May 2021 - openstack-discuss - lists.openstack.org

[cinder] Bug deputy report for week of 2021-05-05
by Sofia Enriquez 05 May '21

05 May '21

Hello, This is a bug report from 2021-04-21 to 2021-05-05. You're welcome to join the next Cinder Bug Meeting later today. Weekly on Wednesday at 1500 UTC on #openstack-cinder Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ------------------------------------------------------------------------------------------------------------ Critical:- High: - https://bugs.launchpad.net/cinder/+bug/1925818 "Retype of non-encrypted root volume to encrypted fails". Unassigned. - https://bugs.launchpad.net/python-cinderclient/+bug/1926331 "Allow cinderclient to handle system-scoped tokens". Unassigned. Medium: - https://bugs.launchpad.net/cinder/+bug/1926630 " Creating an encrypted volume type without a cipher accepted but will fail to create an encrypted volume". Assigned to Eric Harney. - https://bugs.launchpad.net/cinder/+bug/1925809 "[RBD] Cinder backup python3 encoding issue". Unassigned. - https://bugs.launchpad.net/cinder/+bug/1924264 "volume creation with `--hint local_to_instance=UUID` is failing, because deprecated novaclient attribute `list_extensions` is used". Assigned to Pavlo Shchelokovskyy. - https://bugs.launchpad.net/cinder/+bug/1923866 "Netapp dataontap NFS manage operation fails with ipv6 reference". Unassigned. Low: - https://bugs.launchpad.net/cinder/+bug/1926408 "quota-show should raise exception when non-existent tenant id was given". Unassigned. - https://bugs.launchpad.net/cinder/+bug/1926336 " The cinder API should fail early if a system-scoped token is provided without a project ID". Unassigned. - https://bugs.launchpad.net/cinder/+bug/1924574 " [Storwize]: Configure to manage GMCV changed volumes on a separate child pool". Unassigned. - https://bugs.launchpad.net/python-cinderclient/+bug/1925737: "List volumes can not be filtered by bootable". Unassigned. Incomplete: - https://bugs.launchpad.net/cinder/+bug/1927186 "The value of allocated_capacity_gb is incorrect when the number of replicas of cinder-volume is more than one and all of them configured on the same backend". Unassigned. Cheers, Sofi -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[docs] bug tracker for individual projects' search pages
by Erik Panter 05 May '21

05 May '21

Hi, I'm having issues with the individual projects' doc search pages (e.g. https://docs.openstack.org/neutron/victoria/search.html?q=test) since ussuri: When searching Ussuri and Victoria docs, malformed links are returned, and for Wallaby it doesn't return any results. It seems to affect multiple projects that provide the search page, so I am not sure where to report it. Can someone point me to the correct project/bug tracker? Thanks, Erik _____ Erik Panter Systementwickler | Infrastruktur Mittwald CM Service GmbH & Co. KG Königsberger Straße 4-6 32339 Espelkamp Tel.: 05772 / 293-900 Fax: 05772 / 293-333 Mobil: 0151 / 12345678 e.panter(a)mittwald.de https://www.mittwald.de Geschäftsführer: Robert Meyer, Florian Jürgens St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen Informationen zur Datenverarbeitung im Rahmen unserer Geschäftstätigkeit gemäß Art. 13-14 DSGVO sind unter www.mittwald.de/ds abrufbar.

3 4

[TC][Interop] process change proposal for interoperability
by Kanevsky, Arkady 05 May '21

05 May '21

Team, Based on guidance from the Board of Directors, Interop WG is changing its process. Please, review https://review.opendev.org/c/osf/interop/+/787646 Guidelines will no longer need to be approved by the board. It is approved by "committee" consisting of representatives from Interop WG, refstack, TC and Foundation marketplace administrator. Will be happy to discuss and provide more details. Looking for TC review and approval of the proposal before I present it to the board. Thanks, Arkady Kanevsky, Ph.D. SP Chief Technologist & DE Dell Technologies office of CTO Dell Inc. One Dell Way, MS PS2-91 Round Rock, TX 78682, USA Phone: 512 7204955

4 7

[all][tc] Nodejs version change in Xena cycle testing runtime
by Ghanshyam Mann 04 May '21

