April 2021 - openstack-discuss - lists.openstack.org

MAAS dhcpd issue
by toky0 12 Apr '21

12 Apr '21

Hi, Just started a maas+juju deployment on bare metal. I’m facing some errors while PXE booting[1]. Any leads ? Regards, Sami [1] Mar 22 09:57:13 maas kernel: [ 1885.666813] audit: type=1400 audit(1616407033.279:95): apparmor="DENIED" operation="open" profile="snap.maas.supervisor" name="/etc/gss/mech.d/" pid=1131 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Mar 22 09:57:22 maas dhcpd[3861]: DHCPDISCOVER from 4c:52:62:44:0c:bb via eno1: network vlan-5002: no free leases Mar 22 09:57:37 maas systemd[1]: systemd-timedated.service: Succeeded. Mar 22 09:57:43 maas kernel: [ 1915.677372] audit: type=1400 audit(1616407063.291:96): apparmor="DENIED" operation="open" profile="snap.maas.supervisor" name="/etc/gss/mech.d/" pid=1132 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Mar 22 09:58:13 maas dhcpd[3861]: DHCPDISCOVER from 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:13 maas dhcpd[3861]: DHCPOFFER on 192.168.202.10 to 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:15 maas dhcpd[3861]: DHCPDISCOVER from 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:15 maas dhcpd[3861]: DHCPOFFER on 192.168.202.10 to 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:17 maas dhcpd[3861]: DHCPDISCOVER from 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:17 maas dhcpd[3861]: DHCPOFFER on 192.168.202.10 to 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:21 maas dhcpd[3861]: DHCPDISCOVER from 4c:52:62:44:13:f3 via eno1 Mar 22 09:58:21 maas dhcpd[3861]: DHCPOFFER on 192.168.202.10 to 4c:52:62:44:13:f3 via eno1 Mar 22 09:59:13 maas kernel: [ 2005.666324] audit: type=1400 audit(1616407153.280:97): apparmor="DENIED" operation="open" profile="snap.maas.supervisor" name="/etc/gss/mech.d/" pid=1134 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0 Mar 22 09:59:43 maas kernel: [ 2035.667450] audit: type=1400 audit(1616407183.280:98): apparmor="DENIED" operation="open" profile="snap.maas.supervisor" name="/etc/gss/mech.d/" pid=1134 comm="python3" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

3 2

[edge][cinder][manila][swift][tripleo] Storage at the edge discussions at the PTG
by Ildiko Vancsa 12 Apr '21

12 Apr '21

Hi, I’m reaching out to draw your attention to the Edge Computing Group sessions on the PTG in less than two weeks. We are still formalizing our agenda, but we have storage identified as one of the topics that the working group would like to discuss. It would be great to have the session also as a continuation to earlier discussions that we had on previous PTGs with relevant OpenStack project contributors. We have a few cross-community sessions scheduled already, but we still have some flexibility in our agenda to schedule this topic so the most people who are interested in participating can join. Our available options are: * Monday (April 19) between 1400 UTC and 1500 UTC * Tuesday (April) between 1400 UTC and 1600 UTC __Please let me know if you or your project would like to participate and if you have a time slot difference from the above.__ Thanks and Best Regards, Ildikó (IRC ildikov on Freenode)

