July 2021 - openstack-discuss - lists.openstack.org

[neutron] bug deputy report for week of 2021-07-05
by Bence Romsics 12 Jul '21

12 Jul '21

Hi Neutron Team, These are the new bugs of last week: High: * https://bugs.launchpad.net/neutron/+bug/1934930 [ovn] Multiple servers can try to create neutron_pg_drop at the same time fix proposed: https://review.opendev.org/c/openstack/neutron/+/799900 * https://bugs.launchpad.net/neutron/+bug/1934915 [OVN Octavia Provider] Investigate tempest failures tests disabled to unblock ovn-octavia-provider gate: https://review.opendev.org/c/openstack/ovn-octavia-provider/+/799864 Medium: * https://bugs.launchpad.net/neutron/+bug/1934666 IPv6 not set on VMs when using DVR HA + SLAAC/SLAAC (or DHCPv6 stateless) * https://bugs.launchpad.net/neutron/+bug/1934912 Router update fails for ports with allowed_address_pairs containg IP range in CIDR notation fix proposed: https://review.opendev.org/c/openstack/neutron/+/800059 Low: * https://bugs.launchpad.net/neutron/+bug/1934957 [sriov] Unable to change the VF state for i350 interface unassigned RFE / Wishlist: * https://bugs.launchpad.net/neutron/+bug/1934948 [RFE] refactor of L3 resources update procedure * https://bugs.launchpad.net/neutron/+bug/1935764 RFE: Adding support for direct ports with qos in ovn * https://bugs.launchpad.net/neutron/+bug/1934670 neutron-tempest-plugin should migrate from paramiko Incomplete: * https://bugs.launchpad.net/neutron/+bug/1934135 nova cannot create instances, because it doesn't find the network Regards, Bence

1 0

[keystone][interop][refstack] Adding new capabilities to track in interop
by Martin Kopec 12 Jul '21

12 Jul '21

Hi everyone, we are adding new capabilities and tests for keystone service to interop, see: https://review.opendev.org/c/osf/interop/+/799163 If someone from keystone could review the patch, it would be great. Thanks, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA

1 0

[Image Encryption] No meeting today
by Josephine Seifert 12 Jul '21

12 Jul '21

Hi, there will not be a meeting today, as I am ill. The next meeting will be next Monday the 19th of July. greetings Luzi

1 0

[qa] Virtual PTG October 2021
by Martin Kopec 12 Jul '21

12 Jul '21

Hi everyone, as you have probably heard our next PTG will be held virtually in October. I've created a Doodle [1] to collect the best time slots for our team. Please fill it in by Tuesday July 20th (the deadline for team signup is July 21st). I've also created an etherpad [2] to collect ideas/topics for the PTG sessions. If you have anything to discuss, please don't hesitate to write it there. [1] https://doodle.com/poll/a8gakx4ca6zvtuem?utm_source=poll&utm_medium=link [2] https://etherpad.opendev.org/p/qa-yoga-ptg Regards, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA

1 0

[kolla][wallaby][neutron][vpnaas]
by Franck VEDEL 12 Jul '21

12 Jul '21

Hello, and first excuse my English please… thanks a lot. I hope you will understand my problem. I have a problem with the following configuration: kolla-ansible, centos, wallaby. I need the vpnaas service. I create internal networks, configure these networks, the routers, and I create a vpnaas between two internal networks (2 cirros instances for example). To the left; net1: 192.168.10.0/24 Right, net2: 192.168.20.0/24 VM On the left: ping VM on the right (ex 192.168.20.30). The ping goes to the internet, it is handled by the default route on the router leaving net1. I do the same with Victoria: it works. I am testing a VPN between net1 and an internal network behind a real network, behind a watchguard. With Victoria, it works. With Wallaby, it doesn't work. Neutron-l3-agent logs says: Command: ['ipsec', 'whack', '--status'] Exit code: 33 Stdout: Stderr: whack: Pluto is not running (no "/run/pluto/pluto.ctl ») Is there a bug in wallaby? What could be the problem, the configuration and the hardware is the same, it works with victoria, not with wallaby. Thanks for your help. Franck