04 May '21

Hello Everyone, We have done a change in Xena cycle testing runtime on bumping the Nodejs version from Nodejs10 to Nodejs14[1]. Nodejs10 is going to EOL by April 2021 [2]. If you have any jobs running on Nodejs10, please upgrade it to Nodejs14. Vishal from the Horizon team will drive this effort and looking forward to coordination on code/review. [1] https://review.opendev.org/c/openstack/governance/+/788306 [21] https://nodejs.org/en/about/releases/ -gmann

1 0

[release][ironic] ironic-python-agent-builder release model change
by Riccardo Pittau 04 May '21

04 May '21

Hello fellow openstackers! During the recent xena ptg, the ironic community had a discussion about the need to move the ironic-python-agent-builder project from an independent model to the standard release model. When we initially split the builder from ironic-python-agent, we decided against it, but considering some problems we encountered during the road, the ironic community seems to be in favor of the change. The reasons for this are mainly to strictly align the image building project to ironic-python-agent releases, and ease dealing with the occasional upgrade of tinycore linux, the base image used to build the "tinyipa" ironic-python-agent ramdisk. We'd like to involve the release team to ask for advice, not only on the process, but also considering that we need to ask to cut the first branch for the wallaby stable release, and we know we're a bit late for that! :) Thank you in advance for your help! Riccardo

5 8

[glance][ptg] Glance Xena PTG summary
by Abhishek Kekane 04 May '21

04 May '21

Hello Everyone, Apologies for delay in sending the PTG summary and Thank you to everyone who attended the Glance Xena PTG. We had extremely eventful discussions around Secure RBAC and some new ideas for improvement in Glance. Here is a short summary of the discussions. See the Etherpad [1] for full notes. Tuesday, April 20 # Wallaby Retrospective On the positive note, we merged a number of useful features this cycle. We managed to implement a project scope of secure RBAC for images API and Distributed image import stuff. On the other side we had usual problems of review bandwidth and we were not able to keep our focus on reducing/managing the glance bugs backlog. We really need more people in the community helping out with reviews, and ideally moving to become members of the core team. We are happy to onboard new members with appropriate help. # Bug squashing per milestone Unfortunately (due to lack of contributors) glance community was unable to keep track of its bug backlog for the past couple of cycles. This cycle our main focus is to revisit old bugs and reduce the bug backlogs for glance, glance_store and python-glanceclient. We agreed to discuss existing bugs in our weekly meeting after every two weeks for 15-20 minutes. # Interop WG interlock During this session we discussed the state of existing glance tempest coverage and what action needs to be taken if there are any API changes or new API is introduced. Wednesday, April 21 # Secure RBAC - OSSN-0088 This entire day we discussed implementing Secure RBAC in glance. We also decided to discuss with Lance/Gmann whether it is fine to add deprecation warnings for OSSN-0088 on master branch or we should add those directly to stable/wallaby branch where we have defaulted some metaded APIs to admin only. # Glance policy - revisit, restructure We also discussed to revisit and restructure our policy layer. At the moment glance is injecting policies at different layers and most of the policies are injected closed to the database layer. This approach is causing problems in implementing the secure RBAC for location/tasks APIs. During this cycle we are going to experiment on restructuring the policy layer of glance (approach will be to work on restructuring modiffy_image policy and then submit the spec on the basis of that finding before moving forward). # Secure RBAC - Hardening project scope, Implementing System scope/personas During discussion on this topic we identified that to implement system scope in glance we first need to restructure the glance policy layer. Which means we need to keep our focus on restructuring the glance policy layer in this cycle. Also at the moment only publicize_image policy is an appropriate candidate for system scope. So we need to identify whether there are any other APIs which can also use system scope. Thursday, April 22 # Native Image Encryption As this work has dependency on Barbican which is yet to be completed, we decided to revisit the progress of the same around Milestone 2 and decide whether we are ready to implement this feature in Xena cycle or postpone it to next cycle. # Multi-format images We need to identify regression on Nova if we decide to implement the same. I need to connect with dansmith to understand more about it. If there are no side effects then we will be working on design/specification for this feature in this cycle and implement the same in the next cycle. Erno also suggested that we should improve the image conversion plugin based on multiple stores support. # Cinder - Glance cross project discussion During this discussion Rajat (cinder driver maintainer for glance) walked us through the current state of cinder driver of glance and how we could add support for the new attachment API for cinder driver. Friday, April 23 # Cache-API We already agreed on implementation design about the same, the only reason it is pending is we shifted our focus on RBAC in the last cycle. So it is decided to wait for a couple of weeks in this cycle if we get any new contributor to work on it or else implement the same during milestone 1. # Glance Quotas This topic was raised on the fly by belmoreira during the PTG so we discussed the same. We decided to assess the use of keystone's unified limits and put up a design/specification in glance to add quotas for images. Apart from above topics during Open discussion we also discussed some of the swift related bugs which we will be addressing during this cycle. You will find the detailed information about the same in the PTG etherpad [1] along with the recordings of the sessions. I would once again like to thank everyone for joining us in the PTG. [1] https://etherpad.opendev.org/p/xena-glance-ptg Thanks and Regards, Abhishek

