February 2021 - openstack-discuss

[victoria][neutron] qos-fip extension cannot be enabled with OVN
by Malik Obaid 24 Feb '21

24 Feb '21

Hi, I am using Openstack Victoria release on Ubuntu 20.04. While configuring QOS policy I am facing 2 issues. 1. The command 'openstack extension list' does not show qos-fip, despite qos-fip having been added to the list of extension_drivers. 2. An error is raised when trying to assign a qos-policy to a FIP: BadRequestException: 400: Client Error for url: http://172.16.30.46:9696/v2.0/floatingips/774dd653-3a9b-40d7-ade6-7cf5a3a4b…, Unrecognized attribute(s) 'qos_policy_id' I would really appreciate any help in this regard. Thank you. Regards, Malik Obaid

2 1

[magnum][ingress-nginx][cert-manager] issuing letsencrypt certs
by Ionut Biru 24 Feb '21

24 Feb '21

Hi guys, Not sure if we need some new policy on deploying kubernetes 1.18+ but I'm kinda stuck and I don't know what else to do. I'm trying in the past days to generate letsencrypt ssl for a simple nginx deployment I'm deploying Kubernetes 1.19.8 or 1.20.4 cluster on Openstack using Magnum without any ingress controller. I'm deploying ingress-nginx 0.44 using: wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v0.44… Cert-manager 1.2.0 wget https://github.com/jetstack/cert-manager/releases/download/v1.2.0/cert-mana… I'm creating a nginx deployment and service with 2 replicas https://paste.xinu.at/PWu/ Configure ingress for my host: https://paste.xinu.at/7c7FH/ Configure the issuer: https://paste.xinu.at/Bf6/ Reconfigure ingress: https://paste.xinu.at/o1j5wD/ kubectl apply -f deploy.yaml kubectl apply -f cert-manager.yaml kubectl apply -f nginx-deployment.yaml kubectl apply -f ioni_ingress.yaml kubectl apply -f prod_issuer.yaml Error in events: Error presenting challenge: pods "cm-acme-http-solver-" is forbidden: PodSecurityPolicy: unable to admit pod: [] Error in kubernetes logs(ssh on node) https://paste.xinu.at/9aMJ/ -- Ionut Biru - https://fleio.com

1 0

[ops] Where is the instance Action Log stored and how to externally access it and send to ELK?
by Linebarger, John 24 Feb '21

24 Feb '21

Where is the instance Action Log stored (the one you can see on the Horizon dashboard if you select an instance) and how can it be externally accessed, either by CLI or HTTPS or in any other way? It doesn't seem to map to anything stored in the Nova logs in /var/log/nova, at least that I can see. We want to send instance Action Logs to an ELK stack for indexing and display, but are not yet able to figure out how to do so. John M. Linebarger, PhD, MBA Principal Member of Technical Staff Sandia National Laboratories (Work) 505-845-8282

2 1

[all][qa] Gate status of stable stein's legacy jobs with tempest plugins
by Ghanshyam Mann 24 Feb '21

24 Feb '21

Hello Everyone, We recently pinned the Tempest version 26.0.0 in devstack for stable/stein branch testing.[1]. In CI/CD workflow tempest venv can be re-created many times in devstack, devstack-gate (for legacy jobs) or run-tempest roles etc. With the Tempest 26.0.0 version, we need to make tempest venv to use the stable constraints instead of master constraints. And used constraints should be consistent otherwise tempest venv gets recreated which end up removing the previously installed tempest plugins. We have taken care of constraints consistency for zuulv3 native jobs in run-tempest ansible role but for the legacy job which uses the devstack-gate path still use the master constraints and recreate the tempest venv. So your legacy job which uses the tempest plugins will be failing. Example: designate-devstack-pdns4 - https://zuul.opendev.org/t/openstack/build/35fd0a4c76e0482e88ed32ef0840291d I have pushed the fixes which are on devstack, devstack-gate, and tempest(tempest patch is merged). If you are seeing a similar issue please do not recheck and wait for the below patches to merge: - https://review.opendev.org/c/openstack/devstack-gate/+/776722 - https://review.opendev.org/c/openstack/devstack/+/776811 [1] https://review.opendev.org/c/openstack/devstack/+/774103 -gmann

