March 2020 - openstack-discuss - lists.openstack.org

[MicroStack] Beta updates and strict (devmode) confinement on edge
by Pete Vander Giessen 05 Mar '20

05 Mar '20

Hi all, It has been a little while since I’ve posted any MicroStack news. MicroStack is a base set of OpenStack services, bundled into a snap. It’s intended for OpenStack workload development (as opposed to development of OpenStack itself), and also contains some experimental features geared toward edge clouds. We’ve just released a new MicroStack beta, with preview support for clustering (e.g., running a control plane node along with several compute nodes). You can install it with: sudo snap install --classic --beta microstack There are some known issues with refreshes from the current beta version of the snap to the new version. You may need to reinstall MicroStack if you’re running the current beta. To address some issues running MicroStack on non LTS Ubuntu distros, as well as lay the groundwork for a smoother refresh/upgrade process going forward, we’re working on making MicroStack into a strictly confined snap! If you’re feeling brave, you can try the (almost) strictly confined snap in developer mode with the following invocation: sudo snap install --devmode --edge microstack Work to put together a completely confined version of the snap, with no need for the devmode flag, is ongoing. You can find more information about MicroStack at https://microstack.run, and talk to the devs either on this mailing list, or on IRC: freenode #openstack-snaps .

1 0

NovaVMware - vCenter / DevStack - ERROR
by Kevin Puusild 04 Mar '20

04 Mar '20

Hello i have written here before but i didn't get any help so i try again. Current Setup: Ubuntu 18.04 Server with 1 vCenter + 1 ESXi i am trying to setup DevStack with vCenter as a hypervisor (not ESXI) following this wiki article: https://wiki.openstack.org/wiki/NovaVMware/DeveloperGuide to prepare to setup my devstack and following this wiki articel https://docs.openstack.org/devstack/latest/ too (compaining these two articles) *localrc* file is containing below information: ENABLED_SERVICES=g-api,g-reg,key,n-api,n-crt,n-cpu,n-net,n-cond,n-sch,n-novnc,n-cauth,rabbit,mysql,horizon VIRT_DRIVER=vsphere VMWAREAPI_IP=#MY_VCENTER_IP VMWAREAPI_USER=#MY_VCENTER_ADMINISTRATOR_USER VMWAREAPI_PASSWORD=#MY_VCENTER_ADMINISTRATOR_PASSWORD VMWAREAPI_CLUSTER=#MY_VCENTER_CLUSTER_NAME DATABASE_PASSWORD=nova RABBIT_PASSWORD=nova SERVICE_TOKEN=nova SERVICE_PASSWORD=nova ADMIN_PASSWORD=nova HOST_IP=#MY_DEVSTACK_MACHINE_IP after running *stack.sh* script i get following error: ++functions:wait_for_compute:448 hostname +functions:wait_for_compute:448 compute_hostname=devstack +functions:wait_for_compute:450 timeout 60 bash -x ++functions:wait_for_compute:450 hostname +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +:: ID= +:: [[ '' == '' ]] +:: sleep 1 +:: [[ vsphere = \f\a\k\e ]] ++:: openstack --os-cloud devstack-admin --os-region RegionOne compute service list --host devstack --service nova-compute -c ID -f value +functions:wait_for_compute:450 rval=124 +functions:wait_for_compute:462 time_stop wait_for_service +functions-common:time_stop:2330 local name +functions-common:time_stop:2331 local end_time +functions-common:time_stop:2332 local elapsed_time +functions-common:time_stop:2333 local total +functions-common:time_stop:2334 local start_time +functions-common:time_stop:2336 name=wait_for_service +functions-common:time_stop:2337 start_time=1582790249013 +functions-common:time_stop:2339 [[ -z 1582790249013 ]] ++functions-common:time_stop:2342 date +%s%3N +functions-common:time_stop:2342 end_time=1582790309198 +functions-common:time_stop:2343 elapsed_time=60185 +functions-common:time_stop:2344 total=7679 +functions-common:time_stop:2346 _TIME_START[$name]= +functions-common:time_stop:2347 _TIME_TOTAL[$name]=67864 +functions:wait_for_compute:464 [[ 124 != 0 ]] +functions:wait_for_compute:465 echo 'Didn'\''t find service registered by hostname after 60 seconds' Didn't find service registered by hostname after 60 seconds +functions:wait_for_compute:466 openstack --os-cloud devstack-admin --os-region RegionOne compute service list +functions:wait_for_compute:468 return 124 +lib/nova:is_nova_ready:1 exit_trap +./stack.sh:exit_trap:533 local r=124 ++./stack.sh:exit_trap:534 jobs -p +./stack.sh:exit_trap:534 jobs= +./stack.sh:exit_trap:537 [[ -n '' ]] +./stack.sh:exit_trap:543 '[' -f /tmp/tmp.8iR1neh89b ']' +./stack.sh:exit_trap:544 rm /tmp/tmp.8iR1neh89b +./stack.sh:exit_trap:548 kill_spinner +./stack.sh:kill_spinner:443 '[' '!' -z '' ']' +./stack.sh:exit_trap:550 [[ 124 -ne 0 ]] +./stack.sh:exit_trap:551 echo 'Error on exit' Error on exit +./stack.sh:exit_trap:553 type -p generate-subunit +./stack.sh:exit_trap:554 generate-subunit 1582789174 1136 fail +./stack.sh:exit_trap:556 [[ -z /opt/stack/logs ]] +./stack.sh:exit_trap:559 /usr/bin/python3.6 /devstack/devstack/tools/worlddump.py -d /opt/stack/logs World dumping... see /opt/stack/logs/worlddump-2020-02-27-075831.txt for details +./stack.sh:exit_trap:568 exit 124 -- Kevin Puusild

