July 2021 - openstack-discuss - lists.openstack.org

[oslo][stable] periodic-stable errors
by Előd Illés 31 Jul '21

31 Jul '21

1 0

[centos][kolla-ansible][wallaby][vpnaas] I need Help
by Franck VEDEL 30 Jul '21

30 Jul '21

Hello. I try one last time to get some help, answers to my questions because I have been trying for 2 weeks to get the vpnaas service to work under Wallaby, without success. Still, I have no problem under Victoria with vpnaas. However, on my last installation which must work in September (to be used by students), without my understanding why, the horizon container of my centos (rocky) / kolla-ansible / victoria installation does not want to launch and I do not have no logs. So, can't use Victoria. I am trying Wallaby, everything works except vpnaas. My questions: how to get the logs of this hoorizon container which does not start (restart every 20 seconds)? how to know if it is a bug in wallaby with vpnaas? Really thank you if anyone can help me move forward. Franck

5 22

RE: [ops][nova][victoria] Unable to Migrate: Host filter ignoring hosts
by DHilsbos＠performair.com 30 Jul '21

30 Jul '21

All; Thank you for reading my previous email, despite its poor Subject. I have attached a subset of the Nova Scheduler log, with debugging enabled. I have added line numbers to the beginning, in order to facilitate referencing. At line 18 it appears to select the requested server for the migration, but then at line 38, it rejects it. Am I missing something here? Is it unable to assign the resources through placement? Dominic L. Hilsbos, MBA Vice President – Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com -----Original Message----- From: melanie witt [mailto:melwittt@gmail.com] Sent: Wednesday, July 28, 2021 1:24 PM To: Dominic Hilsbos; openstack-discuss(a)lists.openstack.org Subject: Re: [ops][nova] On Wed, 28 Jul 2021, 20:10 +0000, <DHilsbos(a)performair.com> wrote: > All; > > I'm having a problem, though I'm not certain of the full scope. > > The most obvious issue is that I can't live migrate instances. The server I want to send the instance to gets filtered out, though I don't see any logs that tell me why it's being filtered out. > > It might be related that all of my new instances seems to land on a single host. > > An pointers on where to look for logs for Host Filters? You'll want to set [DEFAULT]debug = True in the nova.conf for your nova-scheduler service and restart or HUP the service. And then the logging per scheduler filter (each one will show the starting and ending number of hosts) will be included at DEBUG log level in the nova-scheduler log. -melwitt

3 5

[OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654)
by Jeremy Stanley 30 Jul '21

30 Jul '21

=========================================== OSSA-2021-002: Open Redirect in noVNC proxy =========================================== :Date: July 29, 2021 :CVE: CVE-2021-3654 Affects ~~~~~~~ - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.2 Description ~~~~~~~~~~~ Swe Aung, Shahaan Ayyub, and Salman Khan with the Monash University Cyber Security team reported a vulnerability affecting Nova's noVNC proxying implementation which exposed access to a well-known redirect behavior in the Python standard library's http.server.SimpleHTTPRequestHandler and thus noVNC's WebSockifyRequestHandler which uses it. By convincing a user to follow a specially-crafted novncproxy URL, the user could be redirected to an unrelated site under control of the attacker in an attempt to convince them to divulge credentials or other sensitive data. All Nova deployments with novncproxy enabled are affected. Patches ~~~~~~~ - https://review.opendev.org/791807 (Train) - https://review.opendev.org/791806 (Ussuri) - https://review.opendev.org/791805 (Victoria) - https://review.opendev.org/791577 (Wallaby) - https://review.opendev.org/791297 (Xena) Credits ~~~~~~~ - Swe Aung from Monash University Cyber Security team (CVE-2021-3654) - Shahaan Ayyub from Monash University Cyber Security team (CVE-2021-3654) - Salman Khan from Monash University Cyber Security team (CVE-2021-3654) References ~~~~~~~~~~ - https://launchpad.net/bugs/1927677 - https://bugs.python.org/issue32084 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3654 Notes ~~~~~ - The stable/train branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley

1 0

[cinder] No Cinder Bug Meeting on 4 August
by Sofia Enriquez 30 Jul '21

30 Jul '21

I'll send the email report as usual. Please join the Cinder Xena R-9 virtual that day 1400-1600 UTC. Cheers, Sofia -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[openstack-nova] Attached volume is not available in the VM
by Aleksander Wojtal 30 Jul '21