2 2

[neutron] bug deputy report Abril 5th to 11th
by Miguel Lavalle 12 Apr '21

12 Apr '21

Hi, Here is this week's bugs deputy report: Critical ====== https://bugs.launchpad.net/neutron/+bug/1922563 [UT] py38 CI job failing frequently with TIMED_OUT. In progress. Proposed patch https://review.opendev.org/c/openstack/neutron/+/784771 High ==== https://bugs.launchpad.net/neutron/+bug/1922684 Functional dhcp agent tests fails to spawn metadata proxy. In progress. Proposed fix https://review.opendev.org/c/openstack/neutron/+/784903 https://bugs.launchpad.net/neutron/+bug/1923198 custom kill scripts don't works after migration to privsep. In progress. Proposed fix https://review.opendev.org/c/openstack/neutron/+/785638 https://bugs.launchpad.net/neutron/+bug/1923201 neutron-centos-8-tripleo-standalone in periodic queue runs Neutron from Victroria release. In progress. Proposed fix https://review.opendev.org/c/openstack/neutron/+/785660 Medium ====== https://bugs.launchpad.net/neutron/+bug/1922653 [L3][Port forwarding] multiple floating_ip:port to same internal fixed_ip:port (N-to-1 rule support). Waiting for owner, although it seems Liu Yulong might work on it https://bugs.launchpad.net/neutron/+bug/1922824 [ovn] external port always be scheduled on a single gateway. Needs owner https://bugs.launchpad.net/neutron/+bug/1922892 "ebtables-nft" returns error 4 when a new chain is created. . Needs owner https://bugs.launchpad.net/neutron/+bug/1922919 [FT] BaseOVSTestCase retrieving the wrong min BW queue/qos. In progress. Proposed patch https://review.opendev.org/c/openstack/neutron/+/785158 https://bugs.launchpad.net/neutron/+bug/1922934 [OVN] LSP register race condition with two controllers. In progress. Owner ralonsoh https://bugs.launchpad.net/neutron/+bug/1922923 OVS port issue. Liu Yulong suggested a solution. Awaiting update from submitter https://bugs.launchpad.net/neutron/+bug/1923083 python 3.9 failures. Confirmed. haleyb suggested a work around, which submitter reported as successful. Seems haleyb will work on a fix https://bugs.launchpad.net/neutron/+bug/1923161 DHCP notification could be optimized. In progress. Proposed patch: https://review.opendev.org/c/openstack/neutron/+/785581 RFE === https://bugs.launchpad.net/neutron/+bug/1922716 [RFE] BFD for BGP Dynamic Routing

1 0

[release] Release countdown for week R-0 Apr 12 - Apr 16
by Herve Beraud 10 Apr '21

10 Apr '21

Development Focus ----------------- We will be releasing the coordinated OpenStack Wallaby release next week, on Wednesday, 14 April, 2021. Thanks to everyone involved in the Wallaby cycle! We are now in pre-release freeze, so no new deliverable will be created until final release, unless a release-critical regression is spotted. Otherwise, teams attending the virtual PTG should start to plan what they will be discussing there, by creating and filling team etherpads. You can access the list of PTG etherpads at: http://ptg.openstack.org/etherpads.html General Information ------------------- On release day, the release team will produce final versions of deliverables following the cycle-with-rc release model, by re-tagging the commit used for the last RC. A patch doing just that will be proposed. PTLs and release liaisons should watch for that final release patch from the release team. While not required, we would appreciate having an ack from each team before we approve it on the 14th, so that their approval is included in the metadata that goes onto the signed tag. Upcoming Deadlines & Dates -------------------------- Final Wallaby release: 14 April, 2021 Xena virtual PTG: 19 - 23 April, 2021 -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

[all][tc] What's happening in Technical Committee: summary 9th April, 21
by Ghanshyam Mann 10 Apr '21

