June 2021 - openstack-discuss - lists.openstack.org

cyborg-tempest-plugin test failed due to the zuul server has no accelerators
by Alex Song (宋文平) 22 Jun '21

22 Jun '21

Hello Everyone, Is the Zuul server env changed recently? There are no accelerators and our cyborg-tempest-plugin test failed. Please help. Thanks. Best Regards.

4 5

[cinder] Stepping down from cinder core
by Lucio Seki 21 Jun '21

21 Jun '21

Hi, I've been totally absent from the community in the last cycle, and unfortunately I'm not able to review Cinder patches in the next few cycles either. For this reason, I'm stepping down from the core team. Thank you all for the patience and attention to teach me so many things. It was a great opportunity for me to learn and grow professionally and personally. Hopefully sometime in the future I'll come back to the community again. Kind regards and stay safe, Lucio Seki

3 2

[interop] Preping up for June Board meeting
by Arkady Kanevsky 21 Jun '21

21 Jun '21

Team, as I prepare for the June OIF board meeting we need to do 3 things: 1. Need review and land https://review.opendev.org/c/osf/interop/+/796312 to remove requirement that one of Interop WG co-chair is from the board and nominated by the board. 2. Need to review and land https://review.opendev.org/c/osf/interop/+/784622 that has been discussed several times and is needed to match https://opendev.org/osf/interop/src/branch/master/doc/source/process/2021A.… . 3. Final comments on presentation slides for the board - https://docs.google.com/presentation/d/1-9H1cTXZxW0vCSTzfBe0aMKbd7nggd8SOHQ… We need to complete it by Monday June 21 so I can send it to the board 1 week before the meeting. Thanks, -- Arkady Kanevsky, Ph.D. Phone: 972 707-6456 Corporate Phone: 919 729-5744 ext. 8176456

3 4

[neutron] Bug deputy report for week of June 14th
by Lajos Katona 21 Jun '21

21 Jun '21

Hi, I was last week's bug deputy for Neutron, Below is a short summary of last week's bugs: Critical --------- - https://bugs.launchpad.net/neutron/+bug/1932093 - "oslo_config.cfg.DuplicateOptError: duplicate option: host" using OVN Octavia provider on stable/train - https://review.opendev.org/c/openstack/networking-ovn/+/796517 - - https://bugs.launchpad.net/neutron/+bug/1932483 - CI neutron.tests.functional.services.l3_router.test_l3_dvr get failed frequently - *Unassigned* High ------- - https://bugs.launchpad.net/neutron/+bug/1932421 - ovn-neutron-db-sync deletes legitimate metadata ports - https://review.opendev.org/q/I78673b6a85f1c872e70026da82124d1ba2326562 - https://bugs.launchpad.net/neutron/+bug/1933026 - stack.sh fail with ovs_source: No such file or directory - CI of some project fails with: "/opt/stack/neutron/devstack/plugin.sh: line 23: /opt/stack/devstack/lib/neutron_plugins/ovs_source: No such file or directory" after https://review.opendev.org/c/openstack/neutron/+/793470 is merged. - *Unassigned* Medium ----------- - Low ------ - https://bugs.launchpad.net/neutron/+bug/1932016 - Quality of Service (QoS) in Neutron, error in permissions - Doc fix: https://review.opendev.org/c/openstack/neutron/+/796457 - https://bugs.launchpad.net/neutron/+bug/1932373 - DB migration is interrupted and next execution will fail - Upgrade from Rocky to Victoria fails on db migration, and traceback points to binding index ( https://review.opendev.org/c/openstack/neutron/+/692285 ) but I can't reproduce the issue RFE ------- - https://bugs.launchpad.net/neutron/+bug/1931953 - [RFE] Openflow-based DVR L3 - Agreement on Drivers meeting was that the final goal should be to replace current DVR solution to have only one driver maintained. - https://bugs.launchpad.net/neutron/+bug/1932154 - [rfe] Off-path SmartNIC Port Binding - spec: https://review.opendev.org/c/openstack/neutron-specs/+/788821 Won't fix ------------ - https://bugs.launchpad.net/neutron/+bug/1931844 - Can't ping router with packet size greater than 1476 when ovs datapath_type set to netdev - "ovs datapath_type netdev" should only be used for VM, neutron router related virtual network devices are not compatible with it

