January 2021 - openstack-discuss - lists.openstack.org

[stable][grenade][qa][nova][swift] s-proxy unable to start due to missing runtime deps
by Lee Yarwood 07 Jan '21

07 Jan '21

Hello all, I wanted to raise awareness of the following issue and to seek some feedback on my approach to workaround it: ImportError: No module named keystonemiddleware.auth_token https://bugs.launchpad.net/swift/+bug/1909018 This was introduced after I landed the following devstack backport stopping projects from installing their test-requirements.txt deps: Stop installing test-requirements with projects https://review.opendev.org/q/I8f24b839bf42e2fb9803dc7df3a30ae20cf264eb For the time being to workaround this in various other gates I've suggested that we disable Swift in Grenade on stable/train: zuul: Disable swift services until bug #1909018 is resolved https://review.opendev.org/c/openstack/grenade/+/768224 This finally allowed openstack/nova to pass on stable/train with the following changes to lower-constraints.txt and test-requirements.txt: [stable-only] Cap bandit to 1.6.2 and raise hacking, flake8 and stestr https://review.opendev.org/c/openstack/nova/+/766171/ Are there any objections to disabling Swift in Grenade for the time being on stable/train? Would anyone have any objections to also disabling it on stable/stein via devstack-gate? Many thanks in advance, -- Lee Yarwood A5D1 9385 88CB 7E5F BE64 6618 BCA6 6E33 F672 2D76

2 4

[neutron] SR-IOV mechanism driver configuration, plugin.ini
by Gabriel Omar Gamero Montenegro 07 Jan '21

07 Jan '21

Dear all, I'm following the OpenStack guide for the implementation of SR-IOV mechanism driver. I'm planning to incorporate this driver to my current OpenStack deployment (Queens). Config SR-IOV Guide: https://docs.openstack.org/neutron/queens/admin/config-sriov.html At point 2, section "Configure neutron-server (Controller)" they said that I have to add the 'plugin.ini' file as a parameter to the neutron-server service. To do this they require to <<edit the appropriate initialization script to configure the neutron-server service to load the plugin configuration file>>: --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini I'd like to know a few things: (1) Which plugin.ini file are talking about? (2) How to set up the neutron-server initialization script to add the plugin.ini file? I understand that this varies between OS distro (I'm currently using Ubuntu 16.04 LTS server) Here are some things I tried... I got the following results executing this command: systemctl status neutron-server.service ● neutron-server.service - OpenStack Neutron Server Loaded: loaded (/lib/systemd/system/neutron-server.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2020-12-29 18:13:50 -05 Main PID: 38590 (neutron-server) Tasks: 44 Memory: 738.8M CPU: 29.322s CGroup: /system.slice/neutron-server.service ├─38590 /usr/bin/python2 /usr/bin/neutron-server --config-file=/etc/neutron/neutron.conf --config-file=/etc/neutron/plugins/ml2/ml2_conf.ini --log-file=/var/log/neutron/neutron-server.log ... I see 2 things: (i) When neutron-server is exectured, the following parameters are passed: --config-file=/etc/neutron/neutron.conf --config-file=/etc/neutron/plugins/ml2/ml2_conf.ini --log-file=/var/log/neutron/neutron-server.log (ii) The file '/lib/systemd/system/neutron-server.service' is loaded and it has the following content: ... ExecStart=/etc/init.d/neutron-server systemd-start ... This indicates me that it's executing '/etc/init.d/neutron-server' script. So I suppose this is the file indicated to add the parameters of the SR-IOV OpenStack documentation, but I have no idea where to put them. For Red-Hat distros I found this documentation with the following configuration: https://access.redhat.com/documentation/en-us/ red_hat_enterprise_linux_openstack_platform/7/html/networking_guide /sr-iov-support-for-virtual-networking vi /usr/lib/systemd/system/neutron-server.service ... ExecStart=/usr/bin/neutron-server --config-file /usr/share/neutron/neutron-dist.conf --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugin.ini --config-file /etc/neutron/plugins/ml2/ml2_conf_sriov.ini --log-file /var/log/neutron/server.log Thanks in advance, Gabriel Gamero

3 2

[neutron] Drivers team meeting agenda
by Slawek Kaplonski 07 Jan '21

07 Jan '21

Hi, Agenda for first drivers team meeting in 2021 is available at [1] We have 3 RFEs to discuss: * https://bugs.launchpad.net/neutron/+bug/1909100 * https://bugs.launchpad.net/neutron/+bug/1900934 For that one there is also spec proposed https://review.opendev.org/c/openstack/neutron-specs/+/768588 and we already discussed that few times. So I think it's time to decide if we want to go with that solution or not :) * https://bugs.launchpad.net/neutron/+bug/1910533 Thx and see You tomorrow on the meeting. [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers#Agenda -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[kolla-ansible] Upgrading and skipping a release?
by Eric K. Miller 07 Jan '21

