February 2020 - openstack-discuss

[operators][cinder][nova][glance] possible data loss situation (bug 1852106)
by Brian Rosmaita 20 Feb '20

20 Feb '20

tl;dr: If you are running the OpenStack Train release, add the following to the [DEFAULT]non_inheritable_image_properties configuration option [0] in your nova.conf: cinder_encryption_key_id,cinder_encryption_key_deletion_policy About Your nova.conf ==================== - if you already have a value set for non_inheritable_image_properties, add the above to what you currently have - if non_inheritable_image_properties is *not* set in your current nova.conf, you must set its value to include BOTH the above properties AND the default values (which you can see when you generate a sample nova configuration file [1]) NOTE: At a minimum, the non_inheritable_image_properties list should contain: - the properties used for image-signature-validation (these are not transferrable from image to image): * img_signature_hash_method * img_signature * img_signature_key_type * img_signature_certificate_uuid - the properties used to manage the keys for images of cinder encrypted volumes: * cinder_encryption_key_id * cinder_encryption_key_deletion_policy - review the documentation to determine whether you want to include the other default properties: * cache_in_nova * bittorrent Details ======= This issue is being tracked as Launchpad bug 1852106 [2]. This is probably a low-occurrence situation, because in order for the issue to occur, all of the following must happen: (0) using the OpenStack Train release (or code from master (Ussuri development)) (1) cinder_encryption_key_id and cinder_encryption_key_deletion_policy are NOT included in the non_inheritable_image_properties setting in nova.conf (which they aren't, by default) (2) a user has created a volume of an encrypted volume-type in the Block Storage service (cinder). Call this Volume-1 (3) using the Block Storage service, the user has uploaded the encrypted volume as an image to the Image service (glance). Call this Image-1 (4) using the Compute service (nova), the user has attempted to directly boot a server from the image. (Note: this is an unsupported action, the supported workflow is to use the image to boot-from-volume.) (5) although an unsupported action, if a user does (4), it currently results in a server in status ACTIVE but which is unusable because the operating system can't be found (6) using the Compute service, the user requests the createImage action on the unusable (yet ACTIVE) server, resulting in Image-2 (7) using the Image service, the user deletes Image-2 (which has inherited the cinder_encryption_key_* properties from Image-1) upon which the encryption key is deleted, thereby rendering Image-1 non-decryptable so that it can no longer be used in the normal boot-from-volume workflow NOTE 1: the cinder_encryption_key_deletion_policy image property was introduced in Train. In pre-Train releases, deleting the useless Image-2 in step (7) does NOT result in encryption key deletion. NOTE 2: Volume-1 created in step (2) has a *different* encryption key ID than the one associated with Image-1. Thus, even in the scenario where Image-1 becomes non-decryptable, Volume-1 is not affected. Workaround ========== When cinder_encryption_key_id,cinder_encryption_key_deletion_policy are added to the non_inheritable_image_properties setting in nova.conf, the useless Image-2 created in step (6) above will not have the image properties on it that enable Glance to delete the encryption key still in use by Image-1. This does not, however, protect images for which steps (4)-(6) have been performed before the deployment of this workaround. The safest way to deal with images created before the workaround is deployed is to remove the cinder_encryption_key_deletion_policy image property from any image that has it (or to change its value to 'do_not_delete'). While it is possible to use other image properties to identify images created by Nova as opposed to images created by Cinder, this is not guaranteed to be reliable because image properties may have been modified or removed by the image owner. Proposed Longer-term Fixes ========================== - In the Ussuri release, the unsupported action in step (4) above will result in a 400 rather than an active yet unusable server. Hence it will no longer be possible to create the image of the unusable server that causes the issue. [3] - Additionally, given that the image properties associated with cinder encrypted volumes and image signature validation are specific to a single image and should not be inherited by server snapshots under any circumstances, in Ussuri these "absolutely non-inheritable image properties" will no longer be required to appear in the non_inheritable_image_properties configuration setting in order to prevent them from being propagated to server snapshots. [4] References ========== [0] https://docs.openstack.org/nova/train/configuration/config.html#DEFAULT.non… [1] https://docs.openstack.org/nova/train/configuration/sample-config.html [2] https://bugs.launchpad.net/nova/+bug/1852106 [3] https://review.opendev.org/#/c/707738/ [4] https://review.opendev.org/#/c/708126/