10 Apr '21

Hello Everyone, Here is this week's summary of the Technical Committee activities. If you feel this email is lengthy and can take time to read, I tried to categorize the topic for an easy read and should not take more than 5 min of your time. 1. What we completed this week: ========================= Project updates: ------------------- ** Keystone is switched to DPL model[1]. ** Mistral is switched to DPL model[2]. ** Made devstack-plugin-(amqp1|kafka) branchless[3] ** Deprecated project/deliverables: 1. networking-midonet[4] 2. monasca-transform[5] 3. monasca-analytics[6] 4. monasca-ceilometer[7] 5. monasca-log-api[7] Other updates: ------------------ ** PTL assignment for Xena cycle leaderless projects: We have finished the leader assignments for the leaderless project for Xena cycle[8]. Total 8 projects were leaderless in Xena election. PTL assigned to 6 projects, and 2 projects (Keystone and Mistral) adopted DPL model. ** Radosław Piliszek(yoctozepto) is vice-chair of TC for Xena cycle. ** Prepared the Community newsletter: "OpenStack project news" for this month[9]. 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - http://eavesdrop.openstack.org/meetings/tc/2021/tc.2021-04-08-15.00.log.html * We will have next week's meeting on April 15th, Thursday 15:00 UTC. 3. Activities In progress: ================== Open Reviews ----------------- * No open reviews this week[10]. This is good progress by TC this week. Gate performance and heavy job configs ------------------------------------------------ * dansmith sent the progress on ML[11], and there is a good improvement on gate utilization. Thanks to dansmith for keep monitoring it and collecting the data. Election for one Vacant TC seat ------------------------------------- Voting is started for one open seat for TC and open until April 15, 2021 23:45 UTC. You might have got the email with the voting link; if not please read the instruction in the email from fungi[12]. PTG ----- TC is planning to meet in PTG for Thursday 2 hrs and Friday 4 hrs, details are in etherpad[13], feel free to add topic you would like to discuss with TC in PTG. 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[13]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [14] 3. Office hours: The Technical Committee offers two office hours per week in #openstack-tc [15]: * Tuesday at 0100 UTC * Wednesday at 1500 UTC 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://review.opendev.org/c/openstack/governance/+/784102 [2] https://review.opendev.org/c/openstack/governance/+/782195 [3] https://review.opendev.org/c/openstack/governance/+/784544 [4 ]https://review.opendev.org/c/openstack/governance/+/783799 [5] https://review.opendev.org/c/openstack/governance/+/783624 [6] https://review.opendev.org/c/openstack/governance/+/783659 [7] https://review.opendev.org/c/openstack/governance/+/783657 [8] https://etherpad.opendev.org/p/xena-leaderless [9] https://etherpad.opendev.org/p/newsletter-openstack-news [10] https://review.opendev.org/q/project:openstack/governance+status:open [11] http://lists.openstack.org/pipermail/openstack-discuss/2021-April/021534.ht… [12] http://lists.openstack.org/pipermail/openstack-discuss/2021-April/021718.ht… [13] https://etherpad.opendev.org/p/tc-xena-ptg [14] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [15] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [16] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

[kolla] PTG
by Mark Goddard 09 Apr '21

09 Apr '21

Hi, Just a reminder that it's the Kolla Xena PTG from 19th - 21st April. Anyone is welcome to attend, but please add your name to the Etherpad [1], and follow the instructions to sign up. If there is something you would like to discuss, please add it to the list of topics. Thanks, Mark [1] https://etherpad.opendev.org/p/kolla-xena-ptg

1 0

[kolla] PTL on holiday next week
by Mark Goddard 09 Apr '21

09 Apr '21

Hi, I'll be on holiday next week. Please keep in mind the current feature freeze and aim for stabilisation of the code and preparation for RC1 & branching. Let's aim to branch in the week beginning 19th April. Please also remember it's the PTG in the same week. Remember to add topics to the PTG Etherpad [1] as they come up in discussion or your thoughts. [1] https://etherpad.opendev.org/p/kolla-xena-ptg Thanks, Mark

1 0

[kolla] RHEL based container image
by Tony Liu 09 Apr '21

09 Apr '21

Hi, Given [1], RHEL based container is supported on RHEL 8 by Kolla. Where can I get RHEL based container images? I see CentOS and Ubuntu based images on docker hub, but can't find RHEL based images. [1] https://docs.openstack.org/kolla-ansible/ussuri/user/support-matrix.html Thanks! Tony

3 3

[TripleO] next irc meeting Tuesday Apr 13 @ 1400 UTC in #tripleo
by Marios Andreou 09 Apr '21

09 Apr '21

Reminder that the next TripleO irc meeting is: ** Tuesday 13 April at 1400 UTC in #tripleo ** ** https://wiki.openstack.org/wiki/Meetings/TripleO ** ** https://etherpad.opendev.org/p/tripleo-meeting-items ** Please add anything you want to highlight at https://etherpad.opendev.org/p/tripleo-meeting-items This can be recently completed things, ongoing review requests, blocking issues, or anything else tripleo you want to share. Our last meeting was on Mar 30 - you can find the logs there http://eavesdrop.openstack.org/meetings/tripleo/2021/tripleo.2021-03-30-14.… Hope you can make it on Tuesday, regards, marios

