February 2021 - openstack-discuss

[zaqar][stable]Proposing Hao Wang as a stable branches core reviewer
by hao wang 05 Feb '21

05 Feb '21

Hi, Thierry I want to propose myself(wanghao) to be a new core reviewer of the Zaqar stable core team. I have been PTL in Zaqar for almost two years. I also want to help the stable branches better. Would you help me to add myself to the zaqar stable core team? Thank you.

2 2

[neutron][victoria] Front / Back Routers
by DHilsbos＠performair.com 05 Feb '21

05 Feb '21

All; My team and I have been working through the tutorials on Server World (server-world.com/ean/) in order to learn and build an OpenStack cluster. We've also been looking at the official documentation to attempt to increase our knowledge of the subject. I have a question about Neutron though. All the examples that I remember have Neutron setup with a single router. The router is part of a "provider" network, and subnet on the outside, and one or more "tenant" networks on the inside. Floating IPS, then appear to be IP addresses belonging to the "provider" subnet, that are applied to the router, and which the router then NATs. These setups look like this: Physrouter1 (physical router) subnet: 192.168.0.0/24, IP address: 192.168.0.1 | Physnet1 (192.168.0.0/24)(ovs network definition) | Router1 (ovs router)(allocation pool: 192.168.0.100 - 192.168.0.254) <-- Floating IPs are "owned" by this, and are in the range of the allocation pool | Tenant network(s) This has the advantage of being easy, fast, secure, and simple to setup. What if you wanted something where you could route whole subnet into your OpenStack cluster. Physrouter1 (physical router) subnet: 172.16.255.0/24, IP address: 172.16.255.1 | Physnet1 (172.16.255.0/24)(ovs network definition) | Router1 (ovs router)(fixed IP addresses: 172.16.255.2 & 172.16.254.1/24 + static / dynamic routing) | Network (17216.254.0/24) | Router2(ovs router)(allocation pool: 172.16.254.5 - 172.16.254.254) <-- Floating IPs are "owned" by this, and are in the range of the allocation pool | Tenant network(s) Is my understanding accurate? Are there advantages of one over the other? What commands are used to specify static IPs for ovs routers, and static routing rules? Thank you, Dominic L. Hilsbos, MBA Director - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

3 3

[ops][largescale-sig] How many compute nodes in a single cluster ?
by Thierry Carrez 05 Feb '21

05 Feb '21

Hi everyone, As part of the Large Scale SIG[1] activities, I'd like to quickly poll our community on the following question: How many compute nodes do you feel comfortable fitting in a single-cluster deployment of OpenStack, before you need to scale it out to multiple regions/cells/.. ? Obviously this depends on a lot of deployment-dependent factors (type of activity, choice of networking...) so don't overthink it: a rough number is fine :) [1] https://wiki.openstack.org/wiki/Large_Scale_SIG Thanks in advance, -- Thierry Carrez (ttx)

7 12

[neutron] Drivers meeting 05.02.2021
by Slawek Kaplonski 05 Feb '21

05 Feb '21

Hi, Due to lack of the topics to discuss, lets cancel tomorrow's drivers meeting. Please instead spent some time reviewing some opened specs :) Have a great weekend and see You online. -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

