February 2021 - openstack-discuss

Proposing Flavio Fernandes (flaviof) for ovsdbapp core
by Terry Wilson 15 Feb '21

15 Feb '21

Flavio has been helping out with ovsdbapp a great deal and I would like to nominate him for ovsdbapp-core. He's written some great code and reviews and will be an asset to the team. Historically, I've just added people who were contributing directly, but seeing as ovsdbapp has moved past 1.0 I thought I'd go ahead and follow official procedures this time. ;) Existing team members, please respond with +1/-1. Thanks! Terry

5 6

[neutron] Bug Deputy Report Feb 8 - 15
by Jakub Libosvar 15 Feb '21

15 Feb '21

Hi everyone, I was bug deputy for the last week. It's been mostly business as usual but I'd like to highlight this bug that needs an assignee: https://bugs.launchpad.net/neutron/+bug/1915341 The problem seems to be with LinuxBridge agent after it's restarted, which is not tested on the gate AFAIK. I don't have an LB environment thus I couldn't confirm but would be great if somebody who maintains and is interested in LB can confirm. Here is the full weekly report: Critical * Neutron run with uwsgi is broken with oslo_policy 3.6.2 - https://bugs.launchpad.net/neutron/+bug/1915494 - Assigned to: Slawek Kaplonski * neutron-linuxbridge-agent not starting due to nf_tables rules - https://bugs.launchpad.net/neutron/+bug/1915341 - Needs an assignee High * test_create_router_set_gateway_with_fixed_ip fails in dvr-ha job - https://bugs.launchpad.net/neutron/+bug/1915271 - In progress: https://review.opendev.org/c/openstack/neutron/+/774785 - Assigned to: Oleg Bondarev * Metadata over IPv6 don't works with L3ha routers - https://bugs.launchpad.net/neutron/+bug/1915495 - Assigned to: Slawek Kaplonski Medium * Split logfiles for neutron-functional-with-uwsgi job are empty - https://bugs.launchpad.net/neutron/+bug/1915272 - In progress: https://review.opendev.org/c/openstack/neutron/+/774865 - Assigned to: Bernard Cafarelli * Resource name and collection name for address groups are incorrectly defined in neutron-lib - https://bugs.launchpad.net/neutron/+bug/1915310 - Fix committed: https://review.opendev.org/c/openstack/neutron-lib/+/774924 - Assigned to: Miguel Lavalle * DeviceManager's fill_dhcp_udp_checksums assumes IPv6 available - https://bugs.launchpad.net/neutron/+bug/1915480 - Needs an assignee Low * Openvswitch firewall - removing and adding security group breaks connectivity - https://bugs.launchpad.net/neutron/+bug/1915530 - Assigned to: Slawek Kaplonski RFEs * [RFE] There should be a way to set ethertype for the vlan_transparent networks - https://bugs.launchpad.net/neutron/+bug/1915151 Kuba

1 1

[tc][heat][tacker] Discusssion about heat-translater and tosca-parser maintenance
by TAKAHASHI TOSHIAKI(高橋　敏明) 15 Feb '21

15 Feb '21

Hi, I'm a tacker team member. I'd like to discuss how to maintain heat-translator[1] and tosca-parser[2] repositories. These 2 repositories have not been updated so actively, but tacker often requires code updates for these repositories. Recently, patch merge progress of tacker and these repo do not sometimes match, which affects the development of tacker. For example, our some functional tests on zuul fail because these master codes are not updated. Therefore, tacker members would like to take part more in these 2 developments. Tacker members have already started code reviews, patch posts, etc. If possible, we want some Tacker members to join the core team in the near future. How about this? [1] https://opendev.org/openstack/heat-translator [2] https://opendev.org/openstack/tosca-parser Regards, Toshiaki