1 1

[all][infra][qa] Retiring Logstash, Elasticsearch, subunit2sql, and Health
by Clark Boylan 09 Jul '21

09 Jul '21

Hello everyone, Xenial has recently reached the end of its life. Our logstash+kibana+elasticsearch and subunit2sql+health data crunching services all run on Xenial. Even without the distro platform EOL concerns these services are growing old and haven't received the care they need to keep running reliably. Additionally these services represent a large portion of our resource consumption: * 6 x 16 vcpu + 60GB RAM + 1TB disk Elasticsearch servers * 20 x 4 vcpu + 4GB RAM logstash-worker servers * 1 x 2 vcpu + 2GB RAM logstash/kibana central server * 2 x 8 vcpu + 8GB RAM subunit-worker servers * 64GB RAM + 500GB disk subunit2sql trove db server * 1 x 4 vcpu + 4GB RAM health server To put things in perspective, they account for more than a quarter of our control plane servers, occupying over a third of our block storage and in excess of half the total memory footprint. The OpenDev/OpenStack Infra team(s) don't seem to have the time available currently to do the major lifting required to bring these services up to date. I would like to propose that we simply turn them off. All of these services operate off of public data that will not be going away (specifically job log content). If others are interested in taking this on they can hook into this data and run their own processing pipelines. I am sure not everyone will be happy with this proposal. I get it. I came up with the idea for the elasticsearch job log processing way back at the San Diego summit. I spent many many many hours since working to get it up and running and to keep it running. But pragmatism means that my efforts and the team's efforts are better spent elsewhere. I am happy to hear feedback on this. Thank you for your time. Clark

10 13

[all][tc] What's happening in Technical Committee: summary 9th July, 21: Reading: 5 min
by Ghanshyam Mann 09 Jul '21

09 Jul '21

Hello Everyone, Here is last week's summary of the Technical Committee activities. 1. What we completed this week: ========================= * Y release naming process is completed and announced the name 'Yoga' on ML[1] * Added Ceph Dashboard charm to OpenStack charms [2] * Documentation updates to add DPL model also in 'Appointing leaders' process [3] * Charter change to handle the vacant seat situation during the election or in between of cycle [4]. 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - https://meetings.opendev.org/meetings/tc/2021/tc.2021-07-08-15.00.log.html * We will have next week's meeting on July 15th, Thursday 15:00 UTC[5]. 3. Activities In progress: ================== TC Tracker for Xena cycle ------------------------------ TC is using the etherpad[6] for Xena cycle working item. We will be checking and updating the status biweekly in the same etherpad. Open Reviews ----------------- * Seven open reviews for ongoing activities[7]. ELK services next plan and help status --------------------------------------------- * We discussed this in the TC meeting, below is the summary: ** Help status: as of now, there are no volunteers to help. ** We defined the deadline of service shutdown if there is no help. Agreed Deadline is Yoga cycle end. Clark will update it on ML. ** We also discussed reducing the size of the existing system, and there were multiple ways. Clark will get more data on this and we will continue discussing the same in the next TC meeting on 15th July. Migration from Freenode to OFTC ----------------------------------------- * I started updating the remaining project side wiki/doc page, please review those. ** https://review.opendev.org/q/topic:%2522oftc%2522+status:open * During that I am also updating the retired/deprecated repo README.rst and many of deprecated repo need project-config update to remove the release job run from the master gate. * Retired repo does not need any action from the project team as TC has the ACL right and will take care of patch merge. * All the required work for this migration is tracked in this etherpad[8] Test support for TLS default: ---------------------------------- * Rico has started a separate email thread over testing with tls-proxy enabled[9], we encourage projects to participate in that testing and help to enable the tls-proxy in gate testing. Project updates: ------------------- * Retiring js-openstack-lib [10]. * Create repo for Hashicorp Vault deployment [11] * Deprecate os-panko role [12] Yoga release community-wide goal ----------------------------------------- * Please add the possible candidates in this etherpad [13]. * Current status: One goal "Secure RBAC" is proposed [14]. Other Changes ------------------ * Defining Yoga release testing runtime15] 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[16]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [17] 3. Office hours: The Technical Committee offers a weekly office hour every Tuesday at 0100 UTC [18] 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-July/023512.html [2] https://review.opendev.org/c/openstack/governance/+/797913 [3] https://review.opendev.org/c/openstack/governance/+/797985 [4] https://review.opendev.org/c/openstack/governance/+/797912 [5] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [6] https://etherpad.opendev.org/p/tc-xena-tracker [7] https://review.opendev.org/q/project:openstack/governance+status:open [8] https://etherpad.opendev.org/p/openstack-irc-migration-to-oftc [9] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023000.html [10] https://review.opendev.org/c/openstack/governance/+/798540 [11] https://review.opendev.org/c/openstack/governance/+/799826 [12] https://review.opendev.org/c/openstack/governance/+/799817 [13] https://etherpad.opendev.org/p/y-series-goals [14] https://review.opendev.org/c/openstack/governance/+/799705 [15] https://review.opendev.org/c/openstack/governance/+/799927 [16] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [17] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [18] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