Re: LDAP integration with openstack
by Satish Patel 04 Feb '21

04 Feb '21

check out my blog for full deployment of LDAP - https://satishdotpatel.github.io/openstack-ldap-integration/ On Thu, Feb 4, 2021 at 10:35 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: > > Hi sathish, > Once you are free,please reply to my doubts,I believe that I can solve this issue with your solution. > > Thanks & Regards > Midhunlal N B > +918921245637 > > > On Thu, Feb 4, 2021 at 8:14 PM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >> >> Hi Satish, >> I have some doubt in your configuration >> 1.In keystone, "domains" directory and "keystone.myldapdomain.conf "file i need to create right? >> >> 2.In [ldap] section >> url = ldap://192.168.x.xx >> user = cn=admin,dc=blr,dc=ind,dc=company,dc=com >> password = xxxxx >> suffix = dc=company,dc=com >> I need to add or no need?if not how does openstack connect to my ldap?please reply me. >> >> Thanks & Regards >> Midhunlal N B >> +918921245637 >> >> >> On Thu, Feb 4, 2021 at 7:58 PM Satish Patel <satish.txt(a)gmail.com> wrote: >>> >>> This is what i have >>> >>> In /etc/keystone/keystone.conf >>> >>> [identity] >>> driver = sql >>> domain_config_dir = /etc/keystone/domains >>> domain_specific_drivers_enabled = True >>> >>> In /etc/keystone/domains/keystone.myldapdomain.conf >>> >>> [identity] >>> driver = ldap >>> >>> [ldap] >>> group_allow_create = False >>> group_allow_delete = False >>> group_allow_update = False >>> group_id_attribute = cn >>> ... >>> ... >>> ... >>> <<omitted>> >>> >>> >>> On Thu, Feb 4, 2021 at 9:10 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >>> > >>> > Hi satish, >>> > Thank you so much for your response!Here I am pasting my ldap configuration what i done in keystone.conf,please check and let me know what changes i need to make,also please tell me what are all the new entries i need to add in LDAP. >>> > I have been struggling with this issue for the last 2 month,please help me. >>> > >>> > 1.[identity] >>> > driver = ldap >>> > 2.[ldap] >>> > url = ldap://192.168.x.xx >>> > user = cn=admin,dc=blr,dc=ind,dc=company,dc=com >>> > password = xxxxx >>> > suffix = dc=company,dc=com >>> > query_scope = sub >>> > page_size = 2000 >>> > alias_dereferencing = default >>> > #chase_referrals = false >>> > chase_referrals = false >>> > debug_level = 0 >>> > use_pool = true >>> > pool_size = 10 >>> > pool_retry_max = 3 >>> > pool_retry_delay = 0.1 >>> > pool_connection_timeout = -1 >>> > pool_connection_lifetime = 600 >>> > use_auth_pool = false >>> > auth_pool_size = 100 >>> > auth_pool_connection_lifetime = 60 >>> > user_id_attribute = cn >>> > user_name_attribute = sn >>> > user_mail_attribute = mail >>> > user_pass_attribute = userPassword >>> > user_enabled_attribute = userAccountControl >>> > user_enabled_mask = 2 >>> > user_enabled_invert = false >>> > user_enabled_default = 512 >>> > user_default_project_id_attribute = >>> > user_additional_attribute_mapping = >>> > >>> > group_id_attribute = cn >>> > group_name_attribute = ou >>> > group_member_attribute = member >>> > group_desc_attribute = description >>> > group_additional_attribute_mapping = >>> > >>> > >>> > user_tree_dn = ou=people,dc=blr,dc=ind,dc=company,dc=com >>> > user_objectclass = inetOrgPerson >>> > >>> > group_tree_dn = ou=group,dc=blr,dc=ind,dc=company,dc=com >>> > group_objectclass = organizationalUnit >>> > >>> > This is the configuration I have in my keystone.conf file for ldap integration. >>> > >>> > Thanks & Regards >>> > Midhunlal N B >>> > +918921245637 >>> > >>> > >>> > On Thu, Feb 4, 2021 at 7:10 PM Satish Patel <satish.txt(a)gmail.com> wrote: >>> >> >>> >> Default all group/role/project/user information in SQL but when you say use LDAP then it’s trying to find those information in LDAP, do you have all those information in LDAP? ( assuming not that is why you getting that error) >>> >> >>> >> You should tell your openstack use LDAP for only authentication for user information and look for remaining roles/project etc in SQL That is what I’m running in my cloud and everything works. >>> >> >>> >> Full LDAP integration is little complicated that is why I pick partial method. >>> >> >>> >> Sent from my iPhone >>> >> >>> >> > On Feb 4, 2021, at 7:16 AM, Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >>> >> > >>> >> > >>> >> > Hi all, >>> >> > >>> >> > Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally >>> >> > please help me on this issue. >>> >> > >>> >> > If i run admin-openrc file I am getting below error; >>> >> > >>> >> > root@controller:~/client-scripts# openstack image list >>> >> > The request you have made requires authentication. (HTTP 401) >>> >> > (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) >>> >> > >>> >> > Please help me .Where I am making mistakes? >>> >> > >>> >> > Thanks & Regards >>> >> > Midhunlal N B >>> >> > +918921245637

1 0

Authentication error after configuring LDAP integration with openstack
by Midhunlal Nb 04 Feb '21

04 Feb '21

Hi all, Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally please help me on this issue. If i run admin-openrc file I am getting below error; root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) Please help me .Where I am making mistakes? Thanks & Regards Midhunlal N B +918921245637