1 1

[glance] Replaced parameters "default_store" and "glance_store" breaks cooperation between cinder and glance in rocky release
by Jan Wasilewski 23 Feb '21

23 Feb '21

Hello, I am writing to you, because we faced an issue with broken cooperation between cinder and glance. In our logs(glance-api) we observed such warning message: 2021-02-22 15:30:02.894 756 WARNING oslo_config.cfg [-] Deprecated: Option "stores" from group "glance_store" is deprecated for removal ( This option is deprecated against new config option ``enabled_backends`` which helps to configure multiple backend stores of different schemes. This option is scheduled for removal in the Stein development cycle. ). Its value may be silently ignored in the future. 2021-02-22 15:30:02.896 756 WARNING oslo_config.cfg [-] Deprecated: Option "default_store" from group "glance_store" is deprecated for removal ( This option is deprecated against new config option ``default_backend`` which acts similar to ``default_store`` config option. This option is scheduled for removal in the Stein development cycle. ). Its value may be silently ignored in the future. And we simply wanted to solve this problem, by changing option glance_store to enabled_backends and default_store to default_backend: @@ -2079,7 +2079,7 @@ pool_timeout = 60 # cycle. #stores = file,http -stores = glance.store.rbd.Store +enabled_backends = glance.store.rbd.Store # DEPRECATED: # The default scheme to use for storing images. @@ -2134,7 +2134,7 @@ stores = glance.store.rbd.Store # cycle. #default_store = file -default_store = rbd +default_backend = rbd But then we realized that we're not able to create volumes from new images, because we hit an issue: 2021-02-22 22:45:08.805 5910 ERROR cinder.scheduler.filter_scheduler [req-fe8e8aa2-dd8a-470b-9d70-dbdc757b48d9 54df39e1b74149bcb8cf9ad3eb957d48 afdfb965515f4724a21b6823764ec36d - default default] Error scheduling 9de37fe8-4f9e-4c29-8cfa-c1a71e8c68b7 from last vol-service: cinder-05@huawei_backend#StoragePool001 : [u'Traceback (most recent call last):\n', u' File "/usr/lib/python2.7/dist-packages/taskflow/engines/action_engine/executor.py", line 53, in _execute_task\n result = task.execute(**arguments)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/volume/flows/manager/create_volume.py", line 1059, in execute\n **volume_spec)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/utils.py", line 818, in _wrapper\n return r.call(f, *args, **kwargs)\n', u' File "/usr/lib/python2.7/dist-packages/retrying.py", line 206, in call\n return attempt.get(self._wrap_exception)\n', u' File "/usr/lib/python2.7/dist-packages/retrying.py", line 247, in get\n six.reraise(self.value[0], self.value[1], self.value[2])\n', u' File "/usr/lib/python2.7/dist-packages/retrying.py", line 200, in call\n attempt = Attempt(fn(*args, **kwargs), attempt_number, False)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/volume/flows/manager/create_volume.py", line 959, in _create_from_image\n image_service)\n', u' File "<decorator-gen-238>", line 2, in _prepare_image_cache_entry\n', u' File "/usr/lib/python2.7/dist-packages/cinder/coordination.py", line 151, in _synchronized\n return f(*a, **k)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/volume/flows/manager/create_volume.py", line 757, in _prepare_image_cache_entry\n update_cache=True)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/volume/flows/manager/create_volume.py", line 831, in _create_from_image_cache_or_download\n backend_name) as tmp_image:\n', u' File "/usr/lib/python2.7/contextlib.py", line 17, in __enter__\n return self.gen.next()\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/image_utils.py", line 832, in fetch\n fetch_verify_image(context, image_service, image_id, tmp)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/image_utils.py", line 451, in fetch_verify_image\n None, None)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/image_utils.py", line 377, in fetch\n tpool.Proxy(image_file))\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/glance.py", line 358, in download\n _reraise_translated_image_exception(image_id)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/glance.py", line 602, in _reraise_translated_image_exception\n six.reraise(type(new_exc), new_exc, exc_trace)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/glance.py", line 356, in download\n image_chunks = self._client.call(context, \'data\', image_id)\n', u' File "/usr/lib/python2.7/dist-packages/cinder/image/glance.py", line 225, in call\n return getattr(controller, method)(*args, **kwargs)\n', u' File "/usr/lib/python2.7/dist-packages/glanceclient/common/utils.py", line 545, in inner\n return RequestIdProxy(wrapped(*args, **kwargs))\n', u' File "/usr/lib/python2.7/dist-packages/glanceclient/v2/images.py", line 208, in data\n resp, body = self.http_client.get(url)\n', u' File "/usr/lib/python2.7/dist-packages/keystoneauth1/adapter.py", line 328, in get\n return self.request(url, \'GET\', **kwargs)\n', u' File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 349, in request\n return self._handle_response(resp)\n', u' File "/usr/lib/python2.7/dist-packages/glanceclient/common/http.py", line 98, in _handle_response\n raise exc.from_response(resp, resp.content)\n', u'HTTPInternalServerError: HTTPInternalServerError (HTTP 500)\n'] Which is visible in cinder-scheduler log file. When we reverted a change, everything started to operate normally. I'm just wondering how we can skip this warning message and makes cinder and glance to cooperate correctly, especially that we're planning to make an upgrade from Rocky to Stein soon and this option is planned to be removed in the Stein release. Thanks in advance for your help here. Pozdrawiam, Jan Wasilewski Administrator systemów i sieci CI ATM Tel: +48 691 493 327 jan.wasilewski(a)atman.pl<mailto:jan.wasilewski@atman.pl>, www.atman.eu<http://www.atman.eu/> Informacja o zasadach przetwarzania danych osobowych przez ATM S.A. znajduje się pod tym linkiem<http://www.atman.pl/Informacja-o-przetwarzaniu-danych-osobowych-cabout-pol-…>.

