June 2021 - openstack-discuss - lists.openstack.org

Fwd: DPDK+OVS with OpenStack
by Mark Wittling 23 Apr '25

23 Apr '25

Looking for someone who knows OpenStack with OpenVSwitch, and in addition to that, DPDK with OpenStack and OVS.I am using OpenStack Queens, with OpenVSwitch. The architecture I am using is documented here: https://docs.openstack.org/neutron/queens/admin/deploy-ovs-provider.htmlThe OVS I am using on the Compute Node, is compiled with DPDK, and I have enabled the datapath to netdev (DPDK) on br-prv (provider network bridge), and br-tun (tunneling bridge). But these two bridges, br-tun and br-prv, are patched into another OpenStack bridge, called br-int. I wasn’t actually sure about whether to tinker with this bridge, and wondered what datapath it was using.Then, I realized there is a parameter in the openvswitch_agent.ini file, which I will list here: # OVS datapath to use. 'system' is the default value and corresponds to the # kernel datapath. To enable the userspace datapath set this value to 'netdev'. # (string value) # Possible values: # system - <No description provided> # netdev - <No description provided> #datapath_type = system datapath_type = netdev So in tinkering with this, what I realized, is that when you set this datapath_type to system or netdev, it will adjust the br-int bridge to that datapath type.So here is my question. How can I launch a non-DPDK VM, if all of the bridges are using the netdev datapath type?Here is another question. What if one of the flavors don’t have the largepages property set on them? I assumed OpenStack would revert to a system datapath and not use DPDK for those VM interfaces. Well, I found out in testing, that is not the case. If you set all your bridges up for netdev, and you don’t set the property on the Flavor of the VM (largepages), the VM will launch, but it simply won’t work.Is there no way, on a specific Compute Host, to support both DPDK (netdev datapaths) and non-DPDK (system datapaths)?Either on a VM interface level (VM has one interface that is netdev DPDK and another that is system datapath non-DPDK)?Or on a VM by VM basis (VM 1 has 1 or more netdev datapath interfaces and VM 2 has 1 or more system datapath interfaces)?Am I right here? Once you set up a Compute Host for DPDK, it’s DPDK or nothing on that Compute Host? (edited)

3 2

How to config DPDK compute in OVN
by dangerzone ar 22 Apr '25

22 Apr '25

Hi....as far I understand ovs does support dpdk compute to be deployed. I'm referring to the guideline ' *https://docs.openstack.org/networking-ovn/queens/admin/dpdk.html <https://docs.openstack.org/networking-ovn/queens/admin/dpdk.html>* ' ... It's too brief.. May I know how to config dpdk compute in OVN networking openstack? Hope someone could help what is the config to be done.... Currently compute is run without dpdk over openstack train ovn based. Please need some info on how I can proceed. Thank you

2 1

Live migration fails
by Szabo, Istvan (Agoda) 07 Aug '24

07 Aug '24

Hi, I have couple of compute nodes where the live migration fails with existing vms. When I quickly spawn a vm and try live migration it works so I assume shouldn't be a big problem with the compute node. However I have many existing vms where it fails with a servername not found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 ERROR nova.conductor.tasks.migrate [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] [instance: 1517a2ac-3b51-4d8d-80b3-89a5614d1ae0] Unable to find record for source node servername on servername: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 WARNING nova.scheduler.utils [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] Failed to compute_task_migrate_server: Compute host servername could not be found.: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 WARNING nova.scheduler.utils [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] [instance: 1517a2ac-3b51-4d8d-80b3-89a5614d1ae0] Setting instance to ACTIVE state.: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.672 227612 ERROR oslo_messaging.rpc.server [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] Exception during message handling: ComputeHostNotFound: Compute host am-osfecn-4025 Tried with this command: nova live-migration --block-migrate id. Any idea? Thank you. ________________________________ This message is confidential and is for the sole use of the intended recipient(s). It may also be privileged or otherwise protected by copyright or other legal rules. If you have received it by mistake please let us know by reply email and delete it from your system. It is prohibited to copy this message or disclose its content to anyone. Any confidentiality or privilege is not waived or lost by any mistaken delivery or unauthorized disclosure of the message. All messages sent to and from Agoda may be monitored to ensure compliance with company policies, to protect the company's interests and to remove potential malware. Electronic messages may be intercepted, amended, lost or deleted, or contain viruses.

5 16

[all] Dynamic Zuul results table in Gerrit 3
by Radosław Piliszek 04 Aug '22

04 Aug '22

Hello Fellow OpenStack and OpenDev Folks! TL;DR click on [3] and enjoy. I am starting this thread to not hijack the discussion happening on [1]. First of all, I would like to thank gibi (Balazs Gibizer) for hacking a way to get the place to render the table in the first place (pun intended). I have been a long-time-now user of [2]. I have improved and customised it for myself but never really got to share back the changes I made. The new Gerrit obviously broke the whole script so it was of no use to share at that particular state. However, inspired by gibi's work, I decided to finally sit down and fix it to work with Gerrit 3 and here it comes: [3]. Works well on Chrome with Tampermonkey. Not tested others. I hope you will enjoy this little helper (I do). I know the script looks super fugly but it generally boils down to a mix of styles of 3 people and Gerrit having funky UI rendering. Finally, I'd also like to thank hrw (Marcin Juszkiewicz) for linking me to the original Michel's script in 2019. [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-November/019051… [2] https://opendev.org/x/coats/src/commit/444c95738677593dcfed0cfd9667d4c4f0d5… [3] https://gist.github.com/yoctozepto/7ea1271c299d143388b7c1b1802ee75e Kind regards, -yoctozepto

5 7

Nova not updating to new size of an extended in-use / attached cinder volume (Ceph RBD) to guest
by Christian Rohmann 28 Jun '22

28 Jun '22

Hello Openstack-Discuss, after some digging I found out that cinder learned to resize attached (in-use) volumes quite a while ago with the introduction of the initial "extend 'in-use' volume" feature: https://review.opendev.org/c/openstack/cinder/+/454287/ The support was then extended to also cover Ceph RBD backed volumes with: https://review.opendev.org/c/openstack/nova/+/613039/ Since this is only about the cinder part, I was wondering if nova would ever find out and would actively rescan the device / volume and quintessentially present an increased new size to the guest. Apparently this is where a certain volume-extended event comes into play: https://review.opendev.org/c/openstack/nova/+/454322/ that is to be emitted by cinder when a volume had been extened. I then went head and tried this with the openstack cli (as Horizon does not seem to support / offer to resize in-use volumes. I run Openstack Train with Ceph RBD as storage. First I ran into an issue with the openstack cli (https://bugs.launchpad.net/cinder/+bug/1871759/comments/2 <https://bugs.launchpad.net/cinder/+bug/1871759/comments/2>) but using cinder extend $volumeid $newsize I was able to resize in-use volumes just fine. The only thing missing was the propagation to the guest. I played around with SCSI rescans, but that did not work, reboots also failed to do anyting in this regards. Stopping and starting the VM did work, but why having the capability to online-resize an attached volume when not being able to resize the guest volume as well? Apparently there seems to be an old and somewhat similar observation / bug with https://bugs.launchpad.net/nova/+bug/1369465 So I was simply wondering if this is expected to be working? Are there any special settings / options I need to set to enable this feature? Thanks and with kind regards Christian

4 9

[nova][dev] Revisiting qemu emulation where guest arch != host arch
by Apsey, Christopher 05 Jan '22

05 Jan '22

All, A few years ago I asked a question[1] about why nova, when given a hw_architecture property from glance for an image, would not end up using the correct qemu-system-xx binary when starting the guest process on a compute node if that compute nodes architecture did not match the proposed guest architecture. As an example, if we had all x86 hosts, but wanted to run an emulated ppc guest, we should be able to do that given that at least one compute node had qemu-system-ppc already installed and libvirt was successfully reporting that as a supported architecture to nova. It seemed like a heavy lift at the time, so it was put on the back burner. I am now in a position to fund a contract developer to make this happen, so the question is: would this be a useful blueprint that would potentially be accepted? Most of the time when people want to run an emulated guest they would just nest it inside of an already running guest of the native architecture, but that severely limits observability and the task of managing any more than a handful of instances in this manner quickly becomes a tangled nightmare of networking, etc. I see real benefit in allowing this scenario to run natively so all of the tooling that exists for fleet management 'just works'. This would also be a significant differentiator for OpenStack as a whole. Thoughts? [1] http://lists.openstack.org/pipermail/openstack-operators/2018-August/015653… Chris Apsey Director | Georgia Cyber Range GEORGIA CYBER CENTER 100 Grace Hopper Lane | Augusta, Georgia | 30901 https://www.gacybercenter.org

2 2

[docs] Double headings on every page
by Peter Matulis 04 Nov '21

04 Nov '21

Hi, I'm hitting an oddity in one of my projects where the titles of all pages show up twice. Example: https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/wall… Source file is here: https://opendev.org/openstack/charm-deployment-guide/src/branch/master/depl… Does anyone see what can be causing this? It appears to happen only for the current stable release ('wallaby') and 'latest'. Thanks, Peter

5 6

Help with eventlet 0.26.1 and dnspython >= 2
by Thomas Goirand 04 Oct '21

04 Oct '21

Hi, As you may know, eventlet is incompatible with dnspython >= 2.0.0.0rc1. See [1] for the details. However, Debian unstable has 2.0.0. Would there be some good soul willing to help me fix this situation? I would need a patch to fix this, but I'm really not sure how to start. Cheers, Thomas Goirand (zigo)

8 15

[all][tc][goals] Project Specific PTL and Contributor Documentation: Week R-20 Update
by Ghanshyam Mann 17 Sep '21

17 Sep '21

Hello Everyone, As you know, we did not select any community-wide goal for Xena cycle and in PTG, TC decided to spend more time on the previous cycle pending community-wide goal work[1] One of the previous cycle (Ussuri) goals is 'Project Specific PTL and Contributor Documentation' which still not completed by many projects. - https://governance.openstack.org/tc/goals/selected/ussuri/project-ptl-and-c… I am starting the work to finish this goal which is pretty straight forwards and sending the updates in this ML thread. Please review the patches and merge them or push the patches for your project's repo if not yet done. Gerrit Topic: https://review.opendev.org/q/topic:%22project-ptl-and-contrib-docs%22+(stat… Tracking: https://storyboard.openstack.org/#!/story/2007236 Progress Summary: =============== * Projects completed: 32 * Projects for which patches are up and required to merge those: 10 * Projects for which patches are not yet up: 12 [1] https://etherpad.opendev.org/p/tc-xena-tracker (Item#2) -gmann

2 2

[all]Introduction to venus which is the project of log management and has been contributed to the OpenStack community
by Liye Pang(逄立业) 10 Sep '21

10 Sep '21

Hello everyone, after feedback from a large number of operations and maintenance personnel in InCloud OpenStack, we developed the log management project “Venus” for the OpenStack projects and that has contributed to the OpenStack community. The following is an introduction to “Venus”. If there is interest in the community, we are interested in proposing it to become an official OpenStack project in the future. Background In the day-to-day operation and maintenance of large-scale cloud platform, the following problems are encountered： l Time-consuming for log querying while the server increasing to thousands. l Difficult to retrieve logs, since there are many modules in the platform, e.g. systems service, compute, storage, network and other platform services. l The large amount and dispersion of log make faults are difficult to be discovered. l Because of distributed and interaction between components of the cloud platform, and scattered logs between components, it will take more time to locate problems. About Venus According to the key requirements of OpenStack in log storage, retrieval, analysis and so on, we introduced Venus project, a unified log management module. This module can provide a one-stop solution to log collection, cleaning, indexing, analysis, alarm, visualization, report generation and other needs, which involves helping operator or maintainer to quickly solve retrieve problems, grasp the operational health of the platform, and improve the management capabilities of the cloud platform. Additionally, this module plans to use machine learning algorithms to quickly locate IT failures and root causes, and improve operation and maintenance efficiency. Application scenario Venus played a key role in the following scenarios： l Retrieval: Provide a simple and easy-to-use way to retrieve all log and the context. l Analysis: Realize log association, field value statistics, and provide multi-scene and multi-dimensional visual analysis reports. l Alerts：Convert retrieval into active alerts to realize the error finding in massive logs. l Issue location: Establish a chain relationship and knowledge graphs to quickly locate problems. Overall structure The architecture of log management system based on Venus and elastic search is as follows: Diagram 0: Architecture of Venus venus_api: API module，provide API、rest-api service. venus_manager: Internal timing task module to realize the core functions of the log system. Current progress The current progress of the Venus project is as follows: l Collection：Develop fluentd collection tasks based on collectd to read, filter, format and send plug-ins for OpenStack, operating systems, and platform services, etc. l Index：Dealing with multi-dimensional index data in elasticsearch, and provide more concise and comprehensive authentication interface to return query results. l Analysis：Analyzing and display the related module errors, Mariadb connection errors, and Rabbitmq connection errors. l Alerts：Develop alarm task code to set threshold for the number of error logs of different modules at different times, and provides alarm services and notification services. l Location：Develop the call chain analysis function based on global_requested series, which can show the execution sequence, time and error information, etc., and provide the export operation. l Management：Develop configuration management functions in the log system, such as alarm threshold setting, timing task management, and log saving time setting, etc. Application examples Two examples of Venus application scenarios are as follows. 1. The virtual machine creation operation was performed on the cloud platform and it was found that the virtual machine was not created successfully. First, we can find the request id of the operation and jump to the virtual machine creation call chain page. Then, we can query the calling process, view and download the details of the log of the call. 2. In the cloud platform, the error log of each module can be converted into alarms to remind the users. Further, we can retrieve the details of the error log and error log statistics. Next step The next step of the Venus project is as follows: * Collection：In addition to fluent, other collection plugins such as logstash will be integrated. * Analysis: Explore more operation and maintenance scenarios, and conduct statistical analysis and alarm on key data. * display: The configuration, analysis and alarm of Venus will be integrated into horizon in the form of plugin. * location: Form clustering log and construct knowledge map, and integrate algorithm class library to locate the root cause of the fault. Venus Project Registry Venus library: https://opendev.org/inspur/venus You can grab the source code using the following git command: git clone https://opendev.org/inspur/venus.git Venus Demo Youtu.be: <https://youtu.be/mE2MoEx3awM> https://youtu.be/mE2MoEx3awM

7 15

[masakari] Deprecating process monitor - querying the community in this thread
by Radosław Piliszek 23 Aug '21

23 Aug '21

Hello users of Masakari, As the Masakari core team, we have discussed the deprecation/retirement of one of the monitors - the process monitor. The reason is simple - we consider its mission is better handled by other software such as Kubernetes, Docker, or systemd, depending on how you deploy your OpenStack cluster. I believe the process monitor might have made sense in the pre-containerisation, pre-systemd world but it does not seem to any longer. Please let us know, by replying to this mail, if you have a use case for the process monitor that cannot be handled by the aforementioned software. -yoctozepto