2 1

[nova][octavia][kolla] failed to create loadbalancer on Centos8 system
by W Ch 04 Feb '21

04 Feb '21

Hi: Recently, we added a CI task[0] for octavia in the kolla project. and we tested octavia based on the ubuntu and centos systems. The ubuntu system worked as expected but Centos did not work. I tried to debug it and result is following: Octavia can not create a load balancer on centos8. because octavia-worker failed to plug a vip port on amphora vm.[1] 2021-01-31 08:20:12.065 22 ERROR octavia.compute.drivers.nova_driver [-] Error attaching network None with ip None and port 26a39187-e95a-4131-91e7-24289e777f36 to amphora (compute_id: a210ec88-b554-487f-a125-30b5c7473060) : novaclient.exceptions.ClientException: Unknown Error (HTTP 504) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs [-] Error plugging amphora (compute_id: a210ec88-b554-487f-a125-30b5c7473060) into port 26a39187-e95a-4131-91e7-24289e777f36.: octavia.common.exceptions.ComputeUnknownException: Unknown exception from the compute driver: Unknown Error (HTTP 504). 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs Traceback (most recent call last): 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/octavia/compute/drivers/nova_driver.py", line 318, in attach_network_or_port 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs port_id=port_id) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/api_versions.py", line 393, in substitution 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs return methods[-1].func(obj, *args, **kwargs) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/v2/servers.py", line 2063, in interface_attach 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs obj_class=NetworkInterface) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/base.py", line 363, in _create 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs resp, body = self.api.client.post(url, body=body) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/keystoneauth1/adapter.py", line 401, in post 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs return self.request(url, 'POST', **kwargs) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/client.py", line 78, in request 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs raise exceptions.from_response(resp, body, url, method) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs novaclient.exceptions.ClientException: Unknown Error (HTTP 504) Octavia-work called Neutron API to create a port. And called nova-api to attach the vip to amphora. Neutron created port successfully, but nova failed to attach the port to instance.[2] 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [req-ab0e8d9b-664b-430f-8006-cad713b0c826 401ba22da5f8427fbda5fce24600041b 8ce8b97f710f43d7af2b8f9b1e0463c8 - default default] [instance: a210ec88-b554-487f-a125-30b5c7473060] attaching network adapter failed.: libvirt.libvirtError: Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] Traceback (most recent call last): 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/libvirt/driver.py", line 2149, in attach_interface 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] guest.attach_device(cfg, persistent=True, live=live) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/libvirt/guest.py", line 304, in attach_device 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] self._domain.attachDeviceFlags(device_xml, flags=flags) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 190, in doit 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] result = proxy_call(self._autowrap, f, *args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 148, in proxy_call 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] rv = execute(f, *args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 129, in execute 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] six.reraise(c, e, tb) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/usr/lib/python3.6/site-packages/six.py", line 703, in reraise 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] raise value 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 83, in tworker 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] rv = meth(*args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/usr/lib64/python3.6/site-packages/libvirt.py", line 630, in attachDeviceFlags 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] if ret == -1: raise libvirtError ('virDomainAttachDeviceFlags() failed', dom=self) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] libvirt.libvirtError: Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] Nova-compute called libvirt to attach the device. And libvirt also failed to attach the device[3] 2021-01-31 08:20:23.884+0000: 86663: error : qemuMonitorIORead:491 : Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.884+0000: 86663: debug : qemuMonitorIO:618 : Error on monitor Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.884+0000: 86663: info : virObjectRef:402 : OBJECT_REF: obj=0x7f004c00b610 2021-01-31 08:20:23.884+0000: 86663: debug : qemuMonitorIO:649 : Triggering error callback 2021-01-31 08:20:23.884+0000: 86663: debug : qemuProcessHandleMonitorError:346 : Received error on 0x7f004c0095b0 'instance-00000001' 2021-01-31 08:20:23.884+0000: 64768: debug : qemuMonitorSend:958 : Send command resulted in error Unable to read from monitor: Connection reset by peer I also tried to use kolla/ubuntu-source-nova-libvirt instead of kolla/centos-source-nova-libvirt. and it worked as expected. I think the root cause is that libvirt failed to attach a network device. but i don't know how to resolve this problem. could anyone help me? Thanks Wuchunyang [0]: https://review.opendev.org/c/openstack/kolla-ansible/+/754285 [1]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0… [2]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0… [3]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0…

