October 2022 - openstack-discuss - lists.openstack.org

[Neutron] Bug Deputy Report Oct 17 - 24
by Oleg Bondarev 25 Oct '22

25 Oct '22

Hello Neutron Team, It was probably the most quiet week in the history of Bug Reports: Low ----- - https://bugs.launchpad.net/neutron/+bug/1993181 - [OVN] OVN metadata "MetadataProxyHandler" not working if workers=0 - Fix Released: https://review.opendev.org/c/openstack/neutron/+/861649 - Fixed by Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/1993502 - failing unit tests when not running them all - Fix Released: https://review.opendev.org/c/openstack/neutron/+/861869 - Fixed Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/1993498 - [CI] Create oslo master branch jobs (apart from py39)8 - In progress: https://review.opendev.org/c/openstack/neutron/+/861859 - assigned to Rodolfo Alonso RFEs: ----- - https://bugs.launchpad.net/neutron/+bug/1993288 - RFE: Adopt Keystone unified limits as quota driver for Neutron - New (PTG decision - wait till it become more mature) - Unassigned Thanks, Oleg

1 0

[Cinder][Nova]Zombie process prevention for Cinder and Nova APIs
by yu-kishimoto＠kddi.com 25 Oct '22

25 Oct '22

Hi all, I'm trying to fix issues of spawning zombie processes for Cinder and Nova APIs during instantiation in an IaC (Ansible which is not openstack-ansible). Does someone can kindly help me to solve the issue or give me some clues like parameter changes that can be expected to be effective? - Issues The cinder api service process(port: 8776) existed in a zombie state. The neutron api service process(port: 9696) required for nova existed in a zombie state. - What the IaC does Use an existing tenant to create a network and subnet, then use 8volumes to instantiate 8VMs. - Workarounds and what I've done so far Identify and kill zombie processes. - Environment OS: CentOS Stream 8 Kernel: 4.18.0-408.el8.x86_64 OpenStack: Yoga(Deployed by PackStack: https://www.rdoproject.org/install/packstack/) Nova: 25.0.1 Neutron: 20.2.0 Cinder: 20.0.1 KeyStone: 21.0.0 -- Yukihiro Kishimoto Technologist KDDI Co., Ltd. Tokyo Japan

1 1

[magnum] Antelope PTG summary
by Jake Yip 25 Oct '22

25 Oct '22

Dear all, Magnum had a great meeting during the latest PTG. Thanks to OpenInfra Foundation for holding it. Also, thanks to all who has found precious time to attend. As the current Magnum team is quite small, we have decided on the following: - Deprecate the Fedora Atomic driver - This is EOL. - Deprecate the CoreOS driver - This is similarly EOL. - Deprecate the Docker Swarm driver. Kubernetes has became the container orchestration engine of choice now. With our limited resources, it will be more efficient to support the most popular choice well, instead of multiple choices. - Mark branches before Victoria as unmaintained. These branches only support Kubernetes versions that has been EOL. - Most excitingly, move towards adding Cluster API support for Kubernetes. This allows the Magnum project to leverage off upstream effort in creating and managing a Kubernetes cluster. We understand that removing support is difficult for users, but we believe this is for the better. Our main aim is to keep the project moving fast enough to keep up with upstream Kubernetes. If anyone is willing to help maintain any of the items we plan on deprecating, please drop me a message. Regards, Magnum Team. -- Jake Yip DevOps Engineer, ARDC Nectar Research Cloud

1 0

[nova][placement] 2023.1 Antelope PTG summary
by Sylvain Bauza 24 Oct '22

24 Oct '22

We're on a wetty Monday here and I guess this is time for me to take my pen again and write a PTG recap email for the current release, which is 2023.1 Antelope. Yet again, I *beg* you to *not* use any translation tool when reading any etherpad, including Google Chrome embedded translation or it would fully translate the whole etherpad content for *all* readers. In order to prevent any accidental misusage, here is a readonly copy of the Nova etherpad we had for the week https://etherpad.opendev.org/p/r.8ae4e0ef997aebfe626b2b272ff23f1b Again, I'm human and while I can write bugs (actually I write a lot of them), I can also write wrong things in this email and I can misinterpretate something precise. Apologies if so, and please don't refrain them yourself to correct me by replying to this email. Last but not the least, I'm more than open to any questions or remarks that would come from the reading of this long email. Good luck with this very long thread, you should maybe grab a coffee before starting to read it (and I promise to keep it as short as I can). ### Operator hours ### After the success of the productive Nova meet-and-greet session we held in Berlin (packed room w/ lots of feedback), we were eager to again have a discussion with operators, this time virtually which would have hopefully lowered the entry barrier by not requiring an in-person event in order to attend the session. Consequently, we allocated three timeslots of one hour, two back-to-back on Tuesday and one on Wednesday (on different times to arrange time differences between operators). Unfortunately, I have to write here that we only had a very small attendance on Tuesday with only three operators joining (but providing great feedback, thanks btw. !) and *none* on the 1-hour Wednesday slot. As a result, I won't provide statistics about release and project usage here as numbers are too low to be representative, but here is what we discussed : (again, a readonly etherpad is available here https://etherpad.opendev.org/p/r.aa8b12b385297b455138d35172698d48 for further context) # Upcoming features and general discussions - the possibility to mount Manila shares in Nova seems promising. - As nova doesn't support multiple physnets per neutron network today, this prevents the use of routed networks in some cases. - modifying our mod_wsgi usage to be allowed to pass some arguments is requested - operators seem interested in having PCI devices tracked in Placement # Pain points - getting inventories or used/availables resources in Placement becomes costly as it requires N calls, with N be the number of Resource Providers (instead of a single HTTP call). Problem has been acknowledged by the team and some design discussion occurred. - We should paginate on the flavors API and we need to fix the private > public flavor bug. - mediated devices disappearing at reboot is a problem. This has been discussed during the contributor session later, see below. - routing metrics are hard to manage when you have a long list of multiple ports attached. We eventually agreed on the fact the proposal fix could be an interesting feature for Neutron team to develop. That's it for the operators discussions. Let's now discuss about what we discussed in the contributors PTG agenda : ### Cross-project discussions Two projects this time were discussing with the Nova community : # Ironic-Nova The whole session was about the inconsistencies that were happening if a nova-compute was failing down with Ironic rebalancing the nodes. - we agreed on the fact this wasn't an easy problem to solve - a consensus was around the fact Ironic should support a sharding key so the Nova compute could use it instead of using hash rings. - JayF and johnthetubayguy agreed on codifying this idea into a spec - we'd hear feedback from operators about what they feel of the above migration (sharding their node cloud into sharding pieces and providing sharding details to nova) - in parallel of the above, documentation has to be amended in order to recommend for *existing deployments* to setup active/passive failover mode for Nova computes (instead of relying on hashring rebalances) # Neutron-Nova (I'll briefly cover the details here, as it will also be covered by the Neutron PTG recap) - while Nova is finishing up tracking of PCI devices in Placement this cycle, we agreed on defering the modeling of Neutron-based PCI requests until next cycle. This won't have any impact in terms of existing features that will continue to operate seamlessly. - the way we define switchdev capabilities as of now is incorrect. We agreed on modfying Nova to allow it to report such capabilities to Neutron. This may be a specless blueprint or just a bugfix (and then potential backportability), to be determined later. - MTUs are unfortunately immutable. If you change the MTU value by Neutron, you need to restart the instance( (or reattach the port). We consequently agreed on documenting this caveat, which is due to libvirt/qemu not able to change the MTU while the guest is running. - We eventually agreed on letting --hostname (parameter of an instance creation request) to represent a FQDN thru a nova microversion. This value won't be sanitized by nova and directly passed to Neutron as the hostname value. We also agreed on the fact Nova WON'T ever touch the port domain value in metadata, as this is not in the project scope to manage name domains. ### Procedural discussions (skip it if you're not interacting with the Nova contributors) ### # Zed retrospective - We had a productive Zed release and we made a good job on reducing bugs and bug reports. Kudos to the team again. - The microversions etherpad we had was nice but planning microversions usage is hard. WE agreed on rather providing a document to contributors explaining them how to write an API change that adds a new microversion and how to easily rebase this change if a merge conflict occurs (due to the micoversion being taken by another patch that merged) - We agreed on keeping an etherpad for tracking all API changes during milestone-3 - We agreed on filing blueprints for TC goals that impact Nova - bauzas will promote again the use of review-priority label in Gerrit during weekly meetings in order for cores to show their interest in reviewing a particular patch. # Promoting backlog features to new contributors and enhance mentoring - Starting this cycle, we'll put our list of small and easily actionable blueprints into Launchpad bug reports that have a "Wishlist" status and both a 'low-hanging-fruit' and a 'rfe' tag. New contributors or people wanting to mentor a new upstream member are more than welcome to consume that list of 'rfe' bugs and identify the ones they're willing to work on. A detailed process will be documented for helping newcomers to join. - We'll also draft our pile of work we defer into 'backlog specs' if they require further design (and are less actionable from a newcomer perspective) # Other procedural and release discussions - we'll stop using Storyboard for tracking Placement features and bugs and we'll pivot back to Launchpad for the 'placement' sub-project. - we agreed on a *feature* review day possibly 4 weeks before the feature freeze in order to catch up any late design issue we could have missed when reviewing the spec. - we will EOL stein and older nova branches with elodilles proposing the deletion patch. We agred on discussing EOL'ing train at next PTG. - gibi will work on providing a static requirements file for nova that would use minimum versions of our dependencies (non transitively) and modify unit and functional test jobs to rather use this capped requirements file for testing. - we discussed the User Survey and we agreed on discussing any question we may want to add in the next survey during the next weekly meetings. - "2023.1 Antelope" naming is a bit confusing, but we agreed on we should continue to either use "2023.1" or "2023.1 Antelope" for naming our docs. We also wait for guidelines in order to consistently name our next stable branch (2023.1 possibly). (That's the end of procedural and release discussions, please resume here if you skipped the above) ### Technical bits ### # VMware driver status - As currently no job runs happened since April, we agreed on communicating in the nova-compute logs at periodic times that the code isn't tested so operators running it would know its upstream status. - we'll update the supported matrix documentation to refiect this 'UNTESTED' state # TC goals this cycle - for the FIPS goal, we agreed on the fact the current FIPS job (running on centos 9 stream) shouldn't be running on gate and check pipelines. As the current job is busted (all periodic runs go into TIMEOUT state), we also want to modify the job timeout to allow 30 mins more time for running (due to a reboot in the job definition) - for the oslo.privsep goal, no effort is required from a nova perspective (all deliverables are already using privsep). sean-k-mooney can propose a 'rfe' bug (see the note above on new contributors) for modifying our privsep usage in nova (using different privsep context by callers) - for the Ubunutu 2022.4 goal, gmann already provided changes. We need to review them. - for the RBAC goal, let's discuss it in a proper section just below # Next steps on RBAC - we need to test new policy defaults in a full integrated tempest testsuite (meaning with other projects), ideally before the first milestone. - once we check everything works fine as expected, we can flip the default (enabling new policies) before milestone-2 - we'd like to start drafting the new service role usage by two new specs (one for nova, the other one for placement) # Power management in Nova A pile of work I'm proud we gonna start this cycle. This is about disabling/enabling cores on purpose, so power savings occur. - we agreed on supporting it directly in Nova (and to not design and support an external tool which would suppose to draft some heave interface for an easy quickwin). This would just be a config flag to turn on that would enable CPU cores on demand. - a potential follow-up *may* be to use a different CPU governor depending on flavors or images but this won't be scoped for this release. # Power monitoring in Nova I don't really like this name, as monitoring isn't part of the Nova mission statement so I'll clarify. Here, this is about providing an internal readonly interface for power monitoring tools running on guests that would be able to capture host consumption metrics. One example of such monitoring tools is Scaphandre, demonstrated during the last OpenInfraSummit at a keynote. - we agreed on reusing virtiofs support we're gonna introduce in this release for the Manila share attachment usecase - this share would be readonly and would be unique per instance (ie. we wouldn't be supporting multiple guest agents reading different directories) - this share would be enabled thru a configuration flag per compute, and would only be mounted per instance by specific flavor or image extraspec/metadata. # Database soft-deleted records and the archive/purge commands - We don't want to deprecate DB soft-deleted records as some APIs continue to rely on those records. - We rather prefer to add a new parameter to the purge command that will directly delete the 'soft-deleted' records from the main DBs and not only the shadow tables (skipping the need to archive, if the operator wants to use this parameter) # Nova-compute failing at reboot due to vGPU missing devices Talking of bug #1900800, the problem is that mediated devices aren't persistent so nova-compute isn't able to respawn the instances after a reboot if those are vGPU-flavored. - we agreed on the fact that, like any other device, Nova shouldn't try to create them and we should rather ask the operator to pre-create the mediated devices, exaclty like we do for SR-IOV VFs. - we'll accordingly deprecate the mdev creation in the libvirt driver (but we'll continue to support it) and we'll log a warning if Nova has to create one mdev. - we'll change the nova-compute init script to raise a better exception explaining which mdev is missing - we'll document a procedure for explaining how to get existing mdev information and persist them by udev rules (for upgrade cases) # Robustify our compute hostname changes To be clear, at first step, we will continue to *NOT* support nova-compute hostname changes but we'll better detect the hostname change to prevent later issues. - first step to persist the compute UUID on disk seems a good candidate so a spec is targeted this cycle. - next steps could be to robustify our relationships between instance, compute node and service object records but this design will be deferred for later in a backlog spec. # Move to OpenStackClient and SDK OSC is already fully supported in Zed but it continues to rely on novaclient python bindings for calling the Nova API. - we agreed on modifying OSC to rather use openstacksdk (instead of novaclient) for communicating to the Nova APIs. Contributors welcome on this move. - we agreed on stopping to use project client libraries in nova services (eg. cinderclient used by nova-compute) and rather use openstacksdk directly. A 'rfe' bug per project client will be issued, anyone willing to work on it is welcome. - we also agreed on continuing to support novaclient for a couple of releases, as operators or other consumers of this package could require substantial efforts to move to the sdk. - we agreed on changing the release model for novaclient to be independent so we can release anytime we need. # Evacuate to target state We understand the usecase (evacuate an instance shouldn't always turn the evacuated instance on) - that said, we don't want to amend the API for passing a parameter as this would carry a tech debt indefinitely) - we prefer to propose a new microversion that would stop the instance eventually instead of starting it - operators wanting to keep the original behaviour would need to negociate an older microversion to the Nova API as we don't intend to make spawning optionally chosen by API on evacuate. (aaaaaaaaaaaaaaaand that's it for the PTG recap) Kudos, you were brave, you reached that point. Hope your coffee was good and now you feel rejuvenated. Anyway, time for me now to rest my fingers and to enjoy a deserved time off. As said, I'm all up for any questions or remarks that would come from the reading of this enormous thread. -Sylvain