[neutron] Drivers meeting - agenda for 9.07.2021
by Slawek Kaplonski 09 Jul '21

09 Jul '21

Hi, I will be on PTO tomorrow but Miguel will chair the meeting. Agenda for is at [1]. There are 3 RFEs to discuss: * https://bugs.launchpad.net/neutron/+bug/1933517 - [RFE][OVN] Create an intermediate OVS bridge between VM and intergration bridge to improve the live-migration process * https://bugs.launchpad.net/neutron/+bug/1933222 - [RFE] Add distributed datapath for metadata * https://bugs.launchpad.net/neutron/+bug/1932154 - Off-path SmartNIC Port Binding [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers#Agenda -- Slawek Kaplonski Principal Software Engineer Red Hat

2 1

VM fail over mechanism to Remote DR site
by KK CHN 09 Jul '21

09 Jul '21

Members , I am using OpenStack Ussuri for our datacentre for virtualization requirements. we are using KVM hypervisor on Debian . We are in a requirement that our DR site is 200+ KMs apart from our office premises and connectivity over WAN. This DR site also going to deploy with Ussuri version. How we can setup the DR site so effectively so that, when VMs or Physical hosts in our DC clusters crashes or abruptly power to one physical machine got break due to electrical wire pulled out/unplugged , then how automatic failover to the DR site which is 300 miles away from our DC . what will be the solution for this setup so that automatically the VMs crashed in our DC will be served from our DR site with minimum latency or zero downtime (is zero down time possible ? kindly enlight on this or how to achieve near zero down time ) using OpenStack without any data loss ( is this possible no Data Loss ?). How ? Whats the best architecture for this using openstack, what all are the tools components need to be used ? and what type of solutions need to be deployed for the above requirement. VMs are nearly 100 nos and Linux and Windows majority of them with around 100 GB to 200 GB size for each VM. Kindly share your thoughts and expertise in this regard and enlighten me on what techniques / components of OpenStack need to be employed for achieving this. Any hints and tips and reference links highly appreciated. Thanks in advance, Kris

1 0

[tripleo] Retiring tripleo-common-tempest-plugin
by Takashi Kajinami 09 Jul '21

09 Jul '21

Hello, I have raised this in #tripleo channel yesterday but I noticed we have a tempest plugin[1] for tripleo but it has never been used actually. The repo has not been updated for a while and it's documentation still mentions very old items like python2, usage of mistral in undercloud, and so on. Because I'm not aware of any plan to use this repo for our testing, I proposed retiring repo[1]. If anybody has concern with this retirement, please give your feedback on the proposed change. [1] https://review.opendev.org/c/openstack/project-config/+/800154 Thank you, Takashi

2 1

[release] Release countdown for week R-12, Jul 12 - Jul 16
by Herve Beraud 09 Jul '21