2 1

[operators][cinder] driver removal policy update
by Brian Rosmaita 20 Feb '20

20 Feb '20

The Cinder driver removal policy has been updated [0]. Drivers eligible for removal, at the discretion of the team, may remain in the code repository as long as they continue to pass OpenStack CI testing. When such a driver blocks the CI check or gate, it will be removed immediately. The intent of the policy revision is twofold. First, it gives vendors a longer grace period in which to make the necessary changes to have their drivers reinstated as ‘supported’. Second, keeping these drivers in-tree longer should make life easier for operators who have deployed storage backends with drivers that have been marked as ‘unsupported’. Please see the full statement of the policy [0] for details. [0] https://docs.openstack.org/cinder/latest/drivers-all-about.html#driver-remo…

1 0

[cinder] volume-local-cache spec - last call
by Brian Rosmaita 20 Feb '20

20 Feb '20

The volume-local-cache spec [0], which was granted a Cinder spec-freeze exception, currently has two +2s. It's been reviewed by a lot of people, and as far as I can tell, everyone's concerns have been addressed at this point. However, I'd like to give people one last opportunity to verify this for themselves. Unless a substantive objection is raised, I intend to approve the spec around 12:30 UTC tomorrow (Thursday) so that it can be merged before the Nova meeting at 14:00 UTC. cheers, brian [0] https://review.opendev.org/#/c/684556/

1 0

[kolla] Following Nova with XenAPI deprecation
by Radosław Piliszek 20 Feb '20

20 Feb '20

Hello fellow OpenStackers! There exists some logic in Kolla Ansible that handles XenAPI-specific overrides and bootstrapping with os-xenapi. It is one of those murky, untested features that we prefer to remove as soon as possible. :-) Hence we follow Nova in deprecating this functionality for removal. We will do the removal in Victoria. If you are using XenAPI with recent Kolla-Ansible, please let us know. I will be proposing deprec changes later today. As far as other deployment projects are concerned, DevStack, OpenStack-Helm and Puppet-OpenStack seem to still handle XenAPI specifics. -yoctozepto

1 0

[OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)
by Jeremy Stanley 20 Feb '20

20 Feb '20

============================================================= OSSA-2020-001: Nova can leak consoleauth token into log files ============================================================= :Date: February 19, 2020 :CVE: CVE-2015-9543 Affects ~~~~~~~ - Nova: <18.2.4,>=19.0.0<19.1.0,>=20.0.0<20.1.0 Description ~~~~~~~~~~~ Paul Carlton from HP reported a vulnerability in Nova. An attacker with read access to the serviceâ€™s logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. Patches ~~~~~~~ - https://review.opendev.org/707845 (Queens) - https://review.opendev.org/704255 (Rocky) - https://review.opendev.org/702181 (Stein) - https://review.opendev.org/696685 (Train) - https://review.opendev.org/220622 (Ussuri) Credits ~~~~~~~ - Paul Carlton from HP (CVE-2015-9543) References ~~~~~~~~~~ - https://launchpad.net/bugs/1492140 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9543 Notes ~~~~~ - The stable/queens branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley, on behalf of OpenStack Vulnerability Management

1 0

[oslo][release] oslo.limit mistakenly released as 1.0.0
by Ben Nemec 20 Feb '20

20 Feb '20

Hi, We seem to have created a bit of a problem with the latest oslo.limit release. In keeping with our general policy of bumping the major version when we release libraries without py2 support, oslo.limit got bumped to 1.0. Unfortunately, being a pre-1.0 library it should have only had the minor version bumped. This puts us in an awkward situation since the library is still under heavy development and we expect the API will change, possibly multiple times, before we're ready to commit to a stable API. We also need the ability to continue doing releases during development so we can test the library with consuming projects. I can think of a few options, although I won't guarantee all of these are even possible: * Unpublish 1.0.0 and do further pre-1.0 development on a feature branch cut from before we released 1.0.0. Once we're ready for "1.0", we merge the feature branch to master and release it as 2.0.0. * Stick a big disclaimer in the 1.0.0 docs that it is still under development and proceed to treat 1.0 the same as we would have treated a pre-1.0 library. Again, when ready for "1.0" we tag it 2.0.0. * Make our breaking changes as needed and just continue bumping the major version every release. This unfortunately makes it hard to communicate via the version when the library is ready for use. :-/ * [some better idea that you suggest :-)] Any input on the best way to handle this is greatly appreciated. Thanks. -Ben