1 0

[CLOUDKITTY] Missed CloudKitty meeting today
by Rafael Weingärtner 04 May '21

04 May '21

Hello guys, I would like to apologize for missing the CloudKitty meeting today. I was concentrating on some work, and my alarm for the meeting did not ring. I still have to summarize the PTL meeting. I will do so today. Again, sorry for the inconvenience; see you guys at our next meeting. -- Rafael Weingärtner

3 5

[kolla][ptg] Kolla PTG summary
by Mark Goddard 04 May '21

04 May '21

Hi, Thank you to everyone who attended the Kolla Xena PTG. Thank you also to those who helped out with chairing and driving discussions, since I had a cold and my brain was far from 100%. Here is a short summary of the discussions. See the Etherpad [1] for full notes. # Wallaby Retrospective On the positive side, we merged a number of useful features this cycle, and eventually mitigated the Dockerhub pull limit issues in CI by switching to quay.io. On the negative side, we feel that we have lost some review bandwidth recently. We really need more people in the community helping out with reviews, and ideally moving to become members of the core team. The barrier for entry is probably lower than you think, and the workload does not have to be too heavy - every little helps. PLEASE get in touch if you are interested in helping out. # Review Wallaby PTG actions Many of these are incomplete and still relevant. As usual, it's easier to think of things to do than find time to do them. I've added them at the end of the actions section of the etherpad, and we can revisit them throughout the Xena cycle. # General topics ## Deprecations In the continuing drive to reduce the maintenance overhead of the project, we discussed which components or features might need to be deprecated next. With Tripleo out of the picture, RHEL support is not tested, so it will be deprecated in Wallaby for removal in Xena. We discussed standardising on source image type and dropping support for binary images, but agreed (once again) that it would be too disruptive for users, and the repository model may be easier for users to mirror. ## Release process We agreed to document some more of our release process. We also agreed to try a new approach in Xena, where we begin the cycle deploying the previous release of OpenStack (Wallaby) on our master branches, to avoid firefighting caused by breakage in OpenStack projects. This should provide us with more stability while we add our own features. The downside is that we may build up some technical debt to converge with the new release. Some details are still to be decided. ## Elasticsearch -> OpenSearch The recent Elasticsearch licence change may be a blocker in some organisations, and Amazon's OpenSearch appears to provide an alternative. The final OSS release of Elastic (7.10) EOL is 2022-05-10, so we have time to consider our options. Christian offered to investigate a possible migration. ## Reflection The team reflected a little on how things are going. We agreed that the 4 most active core team members form quite a tight unit that effectively makes decisions and keeps the project moving forward, with the help of other core team members and other community members. We also agreed that we are quite vulnerable to the loss of any of those 4, especially when we consider how many patches are authored and approved by any 3 of those 4, and their areas of expertise. ## Future leadership I have decided that this will be my last cycle as Kolla PTL. I still enjoy the role, but I think it is healthy to rotate the leadership from time to time. We have at least one person lined up for nomination, so watch this space! # Kolla (images) topics ## CentOS Stream 8 We have added support for CentOS Stream 8 (and dropped CentOS Linux 8) in the Wallaby release. Since CentOS Linux 8 will be EOL at the end of this year (THANK YOU VERY MUCH FOR THAT BY THE WAY), we need to consider which stable releases may need to have CentOS Stream 8 support backported. RDO will not support Train on stream. Ussuri will move to Extended Maintenance before the end of 2021, however we know that many users are still a few releases behind upstream. In the end, we agreed to start with backporting support to Victoria, then consider Ussuri once that is done. We agreed to keep CentOS Linux 8 as the default base image due to backwards compatibility promises. Stream images will have a victoria-centos8s tag to differentiate them, similarly to how we handled CentOS 8. ## Official plugins We agreed to remove non-official plugins from our images. Often these projects branch late and break our release processes. We agreed to provide example config snippets and documentation to help adding