30 Jul '21

Hello, During our testing we perform reboot of compute during volume attached task. Result is as follows. Volume is marked as attached to VM (also in DB) ceeinfra@lcm1:~> openstack volume list +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ | ID | Name | Status | Size | Attached to | +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ | c52d406c-5587-445d-9da1-436ffbbe3541 | vol_neXt-488 | available | 10 | | | f3e45efc-35eb-4f95-8e71-f50b5cb69028 | RebootOfComputeHostWhilePerformingVolumeOperations-Volume-0618_19_45_12_669 | in-use | 20 | Attached to neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 on /dev/vdb | | 1bd81392-e2c9-4725-93c8-baa484924f21 | vol_neXt-488 | available | 10 | | | 919db17c-0729-409c-bf59-74539edcea47 | vol_neXt-488 | available | 10 | | +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ >From VM perspective too. ceeinfra@lcm1:~> openstack server show neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 +-------------------------------------+-------------------------------------------------------------------------------------+ | Field | Value | +-------------------------------------+-------------------------------------------------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | nova | | OS-EXT-SRV-ATTR:host | compute-0-11.k2.ericsson.se | | OS-EXT-SRV-ATTR:hypervisor_hostname | compute-0-11.k2.ericsson.se | | OS-EXT-SRV-ATTR:instance_name | instance-00001edc | | OS-EXT-STS:power_state | Running | | OS-EXT-STS:task_state | None | | OS-EXT-STS:vm_state | active | | OS-SRV-USG:launched_at | 2021-06-18T14:14:58.000000 | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | NovaController-Network-0618_19_44_16_852=10.0.0.5 | | config_drive | True | | created | 2021-06-18T14:14:19Z | | flavor | m1.small (2) | | hostId | 5078bfd4fabd8b2e7c9f4554b3ac08d536ceebb5f393db4d38c8ff60 | | id | 95ed49ed-b3f8-46ae-80a0-544b939c50b7 | | image | JCAT_Common_CirrOS_i386 (b71f3fbd-59f1-4c29-a296-5065fe0406f7) | | key_name | None | | name | neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 | | progress | 0 | | project_id | b63725c8ebaf43ebabbed497f41eb71c | | properties | ha-policy='managed-on-host' | | scheduler_hints | {} | | security_groups | name='default' | | status | ACTIVE | | updated | 2021-06-18T14:22:07Z | | user_id | f490f07b813748698e56ca7641d46a72 | | volumes_attached | id='f3e45efc-35eb-4f95-8e71-f50b5cb69028' | +-------------------------------------+-------------------------------------------------------------------------------------+ >From Libvirt perspective, volume is not attached to VM compute-0-11:/var/log # virsh dumpxml instance-00001edc <domain type='kvm' id='1'> <name>instance-00001edc</name> <uuid>95ed49ed-b3f8-46ae-80a0-544b939c50b7</uuid> (...) <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='directsync'/> <source file='/var/lib/nova/instances/95ed49ed-b3f8-46ae-80a0-544b939c50b7/disk' index='2'/> <backingStore type='file' index='3'> <format type='raw'/> <source file='/var/lib/nova/instances/_base/af82cd8216adb002916bb9e422a3fbb637022ec6'/> <backingStore/> </backingStore> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw' cache='directsync'/> <source file='/var/lib/nova/instances/95ed49ed-b3f8-46ae-80a0-544b939c50b7/disk.config' index='1'/> <backingStore/> <target dev='hdd' bus='ide'/> <readonly/> <alias name='ide0-1-1'/> <address type='drive' controller='0' bus='1' target='0' unit='1'/> </disk> <controller type='usb' index='0' model='piix3-uhci'> (...) </domain> System does not provide any indication of the problem. There should be some kind of indication to user that volume attachment was not completed. Pozdrawiam / Best regards, Aleksander Wojtal, Junior Software Engineer TietoEVRY BU Telco Cloud Infra & Applications email aleksander.wojtal(a)tietoevry.com al. Piastów 30, 71-064 Szczecin, tietoevry.com [cid:image001.png@01D77EE0.7C2AE900] Please note: The information contained in this message may be legally privileged, confidential and protected from disclosure. If you received this in error, please notify the sender immediately and delete the message from your computer. Thank you.

3 6

[TripleO] next irc meeting Tuesday 03 August @ 1400 UTC in OFTC #tripleo
by Marios Andreou 30 Jul '21

30 Jul '21

Reminder the next TripleO irc meeting is this coming Tuesday agenda: https://wiki.openstack.org/wiki/Meetings/TripleO one-off items: https://etherpad.opendev.org/p/tripleo-meeting-items (feel free to add any tripleo status/ongoing work etc to the etherpad). Our last meeting was on Jul 20 - you can find logs @ https://meetings.opendev.org/meetings/tripleo/2021/tripleo.2021-07-20-14.00… Hope you can make it on Tuesday, regards, marios

1 0

[sdk] keystone group members list
by Valéry Tschopp 29 Jul '21

29 Jul '21

Hi all, With the openstacksdk, how can list the members of a Keystone group? The Keystone API exists https://docs.openstack.org/api-ref/identity/v3/?expanded=list-users-in-grou… but I didn't find the corresponding SDK functions... Thanks in advance Cheers, Valery -- SWITCH Valéry Tschopp, Software Engineer Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland Email: valery.tschopp(a)switch.ch Phone: +41 44 268 1544 https://www.switch.ch/

1 0

[kolla][keystone][openstack-ansible][deploy][sdk] enforcing scope in Kolla-Ansible deployment
by James Kirsch 29 Jul '21

29 Jul '21

I'm working on adding the option to enable enforce_scope in keystone during Kolla-Ansible deployment. I've revived this transaction to complete this work: https://review.opendev.org/c/openstack/kolla-ansible/+/692179 As part of that effort, I would like to also enable enforce_new_defaults in keystone. Deployment currently fails because the nova keystone user roles created during Kolla-Ansible deployment requires system scope. I can currently get around this using python-openstack: openstack role add --system all --user d7512be612454eff8a7f5bf5476b1531 admin Kolla-ansible relies on the OpenStack Ansible modules to create users and roles for deployment. Looking around the repositories, it does not appear that the openstack ansible module nor the openstacksdk supports granting system scope to a user role. Please let me know if this is not the case or if it is in current development. Otherwise, I could use guidance on what the next steps I could take or who I should talk to so I can move this forward. Thanks, James my awesome background music: http://www.generalfuzz.net about me: http://www.headphonejames.com

3 2

[kolla] Operator pain points
by Mark Goddard 29 Jul '21

29 Jul '21

Hi, The TC is looking at community goals for the Yoga release cycle, and has proposed resolving some operator pain points [1]. These pain points are naturally project-specific, and the first step is collecting some. They are looking for 1-2 points per project, but this is an interesting feedback exercise for us, so don't hold back. Please add any significant operator pain points you have for Kolla (or other projects) to the Etherpad [2]. Thanks, Mark [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-July/023659.html [2] https://etherpad.opendev.org/p/pain-point-elimination

2 1