9 22

[vmware][hyperv][kolla] Is there any interest? (or should we deprecate and remove?)
by Radosław Piliszek 19 Feb '20

19 Feb '20

Hello Fellow Stackers, In Kolla and Kolla-Ansible we have some support for VMware (both hypervisor and networking controller stuff) and Hyper-V. The issue is the relevant code is in pretty bad shape and we had no recent reports about these being used nor working at all for that matter and we are looking into dropping support for these. Please respond if you are interested in these. Long term we would require access to some CI running these to really keep things in shape. -yoctozepto

1 1

Re: [openstack-dev][kuryr] Not working in ARM64 (as Node)
by mdulko＠redhat.com 19 Feb '20

19 Feb '20

Hi, So from this run you need the kuryr-controller logs. Apparently the pod never got annotated with an information about the VIF. Thanks, Michał On Fri, 2020-02-07 at 05:14 +0000, VeeraReddy wrote: > Hi mdulko, > Thanks for your support. > > As you mention i removed readinessProbe and > livenessProbe from Kuryr pod definitions. Still i am facing issue , unable to create pod. > > > > > Attached kubelet and kuryr-cni logs. > > > > Regards, > Veera. > > > On Thursday, 6 February, 2020, 05:19:12 pm IST, <mdulko(a)redhat.com> wrote: > > > Hm, nothing too troubling there too, besides Kubernetes not answering > on /healthz endpoint. Are those full logs, including the moment you > tried spawning a container there? It seems like you only pasted the > fragments with tracebacks regarding failures to read /healthz endpoint > of kube-apiserver. That is another problem you should investigate - > that causes Kuryr pods to restart. > > At first I'd disable the healthchecks (remove readinessProbe and > livenessProbe from Kuryr pod definitions) and try to get fresh set of > logs. > > On Thu, 2020-02-06 at 10:46 +0000, VeeraReddy wrote: > > Hi mdulko, > > Please find kuryr-cni logs > > http://paste.openstack.org/show/789209/ > > > > > > Regards, > > Veera. > > > > > > On Thursday, 6 February, 2020, 04:08:35 pm IST, <mdulko(a)redhat.com> wrote: > > > > > > Hi, > > > > The logs you provided doesn't seem to indicate any issues. Please > > provide logs of kuryr-daemon (kuryr-cni pod). > > > > Thanks, > > Michał > > > > On Thu, 2020-02-06 at 07:09 +0000, VeeraReddy wrote: > > > Hi, > > > I am trying to run kubelet in arm64 platform > > > 1. Generated kuryr-cni successfullly. using kur-cni Dockerfile > > > 2. Generated kuryr-cni-arm64 container. > > > 3. my kube-kuryr-arm64.yml (http://paste.openstack.org/show/789208/) > > > > > > My master node in x86 installed successfully using devstack > > > > > > While running kubelet in arm platform , not able to create kubelet interface (kubelet logs: http://paste.openstack.org/show/789206/) > > > > > > COntroller logs: http://paste.openstack.org/show/789209/ > > > > > > Please help me to fix the issue > > > > > > Veera. > > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > Veera. > > > > > >

