October 2021 - openstack-discuss - lists.openstack.org

[ Tacker ] Passing a shell script/parameters as a file in cloud config
by Lokendra Rathour 16 Nov '21

16 Nov '21

Hi, *In Tacker, while deploying VNFD can we pass a file ( parameter file) and keep it at a defined path using cloud-config way?* Like in *generic hot template*s, we have the below-mentioned way to pass a file directly as below: parameters: foo: default: bar resources: the_server: type: OS::Nova::Server properties: # flavor, image etc user_data: str_replace: template: {get_file: the_server_boot.sh} params: $FOO: {get_param: foo} *but when using this approach in Tacker BaseHOT it gives an error saying * "nstantiation wait failed for vnf 77693e61-c80e-41e0-af9a-a0f702f3a9a7, error: VNF Create Resource CREATE failed: resources.obsvrnnu62mb: resources.CAS_0_group.Property error: resources.soft_script.properties.config: No content found in the "files" section for get_file path: Files/scripts/install.py 2021-10-28 00:46:35.677 3853831 ERROR oslo_messaging.rpc.server " do we have a defined way to use the hot capability in TACKER? Defined Folder Structure for CSAR: . ├── BaseHOT │ └── default │ ├── RIN_vnf_hot.yaml │ └── nested │ ├── RIN_0.yaml │ └── RIN_1.yaml ├── Definitions │ ├── RIN_df_default.yaml │ ├── RIN_top_vnfd.yaml │ ├── RIN_types.yaml │ ├── etsi_nfv_sol001_common_types.yaml │ └── etsi_nfv_sol001_vnfd_types.yaml ├── Files │ ├── images │ └── scripts │ └── install.py ├── Scripts ├── TOSCA-Metadata │ └── TOSCA.meta ├── UserData │ ├── __init__.py │ └── lcm_user_data.py *Objective: * To pass a file at a defined path on the VDU after the VDU is instantiated/launched. -- ~ Lokendra skype: lokendrarathour

2 3

Adjutant needs contributors (and a PTL) to survive!
by Adrian Turjak 15 Nov '21

15 Nov '21

Hello fellow OpenStackers! I'm moving on to a different opportunity and my new role will not involve OpenStack, and there sadly isn't anyone at Catalystcloud who will be able to take over project responsibilities for Adjutant any time soon (not that I've been very onto it lately). As such Adjutant needs people to take over, and lead it going forward. I believe the codebase is in a reasonably good position for others to pick up, and I plan to go through and document a few more of my ideas for where it should go in storyboard so some of those plans exist somewhere should people want to pick up from where I left off before going fairly silent upstream. Plus if people want/need to they can reach out to me or add me to code review and chances are I'll comment/review because I do care about the project. Or I may contract some time to it. There are a few clouds running Adjutant, and people who have previously expressed interest in using it, so if you still are, the project isn't in a bad place at all. The code is stable, and the last few major refactors have cleaned up much of my biggest pain points with it. Best of luck! - adriant

5 6

[neutron] CI meeting time slot
by Slawek Kaplonski 15 Nov '21

15 Nov '21

Hi, As per PTG discussion, I prepared doodle to check what would be the best time slot for most of the people. Doodle is at [1]. Please fill it in if You are interested attending the weekly Neutron CI meeting. Meeting is on the #openstack-neutron irc channel, but we are also planning to do it on video from time to time. The timeslots in doodle have dates for next week, but please ignore them. It's just to pick the best time slot for the meeting to use it weekly. Next week meeting will be for sure still in the current time slot, which is Tuesday 1500 UTC. [1] https://doodle.com/poll/3n2im4ebyxhs45ne?utm_source=poll&utm_medium=link -- Slawek Kaplonski Principal Software Engineer Red Hat

1 1

[neutron] openflow rules tools
by Arnaud Morin 12 Nov '21

12 Nov '21

Hello, When using native ovs in neutron, we endup with a lot of openflow rules on ovs side. Debugging it with regular ovs-ofctl --color dump-flows is kind of painful. Is there any tool that the community is using to manage that? Thanks in advance! Arnaud.

5 5

[all] Anyone use or would like to maintain openstack/training-labs repo
by Ghanshyam Mann 11 Nov '21

11 Nov '21

Hello Everyone, During the TC weekly meeting and PTG discussion to merge the 'Technical Writing' SIG into TC, we found that openstack/training-labs is no maintained now a days. Even we do not know who use this repo for training. I have checked that upstream institute training or CoA are not using this repo in their training. If you are using it for your training please reply to this email pr ping us on #openstack-tc IRC OFTC channel otherwise we will start the retirement process. - https://opendev.org/openstack/training-labs -gmann

1 1

[all][tc] Continuing the RBAC PTG discussion
by Ghanshyam Mann 10 Nov '21

10 Nov '21

Hello Everyone, As decided in PTG, we will continue the RBAC discussion from where we left in PTG. We will have a video call next week based on the availability of most of the interested members. Please vote your available time in below doodle vote by Thursday (or Friday morning central time). - https://doodle.com/poll/6xicntb9tu657nz7 NOTE: this is not specific to TC or people working in RBAC work but more to wider community to get feedback and finalize the direction (like what we did in PTG session). Meanwhile, feel free to review the lance's updated proposal for community-wide goal - https://review.opendev.org/c/openstack/governance/+/815158 -gmann

1 3

[kuryr] Using kuryr-kubernetes CNI without neutron agent(s)?
by Jason Anderson 08 Nov '21