2 1

[nova] Proposing EOL of nova project's old stable branches (Stein, Rocky, Queens)
by Elõd Illés 24 Oct '22

24 Oct '22

Hi, At the 2023.1 Antelope PTG, Nova team discussed that currently open Queens, Rocky and Stein branches for Nova teams' repositories will be moved to End of Life. There are multiple reasons behind this decision: - gate of these branches are broken for a couple of months now - zuul job definitions for these branches use the pre-"zuul-v3" [1] style, which makes the maintenance harder of these jobs - CI on Rocky and Queens use Ubuntu Xenial, which is also beyond its public maintenance window date And last but not least bugfix backports to these branches don't really get enough reviews anymore. If anyone has any interest to keep any of the above branches open then this is the last opportunity to step up, otherwise, as Nova team decided on the PTG, these branches will transition to End of Life. Please let us know before November 7th, we will proceed with the transition in case no responses will come till that day. [1] https://docs.openstack.org/project-team-guide/zuulv3.html Thanks in advance, Előd Illés irc:elodilles @ #openstack-nova

1 0

[telemetry][cloudkitty][ceilometer] Billing windows instances
by Thomas Goirand 24 Oct '22

24 Oct '22

Hi there! We're using telemetry+cloudkitty for our rating. We're happy of it, though we're having the issue that we would like to bill instances running Windows. The example given in the Cloudkitty doc shows how to bill more when an instance runs Windows. That works in theory, though in practice, Microsoft has a license model based on how many vCPU the instannce runs. So the model that the Cloudkitty documentation shows simply doesn't work with the SPLA thingy. We've looked at options. One way would of course writing a new custom pollster, but we don't like the idea: this would mean polling for all of the thousands of instances that are running in our deployments. So we would very much prefer having ceilometer running on compute node (with polling_namespaces=compute) to do the work, as this scales a way better. However, Ceilometer polls libvirt, which only has the information about the image ID, not the metadata associated with the image (like the property os_type=windows, for example). So, is there a better way than a dynamic pollster? Can this be done with ceilometer on the compute nodes? Cheers, Thomas Goirand (zigo)

2 3

Openstack cluster cannot create instances when 1 of 3 rabbitmq cluster node down
by Nguyễn Hữu Khôi 24 Oct '22

24 Oct '22

Description =========== I set up 3 controllers and 3 compute nodes. My system cannot work well when 1 rabbit node in cluster rabbitmq is down, cannot launch instances. It stucked at scheduling. Steps to reproduce =========== Openstack nodes point rabbit://node1:5672,node2:5672,node3:5672// * Reboot 1 of 3 rabbitmq node. * Create instances then it stucked at scheduling. Workaround =========== Point to rabbitmq VIP address. But We cannot share the load with this solution. Please give me some suggestions. Thank you very much. I did google and enabled system log's debug but I still cannot understand why. Nguyen Huu Khoi

5 9

Openstack Cinder and Nova Services cannot work when rabbitmq cluter node down
by Nguyễn Hữu Khôi 24 Oct '22

24 Oct '22

Title: Openstack cluster cannot create when 1 of 3 rabbitmq cluster node down Bug description: Description =========== I set up 3 controllers and 3 compute nodes. My system cannot work when 1 rabbit node in cluster rabbitmq is down, cannot create volume or launch instance. It stucked at creating and scheduling respectively. Steps to reproduce =========== Openstack nodes point rabbit://node1:5672,node2:5672,node3:5672// * Reboot 1 of 3 rabbitmq node. * Create volume or launch instance then it stucked at creating and scheduling respectively. Workaround =========== I need reboot cinder and nova services to create volume and launch instance . More Info: I see in cinder_scheduler, it looks like cinder cannot change to another rabbitmq node. I hope we have ideas for that.. 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task Traceback (most recent call last): 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/_drivers/amqpdriver.py", line 441, in get 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return self._queues[msg_id].get(block=True, timeout=timeout) 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/eventlet/queue.py", line 322, in get 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return waiter.wait() 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/eventlet/queue.py", line 141, in wait 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return get_hub().switch() 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/eventlet/hubs/hub.py", line 313, in switch2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return self.greenlet.switch() 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task _queue.Empty 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task During handling of the above exception, another exception occurred: 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task Traceback (most recent call last): 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_service/periodic_task.py", line 216, in run_periodic_tasks 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task task(self, context) 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/nova/compute/manager.py", line 9716, in _sync_power_states 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task db_instances = objects.InstanceList.get_by_host(context, self.host, 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_versionedobjects/base.py", line 175, in wrapper 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task result = cls.indirection_api.object_class_action_versions( 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/nova/conductor/rpcapi.py", line 240, in object_class_action_versions 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return cctxt.call(context, 'object_class_action_versions', 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/rpc/client.py", line 189, in call 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task result = self.transport._send( 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/transport.py", line 123, in _send 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return self._driver.send(target, ctxt, message, 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/_drivers/amqpdriver.py", line 689, in send 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task return self._send(target, ctxt, message, wait_for_reply, timeout, 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/_drivers/amqpdriver.py", line 678, in _send 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task result = self._waiter.wait(msg_id, timeout, 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/_drivers/amqpdriver.py", line 567, in wait 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task message = self.waiters.get(msg_id, timeout=timeout) 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task File "/var/lib/kolla/venv/lib/python3.8/site-packages/oslo_messaging/_drivers/amqpdriver.py", line 443, in get 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task raise oslo_messaging.MessagingTimeout( 2022-10-24 14:23:01.945 7 ERROR oslo_service.periodic_task oslo_messaging.exceptions.MessagingTimeout: Timed out waiting for a reply to message ID c8a676a9709242908dcff97046d7976d Nguyen Huu Khoi