1 1

[tripleo] Changing TripleO's release model
by Wesley Hayutin 20 Aug '21

20 Aug '21

Greetings TripleO community! At the most recent TripleO community meetings we have discussed formally changing the OpenStack release model for TripleO [1]. The previous released projects can be found here [2]. TripleO has previously released with release-type[‘trailing’, ‘cycle-with-intermediary’]. To quote the release model doc: ‘Trailing deliverables trail the release, so they cannot, by definition, be independent. They need to pick between cycle-with-rc <https://releases.openstack.org/reference/release_models.html#cycle-with-rc> or cycle-with-intermediary <https://releases.openstack.org/reference/release_models.html#cycle-with-int…> models.’ We are proposing to update the release-model to ‘independent’. This would give the TripleO community more flexibility in when we choose to cut a release. In turn this would mean less backporting, less upstream and 3rd party resources used by potentially some future releases. To quote the release model doc: ‘Some projects opt to completely bypass the 6-month cycle and release independently. For example, that is the case of projects that support the development infrastructure. The “independent” model describes such projects.’ The discussion here is to merely inform the greater community with regards to the proposal and conversations regarding the release model. This thread is NOT meant to discuss previous releases or their supported status, merely changing the release model here [3] [0] https://etherpad.opendev.org/p/tripleo-meeting-items [1] https://releases.openstack.org/reference/release_models.html [2] https://releases.openstack.org/teams/tripleo.html [3] https://opendev.org/openstack/releases/src/branch/master/deliverables/xena

9 17

It's time to submit your OpenStack User Survey
by Allison Price 19 Aug '21

19 Aug '21

Hi everyone, Here’s my annual email requesting you complete the OpenStack User Survey [1] and share with your local communities / community friends who are operating OpenStack. Anonymous reposes and aggregated data from the User Survey are shared with the OPenStack PTLs and overall community to help understand operator software requirements. If you have never taken it before, please do! We welcome your feedback and I am happy to answer any questions you may have. If you are one of the many who have, all of your previous information should be stored, so you will just need to provide updates where relevant and re-save. Thank you all! Cheers, Allison [1] https://www.openstack.org/user-survey/survey-2021 <https://www.openstack.org/user-survey/survey-2021> Allison Price Director of Marketing & Community OpenInfra Foundation e: allison(a)openstack.org <mailto:allison@openstack.org>

1 1

[masakari] Compute service with name XXXXX not found.
by at 19 Aug '21

19 Aug '21

Hi, I have some problem with masakari. I can create segment (from CLI and Horizon), but can't create host (the same result from Horizon and CLI). openstack segment host create XXXXX COMPUTE SSH segment_id returns BadRequest: Compute service with name XXXXX could not be found. XXXXX is the name which Horizon suggest, and it's a name of compute host. openstack compute service list returns proper list with state up/enabled on compute hosts (zone nova) Maybe I misunderstood some parameters of host create? As "type" I use COMPUTE, what value should it be? From "Binary" column of openstack compute service list? What is "control_attributes" field, because documentation lacks preceise information what value should be there and what is it use for. Tried to found some info on this error but I haven't found anything... Thanks in advance for any help. Best regards Adam Tomas

4 7

[interop][cinder] review of next.json (part 2)
by Brian Rosmaita 09 Aug '21

09 Aug '21

Hello Interop WG, The Cinder team completed its discussion of what capabilities should be added as advisory in next.json at yesterday's weekly cinder meeting [0]. The tldr; is that we don't have anything to propose for inclusion in next.json at the present time. The team does have some general questions that would help us determine the suitability of some proposed capabilities. We'd like to invite someone from the Interop WG to the cinder xena R-9 virtual midcycle (Wednesday 4 August 2021, 1400-1600 UTC) so we can discuss this "live". So if someone could put 1400 UTC 4 August on their schedule for a 20 minute discussion, that would be very helpful. cheers, brian [0] http://eavesdrop.openstack.org/meetings/cinder/2021/cinder.2021-05-12-14.00…

3 8

Re: [neutron-vpnaas][kolla-ansible][victoria] Growing memory consumption with only one VPN connection
by at 09 Aug '21

09 Aug '21

Hi, 1. There is only one, bidirectional vpn connection between project networks in two regions 2. there is no (or almost no) traffic on this vpn link 3. second region is on one host (kolla all-in-one) and situation looks the same- with vpn service enabled there is excessive Memory use (growing also about 5-6MB/ minute and forcing the system to use swapfile) there is no big cpu usage (ofcourse also due to no traffic inside VPN) It's the same case even if there's no vpn connection configured. Best regards Adam Tomas Wysłane z iPhone'a > Wiadomość napisana przez Vinh Nguyen Duc <vinhducnguyen1708(a)gmail.com> w dniu 29.06.2021, o godz. 11:04: > > > Hi Adam, > Do you think the VPN connection is use CPU and memory to encrypt the VPN traffic? > > On Mon, Jun 28, 2021 at 14:30 Adam Tomas <bkslash(a)poczta.onet.pl <mailto:bkslash@poczta.onet.pl>> wrote: > Hi, > I have problem with neutron vpnaas - after enabling vpnaas plugin everything was ok at first. I was able to create VPN connection and communication is correct. But after a week of running vpnaas (only one VPN connection created/working!) I’ve noticed, that neutron-vpnaas takes more and more memory. I have 5 processes on each controller (there should be always five? Or it is changing dynamically?): > > 42435 1545384 0.6 8.6 5802516 5712412 ? S Jun15 110:50 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf > 42435 1545389 0.6 8.5 5735832 5645856 ? S Jun15 112:16 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf > 42435 1545378 0.5 8.5 5734192 5643620 ? S Jun15 108:09 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf > 42435 1545372 0.5 8.5 5731128 5641436 ? S Jun15 109:07 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf > 42435 1545369 0.6 8.4 5637084 5547392 ? S Jun15 114:21 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf > > now neutron_server takes over 27G of RAM on each controller: > > neutron_server running 10.2 27.2G > > After stopping all neutron containers and starting it again neutron takes a lot less memory: > > neutron_server running 0.5 583M > > but memory usage keeps growing (about 5-6 M every minute). > What’s wrong? When I disable vpnaas globally there’s no problem with excessive memory usage, so it’s vpnaas for sure… > > Best regards > Adam Tomas

3 2

[nova][neutron][deployment-projects] Re secbug #1734320
by Radosław Piliszek 04 Aug '21

04 Aug '21

Hello Folks! I am writing this because a recent patch proposed to DevStack [1] mentioned "when using ml2/ovs vif isolation should always be used to prevent cross tenant traffic during a live migration" which is related to secbug #1734320 "Eavesdropping private traffic" [2]. However, I've found that none of the publicly-available deployment projects seem to be using ``isolate_vif``. [3] [4] Should this be corrected? PS: I used the deployment-projects tag as a collective tag to avoid mentioning all the projects (as it is too long to write :-) ). I hope that relevant people see this if need be or someone passes the information to them. For now, I am curious whether this should actually be enforced by default with ML2/OVS. [1] https://review.opendev.org/c/openstack/devstack/+/796826 [2] https://bugs.launchpad.net/neutron/+bug/1734320 [3] https://codesearch.opendev.org/?q=%5Cbisolate_vif%5Cb&i=nope&files=&exclude… [4] https://github.com/search?p=1&q=isolate_vif&type=Code -yoctozepto

3 2

[horizon][stable] [release] Proposal to make stable/queen as EOL
by vishal manchanda 16 Jul '21

16 Jul '21

Hi all, As discussed in the last horizon weekly meeting[1] on 2021-06-23, I would like to announce that the horizon team decided to make stable/queen branch as EOL. Consider this mail as an official announcement for that. I would like to know if anyone still would like to keep this branch to be open otherwise, I will purpose an EOL patch for this branch. Thanks & Regards, Vishal Manchanda [1] https://meetings.opendev.org/meetings/horizon/2021/horizon.2021-06-23-15.00…

3 4

[nova][stable] Adding nova-core to nova stable branches
by Stephen Finucane 13 Jul '21

13 Jul '21

Happy Friday (again), Following on from my earlier email regarding os-vif stable branch permissions, I'd like to once again propose that we add nova-core to the list of teams with +2 rights on nova stable branches. Unlike the os-vif change, this has been discussed extensively in the past, most recently during the Victoria PTG [1] (search for "Can we add nova-core to nova-stable-maint") and therefore carries a little more baggage with it. Last time we discussed this, there were concerns from some existing stable cores that not all of nova-core were sufficiently well acquainted with stable branch policy and it was suggested that review velocity was sufficient. However, the stable team has remained pretty stable (heh) over the last couple of cycles and is staffed with developers with ample experience of both nova itself and the backport policies of nova and OpenStack as a whole. In addition, we continue to have a long tail of open stable reviews [2] from various people. The stable branches are increasingly important for users and organizations alike, and a faster, smoother backport policy encourages people to have an upstream-first mentality when it comes to maintaining a product built on these branches. The alternative is to handle these backports in a downstream-first or downstream- only manner, which results in duplication of effort and, over the long-term, potential difficulties keeping downstream and upstream in-sync. I think the time has long since passed where we should remove the artificial barrier that exists here. I expect all nova cores will have the maturity and sensibility to ask questions where uncertainty exists and only approve backports that they are confident and knowledgeable about. I do not expect existing stable cores will be sidelined either. Far from it, in fact. Existing stable cores will continue to be valuable both for their reviews and knowledge of the intricacies of stable policy. I proposed a waiting period of one week before making changes to os-vif permissions, but given the history around changes to nova stable core, I think we would benefit from some additional time to assuage any concerns that may still exist. I propose that we come to a decision by 09-Aug, or two weeks from now. If necessary, we can discuss this in real-time during the nova team meeting next Tuesday. Cheers, Stephen [1] https://etherpad.opendev.org/p/nova-victoria-ptg [2] https://review.opendev.org/q/project:openstack/nova+NOT+branch:master+is:op…

2 2

placement service issue (placement-status upgrade check failure)
by Deepak Mohanty 12 Jul '21

12 Jul '21

I need your help with installation of placement service on Ubuntu 20.04. I have followed the steps in: https://docs.openstack.org/placement/wallaby/install/install-ubuntu.html I am facing the following issue when I try to verify the installation: $ placement-status upgrade check Error: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/oslo_upgradecheck/upgradecheck.py", line 196, in run return conf.command.action_fn() File "/usr/lib/python3/dist-packages/oslo_upgradecheck/upgradecheck.py", line 104, in check result = func_name(self, **kwargs) File "/usr/lib/python3/dist-packages/oslo_upgradecheck/common_checks.py", line 41, in check_policy_json policy_path = conf.find_file(conf.oslo_policy.policy_file) File "/usr/lib/python3/dist-packages/oslo_config/cfg.py", line 2543, in find_file raise NotInitializedError() oslo_config.cfg.NotInitializedError: call expression on parser has not been invoked I did a bit of debugging and found that the policy file is: policy.json. I could not find any policy.json on my machine. I created an empty policy.json at: /etc/placement/policy.json (user and group = placement). That too did not work. I have followed the steps in the install guide twice, deleting the placement database and other resources and recreating them. I continue to see the same issue. Thank you for your time.

5 6

[ patrole ] Understanding RBAC Permission Exceptions
by darumaseye 12 Jul '21

12 Jul '21

Hello, I am a researcher studying security of the Openstack's Policies. I'm very interested in the Patrole project and I would like to ask you some questions. In the documentation it is stated that Patrole compares two different types of results: - an expected one ( derived from oslo.policy ) - an actual one ( derived from an actual request to the API ). Given that, Patrole's tests can return 3 different values: 1) "Success" if actual result and expected result are both True or both False; 2) "RbacOverPermissionException" if actual result is True but expected result is False; 3) "RbacUnderPermissionException" in the other case. I can't understand in which cases the tests can return a value different from "Success". As far as I know, an API call should always be validated internally by oslo.policy's rules, before being allowed. So, in order for an API call to be accepted, oslo.policy's rules must allow that API call. It seems to me that the "expected" result ( derived from oslo.policy ) is always included in the actual result. Hoping that everything I said is correct, I would like to ask you: What issue is allowing such a strange behavior in Openstack APIs ? Why the expected results can be different from the actual ones? Are there publicly available examples showing "Failure" values? In general, are there any publicly available test cases that i can study to understand this? I Would like to thank you very much in advance; Best Regards, Jacopo

3 3

[all][infra][qa] Retiring Logstash, Elasticsearch, subunit2sql, and Health
by Clark Boylan 09 Jul '21

09 Jul '21

Hello everyone, Xenial has recently reached the end of its life. Our logstash+kibana+elasticsearch and subunit2sql+health data crunching services all run on Xenial. Even without the distro platform EOL concerns these services are growing old and haven't received the care they need to keep running reliably. Additionally these services represent a large portion of our resource consumption: * 6 x 16 vcpu + 60GB RAM + 1TB disk Elasticsearch servers * 20 x 4 vcpu + 4GB RAM logstash-worker servers * 1 x 2 vcpu + 2GB RAM logstash/kibana central server * 2 x 8 vcpu + 8GB RAM subunit-worker servers * 64GB RAM + 500GB disk subunit2sql trove db server * 1 x 4 vcpu + 4GB RAM health server To put things in perspective, they account for more than a quarter of our control plane servers, occupying over a third of our block storage and in excess of half the total memory footprint. The OpenDev/OpenStack Infra team(s) don't seem to have the time available currently to do the major lifting required to bring these services up to date. I would like to propose that we simply turn them off. All of these services operate off of public data that will not be going away (specifically job log content). If others are interested in taking this on they can hook into this data and run their own processing pipelines. I am sure not everyone will be happy with this proposal. I get it. I came up with the idea for the elasticsearch job log processing way back at the San Diego summit. I spent many many many hours since working to get it up and running and to keep it running. But pragmatism means that my efforts and the team's efforts are better spent elsewhere. I am happy to hear feedback on this. Thank you for your time. Clark

10 13

[Octavia dashboard] Impossible to fill the subnet field when creating a load balancer
by Taltavull Jean-Francois 09 Jul '21

09 Jul '21

Hi All, On my OSA Victoria deployment (on Ubuntu 20.04), the "Create Load Balancer" form does not allow me to fill the mandatory "subnet" field and therefore I can't create a load balancer with Horizon. On the other hand, Octavia works fine and I can create load balancers with the CLI, Terraform, etc. Has one of you already faced such a situation ? Best regards, Jean-François

3 6

[Ironic] Vendor-neutral Disk names
by Mahnoor Asghar 06 Jul '21

06 Jul '21

Dear all, There is [a proposal][1] in the metal3-io/baremetal-operator repository to extend the hardware RAID configuration to support ‘physical_disks’ and ‘controller’ fields in the 'target_raid_config' section. The user should be able to specify the disks for RAID configuration, in a vendor-agnostic way. (This requirement comes from the Airship project.) The names of the disks should be indicative of the physical location of the disks within the server. An algorithm to construct disk names is therefore needed, for this purpose. One possible algorithm was found in the [inventory module][2] of the [Redfish Tacklebox scripts][3]. To construct a disk name, it uses Redfish properties, specifically the ‘Drive’ resource> ‘Physical Location’ object> ‘Part Location’ property> ‘Service Label’ property. ([Link][4] to code) ([Link][5] to Redfish ‘Drive’ resource) If this property is empty, the resource type (String uptil the first dot encountered in the @odata.type field), and the ‘Id’ properties of the Drive resource are used to construct the disk name. ([Link][6] to code) For example, if the 'Drive'.'Physical Location'.'Part Location'.'Service Label' field is ‘Disk.Bay1.Slot0’, this is what the disk name will be. If this field is empty, and the resource name is ‘Drive’ and the resource ‘Id’ is ‘Disk.Bay1.Slot0’, the disk name will be: ‘Drive: Disk.Bay1.Slot0’. We would like to understand the values different vendors give in: - ‘Drive’ resource> ‘Physical Location’ object> ‘Part Location’ property> ‘Service Label’ property - The resource type for a Drive (@odata.type field) - The ‘Id’ property of the Drive resource Also, it would be helpful to understand the existing logic used by vendors to construct the disk names, including the (Redfish or other) properties used. This is so that a consensus can be reached for an algorithm to construct disk names. Any suggestions are welcome, thank you so much! [1]: https://github.com/metal3-io/metal3-docs/pull/148 [2]: https://github.com/DMTF/Redfish-Tacklebox/blob/master/redfish_utilities/inv… [3]: https://github.com/DMTF/Redfish-Tacklebox [4]: https://github.com/DMTF/Redfish-Tacklebox/blob/e429f70a79cfe288756618498ce4… [5]: https://redfish.dmtf.org/schemas/v1/Drive.v1_12_1.json [6]: https://github.com/DMTF/Redfish-Tacklebox/blob/e429f70a79cfe288756618498ce4… Best regards, Mahnoor Asghar Software Design Engineer xFlow Research Inc. mahnoor.asghar(a)xflowresearch.com www.xflowresearch.com