2 1

[oslo] TaCT SIG volunteer
by Herve Beraud 21 Jun '21

21 Jun '21

Hi everyone, We are looking for volunteers to endorse the TaCT SIG liaison role for Oslo. Our previous volunteers are no longer active. Indeed, Moisés officially announced his retirement from Oslo two weeks ago, and Sébastien did not attend our meetings for some time. Here are the details about this role: https://governance.openstack.org/sigs/tact-sig.html Let us know if you're interested in this role, by replying to this thread or by joining us during our meetings (next meeting: July 05). Thanks for your attention. -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

[tc][all] Test support for TLS default
by Rico Lin 21 Jun '21

21 Jun '21

Dear all In short, can you help to enable tls-proxy for your test jobs and fix/report the issue in [4]? Or it makes no sense for you? Here's all repositories contains jobs with tls-proxy disabled: - neutron - neutron-tempest-plugin - cinder-tempest-plugin - cyborg-tempest-plugin - ec2api-tempest-plugin - freezer-tempest-plugin - grenade - heat - js-openstack-lib - keystone - kuryr-kubernetes - masakari - murano - networking-odl - networking-sfc - python-brick-cinderclient-ext - python-neutronclient - python-zaqarclient - sahara - sahara-dashboard - sahara-tests - solum - tacker - telemetry-tempest-plugin - trove - trove-tempest-plugin - vitrage-tempest-plugin - watcher As I'm looking for y-cycle potential goals, I found the tls-proxy support is not actually ready OpenStack wide (you can find some discussion in [3]). We have multiple projects that disable tls-proxy in test jobs [1] (and stay that way for a long time). For security concerns, I'm currently collecting the missing part for this. And try to figure out if there is any infra issue for current jobs. After I attempt to enable tls-proxy for some projects to check the status. And from the test result shows ([2]), We might have bugs/test infra issues in projects. So I invite projects who still have not switched to TLS default. Please do, and help to fix/report the issue you're facing. As we definitely need some more help on figuring out the actual situation on each project. So I created an etherpad [4] to track actions or related information. Meanwhile, I will attempt to enable tls-proxy on more test jobs (and you will be able to find it in [2]). Which gives us a good chance to review the logs and see how we might get chances to fix it and enable TLS by default. [1] https://codesearch.opendev.org/?q=tls-proxy%3A%20false&i=nope&files=&exclud… [2] https://review.opendev.org/q/topic:%22exame-tls-proxy%22+(status:open%20OR%… [3] https://etherpad.opendev.org/p/community-goals [4] https://etherpad.opendev.org/p/support-tls-default *Rico Lin* OIF Board director, OpenStack TC, Multi-arch SIG chair, Heat PTL, Senior Software Engineer@EasyStack

3 2

[ops][nova][spice][victoria] Switch from VNC to SPICE
by DHilsbos＠performair.com 21 Jun '21

21 Jun '21

All; We have a Victoria cluster, and I'd like to switch from VNC to SPICE. Cluster is installed with packages (RDO), and configured manually. I have located https://docs.openstack.org/nova/victoria/admin/remote-console-access.html, but this doesn't tell me which services need to be installed on which servers. Looking at packages, I'm fairly certain nova-spicehtml5proxy (openstack-nova-spicehtml5proxy on CentOS 8) needs to be installed where the nova-novncproxy is currently. I also suspect that qemu-kvm-ui-spice needs to be installed on the nova-compute nodes. Is spice-server needed on the nova-compute nodes? Thank you, Dominic L. Hilsbos, MBA Vice President - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

4 6

[cinder][kolla][OpenstackAnsible] Wallaby Cycle-Trailing Release Deadline
by Herve Beraud 21 Jun '21