1 0

[dev][cinder][keystone] Properly consuming system-scope in cinder
by Lance Bragstad 09 Apr '21

09 Apr '21

Hey folks, As I'm sure some of the cinder folks are aware, I'm updating cinder policies to include support for some default personas keystone ships with. Some of those personas use system-scope (e.g., system-reader and system-admin) and I've already proposed a series of patches that describe what those changes look like from a policy perspective [0]. The question now is how we test those changes. To help guide that decision, I worked on three different testing approaches. The first was to continue testing policy using unit tests in cinder with mocked context objects. The second was to use DDT with keystonemiddleware mocked to remove a dependency on keystone. The third also used DDT, but included changes to update NoAuthMiddleware so that it wasn't as opinionated about authentication or authorization. I brought each approach in the cinder meeting this week where we discussed a fourth approach, doing everything in tempest. I summarized all of this in an etherpad [1] Up to yesterday morning, the only approach I hadn't tinkered with manually was tempest. I spent some time today figuring that out, resulting in a patch to cinderlib [2] to enable a protection test job, and cinder_tempest_plugin [3] that adds the plumbing and some example tests. In the process of implementing support for tempest testing, I noticed that service catalogs for system-scoped tokens don't contain cinder endpoints [4]. This is because the cinder endpoint contains endpoint templating in the URL [5], which keystone will substitute with the project ID of the token, if and only if the catalog is built for a project-scoped token. System and domain-scoped tokens do not have a reasonable project ID to use in this case, so the templating is skipped, resulting in a cinder service in the catalog without endpoints [6]. This cascades in the client, specifically tempest's volume client, because it can't find a suitable endpoint for request to the volume service [7]. Initially, my testing approaches were to provide examples for cinder developers to assess the viability of each approach before committing to a protection testing strategy. But, the tempest approach highlighted a larger issue for how we integrate system-scope support into cinder because of the assumption there will always be a project ID in the path (for the majority of the cinder API). I can think of two ways to approach the problem, but I'm hoping others have more. First, we remove project IDs from cinder's API path. This would be similar to how nova (and I assume other services) moved away from project-specific URLs (e.g., /v3/%{project_id}s/volumes would become /v3/volumes). This would obviously require refactoring to remove any assumptions cinder has about project IDs being supplied on the request path. But, this would force all authorization information to come from the context object. Once a deployer removes the endpoint URL templating, the endpoints will populate in the cinder entry of the service catalog. Brian's been helping me understand this and we're unsure if this is something we could even do with a microversion. I think nova did it moving from /v2/ to /v2.0/, which was technically classified as a major bump? This feels like a moon shot. Second, we update cinder's clients, including tempest, to put the project ID on the URL. After we update the clients to append the project ID for cinder endpoints, we should be able to remove the URL templating in keystone, allowing cinder endpoints to appear in system-scoped service catalogs (just like the first approach). Clients can use the base URL from the catalog and append the admin project ID before putting the request on the wire. Even though the request has a project ID in the path, cinder would ignore it for system-specific APIs. This is already true for users with an admin role on a project because cinder will allow you to get volumes in one project if you have a token scoped to another with the admin role [8]. One potential side-effect is that cinder clients would need *a* project ID to build a request, potentially requiring another roundtrip to keystone. Thoughts? [0] https://review.opendev.org/q/project:openstack/cinder+topic:secure-rbac [1] https://etherpad.opendev.org/p/cinder-secure-rbac-protection-testing [2] https://review.opendev.org/c/openstack/cinderlib/+/772770 [3] https://review.opendev.org/c/openstack/cinder-tempest-plugin/+/772915 [4] http://paste.openstack.org/show/802117/ [5] http://paste.openstack.org/show/802097/ [6] https://opendev.org/openstack/keystone/src/commit/c239cc66615b41a0c09e031b3… [7] http://paste.openstack.org/show/802092/ [8] http://paste.openstack.org/show/802118/

4 8