09 Jul '21

Development Focus ----------------- The Xena-2 milestone is next week, on July 15, 2021! Xena-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/xena/schedule.html for details. General Information ------------------- Libraries need to be released at least once per milestone period. Next week, the release team will propose releases for any library that has not been otherwise released since milestone 1. PTL's and release liaisons, please watch for these and give a +1 to acknowledge them. If there is some reason to hold off on a release, let us know that as well. A +1 would be appreciated, but if we do not hear anything at all by the end of the week, we will assume things are OK to proceed. Remember that non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. Next week is also the deadline to freeze the contents of the final release. All new 'Xena' deliverables need to have a deliverable file in https://opendev.org/openstack/releases/src/branch/master/deliverables and need to have done a release by milestone-2. Changes proposing those deliverables for inclusion in Xena have been posted, please update them with an actual release request before the milestone-2 deadline if you plan on including that deliverable in Xena, or -1 if you need one more cycle to be ready. Upcoming Deadlines & Dates -------------------------- Xena-2 Milestone: 15 July, 2021 -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

qemu-kvm-rhev >= 2.10.0
by Pete Zhang 09 Jul '21

09 Jul '21

We have qemu-kvm-ev in yum.repos.d but it still complains of missing qemu-kvm-rhev. Any idea where we can find qemu-kvm-rhev (NOT qemu-kvm-ev), thx. Error: Execution of '/bin/yum -d 0 -e 0 -y install openstack-nova-compute' returned 1: Error: Package: 1:openstack-nova-compute-20.6.0-1.el7.noarch (local_openstack-tnrp) Requires: qemu-kvm-rhev >= 2.10.0 sh-4.2# yum list | grep qemu-kvm qemu-kvm-ev.x86_64 10:2.10.0-21.el7_5.1.1 local_openstack-tnrp qemu-kvm.x86_64 10:1.5.3-160.el7_6.1 @ORB-updates qemu-kvm-common.x86_64 10:1.5.3-160.el7_6.1 @ORB-updates qemu-kvm-tools.x86_64 10:1.5.3-160.el7_6.1 ORB-updates -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

2 1

[i40e][vf][sriov] Disabling i40evf driver at the compute level.
by Laurent Dumont 09 Jul '21

09 Jul '21

Hey everyone, We are troubleshooting some weirdness with X710 Intel cards and i40evf. Looking around, it seems that most vendors recommend disabling the i40evf driver from the compute side (and keeping the i40e driver). Is anyone aware of any funkiness if both the i40e driver and the i40evf driver is present on computes running VMs with SRIOV ports. Thanks!

3 3

[Cinder] Active/Active Support
by Swapnil Kulkarni 09 Jul '21

09 Jul '21

Hello Cinder Team, Can someone provide a reference documentation for active/active support for a Cinder Driver w.r.t. configuration and any driver changes expected? Best Regards, Swapnil

2 1

[Octavia dashboard] Impossible to fill the subnet field when creating a load balancer
by Taltavull Jean-Francois 09 Jul '21

09 Jul '21

Hi All, On my OSA Victoria deployment (on Ubuntu 20.04), the "Create Load Balancer" form does not allow me to fill the mandatory "subnet" field and therefore I can't create a load balancer with Horizon. On the other hand, Octavia works fine and I can create load balancers with the CLI, Terraform, etc. Has one of you already faced such a situation ? Best regards, Jean-François

3 6

[nova] Applying custom policies at VM creation time
by gustavo panizzo 08 Jul '21

08 Jul '21

Hello I'd like to reject VM creation or mutate the request depending on custom (business) logic for example - reject duplicate names within the same neutron network(s) - change the VM name to append a number or increase it (VM-1 requested, VM-1 already exists so it gets created as VM-2) - reject some values for particular keys on metadata (role=db rejected for project foo) How can I accomplish this? I really don't want to patch nova thanks PS: I found https://github.com/roaet/wafflehaus but it looks it hasn't been touched in years -- IRC: gfa GPG: 0x27263FA42553615F904A7EBE2A40A2ECB8DAD8D5 OLD GPG: 0x44BB1BA79F6C6333