4 4

Re: LDAP integration with penstack
by Satish Patel 04 Feb '21

04 Feb '21

This is what i have In /etc/keystone/keystone.conf [identity] driver = sql domain_config_dir = /etc/keystone/domains domain_specific_drivers_enabled = True In /etc/keystone/domains/keystone.myldapdomain.conf [identity] driver = ldap [ldap] group_allow_create = False group_allow_delete = False group_allow_update = False group_id_attribute = cn ... ... ... <<omitted>> On Thu, Feb 4, 2021 at 9:10 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: > > Hi satish, > Thank you so much for your response!Here I am pasting my ldap configuration what i done in keystone.conf,please check and let me know what changes i need to make,also please tell me what are all the new entries i need to add in LDAP. > I have been struggling with this issue for the last 2 month,please help me. > > 1.[identity] > driver = ldap > 2.[ldap] > url = ldap://192.168.x.xx > user = cn=admin,dc=blr,dc=ind,dc=company,dc=com > password = xxxxx > suffix = dc=company,dc=com > query_scope = sub > page_size = 2000 > alias_dereferencing = default > #chase_referrals = false > chase_referrals = false > debug_level = 0 > use_pool = true > pool_size = 10 > pool_retry_max = 3 > pool_retry_delay = 0.1 > pool_connection_timeout = -1 > pool_connection_lifetime = 600 > use_auth_pool = false > auth_pool_size = 100 > auth_pool_connection_lifetime = 60 > user_id_attribute = cn > user_name_attribute = sn > user_mail_attribute = mail > user_pass_attribute = userPassword > user_enabled_attribute = userAccountControl > user_enabled_mask = 2 > user_enabled_invert = false > user_enabled_default = 512 > user_default_project_id_attribute = > user_additional_attribute_mapping = > > group_id_attribute = cn > group_name_attribute = ou > group_member_attribute = member > group_desc_attribute = description > group_additional_attribute_mapping = > > > user_tree_dn = ou=people,dc=blr,dc=ind,dc=company,dc=com > user_objectclass = inetOrgPerson > > group_tree_dn = ou=group,dc=blr,dc=ind,dc=company,dc=com > group_objectclass = organizationalUnit > > This is the configuration I have in my keystone.conf file for ldap integration. > > Thanks & Regards > Midhunlal N B > +918921245637 > > > On Thu, Feb 4, 2021 at 7:10 PM Satish Patel <satish.txt(a)gmail.com> wrote: >> >> Default all group/role/project/user information in SQL but when you say use LDAP then it’s trying to find those information in LDAP, do you have all those information in LDAP? ( assuming not that is why you getting that error) >> >> You should tell your openstack use LDAP for only authentication for user information and look for remaining roles/project etc in SQL That is what I’m running in my cloud and everything works. >> >> Full LDAP integration is little complicated that is why I pick partial method. >> >> Sent from my iPhone >> >> > On Feb 4, 2021, at 7:16 AM, Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >> > >> > >> > Hi all, >> > >> > Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally >> > please help me on this issue. >> > >> > If i run admin-openrc file I am getting below error; >> > >> > root@controller:~/client-scripts# openstack image list >> > The request you have made requires authentication. (HTTP 401) >> > (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) >> > >> > Please help me .Where I am making mistakes? >> > >> > Thanks & Regards >> > Midhunlal N B >> > +918921245637

1 0

LDAP integration with penstack
by Midhunlal Nb 04 Feb '21

04 Feb '21

Hi all, Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally please help me on this issue. If i run admin-openrc file I am getting below error; root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) Please help me .Where I am making mistakes? Thanks & Regards Midhunlal N B +918921245637

2 1

Issue when accessing Openstack
by open infra 04 Feb '21

04 Feb '21

Hi, I am new to both starlingx and openstack. I have deployed StarlingX and now trying to get access OpenStack. I highly appreciate your help on troubleshooting this issue. http://paste.openstack.org/show/802321/ Log: http://paste.openstack.org/show/802322/ Regards, Danishka

1 0

[magnum] [neutron] [ovn] No inter-node pod-to-pod communication due to missing ACLs in OVN
by Krzysztof Klimonda 04 Feb '21