these plugins back into images. # Kolla Ansible ## Glance metadef APIs (OSSN-0088) Glance team discussed this issue at the PTG, we have an action to follow up on their decision. ## Opinionated, hardened configuration Should we provide an opinionated, hardened configuration? For example TLS by default, conform to OpenStack security checklist, etc. Some nods of approval, but no one offering to implement it. ## Running kolla-ansible bootstrap-servers without stress Currently, running kolla-ansible bootstrap-servers on an existing system can restart docker on all nodes concurrently. This can take out clustered services such as MariaDB and RabbitMQ. There are various options to improve this, including a serial restart, or an intelligent parallel restart (including waiting for services to be up). We decided on an action to investigate enabling Docker live restore by default, and what its shortcomings may be. ## Removal/cleanup of services We again discussed how to do a more fine grained cleanup of services. Ideally this would be per-service, and could include things like dropping DBs and Keystone endpoints. yoctozepto may have time to look into this. ## Cinder active/active bug We are still affected by [2]. We have a fairly good plan to resolve it, but some details around migration of existing clusters need ironing out. yoctozepto and mnasiadka to continue looking at it. ## More fine grained skipping of tasks, e.g. allow to skip service registration We agreed to abandon the tag based approach in favour of pushing an existing effort [3] to make a split genconfig, deploy-containers command pair work. This achieves one of the main gains of skipping the bootstrap and registration steps, and is useful for other reasons. ## Letsencrypt We agreed to split the existing patches [4] into the contentious and non-contentious parts. Namely, separate HAProxy automatic certificate reload from certbot support. The HAProxy reload is currently implemented via supervisord and cron in the container, which does not fit well with our single process container model. We will look into an HAProxy upgrade for automatic certificate rotation detection as a possible solution. ## ProxySQL kevko outlined the proposed ProxySQL patch chain [5], as well as some more details on the nature of the problem being solved. In Wallaby we added initial support for multiple MariaDB clusters. ProxySQL builds on this, providing sharding at the database schema level between different OpenStack projects (nova, neutron, etc.). # Kayobe ## Running host configure during upgrades Pierre proposed a change [6] to our documented upgrade procedure to include a 'host configure' step. Sometimes this is necessary to upgrade or reconfigure Docker, or other parts of the host setup. We agreed that this should be done, but that we should also improve the 'kayobe <seed|seed-hypervisor|overcloud> host upgrade' commands to avoid a full host configure run. ## Support provisioning infrastructure VMs We walked through the proposed feature [7], including the various milestones proposed. An MVP if simply provisioning infra VMs on the seed hypervisor was agreed. ## Ubuntu We discussed what has been achieved [8] in Wallaby so far, what still needs to be done before the release, and what we have left to look at in Xena and beyond. We are on track to have most features available in Wallaby. We discussed whether to backport this work to Victoria. It will depend on how cleanly the code applies. ## Multiple environments Pierre implemented the majority of this long-awaited feature [9] in Wallaby. We still require CI testing, and the ability to share common Kolla configuration between environments. These will be looked at in Xena. ## Multiple host images Pierre started work [10] on this feature. The aim is to describe multiple root disk images with different properties, then map these images to different overcloud hosts. # Priorities We usually vote for community priorities, however this cycle it was felt that they only have a minimal effect on activity. Let's see how it goes without them. Thanks, Mark [1] https://etherpad.opendev.org/p/kolla-xena-ptg [2] https://bugs.launchpad.net/kolla-ansible/+bug/1904062 [3] https://review.opendev.org/c/openstack/kolla-ansible/+/773246 [4] https://review.opendev.org/q/topic:%22bp%252Fletsencrypt-https%22+(status:o… [5] https://review.opendev.org/q/hashtag:%22proxysql%22+(status:open%20OR%20sta… [6] https://review.opendev.org/c/openstack/kayobe/+/783053 [7] https://storyboard.openstack.org/#!/story/2008741 [8] https://storyboard.openstack.org/#!/story/2004960 [9] https://storyboard.openstack.org/#!/story/2002009 [10] https://storyboard.openstack.org/#!/story/2002098

