct indicators (like working db connectivity, and mq connectivity) instead of indirect indicators (like agents' health). Thanks in advance for the feedback. [1] https://docs.openstack.org/oslo.middleware/latest/reference/healthcheck_plu… [2] https://review.opendev.org/731396 [3] https://review.opendev.org/731554 Regards Lajos Katona (lajoskatona)

3 4

[neutron] [nova] [ussuri] IP of the VM at the provider network is different than the one registered at the Openstack controller
by Pavlos Basaras 26 Nov '20

26 Nov '20

Hello, Setup: i follow the main instruction for deploying openstack for learning purposes. I can successfully deploy vms in an internal network, and also connect them to a router that gives internet access using floating ips etc. My setup is based on ubuntu 18. I have virtualbox for deploying controller (10.0.0.11) and compute (10.0.0.31) etc. I have host only adapters at virtual box (dhcp enabled) for the two networks: mgmt: 10.0.0.0/24 and provider 203.0.111.0/24 as per the default instructions, and i use iptables to NAT the vms. Problem: When following the instructions from https://docs.openstack.org/install-guide/launch-instance-provider.html the vm is deployed successfully but the ip that it is assigned is different from the one that the controller has. It seems that there are more than one dhcp instances running? How can i debug this? Any advice? all the best, Pavlos.

2 2

Re: [neutron][openstack-ansible] Instances can only connect to provider-net via tenant-net but not directly
by Oliver Wenz 25 Nov '20

25 Nov '20

> First of all I'd suggest checking `openstack network agent list` and ensure that lxb agent is present there up and healthy. > Next I'd check nova-scheduler log (journalctl eventually) as it might have more insights. linuxbridge agent is up and healthy and the nova-scheduler log doesn't show any errors either > Please check in neutron server logs for the problems with binding port Indeed, running journalctl and grepping for the instance id shows an error (last lines): journalctl -u neutron-server -n 300 | grep 33c662c2-99d6-40fb-a716-118ad8b3b193 Nov 25 15:06:58 infra1-neutron-server-container-cbf4b105 neutron-server[88]: 2020-11-25 15:06:58.738 88 INFO neutron.wsgi [req-e5b7df6c-bfde-438a-bbb1-f2713b63e16b 920e739127a14018a55fb4422b0885e7 0f14905dab5546e0adec2b56c0f6be88 - default default] 192.168.110.128,192.168.110.201 "GET /v2.0/ports?device_id=33c662c2-99d6-40fb-a716-118ad8b3b193 HTTP/1.1" status: 200 len: 205 time: 0.3313231 Nov 25 15:07:04 infra1-neutron-server-container-cbf4b105 neutron-server[89]: 2020-11-25 15:07:04.782 89 INFO neutron.wsgi [req-9bdadc77-27d9-4f9d-86b5-349b598b1ba4 eaf8235312004e2da519b54d196f5415 474b7aa9b7894d6782402135c6ef4c2a - default default] 192.168.110.205,192.168.110.201 "GET /v2.0/ports?tenant_id=0f14905dab5546e0adec2b56c0f6be88&device_id=33c662c2-99d6-40fb-a716-118ad8b3b193 HTTP/1.1" status: 200 len: 1084 time: 0.0956030 Nov 25 15:07:05 infra1-neutron-server-container-cbf4b105 neutron-server[89]: 2020-11-25 15:07:05.020 89 INFO neutron.notifiers.nova [-] Nova event response: {'name': 'network-changed', 'server_uuid': '33c662c2-99d6-40fb-a716-118ad8b3b193', 'tag': '1e24a151-bd29-47f8-914b-05c66587541b', 'status': 'completed', 'code': 200} Nov 25 15:07:05 infra1-neutron-server-container-cbf4b105 neutron-server[89]: 2020-11-25 15:07:05.781 89 INFO neutron.wsgi [req-9b729386-4847-4be3-80fa-dce244435ddd eaf8235312004e2da519b54d196f5415 474b7aa9b7894d6782402135c6ef4c2a - default default] 192.168.110.205,192.168.110.201 "GET /v2.0/ports?tenant_id=0f14905dab5546e0adec2b56c0f6be88&device_id=33c662c2-99d6-40fb-a716-118ad8b3b193 HTTP/1.1" status: 200 len: 1084 time: 0.1147285 Nov 25 15:12:12 infra1-neutron-server-container-cbf4b105 neutron-server[89]: 2020-11-25 15:12:12.445 89 INFO neutron.wsgi [req-15cbcb76-04cd-4813-b1f9-d7f6596e14bf 920e739127a14018a55fb4422b0885e7 0f14905dab5546e0adec2b56c0f6be88 - default default] 192.168.110.205,192.168.110.201 "GET /v2.0/ports?device_id=33c662c2-99d6-40fb-a716-118ad8b3b193 HTTP/1.1" status: 200 len: 1085 time: 0.4594653 Nov 25 15:12:14 infra1-neutron-server-container-cbf4b105 neutron-server[83]: 2020-11-25 15:12:14.453 83 WARNING neutron.notifiers.nova [-] Nova event: {'server_uuid': '33c662c2-99d6-40fb-a716-118ad8b3b193', 'name': 'network-vif-deleted', 'tag': '1e24a151-bd29-47f8-914b-05c66587541b', 'status': 'failed', 'code': 422} returned with failed status Kind regards, Oliver

2 1