2 6

Virtio memory balloon driver
by Albert Braden 19 Feb '20

19 Feb '20

When we build a Centos 7 VM with 1.4T RAM it fails with "[ 17.797177] BUG: unable to handle kernel paging request at ffff988b19478000" I asked in #centos and they asked me to show a list of devices from a working VM (if I use 720G RAM it works). This is the list: [root@alberttest1 ~]# lspci 00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02) 00:01.0 ISA bridge: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] 00:01.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] 00:01.2 USB controller: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] (rev 01) 00:01.3 Bridge: Intel Corporation 82371AB/EB/MB PIIX4 ACPI (rev 03) 00:02.0 VGA compatible controller: Cirrus Logic GD 5446 00:03.0 Ethernet controller: Red Hat, Inc. Virtio network device 00:04.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:05.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:06.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:07.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [root@alberttest1 ~]# lsusb Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub They suspect that the "Virtio memory balloon" driver is causing the problem, and that we should disable it. I googled around and found this: http://www.linux-kvm.org/page/Projects/auto-ballooning It looks like memory ballooning is deprecated. How can I get rid of the driver? Also they complained about my host bridge device; they say that we should have a newer one: 00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02) Where can I specify the host bridge? <bugs_> ok ozzzo one of the devices is called "virtio memory balloon" [13:18:12] <bugs_> do you see that? [13:18:21] <ozzzo> yes [13:18:47] <bugs_> i suggest you google that and read about what it does - i think it would [13:19:02] <bugs_> be worth trying to disable that device on your larger vm to see what happens [13:19:18] <ozzzo> ok I will try that, thank you [13:19:30] * Altiare (~Altiare@unaffiliated/altiare) has quit IRC (Quit: Leaving) [13:21:45] * Sheogorath[m] (sheogora1(a)gateway/shell/matrix.org/x-uiiwpoddodtgrwwz) joins #centos [13:22:06] <@TrevorH> I also notice that the VM seems to be using the very old 440FX and there's a newer model of hardware available that might be worth checking [13:22:21] <@TrevorH> 440FX chipset is the old old pentium Pro chipset! [13:22:32] <@TrevorH> I had one of those in about 1996

4 11

ops meetups team meeting 2020-2-18
by Chris Morgan 19 Feb '20

19 Feb '20

The OpenStack Ops Meetups team meeting was held today on IRC, minutes linked below. Key links vancouver opendev+ptg : https://www.openstack.org/events/opendev-ptg-2020/ South Korea Ops Meetup proposal : https://etherpad.openstack.org/p/ops-meetup-2nd-korea-2020 OpenInfra summit 2020 announced for Berlin, Oct 19-23 : https://superuser.openstack.org/articles/inside-open-infrastructure-the-lat… The meetups team will be proposing content for Vancouver and will shortly solicit feedback on preferred dates for the Ops Meetups even in South Korea. Please follow https://twitter.com/osopsmeetup for more announcements. Minutes: <•openstack> Meeting ended Tue Feb 18 15:37:42 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) 10:37 AM Minutes: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… 10:37 AM Minutes (text): http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… 10:37 AM Log: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… Chris Morgan - on behalf of the OpenStack Ops Meetups team ( https://wiki.openstack.org/wiki/Ops_Meetups_Team) -- Chris Morgan <mihalis68(a)gmail.com>

1 0

Re: [Release-job-failures] Release of openstack/puppet-keystone for ref refs/tags/16.1.0 failed
by Thierry Carrez 19 Feb '20

19 Feb '20

We had a series of failures uploading Puppet artifacts to the forge: Forge API failed to upload tarball with code: 500 errors: An error was encountered while processing your request, please try again later. This affected: openstack/puppet-ceilometer (16.1.0) https://zuul.opendev.org/t/openstack/build/5b0b890d777545c098ea88b70eb89b52 openstack/puppet-panko (16.1.0) https://zuul.opendev.org/t/openstack/build/073cbb3b72ac4241aa1802ccbaf4ada5 openstack/puppet-murano (16.1.0) https://zuul.opendev.org/t/openstack/build/b07a78bd59c84176bb7d9d2f1e0f635c openstack/puppet-keystone (16.1.0) https://zuul.opendev.org/t/openstack/build/be7510a717d3413ab008ab3d34db3672 As a result the tarballs were not uploaded to tarballs.openstack.org either. I think we should reenqueue the tag reference to retrigger the release-openstack-puppet job for those ? -- Thierry Carrez (ttx)

2 1

[neutron] Can br-ex and br-tun use the same interface?
by Zhengyu Pan 18 Feb '20

18 Feb '20

hi, I have only two physical interfaces. In my deploying, network node and compute node are the same. Can Bridge br-tun and br-ex use the same interface when using vxlan network type ? management network use the other interface?

