April 2021 - openstack-discuss - lists.openstack.org

[neutron] April 2021 - PTG Summary
by Slawek Kaplonski 26 Apr '21

26 Apr '21

Hi, Below is my summary of the Neutron sessions during the PTG last week. Etherpad with agenda and all notes from the sessions is available at https:// etherpad.opendev.org/p/neutron-xena-ptg If You want to discuss some topic in more details, please start new thread for it to keep this one clean. ## Day 1 (Monday) ### Retrospective of the Wallaby cycle Good things: * we accomplished our community goals this cycle, like e.g. rootwrap to privsep migration, * migration to the secure RBAC, * many performance improvements, * CI improvements and the job simplification/reducing, * stable team, and a lot of small patches from all around the world, * OVN feature gap with OVS is shrinking, * team support to implement address groups, including RBAC support. In the list of not so good things we mentioned: * During the previous PTG we were talking about some OVN related guides/sessions but we didn't made any, * networking-midonet - (yet another) stadium project deprecated due to lack of maintainers, but it's better to have them clearly marked as out of stadium, than false expectations - we can bring such projects back when needed anyway, * still unstable CI, mainly tempest and tempest-plugin jobs, also during this release functional tests. As for action items for the _Xena_ cycle, we listed couple of things: * Miguel wants to do the ovn knowledge share internally in his company and later share the material, * we will keep working on the improvements for our CI, list of all opened, CI related bugs can be found at https://tinyurl.com/neutron-gate-failures and we will work on reducing that list in next months. * Rodolfo and Miguel will follow up on Nova's plans to drop eventlet and move to the threading and will investigate if we can try to do something similar in the Neutron, * Akihiro raised good point about ML2/OVN and stadium projects. We should clarify the support plan for OVN in all of our stadium projects. Lajos and Lucas volunteered to work on that. ### Secure RBAC - testing - discussion with QA team As next session in the first day, we attended QA team's session about testing new secure RBAC policies. Summary of that discussion can be found in the etherpad: https://etherpad.opendev.org/p/qa-xena-ptg. QA team wants to switch each project to enforce new defaults and the system scope tokens in the Devstack. We will have to monitor that and check what needs to be fixed on our side to accomplish that. ### Deprecated hybrid plug and the iptables_hybrid firewall driver Bence proposed discussion about potential deprecation of the iptables_hybrid firewall driver as we have now native openvswitch driver too. After discussion we decided that we are not going to deprecate it, at least for now. There are known differences between those two drivers and there is still many usecases where people wants to use iptables_hybrid driver. ### Future of the Linuxbridge backend As the last topic of the first day we discussed future of the Linuxbridge backend and ML2 driver. The same topic was discussed in the http://kaplonski.pl/ blog/shanghai_ptg_summary/ and then, based on the feedback from operators we decided that we are not going to deprecate this backend anytime soon as many people are still using it. But now we are couple of cycle later and things didn't change a lot. We still don't have anyone who would like to maintain it. In most cases it works fine but there are also pretty many bugs reported for that backend, which don't have owners - see https://tinyurl.com/linuxbridge-bugs. But things may change in the future and e.g. removal of the legacy iptables from the main distributions may makes things harder to work. We again had feedback, e.g. from Jon that NASA is using that driver and want's to keep using it. But from the other hand in the core Neutron we don't have anyone interested in maintaining it currently. The outcome of the discussion is that we will again raise that topic and ask operators about: - who is using it and what are the use cases addressed by that driver - maybe we can help with proposing another solution, - who is willing to help with maintenance of that backend. If You are using Linuxbridge backend, please give us such feedback. For Xena status is that we still do our best to keep Linuxbridge backend to be running and fully supported but we will also revisit its status again in the next PTG. ## Day 2 (Tuesday) ### Continuation of "L3 feature improvements" During the second day of the PTG we had very interesting discussions about L3 improvements. We discussed bunch of the RFEs proposed by Bence, Lajos and Manu: * [RFE] Add BFD support for Neutron https://bugs.launchpad.net/neutron/+bug/ 1907089 and the spec: https://review.opendev.org/c/openstack/neutron-specs/+/767337 * [RFE] Allow explicit management of default routes: https://bugs.launchpad.net/ neutron/+bug/1921126) and the spec: https://review.opendev.org/c/openstack/neutron-specs/+/781475 * Allow multiple external gateways on a router: https://bugs.launchpad.net/neutron/ +bug/1905295 and the spec: https://review.opendev.org/c/openstack/neutron-specs/+/779511 * [RFE] Enhancement to Neutron BGPaaS to directly support Neutron Routers & bgp-peering from such routers over internal & external Neutron Networks https:// bugs.launchpad.net/neutron/+bug/1921461 and the spec: https://review.opendev.org/c/openstack/neutron-specs/+/783791 * [RFE] BFD for BGP Dynamic Routing: https://bugs.launchpad.net/neutron/+bug/ 1922716 and the spec: https://review.opendev.org/c/openstack/neutron-specs/+/785349. That one still needs to be discussed and approved during the drivers meeting. General outcome from the discussion is that during the Xena cycle we at least wants to have all those specs merged to have agreement about implementation details. When that will be done, Bence, Lajos and others from Ericsson will work on the implementation of those RFEs. ### Tap-as-a-service (taas) project Next topic which we discussed during Tuesday's session was about Tap-as-a-service: https://opendev.org/x/tap-as-a-service project. Few cycle back we were thinking about including it in the Neutron stadium but finally that