2 2

VM failover mechanism to DR site at remote
by KK CHN 08 Jul '21

08 Jul '21

Hi list members , I am using OpenStack Ussuri for our datacentre for virtualization requirements. we are using KVM hypervisor on Debian . We are in a requirement that our DR site is 200+ KMs apart from our office premises and connectivity over WAN. This DR site also going to deploy with Ussuri version. How we can setup the DR site so effectively so that, when VMs or Physical hosts in our DC clusters crashes or abruptly power to one physical machine got break due to electrical wire pulled out/unplugged , then how automatic failover to the DR site which is 300 miles away from our DC . what will be the solution for this setup so that automatically the VMs crashed in our DC will be served from our DR site with minimum latency or zero downtime (is zero down time possible ? kindly enlight on this or how to achieve near zero down time ) using OpenStack without any data loss ( is this possible no Data Loss ?). How ? Whats the best architecture for this using openstack, what all are the tools components need to be used ? and what type of solutions need to be deployed for the above requirement. VMs are nearly 100 nos and Linux and Windows majority of them with around 100 GB to 200 GB size for each VM. Kindly share your thoughts and expertise in this regard and enlighten me on what techniques / components of OpenStack need to employed for achieving this. Any hints and tips and reference links hightly appreicated. Thanks in advance, Kris

1 0

cannot import name greenpool
by Pete Zhang 08 Jul '21

08 Jul '21

We are seeing this error in /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync] from eventlet import greenpool ImportError: cannot import name greenpool *glance/greenlet version* sh-4.2# yum list installed | grep -i "eventlet\|glance" openstack-glance.noarch 1:19.0.4-1.el7 @local_openstack-tnrp python2-eventlet.noarch 0.25.1-1.el7 @local_openstack-tnrp python2-glance.noarch 1:19.0.4-1.el7 @local_openstack-tnrp python2-glance-store.noarch 1.0.1-1.el7 @local_openstack-tnrp python2-glanceclient.noarch 1:2.17.1-1.el7 @local_openstack-tnrp *Log* Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: Traceback (most recent call last): Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/bin/glance-manage", line 6, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.cmd.manage import main Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/cmd/manage.py", line 54, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.db.sqlalchemy import alembic_migrations Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/db/sqlalchemy/alembic_migrations/__init__.py", line 28, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.db.sqlalchemy import api as db_api Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/db/sqlalchemy/api.py", line 46, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.common import utils Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/common/utils.py", line 29, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet.green import socket Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/eventlet/__init__.py", line 10, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet import convenience Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/eventlet/convenience.py", line 4, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet import greenpool Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: ImportError: cannot import name greenpool Error: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]: Failed to call refresh: 'glance-manage db_sync' returned 1 instead of one of [0] Error: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]: 'glance-manage db_sync' returned 1 instead of one of [0] -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

1 0

[cinder] I have a question about openstack cinder zonemanager driver
by aaaa bbbb 08 Jul '21

08 Jul '21

I am using Brocade FC switch in my OpenStack environment. I have a question about OpenStack cinder zonemanger driver. I find that [fc-zone-manager] can only configure one zone driver. If I want to use two FC switches from different vendors at the same time. One is Brocade FC switch, the other one is Cisco FC switch. Is there a method or solution configure two FC switch zone driver in one cinder.conf ? I want them both to support Zone Manager.

2 1

[kolla] Clean shutdown for guest VMs when host shutdown
by J-P Methot 08 Jul '21

08 Jul '21

Hi, I'm about ready to go into production with kolla, but one small issue remains. On regular Openstack deployments, I would use the libvirt-guests service to ensure that VMs on hosts always shutdown cleanly when the host shuts down. This is to prevent database issues which may happen on guests during forced, unclean shutdowns. At first glance, Kolla doesn't seem to install this service or anything similar that would ensure clean shutdown of guests when the host shuts down. I have found in the github source, in the tools folder, a systemd script that is supposed to do that, but it tries to execute /usr/libexec/libvirt-guests.sh shutdown in the libvirt container, which doesn't exist there. Does Kolla already ensure clean shutdown automatically, or is there a script I'm missing that could make this work?