3 5

[nova][cinder] What should the behaviour of extend_volume be with attached encrypted volumes?
by Lee Yarwood 18 Feb '20

18 Feb '20

Hello all, The following bug was raised recently regarding a failure to extend attached encrypted volumes: Failing to extend an attached encrypted volume https://bugs.launchpad.net/nova/+bug/1861071 I've worked up a series below that resolves this for LUKSv1 volumes by taking the LUKSv1 header into account before calling Libvirt to resize the block device within the instance: https://review.opendev.org/#/q/topic:bug/1861071 This results in the instance visable block device being resized to a size just smaller than that requested through Cinder's API. My question to the list is if that behaviour is acceptable given the same call to extend an attached unencrypted volume *will* grow the instance visable block device to the requested size? Many thanks in advance, -- Lee Yarwood A5D1 9385 88CB 7E5F BE64 6618 BCA6 6E33 F672 2D76

1 1

[kolla][zun] Zun image source
by Hongbin Lu 18 Feb '20

18 Feb '20

Hi Kolla team, I was looking into the CentOS Zun image downloaded from DockerHub. It looks the source code is from stable/train branch: $ docker run kolla/centos-source-zun-compute:master cat zun/zun.egg-info/pbr.json {"git_version": "25e56636", "is_release": false} The git_version points to the stable/train branch, but I think it should point to the master branch. FWIW, I also checked the Ubuntu image and the git version in there looks correct: $ docker run kolla/ubuntu-source-zun-compute:master cat zun/zun.egg-info/pbr.json {"git_version": "6fbf52ae", "is_release": false} Any suggestion? Best regards, Hongbin

2 1

[tripleo] deep-dive containers & tooling
by Emilien Macchi 18 Feb '20

18 Feb '20

Hi folks, On Friday I'll do a deep-dive on where we are with container tools. It's basically an update on the removal of Paunch, what will change etc. I'll be on Bluejeans at 2pm UTC, anyone is welcome to join and ask questions or give feedback. https://bluejeans.com/6007759543 Link of the slides: https://docs.google.com/presentation/d/111sEwyIKxx2NCqTIQizdPNVaRbv0HAT5YeM… -- Emilien Macchi

2 4

Re: [Ask OpenStack] 7 updates about "galera", "rabbiitmq", "auth_token", "keysone", "swift-proxy" and more
by Gaurav Goyal 18 Feb '20

18 Feb '20

Dear Openstack Experts, We are using a big openstack setup in our organization and different operation teams adds new computes nodes to it. We as system admin of this Openstack environment wants to audit the configuration parameters on all the nodes. Can you please help to suggest a better way (Tools) to audit this environment? Awaiting your kind reply. Regards Gaurav Goyal On Wed, Feb 12, 2020 at 10:26 PM <communitymngr(a)openstack.org> wrote: > Dear Gaurav Goyal, > > Ask OpenStack has these updates, please have a look: > > - Kubernetes cluster created with Magnum doesn't work > <https://ask.openstack.org/en/question/126164/kubernetes-cluster-created-wit…> (new > question) > - how do i list the top objects consuming more space in the swift > container > <https://ask.openstack.org/en/question/126161/how-do-i-list-the-top-objects-…> (new > question) > - action requests is empty > <https://ask.openstack.org/en/question/126160/action-requests-is-empty/?sort…> (new > question) > - How to Migrate OpenStack Instance from one Tenant to another > <https://ask.openstack.org/en/question/126159/how-to-migrate-openstack-insta…> (new > question) > - Architecture of keystone, swift and memcached together > <https://ask.openstack.org/en/question/126158/architecture-of-keystone-swift…> (3 > rev) > - why is octavia not using keystone public endpoint to validate tokens? > <https://ask.openstack.org/en/question/126156/why-is-octavia-not-using-keyst…> (new > question) > - Error while launching instance on openstack > <https://ask.openstack.org/en/question/126150/error-while-launching-instance…> (2 > rev, 1 ans, 3 ans rev) > > To change frequency and content of these alerts, please visit your user > profile > <https://ask.openstack.org/en/users/18141/gaurav-goyal/subscriptions/>. > To unsubscribe, visit this page > <https://ask.openstack.org/en/users/unsubscribe/?key=89e52fdededaf7e8066737b…> > If you believe that this message was sent in an error, please email about > it the forum administrator at communitymngr(a)openstack.org. > ------------------------------ > > Sincerely, > Ask OpenStack Administrator > > To unsubscribe: there's a big "Stop Email" button in the link to your user > profile above. >