1 0

[keystone] Token
by Adam Tomas 26 Apr '21

26 Apr '21

Hi Which CLI setting sets domain_id field in a token? I tried openstack —os-domain-id SOME_OS_COMMAND, openstack —os-default-domain SOME_OS_COMMAND, openstack —os-default-domain_id SOME_OS_COMMAND but none of them sets this field and policies checking domain_id:%(domain_id) don’t work because of that. Interesting thing is that horizon somehow generates token with domain_id set and everything works with the same policies, I have a problem only with CLI. Can user_domain_id (which is inside of every token is see for particular user) be used instead of domain_id? Example token from CLI: 2021-04-23 12:16:38.090 700 DEBUG keystone.server.flask.request_processing.middleware.auth_context [req-117bc600-490e-46ae-a857-0c8d09dc1dbc 9adbxxxxb02ef 61d4xxxx9c0f - 3a08xxxx82c1 3a08xxxx82c1] RBAC: auth_context: {'token': <TokenModel (audit_id=BLWXSpdbTvqc0YS9WzStjQ, audit_chain_id=['BLWXSpdbTvqc0YS9WzStjQ']) at 0x7f8c390aaca0>, 'domain_id': None, 'trust_id': None, 'trustor_id': None, 'trustee_id': None, 'domain_name': None, 'group_ids': [], 'user_id': '9adbxxxx02ef', 'user_domain_id': '3a08xxxx82c1', 'system_scope': None, 'project_id': '61d4xxxx9c0f', 'project_domain_id': '3a08xxxx82c1', 'roles': ['member', 'project_admin', 'reader', 'domain_admin'], 'is_admin_project': True, 'service_user_id': None, 'service_user_domain_id': None, 'service_project_id': None, 'service_project_domain_id': None, 'service_roles': []} fill_context /var/lib/kolla/venv/lib/python3.8/site-packages/keystone/server/flask/request_processing/middleware/auth_context.py:478 Example token from Horizon: 2021-04-23 12:48:21.009 704 DEBUG keystone.server.flask.request_processing.middleware.auth_context [req-d6d89d3e-c3c1-48c0-b3ed-b3dcedb54db3 9adbxxxx02ef - 3a08xxxx82c1 3a08xxxx82c1 -] RBAC: auth_context: {'token': <TokenModel (audit_id=ZHltw2esTJyTRnFlgHetog, audit_chain_id=['ZHltw2esTJyTRnFlgHetog', 'iJGq-E9fQKKXdZaZq72MQw']) at 0x7f8c3a1b4460>, 'domain_id': '3a08xxx82c1', 'trust_id': None, 'trustor_id': None, 'trustee_id': None, 'domain_name': ‚xxxx', 'group_ids': [], 'user_id': '9adbxxxx02ef', 'user_domain_id': '3a08xxxx82c1', 'system_scope': None, 'project_id': None, 'project_domain_id': None, 'roles': ['project_admin', 'member', 'reader', 'domain_admin'], 'is_admin_project': False, 'service_user_id': None, 'service_user_domain_id': None, 'service_project_id': None, 'service_project_domain_id': None, 'service_roles': []} fill_context /var/lib/kolla/venv/lib/python3.8/site-packages/keystone/server/flask/request_processing/middleware/auth_context.py:478 Best regards Adam