4 6

[wallaby][nova] CPU topology and NUMA Nodes
by Ammad Syed 06 Jul '21

06 Jul '21

Hi, I am using openstack wallaby on ubuntu 20.04 and kvm. I am working to make optimized flavor properties that should provide optimal performance. I was reviewing the document below. https://docs.openstack.org/nova/wallaby/admin/cpu-topologies.html I have two socket AMD compute node. The workload running on nodes are mixed workload. My question is should I use default nova CPU topology and NUMA node that nova deploys instance by default OR should I use hw:cpu_sockets='2' and hw:numa_nodes='2'. Which one from above provide best instance performance ? or any other tuning should I do ? The note in the URL (CPU topology sesion) suggests that I should stay with default options that nova provides. Currently it also works with libvirt/QEMU driver but we don’t recommend it in production use cases. This is because vCPUs are actually running in one thread on host in qemu TCG (Tiny Code Generator), which is the backend for libvirt/QEMU driver. Work to enable full multi-threading support for TCG (a.k.a. MTTCG) is on going in QEMU community. Please see this MTTCG project <http://wiki.qemu.org/Features/tcg-multithread> page for detail. Ammad

5 9

[nova] spec review day
by Balazs Gibizer 05 Jul '21

05 Jul '21

Hi, During the today's meeting it came up that we should have a spec review day around M1 (and later one more before M2). As M1 is 27th of May, I propose to do a spec review day on 25th of May, which is a Tuesday. Let me know if the timing does not good for you. The rules are the usual. Let's use this day to focus on open specs, trying to reach agreement on as many thing as possible with close cooperation during the day. Cheers, gibi

1 3

[Kolla-Ansible] Regarding stability of Ironic deployment with Kolla-Ansible
by Amit Mahajan 01 Jul '21

01 Jul '21

Hi All, We are exploring Kolla-Ansible for our multinode production grade deployment. In our setup, some workloads will also run on bare-metal, so Ironic is the key requirement. We came across the following text on the Kolla-Ansible documentation page for Rocky release. "Ironic works well in Kolla, though it is not currently tested as part of Kolla CI, so may be subject to instability." Our query is that is deployment of Ironic using Kolla-Ansible production grade for the latest OpenStack release?

3 6

[kayobe][victoria] no module named docker - deploy fail after deploy successful
by Tony Pearce 01 Jul '21

01 Jul '21

I had a successful deployment of Openstack Victoria via Kayobe with an all-in-one node running controller and compute roles. I wanted to then add 2 controller nodes to make 3 controllers and one compute. The 2 additional controllers have a different interface naming so I needed to modify the inventory. I checked this ansible documentation to figure out the changes I’d need to make [1]. The first try, I misunderstood the layout because kayobe tried to configure the new nodes interfaces with incorrect naming. In my first try I tried this inventory layout: Move existing configuration: [kayobe config] / Inventory / * To [kayobe config] / Inventory / Ciscohosts / Create new from copy of existing:[kayobe config] / Inventory / Ciscohosts / > [kayobe config] / Inventory / Otherhosts / The Otherhosts had its own host file with the 2 controllers and group_vars/controllers network interface configuration as per these two hosts. But anyway it didnt achieve the desired result so I rechecked the ansible doc [1] and decided to do this another way as follows: In my second try I first reversed the inventory change: Delete the new dir: [kayobe config] / Inventory / Otherhosts / Move back the config: [kayobe config] / Inventory / Ciscohosts / * > [kayobe config] / Inventory / Delete the empty dir: [kayobe config] / Inventory / Ciscohosts / Then create host_vars for the two individual hosts: [kayobe config] / Inventory / host_vars / cnode2 [kayobe config] / Inventory / host_vars / cnode3 And updated the single hosts inventory file [kayobe config] / Inventory / hosts This seemed to work fine, the “kayobe overcloud host configure” was successful and the hosts interfaces were set up as I desired. The issue came when doing the “kayobe overcloud service deploy” and failed with "/usr/bin/python3", "-c", "import docker” = ModuleNotFoundError: No module named 'docker' for all three nodes, where previously it (the deployment) had been successful for the all-in-one node. I do not know if this task had run or skipped before but the task is run against "baremetal" group and controllers and compute are in this group so I assume that it had been ran successfully in previous deployments and this is the weird thing because no other changes have been made apart from as described here. Verbose error output: [3] After the above error, I reverted the inventory back to the “working” state, which is basically to update the inventory hosts and removed the 2 controllers. As well as remove the whole host_vars directory. After doing this however, the same error is still seen /usr/bin/python3", "-c", "import docker” = ModuleNotFoundError. I logged into the host and tried to run this manually on the CLI and I see the same output. What I don’t understand is why this error is occurring now after previous successful deployments. To try and resolve /workaround this issue I have tried to no avail: - recreating virtual environments on all-in-one node - recreating virtual environments on ACH - deleting the [kolla config] directory - deleting .ansible and /tmp/ caches - turning off pipelining After doing the above I needed to do the control host bootstrap and host configure before service deploy however the same error persisted and I could not work around it with any of the above steps being performed. As a test, I decided to turn off this task in the playbook [4] and the yml file runs as follows: [2]. This results in a (maybe pseudo) successful deployment again, in a sense that it deploys without failure because that task does not run. After this was successful in deploying once again as it had previously had been, I added the two controller nodes using the “host_vars” and then I was able to successfully deploy again with HA controllers. Well, it is successful apart from Designate issue due to Designate already having the config [5]. I can log in to the horizon dashboard and under system information I can see all three controllers there. Could I ask the community for help with: 1. Regarding the kayobe inventory, is anything wrong with the 2nd attempt in line with Kayobe? 2. Has anyone come across this docker issue (or similar within this context of failing after being successful) and can suggest? I repeatedly get these odd issues where successful deployments then fail in the future. This often occurs after making a config change and then rolling back but the roll back does not return to a working deployment state. The fix/workaround for me in these cases is to “kayobe overcloud service destroy --yes-i-really-really-mean-it” and also re-deploy the host. [1] Best Practices — Ansible Documentation <https://docs.ansible.com/ansible/2.8/user_guide/playbooks_best_practices.ht…> [2] modified Checking docker SDK version# command: "{{ ansible_python.execut - Pastebin.com <https://pastebin.com/xXJFHc0N> [3] TASK [prechecks : Checking docker SDK version] ********************************* - Pastebin.com <https://pastebin.com/ZmLs4LUZ> [4] /home/cv-user/kayobe-victoria/venvs/kolla-ansible/share/kolla-ansible/ansible/roles/prechecks/tasks/package_checks.yml [5] TASK [designate : Update DNS pools] ******************************************** - Pastebin.com <https://pastebin.com/USiCAXpT> Kind regards,

2 2

[nova][placement] Openstack only building one VM per machine in cluster, then runs out of resources
by Jeffrey Mazzone 01 Jul '21

01 Jul '21

Hello, I am installing Openstack Ussuri and am running into an issue when using Availability Zones. I initially thought it was a quota issue but that no longer seems to be the case. I started a thread on serverfault and was recommended to submit these questions here as well. Here is the original link: https://serverfault.com/questions/1064579/openstack-only-building-one-vm-pe… The issue is still, I can successfully build vms on every host, but only one vm per host. The size of the initial vm does not matter. Since I posted the thread above, I have redeployed the entire cluster, by hand, using the docs on openstack.org<http://openstack.org>. Everything worked as it should, I created 3 test aggregates, 3 test availability zones, with no issues for about a month. All of a sudden, the system reverted to no longer allowing more than one machine to be placed per host. There has been no changes to the controller. I have enabled placement logging now so I can see more information but I don’t understand why its happening. Example. Start with a host that has no vms on it: ~# openstack resource provider usage show 3f9d0deb-936c-474a-bdee-d3df049f073d +----------------+-------+ | resource_class | usage | +----------------+-------+ | VCPU | 0 | | MEMORY_MB | 0 | | DISK_GB | 0 | +----------------+-------+ Create 1 vm with 4 cores ~# openstack resource provider usage show 3f9d0deb-936c-474a-bdee-d3df049f073d +----------------+-------+ | resource_class | usage | +----------------+-------+ | VCPU | 4 | | MEMORY_MB | 0 | | DISK_GB | 0 | +----------------+-------+ The inventory list for that provider is: ~# openstack resource provider inventory list 3f9d0deb-936c-474a-bdee-d3df049f073d +----------------+------------------+----------+----------+----------+-----------+--------+ | resource_class | allocation_ratio | min_unit | max_unit | reserved | step_size | total | +----------------+------------------+----------+----------+----------+-----------+--------+ | VCPU | 16.0 | 1 | 64 | 0 | 1 | 64 | | MEMORY_MB | 1.5 | 1 | 515655 | 512 | 1 | 515655 | | DISK_GB | 1.0 | 1 | 7096 | 0 | 1 | 7096 | +----------------+------------------+----------+----------+----------+-----------+--------+ Trying to start another vm on that host fails with the following log entries: scheduler.log "status": 409, "title": "Conflict", "detail": "There was a conflict when trying to complete your request.\n\n Unable to allocate inventory: Unable to create allocation for 'VCPU' on resource provider conductor.log Failed to schedule instances: nova.exception_Remote.NoValidHost_Remote: No valid host was found. There are not enough hosts available. placement.log Over capacity for VCPU on resource provider 3f9d0deb-936c-474a-bdee-d3df049f073d. Needed: 4, Used: 8206, Capacity: 1024.0 As you can see, the used value is suddenly 8206 after a single 4 core vm is placed on it. I don’t understand what im missing or could be doing wrong. Im really unsure where this value is being calculated from. All the entries in the database and via openstack commands show the correct values except in this log entry. Has anyone experienced the same or similar behavior? I would appreciate any insight as to what the issue could be. Thanks in advance! -Jeff M

5 14

Fwd: [TRIPLEO] - ZUN Support in TripleO
by Lokendra Rathour 01 Jul '21

01 Jul '21

Hello Everyone, We are curious in understanding the usage of ZUN Sevice in TripleO with respect to which we have questions as below: 1. Does TripleO Support ZUN? 2. If not then, is there any alternative to deploy containerize services in TripleO? Any support with respect to the questions raised will definitely help us in deciding the tripleO usage. -- ~ Lokendra skype: lokendrarathour

6 7

[openstack] [DC-DC Setup] [Replication] Correct approach to a DC-DC setup for Openstack (victoria)
by Swogat Pradhan 01 Jul '21

01 Jul '21

Hi, I am trying to setup a DC-DC setup in openstack victoria, I have 2 numbers of all in one setup (controller, compute) with shared mysql and rabbitmq cluster and am using ceph image replication and configuring cinder replication on top of it. So when the 1st node goes down then i will perform a 'cinder failover-host node1' and then do a nova-evacuate to failover to the 2nd DC setup and once the node 1 comes up i will use cinder failback and live migration from node2 to node1. **i am facing some minor issues in this setup which I will ask once I know this is the right approach to the DC-DC concept. Can you please shed some light on this being the right approach or not and if not then how can i improve it? With regards Swogat pradhan

1 1

[all][tc] Technical Committee next weekly meeting on July 1st at 1500 UTC
by Ghanshyam Mann 01 Jul '21

01 Jul '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for July 1st at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, June 30th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[Swift] Object replication failures on newly upgraded servers
by Mark Kirkwood 01 Jul '21

01 Jul '21

HI, I'm in the process of upgrading a Swift cluster from 2.7/Mitaka to 2.23/Train. While in general it seems to be going well, I'm noticing non-zero object replication failures on the upgraded nodes only, e.g: $ curl http://localhost:6000/recon/replication/object {"replication_last": 1622156911.019487, "replication_stats": {"rsync": 40580, "success": 4141229, "attempted": 2081856, "remove": 4083, "suffix_count": 14960481, "failure": 26550, "hashmatch": 4127197, "failure_nodes": {"10.11.18.67": {"obj08": 2348, "obj09": 60, "obj10": 3030, "obj02": 34, "obj03": 25, "obj01": 44, "obj06": 1498, "obj07": 28, "obj04": 69, "obj05": 36}, "10.11.18.68": {"obj03": 6901, "obj01": 293, "obj06": 1901, "obj04": 10281, "obj10": 1}, "10.12.18.76": {"obj10": 1}}, "suffix_sync": 1785, "suffix_hash": 2778}, "object_replication_last": 1622156911.019487, "replication_time": 1094.7836411476135, "object_replication_time": 1094.7836411476135} Examining the logs (/var/log/swift/object.log and /var/log/syslog) these are not throwing up any red flags (i.e no failing rsyncs noted). Any suggesting about how to get more information about what went wrong e.g: "10.11.18.67": {"obj08": 2348}, how to find what those 2348 errors were? regards Mark P.s: basic sanity checking is ok - uploaded objects go where they should and can be retrieved for 2.7 or 2.23 servers ok (the old and new version servers agree about object placement)

2 4

[Interop] board approved our new process
by Arkady Kanevsky 01 Jul '21

01 Jul '21

Team, I would like to share with you that OIF board had approved our https://opendev.org/osf/interop/src/branch/master/doc/source/process/2021A.… process. That includes that co-chairs of the working group are elected by the group. The Board punted back to WG on how to handle human readable form of guidelines. More on it on Friday. Congratulations to all for making it happen. Thanks, -- Arkady Kanevsky, Ph.D. Phone: 972 707-6456 Corporate Phone: 919 729-5744 ext. 8176456

1 0

[kolla][wallaby] OVS drops RARP packets by QEMU upon live-migration
by Gargano Andrea 30 Jun '21

30 Jun '21

Hello all, we have a new kolla-ansible wallaby installation, during live migration we lose a lot of packages as reported on bug 1815989. Could you please give us some advices to fix it? Thank you. Andrea Gargano

3 6

[tc][all] What should we have as community goals for Y series?( Starting community-wide goals ideas)
by Rico Lin 30 Jun '21