1 0

[neutron] bug deputy report (Feb 10-17)
by Akihiro Motoki 18 Feb '20

18 Feb '20

Hi, Here is a neutron bug deputy report last week. While 15 new bugs were reported, several bugs needs further investigation and are not triaged yet. I will look into them but it would be great if they need attentions. --- Undecided - https://bugs.launchpad.net/neutron/+bug/1862611 Neutron try to register invalid host to nova aggregate for ironic routed network Undecided It was covered by the last week report, but it needs more eyes familiar with routed network. - https://bugs.launchpad.net/neutron/+bug/1862851 update_floatingip_statuses: StaleDataError: UPDATE statement on table 'standardattributes' expected to update 1 row(s); 0 were matched. Undecided Needs to be checked by folks familiar with DVR. It looks like a race condition. - https://bugs.launchpad.net/neutron/+bug/1862932 [neutron-bgp-dragent] passive agents send wrong number of routes Undecided Needs attention by folks familiar with dynamic-routing stuff. - https://bugs.launchpad.net/neutron/+bug/1863068 Dublicated Neutron Meter Rules in different projects kills metering Undecided - https://bugs.launchpad.net/neutron/+bug/1863091 IPVS setup fails with openvswitch firewall driver, works with iptables_hybrid Undecided - https://bugs.launchpad.net/neutron/+bug/1863110 2/3 snat namespace transitions to master Undecided - https://bugs.launchpad.net/neutron/+bug/1863201 stein regression listing security group rules Undecided - https://bugs.launchpad.net/neutron/+bug/1863213 Spawning of DHCP processes fail: invalid netcat options Undecided ralonsoh assigned himself. Any update on this? Incomplete - https://bugs.launchpad.net/neutron/+bug/1863206 Port is reported with 'port_security_enabled=True' without port-security extension Incomplete I think the bug author misunderstood the default of port-security extension behavior. Double check would be appreciated. Confirmed - https://bugs.launchpad.net/neutron/+bug/1863577 [ovn] tempest.scenario.test_network_v6.TestGettingAddress tests failing 100% times Confirmed, High In Progress - https://bugs.launchpad.net/neutron/+bug/1862618 [OVN] functional test test_virtual_port_delete_parents is unstable In Progress, Medium - https://bugs.launchpad.net/neutron/+bug/1862703 Neutron remote security group does not work In Progress, High - https://bugs.launchpad.net/neutron/+bug/1862648 [OVN] Reduce the number of tables watched by MetadataProxyHandler High, Fix Released - https://bugs.launchpad.net/neutron/+bug/1862893 [OVN]Updating a QoS policy for a port will cause a KeyEerror In Progress, Low Fix Released - https://bugs.launchpad.net/neutron/+bug/1862927 "ncat" rootwrap filter is missing Fix Released The root cause turned out that we need to specify rootwrap filter config by abspath.

1 0

[charms] OpenStack Charms 20.02 release is now available
by Peter Matulis 18 Feb '20