1 1

[cinder] festival of mypy reviews 30 April 2021
by Brian Rosmaita 26 Apr '21

26 Apr '21

Hello Cinder community members, As discussed at last week's PTG, we will be holding a special Cinder Festival of mypy Reviews at the end of this week on Friday 30 April. what: Cinder Festival of mypy Reviews when: Friday 30 April 2021 from 1400-1600 UTC where: https://meetpad.opendev.org/cinder-festival-of-reviews See you there! brian

1 0

[cinder] reminder: this week's meeting in video+IRC
by Brian Rosmaita 26 Apr '21

26 Apr '21

Quick reminder that this week's Cinder team meeting on Wednesday 28 April, being the final meeting of the month, will be held in both videoconference and IRC at the regularly scheduled time of 1400 UTC. These are the video meeting rules we've agreed to: * Everyone will keep IRC open during the meeting. * We'll take notes in IRC to leave a record similar to what we have for our regular IRC meetings. * Some people are more comfortable communicating in written English. So at any point, any attendee may request that the discussion of the current topic be conducted entirely in IRC. * The meeting will be recorded. connection info: https://bluejeans.com/3228528973 meeting agenda: https://etherpad.opendev.org/p/cinder-xena-meetings cheers, brian

1 0

[neutron] bug deputy report for week of 2021-04-19
by Rodolfo Alonso Hernandez 26 Apr '21

26 Apr '21

Hello Neutrinos: This is the list of bugs opened during the last week. I would like to remark the two critical bugs and the high one, that are not assigned. Critical: - https://bugs.launchpad.net/neutron/+bug/1925451: “[stable/rocky] grenade job is broken”. Unassigned. - https://bugs.launchpad.net/neutron/+bug/1926109: “SSH timeout (wait timeout) due to potential paramiko issue“. Unassigned. High: - https://bugs.launchpad.net/neutron/+bug/1925498: “SNAT is not working“. Unassigned. - NOTE: I didn't have time to test if this issue is legit. IMO that's something that should have been detected years ago but I'm until this bug is triaged, I'll set it as "high". Medium: - https://bugs.launchpad.net/neutron/+bug/1925406: “[functional] run dsvm-functional locally will need ovn no matter the running cases are”. Unassigned. - https://bugs.launchpad.net/neutron/+bug/1916428: “dibbler tool for dhcpv6 is concluded“. Unassigned. - NOTE: I’m adding this bug into this list because this week a duplicate of this bug was filled. Worth mentioning it again. - https://bugs.launchpad.net/neutron/+bug/1925836: “[OVN] OVN metadata should not need to monitor the enterily Chassis table”. Assigned to Lucas. - https://review.opendev.org/c/openstack/neutron/+/787780 Low: - https://bugs.launchpad.net/neutron/+bug/1925218: “[OVN] BW limit QoS rules assigned to networks with SR-IOV ports are created on NBDB”. Assigned to Rodolfo. - https://review.opendev.org/c/openstack/neutron/+/787351 - https://bugs.launchpad.net/neutron/+bug/1925368: “[L3] Router GW can be removed with routes defined”. Unassigned. - NOTE: I would like to know if this is a valid issue or not. - https://bugs.launchpad.net/neutron/+bug/1925433: “[doc] SR-IOV config documentation has not been updated when SRIOV attach got implemented”. Assigned to Balazs. - https://review.opendev.org/c/openstack/neutron/+/787500 - https://bugs.launchpad.net/neutron/+bug/1925841: “"backref" warnings for "QosNetworkPolicyBinding.port" and "StandardAttribute.tags"“. Assigned to Rodolfo. - https://review.opendev.org/c/openstack/neutron/+/787782 Whishlist: - https://bugs.launchpad.net/neutron/+bug/1925528: “Improve "NeutronDbObject.objects_exist" performance“. Assigned to Rodolfo. - https://review.opendev.org/c/openstack/neutron/+/787681 Incomplete: - https://bugs.launchpad.net/neutron/+bug/1925213: “o-api seems to leak memory when ovn-octavia-provider is used” - https://bugs.launchpad.net/neutron/+bug/1926045: “Restrictions on FIP binding” - https://bugs.launchpad.net/neutron/+bug/1926049: “check_changed_vlans failed“ Undecided/unconfirmed: - https://bugs.launchpad.net/neutron/+bug/1925789: “neutron fwaas2 l3 - inconsistent order of jump rules“. FWaaS bug in Train. Regards.

