February 2020 - openstack-discuss

[nova] noVNC console with password authentication
by Brin Zhang(张百林) 04 Feb '20

04 Feb '20

Hi all: About https://review.opendev.org/#/c/623120/ SPEC, there are two different perspectives, one from Alex and one from SPEC author Jingyu. 1. @Jingyu’s point is add“vnc_password”to the instance’s metadata,“vnc_password”is only provided for libvirtd support. As described in SPEC, the“vnc_password”parameter is populated when the instance generates XML, and when show server details that pop the “vnc_password”from nova api to ensure its security. That we can refer to the implementation of "adminPass" to understand this method. Its advantage is that it will not break the current nova api, you only need to store“vnc_password”in the instance's metadata. The disadvantage is that“vnc_password”is in the metadata but the user cannot get it. In addition, after we are evacuate/rebuild a server that we should reset it’s“vnc_password”, or take out "vnc_password" from the original instance and write into the new instance during evacuate/rebuild. 2. @Alex’s suggestion is change the Create Console API, add“vnc_password”as a new request optional parameter to the request body, that when we request create the remote console, if the“vnc_password”is not None we will reset the server’s vnc passwd, if“vnc_password”is None, that it will use the novnc password set last time you opened the console. The advantage is that it is more simple and convenient than storing "vnc_password" in metadata. When evacuate/rebuild, there is no need to consider the problem of "vnc_password" storage, but when we first open the console, we need to set it in the request body the value of "vnc_password". The disadvantage is that you need to add a new microversion to support this feature, which will break the current nova API (Create Console API). In addition, from the working principle of the RFB protocol, nova does not care about the "vnc_password" parameter passed in to obtain the Console URL. The verification of the vnc password is the job of the vnc server maintained by libvirtd. We look forward to completing it before the SPEC freeze, and hope to get more feedback, especially from the nova core team. SPEC link: https://review.opendev.org/#/c/623120/ brinzhang

1 0

[kuryr] Deprecation of Ingress support and namespace isolation
by Michał Dulko 04 Feb '20

04 Feb '20

Hi, I've decided to put up a patch [1] deprecating the aforementioned features. It's motivated by the fact that there are better ways to do both: * Ingress can be done by another controller or through cloud provider. * Namespace isolation can be achieved through network policies. Both alternative ways are way better tested and there's nobody maintaining the deprecated features. I'm open to keep them if someone using them steps up. With the fact that Kuryr seems to be tied more with Kubernetes releases than with OpenStack ones and given there will be no objections, we might start removing the code in the Ussuri timeframe. [1] https://review.opendev.org/#/c/703420/ Thanks, Michał

2 1

RDO OpenStack Repo for CentOS 8
by Pradeep Antil 04 Feb '20

04 Feb '20

Hi Folks, I am trying to deploy single node openstack on CentOS 8 using packstack, but it seems like CentOS 8 packages are not updated in repo. Has anyone tried this before on centos 8 , if yes what repository should I use ? [root@xxxxx~]# dnf install -y https://www.rdoproject.org/repos/rdo-release.rpm Last metadata expiration check: 0:02:17 ago on Tue 04 Feb 2020 03:07:49 AM EST. rdo-release.rpm 936 B/s | 6.4 kB 00:07 Dependencies resolved. ============================================================================================================================== Package Architecture Version Repository Size ============================================================================================================================== Installing: rdo-release noarch stein-3 @commandline 6.4 k Transaction Summary ============================================================================================================================== Install 1 Package Total size: 6.4 k Installed size: 3.1 k Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : rdo-release-stein-3.noarch 1/1 Verifying : rdo-release-stein-3.noarch 1/1 Installed: rdo-release-stein-3.noarch Complete! [root@xxxx ~]# [root@xxxx ~]# [root@xxxx ~]# dnf install -y openstack-packstack RDO CentOS-7 - QEMU EV 42 kB/s | 35 kB 00:00 OpenStack Stein Repository 1.3 MB/s | 4.1 MB 00:03 Last metadata expiration check: 0:00:01 ago on Tue 04 Feb 2020 03:12:15 AM EST. Error: Problem: cannot install the best candidate for the job - nothing provides python-netifaces needed by openstack-packstack-1:14.0.0-1.el7.noarch - nothing provides PyYAML needed by openstack-packstack-1:14.0.0-1.el7.noarch - nothing provides python-docutils needed by openstack-packstack-1:14.0.0-1.el7.noarch (try to add '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) [root@xxxxx ~]# -- Best Regards Pradeep Kumar

2 1

[cinder][ci] Cinder drivers being Unsupported and General CI Status ...
by Jay Bryant 04 Feb '20