07 Jan '21

Hi, We're working on some upgrades of OpenStack deployed with Kolla Ansible (Stein and later), and wasn't sure if it was practical or possible to upgrade, say, from Stein to Victoria, or Train to Victoria, directly, instead of upgrading in 3 steps from Stein->Train->Ussuri->Victoria. Any reason skipping a release will cause any known harm? Anybody done this successfully? Thanks! Eric

2 3

[neutron] Performance impact for attaching Security Group with more number of rules
by Dhanasekar Kandasamy 07 Jan '21

07 Jan '21

Hi, We have an OpenStack Environment with 5000+ VMs running currently. I want to apply some common Security Group to all my running VMs. - Common Security Group (SEC_GRP_COMMON) has around 700 rules. - This Security Group (SEC_GRP_COMMON) has been shared to all the OpenStack Projects using Role-Based Access Control (RBAC). - Wanted to apply this Security Group (SEC_GRP_COMMON) to all the running VMs in the Cloud *Question 1*: With the above scenario, what will happen if I attach this Security Group(with 700+ rules) to all the 5000+ VMs? Will there be any performance issue/impact for the same (CPU utilization, Memory etc. in the Compute Server or Performance issues in application running in the VMs) *Question 2*: Is there any recommendations or benchmark data for maximum number of rules in the Security Group in OpenStack cloud? Thanks, Dhana

2 1

tinyipa cannot boot OS of baremetal node
by Ankele zhang 07 Jan '21

07 Jan '21

Hi~ My Rocky OpenStack platform deployed with official documents, includes Keystone/Cinder/Neutron/Nova and Ironic. I used to boot my baremetal nodes by CoreOS downloaded on https://tarballs.opendev.org/openstack/ironic-python-agent/coreos/files/ <https://tarballs.opendev.org/openstack/ironic-python-agent/coreos/files/cor…> Since I want to customize my own HardwareManager for configuring RAID, I have build TinyIPA image tinyipa.tar.gz and tinyipa.vmlinuz with ironic-python-agent-builder(master branch) and ironic-python-agent(rocky branch). Here are all the products of the build process. [image: image.png] Then I used these two images to create the baremetal node, and boot nova server, but I didn't get the results I wanted, it couldn't enter the ramdisk and always in 'wait call-back' state. as following [image: image.png] I got nothing in /var/log/ironic/ironig-conductor.log and /var/log/nova/nova-compute.log I don't know if these two image (tinyipa.tar.gz and tinyipa.vmlinuz) are valid for Ironic. If not, how can I customize HardwareManager? Looking forward to hearing from you. Ankele

3 3

[neutron] Next step for BGP routed networks over segmented provider infrastructure segments
by Thomas Goirand 06 Jan '21

06 Jan '21

Hi Ryan, and all of the Neutron team, Today, I'm happy to let you know that I've been able to finish the patch and that it's merged: https://review.opendev.org/c/openstack/neutron/+/669395 I also managed to add some docs to Neutron about it: https://docs.openstack.org/neutron/latest/admin/config-bgp-floating-ip-over… We've used it in a pre-production environment, and it just works as expected, it's kind of great. However, there's some feature gaps that would need to be addressed. Namely: - external-gateway of routers aren't advertized - we can't do direct attach of public IPs to VMs - I failed adding IPv6 dual stack to this setup Let me go into more details for each of these 3 points. 1/ No BGP advertizing for the router default gateways When doing: openstack router set --external-gateway <provider-net> <router> we then get this type of port: # openstack port show <UUID> -c binding_vif_details -c binding_vif_type +---------------------+-------------------------------------------------------------------------------------------------------------+ | Field | Value | +---------------------+-------------------------------------------------------------------------------------------------------------+ | binding_vif_details | bridge_name='br-int', connectivity='l2', datapath_type='system', ovs_hybrid_plug='True', port_filter='True' | | binding_vif_type | ovs | +---------------------+-------------------------------------------------------------------------------------------------------------+ which doesn't match the type of port we have for floating IPs: # openstack port show <UUID> -c binding_vif_details -c binding_vif_type +---------------------+---------+ | Field | Value | +---------------------+---------+ | binding_vif_details | | | binding_vif_type | unbound | +---------------------+---------+ and then, the next HOP for the router gateway isn't advertized over BGP. Do you know how we could get neutron-dynamic-routing to do that advertizing, with the next HOP on the network node(s)? Where should that code be patch? Inside Neutron, or in neutron-dynamic-routing? Is this really related to the port type as I've showed above? 2/ No direct attach to VM ports We can't attach a port with an IP network:routed directly to a VM. I tried to add the subnet type "compute:nova" to the floating IP subnet, but that didn't do it: Neutron refuses to attach the port to a VM. Do you know why? How and what and where should we patch Neutron to fix this? 3/ IPv6 dual stack I tried to setup a dual-stack network, and failed. How should this be done? Should we add v6 subnets to segments and one subnet with the type --service-type 'network:router_gateway' as well? This is what I tried but it didn't work for me. Should tenants create their own v6 subnet out of the v6 subnet pool I provisioned as admin? Cheers, Thomas Goirand (zigo) P.S: Please keep my Infomaniak colleagues as Cc.