1 0

[large-scale][oslo.messaging] RPC workers and db connection
by Arnaud Morin 24 Oct '22

24 Oct '22

Hey all, TLDR: How can I fine tune the number of DB connection on OpenStack services? Long story, with some inline questions: I am trying to figure out the maximum number of db connection we should allow on our db cluster. For this short speech, I will use neutron RPC as example service, but I think nova is acting similar. So, to do so, I identified few parameters that I can tweak: rpc_workers [1] max_pool_size [2] max_overflow [3] executor_thread_pool_size [4] rpc_worker default is half CPU threads available (result of nproc) max_pool_size default is 5 max_overflow default is 50 executor_thread_pool_size is 64 Now imagine I have a server with 40 cores, So rpc_worker will be 20. Each worker will have a DB pool with 5+50 connections available. Each worker will use up to 64 "green" thread. The theorical max connection that I should set on my database is then: rpc_workers*(max_pool_size+max_overflow) = 20*(5+50) = 1100 Q1: am I right here? I have the feeling that this is huge. Now, let's assume each thread is consuming 1 connection from the DB pool. Under heavy load, I am affraid that the 64 threads could exceed the number of max_pool_size+max_overflow. Also, I noticed that some green threads were consuming more than 1 connection from the pool, so I can reach the max even sooner! Another thing, I notice that I have 21 RPC workers, not 20. Is it normal? [1] https://docs.openstack.org/neutron/latest/configuration/neutron.html#DEFAUL… [2] https://docs.openstack.org/neutron/latest/configuration/neutron.html#databa… [3] https://docs.openstack.org/neutron/latest/configuration/neutron.html#databa… [4] https://docs.openstack.org/neutron/latest/configuration/neutron.html#DEFAUL… Cheers, Arnaud.

3 4

RE: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)
by Felix Hüttner 24 Oct '22

24 Oct '22

Sorry, no idea about that, for us the group also has write permissions -- Felix Huettner From: 박경원 <park0kyung0won(a)dgist.ac.kr> Sent: Monday, October 24, 2022 9:24 AM To: Felix Hüttner <felix.huettner(a)mail.schwarz>; openstack-discuss(a)lists.openstack.org Subject: RE: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem) Hello Felix Thank you very much for kind reply Do I also need to change permission setting of volume file in /var/lib/nova/mnt/... ? By default its: drwxr-x--- 2 64061 64061 11 Oct 24 04:19 99c4f7e8b15983b65e20cb7d37db899f group has only read and execute permission, no write permission ---------- 원본 메일 ---------- 보낸사람: "Felix Hüttner" <felix.huettner(a)mail.schwarz<mailto:felix.huettner@mail.schwarz>> 받는사람: "park0kyung0won(a)dgist.ac.kr<mailto:park0kyung0won@dgist.ac.kr>" <park0kyung0won(a)dgist.ac.kr<mailto:park0kyung0won@dgist.ac.kr>>, "openstack-discuss(a)lists.openstack.org<mailto:openstack-discuss@lists.openstack.org>" <openstack-discuss(a)lists.openstack.org<mailto:openstack-discuss@lists.openstack.org>> 날짜: 2022-10-24 (월) 16:12:48 제목: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem) Hi, we are solving this issue for us by creating a “cinder” group on all hypervisors with the same gid (64061 in your case). Then we add the nova user to the cinder group and we are fine afterwards. You might need set “dynamic_ownership = 0" In your libvirt qemu.conf -- Felix Huettner From: 박경원 <park0kyung0won(a)dgist.ac.kr<mailto:park0kyung0won@dgist.ac.kr>> Sent: Monday, October 24, 2022 7:21 AM To: openstack-discuss(a)lists.openstack.org<mailto:openstack-discuss@lists.openstack.org> Subject: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem) Hi I'm trying to setup cinder-volume service with NFS backend When I create a new VM instance with a volume from web UI, cinder-volume service on storage node creates volume file just fine But I get the following error on compute node and instance fails to spawn. 2022-10-24 02:14:25.347 402789 ERROR nova.compute.manager [req-47ec9fb1-9daa-4c24-8673-538797a217cc 8769cfaf608349bd9fbb36f92b188fe3 e1e8e8397cde49899b00d09dec76b29e - default default] [instance: 5acb1dc3-0685-4980-977b-b6dfff6dfb45] Instance failed to spawn: libvirt.libvirtError: internal error: process exited while connecting to monitor: 2022-10-24T02:14:24.819644Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30","aio":"native","node-name":"libvirt-2-storage","cache":{"direct":true,"no-flush":false},"auto-read-only":true,"discard":"unmap"}: Could not open '/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30': Permission denied I've added appropriate configs to apparmor profile. (Using Ubuntu 22.04) Apparmor isn't blocking this access. While the instance is spawning, I've checked ownership of the volume file on compute node: root@compute-node:/var/lib/nova/mnt$ ls -al total 17 drwxr-xr-x 3 nova nova 4096 Oct 24 04:19 . drwxr-xr-x 12 nova nova 4096 Oct 24 02:14 .. drwxr-x--- 2 64061 64061 11 Oct 24 04:19 99c4f7e8b15983b65e20cb7d37db899f It seems like cinder user on storage node creates volume file with UID/GID of 64061 (cinder user's UID/GID) But nova user on compute node has UID/GID of 64060, therefore cannot open volume file(/var/lib/nova/mnt/99c4f7e8b15983b65e20cb7d37db899f/volume-8f478992-dde3-4c20-9005-61cd34eacf30) Should I manually set the UID/GID of nova user on compute node to 64061, so both nova user on compute node and cinder user on storage node would have the same UID/GID? Feels like this duct taping isn't a proper solution. Did I miss something? Thank you Diese E Mail enthält möglicherweise vertrauliche Inhalte und ist nur für die Verwertung durch den vorgesehenen Empfänger bestimmt. Sollten Sie nicht der vorgesehene Empfänger sein, setzen Sie den Absender bitte unverzüglich in Kenntnis und löschen diese E Mail. Hinweise zum Datenschutz finden Sie hier<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.daten…>. Diese E Mail enthält möglicherweise vertrauliche Inhalte und ist nur für die Verwertung durch den vorgesehenen Empfänger bestimmt. Sollten Sie nicht der vorgesehene Empfänger sein, setzen Sie den Absender bitte unverzüglich in Kenntnis und löschen diese E Mail. Hinweise zum Datenschutz finden Sie hier<https://www.datenschutz.schwarz>.

1 0

RE: RE: [yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)
by 박경원 24 Oct '22

24 Oct '22

1 0

[yoga][cinder] Cinder NFS backend: Compute service cannot access volume file (UID/GID problem)
by 박경원 24 Oct '22

24 Oct '22

2 1

[largescale-sig] No meeting this week
by Thierry Carrez 23 Oct '22

23 Oct '22

Hi everyone, With the PTG just over, the Large Scale SIG will not be meeting this week. Our next regular IRC meeting will be November 9, at 1500utc on #openstack-operators on OFTC. Feel free to add topics to the agenda: https://etherpad.openstack.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

1 0

single Network interface
by Parsa Aminian 23 Oct '22

23 Oct '22

Hello I use kolla ansible wallaby version . my compute node has only one port . is it possible to use this server ? as I know openstack compute need 2 port one for management and other for external user network . Im using provider_networks and it seems neutron_external_interface could not be the same as network_interface because openvswitch need to create br-ex bridge on separate port is there any solution that i can config my compute with 1 port ?

7 9

[tc][all][policy][rbac] RBAC 2023.1 Antelope cycle Virtual PTG discussions summary
by Ghanshyam Mann 23 Oct '22

23 Oct '22

Hello Everyone, Last week, I tried to attend all the RBAC-related sessions on various projects. We mainly discussed the next steps on RBAC and implementing the project personas if not yet done. I captured the summary and outcome of the discussions of those projects in the below etherpad: Look for the section: "RBAC/Policy 2023.1 Antelope PTG summary". If I have missed any project discussion, please add it to the etherpad. - https://etherpad.opendev.org/p/rbac-goal-tracking One of the big outcomes, we agreed on all the projects (implemented phase-1) to enable the scope checks and new defaults by default. But before doing that, we need to test the new defaults and scope in Tempest (tempest plugin) integrated gate. I have started working on the job enabling the scope and new defaults[1]. [1] https://review.opendev.org/c/openstack/tempest/+/614484 -gmann

1 0

[tc][all][ Technical Committee 2023.1 Antelope cycle Virtual PTG discussions summary
by Ghanshyam Mann 23 Oct '22