5 9

[ironic] A new project for useful deploy steps?
by Dmitry Tantsur 14 Feb '21

14 Feb '21

Hi all, We have finally implemented in-band deploy steps (w00t!), and people started coming up with ideas. I have two currently: 1) configure arbitrary kernel command line arguments via grub 2) write NetworkManager configuration (for those not using cloud-init) I'm not sure how I feel about putting these in IPA proper, seems like we may go down a rabbit hole here. But what about a new project (ironic-python-agent-extras?) with a hardware manager providing a collection of potentially useful deploy steps? Or should we nonetheless just put them in IPA with priority=0? Opinions welcome. Dmitry -- Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill

4 6

[Interop, Users] listing interop results
by Kanevsky, Arkady 12 Feb '21

12 Feb '21

Dell Customer Communication - Confidential Team, We are reviewing our openstack interop program. We have 3 base "certifications" for interop that cloud vendors can submit and foundation list on marketplace https://www.openstack.org/marketplace/ : 1. Openstack Powered Storage 2. OpenStack Powered Compute 3. OpenStack Powered Platform (combines both compute and storage) These can be viewed as the core. And there are 3 add-on programs for specific projects of openstack: 1. DNS (Designate) 2. Orchestration (Heat) 3. Shared-File-System (Manila) We have 4 categories of clouds that use interop programs and list their offering with interoperability results and logo: 1. Remotely managed private clouds - https://www.openstack.org/marketplace/remotely-managed-private-clouds/ * The latest interop guidelines listed there is 2019.11 and most are from 2017-2018 * All used OpenStack Powered Platform * Vexxhost listed without listing what guidelines they used. (Jimmy can you pull what they had submitted and update their entry) 2. Distros and Appliances - https://www.openstack.org/marketplace/distros/ : * These seems to be updated most often. Several used the latest 2020.06 guidelines * There are usage of all 3 core logos. * No add-on logos listed 3. Hosted Private Clouds - https://www.openstack.org/marketplace/hosted-private-clouds/ : * There is one entry that uses 2020.06 guidelines but most are 2016-2018. * Most for Powered Platform and one for Powered Compute 4. Public Cloud - https://www.openstack.org/marketplace/public-clouds/ : * There is one entry that uses 2020.06 guidelines but most are 2016-2018. * Mixture of Powered Platform and Powered Compute I will skip the question on the value of Marketplace program as it will be discussed separately in newly formed temporary WG under foundation to review/define Open Infrastructure Branding and Trademark policy. We need to address the issue on how to list add-ons for current openstack marketplace program. The simplest way is to add to "TESTED" OpenStack Powered Platform/Compute/Storage also add-ons that vendors passed. In the detailed section we already listing what APIs and services supported and which version. So do not see any changes needed there. Comments and suggestions please? Thanks, Arkady Kanevsky, Ph.D. SP Chief Technologist & DE Dell EMC office of CTO Dell Inc. One Dell Way, MS PS2-91 Round Rock, TX 78682, USA Phone: 512 7204955

4 6

[Neutron] Distributed Virtual Routing with OVN as Backend
by Taha Adel 12 Feb '21

12 Feb '21

Hello OpenStack Community, Let me introduce myself in brief first. My name is Taha and I'm a communications and electronics engineering student in the fourth year. My graduation project is to build a cloud infrastructure suited for Institutions and Universities to fully utilize the idle physical resources on the campus. I'm using OpenStack Platform as the cloud orchestrator, and I have a question regarding the Networking service in the cloud, Neutron. In my project, I want to use Distributed Virtual Routing for Layer three forwarding, floating IPs, and SNAT to limit the management overhead in the could and simplify the architecture. This design should end up with one controller node and a bunch of distributed compute nodes across the university. In my design, all compute nodes are attached to the provider network to allow N/S traffic in a distributed manner. The problem here is that I read in the OpenStack documentation that the SNAT traffic should always traverse through a centralized gateway node, and I need SNAT traffic as well as the other N/S traffic to be distributed across the compute nodes. So, the question here, is there any configuration that should let me fulfill this requirement? Sorry for taking so long, and I appreciate your help in advance. Best regards. Taha Adel عدم التعرض للفيروسات www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