1 0

failed to launch openstack instance when integrating with odl
by mohammad mighani 06 Jan '21

06 Jan '21

Hi everyone I tried to integrate Openstack train with Opendaylight magnesium and my references were [1] and [2] but after doing all the steps, the instance failed to launch. I changed port_binding_controller in [ml2_odl] section in the ml2_conf.ini file from pseudo-agentdb-binding to legacy-port-binding and then the instance launched but the status of router interfaces was still down. I have a controller node and a compute node. and Opendaylight runs on the controller node. nova-compute.log: INFO nova.virt.libvirt.driver [-] [instance: 975fa79e-6567-4385-be87-9d12a8eb3e94] Instance destroyed successfully. 2021-01-02 12:33:23.383 25919 ERROR vif_plug_ovs.ovsdb.impl_vsctl [req-a0a7ebf0-7e63-4c60-a8d2-07c05f1aa4f4 04c7685a2166481a9ace54eb5e71f6e5 ca28ee1038254649ad133d5f09f7a186 - default default] Unable to execute ['ovs-vsctl', '--timeout=120', '--oneline', '--format=json', '--db=tcp: 127.0.0.1:6640', '--', '--if-exists', 'del-port', 'br-int', 'tap50eb0b68-a4']. Exception: Unexpected error while running command. Command: ovs-vsctl --timeout=120 --oneline --format=json --db=tcp: 127.0.0.1:6640 -- --if-exists del-port br-int tap50eb0b68-a4 Exit code: 1 Stdout: '' Stderr: 'ovs-vsctl: tcp:127.0.0.1:6640: database connection failed (Connection refused)\n': oslo_concurrency.processutils.ProcessExecutionError: Unexpected error while running command. controller ovs: Manager "tcp:192.168.222.48:6640" is_connected: true Bridge br-int Controller "tcp:192.168.222.48:6653" is_connected: true fail_mode: secure Port tune52c5c73a50 Interface tune52c5c73a50 type: vxlan options: {key=flow, local_ip="10.0.0.31", remote_ip="10.0.0.11"} Port br-int Interface br-int type: internal Bridge br-ex Port br-ex Interface br-ex type: internal Port ens160 Interface ens160 ovs_version: "2.13.1" compute ovs: Manager "tcp:192.168.222.48:6640" is_connected: true Bridge br-int Controller "tcp:192.168.222.48:6653" is_connected: true fail_mode: secure Port br-int Interface br-int type: internal Port tun34b3712d975 Interface tun34b3712d975 type: vxlan options: {key=flow, local_ip="10.0.0.11", remote_ip="10.0.0.11"} Port tund5123ce5b8a Interface tund5123ce5b8a type: vxlan options: {key=flow, local_ip="10.0.0.11", remote_ip="10.0.0.31"} ovs_version: "2.13.1"

1 0

[ironic] inspector auto-discovery disabled by default in bifrost
by Jacob Anders 06 Jan '21

06 Jan '21

Hi Ironicers, The Ironic team recently decided to change the default inspector auto-discovery behavior in bifrost. In the past, this feature was enabled by default. However, this was causing issues in deployments where the operators had no intention of using auto-discovery but the IPA somehow booted anyway, causing port conflicts and creating failure modes which were particularly tricky to debug. For this reason, inspector auto-discovery has been disabled by default with this change which merged yesterday: https://review.opendev.org/c/openstack/bifrost/+/762998 This is to make sure that the operators utilising inspector auto-discovery in bifrost are aware of this change and can re-enable inspector discovery if desired. Best regards, Jacob

1 0

[Nova]ask for help: how to plug vif to ovs when ovs is not together with nova-compute
by 付志华 05 Jan '21

05 Jan '21

hello， I encountered some problems in deploying the smart network interface card（SmartNIC）where Nova-compute is not together with OVS. For example, OVS is deployed on the SmartNIC and Nova-compute is on the Host(Compute Node), how does Nova plug the virtual interface of VM to OVS bridge? Does the latest version of openstack support this? Thanks.

2 1