23 Oct '22

Hello Everyone, I am summarizing the Technical Committee discussion that happened in the 2023.1 Antelope cycle PTG last week. Also, in case anyone wanted to search for all the projects etherpad later after ptgbot cleans them, I have added those to this wiki[1] Attendance: ========= * ~30 on Monday, ~25 on Thursday, ~20 on Friday Improvement in project governance: =========================== We continued the discussion from Monday and discussed a few high-level criteria which can be the potential criteria to monitor inactive projects. Along with contributors, event, and meeting occurrence is one of them but not all. JayF will be working on this to list the exact criteria/things TC can monitor to find and work on help inactive projects. User Survey: ========== * 2021 user Survey result analysis: We started with the pending review of the 2021 survey analysis[2]. There wasn't 2020 analysis so, the comparison was done using 2019. Overall, the trends in the survey were positive. We discussed adding the question about UI participants especially if users need new features to be implemented in UI then what prevents them to help and contribute? * 2022 User Survey result: knikolla and I will be working on the analysis of this survey result. jungleboyj will help on documenting the process and tips to analyze the survey xls which is not an easy task. Thanks to jungleboyj for doing the survey analysis and helping with the 2022 survey too. * 2023 User Survey question review: While doing the 2021 survey analysis, we discussed the below changes in 2023 survey. ** Remove "Other ways users participate:" ** Add: 1. how users are consuming OS. From pypi packages? From RHOSP? etc. 2. How are users interacting with OpenStack? Through Horizon? CLI? Skyline? An internally developed tool? etc. 3. Adding a sub-question about UI development help in "To which projects does your organization contribute maintenance resources such as patches for bugs and reviews on master or stable branches?" 4. Asking about what all OSS/software/services are used in your OpenStack provisioned cloud/resource. * Action: As the next step, we will work on the exact wording for the above questions and send it to Allison before the end of Oct month. Next step for OSC work ================== We started the discussion on sdk/osc should continue supporting the old interfaces even if we are not able to test them properly. Anyone running a very old cloud should be able to use the sdk/osc latest. We agree and Artem mentioned being more careful about removing the things. Next, we discussed where we stand on OSC work and direction from the project side and good progress from nova, neutron, and manila (might be a few more) but at the same time, many other projects need work on fixing the feature gaps. Glance is also in agreement to work towards OSC. There was a question on when and how we should work towards deprecating/removing the project's python client. The best way is to start implementing the new features in OSC and try their best to fill the old feature gap. Based on the current state, we agree to start this work as one of the community-wide and Artem volunteers to help here. * Action: ** Propose this as a community-wide goal "focus on fixing the feature gaps in osc not to remove the pythonclient which can be another goal" ** Look at devstack's use of OSC to see if we can enable token caching and perhaps use a smaller venv for performance Consistent and Secure Default RBAC ============================ As a good amount of the services are ready with the project personas, We will be testing them in the integrated gate (tempest and tempest plugins jobs), and based on the results we will enable the scope to enforce and new defaults enforce by default in this cycle. Also, services can start implementing phase 2 of the goal which is the service-to-service role. On Horizon question of moving to new defaults. because of the explicit policy files (with defaults) on the horizon side, the operator will not be able to just switch the flag until they change the policy file. For a better migration path and getting one more cycle to test the new defaults by default on the service side, it is better for Horizon to move to new defaults in the next cycle. FIPs goal ======= Ade lee provided the current status[3] of the goal which is good progress. There is work going on having the ubuntu based FIPs enabled job[4] and that will be to achieve the goal of having of voting job in the check/gate pipeline. Migrate CI/CD jobs to Ubuntu 22.04 (Jammy Jellyfish) ========================================= Projects are testing the jobs on Jammy but not all[5], we encourage the projects to start testing your project jobs before the deadline which is m-1 (Nov 18), and fix the issues if there are any. One known issue is Ceph job failing on Jammy as there aren't jammy upstream packages. There are packages in UCA and Ubuntu proper that could be used instead. The community-wide goal process in a world with few contributors =================================================== This topic is on how we can improve the community-wide goal progress and productivity but at the same time reduce the overhead on projects. Also, to highlight that the Champion of a goal is not required to do all the work and it is up to the champion. knikolla will work on the goal documentation to try goal overhead minimum. We will be more careful with goal selection to make sure if any work can be done without a community-wide goal then we should proceed that way. * Action: knikolla: see opportunities for rewording the community goal document. mention: striving to keep goals to a minimum to reduce overhead on teams and try to build consensus first. Pop-Up Team checks ================ We have two active popup teams, 1. Image Encryption 2. Policy(RBAC). Both have pending work to finish so will continue in this cycle also. Support policy for 32-bit platforms support ================================= Zigo is testing the OpenStack on 32-bit and filed bugs[6]. As we do not test it in the upstream CI/CD, we will not be committing to its support. But it is completely ok to fix the bug or add a skip in tests. Thanks to zigo for testing and reporting the bugs. Fixing docs build issues with recent Sphinx ================================ Sphinx is capped at 4.5.0 in upper constraints for a long time and whether we should move our doc to 6.0 or not is the question. Moving to 6.0 needs more work in openstackdocstheme. Until we have someone fixing things, it is ok to continue on Sphinx 4.5.0. Election retrospective: ================= We had a good amount of discussion on elections and many ideas to improve them in the future. Also by discussing the k8s election process with k8s steering committee members. We also discussed TC Chair election process to record the nomination in a better way. This is still not concluded and we continue the discussion in TC. Overall it was a productive discussion and we came up with below action items: *Action: 1. Extend the nomination and voting period to two weeks and also communicate the election well in advance. 2. Along with existing projects/SIG repos, add a few more related repos (governance, etc) in election tooling to count the electorate. 3. Add in the election process: call for AC on openstack-discuss or any other ML before the deadline. 4. Appoint a TC liaison as a point of contact to track the election dates more carefully and ICAL for election tasks will be a good idea to send/add. 5. Update the TC charter to mention the election period, and deadline explicitly. Cross-community sessions with k8s steering committee team: =============================================== We invited Kubernetes Steering Committee members to TC sessions. Tim and Christoph joined the sessions. This is a great way to collaborate between two communities. Following the introduction from both sides, we discussed various topics and share the process, challenges, and feedback from both sides. The election process, contributor recruiting, and how to engage them as long-term contributors. Also having part-time or non-corporate contributors is still a challenge for both communities. We also discussed the operator engagement challenges OpenStack is facing. Kubernetes operator thing is a bit complicated and they have app dev, cluster, app, and infra operator. Similar to OpenInfra foundation to the OpenStack community, CNCF foundation plays an important role for them to connect the operator with the community as much as possible. Discuss and clarify the supported upgrade-path testing in PTI: =============================================== To provide a better upgrade path, we decided to test the old distro version also whenever we will bump the distro version in our CI/CD. Below are details of the upgrade testing we will be following: Agree: * Supporting two distro versions when we bump the new distro version in any release: (this is only for the release bump of the distro and after that, we can go back to a single distro version testing) ** Run single tempest job in project gate on old distro version, not all jobs ** Add the previous python version unit test job in the new release testing template. * For non-SLURP releases, we will try not to change the testing runtime unless it is very much required due to the EOL of versions, we are using in testing. * In case the project has to add some feature that needs a new version of deps which is not supported in the old distro version then they need to be explicit about it and communicate in a better way. * Action: I will document the above in PTI. Guidelines for using the OpenStack release version/name and project version in 1. releasenotes 2. Documentation ===================================================================================== In Zed cycle, TC passed a resolution[7] and also prepared the guidelines[8] on using the release number as a primary identifier. During nova PTG, there was a question on what is the recommendation for using OpenStack version and package version (say Nova 27.0.0) in project documentation, releasenotes etc. After discussing the multiple options listed in etherpad we agree to go for the below: * OpenStack <release version> (<project> <project vesion>) Example: OpenStack 2023.1 (Nova 27.0.0) I will add this to the release identifier page[8] so that all projects can use it consistently. Discussion on projects (like neutron, ceilometer ) in Upper Constraints: ===================================================== Having projects in u-c makes it difficult for users to have a consistent deployment of those services. But we do not recommend using the u-c in production and it can be explicitly mentioned in the requirement and project-team-guide document. * Action: tonyb to document the upper constraints usage expectation (especially for production usage) in the requirement document as well as in project-team-guide[9]. Zed Retrospective: ============== In the end, we discussed the Zed cycle retrospective. * What went well? ** Good amount of work in the zed cycle[10] ** New TC members ** Good participation in meetings especially video call ** TC & Community Engagement (leaders interaction) improving *** i18 SIG team having there helped to proceed with i18 SIG work One thing to improve next time is to explicitly call out the team/members with a courtesy ping for future PTG if any related discussion. We do send the agenda on ML in advance but no harm in ping also. Meeting time check: =============== TC weekly Video calls are more productive compared to text meetings and we will do two video calls in a month. We will also start a poll to select the meeting time. 2023.1 cycle TC Tracker ================== I prepared the TC tracker for 2023.1 and listed all the actionable working items that came up during the PTG discussion. This is helpful for tracking the working items. - https://etherpad.opendev.org/p/tc-2023.1-tracker Thank you for reading the summary or I will say detailed summary :), have a nice weekend everyone. [1] https://wiki.openstack.org/wiki/PTG/2023.1/Etherpads [2] https://review.opendev.org/c/openstack/governance/+/836888 [3] https://etherpad.opendev.org/p/fips_goal_status [4] https://review.opendev.org/c/openstack/project-config/+/861457/ [5] https://etherpad.opendev.org/p/migrate-to-jammy [6] https://bugs.launchpad.net/glance-store/+bug/1991406 [7] https://governance.openstack.org/tc/resolutions/20220524-release-identifica… [8] https://governance.openstack.org/tc/reference/release-naming.html [9] https://docs.openstack.org/project-team-guide/dependency-management.html [10] https://etherpad.opendev.org/p/tc-zed-tracker -gmann

1 0

[tc][all][ptg] "Technical Committee + Leaders interaction" 2023.1 cycle vPTG sessions summary
by Ghanshyam Mann 23 Oct '22