1 0

Openstack Stack issues
by Premkumar Subramaniyan 04 May '21

04 May '21

Hi, I am using the Openstack *USURI *version in *Centos7*. Due to some issues my disk size is full,I freed up the space. Afte that some service went down. After that I have issues in creating the stack and list stack. Attached the Screenshot for your reference [opnfv@aio1 ~]$ openstack stack list --debug START with options: stack list --debug options: Namespace(access_token='***', access_token_endpoint='', access_token_type='', application_credential_id='', application_credential_name='', application_credential_secret='***', auth_methods='', auth_type='', auth_url='http://10.200.134.218:5000/v3', cacert=None, cert='', client_id='', client_secret='***', cloud='', code='', debug=True, default_domain='default', default_domain_id='', default_domain_name='', deferred_help=False, discovery_endpoint='', domain_id='', domain_name='', endpoint='', identity_provider='', insecure=None, interface='public', key='', log_file=None, openid_scope='', os_beta_command=False, os_compute_api_version='', os_identity_api_version='3', os_image_api_version='', os_network_api_version='', os_object_api_version='', os_orchestration_api_version='1', os_project_id=None, os_project_name=None, os_volume_api_version='', passcode='', password='***', project_domain_id='default', project_domain_name='', project_id='0e75229392c54a398ab302a8e43aebe6', project_name='admin', protocol='', redirect_uri='', region_name='RegionOne', remote_project_domain_id='', remote_project_domain_name='', remote_project_id='', remote_project_name='', service_provider='', system_scope='', timing=False, token='***', trust_id='', user_domain_id='', user_domain_name='Default', user_id='', username='admin', verbose_level=3, verify=None) Auth plugin password selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'baremetal_introspection_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'user_domain_name': 'Default', 'project_domain_id': 'default', 'project_id': '0e75229392c54a398ab302a8e43aebe6', 'project_name': 'admin'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'username': 'admin', 'password': '***', 'auth_url': ' http://10.200.134.218:5000/v3', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'auth_type': 'password', 'networks': []} defaults: {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'auth_type': 'password', 'baremetal_status_code_retries': 5, 'baremetal_introspection_status_code_retries': 5, 'image_status_code_retries': 5, 'disable_vendor_agent': {}, 'interface': None, 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active'} cloud cfg: {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'baremetal_introspection_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'user_domain_name': 'Default', 'project_domain_id': 'default', 'project_id': '0e75229392c54a398ab302a8e43aebe6', 'project_name': 'admin'}, 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'username': 'admin', 'password': '***', 'auth_url': ' http://10.200.134.218:5000/v3', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'auth_type': 'password', 'networks': []} compute API version 2.1, cmd group openstack.compute.v2 identity API version 3, cmd group openstack.identity.v3 image API version 2, cmd group openstack.image.v2 network API version 2, cmd group openstack.network.v2 object_store API version 1, cmd group openstack.object_store.v1 volume API version 3, cmd group openstack.volume.v3 orchestration API version 1, cmd group openstack.orchestration.v1 command: stack list -> heatclient.osc.v1.stack.ListStack (auth=True) Auth plugin password selected auth_config_hook(): {'api_timeout': None, 'verify': True, 'cacert': None, 'cert': None, 'key': None, 'baremetal_status_code_retries': '5', 'baremetal_introspection_status_code_retries': '5', 'image_status_code_retries': '5', 'disable_vendor_agent': {}, 'interface': 'public', 'floating_ip_source': 'neutron', 'image_api_use_tasks': False, 'image_format': 'qcow2', 'message': '', 'network_api_version': '2', 'object_store_api_version': '1', 