October 2021 - openstack-discuss - lists.openstack.org

Openstack Glance image signature and validation for upload and boot controls?
by S Andronic 23 Oct '21

23 Oct '21

Hi, I have a question in regards to Openstack Glance and if I got it right this can be a place to ask, if I am wrong please kindly point me in the right direction. When you enable Image Signing and Certificate Validation in nova.conf: [glance] verify_glance_signatures = True enable_certificate_validation = True Will this stop users from uploading unsigned images or using unsigned images to spin up instances? Intuitively I feel that it will enforce checks only if the signature property exists, but what if it doesn't? Does it control in any way unsigned images? Does it stop users from uploading or using anything unsigned? Would an image without the signing properties just be rejected? If this feature doesn't stop the use of unsigned images as a security control what is the logic behind it then? Is this meant not to stop users from using unsigned images but such that people who do use signed images have verification for their code? So if the goal is to stop people from using random images and image signing and validation is not the answer what would be? Kind Regards, S. Andronic

2 2

[tripleo] Issue finding /etc/docker directory in Centos 8 Overcloud Deployment
by Anirudh Gupta 23 Oct '21

23 Oct '21

Hi Team, I am trying to install Tripleo Train Release on Centos 8 I have successfully installed Undercloud. For overcloud images, I have downloaded and uploaded images given on rdo_trunk https://images.rdoproject.org/centos8/train/rdo_trunk/current-tripleo/ For deployment of overcloud, I executed the command openstack overcloud deploy --templates This command successfully creates a stack, executed the SSH on the machines successfully and then started some ansible tasks. During execution of ansible tasks, it gave a error at below task TASK | manage /etc/docker/daemon.json *The error message clearly states that directory /etc/docker is not found.* This task is present at path " */usr/share/ansible/roles/container-registry/tasks/docker.yml"* Since, in Centos 8 docker has been replaced with Podman, this error is bound to happen Commenting this particular task can be a workaround, but I have no idea what would be the impact of this. There are multiple tasks which makes use of /etc/docker directory Is there any way to resolve this?

2 3

[charms] OpenStack Charms 21.10 release is now available
by Peter Matulis 23 Oct '21

23 Oct '21

The 21.10 release of the OpenStack Charms is now available. This release brings several new features to the existing OpenStack Charms deployments for Queens, Stein, Ussuri, Victoria, Wallaby, Xena and many stable combinations of Ubuntu + OpenStack. Please see the Release notes for full details: https://docs.openstack.org/charm-guide/latest/release-notes/2110.html == Highlights == * OpenStack Xena OpenStack Xena is now supported on Ubuntu 20.04 LTS (via UCA) and Ubuntu 21.10 natively. * Cinder storage backend charms Two stable charms are now available that provide LVM and NetApp storage backends for Cinder. The new charms are cinder-lvm and cinder-netapp respectively. The cinder-lvm charm deprecates the LVM functionality of the cinder charm. A migration path is available. * Cloud operational improvements Improvements have been implemented at the operational level through the addition of many actions and configuration options to the current set of stable charms. * Tech-preview charms Two tech-preview charms are now available. The ceph-dashboard charm deploys the Ceph Dashboard and the openstack-loadbalancer charm deploys a load balancer for OpenStack applications that support the charm. * Documentation updates Ongoing improvements to the OpenStack Charms Deployment Guide, the OpenStack Charm Guide, and the charm READMEs. == OpenStack Charms team == The OpenStack Charms team can be contacted on the #openstack-charms IRC channel (on OFTC) or in the Ubuntu user forum: https://discourse.ubuntu.com/c/openstack/ == Thank you == Lots of thanks to the 57 contributors below who squashed 131 bugs, enabled new features, and improved the documentation! Alex Kavanagh Arif Ali Aurelien Lourot Bartosz Woronicz Billy Olsen Brett Milford Chris MacNaughton Corey Bryant Cornellius Metto Cory Johns David Ames David Negreira Diko Parvanov Dmitrii Shcherbakov Edin Sarajlic Edward Hope-Morley Eric Chen Erlon R. Felipe Reyes Frode Nordahl Gabriel Angelo Garrett Thompson Ghanshyam Mann Gustavo Sanchez Hemanth Nakkina Hernan Garcia James Page James Troup Jarred Wilson John P Jose Phillips Julien Thieffry Liam Young Linda Guo Luciano Lo Martin Kalcok Nicholas Njihia Nicolas Bock Nikhil Kshirsagar Nobuto Murata Peter Matulis Robert Gildein Rodrigo Barbieri Sean McGinnis Simon Dodsley Stephan Pampel Trent Lloyd Vladimir Grevtsev Xav Paice Yoshi Kadokawa YuehuiLei Zhang Hua eric-chen jiangzhilin likui tushargite96 yangyawei -- OpenStack Charms Team