2 1

[tripleo] migrating master from CentOS-8 to CentOS-8-Stream
by Wesley Hayutin 23 Feb '21

23 Feb '21

Greetings, Just a heads up over the course of the next few weeks upstream TripleO should see a transparent migration from CentOS-8 to CentOS-8-Stream. We do have a few options with regards to how the transition will take place. First and foremost we're going to migrate the master branch only at this time. *Question 1: Artifacts* Option1: New namespaces for artifacts: Containers: https://hub.docker.com/r/tripleomasterstream/ or some combination Images: http://images.rdoproject.org/centosstream8 or other combination Option2: Master content and namespaces is overwritten with centos-8-stream containers and images and will retain the paths and namespaces. Containers: https://hub.docker.com/u/tripleomaster Images: http://images.rdoproject.org/centos8/master/ *Question 2: job names* We can update the master jobs to include "stream" in the name and be explicit for the distro name OR: We can leave the job names as is and just communicate that "centos-8" is now really centos-8-stream Now's your chance to weigh in prior to the upcoming changes. Thanks!

5 5

Unexpected MAC Address Change
by Lazuardi Nasution 23 Feb '21

23 Feb '21

Hi, Today, I find some of our Windows Server VMs cannot be accessed. After some inspection, I find that there is expected MAC address change on those VMs. There are inconsistencies between "ps aux | grep instance-***" output on such compute nodes where affected VMs reside, with "virsh dumpxml instance-***" on the same compute nodes. The "virsh dumpxml instance-***" output is consistent with TAP interface MAC address on "ip link" output and the MAC address of port list on OpenStack dashboard/CLI. Following are one of those outputs. This weirdness is back to normal after I do a live migration to another compute node. virsh dumpxml instance-000003e5 ... <interface type='bridge'> <mac address='fa:16:3e:ef:4e:3b'/> <source bridge='br-int'/> ... ps aux | grep instance-000003e5 ... netdev=hostnet0,id=net0,mac=fa:16:3e:8e:92:f0 ... What can change the MAC address on "ps aux | grep instance-***" output? This weirdness happens on Ussuri with Ubuntu 20.04 and OVN. Is this a bug? What kind of bug? Is there any other information should I look for to find the root cause? Best regards,

1 0

[largescale-sig] Video meeting Feb 24: "Regions vs. Cells"
by Thierry Carrez 23 Feb '21

23 Feb '21

Hi everyone, In order to increase its reach, the Large Scale SIG will organize video meetings around specific scaling topics, just one hour of discussion bootstrapped by a short presentation from operators of large scale deployments of OpenStack. Our first video meeting will be next Wednesday, February 24, at 1500utc on Zoom (link/password will be provided on this thread the day before the event). The theme will be: "Regions vs. Cells" quickstarted by a presentation from Belmiro Moreira (CERN). If you're interested in sharing your experience on this topic, or just want to learn more about that, please mark your calendar and join us next Wednesday ! -- Thierry Carrez