1 0

[stable][heat] Nominating Rabi Mishra for heat-stable-maint
by Zane Bitter 04 Mar '20

04 Mar '20

Rabi has been a core reviewer on Heat for more than 4 years, and is a former PTL. In that time he's done hundreds of backports: https://review.opendev.org/#/q/owner:ramishra%2540redhat.com+branch:%22%255… (Only two of which we ended up deciding not to merge, the last of which was in 2016.) As well as a good number of reviews: https://review.opendev.org/#/q/reviewedby:ramishra%2540redhat.com+branch:%2… Rabi also maintains a downstream distribution of Heat, so he is fully aware of the pain that backporting inappropriate changes can cause. He is well aware of the stable branch guidelines and is, if anything, more conservative than I am in applying them. I'm 100% confident he will not be approving any feature backports. I'll be spending some extended time away from a keyboard in the near future, so it's important that we increase the bus factor (from 1) of heat-stable-maint team members. thanks, Zane.

3 2

[oslo][infra] OpenDev git repo for oslo.policy missing commit
by Ben Nemec 04 Mar '20

04 Mar '20

Found a weird thing today. The OpenDev oslo.policy repo[0] is missing [1]. Even stranger, I see it on the Github mirror[2]. Any idea what happened here? -Ben 0: https://opendev.org/openstack/oslo.policy/commits/branch/master 1: https://review.opendev.org/#/c/708212/ 2: https://github.com/openstack/oslo.policy/commits/master

2 2

[policy][keystone][nova][cyborg][barbican][neutron][manila][cinder] Policy Popup team progress report
by Colleen Murphy 04 Mar '20