23 Oct '22

Hello Everyone, I am writing the Technical Committee + Leader interaction session discussion summary that happened in the 2023.1 Antelope cycle PTG this week. We continue the interaction session in this PTG also. The main idea here is to interact with community leaders and ask for their feedback on TC. I am happy to see ~30 attendance and had a good amount of discussions. Below are the topics we discussed in this feedback session. Updates from TC: ============= * Conveying current selected Community-wide goals. * Avoid Bare recheck * TC PTG slots: 15-19 UTC on Thursday and Friday * Status on previous PTG interaction sessions' Action items/feedback: ** PTLs/Leaders to start spreading the word and monitor ignorant recheck in their weekly meeting Status: Good progress in this, many projects started monitoring it and slaweq continues contacting the PTL for this. But we still encourage PTLs/Leaders to publish the blog/video of their stories/project updates etc at least once in a cycle. You can check the places where to publish such blogs/videos [1]. ** Recognize the contribution: Status: Not done, we are continuing this AI and will work on it this cycle. ** Bare Recheck: Status: Done. TC is monitoring the bare recheck in the weekly meetings and slaweq reaching out to projects to do the same in their weekly meeting. Feedback on TC activities or anything Community Leaders would like TC to spend more time on: ========================================================================= * Continue the TC weekly summary email which is helpful * TC to build a review process that would happen periodically to check the project status. Basically to ensure the project status as per "Emerging Technology and Inactive projects"[2]. JayF volunteered to work on this to write some documentation or resolution. ** Action Item: 1. JayF to write a resolution on criteria/flag to identify/action on the inactive projects. Renovate translation SIG i18: ====================== Ian and Seongsoo joined the discussion to provide the current state and help needed in i18 SIG. We collected some information on translation usage, language, and content(GUI, doc, log etc). Motoki updated information from the Japan group but still, needs more information from other groups/translation users and agrees to add some queries in the 2023 user survey. Also, Brian will investigate the possibility of migration to weblate tool. * Action Item: 1. rosmaita: draft questions for the survey, get feedback from ian and seongsoo 2. rosmaita: follow up with weblate service to determine whether OpenStack qualifies for gratis service 3. Ian to reach out to contributors/users to know the translation requirements for applicable language. Possibilities to avoid RC time issues with Oslo release: ======================================== After discussing the issue that occurred for Sqlalchemy 2.0 related merge in the zed cycle, we discuss one option to propose the non-client feature freezes to m-2 and get more feedback from Oslo or other non-client lib maintainers. Also, we encourage adding the lib forward testing which tests the integration gate with the master version of lib which can help to find the issues while the code merges itself. As discussed Elod proposed the review to get more feedback[3] and also email it to ML[4]. After getting feedback from Oslo maintainer it seems it is not a good idea to preponed the lib feature freeze. Discussion is going on in ML[4]. Clean up Zuul config errors: ===================== At the end of the session, we discussed the current zuul config error in OpenStack projects. TC is actively working on this and knikolla and other members trying to fix them as much as possible. Please check your projects and fix them, priority is to fix the master and supported branches, not the EM state branches. [1] https://docs.openstack.org/project-team-guide/spread-the-word.html [2] https://governance.openstack.org/tc/reference/emerging-technology-and-inact… [3] https://review.opendev.org/c/openstack/releases/+/861900 [4] https://lists.openstack.org/pipermail/openstack-discuss/2022-October/030914… -gmann

1 0

Follow up on https://storyboard.openstack.org/#!/story/2010377
by rajiv mucheli 22 Oct '22

22 Oct '22

Hi, Unlike Openstack Yoga, where the setuptools version was set in upper-contstraints.txt. This is not set in Openstack Zed, which uses jammy with python 3.10. I get the below while performing few tests : - [[ -f /failure ]] - echo Wheel failed to build - cat /failure Wheel failed to build thrift===0.16.0 python-nss===1.0.1 We will need to stay with setuptools <58 to fix the 2to3 compiler issue, else anyjson packages adds up to the above list, but thrift is removed when setuptools >63. Regards, Rajiv

2 5

[PTL][TC] library *feature* freeze at Milestone-2
by Elõd Illés 22 Oct '22

22 Oct '22

Hi, During 'TC + Community leaders interaction' [1] a case was discussed, where a late library release caused last minute fire fighting in Zed cycle, and people discussed the possibility to introduce a (non-client) library *feature* freeze at Milestone-2 to avoid similar issues in the future. I've started to propose the possible schedule change [2] (note: it's not ready yet as it does not emphasize that at Milestone-2 we mean *feature* freeze for libraries, not "final library release"). The patch already got some reviews from library maintainers so I'm calling the attention to this change here on the ML. Thanks everyone for the responses in advance, Előd [1] https://lists.openstack.org/pipermail/openstack-discuss/2022-October/030718… [2] https://review.opendev.org/c/openstack/releases/+/861900

4 5

[neutron]: DVR with OVN
by Farhad Sunavala 22 Oct '22

22 Oct '22

Hi, Just want to get a feel with how users are using DVR with OVN especially for a medium sized installation (500 nodes, 3000-4000 VMs)Are you just using it in the default configuration with all the complexities and just take the hit when troubleshooting why a particular path doesn't work as expected? Are you taking precautions such as providing VMs with a separate direct path to the public network in case the main interface connected to DVR fails?See OpenInfra 17th minute of Live Ep. 26 Large Scale Neutron Best Practices @ (340) OpenInfra Live Ep. 26: Large Scale OpenStack: Neutron Scaling Best Practices - YouTube | | | | | | | | | | | OpenInfra Live Ep. 26: Large Scale OpenStack: Neutron Scaling Best Pract... | | | Is DVR with OVN reasonably solid for production environments that makes you comfortable enough to use it in installations with around 5000 VMs? thanks,Fred.

1 0

[tripleo] gate blocker centos 9 content provider - trending fixed
by Marios Andreou 21 Oct '22

21 Oct '22

Hello FYI (few folks asking in irc apologies should have sent sooner) gate blocker on the content provider https://bugs.launchpad.net/tripleo/+bug/1984237/comments/5 thanks chkumar we are trying to get a fix through gate at https://review.opendev.org/c/openstack/tripleo-quickstart/+/856582 please hold your recheck until that merges or use depends-on thank you!

2 1

Track Chair Nominations Close in One Week!
by Helena Spease 21 Oct '22

21 Oct '22

Hey everyone! Track Chair nominations <https://openinfrafoundation.formstack.com/forms/trackchairnominations2023> for the 2023 OpenInfra Summit in Vancouver (June 13-15, 2023) are closing soon! Please submit your nominations before they close on October 28, 2022 Track Chairs for each Track will help build the Summit schedule, and are made up of individuals working in open infrastructure. Responsibilities include: - Help the Summit team put together the best possible content based on your subject matter expertise - Promote the individual Tracks within your networks - Review the submissions and Community voting results in your particular Track - Determine if there are any major content gaps in your Track, and if so, potentially solicit additional speakers directly to submit - Ensure diversity of speakers and companies represented in your Track - Avoid vendor sales pitches, focusing more on real-world user stories and technical, in-the-trenches experiences 2023 Summit Tracks: - 5G/NFV & Edge - AI/Machine Learning/HPC - CI/CD - Container Infrastructure - Getting Started - Hardware Enablement - Open Development - Private & Hybrid Cloud - Public Cloud - Security - Hands On Workshops Full track descriptions are available here <https://openinfra.dev/summit/vancouver-2023/summit-tracks/>. If you’re interested in nominating yourself or someone else to be a member of the Summit Track Chairs for a specific Track, please fill out the nomination form <https://openinfrafoundation.formstack.com/forms/trackchairnominations2023>. Nominations will close on October 28th, 2022. Track Chairs selections will occur before we close the Call for Presentations (CFP) so that the Chairs can host office hours to consult on submissions, and help promote the event. CFP will be opening in November, registration <https://openinfrasummit2023.eventbrite.com/> and sponsorship <http://openinfra.dev/summit/vancouver-2023/summit-sponsor/> information are already available. Please email speakersupport(a)openinfra.dev with any questions or feedback. Cheers, Helena Spease

1 0

[ptl][release][stable][EM] Extended Maintenance - Wallaby
by Elõd Illés 21 Oct '22

21 Oct '22

Hi, In less than a two weeks Wallaby is planned to transition to Extended Maintenance phase [1] (planned date: November 2nd, 2022). The release patches for the transition have been generated [2], these patches mark the latest release in stable/wallaby with wallaby-em. PTLs and release liaisons are encouraged to approve them as soon as possible, by latest before the transition date. After the transition stable/wallaby will be still open for bug fixes, but there won't be any official releases. Note: if a team wants to do a final release before the transition, then it can be done, but be careful to not release fixes that could break things to avoid broken releases as *final* stable Wallaby release. Thanks, Előd irc: elodilles @ #openstack-releases [1] https://releases.openstack.org/ [2] https://review.opendev.org/q/topic:wallaby-em

1 0

Seeking help for Keystone Error while assign_role_to_user for a Project in Openstack SDK
by Ayush Jaiswal 21 Oct '22

21 Oct '22

Hi Team, I am using the Openstack SDK in my django rest api project where I have to create a new project and assign various users with different roles to that project in openstack. However, while adding a user to a project I am getting the following error. [image: image.png] Complete details of the steps I followed that resulted in this error are in the text file attached with this email. Kindly help me resolve this issue. Your support is highly appreciated. -- Thanks and Regards, Ayush Jaiswal