1 1

[cinder/barbican] LUKS encryption for mounted disk - how to decrypt cinder volume
by Jan Wasilewski 23 Feb '21

23 Feb '21

Hi All, I have a question about the possible decryption of LUKS volume. I'm testing currently barbican+cinder, but I'm just wondering if there is a way, to somehow decrypt my LUKS volume with payload generated by a barbican. Is there any procedure for that? I was doing it by myself, but somehow it doesn't work and I got an error: [TEST]root@barbican-01:/usr/lib/python3/dist-packages# barbican secret get --payload --payload_content_type application/octet-stream http://controller.test:9311/v1/secrets/76631940-9ab6-4b8c-9481-e54c3ffdbbfe +---------+--------------------------------------------------------------------------------------------------------+ | Field | Value | +---------+--------------------------------------------------------------------------------------------------------+ | Payload | b'\xbf!i\x97\xf4\x0c\x12\xa4\xfe4\xf3\x16C\xe8@\xdc\x0f\x9d+:\x0c7\xa9\xab[\x8d\xf2\xf1\xae\r\x89\xdc' | +---------+--------------------------------------------------------------------------------------------------------+ cryptsetup luksOpen /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f my-volume Enter passphrase for /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f: *<passphrase from payload>* No key available with this passphrase. I thought that above issue can be related to encoding, so I took payload value directly from vault and use it as a key-file, but problem is exactly the same(my encrypted volume is the last volume list by domblklist option): vault kv get secret/data/e5baa518207e4f9db4810988d22087ce | grep value | awk -F'value:' '{print $2}' 4d4d35676c336567714850663477336d2b415475746b74774c56376b77324b4e73773879724c46704678513d] [TEST]root@comp-02:~# cat bbb 4d4d35676c336567714850663477336d2b415475746b74774c56376b77324b4e73773879724c46704678513d [TEST]root@comp-02:~# cat bbb | base64 -d > pass2 [TEST]root@comp-02:~# cat pass2 ▒▒߻▒▒▒▒▒^<▒N▒▒▒▒~پ5▒▒▒▒▒▒▒z߾▒▒▒▒~▒▒▒▒▒n▒▒▒▒▒]▒[TEST]root@comp-02:~# [TEST]root@comp-02:~# virsh domblklist instance-00000da8 Target Source ------------------------------------------------ vda /dev/dm-17 vdb /dev/disk/by-id/wwn-0x6e00084100ee7e7e74623bd3000036bc vdc /dev/dm-16 vde /dev/disk/by-id/wwn-0x6e00084100ee7e7e7ab0b13c0000386f vdf /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 [TEST]root@comp-02:~# udisksctl unlock -b /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 --key-file pass2 Error unlocking /dev/dm-21: GDBus.Error:org.freedesktop.UDisks2.Error.Failed: Error unlocking /dev/dm-21: Failed to activate device: Operation not permitted [TEST]root@comp-02:~# cryptsetup luksOpen /dev/disk/by-id/wwn-0x6e00084100ee7e7e7bd45c1b000038b5 my-volume --master-key-file=pass2 Volume key does not match the volume. I see that nova/cinder and barbican are doing this stuff somehow so I strongly believe there is a way to decrypt this manually. Maybe I’m doing something wrong in my testing-steps. Thanks in advance for any help here! Unfortunately, I haven’t found any materials on how to do this. Best regards, Jan

2 5

[tc] weekly update
by Mohammed Naser 22 Feb '21

22 Feb '21

Hi everyone, Here's an update on what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Cool-down cycle goal https://review.opendev.org/c/openstack/governance/+/770616 - monasca-log-api & monasca-ceilometer does not make releases https://review.opendev.org/c/openstack/governance/+/771785 ## Project Updates - Retire tempest-horizon https://review.opendev.org/c/openstack/governance/+/774379 ## General Changes - Add assert:supports-api-interoperability tag to neutron https://review.opendev.org/c/openstack/governance/+/773090 - Add assert:supports-api-interoperability to cinder https://review.opendev.org/c/openstack/governance/+/773684 # Other Reminders - Our next [TC] Weekly meeting is scheduled for February 25th at 1500 UTC. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, February 24th, 2100 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0