04 Feb '21

Hi, This email is a follow-up to a discussion I've openened on ovs-discuss ML[1] regarding lack of TCP/UDP connectivity between pods deployed on magnum-managed k8s cluster with calico CNI and IPIP tunneling disabled (calico_ipv4pool_ipip label set to a default value of Off). As a short introduction, during magnum testing in ussuri deployment with ml2/ovn neutron driver I've noticed lack of communication between pods deployed on different nodes as part of magnum deployment with calico configured to *not* encapsulate traffic in IPIP tunnel, but route it directly between nodes. In theory, magnum configures adds defined pod network to k8s nodes ports' allowed_address_pairs[2] and then security group is created allowing for ICMP and TCP/UDP traffic between ports belonging to that security group[3]. This doesn't work with ml2/ovn as TCP/UDP traffic between IP addresses in pod network is not matching ACLs defined in OVN. I can't verify this behaviour under ml2/ovs for the next couple of weeks, as I'm taking them off for holidays, but perhaps someone knows if that specific usecase (security group rules with remote groups used with allowed address pairs) is supposed to be working, or should magnum use pod network cidr to allow traffic between nodes instead. [1] https://mail.openvswitch.org/pipermail/ovs-discuss/2020-December/050836.html [2] https://github.com/openstack/magnum/blob/c556b8964fab129f33e766b1c33908b2eb… [3] https://github.com/openstack/magnum/blob/c556b8964fab129f33e766b1c33908b2eb… -- Best Regards, - Chris

5 9

[cyborg]No meeting on Feb 11
by Wang, Xin-ran 04 Feb '21

04 Feb '21

Hi all, With Chinese new year approaching and people being out, we are going to cancel the cyborg IRC meeting on Feb 11. Have a Happy Holiday and Happy Chinese New Year. 😊 Thanks, Xin-Ran

1 0

[all] Eventlet broken again with SSL, this time under Python 3.9
by Thomas Goirand 04 Feb '21

04 Feb '21

Hi, Swift proxy fails with Python 3.9 under Debian Unstable with Python 3.9: http://paste.openstack.org/show/802063/ (that's when doing a simple "openstack container list") I got the same problem with neutron-rpc-server: http://paste.openstack.org/show/802071/ (this happens when neutron-rpc-server tries to tell Nova that my new VM port is up) I didn't really look further, but I guess so many services are affected. This looks like general to OpenStack, and feels like yet-another-problem-with-eventlet, and looks very similar to this one: https://github.com/eventlet/eventlet/issues/677 even though that's here a Python 3.9 issue, not 3.7. I'd very much appreciate if some Eventlet specialist could look into this problem, because that's beyond my skills. Cheers, Thomas Goirand (zigo)

5 17

[tc] weekly meeting
by Mohammed Naser 04 Feb '21

04 Feb '21

Hi everyone, Here’s the agenda for our weekly TC meeting. It will happen tomorrow (Thursday the 4th) at 1500 UTC in #openstack-tc and I will be your chair. If you can’t attend, please put your name in the “Apologies for Absence” section. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting # ACTIVE INITIATIVES * Follow up on past action items * Audit SIG list and chairs (diablo_rojo) - https://etherpad.opendev.org/p/2021-SIG-Updates - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019994.… * Gate performance and heavy job configs (dansmith) - http://paste.openstack.org/show/jD6kAP9tHk7PZr2nhv8h/ * Dropping lower-constraints testing from all projects (gmann) - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019672.… * Mistral Maintenance (gmann) - Any early step we can take to get help in Mistral maintenance? - http://lists.openstack.org/pipermail/openstack-discuss/2021-February/020137… * Open Reviews - https://review.opendev.org/q/project:openstack/governance+is:open Thanks, Mohammed -- Mohammed Naser VEXXHOST, Inc.