1 0

[victoria] Loose network on all instance.
by Albert Shih 21 Oct '22

21 Oct '22

Hi, I've a small openstack installation running Victoria on Ubuntu 20 LTS. After a update (not upgrade) of Ubuntu, I loose all network on all my instance. On a instance console I got : [[0;32m OK [0m] Started [0;1;39mifup for ens3[0m. Starting [0;1;39mRaise network interfaces[0m... [[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 4s / 6min 2s) M[K[[0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 4s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 5s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 5s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m*[0m] A start job is running for Raise ne��ork interfaces (1min 6s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m] A start job is running for Raise ne��ork interfaces (1min 6s / 6min 2s) M[K[ [0;31m*[0m] A start job is running for Raise ne��ork interfaces (1min 7s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m] A start job is running for Raise ne��ork interfaces (1min 7s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m*[0m] A start job is running for Raise ne��ork interfaces (1min 8s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 8s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 9s / 6min 2s) M[K[[0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (1min 9s / 6min 2s) M[K[[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 10s / 6min 2s) M[K[[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 10s / 6min 2s) M[K[[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 11s / 6min 2s) M[K[[0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 11s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 12s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��rk interfaces (1min 12s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m*[0m] A start job is running for Raise ne��rk interfaces (1min 13s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m] A start job is running for Raise ne��rk interfaces (1min 13s / 6min 2s) M[K[ [0;31m*[0m] A start job is running for Raise ne��rk interfaces (1min 14s / 6min 2s) ...... ...... M[K[ [0;31m*[0;1;31m*[0m] A start job is running for Raise ne��rk interfaces (2min 59s / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m*[0m] A start job is running for Raise network interfaces (3min / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise network interfaces (3min / 6min 2s) M[K[ [0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 1s / 6min 2s) M[K[[0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 1s / 6min 2s) M[K[[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 2s / 6min 2s) M[K[[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 2s / 6min 2s) M[K[[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 3s / 6min 2s) M[K[[0;31m*[0;1;31m*[0m[0;31m* [0m] A start job is running for Raise ne��ork interfaces (3min 3s / 6min 2s) M[K[[0;32m OK [0m] Finished [0;1;39mRaise network interfaces[0m. [K[[0;32m OK [0m] Reached target [0;1;39mNetwork[0m. Starting [0;1;39mInitial cloud-ini�� (metadata service crawler)[0m... [ 186.709234] cloud-init[514]: Cloud-init v. 20.4.1 running 'init' at Thu, 20 Oct 2022 20:12:41 +0000. Up 186.69 seconds. [ 186.727021] cloud-init[514]: ci-info: ++++++++++++++++++++++++++++++++++++Net device info+++++++++++++++++++++++++++++++++++++ [ 186.728928] cloud-init[514]: ci-info: +--------+------+------------------------------+-----------+-------+-------------------+ [ 186.730709] cloud-init[514]: ci-info: | Device | Up | Address | Mask | Scope | Hw-Address | [ 186.732694] cloud-init[514]: ci-info: +--------+------+------------------------------+-----------+-------+-------------------+ [ 186.734765] cloud-init[514]: ci-info: | ens3 | True | fe80::f816:3eff:fec3:2e6c/64 | . | link | fa:16:3e:c3:2e:6c | [ 186.736681] cloud-init[514]: ci-info: | lo | True | 127.0.0.1 | 255.0.0.0 | host | . | [ 186.738473] cloud-init[514]: ci-info: | lo | True | ::1/128 | . | host | . | [ 186.740246] cloud-init[514]: ci-info: +--------+------+------------------------------+-----------+-------+-------------------+ [ 186.741723] cloud-init[514]: ci-info: +++++++++++++++++++Route IPv6 info+++++++++++++++++++ [ 186.742306] cloud-init[514]: ci-info: +-------+-------------+---------+-----------+-------+ [ 186.742881] cloud-init[514]: ci-info: | Route | Destination | Gateway | Interface | Flags | [ 186.743460] cloud-init[514]: ci-info: +-------+-------------+---------+-----------+-------+ [ 186.744075] cloud-init[514]: ci-info: | 1 | fe80::/64 | :: | ens3 | U | [ 186.744681] cloud-init[514]: ci-info: | 3 | local | :: | ens3 | U | [ 186.745255] cloud-init[514]: ci-info: | 4 | multicast | :: | ens3 | U | [ 186.745833] cloud-init[514]: ci-info: +-------+-------------+---------+-----------+-------+ in the log of neutron-linuxbridge-agent.log it seem everything should work : 2022-10-20 20:17:54.967 59611 INFO neutron.plugins.ml2.drivers.agent._common_agent [req-9e6b23d3-1e0e-4c48-8f0e-30d761233188 - - - - -] Port tap4f68bcf1-4d updated. Details: {'device': 'tap4f68bcf1-4d', 'network_id': '9223f9ff-7ab0-4268-9b7f-3b5966625c65', 'port_id': '4f68bcf1-4d32-4ad3-a0df-0415f7170c5d', 'mac_address': 'fa:16:3e:c3:2e:6c', 'admin_state_up': True, 'network_type': 'flat', 'segmentation_id': None, 'physical_network': 'provider', 'mtu': 1500, 'fixed_ips': [{'subnet_id': '12cdcc06-bbf0-48f2-b303-bdfab460c696', 'ip_address': '145.238.137.52'}], 'device_owner': 'compute:nova', 'allowed_address_pairs': [], 'port_security_enabled': True, 'qos_policy_id': None, 'network_qos_policy_id': None, 'profile': {}, 'propagate_uplink_status': False} But I'm unable to ping any instance. Any idea ? Regards -- Albert SHIH 🦫 Observatoire de Paris France Heure locale/Local time: jeu. 20 oct. 2022 22:47:15 CEST

2 1

[designate] [release] Proposing to EOL Designate stable branches Queens, Rocky, Stein, and Train
by Michael Johnson 21 Oct '22

21 Oct '22

Today at the Designate PTG session we discussed the number of stable branches (10) we are carrying for Designate and the lack of interest in maintaining them. For example, there has not been a patch merged on the Queens branch for over two years. Based on the discussion, and lack of patches merged to the older branches, I am proposing we move the Queens, Rocky, Stein, and Train stable branches from extended maintenance to end-of-life status. The definition of this process is part of the project team guide[1]. I plan to propose patches for the required changes next week. If you would like to maintain one of these branches, please respond to this email and post a patch to the branch to resolve any existing issues on the older branches. Michael [1] https://docs.openstack.org/project-team-guide/stable-branches.html#end-of-l…

1 0

[i18n] questions for the user survey
by Brian Rosmaita 21 Oct '22

21 Oct '22

Hello people interested in internationalization, At the PTG this week, the i18n SIG drafted some questions for the 2023 OpenStack User Survey. Please look them over and leave any comments on the etherpad: https://etherpad.opendev.org/p/oct2022-ptg-openstack-i18n-user-survey-quest… We need to get these to the Foundation quickly, so please leave your comments before 1200 UTC on Monday 24 October.

1 0

[glance] Slow image download when using glanceclient
by Lucio Seki 20 Oct '22

20 Oct '22

Hi glance experts, I'm using the following code to download a glance image: ``` from glanceapi import client ... glance = client.Client(GLANCE_API_VERSION, session=sess) ... with open(path, 'wb') as image_file: data = glance.images.data(image_id) for chunk in tqdm(data, unit='B', unit_scale=True, unit_divisor=1024): image_file.write(chunk) ``` And I get a speed around 3kB/s. It would take months to download an image. I'm using python3-glanceclient==3.6.0. I even tried: ``` for chunk in tqdm(data, unit='B', unit_scale=True, unit_divisor=1024): pass ``` to see if the bottleneck was the disk I/O, but didn't get any faster. In the same environment, when I use the glance CLI instead: ``` glance image-download --file $path $image_id ``` I get hundreds of MB/s download speed, and it finishes in a few minutes. Is there anything I can do to improve the glanceclient performance? I'm considering using subprocess.Popen(['glance', 'image-download', ...]) if nothing helps... Regards, Lucio

3 6

[all][tc] 2023.1 Antelope TC-PTG Planning
by Ghanshyam Mann 20 Oct '22

20 Oct '22

Hello Everyone, As you already know that the 2023.1 cycle virtual PTG will be held between Oct 17th - 21[1]. I have started the preparation for the Technical Committee PTG sessions. Please do the following: 1. Fill the below poll as per your availability. - https://framadate.org/yi8LNQaph5wrirks 2. Add the topics you would like to discuss to the below etherpad. - https://etherpad.opendev.org/p/tc-2023-1-ptg NOTE: this is not limited to TC members only; I would like all community members to fill the doodle poll and, add the topics you would like or want TC members to discuss in PTG. [1] https://lists.openstack.org/pipermail/openstack-discuss/2022-August/030041.… -gmann

2 4

[PTG][nova][neutron] Nova-Neutron cross-team meetings
by Rodolfo Alonso Hernandez 20 Oct '22

20 Oct '22

Hello all: The Nova-Neutron cross-team sessions today, starting at 13UTC, will be on Nova channel "bexar". In any case, I'll send an update in our IRC channel and I'll keep "mitaka" session open to redirect people to "bexar". Regards.

1 0

[dev][infra][tact-sig] Updating Zuul's default-ansible-version to 6
by Jeremy Stanley 19 Oct '22

19 Oct '22

Just a heads up for folks not following the OpenDev Collaboratory's service-announce mailing list... now that Zed is officially released, we'll be increasing the default Ansible version for Zuul jobs from 5 to 6 in preparation for Zuul to drop Ansible 5 support in coming weeks. See the full announcement here: https://lists.opendev.org/pipermail/service-announce/2022-October/000046.ht… -- Jeremy Stanley

2 1

[horizon] Cancelling Two Weekly Meeting
by vishal manchanda 19 Oct '22

19 Oct '22

Hello Team, As discussed in Yesterday's PTG meeting, there will be no horizon weekly meeting for today and next week. The next horizon weekly meeting will be on 2nd November. Thanks & Regards, Vishal Manchanda

1 0

DC DR Setup Queries
by KK CHN 19 Oct '22

19 Oct '22

List, We are having a client DC running on HP( HP simplivity) HCI servers, With VMware ( Vsphere 7.0) only few VMs running on it. (11 VMs maximum all Linux VMs). The DR site also having the same HCI setup another location. ( The VMs are replicated to DR site with HP simplivity). We are planning to use Openstack for both DC and DR solutions with Wallaby or Xena version with KVM as hypervisor to replace the proprietary S/W and H/W vendor locking. The requirement is to Setup a Stable DC- DR solution. Totally confused How to setup a best Dc- DR solution for this purpose. The DR setup can be possible / advisable with Zero down time ?( or manual DR site uping with downtime of hours ) ? What are the available/suggested DC-DR replication mechanisms for high degree of application data protection and service availability? Kindly advise.. Thanks in advance, Krish