'secgroup_source': 'neutron', 'status': 'active', 'auth': {'user_domain_name': 'Default', 'project_domain_id': 'default', 'project_id': '0e75229392c54a398ab302a8e43aebe6', 'project_name': 'admin'}, 'additional_user_agent': [('osc-lib', '2.3.1')], 'verbose_level': 3, 'deferred_help': False, 'debug': True, 'region_name': 'RegionOne', 'default_domain': 'default', 'timing': False, 'username': 'admin', 'password': '***', 'auth_url': 'http://10.200.134.218:5000/v3', 'beta_command': False, 'identity_api_version': '3', 'orchestration_api_version': '1', 'auth_type': 'password', 'networks': []} Using auth plugin: password Using parameters {'auth_url': 'http://10.200.134.218:5000/v3', 'project_id': '0e75229392c54a398ab302a8e43aebe6', 'project_name': 'admin', 'project_domain_id': 'default', 'username': 'admin', 'user_domain_name': 'Default', 'password': '***'} Get auth_ref REQ: curl -g -i -X GET http://10.200.134.218:5000/v3 -H "Accept: application/json" -H "User-Agent: openstacksdk/0.55.0 keystoneauth1/4.3.1 python-requests/2.25.1 CPython/3.6.8" Starting new HTTP connection (1): 10.200.134.218:5000 http://10.200.134.218:5000 "GET /v3 HTTP/1.1" 200 254 RESP: [200] Connection: close Content-Length: 254 Content-Security-Policy: default-src 'self' https: wss:; Content-Type: application/json Date: Thu, 29 Apr 2021 05:26:21 GMT Server: nginx/1.18.0 Vary: X-Auth-Token X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block x-openstack-request-id: req-5e95ffe0-5fde-4234-9e7c-f79287e539a0 RESP BODY: {"version": {"id": "v3.14", "status": "stable", "updated": "2020-04-07T00:00:00Z", "links": [{"rel": "self", "href": " http://10.200.134.218:5000/v3/"}], "media-types": [{"base": "application/json", "type": "application/vnd.openstack.identity-v3+json"}]}} GET call to http://10.200.134.218:5000/v3 used request id req-5e95ffe0-5fde-4234-9e7c-f79287e539a0 Making authentication request to http://10.200.134.218:5000/v3/auth/tokens Resetting dropped connection: 10.200.134.218 http://10.200.134.218:5000 "POST /v3/auth/tokens HTTP/1.1" 201 6037 {"token": {"methods": ["password"], "user": {"domain": {"id": "default", "name": "Default"}, "id": "b3c6351eb7d841678297401969eb01c7", "name": "admin", "password_expires_at": null}, "audit_ids": ["-pXpoN1cRyS5ioGPNOEdkg"], "expires_at": "2021-04-29T17:26:22.000000Z", "issued_at": "2021-04-29T05:26:22.000000Z", "project": {"domain": {"id": "default", "name": "Default"}, "id": "0e75229392c54a398ab302a8e43aebe6", "name": "admin"}, "is_domain": false, "roles": [{"id": "5123dc78efec436dad719099e4979536", "name": "admin"}, {"id": "6ddb974942354b53a6cc1dfe10cc58a9", "name": "member"}, {"id": "24de7013b1124fcd99c31482ede6a855", "name": "reader"}], "catalog": [{"endpoints": [{"id": "9ef24c86cb5e49f6aecb882adfe8b8be", "interface": "admin", "region_id": "RegionOne", "url": "http://172.29.236.100:5000", "region": "RegionOne"}, {"id": "c43060c06da940ab9c9de47d96efca5f", "interface": "internal", "region_id": "RegionOne", "url": " http://172.29.236.100:5000", "region": "RegionOne"}, {"id": "ff7a8af4a859400584fc2f4025f8110a", "interface": "public", "region_id": "RegionOne", "url": "http://10.200.134.218:5000", "region": "RegionOne"}], "id": "0177ada716b8496390b53f88de002762", "type": "identity", "name": "keystone"}, {"endpoints": [{"id": "01dcd05263a5499a9222459614c19099", "interface": "admin", "region_id": "RegionOne", "url": " http://172.29.236.100:8776/v2/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "8f8d9172c7b94baf8971d6fce50c3c22", "interface": "public", "region_id": "RegionOne", "url": " http://10.200.134.218:8776/v2/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "abe2895da1fc47e2a795136a0f154dad", "interface": "internal", "region_id": "RegionOne", "url": " http://172.29.236.100:8776/v2/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}], "id": "2a8111a2e7224baaa928ba19545754cd", "type": "volumev2", "name": "cinderv2"}, {"endpoints": [{"id": "027033523daf4adc8d1a180e41f57c00", "interface": "admin", "region_id": "RegionOne", "url": " http://172.29.236.100:8004/v1/