30 Jun '21

Dear all, We're now in R-22 week for Xena cycle which sounds like a perfect time to start calling for community-wide goals ideas for Y-series. According to the goal process schedule [1], we need to find potential goals, and champions before Xena milestone-1 and provide proper discussion in the community right after that to give a clear view and detail on each goal. And if we would like to keep up with the schedule, we should start right away to identify potential goals. So please help to provide ideas for Y series community-wide goals in [2]. Community-wide goals are important in terms of solving and improving a technical area across OpenStack as a whole. It has a lot more benefits to be considered from users as well from a developer's perspective. See [3] for more details about community-wide goals and processes. Also, you can refer to the backlogs of community-wide goals from this[4] and victoria cycle goals[5] (also ussuri[6]). We took cool-down cycle goal step for Xena cycle [7], so no selected goals for Xena. [1] https://governance.openstack.org/tc/goals/#goal-selection-schedule [2] https://etherpad.opendev.org/p/y-series-goals [3] https://governance.openstack.org/tc/goals/index.html [4] https://etherpad.openstack.org/p/community-goals [5] https://etherpad.openstack.org/p/YVR-v-series-goals [6] https://etherpad.openstack.org/p/PVG-u-series-goals [7] https://review.opendev.org/c/openstack/governance/+/770616 *Rico Lin* OIF Board director, OpenStack TC, Multi-arch SIG chair, Heat PTL, Senior Software Engineer@EasyStack

10 13

[TripleO] moving stable/stein and stable/queens to End of Life
by Marios Andreou 30 Jun '21

30 Jun '21

Hello TripleO, I am proposing to move to End of Life for stable/stein and stable/queens branches across all TripleO repos (stein [1] and queens [2]). The proposal was introduced and discussed in recent TripleO irc meetings [3] and there have been no objections so far. The main reason is to allow us to focus our resources on the more active branches, train ussuri victoria wallaby and xena (!). We moved the rocky branch to EOL last cycle with [4] for the same reason. I think this move is well justified as these branches are getting relatively few commits lately (so calling into question the resources we are dedicating to running and maintaining the check, gate and 3rd party periodic/promotion lines). Looking at tripleo-common, python-tripleoclient and tripleo-heat-templates I counted 9 commits to stable/stein and 23 commits to stable/queens since November 2020 (details on those numbers at [5][6]). Please speak up if you have any concerns or questions about the proposal. If there are none then the next step is to post a review against the releases repo to make it official. regards, marios [1] https://releases.openstack.org/teams/tripleo.html#stein [2] https://releases.openstack.org/teams/tripleo.html#queens [3] https://meetings.opendev.org/meetings/tripleo/2021/tripleo.2021-06-08-14.00… [4] https://review.opendev.org/c/openstack/releases/+/774244 [5] https://gist.github.com/marios/b3155fe3b1318cc26bfa4bc15c764a26#gistcomment… [6] https://gist.github.com/marios/b3155fe3b1318cc26bfa4bc15c764a26#gistcomment…

2 2

[release][stable] stale old branches probably should be EOL'd
by Előd Illés 30 Jun '21

30 Jun '21

Hi Release Team, now that stable/ocata is mostly tagged with ocata-eol tag it turned out that there are repositories that did not have any deliverables in ocata (not even a yaml under deliverables/ocata in the release repository). In fact, I've checked and there are several examples from the past where repositories have old stable branches open [1] that should be $series-eol tagged and deleted in my understanding. I think these old stable branches were skipped accidentally during the old EOL processing, so I would suggest to tag these with $series-eol and then delete the old branches. I don't see any reason these branches should be kept open. But let me know if I miss anything! If we stick to the tagging + deletion, then the next question is how to achieve this. There are a couple of options: 1. use the existing tools: such as creating a yaml file under deliverables/$series/ and add the $series-eol tag for the given repositories (I understand that these are not 'real' deliverables, but does that cause any issue for us?) 2. implement some new mechanism, similar to option 1, but clearly indicate that the tagging does not create any deliverables 3. manual tagging + deletion I think the 1st option is the easiest and since we already have the whole process there, we can simply use the existing tool. So what do you think? - Is that OK to tag these open old stable branches with $series-eol tag and then delete them? - If yes, which option from the above list is acceptable, or what else can we do? Thanks for the answers/ideas in advance, Előd [1] http://paste.openstack.org/show/806995/

4 5

Question for Openstack installation!!
by dionysa.varvarigou 30 Jun '21

30 Jun '21

Hello, Is it possible that I could have some guidance for making the Horizon for Wallaby working on ubuntu 20.04? I followed all the steps for its installation and configuration, but I cannot make it to work. The problem is that once I put in my browser my <ip address>/horizon/, it gives me the default apache2 page. So, I tried to find the available site for horizon but I cannot find it by any means. I have triple checked the horizon conf file and I have done everything according to the documentation (https://docs.openstack.org/horizon/wallaby/install/install-ubuntu.html) I tried to google and see if there is any troubleshooting but nothing. I do not know what else to do... So, is it possible that I could get some help??? I hope to hear from you soon.. Have a great day, Dionysia

1 0

[Diversity] Diversity and Inclusion July Meeting Update
by Amy Marrich 30 Jun '21

30 Jun '21

Due to most US companies having July 5th off, we will be moving the Jully D&I WG meeting Please join us Monday, July 19th at 17:00 UTC in the #openinfra-diversity channel on OFTC. The agenda can be found at https://etherpad.openstack.org/p/ diversity-wg-agenda. Thanks, Amy (spotz)

1 0

[cinder] Bug deputy report for week of 2021-30-06
by Sofia Enriquez 30 Jun '21

30 Jun '21

Hello, This is a bug report from 2021-16-06 to 2021-23-06. You're welcome to join the Cinder Bug Meeting today. Weekly on Wednesday at 1500 UTC on #openstack-cinder Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Medium: - https://bugs.launchpad.net/cinder/+bug/1933835 "[storwize svc] In _update_replication_group On failure it should not leave the volume relation in stopped state and RCCG in stopped state". Unassigned Undecided / Invalid - https://bugs.launchpad.net/cinder/+bug/1933443 " Backup deleted but data not deleted". Unassigned Cheers, Sofia Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[cinder] propose Sofia Enriquez for cinder core
by Brian Rosmaita 30 Jun '21

30 Jun '21

Sofia Enriquez (enriquetaso on IRC) has been active the past few cycles submitting patches, doing reviews, and participating in the Cinder weekly meeting, PTGs, and midcycles. She has also been acting as the Cinder Bug Deputy for Xena and has been running the Bug Squad meeting each week. Something I particularly appreciate is that she has included the cinder-tempest-plugin in her range of patches and reviews. Cinder and its various deliverables make up a large code base. Sofia has demonstrated a willingness and capacity to learn about the code, and I anticipate that she will continue to deepen her cinder knowledge as she continues to work in the project. At the same time, I believe that she is self-aware enough to know the limits of her knowledge and can be trusted not to approve patches that she doesn't understand. Above all, she will bring some much needed review bandwidth to the project. In the absence of objections, I'll add Sofia to the core team just before the next Cinder team meeting (Wednesday, 30 June at 1400 UTC). Please communicate any concerns to me before that time. cheers, brian

10 10

[qa] Cancelling Office Hour on July 6th
by Martin Kopec 30 Jun '21

30 Jun '21

Hi everyone, we are cancelling the next Office Hour - July 6th - due to PTOs and public holidays. QA wiki page: https://wiki.openstack.org/wiki/QA#Projects Thanks, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA

1 0

[nova][osc][api-sig] How strict should our clients be?
by Stephen Finucane 30 Jun '21

30 Jun '21

Hey, We have an interesting problem that I wanted to poll opinions on. In OSC 5.5.0, we closed most of the gaps between novaclient and openstackclient. As part of these changes, we introduced validation of a number of requests such as validating enum-style values. For example, [1][2][3]. This validation already occurs on the server side, but by adding it to the client side we prevent users sending invalid requests to the server in the first place and allow users to discover the correct API behaviour from the client rather than having to read the API docs or use trial and error. Now, an issue has been opened against OSC. Apparently someone has been relying on a bug in Nova to pass a different value to the API that what the schema should have allowed, and they are dismayed that the client no longer allows them to do this. They have asked [4][5] that we relax the client-side validation to allow them to continue relying on this bug. As you can probably tell from my comments, this seems to me to be an open and shut case: you shouldn't fork an OpenStack API and you shouldn't side-step validation. However, I wanted to see if anyone disagreed and thought there was merit in loose or no validation of API requests made via our clients. Let me know what you think, Stephen [1] https://github.com/openstack/python-openstackclient/blob/5.5.0/openstackcli… [2] https://github.com/openstack/python-openstackclient/blob/5.5.0/openstackcli… [3] https://github.com/openstack/python-openstackclient/blob/5.5.0/openstackcli… [4] https://storyboard.openstack.org/#!/story/2008975 [5] https://github.com/openstack/python-openstackclient/commit/ab0b1fe885ee0a21…

9 16

[kolla][wallaby] pull error
by Ignazio Cassano 29 Jun '21

29 Jun '21

Hello, I pulled images two weeks ago and now I am trying to pull again but I got the followings error: TASK [common : include_tasks] ************************************************************************************************************************************************************************************* included: /usr/local/share/kolla-ansible/ansible/roles/common/tasks/pull.yml for localhost TASK [common : Pulling common images] ***************************************************************************************************************************************************************************** failed: [localhost] (item={'key': 'fluentd', 'value': {'container_name': 'fluentd', 'group': 'fluentd', 'enabled': True, 'image': 'kolla/ubuntu-source-fluentd:wallaby', 'environment': {'KOLLA_CONFIG_STRATEGY': 'COPY_ALWAYS'}, 'volumes': ['/etc/kolla/fluentd/:/var/lib/kolla/config_files/:ro', '/etc/localtime:/etc/localtime:ro', '/etc/timezone:/etc/timezone:ro', 'kolla_logs:/var/log/kolla/', 'fluentd_data:/var/lib/fluentd/data/'], 'dimensions': {}}}) => {"ansible_loop_var": "item", "changed": true, "item": {"key": "fluentd", "value": {"container_name": "fluentd", "dimensions": {}, "enabled": true, "environment": {"KOLLA_CONFIG_STRATEGY": "COPY_ALWAYS"}, "group": "fluentd", "image": "kolla/ubuntu-source-fluentd:wallaby", "volumes": ["/etc/kolla/fluentd/:/var/lib/kolla/config_files/:ro", "/etc/localtime:/etc/localtime:ro", "/etc/timezone:/etc/timezone:ro", "kolla_logs:/var/log/kolla/", "fluentd_data:/var/lib/fluentd/data/"]}}, "msg": "'Traceback (most recent call last):\\n File \"/tmp/ansible_kolla_docker_payload_w1uzvf82/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 1195, in main\\n File \"/tmp/ansible_kolla_docker_payload_w1uzvf82/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 288, in __init__\\n File \"/usr/local/lib/python3.8/dist-packages/docker/api/client.py\", line 131, in __init__\\n self._auth_configs = auth.load_config(\\nTypeError: load_config() got an unexpected keyword argument \\'config_dict\\'\\n'"} failed: [localhost] (item={'key': 'kolla-toolbox', 'value': {'container_name': 'kolla_toolbox', 'group': 'kolla-toolbox', 'enabled': True, 'image': 'kolla/ubuntu-source-kolla-toolbox:wallaby', 'environment': {'ANSIBLE_NOCOLOR': '1', 'ANSIBLE_LIBRARY': '/usr/share/ansible'}, 'privileged': True, 'volumes': ['/etc/kolla/kolla-toolbox/:/var/lib/kolla/config_files/:ro', '/etc/localtime:/etc/localtime:ro', '/etc/timezone:/etc/timezone:ro', '/dev/:/dev/', '/run/:/run/:shared', 'kolla_logs:/var/log/kolla/', '/run/openvswitch:/run/openvswitch:shared'], 'dimensions': {}}}) => {"ansible_loop_var": "item", "changed": true, "item": {"key": "kolla-toolbox", "value": {"container_name": "kolla_toolbox", "dimensions": {}, "enabled": true, "environment": {"ANSIBLE_LIBRARY": "/usr/share/ansible", "ANSIBLE_NOCOLOR": "1"}, "group": "kolla-toolbox", "image": "kolla/ubuntu-source-kolla-toolbox:wallaby", "privileged": true, "volumes": ["/etc/kolla/kolla-toolbox/:/var/lib/kolla/config_files/:ro", "/etc/localtime:/etc/localtime:ro", "/etc/timezone:/etc/timezone:ro", "/dev/:/dev/", "/run/:/run/:shared", "kolla_logs:/var/log/kolla/", "/run/openvswitch:/run/openvswitch:shared"]}}, "msg": "'Traceback (most recent call last):\\n File \"/tmp/ansible_kolla_docker_payload_u6x9d04r/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 1195, in main\\n File \"/tmp/ansible_kolla_docker_payload_u6x9d04r/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 288, in __init__\\n File \"/usr/local/lib/python3.8/dist-packages/docker/api/client.py\", line 131, in __init__\\n self._auth_configs = auth.load_config(\\nTypeError: load_config() got an unexpected keyword argument \\'config_dict\\'\\n'"} failed: [localhost] (item={'key': 'cron', 'value': {'container_name': 'cron', 'group': 'cron', 'enabled': True, 'image': 'kolla/ubuntu-source-cron:wallaby', 'environment': {'DUMMY_ENVIRONMENT': 'kolla_useless_env'}, 'volumes': ['/etc/kolla/cron/:/var/lib/kolla/config_files/:ro', '/etc/localtime:/etc/localtime:ro', '/etc/timezone:/etc/timezone:ro', 'kolla_logs:/var/log/kolla/'], 'dimensions': {}}}) => {"ansible_loop_var": "item", "changed": true, "item": {"key": "cron", "value": {"container_name": "cron", "dimensions": {}, "enabled": true, "environment": {"DUMMY_ENVIRONMENT": "kolla_useless_env"}, "group": "cron", "image": "kolla/ubuntu-source-cron:wallaby", "volumes": ["/etc/kolla/cron/:/var/lib/kolla/config_files/:ro", "/etc/localtime:/etc/localtime:ro", "/etc/timezone:/etc/timezone:ro", "kolla_logs:/var/log/kolla/"]}}, "msg": "'Traceback (most recent call last):\\n File \"/tmp/ansible_kolla_docker_payload_z0tqur4o/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 1195, in main\\n File \"/tmp/ansible_kolla_docker_payload_z0tqur4o/ansible_kolla_docker_payload.zip/ansible/modules/kolla_docker.py\", line 288, in __init__\\n File \"/usr/local/lib/python3.8/dist-packages/docker/api/client.py\", line 131, in __init__\\n self._auth_configs = auth.load_config(\\nTypeError: load_config() got an unexpected keyword argument \\'config_dict\\'\\n'"} PLAY RECAP ******************************************************************************************************************************************************************************************************** localhost : ok=5 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 Any help, please ? Ignazio

1 1

[masakari] PTL on vacations, next two meetings cancelled
by Radosław Piliszek 29 Jun '21

29 Jun '21

Hello, Propagating this information from today's meeting: The next two Masakari meetings (July 6 and 13) are cancelled because I will be on vacations. Kind regards, -yoctozepto