2 2

[cloudkitty] Another core team cleanup
by Pierre Riteau 18 Oct '22

18 Oct '22

Hello, Almost exactly two years since the last core team cleanup [1], it's probably time to have another one. I don't think we have heard from these contributors in the last couple of years: Justin Ferrieu jferrieu(a)objectif-libre.com Luis Ramirez luis.ramirez(a)opencloud.es Luka Peschke mail(a)lukapeschke.com Maxime Cottret maxime.cottret(a)gmail.com Stéphane Albert sheeprine(a)nullplace.com Jeremy Liu liuj285(a)chinaunicom.cn Is everyone okay with removing cloudkitty-core membership for these users? Cheers, Pierre Riteau (priteau) [1] https://lists.openstack.org/pipermail/openstack-discuss/2020-October/017751…

2 3

[ovn][neutron] RE: OVN BGP Agent query
by Ihtisham ul Haq 18 Oct '22

18 Oct '22

Hi Luis and Daniel, Please see inline response. > From: Daniel Alvarez Sanchez <dalvarez(a)redhat.com> > Sent: 29 September 2022 11:37 > Subject: Re: OVN BGP Agent query > > Hi Ihtisham and Luis, > > On Thu, Sep 29, 2022 at 7:42 AM Luis Tomas Bolivar <ltomasbo(a)redhat.com> wrote: > > Some comments and questions inline > > > > On Tue, Sep 27, 2022 at 1:39 PM Ihtisham ul haq <ihtisham.uh(a)hotmail.com> wrote: > > > Hi Luis, > > > > > > Thanks for your work on the OVN BGP Agent. We are planning > > > to use it in our OVN deployment, but have a question regarding it. > > > > Great to hear! Can you share a bit more info about this environment? like > > openstack version, target workload, etc. We plan to use this with Yoga version. Our workload consist of enterprise users with VMs running on Openstack and connected to their enterprise network via transfer network(to which the customer neutron router is attached to). And we also have public workload but with the ovn-bgp we only want to we want to advertise the former. > > > > > The way our current setup with ML2/OVS works is that our customer VM IP routes > > > are announced via the router IP(of the that customer) to the leaf switch instead of > > > the IP of the host where the neutron BGP agent runs. And then even if the > > > router fails over, the IP of the router stays the same and thus the BGP route > > > doesn't need to be updated. > > > > Is this with Neutron Dynamic Routing? When you say Router IP, do you mean the virtual neutron router and its IP associated with the provider network? What type of IPs are you announcing with BGP? IPs on provider network or on tenant networks (or both)? Yes, that's with Neutron DR agent, and I meant virtual neutron router with IP from the provider network. We announce IPs of our tenant network via the virtual routers external address. > > If the router fails over, the route needs to be updated, doesn't it? Same IP, but exposed in the new location of the router? Correct. > The route to the tenant network doesn't change, ie. > 192.168.0.0 via 172.24.4.100 (this route remains the same regardless of where 172.24.4.100 is). > If there's L2 in the 172.24.4.0 network, the new location of 172.24.4.100 will be learnt via GARP announcement. In our case, this won't happen as we don't have L2 so we expose directly connected routes to overcome this "limitation". Right, in our case we have a stretched L2 transfer network(mentioned above) to which our gateway nodes and customer routers are connected to, so we can advertise the IPs from the tenant network via the virtual router external IP and thus the location of the router isn't relevant in case of failover as its address will be relearned. > In the case of Neutron Dynamic Routing, there's no assumption that everything is L3 so GARPs are needed to learn the new location. > > > > We see that the routes are announced by the ovn-bgp-agent via the host IP(GTW) in our > > > switch peers. If that's the case then how do you make sure that during failover > > > of a router, the BGP routes gets updated with the new host IP(where the router > > > failed over to)? > > > > The local FRR running at each node is in charge of exposing the IPs. For the IPs on the provider network, the traffic is directly exposed where the VMs are, without having to go through the virtual router, so a router failover won't change the route. > > In the case of VMs on tenant networks, the traffic is exposed on the node where the virtual router gateway port is associated (I suppose this is what you refer to with router IP). In the case of a failover the agent is in charge of making FRR to withdraw the exposed routes on the old node, and re-advertise them on the new router IP location > > > > > Can we accomplish the same route advertisement as our ML2/OVS setup, using the ovn-bgp-agent? > > I think this is technically possible, and perhaps you want to contribute that functionality or even help integrating the agent as a driver of Neutron Dynamic Routing? Sounds good, our plan currently is to add this to the ovn-bgp-agent, so we can announce our tenant routes via virtual routers external address on a stretched L2 network, to make it work with our use case. -- Ihtisham ul Haq Diese E Mail enthält möglicherweise vertrauliche Inhalte und ist nur für die Verwertung durch den vorgesehenen Empfänger bestimmt. Sollten Sie nicht der vorgesehene Empfänger sein, setzen Sie den Absender bitte unverzüglich in Kenntnis und löschen diese E Mail. Hinweise zum Datenschutz finden Sie hier<https://www.datenschutz.schwarz>.

3 5

[kolla] Monasca removal, Kafka and Zookeeper deprecation/removal
by Michał Nasiadka 18 Oct '22

18 Oct '22

Hello, As Kolla/Kolla-Ansible projects are implementing switch to OpenSearch - it became obvious to remove Elasticsearch (which is EOL in Kolla-provided version) and orchestrate a direct upgrade into OpenSearch. Part of this work is removal of elasticsearch and log stash Kolla container images and elasticsearch role in Kolla-Ansible. Since Monasca is relying on Elasticsearch and Logstash - and there are no contributors willing to make it work with OpenSearch inside Kolla/Kolla-Ansible - we decided to drop Monasca support in Zed release (especially that the CI jobs have been long failing). One of the Monasca dependencies is Kafka (and ZooKeeper) - is there anybody using it outside of Monasca deployment in Kolla/Kolla-Ansible? If in 4 weeks there will be no answers to this question - we will also remove Kafka and ZooKeeper container images in Kolla (and their respective roles in Kolla-Ansible). Thanks Michal

1 0

[cinder] cancelling this week's meeting (19 Oct)
by Rajat Dhasmana 18 Oct '22

18 Oct '22

Hello Argonauts, Since we've PTG this week, we will not be conducting the weekly meeting on 19th Oct 2022 but everyone is recommended to attend the PTG instead[1]. See you all at the PTG! [1] https://etherpad.opendev.org/p/antelope-ptg-cinder Thanks and regards Rajat Dhasmana

1 0

[kolla] Weekly meeting 20th Oct 2022
by Michał Nasiadka 18 Oct '22

18 Oct '22

Hello, Since this is PTG week - this week meeting is cancelled. Best regards, Michal

1 0

[tacker] Cancelling IRC meeting on Oct 18
by Yasufumi Ogawa 18 Oct '22

18 Oct '22

Hi team, Since we're going to have the vPTG session, I'd like to cancel IRC meeting today. Thanks, Yasufumi

1 0

[keystone] Cancelling weekly meeting for 10/18/22
by Dave Wilde 18 Oct '22

18 Oct '22

Cancelling due to the PTG

1 0

[ptls][tc] 2022 OpenStack User Survey Project Question Responses
by Allison Price 17 Oct '22

17 Oct '22

Hi everyone, Please find attached the responses to the project questions from the 2022 OpenStack User Survey. Based on feedback last year, I included additional, non-identifiable information that will hopefully help provident deployment context for the responses to your questions. If you need a reminder of your project question, you can review the OpenStack User Survey [1]. During the PTG, I would encourage you and your teams to review the responses and decide if you would like to make any changes to your question for the 2023 OpenStack User Survey. It is live now, but we can make changes ahead of significant promotion. Please reach out to me directly with any changes. If you have any questions on how to read the results, please let me know. Have a great week at the PTG! Cheers, Allison [1] https://www.openstack.org/usersurvey

2 4

[kolla][ptg] Meetings on Tuesday 18th Oct
by Michał Nasiadka 17 Oct '22

17 Oct '22

Hello Koalas, Due to exhaustion of topics - we’re meeting tomorrow only on the Kolla Operator Hour at 16 UTC. Kolla Operator Hour Etherpad: https://etherpad.opendev.org/p/oct2022-ptg-operator-hour-kolla Best regards, Michal Nasiadka

1 0

[manila] Cancelling two weekly meetings
by Carlos Silva 17 Oct '22

17 Oct '22

Hello, Zorillas! As agreed in the previous week, we will be cancelling the next two weekly meetings: from this week (Oct 20th) and next week (Oct 27th). The next weekly meeting for Manila will be on Nov 3rd. Thank you, carloss

1 0

[release] Release countdown for week R-22, Oct 17 - 21
by Előd Illés 17 Oct '22

17 Oct '22

Hi, Welcome back to the release countdown emails! These will be sent at major points in the 2023.1 Antelope development cycle, which should conclude with a final release on March 22nd, 2023. Development Focus ----------------- At this stage in the release cycle, focus should be on planning the 2023.1 Antelope development cycle, assessing 2023.1 Antelope community goals and approving 2023.1 Antelope specs. General Information ------------------- 2023.1 Antelope is a 24 weeks long development cycle. In case you haven't seen it yet, please take a look over the schedule for this release: https://releases.openstack.org/antelope/schedule.html By default, the team PTL is responsible for handling the release cycle and approving release requests. This task can (and probably should) be delegated to release liaisons. Now is a good time to review release liaison information for your team and make sure it is up to date: https://opendev.org/openstack/releases/src/branch/master/data/release_liais… By default, all your team deliverables from the Zed release are continued in 2023.1 Antelope with a similar release model. Upcoming Deadlines & Dates -------------------------- Virtual PTG: October 17-21, 2022 Antelope-1 milestone: November 17th, 2022 Előd Illés irc: elodilles @ #openstack-release

1 0

[openstack-helm] No Weekly IRC Meeting - PTG
by Gage Hugo 17 Oct '22

17 Oct '22

Hey team, This week is the PTG so the weekly IRC meeting is cancelled. We will be meeting for an hour at the same time slot for our PTG session: https://ptg.opendev.org/ptg.html