1 0

Integration tests failing on master branch for ppc64le
by aditi Dukle 03 Feb '21

03 Feb '21

3 2

Backup drivers issue with the container parameter
by Gorka Eguileor 03 Feb '21

03 Feb '21

Hi all, In the next Cinder meeting I'll bring a Backup driver issue up for discussion, and this email hopefully provides the necessary context to have a fruitful discussion. The issue is around the `container` optional parameter in backup creation, and its user and administrator unfriendliness. The interpretation of the `container` parameter is driver dependent, and it's being treated as: - A bucket in Google Cloud Storage and the new S3 driver - A container in Swift - A pool in Ceph - A directory in NFS and Posix Currently the only way to prevent cloud users from selecting a different `container` is by restricting what the storage user configured in Cinder backup can do. For Ceph we can make the storage user unable to access any other existing pools, for Swift, GCS, and S3 we can remove permissions to create buckets/containers from the storage user. This achieves the administrator's objective of not allowing them to change the `container`, but cloud users will have a bad experience, because the API will accept the request but the backup will go into `error` state and they won't see any additional information. And this solution is an all or nothing approach, as we cannot allow just some cloud users select the container while preventing others from doing so. For example we may want some cloud users to be able to do backups on a specific RBD pool that is replicated to a remote location. I think we can solve all these issues if we: - Create a policy for accepting the `container` parameter on the API (defaulting to allow for backward compatibility). - Add a new configuration option `backup_container_regex` to control acceptable values for the `container` (defaults to `.*` for backward compatibility). This option would be used by the backup manager (not the drivers themselves) on backup creation, and would result in a user message if the provided container was not empty and failed the regex check. I think this summarizes the situation and my view on the matter. Feedback is welcome here or in the next Cinder meeting. Cheers, Gorka.

2 1

[oslo] Proposing Daniel Bengtsson for Oslo Core
by Herve Beraud 03 Feb '21

03 Feb '21

Hi, Daniel has been working on Oslo for quite some time now and during that time he was a great help on Oslo. I think he would make a good addition to the general Oslo core team. He helped us by proposing patches to fix issues, maintaining stable branches by backporting changes, and managing our releases by assuming parts of the release liaison role. Existing Oslo team members (and anyone else we co-own libraries with) please respond with +1/-1. If there are no objections we'll add him to the ACL soon. :-) Thanks. -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

5 5

[cinder] wallaby R-9 virtual mid-cycle 10 Feb at 14:00 UTC
by Brian Rosmaita 03 Feb '21

03 Feb '21

The poll results are in (9 responses) and there was only one option where everyone could attend (apologies to the two people who marked that "as need be"): DATE: Wednesday, 10 February 2021 TIME: 1400-1600 UTC (2 hours) LOCATION: https://bluejeans.com/3228528973 The meeting will be recorded. Please add topics to the planning etherpad: https://etherpad.opendev.org/p/cinder-wallaby-mid-cycles Note that there will be no cinder weekly meeting on 10 February. cheers, brian

1 0

[infra][kuryr][launchpad]
by Michał Dulko 03 Feb '21

03 Feb '21

Hi, Seems like the bugs integration with Launchpad for Kuryr is broken since the Gerrit upgrade - the patches with Closes-Bug: <id> are no longer picked up by Launchpad and bug statuses are not updated. Is it a known problem or are there any extra steps we need to as a Kuryr team do to reenable the integration? Thanks, Michał

2 2

[baremetal-sig][ironic] Tue Jan 12, 2021, 2pm UTC: 'Multi-Tenancy in Ironic: Of Owners and Lessees'
by Arne Wiebalck 03 Feb '21

03 Feb '21

Dear all, Happy new year! The Bare Metal SIG will continue its monthly meetings and start again on Tue Jan 12, 2021, at 2pm UTC. This time there will be a 10 minute "topic-of-the-day" presentation by Tzu-Mainn Chen (tzumainn) on 'Multi-Tenancy in Ironic: Of Owners and Lessees' So, if you would like to learn how this relatively recent addition to Ironic works, you can find all the details for this meeting on the SIG's etherpad: https://etherpad.opendev.org/p/bare-metal-sig Everyone is welcome, don't miss out! Cheers, Arne

3 5

[kolla][adjutant] Granular quota settings with Adjutant
by Braden, Albert 03 Feb '21

03 Feb '21

We have been experimenting with Adjutant, and it offers a menu of sizes (default small, medium and large). It's easy to add more sizes, but we would like to allow customers to request granular changes. For example, if a customer needs to add 10 cores and 5 instances to his existing quota. This would require some changes to Horizon, and an Adjutant plugin. Is anyone already doing this, or working in that direction? I apologize for the nonsense below. So far I have not been able to stop it from being attached to my external emails. I'm working on it. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

2 1

Strange behaviour of OSC in keystone MFA context
by Taltavull Jean-Francois 03 Feb '21