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "765c7ea8a9c4456bb23ba5d519ffa033", "interface": "internal", "region_id": "RegionOne", "url": " http://172.29.236.100:8004/v1/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "f3a264f72c0a4960b9740e466eb52d83", "interface": "public", "region_id": "RegionOne", "url": " http://10.200.134.218:8004/v1/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}], "id": "31803d9d7a3e4d4e92d9522459526a68", "type": "orchestration", "name": "heat"}, {"endpoints": [{"id": "1183338890744524b28c274ca61e93ff", "interface": "admin", "region_id": "RegionOne", "url": "http://172.29.236.100:8780", "region": "RegionOne"}, {"id": "21bcc1ebb4de44d2931f0220d6fa1576", "interface": "internal", "region_id": "RegionOne", "url": "http://172.29.236.100:8780", "region": "RegionOne"}, {"id": "70f912ca1dc44c3a826e987d1ea9f5b4", "interface": "public", "region_id": "RegionOne", "url": "http://10.200.134.218:8780", "region": "RegionOne"}], "id": "5c4974e041d34241bc7edf17f8ce07ae", "type": "placement", "name": "placement"}, {"endpoints": [{"id": "3c105203c90845d0a523f34cf6bc037b", "interface": "public", "region_id": "RegionOne", "url": "http://10.200.134.218:8000/v1", "region": "RegionOne"}, {"id": "cf77bee702da43d68aee3863d4fa68f0", "interface": "internal", "region_id": "RegionOne", "url": "http://172.29.236.100:8000/v1", "region": "RegionOne"}, {"id": "deda0fe9872d472e8ad04bf9cf65caab", "interface": "admin", "region_id": "RegionOne", "url": " http://172.29.236.100:8000/v1", "region": "RegionOne"}], "id": "675d604be05245e38156198a2e0c955c", "type": "cloudformation", "name": "heat-cfn"}, {"endpoints": [{"id": "0f358e9c8a9e4d4aa87ba5827c5612a7", "interface": "public", "region_id": "RegionOne", "url": " http://10.200.134.218:9696", "region": "RegionOne"}, {"id": "e0fda98441e442ad84ad9638b97fb5a9", "interface": "admin", "region_id": "RegionOne", "url": "http://172.29.236.100:9696", "region": "RegionOne"}, {"id": "f63223fe921a44e48fffaa90a22619b2", "interface": "internal", "region_id": "RegionOne", "url": "http://172.29.236.100:9696", "region": "RegionOne"}], "id": "679d6c52473b4b87867b0839238a2533", "type": "network", "name": "neutron"}, {"endpoints": [{"id": "04618143b8764565bd1f292c481ec9fc", "interface": "internal", "region_id": "RegionOne", "url": "http://172.29.236.100:9292", "region": "RegionOne"}, {"id": "131339c1c9564d0d9f0cfdf6311c2893", "interface": "admin", "region_id": "RegionOne", "url": "http://172.29.236.100:9292", "region": "RegionOne"}, {"id": "f0725b46e74549d1b3d58efaa46dbf02", "interface": "public", "region_id": "RegionOne", "url": "http://10.200.134.218:9292", "region": "RegionOne"}], "id": "df050da4381c4209968693e4aca92da5", "type": "image", "name": "glance"}, {"endpoints": [{"id": "7cb5429849d741238e31f929132b224d", "interface": "admin", "region_id": "RegionOne", "url": "http://172.29.236.100:8774/v2.1", "region": "RegionOne"}, {"id": "ab640e3d4ccf4d66832b0d2d38f30be9", "interface": "internal", "region_id": "RegionOne", "url": " http://172.29.236.100:8774/v2.1", "region": "RegionOne"}, {"id": "d707d5092628423397cb02a46cb1deca", "interface": "public", "region_id": "RegionOne", "url": "http://10.200.134.218:8774/v2.1", "region": "RegionOne"}], "id": "e807659ac4f74b78805b0f9e605081f0", "type": "compute", "name": "nova"}, {"endpoints": [{"id": "152f11cd02de47069bb7fee11954395d", "interface": "public", "region_id": "RegionOne", "url": " http://10.200.134.218:8776/v3/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "71b96d9f9b994d72bf21c10810a532f9", "interface": "admin", "region_id": "RegionOne", "url": " http://172.29.236.100:8776/v3/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}, {"id": "935b1c8e4da547ca891334fe476291b6", "interface": "internal", "region_id": "RegionOne", "url": " http://172.29.236.100:8776/v3/0e75229392c54a398ab302a8e43aebe6", "region": "RegionOne"}], "id": "ff62f9bcded14444bbb4f1e1cdcaf60b", "type": "volumev3", "name": "cinderv3"}]}} run(Namespace(all_projects=False, columns=[], deleted=False, fit_width=False, formatter='table', hidden=False, limit=None, long=False, marker=None, max_width=0, nested=False, noindent=False, print_empty=False, properties=None, quote_mode='nonnumeric', short=False, sort=None, sort_columns=[], sort_direction=None, tag_mode=None, tags=None)) take_action(Namespace(all_projects=False, columns=[], deleted=False, fit_width=False, formatter='table', hidden=False, limit=None, long=False, marker=None, max_width=0, nested=False, noindent=False, print_empty=False, properties=None, quote_mode='nonnumeric', short=False, sort=None, sort_columns=[], sort_direction=None, tag_mode=None, tags=None)) Instantiating