1 0

[cinder] reminder: this week's meeting in video+IRC
by Brian Rosmaita 29 Jun '21

29 Jun '21

Quick reminder that this week's Cinder team meeting on Wednesday 30 June, being the final meeting of the month, will be held in both videoconference and IRC at the regularly scheduled time of 1400 UTC. These are the video meeting rules we've agreed to: * Everyone will keep IRC open during the meeting. * We'll take notes in IRC to leave a record similar to what we have for our regular IRC meetings. * Some people are more comfortable communicating in written English. So at any point, any attendee may request that the discussion of the current topic be conducted entirely in IRC. * The meeting will be recorded. connection info: https://bluejeans.com/3228528973 meeting agenda: https://etherpad.opendev.org/p/cinder-xena-meetings cheers, brian

1 0

October 2021 PTG Dates & Registration
by Ashlee Ferguson 29 Jun '21

29 Jun '21

Hi everyone, We're happy to announce the next virtual PTG[1] will take place October 18-22, 2021! Registration is now open[2]. The virtual PTG is free to attend, but make sure to register so you recieve important communications like schedules, passwords, and other relevant updates. Next week, keep an eye out for info regarding team sign-ups. Can't wait to see you all there! Ashlee [1] https://www.openstack.org/ptg/ [2] https://openinfra-ptg.eventbrite.com

1 0

[neutron] bug deputy report (Jun 21-27)
by Akihiro Motoki 29 Jun '21

29 Jun '21

Hi team, I was a bug deputy in neutron last week. Sorry for late. Summary ======= The following needs attentions from OVN and DVR folks. - 1 bug on OVN driver related to security group rule deletion needs investigation - 2 DVR-specific bugs need to be triaged by L3 DVR folks I also marked a bug on explicit deletion of a port used by nova as RFE. Needs attentions ================ * [OVN] neutron with ovn returns Conflict on security group rules delete https://bugs.launchpad.net/bugs/1933638 Medium, unassigned, specific to OVN mechanism driver * Untriaged specific to DVR * snat arp entry missing in qrouter namespace https://bugs.launchpad.net/neutron/+bug/1933092 * Unable to update mtu on DVR snat https://bugs.launchpad.net/bugs/1933273 * OSError: Premature eof waiting for privileged process error in Ussuri release of Neutron https://bugs.launchpad.net/neutron/+bug/1933813 Collecting more information from the bug author * Unassigned Gate failure * [Fullstack] TestLegacyL3Agent.test_mtu_update fails sometimes https://bugs.launchpad.net/neutron/+bug/1933234 Bugs with assignees =================== * New with assignees * [OVN] Live migration of network sensitive VMs breaks communication https://bugs.launchpad.net/neutron/+bug/1933517 New, Medium, assigned to ralonsoh * Explicitly provide a DB context when executing a DB transaction https://bugs.launchpad.net/neutron/+bug/1933321 New, Wishlist, this is a tracker for all patches to decorate db transactions * Confirmed/Triaged * Unable to show security groups for non-admin users if custom policies using. https://bugs.launchpad.net/bugs/1933242 Confirmed, High, Assigned to amotoki * missing global_request_id in neutron_lib context from_dict method https://bugs.launchpad.net/bugs/1933802 Low, Confirmed, potential improvement in neutron-lib Context.from_dict() Unassigned but amotoki can take care of it. * In Progress * [OVN] The type of ovn controller is not recognized as a gateway agent https://bugs.launchpad.net/bugs/1933401 * L3 DB FloatingIP callbacks improvements https://bugs.launchpad.net/bugs/1933502 * Stable branches * [stable/train] Backported patch introduced incompatible method calls for py2.7 https://bugs.launchpad.net/bugs/1933366 High, New, assigned to ralonsoh RFEs ==== * locked instance can be rendered broken by deleting port https://bugs.launchpad.net/bugs/1930866 It was filed as a normal bug, but it requires an API change, so I triaged it as RFE. * [RFE] Add distributed datapath for metadata https://bugs.launchpad.net/neutron/+bug/1933222

1 0

Error creating VMs
by open infra 29 Jun '21

29 Jun '21

Hi After setting up OpenStack environment using STX R5 (two controllers, two storage nodes and one worker), I have deployed a VM. VM ended up with ERROR status. I highly appreciate if someone can guide to dig further (what logs to check ) or to fix this issue. http://paste.openstack.org/show/806626/ Regards Danishka

2 14

[openstack-helm] No Meeting Tomorrow
by Gage Hugo 29 Jun '21

29 Jun '21

Hey team, Since there are no agenda items [0] for the IRC meeting tomorrow, the meeting is cancelled. Our next meeting will be July 06th. Thanks [0] https://etherpad.opendev.org/p/openstack-helm-weekly-meeting

1 0

How to get information about the available space in all cinder-volume
by Salman Sheikh 29 Jun '21

29 Jun '21

Dear experts, I have made cinder-volume /dev/sdb on controller as well as compute node, how do i get the information of space available in cinder.

2 2

[cinder] OpenStack lvm and Shared Storage
by pradyumna borge 28 Jun '21

28 Jun '21

Hi, In a mulit-node setup do we need to provide shared storage via Cinder when setting up the second compute node? In a typical mulit-node setup we will have: 1. First node as Controller node acting as a Compute node too. This will have Cinder *lvm*. 2. Second node as Compute node. 1. Will this node have any storage via lvm? If yes then how will the first compute node access storage on the second node? 2. Likewise, how can the VMs on this second node access storage on the first compute node? My other questions are: 1. So if I spawn a VM on the second Compute node, where will the disks of the VM reside? 2. Can I attach attach a disk on the first node to a VM on the second node? 3. Do I have to configure NFS storge as shared storage for Cinder? 4. Does Cinder take care of sharing the disks (I dont think so) 5. What are the steps to setup devstack for multi-node and multi storage (nfs and lvm) ~ shree

3 2

[Ironic] No usptream meeting on July 5th
by Iury Gregory 28 Jun '21

28 Jun '21

Hello Ironicers! During our weekly meeting today we agreed that we will skip the next meeting due to holidays in the US and other countries! -- *Att[]'sIury Gregory Melo Ferreira * *MSc in Computer Science at UFCG* *Part of the ironic-core and puppet-manager-core team in OpenStack* *Software Engineer at Red Hat Czech* *Social*: https://www.linkedin.com/in/iurygregory *E-mail: iurygregory(a)gmail.com <iurygregory(a)gmail.com>*

1 0

[dev][infra][tact-sig] Zuul 4.6.0 and associated job changes
by Jeremy Stanley 28 Jun '21

28 Jun '21

Today at 14:00 UTC the OpenDev Collaboratory upgraded its deployment of Zuul, coinciding with the 4.6.0 security release. This release disabled or changed a number of features which could previously be leveraged to take over executors or obtain decrypted copies of secret data, necessitating adjustments to some jobs. I think we've now addressed the majority of the central job resources which were impacted, but there are almost certainly less-frequently-exercised jobs which are still configured to do things which will no longer work. There were likely some strange-looking failures, particularly in promote and post pipeline builds, between 15:00 and 19:00 UTC today, so if you need something rerun for any reason please do reach out. The two main categories of new bugs which will need fixing are: * Use of Jinja2 templating in secret definitions * Setting ansible_connection, ansible_host, ansible_python_interpreter, ansible_shell_executable, or ansible_user The full release notes can be found in the release announcement here: http://lists.zuul-ci.org/pipermail/zuul-announce/2021-June/000096.html If you run into a new problem in one of your jobs and you believe it may be related to the above or similar fallout from the changes in Zuul 4.6.0 and need assistance, please don't hesitate to contact the TaCT SIG in the #openstack-infra channel on the OFTC IRC network or by replying to this mailing list thread. Apologies for any disruption this update may have caused, and thanks for your understanding. -- Jeremy Stanley

6 9

[kolla][monasca] thresh keeps dying
by Tomasz Rutkowski 28 Jun '21

28 Jun '21

can someone direct me where to search for the cause? as I understand failing to submit the topology to storm cluster shouldn't be final, and the process just dissapers there... + exec /opt/storm/bin/storm jar /monasca-thresh-source/monasca-thresh-stable-victoria/thresh/target/monasca-thresh-2.4.0-SNAPSHOT-shaded.jar -Djava.io.tmpdir=/var/lib/monasca-thresh/data monasca.thresh.ThresholdingEngine /etc/monasca/thresh-config.yml monasca-thresh Running: /usr/lib/jvm/java-8-openjdk-amd64/bin/java -client -Ddaemon.name= -Dstorm.options= -Dstorm.home=/opt/storm -Dstorm.log.dir=/var/log/kolla/storm -Djava.library.path=/usr/local/lib:/opt/local/lib:/usr/lib -Dstorm.conf.file= -cp /opt/storm/*:/opt/storm/lib/*:/opt/storm/extlib/*:/monasca-thresh-source/monasca-thresh-stable-victoria/thresh/target/monasca-thresh-2.4.0-SNAPSHOT-shaded.jar:/opt/storm/conf:/opt/storm/bin -Dstorm.jar=/monasca-thresh-source/monasca-thresh-stable-victoria/thresh/target/monasca-thresh-2.4.0-SNAPSHOT-shaded.jar -Dstorm.dependency.jars= -Dstorm.dependency.artifacts={} -Djava.io.tmpdir=/var/lib/monasca-thresh/data monasca.thresh.ThresholdingEngine /etc/monasca/thresh-config.yml monasca-thresh 687 [main] INFO m.t.ThresholdingEngine - -------- Version Information -------- 692 [main] INFO m.t.ThresholdingEngine - monasca-thresh-2.4.0-SNAPSHOT-2021-06-06T08:32:08-${buildNumber} 693 [main] INFO m.t.ThresholdingEngine - Instantiating ThresholdingEngine with config file: /etc/monasca/thresh-config.yml, topology: monasca-thresh 1000 [main] INFO o.h.v.i.u.Version - HV000001: Hibernate Validator 5.2.1.Final 1197 [main] INFO m.t.ThresholdingEngine - local set to false 1312 [main] INFO m.t.i.t.MetricSpout - Created 1340 [main] INFO m.t.i.t.EventSpout - EventSpout created 1516 [main] WARN o.a.s.u.Utils - STORM-VERSION new 1.2.2 old null 1516 [main] INFO m.t.ThresholdingEngine - submitting topology monasca-thresh to non-local storm cluster 1549 [main] INFO o.a.s.StormSubmitter - Generated ZooKeeper secret payload for MD5-digest: -7012431400424907995:-9108807134284416946 1728 [main] INFO o.a.s.u.NimbusClient - Found leader nimbus : storm1:6627 1751 [main] INFO o.a.s.s.a.AuthUtils - Got AutoCreds [] 1756 [main] INFO o.a.s.u.NimbusClient - Found leader nimbus : storm1:6627 Exception in thread "main" java.lang.RuntimeException: Topology with name `monasca-thresh` already exists on cluster at org.apache.storm.StormSubmitter.submitTopologyAs(StormSubmitter.java:237) at org.apache.storm.StormSubmitter.submitTopology(StormSubmitter.java:387) at org.apache.storm.StormSubmitter.submitTopology(StormSubmitter.java:159) at monasca.thresh.ThresholdingEngine.run(ThresholdingEngine.java:111) at monasca.thresh.ThresholdingEngine.main(ThresholdingEngine.java:82) regards -- Tomasz Rutkowski

2 2

[kolla-ansible] [swift] access denied to various APIs
by Bernd Bausch 28 Jun '21

28 Jun '21

I set up a cloud with the Victoria version of Kolla-Ansible. I enabled Swift and configured Swift as backend for Glance and Cinder-Backup. The Glance backend works, the Cinder-Backup backend doesn't. Furthermore, as a non-admin user I can't do anything with Swift. These two headscratchers that may or may not be related. I seek for help how to troubleshoot this. *Headscratcher 1*: Swift doesn't accept unauthenticated /info API, although expose_info is explicitly set to "true". This is why Cinder-Backup fails; it performs this API when starting up: curl http://192.168.122.253:8080/info {"error": {"code": 401, "title": "Unauthorized", "message": "The request you have made requires authentication."}} When I add a valid token, this works. *Headscratcher 2*: Swift refuses access except for the admin role. I get this when I don't have the admin role: $ source demorc.sh $ swift stat Account HEAD failed: http://192.168.122.253:8080/v1/AUTH_06d5618863294187bf46c611c0ebb4a7 403 Forbidden Failed Transaction ID: tx7e8d958e3c7b410880000-0060d81a25 To add insult to injury, I don't see relevant messages in the centralized Elasticsearch log, and logging does not go to any log files. Any thoughts? Thanks, Bernd

2 1

[wallaby][magnum] magnum-conductor service crash
by Ammad Syed 28 Jun '21

28 Jun '21

Hi, I am using openstack wallaby on ubuntu20.04. My service of magnum-conductor is getting crashed with below error in syslog of ubuntu. Jun 26 22:52:17 orchestration magnum-conductor[173714]: /usr/lib/python3/dist-packages/magnum/drivers/common/driver.py:38: PkgResourcesDeprecationWarning: Parameters to load are deprecated. Call .resolve and .require separately. Jun 26 22:52:17 orchestration magnum-conductor[173714]: yield entry_point, entry_point.load(require=False) Jun 26 22:52:17 orchestration magnum-conductor[173714]: /usr/lib/python3/dist-packages/kubernetes/client/apis/init.py:10: DeprecationWarning: The package kubernetes.client.apis is renamed and deprecated, use kubernetes.client.api instead (please note that the trailing s was removed). Jun 26 22:52:17 orchestration magnum-conductor[173714]: warnings.warn( Jun 26 22:52:17 orchestration magnum-conductor[173714]: /usr/lib/python3/dist-packages/magnum/drivers/common/driver.py:38: PkgResourcesDeprecationWarning: Parameters to load are deprecated. Call .resolve and .require separately. Jun 26 22:52:17 orchestration magnum-conductor[173714]: yield entry_point, entry_point.load(require=False) Jun 26 22:52:17 orchestration magnum-conductor[173714]: Traceback (most recent call last): Jun 26 22:52:17 orchestration magnum-conductor[173714]: File "/usr/lib/python3/dist-packages/eventlet/hubs/hub.py", line 476, in fire_timers Jun 26 22:52:17 orchestration magnum-conductor[173714]: timer() Jun 26 22:52:17 orchestration magnum-conductor[173714]: File "/usr/lib/python3/dist-packages/eventlet/hubs/timer.py", line 59, in call Jun 26 22:52:17 orchestration magnum-conductor[173714]: cb(*args, **kw) Jun 26 22:52:17 orchestration magnum-conductor[173714]: File "/usr/lib/python3/dist-packages/eventlet/semaphore.py", line 152, in _do_acquire Jun 26 22:52:17 orchestration magnum-conductor[173714]: waiter.switch() Jun 26 22:52:17 orchestration magnum-conductor[173714]: greenlet.error: cannot switch to a different thread Any advice how to fix it ? -- Regards, Ammad

1 0

[neutron-vpnaas][kolla-ansible][victoria] Growing memory consumption with only one VPN connection
by Adam Tomas 28 Jun '21