04 Mar '20

This is an update on the progress made within the Policy Popup team[1] so far this cycle. [1] https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popu… Why This Is Important ===================== Separating system, domain, and project-scope APIs and providing meaningful default roles is critical to facilitating secure cloud deployments and to fulfilling OpenStack's vision as a fully self-service infrastructure provider[2]. Until all projects have completed this policy migration, the "reader" role that exists in keystone is dangerously misleading, and the `[oslo_policy]/enforce_scope` option has limited usefulness as long as projects lack uniformity in how an administrator can use scoped APIs. [2] https://governance.openstack.org/tc/reference/technical-vision.html#self-se… Project Progress ================ Nova ---- - Ussuri spec has merged[3] - 28 changes implementing the spec have been merged[4] - 39 additional changes have been proposed and are awaiting review[5] [3] https://review.opendev.org/686058 [4] https://review.opendev.org/#/q/topic:bp/policy-defaults-refresh+status:merg… [5] https://review.opendev.org/#/q/topic:bp/policy-defaults-refresh+status:open Cyborg ------ - Ussuri spec has merged[6] and a tracking story has been created[7] - 2 changes to implement the spec have been proposed and are awaiting review[8] [6] https://review.opendev.org/699099 [7] https://storyboard.openstack.org/#!/story/2007024 [8] https://review.opendev.org/#/q/project:openstack/cyborg+topic:policy-popup+… Barbican -------- - A table has been created outlining the required policy changes[9] - No patches merged or proposed yet [9] https://wiki.openstack.org/wiki/Barbican/Policy Neutron ------- - No planning document - No patches merged or proposed yet Manila ------ - No planning document - No patches merged or proposed yet Cinder ------ - No planning document - No patches merged or proposed yet How You Can Help ================ If you are a contributor for these teams, please update the popup team wiki page[10] as your project starts to plan and implement policy changes. If you are a cloud operator, please help review the proposed policy rule changes to sanity-check the new scope and role defaults and to help influence these decisions. [10] https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popu… Reminders ========= - Reach out at any time to the keystone team if you have questions on this popup team's goals. - Colleen still seeking to be replaced as co-chair, please let me know if you're interested.

1 0

[Watcher] Queue watcher_notifications
by Alexandros Soumplis 04 Mar '20

04 Mar '20

Hi all, We are using Watcher on Train and we have noticed a problem with the watcher_notifications queue which fills up with messages from Cinder and watcher-decision-engine seems not to consume them. On the contrary it perfectly consumes nova notifications from the versioned_notifications queue. Any suggestions ? a.

1 0

Upcoming UC meeting: March 5th 2020
by Mohamed Elsakhawy 04 Mar '20

04 Mar '20

Good day everyone, As you may have heard, there is an ongoing discussion for having a single body to encompass both the UC and TC responsibilities, potentially by merging the two bodies. This is still at early stages, and thus to facilitate this discussion we will hold tomorrow's UC meeting using video conferencing to allow all audience to easily share their thoughts and input. The meeting will happen at its normal time "13:30 EST", If you are interested in joining, please use the link below https://hangouts.google.com/u/1/call/q_bcZpCRXgB2_Cak4ycyAEEI Thanks Mohamed --melsakhawy

4 6

[neutron] security group list regression
by James Denton 04 Mar '20

04 Mar '20

Hello all, We recently upgraded an environment from Newton -> Rocky, and have noticed a pretty severe regression in the time it takes the API to return the list of security groups. This environment has roughly 8,000+ security groups, and it takes nearly 75 seconds for the ‘openstack security group list’ command to complete. I don’t have actual data from the same environment running Newton, but was able to replicate this behavior with the following lab environments running a mix of virtual and baremetal machines: Newton (VM) Rocky (BM) Stein (VM) Train (BM) Number of sec grps vs time in seconds: # Newton Rocky Stein Train 200 4.1 3.7 5.4 5.2 500 5.3 7 11 9.4 1000 7.2 12.4 19.2 16 2000 9.2 24.2 35.3 30.7 3000 12.1 36.5 52 44 4000 16.1 47.2 73 58.9 5000 18.4 55 90 69 As you can see (hopefully), the response time increased significantly between Newton and Rocky, and has grown slightly ever since. We don't know, yet, if this behavior can be seen with other 'list' commands or is limited to secgroups. We're currently verifying on some intermediate releases to see where things went wonky. There are some similar recent reports out in the wild with little feedback: https://bugzilla.redhat.com/show_bug.cgi?id=1788749 https://bugzilla.redhat.com/show_bug.cgi?id=1721273 I opened a bug here, too: https://bugs.launchpad.net/neutron/+bug/1865223 Bottom line: Has anyone else experienced similar regressions in recent releases? If so, were you able to address them with any sort of tuning? Thanks in advance, James