orchestration client: <class 'heatclient.v1.client.Client'> REQ: curl -g -i -X GET http://10.200.134.218:8004/v1/0e75229392c54a398ab302a8e43aebe6/stacks? -H "Accept: application/json" -H "Content-Type: application/json" -H "User-Agent: python-heatclient" -H "X-Auth-Token: {SHA256}a0ae405fe8fdb29acbcc65b1ce4feb9a304448592d6a8ae982955e903f45f3c0" -H "X-Region-Name: RegionOne" Starting new HTTP connection (1): 10.200.134.218:8004 http://10.200.134.218:8004 "GET /v1/0e75229392c54a398ab302a8e43aebe6/stacks HTTP/1.1" 503 None RESP: [503] Cache-Control: no-cache Connection: close Content-Type: text/html RESP BODY: Omitted, Content-Type is set to text/html. Only application/json responses have their bodies logged. ERROR: b'<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request.\n</body></html>\n' Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/cliff/app.py", line 401, in run_subcommand result = cmd.run(parsed_args) File "/usr/local/lib/python3.6/site-packages/osc_lib/command/command.py", line 39, in run return super(Command, self).run(parsed_args) File "/usr/local/lib/python3.6/site-packages/cliff/display.py", line 115, in run column_names, data = self.take_action(parsed_args) File "/usr/local/lib/python3.6/site-packages/heatclient/osc/v1/stack.py", line 577, in take_action return _list(client, args=parsed_args) File "/usr/local/lib/python3.6/site-packages/heatclient/osc/v1/stack.py", line 691, in _list data = list(data) File "/usr/local/lib/python3.6/site-packages/heatclient/v1/stacks.py", line 136, in paginate stacks = self._list(url, 'stacks') File "/usr/local/lib/python3.6/site-packages/heatclient/common/base.py", line 114, in _list body = self.client.get(url).json() File "/usr/local/lib/python3.6/site-packages/keystoneauth1/adapter.py", line 395, in get return self.request(url, 'GET', **kwargs) File "/usr/local/lib/python3.6/site-packages/heatclient/common/http.py", line 323, in request raise exc.from_response(resp) heatclient.exc.HTTPServiceUnavailable: ERROR: b'<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request.\n</body></html>\n' clean_up ListStack: ERROR: b'<html><body><h1>503 Service Unavailable</h1>\nNo server is available to handle this request.\n</body></html>\n' END return value: 1 Warm Regards, Premkumar Subramaniyan Technical staff M: +91 9940743669 *CRN Top 10 Coolest Edge Computing Startups of 2020 <https://www.crn.com/slide-shows/networking/the-10-coolest-edge-computing-st…>*

5 11

[Ussuri][neutron] How to accomplish what allow_same_net_traffic did
by Eugen Block 04 May '21

04 May '21

Hi *, I was wondering how other operators deal with this. Our cloud started somewhere in Kilo or Liberty version and in older versions the option allow_same_net_traffic allowed to control whether instances in our shared network could connect to each other between different projects. That option worked for us but is now deprecated and the Pike release notes [1] state: > Given that there are other better documented and better tested ways > to approach this, such as through use of neutron’s native port > filtering or security groups, this functionality has been removed. > > Users should instead rely on one of these alternatives. Does that mean all security groups need to be changed in a way that this specific shared network is not reachable? That would be a lot of work if you have many projects. Is there any easier way? Regards, Eugen [1] https://docs.openstack.org/releasenotes/nova/pike.html

2 2