28 Jun '21

Hi, I have problem with neutron vpnaas - after enabling vpnaas plugin everything was ok at first. I was able to create VPN connection and communication is correct. But after a week of running vpnaas (only one VPN connection created/working!) I’ve noticed, that neutron-vpnaas takes more and more memory. I have 5 processes on each controller (there should be always five? Or it is changing dynamically?): 42435 1545384 0.6 8.6 5802516 5712412 ? S Jun15 110:50 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf 42435 1545389 0.6 8.5 5735832 5645856 ? S Jun15 112:16 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf 42435 1545378 0.5 8.5 5734192 5643620 ? S Jun15 108:09 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf 42435 1545372 0.5 8.5 5731128 5641436 ? S Jun15 109:07 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf 42435 1545369 0.6 8.4 5637084 5547392 ? S Jun15 114:21 /var/lib/kolla/venv/bin/python3.8 /var/lib/kolla/venv/bin/neutron-server --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --config-file /etc/neutron/neutron_vpnaas.conf now neutron_server takes over 27G of RAM on each controller: neutron_server running 10.2 27.2G After stopping all neutron containers and starting it again neutron takes a lot less memory: neutron_server running 0.5 583M but memory usage keeps growing (about 5-6 M every minute). What’s wrong? When I disable vpnaas globally there’s no problem with excessive memory usage, so it’s vpnaas for sure… Best regards Adam Tomas

1 0

[kolla] URGENT to cores - DO NOT MERGE patches
by Radosław Piliszek 27 Jun '21

27 Jun '21

Please DO NOT MERGE any changes until issues mentioned in thread [1] are resolved. The reason is that these cause the crucial jobs to never run. I see we have merged one job without proper testing already. [2] You can see only tox testing ran there. [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023291.html [2] https://review.opendev.org/c/openstack/kolla-ansible/+/779204 -yoctozepto

1 1

[cinder] [replication] Error in cinder replication | Openstack Victoria
by Swogat Pradhan 26 Jun '21

26 Jun '21

Hi, I am trying to configure cinder replication with ceph as backend and i followed this URL to configure the cinder replication: https://netapp.io/2016/10/14/cinder-replication-netapp-perfect-cheesecake-r… and http://www.sebastien-han.fr/blog/2017/06/19/OpenStack-Cinder-configure-repl… i created a Volume type - REPL, with replication enabled <is> True and colume backend name parameter. But when i am trying to create a volume using the created volume type the volume is getting created in ceph but in cinder the status is showing error. and when checked log getting the following error: 2021-06-24 17:59:39.556 28472 ERROR cinder.volume.drivers.rbd [req-6e6b901e-f2dd-43a4-a089-6c734b279e17 d576181b6a444541b8ec7f37d750a4c1 a9ac2eba50d84d64ac44b179bbcc9183 - default default] Error creating rbd image volume-361f35c4-a589-4653-b404-fb93d2f598cf.: cinder.exception.ReplicationError: Volume 361f35c4-a589-4653-b404-fb93d2f598cf replication error: Failed to enable image replication I tried to create a volume using volume type- default and then later changed the volume type using command 'cinder retype' to the created volume type and it changed without any issue. I am using openstack victoria . With regards, Swogat Pradhan

4 5

[all][tc] What's happening in Technical Committee: summary 25th June, 21: Reading: 5 min
by Ghanshyam Mann 26 Jun '21

26 Jun '21

Hello Everyone, Here is last week's summary of the Technical Committee activities. 1. What we completed this week: ========================= * Deprecated panko and puppet-panko project[1] 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - https://meetings.opendev.org/meetings/tc/2021/tc.2021-06-24-15.00.log.html * We will have next week's meeting on July 1st, Thursday 15:00 UTC[2]. 3. Activities In progress: ================== TC Tracker for Xena cycle ------------------------------ TC is using the etherpad[3] for Xena cycle working item. We will be checking and updating the status biweekly in the same etherpad. Open Reviews ----------------- * Five open review for ongoing activities[4]. Migration from Freenode to OFTC ----------------------------------------- * Not much progress on project side wiki/doc page which is only thing left for this migration. * All the required work for this migration is tracked in this etherpad[5] 'Y' release naming process ------------------------------- * Y release naming election is closed now. As a last step, the foundation is doing trademark checks on elected ranking. Deprecate OpenStack-Ansible nspawn repositories ------------------------------------------------------------ * OpenStack-Ansible nspawn repositories is in process of retirement[6] Test support for TLS default: ---------------------------------- * Rico has started a separate email thread over testing with tls-proxy enabled[7], we encourage projects to participate in that testing and help to enable the tls-proxy in gate testing. Retiring governance's in-active repos ------------------------------------------- * The Technical Committee retiring the governance's in-active repos which are not required in current structure[8]. Adding Ceph Dashboard charm to OpenStack charms --------------------------------------------------------------- * Proposal to add Ceph Dashboard charm to OpenStack charms[9] Other Changes ------------------ * Charter change to handle the vacant seat situation[10] * Add DPL model also in 'Appointing leaders' section[11] 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[12]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [13] 3. Office hours: The Technical Committee offers a weekly office hour every Tuesday at 0100 UTC [14] 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://review.opendev.org/c/openstack/governance/+/796408 [2] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [3] https://etherpad.opendev.org/p/tc-xena-tracker [4] https://review.opendev.org/q/project:openstack/governance+status:open [5] https://etherpad.opendev.org/p/openstack-irc-migration-to-oftc [7] https://review.opendev.org/c/openstack/governance/+/797731 [7] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023000.html [8] https://etherpad.opendev.org/p/governance-repos-cleanup [9] https://review.opendev.org/c/openstack/governance/+/797913 [10] https://review.opendev.org/c/openstack/governance/+/797912 [11] https://review.opendev.org/c/openstack/governance/+/797985 [12] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [13] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [14] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

[tc][all][goal] Migrate RBAC Policy Format from JSON to YAML: COMPLETED
by Ghanshyam Mann 25 Jun '21

25 Jun '21

Hello Everyone, I am happy to update that we have completed the community wide goal for "Migrate RBAC Policy Format from JSON to YAML". - https://governance.openstack.org/tc/goals/selected/wallaby/migrate-policy-f… Thanks to all the projects/contributors involved in this work. Completion Report: =============== * Projects completed: 33 * Projects do not need any changes: 16 * project left: 0 * This is the complete work we did for this goal: ** Gerrit Topic: https://review.opendev.org/q/topic:%22policy-json-to-yaml%22+(status:open%2… ** Tracking Etherpad: https://etherpad.opendev.org/p/migrate-policy-format-from-json-to-yaml -gmann

1 0

[nova][os-vif][stable] Adding os-vif-core to os-vif stable branches
by Stephen Finucane 25 Jun '21

25 Jun '21

Happy Friday, Per $subject, I'd like to propose that we add os-vif-core to the list of teams with +2 rights on os-vif stable branches. Currently this list is restricted to "Project Bootstrappers", nova-stable-maint and stable-maint-core. os-vif doesn't see many backports, but it is a rather specialist library that requires some domain-specific knowledge to grok and the existing stable reviewers typically insist on reviews from core reviewers before approving changes. By making this change, we can avoid this little dance. We have discussed this already on #openstack-nova, but if there are any concerns, please raise them now. If not, I'll seek to have the relevant changes merged to openstack/project-config by the end of next week. I'll post these changes shortly. Cheers, Stephen [1] https://meetings.opendev.org/irclogs/%23openstack-nova/%23openstack-nova.20…

3 3

[cinder] upcoming driver deadlines
by Brian Rosmaita 25 Jun '21

25 Jun '21

This is a reminder that the cinder New Driver Merge Deadline is Thursday 15 July 2021 [0]. Please make sure *right now* that you've filed a Launchpad blueprint for your driver and that your blueprint shows up in this list: https://blueprints.launchpad.net/cinder/xena (if it doesn't, contact me off list) If you're adding a new feature to a driver, you should also file a Lanuchpad blueprint (it helps us prioritize reviews). See the Xena release schedule for more info about the Cinder Driver Features Declaration [1]. New features for current drivers follow the regular Feature Freeze policy (that is, must be merged by Milestone 3). cheers, brian [0] https://releases.openstack.org/xena/schedule.html#x-cinder-driver-deadline [1] https://releases.openstack.org/xena/schedule.html#x-cinder-driver-features-…

1 0

[dev][nova] PCI IRQ Affinity for VMS with dedicated CPUs
by Soares Sarto, Ricardo 25 Jun '21

25 Jun '21

Hello Everyone, Does NOVA provide any intelligent affining of IRQs of PCI Devices to CPUs pinned to VMs? i.e. for VMs that have pci-passthrough interfaces to PCI devices and are using ‘dedicated’ CPU policy, does NOVA automatically affine the IRQs for those PCI devices the CPUs that are allocated to the VM? Furthermore, is there any flavor extraspec that can further scope the IRQ affinity of the PCI Devices to a subset of the VM’s dedicated cpus? If not, is this a new capability that the NOVA team would be open to? -rsoaress

2 1

[neutron] can floating IP port forwarding work when agent_mode is dvr or dvr_snat but on compute node?
by Yi Yang (杨燚)-云服务集团 25 Jun '21

25 Jun '21

Hi, folks I’m working on https://bugs.launchpad.net/neutron/+bug/1931953, per my check for neutron-specs/specs/rocky/port-forwarding.rst, it seems port forwarding function only can be done on network node, so I don’t think we need to do it on compute node, can anybody help confirm this? Per my understanding, if a FIP is set port forwarding to two VMS across two compute node, physical switch has no way to know which compute node it should send to if destination IP is this FIP, right? But on centralized mode, this isn’t an issue.

2 2

[ironic] Ansible deploy_interface error output
by Ivan Iotchenko 25 Jun '21

25 Jun '21

Hello We are using Ironic (Train) and Ansible deploy interface. Everything works just awesome and we were able to include all the things we need into deployment/undeployment process (with respect to flexibility provided by Ansible). However, there is an issue. If you have failures during the process - you will be presented with full Ansible output which can be large enough (and thus cut). Almost every failure requires you to review log files (Ironic/Ansible). This is fine if deployment is being done by Ironic admin or person who have required experience. For other users it can be a blocker. Usually you just cannot determine root cause from the error message in last_failure field, which you can get both from console or UI. Error output was pretty straightforward with direct deploy interface. Is there a way to made Ansible error output better? E.g. to make it short and descriptive (“DNS registration failed bla-bla-bla”) Thanks, Ivan

1 0

Regarding Bind server in ubuntu
by Adivya Singh 24 Jun '21

24 Jun '21

hi Team, I am facing one issue in Bind Server installation in ubuntu, I am not able to resolve the reserve DNS names , I am suspecting there is a issue in SOA , when i am doing dig from the public IP to the private subnet IP, it does not return anything like dig -x <Floating IP><private IP> regards Adivya Singh

2 1

[kolla] Wallaby releases available
by Mark Goddard 24 Jun '21

24 Jun '21

Hi, I'm pleased to announce the availability of the first Wallaby releases for all Kolla deliverables: * kolla 12.0.0 (https://docs.openstack.org/releasenotes/kolla/wallaby.html#relnotes-12-0-0-…) * kolla-ansible 12.0.0 (https://docs.openstack.org/releasenotes/kolla-ansible/wallaby.html#relnotes…) * kayobe 10.0.0 (https://docs.openstack.org/releasenotes/kayobe/wallaby.html#relnotes-10-0-0…) A lot of hard work was involved in these releases which add support for two new OS versions: CentOS Stream and Debian Bullseye. Many thanks to everyone who contributed to these releases. And now onto Xena! Thanks, Mark

1 0

[nova] SCS standardized flavor naming
by Dmitriy Rabotyagov 24 Jun '21

24 Jun '21

Hi! > The point is, a new customer will *not* spend time reading the spec. > Typically, they will want to just fire-up a VM quickly without reading > too much docs... While I find Thomases flavor naming also not really intuitive for customers - out of nvt4-a8-ram24-disk50-perf2 I could guess only disk size and amout of ram (is it in gygabytes?) but "SCS-16T:64:200s-GNa:64-ib" doesn't make any sense to me at all (if I haven't read [1] ofc). I totally agree that no user in Public cloud would read any spec before launching their VM and it would be super hard to force them to do so. So flavor naming should be as explicit and readable as possible and assuming that person who will use cloud has no idea about specs we're making. These specs should be designed for cloud providers to comply and have same standards so users feel comfortable and secure, but don't assume regular users to have special skills in reading what engineers come up to. If regular users would find this hard to use, companies might choose hapiness of customers over some compliance. As nova doesn't have any text description for flavors, so flavor name is everything we have to expose to the customers and it should be clean and readable from the first sight. > nvt4-a8-ram24-disk50-perf2 > > This means: > - nvt4: nvidia T4 GPU > - a8: AMD VCPU 8 (we also have i4 for example, for Intel) > - ram24: 24 GB of RAM > - disk50: 50 GB of local system disk > - perf2: level 2 of IOps / IO bandwidth So what I'd suggest to cover that usecase would be smth like: 8vCPU-24576RAM-50SSD-pGPU:T4-10kIOPS-EPYC4 > SCS-8C:32:2x200S-bms-i2-GNa:64-ib > [4] In case you wonder: 8 dedicated cores, 32GiB RAM, 2x200GB SSD disks > on bare metal sys, intel Cascade Lake, nVidia GPU with 64 Ampere SMs > and InfiniBand. Would be probably smth like: 8pCPU-32768RAM-2x200SSD-2vGPU:A100-IB-Cascade [1] https://github.com/SovereignCloudStack/Operational-Docs/blob/main/flavor-na… -- Kind Regards, Dmitriy Rabotyagov

3 3

[all][tc] Technical Committee next weekly meeting on June 24th at 1500 UTC
by Ghanshyam Mann 24 Jun '21

24 Jun '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for June 24th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, June 23rd, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[nova][libvirt][cinder] Volume-based live migration and multi-attach
by Mariusz Karpiarz 24 Jun '21

24 Jun '21

Hi all, For live migration of volume-based instances (a Cinder volume used for the main OS disk) to work does the Cinder backend need to support multi-attach or at any point of the migration process are there multiple processes accessing the same volume?