1 0

[qa][ptg] Summary of the discussed topics
by Martin Kopec 26 Apr '21

26 Apr '21

Hi all, here's a summary of the topics we have discussed during QA sessions: * Migration of devstack and Tempest tests to new secure RBAC There was a great discussion about this goal, many good points raised. See the PTG etherpad for more details. * Patrole execution time improvement This is up for a few cycles already and is missing a volunteer. We will discuss next steps towards this goal during one of the following QA office hour meetings. * What FeatureFreeze means for QA projects We have discussed the types of changes we should avoid merging during Feature Freeze. * Tempest plugins should use master tempest in their testing jobs We have noticed that many check/gate CI jobs use latest tempest tag (downloaded form pip) instead of the master branch we may potentially lead to approving changes which are not compatible with the master branch of tempest. * Fix backward compatibility of run-tempest role We deprecated couple of tempest's CLI args and replaced them by new ones in 26.1.0, however, as it turns out the backward compatibility conditions in run-tempest role are not sufficient. We will try to create a stable job variant to be used in jobs with older tempest versions. * Cleanup of duplicated scenario.manager Announcing tempest.scenario.manager a stable interface in tempest 27.0.0 raises a question when to remove the duplicated scenario.manager in plugins' codebase. * Whether to branch tempest No, we won't. We wrote down all pros and cons. The main fact against is that per an agreement all stable releases + master should be tested with the same set of tests. However, we will discuss branching for EM with the release team. Full discussion (PTG etherpad): https://etherpad.opendev.org/p/qa-xena-ptg QA's priority items for Xena cycle: https://etherpad.opendev.org/p/qa-xena-priority Regards, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA <https://red.ht/sig>

1 0

rocky 2 node installation unable to access internet in instance
by cloud learner 25 Apr '21

25 Apr '21

Dear All, I am new to this, installed rocky on centos 7 with 2 node controller and compute nodes, followed https://docs.openstack.org/neutron/rocky/install/environment-networking-con… as mentioned in the document used vxlan and the Networking option 2: Self service network and used linuxbridge, verified all the steps as mentioned in the document and all things are working fine but i am unable to access the internet in instances. The network layout image attached herewith for reference there are two ports, one is for management and another is a provider network through which the internet is accessible. The provider network is 10.1.0.0/16 and the gateway is 10.1.1.1 which I have set in the external network.. When i run # ip netns command on controller node it shows qdhcp and qrouter [root@controller ~]# ip netns qrouter-2f84ff08-7293-4822-a4c1-57278d80f1cf (id: 2) qdhcp-186cc689-267b-49ca-90a7-b312fd0367f3 (id: 1) qdhcp-513292db-3eb8-4902-974f-4bb9c4757652 (id: 0) but when I run # ip netns command on compute it shows nothing. [root@controller ~]# openstack network agent list +--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+ | ID | Agent Type | Host | Availability Zone | Alive | State | Binary | +--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+ | 0286adac-2a32-4866-8b75-95f190c2c310 | Linux bridge agent | compute1 | None | :-) | UP | neutron-linuxbridge-agent | | 47728860-d7b0-4b15-b3dc-1f8a6bf81125 | Metadata agent | controller | None | :-) | UP | neutron-metadata-agent | | 4957d1b2-ea33-4034-9869-8518438416b0 | L3 agent | controller | nova | :-) | UP | neutron-l3-agent | | a81e4138-0190-41ef-b0a1-bd1b66c01343 | DHCP agent | controller | nova | :-) | UP | neutron-dhcp-agent | | ea43868d-8394-4cf5-a104-edc5ecbaff9e | Linux bridge agent | controller | None | :-) | UP | neutron-linuxbridge-agent | +--------------------------------------+--------------------+------------+-------------------+-------+-------+---------------------------+ Is there any need to create br-int or br-ex on nodes because that is not mentioned in the link which i have followed, if need kindly guide the steps to do that and on which node these steps need to follow.