18 Feb '20

The 20.02 release of the OpenStack Charms is now available. This release brings several new features to the existing OpenStack Charms deployments for Queens, Rocky, Stein, Train, and many other stable combinations of Ubuntu + OpenStack. Please see the Release Notes for full details: https://docs.openstack.org/charm-guide/latest/2002.html == Highlights == * New charm: manila-ganesha There is a new charm to support Ganesha for use with Manila and CephFS: manila-ganesha. This charm, as well as the requisite manila and ceph-fs charms, have been promoted to supported status. * Swift global cluster With OpenStack Newton or later, support for a global cluster with Swift is available as a tech preview. * OVN With OpenStack Train or later, support for integration with Open Virtual Network (OVN) is available as a tech preview. * MySQL8 With Ubuntu 19.10 or later, support for MySQL 8 is available as a tech preview. * New charms: watcher and watcher-dashboard There are two new charms to support Watcher, the resource optimization service for multi-tenant OpenStack-based clouds: watcher and watcher-dashboard. This is the first release of these charms and they are available as a tech preview. * Policy overrides The policy overrides feature provides operators with a mechanism to override policy defaults on a per-service basis. The last release (19.10) introduced the feature for a number of charms. This release adds support for openstack-dashboard and octavia charms. * Disabling snapshots as a boot source for the OpenStack dashboard Snapshots can be disabled as valid boot sources for launching instances in the dashboard. This is done via the new 'disable-instance-snapshot' configuration option in the openstack-dashboard charm. == OpenStack Charms team == The OpenStack Charms team can be contacted on the #openstack-charms IRC channel on Freenode. == Thank you == Lots of thanks to the below 49 charm contributors who squashed 53 bugs, enabled support for a new release of OpenStack, improved documentation, and added exciting new functionality! Liam Young Corey Bryant Peter Matulis Sahid Orentino Ferdjaoui Frode Nordahl Alex Kavanagh David Ames Chris MacNaughton Stamatis Katsaounis inspurericzhang Tiago Pasqualini Andrew McLeod ShangXiao Ryan Beisner James Page Felipe Reyes kangyufei Edward Hope-Morley Adam Dyess Xuan Yandong Arif Ali Chris Johnston wangfaxin Aurelien Lourot Alexandros Soumplis Jose Guedez Qitao Tytus Kurek Seyeong Kim Dongdong Tao Haw Loeung Jorge Niedbalski Qiu Fossen Yanos Angelopoulos Syed Mohammad Adnan Karim JiaSiRui Xiyue Wang Adam Dyess Jose Delarosa Alexander Balderson Andreas Jaeger Dmitrii Shcherbakov Jacek Nykis Thobias Trevisan Hemanth Nakkina Shuo Liu Drew Freiberger zhangboye Aggelos Kolaitis -- OpenStack Charms Team

1 0

[blazar] Spec for flexible reservation policy enforcement
by Jason Anderson 18 Feb '20

18 Feb '20

Hi all, Last week I introduced a final version of the flexible reservation usage spec[1]. This builds on the original spec proposed by Pierre Riteau some months ago. The purpose of the functionality is to allow operators to define various limits or more sophisticated policies around advanced reservations, in order to prevent e.g., a single user from reserving all resources for an indefinite amount of time. Instead of a quota-based approach, the decisions are delegated to an external service; a future improvement could be providing a default implementation (perhaps using quotas and some default time limits) that can be deployed alongside Blazar. I would appreciate reviews from the core team and feedback from others as to the design. This work is planned for Ussuri pending spec approval. Thanks, /Jason [1]: https://review.opendev.org/#/c/707042/ -- Jason Anderson Chameleon DevOps Lead Consortium for Advanced Science and Engineering, The University of Chicago Mathematics & Computer Science Division, Argonne National Laboratory

1 0

[goals][Drop Python 2.7 Support] Week R-13 Update (we are at deadline)
by Ghanshyam Mann 17 Feb '20