2 1

[neutron] OVS tunnels and VLAN provider networks on the same interface
by Krzysztof Klimonda 24 Jun '21

24 Jun '21

Hi All, What is the best practice for sharing same interface between OVS tunnels and VLAN-based provider networks? For provider networks to work, I must "bind" entire interface to vswitchd, so that it can handle vlan bits, but this leaves me with a question of how to plug ovs tunnel interface (and os internal used for control<->compute communication, if shared). I have two ideas: 1) I can bind entire interface to ovs-vswitchd (in ip link output it's marked with "master ovs-system") and create vlan interfaces on top of that interface *in the system*. This seems to be working correctly in my lab tests. 2) I can create internal ports in vswitchd and plug them into ovs bridge - this will make the interface show up in the system, and I can configure it afterwards. In this setup I'm concerned with how packets from VMs to other computes will flow through the system - will they leave openvswitch to host system just to go back again to be sent through a tunnel? I've tried looking for some documentation regarding that, but came up empty - are there some links I could look at to get a better understanding of packet flow and best practices? Best Regards, -- Krzysztof Klimonda kklimonda(a)syntaxhighlighted.com

5 9

[keystone] "identity_provider failed validation" getting scoped token, on Rocky/Python3
by Marek Szuba 24 Jun '21

24 Jun '21

Dear everyone, I run a small OpenStack cloud on Debian Buster, using standard distro packages - i.e. Rocky. My Keystone is configured as a federated-identity Service Provider, with the IdP accessed using OpenID. Having got things working successfully using local users I went on to testing federation - and found out that using the OpenStack CLI to get a scoped token from an unscoped one reports a server error 500, and logging in to Horizon shows usage and event data couldn't be retrieved. On the server side, in both cases Keystone log shows the following: INFO keystone.common.wsgi [req-foo bar baz - Federated default] POST https://osc.example.com:5000/v3/auth/tokens ERROR keystone.common.wsgi [req-foo bar baz - Federated default] identity_provider failed validation: <function FederatedCredential.<lambda> at 0xdeadbeef>: ValueError: identity_provider failed validation: <function FederatedCredential.<lambda> at 0xdeadbeef> ERROR keystone.common.wsgi Traceback (most recent call last): ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/common/wsgi.py", line 148, in __call__ ERROR keystone.common.wsgi result = method(req, **params) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/auth/controllers.py", line 67, in authenticate_for_token ERROR keystone.common.wsgi self.authenticate(request, auth_info, auth_context) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/auth/controllers.py", line 236, in authenticate ERROR keystone.common.wsgi auth_info.get_method_data(method_name)) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/auth/plugins/token.py", line 46, in authenticate ERROR keystone.common.wsgi PROVIDERS.identity_api ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 101, in handle_scoped_token ERROR keystone.common.wsgi send_notification(taxonomy.OUTCOME_SUCCESS) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/keystone/notifications.py", line 685, in send_saml_audit_notification ERROR keystone.common.wsgi user=user_id, groups=group_ids) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/pycadf/credential.py", line 84, in __init__ ERROR keystone.common.wsgi setattr(self, FED_CRED_KEYNAME_IDENTITY_PROVIDER, identity_provider) ERROR keystone.common.wsgi File "/usr/lib/python3/dist-packages/pycadf/cadftype.py", line 66, in __set__ ERROR keystone.common.wsgi (self.name, self.func)) ERROR keystone.common.wsgi ValueError: identity_provider failed validation: <function FederatedCredential.<lambda> at 0xdeadbeef> i.e. the request has succeeded but then things fall over when an audit notification is to be sent. Having poked around the sources of keystone.notifications.send_saml_audit_notifications() and the code it references, I found out the following: - the lambda function which triggers the error checks if 'identity_provider' is a six string type; - when this error occurs the value of 'identity_provider' is indeed the name of my IdP - but as *bytes* rather than str! - this doesn't happen every time this IdP name is used - if I add a simple identity_provider = identity_provider.decode('utf-8') to the relevant function I start getting errors suggesting that under some circumstances, 'identity_provider' is str as it should be. All in all, it seems like this particular bit of Keystone code in Rocky does not properly support Python3. Unfortunately an upgrade to a newer OpenStack version is non-trivial for me for several reasons, only some of which are under my control - and the stop-gap measure of having patched the relevant function with "if identity_provider is bytes, decode it to str" means I've had to put the relevant Debian package on hold, thus blocking potential updates. Therefore, I look forward to hearing from you any and all ideas which might help address this problem in less radical fashion. Thank you in advance! -- MS

1 0

Regarding dhcp not forwarding the IP in openstack
by Adivya Singh 24 Jun '21

24 Jun '21

Hi Team, I have a issue where, the dhcp are not forwarding the IP for some reason, and the dhcp are not responding properly in a hypervisor I can see that, all the interfaces are up tap devices are ip, can u please suggest what should we do to resolve the issue Regards Adivya Singh

2 1

[all][tripleo][validations] Communication from the Validations Framework team! o/
by Gaël Chamoulaud 24 Jun '21

24 Jun '21

Greetings everyone! For those who do not know about the Validations Framework yet: The Validations Framework is at the same time, A collection of Ansible roles and playbooks to detect and report potential issues during a TripleO deployment and A Python library to manipulate them through a Command Line Interface. * Validations are used to efficiently and reliably verify various facts about the cloud (or any other products) on the level of individual nodes and hosts. * Validations are non-intrusive by design, and recommended when performing large scale changes to the cloud, for example upgrades, or to aid in the diagnosis of various issues. Historically, this project was created during the Newton cycle for a direct use with OpenStack/TripleO and became the Validations Framework since Stein. We strongly feel and think that this project can be beneficial to other environments, projects or products... If you read this line it's probably because you are still interested, so if you want to talk with us about the Validations Framework, how to create a new validation for your product and/or integrate our CLI in your workflow, please feel free to reach us on this mailing list or come join us on IRC: * IRC channel #validation-framework at Libera (For all subject-matters) * IRC channel #tripleo at OFTC (OpenStack and TripleO discussions) We are looking forward seeing you around! [1] - https://opendev.org/openstack/tripleo-validations [2] - https://docs.openstack.org/tripleo-validations/latest/ [3] - https://opendev.org/openstack/validations-libs [4] - https://docs.openstack.org/validations-libs/latest/ [5] - https://opendev.org/openstack/validations-common [6] - https://docs.openstack.org/validations-common/latest/ Best Regards, Cédric Jeanneret, David J. Peacock, Jan Buchta, Jiri Podivin, Mathieu Bultel, and I! -- Gaël Chamoulaud - (He/Him/His)

1 0

[neutron] Drivers meeting 25.06.2021 cancelled
by Slawek Kaplonski 24 Jun '21

24 Jun '21

Hi, I will be on PTO tomorrow thus I will not be able to chair the meeting. Let's cancel it this week and see You again next Friday. -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[cinder] status of some unapproved Xena specs
by Brian Rosmaita 24 Jun '21

24 Jun '21

As attentive members of the OpenStack community know, Friday 25 June is the Xena spec freeze for cinder [0]. There are four specs that have been discussed on and off at PTGs and midcycle meetings that don't appear ready for approval in Xena. The discussion of these specs at today's cinder meeting is here: https://meetings.opendev.org/meetings/cinder/2021/cinder.2021-06-23-14.00.l… The specs I'm talking about are these: 1. Support revert any snapshot https://review.opendev.org/c/openstack/cinder-specs/+/736111 discussion: https://wiki.openstack.org/wiki/CinderXenaMidCycleSummary#Support_revert_an… 2. Migration support for a volume with replication status enabled https://review.opendev.org/c/openstack/cinder-specs/+/766130 discussion: https://wiki.openstack.org/wiki/CinderXenaMidCycleSummary#Migration_support… 3. Update original volume az https://review.opendev.org/c/openstack/cinder-specs/+/778437 discussion: https://wiki.openstack.org/wiki/CinderXenaMidCycleSummary#Migration_support… 4. Allow volumes to be part of multiple volume groups https://review.opendev.org/c/openstack/cinder-specs/+/792722 I think this spec isn't getting much attention because it has a -1 from Zuul, and the last few sections still contain the boilerplate language from the spec template, which makes it look like the spec is still in progress. When these have come up for discussion at previous meetings, there is general support among the cinder team, though there are details that we feel need to be worked out on the specs. These details have been noted on the Gerrit reviews and in the previous PTG and midcycle discussion summaries. While some points have been addressed, other important points have not. This makes me think that there is a communication problem between the team and the spec proposers. I encourage people proposing specs that are having problems in review to put their spec on the weekly cinder meeting agenda [1] so that we can discuss them interactively and hopefully explain more clearly what issues the cinder team has with the specs as currently proposed. If attending the weekly cinder meeting (1400 UTC on Wednesdays) is difficult because of time zone issues, please let me know and we can figure something out (maybe an occasional spec review meeting held at some time other than 1400 UTC). Or maybe there's an alternative communication medium we haven't explored yet. The cinder team encourages community participation in cinder development, and it distresses us to see these specs languishing. cheers, brian [0] https://releases.openstack.org/xena/schedule.html#x-cinder-spec-freeze [1] https://etherpad.opendev.org/p/cinder-xena-meetings

1 0

[largescale-sig] Next meeting: June 23, 15utc on #openstack-operators
by Thierry Carrez 23 Jun '21

23 Jun '21

Hi everyone, Our next Large Scale SIG meeting will be this Wednesday in #openstack-operators on OFTC IRC, at 15UTC. Please note the new channel to be used! You can doublecheck how that time translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20210623T15 A number of topics have already been added to the agenda, including discussing our next OpenInfra.Live show. Feel free to add other topics to our agenda at: https://etherpad.openstack.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

1 1

[TC] Open Infra Live- Open Source Governance
by Kendall Nelson 23 Jun '21

23 Jun '21

Hello TC Folks :) So I have been tasked with helping to collect a couple volunteers for our July 29th episode of Open Infra Live (at 14:00 UTC) on open source governance. I am also working on getting a couple members from the k8s steering committee to join us that day. If you are interested in participating, please let me know! I only need like two volunteers, but if we have more people than that dying to join in, I am sure we can work it out. Thanks! -Kendall Nelson (diablo_rojo)

4 5

[cinder] CI coverage for SPDK
by Balazs Gibizer 23 Jun '21

23 Jun '21

Hi Cinder Team, I'm wondering what CI coverage cinder has for SPDK driver. The code mentions that Mellanox CI[1] but I'm not able to find a run from that CI in the recent cinder patches. Is this driver still covered somewhere? Cheers, gibi [1] https://github.com/openstack/cinder/blob/393c2e4ad90c05ebf28cc3a2c65811d7e1…

3 3

[cinder] Bug deputy report for week of 2021-23-06
by Sofia Enriquez 23 Jun '21

23 Jun '21

Hello, This is a bug report from 2021-16-06 to 2021-23-06. You're welcome to join the Cinder Bug Meeting today. Weekly on Wednesday at 1500 UTC on #openstack-cinder Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- High: - CI features discussed last week: - https://bugs.launchpad.net/cinder/+bug/1932188 "lvm commands crash, causing failure" Assigned to Sofia Enriquez and Eric Harney - https://bugs.launchpad.net/os-brick/+bug/1929223 "scaleio connector disables HTTPS certificate validation". Unassigned Medium: - https://bugs.launchpad.net/cinder/+bug/1932964 "SolidFire duplicate volume name exception on migration and replication". Assigned to Fábio Oliveira Low: - https://bugs.launchpad.net/cinder/+bug/1933265 "cinder-backup ceph snapshot delete". Unassigned Wishlist: - https://bugs.launchpad.net/cinder/+bug/1933052 "cinder_internal_tenant_* is not predictable". Unassigned Cheers, Sofia -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[Kolla][nova] /var/lib/nova/instances on nfs
by Ignazio Cassano 23 Jun '21

23 Jun '21

Hello Stackers, is there any configuration parameter in kolla for sharing nova on nfs between compute nodes ? Or I must insert an entry in fstab ? Thanks Ignazio

3 5

[cinder] topics for wednesday's cinder meeting
by Brian Rosmaita 22 Jun '21

22 Jun '21

Hello Cinder Team, There are two topics on the agenda for tomorrow that you may want to look at in advance. First, the specs deadline is Friday, so everyone should be looking at specs: https://review.opendev.org/q/project:openstack%252Fcinder-specs+status:open Second, Simon put a discussion of allowing `black` to be used as an auto-linter on the agenda. The question is whether this should be allowed as an optional tool for developers. There is an example patch posted: https://review.opendev.org/c/openstack/cinder/+/792462 and here is some general info about black: https://black.readthedocs.io/en/stable/the_black_code_style/current_style.h… The choice of a linter can be quite contentious, so the discussion will be timeboxed so that we'll have sufficient time to talk about specs. So I thought I'd sent out notice in advance so that we'll be able to make good use of meeting time. cheers, brian

1 0

[glance] nominating Cyril Roelandt for glance core
by Abhishek Kekane 22 Jun '21

22 Jun '21

Hi All, I am nominating Cyril Roelandt (cyril-roelandt LP and Steap on IRC) to be a Glance core. Cyril has been around the Glance community for a long time and is familiar with the architecture and design patterns used in Glance and its related projects. He's contributed code, triaged bugs, provided bug fixes, and did quality reviews for Glance. He is also helping me in reducing our bug backlogs. Considering the current situation with the project, however, it would be an enormous help to have someone as knowledgeable about Glance as Cyril to have +2 abilities. I discussed this with cyril, he's agreed to be a core reviewer. In any case, I'd like to put Cyril to work as soon as possible! So please reply to this message with comments or concerns before 23:59 UTC on Monday 21 June. I'd like to confirm Cyril as a core on Tuesday 22 June. Thanks and Regards, Abhishek

6 6

[Wallaby][kolla][masakari] hacluser issues
by Ignazio Cassano 22 Jun '21

22 Jun '21

Hello everyone, I wonder if this is a good place for discussing about some issues I am facing with instance HA with masakari hacluster kolla wallaby. Thanks Ignazio

2 8

[ops][victoria][nova] Add hardware to guest (was: [ops][nova][spice][victoria] Switch from VNC to SPICE)
by DHilsbos＠performair.com 22 Jun '21

22 Jun '21

Just realized that I sent this to Sean, but not the list... Sean; Thank you for that pointer to hw_video_model=virtio, that addressed the resolution issue! Any chance you could point me at a metadata option that would tell libvirt to provide 2 monitor devices? It looks like I need to send the max_outputs=2 to qemu, or libvirt or directly to virtio-vga (I'm not sure which) [1], though I don't see a way to pass that through in nova.virt.libvirt.driver [2]. As to how GoToMyPC works... I don't know, but I believe it captures the framebuffer. [1] https://www.kraxel.org/blog/2019/09/display-devices-in-qemu/ [2] https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py Thank you, Dominic L. Hilsbos, MBA Vice President – Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com -----Original Message----- From: Sean Mooney [mailto:smooney@redhat.com] Sent: Monday, June 21, 2021 4:57 AM To: Dominic Hilsbos; laurentfdumont(a)gmail.com; openstack-discuss(a)lists.openstack.org Subject: Re: [ops][nova][spice][victoria] Switch from VNC to SPICE On Fri, 2021-06-18 at 20:44 +0000, DHilsbos(a)performair.com wrote: > We're trying to virtualize desktops for remote workers. Guests will > be Windows. Remote connection method will be GoToMyPC. As such, I > need the OS to believe either 1) it has 2 1920 x 1080 monitors, or 2) > it has a single 3840 x 1080 monitor. Neither of which have I found a > way to do in VNC. i am not sure the resoltution that rdp or whatever GoToMyPC uses will be affected by the use of vnc or spcice on the host. I think this is related to the video model used in the guets unless GoToMyPC is running on the host and connecting the the qemu process. thats not normally something we would recommend but if its directly conecting to the qemu process then the use of vnc or spice might be a factor have you tried changing the video model to virtio for example, that should enabel more resolutions in the guest. i know that usign RDP in a windows guest with hw_video_model=virtio in the image does allow higher resolutions and i think it enables multi monitor support too. > > Thank you, > > Dominic L. Hilsbos, MBA > Vice President – Information Technology > Perform Air International Inc. > DHilsbos(a)PerformAir.com > www.PerformAir.com > > From: Laurent Dumont [mailto:laurentfdumont@gmail.com] > Sent: Friday, June 18, 2021 12:39 PM > To: Dominic Hilsbos > Cc: stephenfin(a)redhat.com; openstack-discuss > Subject: Re: [ops][nova][spice][victoria] Switch from VNC to SPICE > > Are you using the Openstack console itself? You might have more > flexibility with a dedicated VNC server inside the VM and connect > directly to it. So you would not be tied to the Openstack VNC support > which I dont think was ever designed for graphical usage. More of a > "it's 2AM, server is crashed and I need a way in!". > > On Fri, Jun 18, 2021 at 1:58 PM <DHilsbos(a)performair.com> wrote: > Stephen; > > Thank you for the information. > > What's the replacement? Is VNC getting improvements to allow higher > resolutions, and multi-monitor, in the guest? > > We've already decided to transition our OpenStack cluster away from > CentOS, as RDO doesn't package some of the OpenStack projects we'd > like to use, and RedHat has lost our trust. > > Thank you, > > Dominic L. Hilsbos, MBA > Vice President – Information Technology > Perform Air International Inc. > DHilsbos(a)PerformAir.com > www.PerformAir.com > > > -----Original Message----- > From: Stephen Finucane [mailto:stephenfin@redhat.com] > Sent: Friday, June 18, 2021 10:33 AM > To: Dominic Hilsbos; openstack-discuss(a)lists.openstack.org > Subject: Re: [ops][nova][spice][victoria] Switch from VNC to SPICE > > On Fri, 2021-06-18 at 16:53 +0000, DHilsbos(a)performair.com wrote: > > All; > > > > We have a Victoria cluster, and I'd like to switch from VNC to > > SPICE. Cluster is installed with packages (RDO), and configured > > manually. > > > > I have located > > https://docs.openstack.org/nova/victoria/admin/remote-console-access.html > > , but this doesn't tell me which services need to be installed on > > which servers. > > > > Looking at packages, I'm fairly certain nova-spicehtml5proxy > > (openstack-nova-spicehtml5proxy on CentOS 8) needs to be installed > > where the nova-novncproxy is currently. > > > > I also suspect that qemu-kvm-ui-spice needs to be installed on the > > nova-compute nodes. Is spice-server needed on the nova-compute > > nodes? > > Not an answer, but I'd be very careful about building solutions based > on SPICE. > It has been deprecated in RHEL 8.3 and recent versions of Fedora and > is slated > for removal in RHEL 9, as this bug [1] points out. It is also > receives very > little attention in nova as some deployments tooling (such as Red Hat > OSP) has > not supported it for some time. There's a non-zero chance support for > this > console type will be dropped entirely in some future release. > > Stephen > > [1] https://bugzilla.redhat.com/show_bug.cgi?id=1946938 > > > Thank you, > > > > Dominic L. Hilsbos, MBA > > Vice President - Information Technology > > Perform Air International Inc. > > DHilsbos(a)PerformAir.com > > www.PerformAir.com > > > > > > > >