4 7

[release][tc][horizon] xstatic repositories marked as deprecated
by Akihiro Motoki 04 Mar '20

04 Mar '20

Hi, I noticed some xstatic repositories [1] under the horizon team are marked as deprecated. They are marked as deprecated in [2] as they were never released, but the actual situation looks different. They are used in horizon requirements and the contents of these repositories are same as those in the corresponding PyPI modules. I guess they were released to PyPI based on the repositories but the horizon team just forgot to push the corresponding tags. I would like to drop 'deprecated' mark from the repositories and move them to the proper situation. Does it make sense? If so, what is the right solution to do this? In my understanding, we need to add tags corresponding to the deliverables and to add deliverable files in the releases repo. What I am not sure is whether we can push a tag to a repository without pushing deliverables to PyPI? Or do we need to create another release to tag them in their repositories? [1] Such xstatic repositories are: - xstatic-bootstrap-datepicker - xstatic-hogan - xstatic-jquery-migrate - xstatic-jquery.quicksearch - xstatic-jquery.tablesorter - xstatic-rickshaw - xstatic-spin [2] https://review.opendev.org/#/c/629889/ Thanks, Akihiro Motoki (irc: amotoki)

5 8

[keystone] Keystone Team Update - Week of 2 February 2020
by Vishakha Agarwal 04 Mar '20

04 Mar '20

# Keystone Team Update - Week of 2 March 2020 ## News ### User Support and Bug Duty Every week the duty is being rotated between the members. The person-in-charge for bug duty for current and upcoming week can be seen on the etherpad [1] [1] https://etherpad.openstack.org/p/keystone-l1-duty ## Open Specs Ussuri specs: https://bit.ly/2XDdpkU Ongoing specs: https://bit.ly/2OyDLTh ## Recently Merged Changes Search query: https://bit.ly/2pquOwT We merged 4 changes this week. ## Changes that need Attention Search query: https://bit.ly/2tymTje There are 24 changes that are passing CI, not in merge conflict, have no negative reviews and aren't proposed by bots. ### Priority Reviews * Ussuri Roadmap Stories - Groups in keystone SAML assertion https://tree.taiga.io/project/keystone-ussuri-roadmap/us/33 https://review.opendev.org/#/c/588211/ Add openstack_groups to assertion - Add support for modifying resource options to CLI tool https://tree.taiga.io/project/keystone-ussuri-roadmap/us/53 https://review.opendev.org/#/c/697444/ Adding options to user cli * Special Requests https://review.opendev.org/#/c/710734/ Correcting api-ref for users ## Bugs This week we opened 1 new bug and closed 1. Bugs opened (1) Bug #1865121 (keystone:Undecided): 'openstack token issue' command doesn't issue token for MFA enabled user - Opened by Abhishek Sharma M https://bugs.launchpad.net/keystone/+bug/1865121 Bugs closed (1) Bug #1865121 (keystone:Undecided) https://bugs.launchpad.net/keystone/+bug/1865121 ## Milestone Outlook https://releases.openstack.org/ussuri/schedule.html Feature proposal freeze is NEXT WEEK (March 9- March 16). Spec implementations that are not submitted or still in a WIP state by the end of the week will need to be postponed until next cycle unless we agree on an exception. ## Help with this newsletter Help contribute to this newsletter by editing the etherpad: https://etherpad.openstack.org/p/keystone-team-newsletter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0