January 2022 - openstack-discuss - lists.openstack.org

[TripleO] Overcloud deployment failing with Network Seggregation
by Anirudh Gupta 07 Jan '22

07 Jan '22

Hi Team, I am trying to deploy an Openstack Train using TripleO having 3 Controllers and 1 Compute. Without Network Isolation, I have deployed it successfully. Now, I am trying to segregate my network traffic using multiple-nics-vlan configuration generated via the below command /tools/process-templates.py -o ~/openstack-tripleo-heat-templates-rendered -n /home/stack/network_data.yaml -r /home/stack/templates/roles_data.yaml The command used for deploying the overcloud is openstack overcloud deploy --templates \ *-n /home/stack/templates/network_data.yaml \* -r /home/stack/templates/roles_data.yaml \ -e /home/stack/templates/node-info.yaml \ *...* *-e /home/stack/templates/environments/network-isolation.yaml \-e /home/stack/templates/environments/network-environment.yaml \* *...* It is failing just after the ovs bridge gets created and external nic vlan is attached to the bridge. [image: MicrosoftTeams-image (1).png] MAC Address of br-ex is same as the MAC of the interface specified in file network/config/multiple-nics-vlan/controller.yaml For testing, If I assign an IP address to that interface, it is reachable to GW. But, in case IP is assigned to VLAN 418 and it is added in the br-ex, Gateway remains unreachable. Please suggest

1 0

[neutron] Drivers meeting - Friday 7.1.2022 - cancelled
by Lajos Katona 06 Jan '22

06 Jan '22

Hi Neutron Drivers! Tomorrow we have not enough drivers to vote (see previous mail from mlavalle: [0]), so let's cancel tomorrow's meeting, and meet a week later: January 14th. [0]: http://lists.openstack.org/pipermail/openstack-discuss/2022-January/026549.… See You on the meeting next week. Lajos Katona (lajoskatona)

1 0

[all][Neutron][devstack] Deprecate lib/neutron
by Lajos Katona 06 Jan '22

06 Jan '22

Hi, In devstack we have two more or less overlapping lib for deploying Neutron: lib/neutron and lib/neutron-legacy. lib/neutron-legacy was recently "undeprecated" (see [0]), and Openstack CI mostly (fully?) uses it. To avoid double maintenance, and confusion in settings we would like to deprecate lib/neutron, for recent discussions see [1] and [2]. The plan is to keep lib/neutron for 2 cycles (that will be AA or the release after Z) and delete lib/neutron then, and rename lib/neutron-legacy to lib/neutron. As You can see from the discussions below there are questions like how to name the processes, log-files etc..., as lib/neutron-legacy uses q-* and lib/neutron uses neutron-* names. The best would be to keep both in the long term (we love q-* as historical tradition, but neutron-* looks like so fresh and modern;)) If you have any thoughts suggestions or questions please answer to this mail or comment on the deprecation patch: [3] [0]: https://review.opendev.org/c/openstack/devstack/+/704829 [1]: https://meetings.opendev.org/meetings/networking/2022/networking.2022-01-04… [2]: https://meetings.opendev.org/irclogs/%23openstack-qa/%23openstack-qa.2022-0… [3]: https://review.opendev.org/c/openstack/devstack/+/823653

1 0

[neutron] Dadfailed of ipv6 metadata IP in qdhcp namespace and disappearing dhcp namespaces
by Kamil Madáč 06 Jan '22