1 0

How do I delete my account of review.opendev.org?
by Rikimaru Honjo 25 Apr '21

25 Apr '21

Hi, How do I delete my account of review.opendev.org? I couldn't find the UI or documents for it. I'm sorry if I overlooked it. Best regards,

2 4

audit middleware logs
by Basireddy Hanumantha Reddy 25 Apr '21

25 Apr '21

Hi, I am using pike version. I have configured nova service as mentioned in https://docs.openstack.org/keystonemiddleware/pike/audit.html 1. added in api-paste.ini file [ filter : audit ] paste . filter_factory = keystonemiddleware . audit : filter_factory audit_map_file = / etc / nova / api_audit_map . conf 2. verified composite:openstack_compute_api_v2 section. 3. Copied the api_audit_map.conf file to the /etc/nova/ After that I have restared all openstack services. But I couldn't find any audit logs with oslo.messaging.notification.audit.http.request in nova.log file I can see only logs related to oslo.messaging as openstack nova-scheduler[17534]: INFO oslo.messaging.notification.scheduler.select_destinations.start [None req-01612e5a-37d9-4b62-970a-fcf7d3c409ad admin admin] {"event_type": "scheduler.select_destinations.start", "timestamp": "2021-04-25 11:10:40.249260", "payload": {"request_spec": {"instance_properties": {"root_gb": 1, "uuid": "ee4ddae2-9397-401c-b80f-543061e75dd2", "availability_zone": null, "ephemeral_gb": 0, "numa_topology": null, "memory_mb": 512, "vcpus": 1, "project_id": "d078fd26a1204e6abede5faca777da8b", "pci_requests": {"requests": []}}, "instance_type": {"disabled": false, "root_gb": 1, "name": "m1.tiny", "flavorid": "1", "deleted": false, "created_at": "2021-04-22T17:34:26.000000", "ephemeral_gb": 0, "updated_at": null, "memory_mb": 512, "vcpus": 1, "extra_specs": {}, "swap": 0, "rxtx_factor": 1.0, "is_public": true, "deleted_at": null, "vcpu_weight": 0, "id": 6}, "image": {"status": "active", "name": "cirros-0.3.5-x86_64-disk", "container_format": "bare", "created_at": "2021-04-22T17:32:54.000000", "disk_format": "qcow2", "updated_at": "2021-04-22T17:32:55.000000", "id": "e0d062fa-2b3c-4a6e-90e4-3ef796c3a594", "min_disk": 0, "min_ram": 0, "checksum": "f8ab98ff5e73ebab884d80c9dc9c7290", "owner": "d078fd26a1204e6abede5faca777da8b", "properties": {}, "size": 13267968}, "num_instances": 1}}, "priority": "INFO", "publisher_id": "scheduler.openstack", "message_id": "3128ed95-1599-46f8-b110-93fcb0776812"} what I understood that as part of audit middleware, logs should contain oslo.messaging.notification.audit.http.request and oslo.messaging.notification.audit.http.response. Please suggest what I am missing. Thanks, Hanumantha Reddy.

1 0

Recall: [cyborg][ptg] Cyborg vPTG Summary April 2021
by Wang, Xin-ran 25 Apr '21

25 Apr '21

Wang, Xin-ran would like to recall the message, "[cyborg][ptg] Cyborg vPTG Summary April 2021".

1 0