03 Feb '21

Hello, I'm experiencing the following strange behavior of openstack CLI with os-auth-methods option (most parameters are defined in clouds.yaml): $ openstack token issue --os-auth-type v3multifactor --os-auth-methods password,totp The plugin p could not be found Note that "p" is the first letter of "password". It looks like the option parser handled "password,totp" as a string instead of as a list of strings. Version of openstack CLI is 5.4.0. Any idea ? Thanks ! Jean-François

5 7

[cinder] wallaby R-9 mid-cycle poll
by Brian Rosmaita 02 Feb '21

02 Feb '21

Hello Cinder team and anyone interested in Cinder, The second wallaby mid-cycle meeting will be held during week R-9 (the week of 8 February 2021). It will be 2 hours long. Please indicate your availability on the following poll: https://doodle.com/poll/9vqri7855cab858d Please respond before 21:00 UTC on Tuesday 2 February 2021. thanks, brian

1 1

[tc] weekly meeting
by Mohammed Naser 02 Feb '21

02 Feb '21

Hi everyone, Here’s an update on what happened in the OpenStack TC this week. You can get more information by checking for changes in the openstack/governance repository. # Patches ## Open Reviews - Remove Karbor project team https://review.opendev.org/c/openstack/governance/+/767056 - Create ansible-role-pki repo https://review.opendev.org/c/openstack/governance/+/773383 - Add assert:supports-api-interoperability tag to neutron https://review.opendev.org/c/openstack/governance/+/773090 - Add rbd-iscsi-client to cinder project https://review.opendev.org/c/openstack/governance/+/772597 - Cool-down cycle goal https://review.opendev.org/c/openstack/governance/+/770616 - Define Xena release testing runtime https://review.opendev.org/c/openstack/governance/+/770860 - monasca-log-api & monasca-ceilometer does not make releases https://review.opendev.org/c/openstack/governance/+/771785 - Define 2021 upstream investment opportunities https://review.opendev.org/c/openstack/governance/+/771707 - [manila] add assert:supports-api-interoperability https://review.opendev.org/c/openstack/governance/+/770859 ## Project Updates - Setting Ke Chen as Watcher's PTL https://review.opendev.org/c/openstack/governance/+/770913 - Move openstack-tempest-skiplist to release-management: none https://review.opendev.org/c/openstack/governance/+/771488 - js-openstack-lib does not make releases https://review.opendev.org/c/openstack/governance/+/771789 ## General Changes - Drop openSUSE from commonly tested distro list https://review.opendev.org/c/openstack/governance/+/770855 - Add Resolution of TC stance on the OpenStackClient https://review.opendev.org/c/openstack/governance/+/759904 ## Abandoned Projects - WIP NO MERGE Move os-*-config to Heat project governance https://review.opendev.org/c/openstack/governance/+/770285 # Other Reminders - Our next [TC] Weekly meeting is scheduled for February 4th at 1500 UTC. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, February 3rd, at 2100 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0

LDAP integration with openstack
by Midhunlal Nb 02 Feb '21

02 Feb '21

Hi, I tried to integrate ldap with my openstack. I followed an openstack document and completed the ldap integration,after that I am getting a lot of errors,I am not able to run any openstack commands. -->I followed below document https://docs.openstack.org/keystone/rocky/admin/identity-integrate-with-lda… --->I am getting below errors root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) --->so I checked keystone log POST http://controller:5000/v3/auth/tokens 2021-01-29 11:16:36.881 28558 WARNING keystone.auth.plugins.core [req-cf013eff-6e1e-43c4-a6ae-9f91f4fe48f9 - - - - -] Could not find user: neutron.: UserNotFound: Could not find user: neutron. 2021-01-29 11:16:36.881 28558 WARNING keystone.common.wsgi [req-cf013eff-6e1e-43c4-a6ae-9f91f4fe48f9 - - - - -] Authorization failed. The request you have made requires authentication. from192.168.xxx.xx: Unauthorized: The request you have made requires authentication. 2021-01-29 11:17:22.009 28556 INFO keystone.common.wsgi [req-a2a480a7-2ee1-4e11-8a48-dcf93ffb96db - - - - -] POSthttp://controller:5000/v3/auth/tokens 2021-01-29 11:17:22.039 28556 WARNING keystone.auth.plugins.core [req-a2a480a7-2ee1-4e11-8a48-dcf93ffb96db - - - - -] Could not find user: placement.: UserNotFound: Could not find user: placement. Anyone please help me on this issue. Thanks & Regards Midhunlal N B +918921245637

2 1