21 Jun '21

Hello teams with trailing projects, Next week is the Wallaby cycle-trailing release deadline [1], and all projects following the cycle-trailing release model must release their Wallaby deliverables by 02 July, 2021. The following trailing projects haven't been released yet for Wallaby (aside the release candidates versions). Cinder team's deliverables: - cinderlib OSA team's deliverables: - openstack-ansible-roles - openstack-ansible Kolla team's deliverables: - kayobe - kolla - kolla-ansible This is just a friendly reminder to allow you to release these projects in time. Do not hesitate to ping us if you have any questions or concerns. [1] https://releases.openstack.org/xena/schedule.html#x-cycle-trail -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

Ceph RADOSGW Keystone integration - S3 bucket policies targeting not just whole projects but particular users?
by Christian Rohmann 21 Jun '21

21 Jun '21

Hallo Openstack-Users, (this is somewhat of a cross-port with the ceph-users ML, I just did not know where to ask about this best) I've been wondering about the state of OpenStack Keystone Auth in RADOSGW, especially in regards to the abilities to utilize bucket policies restricting access to only those users and only those objects which are required. 1) Even though the general documentation on RADOSGW S3 bucket policies is a little "misleading" https://docs.ceph.com/en/latest/radosgw/bucketpolicy/#creation-and-removal in showing users being referred as Principal, the documentation about Keystone integration at https://docs.ceph.com/en/latest/radosgw/keystone/#integrating-with-openstac… clearly states, that "A Ceph Object Gateway user is mapped into a Keystone <tenant>"||. In the keystone authentication code it strictly only takes the project from the authenticating user: * https://github.com/ceph/ceph/blob/6ce6874bae8fbac8921f0bdfc3931371fc61d4ff/… * https://github.com/ceph/ceph/blob/6ce6874bae8fbac8921f0bdfc3931371fc61d4ff/… This is rather unfortunate as this renders the usually powerful S3 bucket policies to be rather basic with granting access to all users (with a certain role) of a project or more importantly all users of another project / tenant, as in using arn:aws:iam::$OS_REMOTE_PROJECT_ID:root as principal. Or am I just misreading anything here or is this really all that can be done if using native keystone auth? Apparently I was not the only one wondering ... https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/7MXUZ63DEH7… 2) There is a PR open implementing generic external authentication https://github.com/ceph/ceph/pull/34093 Apparently this seems to also address the lack of support for subusers for Keystone - if I understand this correctly I could then grant access to users arn:aws:iam::$OS_REMOTE_PROJECT_ID:$user * Are there any plans on the roadmap to extend the functionality in regards to keystone as authentication backend? * Is anybody using another (custom) solution to allow a more fine-grained user and access management when utilizing Ceph for their object storage? Are you potentially not using Keystone directly and use a central database such as an LDAP and have Ceph and Keystone use that independently? Regards Christian

1 0

Wallaby install via kayobe onto ubuntu 20 all in one host
by Tony Pearce 21 Jun '21

21 Jun '21

I'm trying to run "kayobe overcloud host configure" against an ubuntu 20 machine to deploy Wallaby. I'm getting an error that python is not found during the host configure part. PLAY [Verify that the Kayobe Ansible user account is accessible] TASK [Verify that a command can be executed] fatal: [juc-ucsb-5-p]: FAILED! => {"changed": false, "module_stderr": "/bin/sh: 1: /usr/libexec/platform-python: not found\n", "module_stdout": "", "msg": "The module failed to execute correctly, you probably need to set the interpreter.\nSee stdout/stderr for the exact error", "rc": 127} Python3 is installed on the host. When searching where this platform-python is coming from it returns the kolla-ansible virtual envs: $ grep -rni -e "platform-python" venvs/kolla-ansible/lib/python3.8/site-packages/ansible/config/base.yml:1450: '8': /usr/libexec/platform-python venvs/kolla-ansible/lib/python3.8/site-packages/ansible/config/base.yml:1470: - /usr/libexec/platform-python I had a look through the deployment guide for Kayobe Wallaby and didnt see a note about changing this. Do I need to do further steps to support the ubuntu overcloud host? I have already set (as per the doc): os_distribution: ubuntu os_release: focal Regards, Tony Pearce

3 14