06 Jan '22

Hello, In our small cloud environment, we started to see weird behavior during last 2 months. Dhcp namespaces started to disappear randomly, which caused that VMs losed connectivity once dhcp lease expired. After the investigation I found out following issue/bug: 1. ipv6 metadata address of tap interface in some qdhcp-xxxx namespaces are stucked in "dadfailed tentative" state (i do not know why yet) 2. 3. root@cloud01:~# ip netns exec qdhcp-3094b264-829b-4381-9ca2-59b3a3fc1ea1 ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2585: tap1797d9b1-e1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 link/ether fa:16:3e:77:64:0d brd ff:ff:ff:ff:ff:ff inet 169.254.169.254/32 brd 169.254.169.254 scope global tap1797d9b1-e1 valid_lft forever preferred_lft forever inet 192.168.0.2/24 brd 192.168.0.255 scope global tap1797d9b1-e1 valid_lft forever preferred_lft forever inet6 fe80::a9fe:a9fe/64 scope link dadfailed tentative valid_lft forever preferred_lft forever inet6 fe80::f816:3eff:fe77:640d/64 scope link valid_lft forever preferred_lft forever 4. 5. This blocked dhcp agent to finish sync_state function, and NetworkCache was not updated with subnets of such neutron network 6. During creation of VM assigned to such network, agent does not detect any subnets (see point 2), so he thinks (reload_allocations()) there is no dhcp needed and deletes qdhcp-xxxx namespace, so no DHCP and no Metadata are working on such network since that moment, and after 24h we see connectivity issues. 7. Restart of DHCP agent recreates missing qdhcp-xxxx namespaces, but NetworkCache in dhcp agent is again empty, so creation of VM deletes the qdhcp-xxxx namespace again 🙁 Workaround is to remove dhcp agent from that network and add it again. Interestingly, sometimes I need to do it multiple times, because in few cases tap interface in new qdhcp finishes again in dadfailed tentative state. After year in production we have 20 networks out of 60 in such state. We are using kolla-ansible deployment on Ubuntu 20.04, kernel 5.4.0-65-generic. Openstack version Victoria and neutron is in version 17.2.2.dev70. Is that bug in neutron, or is it misconfiguration of OS on our side? I'm locally testing patch which disables ipv6 dad in qdhcp-xxxx namespace (net.ipv6.conf.default.accept_dad = 1), but I'm not sure it is good solution when it comes to other neutron features? Kamil Madáč Slovensko IT a.s.

3 3

[horizon] Bump XStatic-Angular-FileUpload to 12.2.13
by Thomas Goirand 06 Jan '22

06 Jan '22

Hi, After someone unrelated to OpenStack maintenance uploaded libjs-angular-file-upload 12.2.13, I tested it, and it didn't break Horizon (at least, when I manually uploaded a file, it worked...). So IMO, it would be fine to just bump to that version. Cheers, Thomas Goirand (zigo)

1 0

[keystone][requirements] keystone holding back pysaml2-7.1.x update
by Matthew Thode 06 Jan '22

06 Jan '22

Hi again, pysaml2===7.1.0 has been breaking updates for a while now. https://review.opendev.org/818612 -- Matthew Thode

1 0

[horizon][requirements] falling behind on requirements updates
by Matthew Thode 06 Jan '22

06 Jan '22

Hi, The following requirements updates have been stalled. XStatic-Angular===1.8.2.1 Has been held back for at least 7 months, but I think closer to a year now. Some review history is here: https://review.opendev.org/794258 django-compressor===2.4.1 rcssmin===1.1.0 rjsmin===1.1.0 These come as a group and have been holding things back for about a month. I'm not sure what's holding things back here on the horizon side. Review bundled with XStatic-Angular here: https://review.opendev.org/823449 -- Matthew Thode

1 0

[all][tc] Technical Committee next weekly meeting on Jan 6th at 1500 UTC
by Ghanshyam Mann 06 Jan '22

06 Jan '22

Hello Everyone, Technical Committee's next weekly meeting is scheduled for Jan 6th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, Jan 5th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[infra] Missing releases from opendev.org/opendev/git-review/tags
by Pete Zaitcev 05 Jan '22