2 2

Reply to: [lists.openstack.org代发][Wallaby][kolla][masakari] hacluser issues
by Sam Su (苏正伟) 22 Jun '21

22 Jun '21

Hi, Ignazio You can discuss about instance HA issue with others on the channel ‘openstack-masakari’in OFTC. They will have a weekly meeting this Tuesday, 4:00-5:00 UTC on the IRC channel. Welcomed. 发件人: Ignazio Cassano [mailto:ignaziocassano@gmail.com] 发送时间: 2021年6月22日 3:06 收件人: openstack-discuss <openstack-discuss(a)lists.openstack.org> 主题: [lists.openstack.org代发][Wallaby][kolla][masakari] hacluser issues Hello everyone, I wonder if this is a good place for discussing about some issues I am facing with instance HA with masakari hacluster kolla wallaby. Thanks Ignazio

3 2

[openstack-helm] No meeting tomorrow
by Gage Hugo 22 Jun '21

22 Jun '21

Hey team, Since there are no agenda items [0] for the IRC meeting tomorrow, the meeting is cancelled. Our next meeting will be June 29th. Thanks [0] https://etherpad.opendev.org/p/openstack-helm-weekly-meeting

1 0

cyborg-tempest-plugin test failed due to the zuul server has no accelerators
by Alex Song (宋文平) 22 Jun '21

22 Jun '21

Hello Everyone, Is the Zuul server env changed recently? There are no accelerators and our cyborg-tempest-plugin test failed. Please help. Thanks. Best Regards.

4 5

[cinder] Stepping down from cinder core
by Lucio Seki 21 Jun '21

21 Jun '21

Hi, I've been totally absent from the community in the last cycle, and unfortunately I'm not able to review Cinder patches in the next few cycles either. For this reason, I'm stepping down from the core team. Thank you all for the patience and attention to teach me so many things. It was a great opportunity for me to learn and grow professionally and personally. Hopefully sometime in the future I'll come back to the community again. Kind regards and stay safe, Lucio Seki

3 2

[interop] Preping up for June Board meeting
by Arkady Kanevsky 21 Jun '21

21 Jun '21

Team, as I prepare for the June OIF board meeting we need to do 3 things: 1. Need review and land https://review.opendev.org/c/osf/interop/+/796312 to remove requirement that one of Interop WG co-chair is from the board and nominated by the board. 2. Need to review and land https://review.opendev.org/c/osf/interop/+/784622 that has been discussed several times and is needed to match https://opendev.org/osf/interop/src/branch/master/doc/source/process/2021A.… . 3. Final comments on presentation slides for the board - https://docs.google.com/presentation/d/1-9H1cTXZxW0vCSTzfBe0aMKbd7nggd8SOHQ… We need to complete it by Monday June 21 so I can send it to the board 1 week before the meeting. Thanks, -- Arkady Kanevsky, Ph.D. Phone: 972 707-6456 Corporate Phone: 919 729-5744 ext. 8176456

3 4

[neutron] Bug deputy report for week of June 14th
by Lajos Katona 21 Jun '21

21 Jun '21

Hi, I was last week's bug deputy for Neutron, Below is a short summary of last week's bugs: Critical --------- - https://bugs.launchpad.net/neutron/+bug/1932093 - "oslo_config.cfg.DuplicateOptError: duplicate option: host" using OVN Octavia provider on stable/train - https://review.opendev.org/c/openstack/networking-ovn/+/796517 - - https://bugs.launchpad.net/neutron/+bug/1932483 - CI neutron.tests.functional.services.l3_router.test_l3_dvr get failed frequently - *Unassigned* High ------- - https://bugs.launchpad.net/neutron/+bug/1932421 - ovn-neutron-db-sync deletes legitimate metadata ports - https://review.opendev.org/q/I78673b6a85f1c872e70026da82124d1ba2326562 - https://bugs.launchpad.net/neutron/+bug/1933026 - stack.sh fail with ovs_source: No such file or directory - CI of some project fails with: "/opt/stack/neutron/devstack/plugin.sh: line 23: /opt/stack/devstack/lib/neutron_plugins/ovs_source: No such file or directory" after https://review.opendev.org/c/openstack/neutron/+/793470 is merged. - *Unassigned* Medium ----------- - Low ------ - https://bugs.launchpad.net/neutron/+bug/1932016 - Quality of Service (QoS) in Neutron, error in permissions - Doc fix: https://review.opendev.org/c/openstack/neutron/+/796457 - https://bugs.launchpad.net/neutron/+bug/1932373 - DB migration is interrupted and next execution will fail - Upgrade from Rocky to Victoria fails on db migration, and traceback points to binding index ( https://review.opendev.org/c/openstack/neutron/+/692285 ) but I can't reproduce the issue RFE ------- - https://bugs.launchpad.net/neutron/+bug/1931953 - [RFE] Openflow-based DVR L3 - Agreement on Drivers meeting was that the final goal should be to replace current DVR solution to have only one driver maintained. - https://bugs.launchpad.net/neutron/+bug/1932154 - [rfe] Off-path SmartNIC Port Binding - spec: https://review.opendev.org/c/openstack/neutron-specs/+/788821 Won't fix ------------ - https://bugs.launchpad.net/neutron/+bug/1931844 - Can't ping router with packet size greater than 1476 when ovs datapath_type set to netdev - "ovs datapath_type netdev" should only be used for VM, neutron router related virtual network devices are not compatible with it

2 1

[oslo] TaCT SIG volunteer
by Herve Beraud 21 Jun '21

21 Jun '21

Hi everyone, We are looking for volunteers to endorse the TaCT SIG liaison role for Oslo. Our previous volunteers are no longer active. Indeed, Moisés officially announced his retirement from Oslo two weeks ago, and Sébastien did not attend our meetings for some time. Here are the details about this role: https://governance.openstack.org/sigs/tact-sig.html Let us know if you're interested in this role, by replying to this thread or by joining us during our meetings (next meeting: July 05). Thanks for your attention. -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

[tc][all] Test support for TLS default
by Rico Lin 21 Jun '21

21 Jun '21

Dear all In short, can you help to enable tls-proxy for your test jobs and fix/report the issue in [4]? Or it makes no sense for you? Here's all repositories contains jobs with tls-proxy disabled: - neutron - neutron-tempest-plugin - cinder-tempest-plugin - cyborg-tempest-plugin - ec2api-tempest-plugin - freezer-tempest-plugin - grenade - heat - js-openstack-lib - keystone - kuryr-kubernetes - masakari - murano - networking-odl - networking-sfc - python-brick-cinderclient-ext - python-neutronclient - python-zaqarclient - sahara - sahara-dashboard - sahara-tests - solum - tacker - telemetry-tempest-plugin - trove - trove-tempest-plugin - vitrage-tempest-plugin - watcher As I'm looking for y-cycle potential goals, I found the tls-proxy support is not actually ready OpenStack wide (you can find some discussion in [3]). We have multiple projects that disable tls-proxy in test jobs [1] (and stay that way for a long time). For security concerns, I'm currently collecting the missing part for this. And try to figure out if there is any infra issue for current jobs. After I attempt to enable tls-proxy for some projects to check the status. And from the test result shows ([2]), We might have bugs/test infra issues in projects. So I invite projects who still have not switched to TLS default. Please do, and help to fix/report the issue you're facing. As we definitely need some more help on figuring out the actual situation on each project. So I created an etherpad [4] to track actions or related information. Meanwhile, I will attempt to enable tls-proxy on more test jobs (and you will be able to find it in [2]). Which gives us a good chance to review the logs and see how we might get chances to fix it and enable TLS by default. [1] https://codesearch.opendev.org/?q=tls-proxy%3A%20false&i=nope&files=&exclud… [2] https://review.opendev.org/q/topic:%22exame-tls-proxy%22+(status:open%20OR%… [3] https://etherpad.opendev.org/p/community-goals [4] https://etherpad.opendev.org/p/support-tls-default *Rico Lin* OIF Board director, OpenStack TC, Multi-arch SIG chair, Heat PTL, Senior Software Engineer@EasyStack

3 2

[ops][nova][spice][victoria] Switch from VNC to SPICE
by DHilsbos＠performair.com 21 Jun '21

21 Jun '21

All; We have a Victoria cluster, and I'd like to switch from VNC to SPICE. Cluster is installed with packages (RDO), and configured manually. I have located https://docs.openstack.org/nova/victoria/admin/remote-console-access.html, but this doesn't tell me which services need to be installed on which servers. Looking at packages, I'm fairly certain nova-spicehtml5proxy (openstack-nova-spicehtml5proxy on CentOS 8) needs to be installed where the nova-novncproxy is currently. I also suspect that qemu-kvm-ui-spice needs to be installed on the nova-compute nodes. Is spice-server needed on the nova-compute nodes? Thank you, Dominic L. Hilsbos, MBA Vice President - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

4 6

[cinder][kolla][OpenstackAnsible] Wallaby Cycle-Trailing Release Deadline
by Herve Beraud 21 Jun '21

21 Jun '21

Hello teams with trailing projects, Next week is the Wallaby cycle-trailing release deadline [1], and all projects following the cycle-trailing release model must release their Wallaby deliverables by 02 July, 2021. The following trailing projects haven't been released yet for Wallaby (aside the release candidates versions). Cinder team's deliverables: - cinderlib OSA team's deliverables: - openstack-ansible-roles - openstack-ansible Kolla team's deliverables: - kayobe - kolla - kolla-ansible This is just a friendly reminder to allow you to release these projects in time. Do not hesitate to ping us if you have any questions or concerns. [1] https://releases.openstack.org/xena/schedule.html#x-cycle-trail -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

Ceph RADOSGW Keystone integration - S3 bucket policies targeting not just whole projects but particular users?
by Christian Rohmann 21 Jun '21

21 Jun '21

Hallo Openstack-Users, (this is somewhat of a cross-port with the ceph-users ML, I just did not know where to ask about this best) I've been wondering about the state of OpenStack Keystone Auth in RADOSGW, especially in regards to the abilities to utilize bucket policies restricting access to only those users and only those objects which are required. 1) Even though the general documentation on RADOSGW S3 bucket policies is a little "misleading" https://docs.ceph.com/en/latest/radosgw/bucketpolicy/#creation-and-removal in showing users being referred as Principal, the documentation about Keystone integration at https://docs.ceph.com/en/latest/radosgw/keystone/#integrating-with-openstac… clearly states, that "A Ceph Object Gateway user is mapped into a Keystone <tenant>"||. In the keystone authentication code it strictly only takes the project from the authenticating user: * https://github.com/ceph/ceph/blob/6ce6874bae8fbac8921f0bdfc3931371fc61d4ff/… * https://github.com/ceph/ceph/blob/6ce6874bae8fbac8921f0bdfc3931371fc61d4ff/… This is rather unfortunate as this renders the usually powerful S3 bucket policies to be rather basic with granting access to all users (with a certain role) of a project or more importantly all users of another project / tenant, as in using arn:aws:iam::$OS_REMOTE_PROJECT_ID:root as principal. Or am I just misreading anything here or is this really all that can be done if using native keystone auth? Apparently I was not the only one wondering ... https://lists.ceph.io/hyperkitty/list/ceph-users@ceph.io/thread/7MXUZ63DEH7… 2) There is a PR open implementing generic external authentication https://github.com/ceph/ceph/pull/34093 Apparently this seems to also address the lack of support for subusers for Keystone - if I understand this correctly I could then grant access to users arn:aws:iam::$OS_REMOTE_PROJECT_ID:$user * Are there any plans on the roadmap to extend the functionality in regards to keystone as authentication backend? * Is anybody using another (custom) solution to allow a more fine-grained user and access management when utilizing Ceph for their object storage? Are you potentially not using Keystone directly and use a central database such as an LDAP and have Ceph and Keystone use that independently? Regards Christian

1 0

Wallaby install via kayobe onto ubuntu 20 all in one host
by Tony Pearce 21 Jun '21

21 Jun '21

I'm trying to run "kayobe overcloud host configure" against an ubuntu 20 machine to deploy Wallaby. I'm getting an error that python is not found during the host configure part. PLAY [Verify that the Kayobe Ansible user account is accessible] TASK [Verify that a command can be executed] fatal: [juc-ucsb-5-p]: FAILED! => {"changed": false, "module_stderr": "/bin/sh: 1: /usr/libexec/platform-python: not found\n", "module_stdout": "", "msg": "The module failed to execute correctly, you probably need to set the interpreter.\nSee stdout/stderr for the exact error", "rc": 127} Python3 is installed on the host. When searching where this platform-python is coming from it returns the kolla-ansible virtual envs: $ grep -rni -e "platform-python" venvs/kolla-ansible/lib/python3.8/site-packages/ansible/config/base.yml:1450: '8': /usr/libexec/platform-python venvs/kolla-ansible/lib/python3.8/site-packages/ansible/config/base.yml:1470: - /usr/libexec/platform-python I had a look through the deployment guide for Kayobe Wallaby and didnt see a note about changing this. Do I need to do further steps to support the ubuntu overcloud host? I have already set (as per the doc): os_distribution: ubuntu os_release: focal Regards, Tony Pearce

3 14