17 Feb '20

Hello Everyone, Below is the progress on "Drop Python 2.7 Support" at end of R-13 week. Schedule: https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html#sc… Highlights: ======== * Deadline was M-2 (R-13 week). * Things are breaking and being fixed daily. * Do not worry about the gate failure, it is better to break it now and fix so that we can smoothly release Ussuri. * Tempest has dropped the py2 and stop running the py2 jobs and so does devstack. * tempest-full job has been moved to py2 (it started running on py3 when devstack default to py3). This job is not supposed to run on master gate (except d-g which should keep running on py2 jobs). tempest-full-py3 is the py3 version of it. But few master jobs derived from tempest-full needs to either start using tempest-full-py3 or explicitly enable py3. I will be working on those next week. * Bugs & Status: No open bugs as of now. Below is the status of last week's bugs. ** QA dropped py3.5 support also from many tooling like stackviz etc which are branchless and should keep working on stable py3.5 env. We have reverted the dropping py3.5 and working now. ** Nova stable branches are still falling for the u-c reason on nova-live-migration. Fixes are up[2] *** Fixed and gate is green. * * Tempest tox 'all-plugin' usage issue[3] *** Fixed and gate is green. ** neutron-vpass in-tree plugin issue *** Fixed and gate is green. NOTE: I know few py2.7 drop patches are failing on few projects, I will continue debugging those. Help from the failing project will be greatly appreciated to meet the deadline. Project wise status and need reviews: ============================ Phase-1 status: The OpenStack services have not merged the py2 drop patches: NOTE: This was supposed to be completed by milestone-1 (Dec 13th, 19). * Adjutant ** https://review.opendev.org/#/c/706723/ * Masakari ** https://review.opendev.org/#/c/694551/ * Qinling ** https://review.opendev.org/#/c/694687/ Phase-2 status: By today, we should be completing the phase-2 work which is nothing but drop py2 from everything except requirement repo. But we have few repos to merge the patches on priority. * Open review: https://review.opendev.org/#/q/topic:drop-py27-support+status:open How you can help: ============== - Review the patches. Push the patches if I missed any repo. [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-February/012463… [2] https://review.opendev.org/#/q/I8190f93e0a754fa59ed848a3a230d1ef63a06abc [3] https://bugs.launchpad.net/tempest/+bug/1862240 [4] https://review.opendev.org/#/q/topic:bug/1862240+(status:open+OR+status:mer… -gmann

2 2

[cinder][nova] volume-local-cache meeting results
by Brian Rosmaita 17 Feb '20

17 Feb '20

Thanks to everyone who attended this morning, we had a productive meeting. If you missed it and want to know what happened: etherpad: https://etherpad.openstack.org/p/volume-local-cache recording: https://youtu.be/P9bouCCoqVo Liang Fang will be updating the specs to reflect what was discussed: cinder spec: https://review.opendev.org/#/c/684556/ nova spec: https://review.opendev.org/#/c/689070/ cheers, brian

2 1

Automatically remove /var/log directory from the openstack instance
by Md. Ziaul Haque 16 Feb '20

16 Feb '20

Hello, During few days we have faced that from the instance /var/log directory log have been removed automatically after the unexpected reboot. We have faced this issue with centos and ubuntu images. Openstack version is rocky and qemu-kvm version 2.12.0 . If anybody has faced the same issue, kindly help us for solving this issue Thanks & Regards Ziaul

1 0

[queens][config_drive] not working for ubuntu bionic
by Ignazio Cassano 15 Feb '20

15 Feb '20

Hello, I configured config drive and centos instances works fine with it. Ubuntu bionic tries to get metadata from network and cloud-init does not set hostname and does not insert keys for ssh. Any help, please Ignazio

4 10

[queens]neutron][metadata] configuration
by Ignazio Cassano 15 Feb '20

15 Feb '20

Hello everyone, in my installation of Queees I am using many provider networks. I don't use openstack router but only dhcp. I would like my instances to reach the metadata agent without the 169.154.169.254 route, so I would like the provider networks to directly reach the metadata agent on the internal api vip. How can I get this configuration? Thank you Ignazio

3 7

UC Nominations now open
by Amy Marrich 15 Feb '20

15 Feb '20

The nomination period for the February User Committee elections is now open. Any individual member of the Foundation who is an Active User Contributor (AUC) can propose their candidacy (except the two sitting UC members elected in the previous election). Self-nomination is common; no third party nomination is required. Nominations can be made by sending an email to the user-committee(a)lists.openstack.org mailing-list[0], with the subject: “UC candidacy” by February 16, 23:59 UTC aa voting will begin on February 17. The email can include a description of the candidate platform. The candidacy is then confirmed by one of the election officials, after verification of the electorate status of the candidate. Criteria for AUC status can be found at https://superuser.openstack.org/articles/auc-community/. If you are still not sure of your status and would like to verify in advance please email myself(amy(a)demarco.com) and Rain Leander(rleander(a)redhat.com) as we are serving as the Election Officials. Thanks, Amy Marrich (spotz) 0 - Please make sure you are subscribed to this list before sending in your nomination.

1 1