08 Nov '21

Hello all, I’m interested in letting Neutron provide the network configuration frontend for networks realized on k8s kubelets. I have been reading a lot about kuryr-kubernetes and it looks like it fits the bill, but some of the older architecture diagrams I’ve seen indicate that OVS and the neutron-openvswitch-agent (or similar) must also run on the kubelet node. Is this still accurate? I am hoping to avoid this because my understanding is that running the OVS agent means giving the kubelet node access to RabbitMQ and potentially storing admin keystone creds on the node as well. Can kuryr-kubernetes work without such an agent co-located? Thanks! Jason Anderson --- Chameleon DevOps Lead Department of Computer Science, University of Chicago Mathematics and Computer Science, Argonne National Laboratory

2 5

[docs] Double headings on every page
by Peter Matulis 04 Nov '21

04 Nov '21

Hi, I'm hitting an oddity in one of my projects where the titles of all pages show up twice. Example: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/wall… Source file is here: https://opendev.org/openstack/charm-deployment-guide/src/branch/master/depl… Does anyone see what can be causing this? It appears to happen only for the current stable release ('wallaby') and 'latest'. Thanks, Peter

5 6

[barbican] Simple Crypto Plugin kek issue
by Ammad Syed 04 Nov '21

04 Nov '21

Hi, I have installed barbican and using it with openstack magnum. When I am using the default kek describe in document below, works fine and magnum cluster creation goes successful. https://docs.openstack.org/barbican/latest/install/barbican-backend.html But when I generate a new kek with below command. python3 -c "from cryptography.fernet import Fernet ; key = Fernet.generate_key(); print(key)" and put it in barbican.conf, the magnum cluster failed to create and I see below logs in barbican. 2021-10-29 12:53:28.932 568554 INFO barbican.plugin.crypto.simple_crypto [req-aaac01e9-82af-421b-b85a-ff998d904972 ad702ac807f44c73a32a9b7a795b693c d782069f335041138f0cb141fde9933f - default default] Software Only Crypto initialized 2021-10-29 12:53:28.932 568554 DEBUG barbican.model.repositories [req-aaac01e9-82af-421b-b85a-ff998d904972 ad702ac807f44c73a32a9b7a795b693c d782069f335041138f0cb141fde9933f - default default] Getting session... get_session /usr/lib/python3/dist-packages/barbican/model/repositories.py:364 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers [req-aaac01e9-82af-421b-b85a-ff998d904972 ad702ac807f44c73a32a9b7a795b693c d782069f335041138f0cb141fde9933f - default default] Secret creation failure seen - please contact site administrator.: cryptography.fernet.InvalidToken 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers Traceback (most recent call last): 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/fernet.py", line 113, in _verify_signature 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers h.verify(data[-32:]) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/hazmat/primitives/hmac.py", line 70, in verify 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers ctx.verify(signature) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/hmac.py", line 76, in verify 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers raise InvalidSignature("Signature did not match digest.") 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers cryptography.exceptions.InvalidSignature: Signature did not match digest. 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers During handling of the above exception, another exception occurred: 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers Traceback (most recent call last): 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/api/controllers/__init__.py", line 102, in handler 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers return fn(inst, *args, **kwargs) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/api/controllers/__init__.py", line 88, in enforcer 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers return fn(inst, *args, **kwargs) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/api/controllers/__init__.py", line 150, in content_types_enforcer 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers return fn(inst, *args, **kwargs) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/api/controllers/secrets.py", line 456, in on_post 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers new_secret, transport_key_model = plugin.store_secret( 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/plugin/resources.py", line 108, in store_secret 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers secret_metadata = _store_secret_using_plugin(store_plugin, secret_dto, 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/plugin/resources.py", line 279, in _store_secret_using_plugin 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers secret_metadata = store_plugin.store_secret(secret_dto, context) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/plugin/store_crypto.py", line 96, in store_secret 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers response_dto = encrypting_plugin.encrypt( 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/plugin/crypto/simple_crypto.py", line 76, in encrypt 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers kek = self._get_kek(kek_meta_dto) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/barbican/plugin/crypto/simple_crypto.py", line 73, in _get_kek 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers return encryptor.decrypt(kek_meta_dto.plugin_meta) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/fernet.py", line 76, in decrypt 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers return self._decrypt_data(data, timestamp, ttl, int(time.time())) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/fernet.py", line 125, in _decrypt_data 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers self._verify_signature(data) 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers File "/usr/lib/python3/dist-packages/cryptography/fernet.py", line 115, in _verify_signature 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers raise InvalidToken 2021-10-29 12:53:28.991 568554 ERROR barbican.api.controllers cryptography.fernet.InvalidToken Any advise how to fix it ? - Ammad

2 1

[ptl][release][stable][EM] Extended Maintenance - Ussuri
by Előd Illés 03 Nov '21

03 Nov '21

Hi, As Xena was released last week and we are in a less busy period, now it is a good time to call your attention to the following: In a month Ussuri is planned to transition to Extended Maintenance phase [1] (planned date: 2021-11-12). I have generated the list of the current *open* and *unreleased* changes in stable/ussuri for the follows-policy tagged repositories [2] (where there are such patches). These lists could help the teams who are planning to do a *final* release on Ussuri before moving stable/ussuri branches to Extended Maintenance. Feel free to edit and extend these lists to track your progress! * At the transition date the Release Team will tag the *latest* Ussuri releases of repositories with *ussuri-em* tag. * After the transition stable/ussuri will be still open for bug fixes, but there won't be official releases anymore. *NOTE*: teams, please focus on wrapping up your libraries first if there is any concern about the changes, in order to avoid broken (final!) releases! Thanks, Előd [1] https://releases.openstack.org/ [2] https://etherpad.opendev.org/p/ussuri-final-release-before-em

1 1