05 Jan '22

Greetings: I noticed that the list of tags for git-review in the website does not include the 2.2.x tags, which exist in git: [zaitcev@niphredil git-review-0]$ grep url .git/config url = https://opendev.org/opendev/git-review.git [zaitcev@niphredil git-review-0]$ git tag -l --format='%(objectname) %(objecttype) %(refname)'| grep 2\\.2 bb81051c2481d4ac983ec0b28bd62b590d361141 tag refs/tags/2.2.0 [zaitcev@niphredil git-review-0]$ git show bb81051c2481d4ac983ec0b28bd62b590d361141 | head -5 tag 2.2.0 Tagger: Jeremy Stanley <fungi(a)yuggoth.org> Date: Wed Nov 24 02:20:05 2021 +0000 Release 2.2.0 [zaitcev@niphredil git-review-0]$ The 2.2.0 is missing from https://opendev.org/opendev/git-review/tags Coincidentally, it is also missing from https://tarballs.opendev.org/openstack/git-review/ Is this something that the infrastructure team did on purpose? Or is this just a bug to be reported? -- Pete

3 7

RE: [nova][dev] Revisiting qemu emulation where guest arch != host arch
by Race, Jonathan 05 Jan '22

05 Jan '22

That makes sense which is the best method I saw as well. For your example "use HW_ARCH_X86 to idenfiy the host as being x86 and COMPUTE_ARCH_X86 for emulated", I actually implemented a new field called hw_emulation_architecture as to not conflict with any existing nova operations and to eliminate confusion. This allows for setting this specific value as an image meta property in glance, and if it is set then it will execute emulation via qemu for the designated architecture. If it is not set then operations will occur as normal. https://review.opendev.org/c/openstack/nova/+/822053 is really just an initial response for the bug, that was submitted. And our long-term goal is to collab on this existing blueprint https://blueprints.launchpad.net/nova/+spec/pick-guest-arch-based-on-host-a… for a more full set of capabilities. Jonathan Race Cyber Range Engineer | Georgia Cyber Range GEORGIA CYBER CENTER On Wed, 2020-07-15 at 14:17 +0000, Apsey, Christopher wrote: > All, > > A few years ago I asked a question[1] about why nova, when given a hw_architecture property from glance for an image, would not end up using the correct qemu-system-xx binary when starting the guest process on a compute node if that compute nodes architecture did not match the proposed guest architecture. As an example, if we had all x86 hosts, but wanted to run an emulated ppc guest, we should be able to do that given that at least one compute node had qemu-system-ppc already installed and libvirt was successfully reporting that as a supported architecture to nova. It seemed like a heavy lift at the time, so it was put on the back burner. > > I am now in a position to fund a contract developer to make this happen, so the question is: would this be a useful blueprint that would potentially be accepted? > yes, i cant really speak to how much use it would get or how useful it woudl be to the majoriy fo user but i would be supportive of adding this capablity. We have to be a little carful to get the design wright for example we might want to differnciate between the native architecture and emulated architectures e.g. use HW_ARCH_X86 to idenfiy the host as being x86 and COMPUTE_ARCH_X86 for emulated with the new "in" suppot being added to placment we can use required=in:HW_ARCH_X86,COMPUTE_ARCH_X86 in cases where you dont care and by default if you wanted native only you could use the HW_ARCH_* traits in the image and we can have a prefileter add the both triats by default if the architrue is set in the iamge and there is not arch trait in the flavor or image. i will certenly review a spec if you proporse one but you might now have time to get it approved this cycle the spec deadlien woudl have been thursday btu it has been moved to next week. > Most of the time when people want to run an emulated guest they would just nest it inside of an already running guest of the native architecture, but that severely limits observability and the task of managing any more than a handful of instances in this manner quickly becomes a tangled nightmare of networking, etc. I see real benefit in allowing this scenario to run natively so all of the tooling that exists for fleet management 'just works'. This would also be a significant differentiator for OpenStack as a whole. > > Thoughts? > > [1] > http://lists.openstack.org/pipermail/openstack-operators/2018-August/015653…<https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2Flists.open…> > > Chris Apsey > Director | Georgia Cyber Range > GEORGIA CYBER CENTER > > 100 Grace Hopper Lane | Augusta, Georgia | 30901 > https://www.gacybercenter.org<https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.gacyb…> >

1 0