2 1

[openstack-ansible] Check current state of Keystone DB: HAProxy galera-clustercheck fails if external_vip is used
by Philipp Wörner 12 Feb '21

12 Feb '21

Dear all, unfortunately we are facing an problem while setting up Openstack (described at the end of the mail). Last year we had no issue with our configuration. I found the problem why the playbook stops and a temporary workaround. But I dont know the root cause, maybe you can help me with some advice. Thank you in advance! Have a sunny weekend and best regards, Philipp Where setup-openstack.yml stops: TASK [os_keystone : Check current state of Keystone DB] **************************************************************************** **************************************************************************** ****************************** fatal: [infra1_keystone_container-01c233df]: FAILED! => {"changed": true, "cmd": ["/openstack/venvs/keystone-21.2.3.dev4/bin/keystone-manage", "db_sync", "--check"], "delta": "0:01:42.166790", "end": "2021-02-11 13:01:06.282388", "failed_when_result": true, "msg": "non-zero return code", "rc": 1, "start": "2021-02-11 12:59:24.115598", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []} Reason: This is caused because HAProxy thinks the service is not available caused by the health check against port 9200. If I test the cluster-check-service manually, I see the external_vip isnt allowed. root@bc1bl11:/home/ubuntu# telnet -b <internal_vip> 192.168.110.235 9200 Trying 192.168.110.235... Connected to 192.168.110.235. Escape character is '^]'. HTTP/1.1 200 OK Content-Type: text/plain Connection: close Content-Length: 40 Percona XtraDB Cluster Node is synced. Connection closed by foreign host. root@bc1bl11:/home/ubuntu# telnet -b <external_vip> 192.168.110.235 9200 Trying 192.168.110.235... Connected to 192.168.110.235. Escape character is '^]'. Connection closed by foreign host. Workaround: After manually modifying the service-configuration and adding the external_vip to the whitelist everything works and the OSA-playbook succeeds as well: root@infra1-galera-container-492e1206:/# cat /etc/xinetd.d/mysqlchk # default: on # description: mysqlchk # Ansible managed service mysqlchk { disable = no flags = REUSE socket_type = stream port = 9200 wait = no user = nobody server = /usr/local/bin/clustercheck log_on_failure += USERID only_from = 192.168.110.200 192.168.110.235 192.168.110.211 127.0.0.1 per_source = UNLIMITED } Question: I am wondering now why haproxy uses the external_vip to check the mysql-service and why I am facing this problem now because last year everything was fine with our configuration. We just moved the external_vip from the NIC to the bridge in the netplan-config and the external_vip is now in the same network as the internal_vip. Here is also a snipped of our haproxy config: root@bc1bl11:/home/ubuntu# cat /etc/haproxy/haproxy.cfg # Ansible managed global log /dev/log local0 chroot /var/lib/haproxy user haproxy group haproxy daemon maxconn 4096 stats socket /var/run/haproxy.stat level admin mode 600 ssl-default-bind-options force-tlsv12 tune.ssl.default-dh-param 2048 defaults log global option dontlognull option redispatch option forceclose retries 3 timeout client 50s timeout connect 10s timeout http-request 5s timeout server 50s maxconn 4096 frontend galera-front-1 bind 192.168.110.211:3306 option tcplog timeout client 5000s acl white_list src 127.0.0.1/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 tcp-request content accept if white_list tcp-request content reject mode tcp default_backend galera-back backend galera-back mode tcp balance leastconn timeout server 5000s stick store-request src stick-table type ip size 256k expire 30m option tcplog option httpchk HEAD / HTTP/1.0\r\nUser-agent:\ osa-haproxy-healthcheck # server infra1_galera_container-492e1206 192.168.110.235:3306 server infra1_galera_container-492e1206 192.168.110.235:3306 check port 9200 inter 12000 rise 1 fall 1