04 Feb '20

All, We once again are at the point in the release where we are talking about 3rd Party CI and what is going on for Cinder. At the moment I have analyzed drivers that have not successfully reported results on a Cinder patch in 30 or more days and have put together the following list of drivers to be unsupported in the Ussuri release: * Inspur Drivers * Infortrend * Kaminario * NEC * Quobyte * Zadara * HPE Drivers If your name is in the list above you are receiving this e-mail directly, not just through the mailing list. If you are working on resolving CI issues please let me know so we can discuss how to proceed. In addition to the fact that we will be pushing up unsupported patches for the drivers above, we have already unsupported and removed a number of drivers during this release. They are as follows: * Unsupported: o MacroSAN Driver * Removed: o ProphetStor Driver o Nimble Storage Driver o Veritas Access Driver o Veritas CNFS Driver o Virtuozzo Storage Driver o Huawei FusionStorage Driver o Sheepdog Storage Driver Obviously we are reaching the point that the number of drivers leaving the community is concerning and it has sparked discussions around the fact that maybe our 3rd Party CI approach isn't working as intended. So what do we do? Just mark drivers unsupported and no longer remove drivers? Do we restore drivers that have recently been removed? We are planning to have further discussion around these questions at our next Cinder meeting in #openstack-meeting-4 on Wednesday, 1/29/20 at 14:00 UTC. If you have thoughts or strong opinions around this topic please join us. Thank you! Jay Bryant jsbryant(a)electronicjungle.net IRC: jungleboyj

7 8

[oslo] drop 2.7 support - track releases
by Herve Beraud 04 Feb '20

04 Feb '20

Hello, FYI you can track the dropping of py2.7 support in oslo by using: https://review.opendev.org/#/q/topic:oslo_drop_py2_support+(status:open+OR+… Topic: oslo_drop_py2_support We release a major version each time an oslo projects drop the py2.7 support. -- Hervé Beraud Senior Software Engineer Red Hat - Openstack Oslo irc: hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

2 3

[security] No Security SIG Meeting - Feb 06th
by Gage Hugo 03 Feb '20

03 Feb '20

The Security SIG won't be meeting this Thursday, Feb 06th, we will be back next week. For any questions please feel free to ask in #openstack-security. Thanks

1 0

[security] Security SIG Newsletter - Jan 2020
by Gage Hugo 03 Feb '20

03 Feb '20

Hope everyone's 2020 is going good so far, here's the list of updates from the Security SIG. Overall Jan was a pretty quiet month, only have a few update items. #Month Jan 2020 - Security SIG Meeting Info: http://eavesdrop.openstack.org/#Security_SIG_meeting - Weekly on Thursday at 1500 UTC in #openstack-meeting - Agenda: https://etherpad.openstack.org/p/security-agenda - https://security.openstack.org/ - https://wiki.openstack.org/wiki/Security-SIG #Updates - https://review.opendev.org/#/c/678426/ - Update to vmt policy, currently up for formal TC review - https://bugs.launchpad.net/nova/+bug/1492140 - Updates to stable branches - https://bugs.launchpad.net/neutron/+bug/1732067 - Backports to stable branches may require a configuration change #VMT Reports - A full list of publicly marked security issues can be found here: https://bugs.launchpad.net/ossa/

1 0

[Ansible] European Ansible Cntributors Summit
by Amy Marrich 03 Feb '20

03 Feb '20

This was shared on the OpenStack-Ansible channel this morning and I wanted to share with everyone using Ansible who might be interested in attending. https://groups.google.com/forum/#!topic/ansible-outreach/sLte90d5hdc Thanks, Amy (spotz)

1 0

[neutron] Bug Deputy Report Jan. 27 - Feb. 3
by Ryan Tidwell 03 Feb '20

03 Feb '20

Here's this week's bug report for neutron: https://bugs.launchpad.net/neutron/+bug/1861269 Functional tests failing due to failure with getting datapath ID from ovs Fix merged to master, backports in progress https://review.opendev.org/705401 https://review.opendev.org/705400 https://review.opendev.org/705399 https://review.opendev.org/705398 https://bugs.launchpad.net/neutron/+bug/1861442 QOS minimum bandwidth rejection of non-physnet network and updates should be driver specific This was discussed in the drivers meeting. The short-term plan is move where validation is done, then there is likely an RFE to tackle once this fixed. https://bugs.launchpad.net/neutron/+bug/1861496 All ports of server instance are open even no security group does allow this This one is worth a look as it involves security groups potentially not filtering things as expressed by the user. I asked a follow-up question in launchpad, others should chime in. https://bugs.launchpad.net/neutron/+bug/1861502 [OVN] Mechanism driver - failing to recreate floating IP Some errors related to the OVN ML2 driver are being observed in the gate "TypeError: create_floatingip() missing 1 required positional argument: 'floatingip'" https://bugs.launchpad.net/neutron/+bug/1861670 AttributeError: 'NetworkConnectivityTest' object has no attribute 'safe_client' Fix proposed - https://review.opendev.org/#/c/705413/ https://bugs.launchpad.net/neutron/+bug/1861674 Gateway which is not in subnet CIDR is unsupported in ha router This could use some follow-up by the team for clarification Some OVN scheduler-related issues: [OVN] GW rescheduling mechanism is triggered on every Chassis updated unnecessarily https://bugs.launchpad.net/bugs/1861510 Some PoC code up for review - https://review.opendev.org/#/c/705331/ https://bugs.launchpad.net/bugs/1861509 [OVN] GW rescheduling logic is broken RFE's: https://bugs.launchpad.net/neutron/+bug/1861032 Add support for configuring dnsmasq with multiple IPv6 addresses in same subnet on same port https://bugs.launchpad.net/neutron/+bug/1861529 A port's network should be changable -Ryan