1 0

neutron l3 agents number
by Arnaud Morin 22 Oct '21

22 Oct '21

Hey team, When using DVR + HA, we endup with all routers beeing deployed on the computes (the DVR part) and 3 routers on dvr_snat nodes (for HA). The question is why 3 for snats? I know that this is the max_l3_agents_per_router config parameter, but 2 seems enough? On the other side, DHCP agent default (dhcp_agents_per_network) is 1, while this is also a precious service provided in the tenant network. So, is there any downside on having only 2 agents for routers? Thanks in advance, Arnaud.

3 4

Cannot login to gerrit
by F Yushiro 21 Oct '21

21 Oct '21

Hi, I tried to login ty Gerrit w/ OpenID but redirected the following page and saw "Not Found". https://review.opendev.org/SignInFailure,SIGN_IN,Contact+site+administrator Could you please help me to login? My login email is y.furukawa8(a)gmail.com. I used to use ex-company address. When I left the company, I've modified my email address to above gmail one. I wonder that might occur this situation. Best regards,

2 1

[cinder][PTG] Friday schedule update
by Brian Rosmaita 21 Oct '21

21 Oct '21

Thanks for everyone who's participated so far. We're having a productive PTG! It turns out that it's going to be important for us to participate in the TC discussion of the secure RBAC community goal tomorrow, so I've rearranged our schedule a bit. What we have now is: 1300 UTC: announcements 1302 UTC: Quotas!!! (geguileo) 1330-1500 UTC: community goal: secure RBAC 1500 UTC: Clarify the Volume Driver API, Part 2 1600 UTC: Yoga priorities and responsibilities (rosmaita) The etherpad has been updated and has links to relevant info: https://etherpad.opendev.org/p/yoga-ptg-cinder cheers, brian

1 0

Trove guest agent and Rabbitmq
by wodel youchi 21 Oct '21

21 Oct '21

Hi, I am trying to deploy Trove. I am using the Kolla-ansible and Openstack wallaby version. >From the documentation, the Trove guest agent, which runs inside the Tove instance communicates with the trove-taskmanager via rabbitmq, how is this done? The rabbitmq is running in the api network, the instance is running in the tunnel (tenant) network, and in my case, those networks are in different vlans, how should I configure this? Regards.

3 5

[swift][ptg] Ops feedback session soon - Oct 21 at 13:00 UTC
by Timothy Burke 21 Oct '21

21 Oct '21

As in PTGs past, we're getting devs and ops together to talk about Swift: what's working, what isn't, and what would be most helpful to improve. We're meeting in Havana (https://www.openstack.org/ptg/rooms/havana) at 13:00UTC -- if you run a Swift cluster, we hope to see you there! Even if you can't make it, I'd appreciate if you can offer some feedback on this PTG's etherpad (https://etherpad.opendev.org/p/swift-yoga-ops-feedback) Tim

1 0

[tempest] S3 API tests
by Vladimir Prokofev 20 Oct '21

20 Oct '21

Hello. Are there any Swift S3 API tests in tempest? I didn't find any standard packages, nor as a plugin.

4 5

[Nova][interop]
by Arkady Kanevsky 20 Oct '21

20 Oct '21

Sean and Nova team, Interop WG would like 20-30 minutes on Yaga PTG agenda to discuss latest interop guidelines for Nova. If you can point us to etherpad then we can add it to agenda. Thanks, Arkady -- Arkady Kanevsky, Ph.D. Phone: 972 707-6456 Corporate Phone: 919 729-5744 ext. 8176456

3 6