2 1

[neutron][ovn] ipv6 in virtual networks
by Piotr Misiak 12 Feb '21

12 Feb '21

Hi all, I have a test env with OpenStack Ussuri and OVN deployed by kolla-ansible. I'm struggling with IPv6 VMs addressing. Has anyone deployed such configuration successfully? What is working: - SLAAC for VMs IPv6 addressing - VMs configure IPv6 addresses and can ping each other via IPv6 - VMs can ping virtual router's fe80:: address - OVN is sending ICMPv6 RA packets periodically on virtual private networks What is not working: - VMs can't ping virtual router's private network IPv6 address specified in virtual network configuration in Neutron (IPv6 GUA), I see ICMPv6 echo request packets on tapXXXXX interfaces with a correct DEST MAC, but there are no responses. - Routing is not working at all Besides those, I can't imagine how upstream router will know how to reach a particular private network with GUA IPv6 addresses (to which virtual router send packets to reach a particular private network?). I have a standard external network with IPv6 GUA /64 subnet and virtual routers which connects private networks with IPv6 GUA /64 subnets with external network. I thought that OVN virtual router will send ICMPv6 RA packets on external network with reachable prefixes and upstream router will learn routing info from those but I don't see any RA packets sent by OVN on external network, I see only RA packets from an upstream router. How this should work and be configured? How to configure GUA IPv6 addresses on virtual private networks? Is it supported by Neutron/OVN? Looking forward any responses regarding this area because documentation does not exist technically. Thanks!

3 5

[kolla][osa] Host network configuration tools
by Mark Goddard 12 Feb '21

12 Feb '21

Hi, We're working on adding Ubuntu support to Kayobe, and are at the stage of deciding on which tool to use for host network configuration. The Ansible role we use supports /etc/network/interfaces, but we're thinking it might be sensible to choose something more modern before we get locked in. There are 3 reasonable options, as far as we can tell: * netplan: installed by default on 20.04 server images. Seems like a fairly simple solution, but I have read some reports of missing features. * systemd-networkd: the default renderer for netplan. Standard systemd style interface. We might get around the missing features by using this directly. * NetworkManager: the default on Ubuntu desktop, but have heard it can be a bit heavy and does too much without being asked to. I've also heard that more recent versions are improved. The main reason we would go this route would be for consistency with CentOS/RHEL. Any feedback of experience with these and their suitability for use in OpenStack cloud infrastructure would be appreciated. Thanks, Mark

4 3

[all][interop] Reforming the refstack maintainers team
by Ghanshyam Mann 12 Feb '21

12 Feb '21

Hello Everyone, As Goutham mentioned in a separate ML thread[2] that there is no active maintainer for refstack repo which we discussed in today's interop meeting[1]. We had a few volunteers who can help to maintain the refstack and other interop repo which is good news. I would like to call for more volunteers (new or existing ones), if you are interested to help please do reply to this email. The role is to maintain the source code of the below repos. I will propose the ACL changes in infra sometime next Friday (18th dec) or so. For easy maintenance, we thought of merging the below repo core group into a single group called 'refstack-core' - openstack/python-tempestconf - openstack/refstack - openstack/refstack-client - x/ansible-role-refstack-client (moving to osf/ via https://review.opendev.org/765787) Current Volunteers: - martin (mkopec(a)redhat.com) - gouthamr (gouthampravi(a)gmail.com) - gmann (gmann(a)ghanshyammann.com) - Vida (vhariria(a)redhat.com) - interop-core (we will add this group also which has interop WG chairs so that it will be easy to maintain in the future changes) NOTE: there is no change in the 'interop' repo group which has interop guidelines and doc etc. [1] https://etherpad.opendev.org/p/interop [2] http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019263… -gmann

8 12