1 0

Re: [magnum] Help / Pointers on mirroring https://opendev.org/starlingx in github.com for CNCF certification of starlingx
by Roman Gorshunov 03 Feb '20

03 Feb '20

Hello Bin, Yes, that's correct. When you are connecting to the GitHub, your username should be git. GitHub recognizes you by your SSH key [0]. Example: [roman@pc ~]$ ssh git(a)github.com PTY allocation request failed on channel 0 Hi gorshunovr! You've successfully authenticated, but GitHub does not provide shell access. Connection to github.com closed. [roman@pc ~]$ As you may see, GitHub has recognized me as 'gorshunovr', despite I was using 'git' as a username for SSH. [0] https://help.github.com/en/github/authenticating-to-github/testing-your-ssh… Please, use mailing list for the communication, not direct e-mail. Thank you. Best regards, -- Roman Gorshunov On Mon, Feb 3, 2020 at 3:53 PM Qian, Bin <Bin.Qian(a)windriver.com> wrote: > > Hi Roman, > > Thank you for the information about GitHub mirroring. > Based on the info below, I think what we want to do is to: > 1. create a GitHub account, which has the privilege to commit to our repos, > 2. with the account, create ssh key on zuul server and upload the ssh key to GitHub > 3. use zuul tool [3] to create zuul job secret, embed it to the upload job in zuul.yaml > 4. add the upload job a post job > > But I am not very sure about the step 1, as in the reference [4] below, it states, > "For GitHub, the user parameter is git, not your personal username." > > Would you please let me know if my steps above is correct? > > Thanks, > > Bin > > ________________________________ > From: Waines, Greg > Sent: Thursday, January 30, 2020 10:21 AM > To: Qian, Bin > Cc: Eslimi, Dariush; Khalil, Ghada > Subject: FW: [magnum] Help / Pointers on mirroring https://opendev.org/starlingx in github.com for CNCF certification of starlingx > > fyi > > > > From: Roman Gorshunov <paye600(a)gmail.com> > Date: Thursday, January 30, 2020 at 11:38 AM > To: "openstack-discuss(a)lists.openstack.org" <openstack-discuss(a)lists.openstack.org> > Subject: Re: [magnum] Help / Pointers on mirroring https://opendev.org/starlingx in github.com for CNCF certification of starlingx > > > > Hello Greg, > > > > - Create a GitHub account for the starlingx, you will have URL on > > GitHub like [0]. You may try to contact GitHub admins and ask to > > release starlingx name, as it seems to be unused. > > - Then create SSH key and upload onto GitHub for that account in > > GitHub interface > > - Create empty repositories under [1] to match your existing > > repositories names here [2] > > - Encrypt SSH private key as described here [3] or here [4] using this tool [5] > > - Create patch to all your projects under [2] to '/.zuul.yaml' file, > > similar to what is listed here [6] > > - Change job name shown on line 407 via URL above, description (line > > 409), git_mirror_repository variable (line 411), secret name (line 414 > > and 418), and SSH key starting from line 424 to 463, to match your > > project's name, repo path on GitHub, and SSH key > > - Submit changes to Gerrit with patches for all your project and get > > them merged. If all goes good, the next change merged would trigger > > your repositories to be synced to GitHub. Status could be seen here > > [7] - search for your newly created job manes, they should be nested > > under "upload-git-mirrorMirrors a tested project repository to a > > remote git server." > > > > Hope it helps. > > > > [0] https://github.com/starlingxxxx > > [1] https://github.com/starlingxxxx/... > > [2] https://opendev.org/starlingx/... > > [3] https://docs.openstack.org/infra/manual/zuulv3.html#secret-variables > > [4] https://docs.openstack.org/infra/manual/creators.html#mirroring-projects-to… > > [5] https://opendev.org/zuul/zuul/src/branch/master/tools/encrypt_secret.py > > [6] https://opendev.org/airship/deckhand/src/commit/51dcea4fa12b0bcce65c381c286… > > [7] https://zuul.openstack.org/jobs > > > > Sample content of your addition (patch) to your '/.zuul.yaml' files: > > =================================================== > > - job: > > name: starlingx-compile-upload-git-mirror > > parent: upload-git-mirror > > description: Mirrors starlingx/compile to starlingxxxx/compile > > vars: > > git_mirror_repository: starlingxxxx/compile > > secrets: > > - name: git_mirror_credentials > > secret: starlingx-compile-github-secret > > pass-to-parent: true > > > > - secret: > > name: starlingx-compile-github-secret > > data: > > user: git > > host: github.com > > host_key: github.com ssh-rsa > > AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ== > > ssh_key: !encrypted/pkcs1-oaep > > - <here goes encrypted SSH private key> > > =================================================== > > > > Best regards, > > -- > > Roman Gorshunov > > > >

2 1