4 6

[kolla] [kolla-ansible] Multiple external ceph clusters
by Alexandros Soumplis 08 Jul '21

08 Jul '21

Hi all, I am trying to connect Cinder and Manila with a second CEPH cluster and cannot find an "elegant" way to copy a second pair of ceph.conf/ceph_keyring to the running images. I can do it manually or by changing the playbook code, but I was wondering if there is a clean solution that will allow me to do this without touching the base code of kolla-ansible. Thank you in advance for any suggestions! Best, Alexandros

1 0

bird rpm for Openstack Release Train
by Pete Zhang 08 Jul '21

08 Jul '21

Does anyone know which version of bird rpm used by Openstack Release Train and where I can download it? thx. -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

1 0

[TripleO] Abandoning all open stable/stein and stable/queens patches for EOL
by Marios Andreou 08 Jul '21

08 Jul '21

Hello folks As brought to my attention this morning, we still have some open reviews against stein [1] and queens [2]. Since we have agreed to EOL those branches we should not be merging any new code there (if this is news to you (!) see [3] - EOL patches at [4][5]). I am going to go through and abandon all the patches in [1][2]. If this causes problems for you then please reach out to me ASAP so we can work something out if possible (may be harder for stein, e.g. we'd have to address some broken jobs first). For example, we can try and merge your patch and then resend the EOL patches at [4][5]. Once the patches at [4][5] merge (which is looking pretty close, they have at least one +2 from the release team) then all bets are off we can't merge anything else there. regards, marios [1] https://review.opendev.org/q/(project:%255Eopenstack/.*tripleo.*)AND(status… [2] https://review.opendev.org/q/(project:%255Eopenstack/.*tripleo.*)AND(status… [3] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023409.html [4] https://review.opendev.org/c/openstack/releases/+/798924 [5] https://review.opendev.org/c/openstack/releases/+/798925

2 3

Increase image upload limit
by open infra 08 Jul '21

08 Jul '21

Hi In a Kubernetes based OpenStack deployment, how to set the value for image_size_cap? Regards Danishka

1 0

[keystone] which CADF events are considered audit logs?
by Bence Romsics 08 Jul '21

08 Jul '21

Hi All, My colleagues working downstream asked me about audit logging, however I did not know enough about it to answer their questions. So let me please phrase their question here: For all other OpenStack components but Keystone they see audit logs in CADF format with event types 'audit.http.request' and 'audit.http.response'. Always separate logs for requests and responses. However from Keystone they also encountered CADF events with event_types like 'identity.user.created', 'identity.user.deleted' or 'identity.authenticate'. Please see an example at the end of my mail. And I guess all examples from https://docs.openstack.org/keystone/latest/admin/event_notifications.html also apply here. They were a bit surprised that these events do not one-by-one correspond to request-responses. So I believe their question is: Do you consider these Keystone events audit logs? Or do you consider them just event logs in CADF format? Or does the answer to this question depend on the object of auditing? Thanks in advance, Bence Romsics keystone/keystone-main.log:188003:<14>2021-06-15T12:51:27.323753+02:00 cic-1.domain.tld keystone-main[14531]: INFO oslo.messaging.notification.identity.user.created [req-8c3fed70-db9c-4f37-a9c5-517491d55246 034a3ac87804494a8d89d32987ff6696 e2fa6412da584f7ebb439d108e1a1185 - default default] {"event_type": "identity.user.created", "timestamp": "2021-06-15 10:51:27.321921", "payload": {"typeURI": http://schemas.dmtf.org/cloud/audit/1.0/event<http://schemas.dmtf.org/cloud/audit/1.0/event>, "initiator": {"typeURI": "service/security/account/user", "host": {"agent": "python-keystoneclient", "address": "192.168.2.124"}, "project_id": "e2fa6412da584f7ebb439d108e1a1185", "user_id": "034a3ac87804494a8d89d32987ff6696", "id": "034a3ac87804494a8d89d32987ff6696"}, "target": {"typeURI": "data/security/account/user", "id": "3dac4a1acaaa4d5598d03b9970d13ce5"}, "observer": {"typeURI": "service/security", "id": "6c15158d525643ea9e40e26b88489b82"}, "eventType": "activity", "eventTime": "2021-06-15T10:51:27.211457+0000", "action": "created.user", "outcome": "success", "id": "c0723c47-f806-54c6-b8b1-14d4e5fdd456", "resource_info": "3dac4a1acaaa4d5598d03b9970d13ce5"}, "priority": "INFO", "publisher_id": "identity.cic-1.domain.tld", "message_id": "2a2adc06-710d-4b11-abdf-2b588a2b8440"}

1 0