1 0

[0SSN-0090] Best practices when configuring Glance with COW backends
by Brian Rosmaita 17 Oct '22

17 Oct '22

Best practices when configuring Glance with COW backends --- ### Summary ### When deploying Glance in a popular configuration where Glance shares a common storage backend with Nova and/or Cinder, it is possible to open some known attack vectors by which malicious data modification can occur. This note reviews the known issues and suggests a Glance deployment configuration that can mitigate such attacks. ### Affected Services / Software ### Glance, all supported releases (Queens through Zed) ### Discussion ### This note applies to you if you are operating an end-user-facing glance-api service with the 'show_multiple_locations' option set to True (the default value is False) or if your end-user-facing glance-api has the 'show_image_direct_url' option set to True (default value is False). Our recommendation is that the image "locations" and "direct_url" fields [0] *never* be displayed to end users in a cloud. This can be accomplished by running two glance-api services: - A "user-facing" glance-api that is accessible to end users and which appears in users' service catalogs. - An "internal-only-facing" glance-api that is accessible only to those services that require access to the 'direct_url' or image location fields, and which is protected by firewalls from access by end users. (Nova, Cinder, and Ironic all have configuration options to specify the Glance API endpoint each service uses [1].) This dual glance-api deployment was suggested in "Known Issues" in Glance release notes in the Rocky [2] through Ussuri releases, but it seems that the idea has not received sufficient attention. Hence this security note. The attack vector that becomes available when image locations are exposed to end users was originally outlined in OSSN-0065 [3], though that note was not clear about the attack surface or mitigation, and contained some forward-looking statements that were not fulfilled. The attack vector is: [A] malicious user could create an image in Glance, set an additional location on that image pointing to an altered image, then delete the original location, so that consumers of the original image would unwittingly be using the malicious image. Note, however, that this attack vector cannot change the original image's checksum, and it is limited to images that are owned by the attacker. OSSN-0065 suggests that this is only an issue when users do not checksum their image data. It neglects the fact that in some popular deployment configurations in which Nova creates a root disk snapshot, data is never uploaded to Glance, but instead a snapshot is created directly in the backend and Nova creates a Glance image record with "size" 0 and an empty "os_hash_value" [4], making it impossible to compare the hash of downloaded image data to the value maintained by Glance. Further, when Nova is configured to use the same storage for ephemeral disks that is used as a Glance image store, Nova efficiently creates a server root disk directly in the backend without checksumming the image data. This is an intentional design choice to optimize storage space and host resources, but an implication is that even if the image record has a recorded hash, it is not being checked at the point of image consumption. Similarly, when using a shared backend, or a cinder glance_store, Cinder will efficiently clone a volume created from an image directly in the backend without checksumming the image data. Again, this is done intentionally in order to optimize resources, but it is important to be aware of the security tradeoff being made by this configuration. In other words, if the image data is not going to be checked at the point of image consumption, then extra care needs to be taken to ensure the integrity of the data path. OSSN-0065 suggested that the attack vector of substituting image data by modifying the image locations could be addressed by using policies, but that has turned out not to be the case. The only way currently to mitigate this vector is to deploy glance-api in a dual configuration as described above, namely with an internal-only-facing glance-api used by Nova and Cinder (that has show_multiple_locations enabled), and an end-user-facing glance-api (that has show_multiple_locations disabled). So far the focus has been on 'show_multiple_locations'. When that setting is disabled in Glance, it is not possible to manipulate the locations via the OpenStack Images API. Keep in mind, however, that in any Glance/Nova/Cinder configuration where Nova and/or Cinder do copy-on-write directly in the image store, image data transfer takes place outside Glance's image data download path, and hence the os_hash_value is *not* checked. Thus, if the backend store is itself compromised and image data is replaced directly in the backend, the substitution will *not* be detected. This brings us to the 'show_image_direct_url' option, which includes a "direct_url" field in the image-show response that can be used by various OpenStack services to consume images directly from the storage backend. Exposing the 'direct_url' to end users leaks information about the storage backend. What exactly that information consists of depends upon the backend in use and how it is configured, but in general, it is not a good idea to provide hints that could be useful to malicious actors in their attempts to compromise the backend storage by some type of independent exploit. The 'direct_url', being read-only, may appear innocuous, but its use by services is usually to perform some kind of optimized image data access that most likely does not include computing a hash of the image data. We therefore recommend that OpenStack services that require exposure of the 'direct_url' image property be similarly configured to use an internal-only-facing glance-api. It is worth nothing that end users who wish to download an image do not require access to the 'direct_url' image property because they can simply use the image-data-download API call [5]. ### Recommended Actions ### A glance-api service with 'show_multiple_locations' enabled should *never* be exposed directly to end users. This setting should only be enabled on an internal-only-facing glance-api that is used by OpenStack services that require access to image locations. This could be done, for example, by running two glance-api services with different configuration files and using the appropriate configuration options for each service to specify the Image API endpoint to access, and making sure the special internal endpoint is firewalled in such a way that only the appropriate OpenStack services can contact it. Similarly, enabling 'show_image_direct_url' exposes information about the storage backend that could be of use to malicious actors in as yet unknown exploits, so it should likewise only be enabled on an internal-only-facing glance-api. ### Notes / References ### [0] https://docs.openstack.org/api-ref/image/v2/index.html#show-image-schema [1] Nova and Ironic use 'endpoint_override' in the '[glance]' section of the configuration file; Cinder uses 'glance_api_servers' in the '[DEFAULT]' section. [2] OSSN-0065: https://wiki.openstack.org/wiki/OSSN/OSSN-0065 [3] The Glance "multihash" metadata pair of 'os_hash_algo' and 'os_hash_value' were introduced in Rocky to replace the legacy md5 'checksum' field. The python-glanceclient has used multihash checksumming for download verification since version 2.13.0. [4] https://docs.openstack.org/releasenotes/glance/rocky.html#known-issues [5] https://docs.openstack.org/api-ref/image/v2/index.html?#download-binary-ima… ### Contacts / References ### Author: Brian Rosmaita, Red Hat This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0090 Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1990157 Mailing List : [Security] tag on openstack-discuss(a)lists.openstack.org OpenStack Security Project : https://launchpad.net/~openstack-ossg CVE: none

1 0

[swift] upgrade newton to train in containers
by Marcel 17 Oct '22

17 Oct '22

I'm planning an upgrade for our newton based swift cluster (OOO vm based) to a (kolla image based containers) train cluster So far I have tested the upgrade for the proxies, account_servers and container servers and it looks promising. I have in a test environment: - switched to the new proxies with the old ring files and it looks like everything works normally - Added the new (train) account and container servers to the rings and it looks like all is fine - Removed the old account and container servers, still fine - tested fall back, also fine My question actually is: Did the account and container database format change between newton and train in such a way that I might run into troubles trying the upgrade as tested above in ways that I did not yet foresee? Thanks Marcel

1 0

[Neutron] Bug Deputy Report Oct 10 - 17
by Jakub Libosvar 17 Oct '22

17 Oct '22

Hi all, I was the bug deputy last week, here is the report. Nothing that requires immediate attention. Medium ------ - [ovn-octavia-provider] Detach OVN-LB LS from the LR breaks OVN-LB connectivity https://bugs.launchpad.net/neutron/+bug/1992363 assigned to Luis Fix proposed: https://review.opendev.org/c/openstack/ovn-octavia-provider/+/860781 - [scale] Setting a gateway on router is killing database https://bugs.launchpad.net/neutron/+bug/1992950 Assigned to Arnaud Morin Fix proposed: https://review.opendev.org/c/openstack/neutron/+/861322 - Disable in-band flow management in the ovs bridges https://bugs.launchpad.net/neutron/+bug/1992953 Assigned to Slawek Fix proposed: https://review.opendev.org/c/openstack/neutron/+/861351 Wishlist ------- - fip will loss when it migrate between dvr-sant agent and dvr_no_external in Rocky https://bugs.launchpad.net/neutron/+bug/1992542 The reported bug uses unsupported configuration dvr_snat agent mode on the compute nodes. Cheers Kuba

1 0

[kolla][ptg] Using Meetpad instead of Zoom
by Michał Nasiadka 17 Oct '22

17 Oct '22

Hello, If you’re planning on joining the Kolla PTG - please use Meetpad - https://meetpad.opendev.org/kolla-antelope-ptg Sorry for last minute changes Best regards, Michal

1 0

[ptg][nova][placement] Nova/Placement at the PTG, howto
by Sylvain Bauza 17 Oct '22

17 Oct '22

Hey stackers, Got some questions about how/when joining the Nova community at the PTG during this week, so I'll provide you a howto ;) *What is the main document for the Nova PTG ?* This : https://etherpad.opendev.org/p/nova-antelope-ptg Please, please, don't try to translate this etherpad directly as you'll see. *I'm an operator and I want to tell you how terrible you folks are* There : https://etherpad.opendev.org/p/oct2022-ptg-operator-hour-nova Again, don't try to translate this document or you'll create problems for people who don't know your language. *When do you folks discuss ?* Monday : 14:00-15:00 UTC Ironic/Nova cross-project session Tuesday : 13:00 - 15:00 UTC Operator hours. If you are an operator, please join us ! :-) 15:00 - 17:00 UTC Nova sessions for contributors 15:10 UTC (possibly) : Nova team photo Wednesday : 13:00 - 16:00 UTC Nova sessions for contributors 16:00 - 17:00 Operator hour. If you are an operator, please join us ! :-) Thursday : 13:00 - 15:00 UTC Neutron/Nova cross-project session 15:00 - 17:00 UTC Nova sessions for contributors Friday : 13:00 - 17:00 UTC Nova sessions for contributors *How to join ?* Simple. You can look at https://ptg.opendev.org/ptg.html if you want so you'll see what topic we are currently discussing. If you want to arrive, just click either on "operator-hour" nova tag or "nova-placement" tag and it will automatically open the Google Meet client for joining the Nova meeting. If you also want, you can directly join us by using this link https://www.openstack.org/ptg/rooms/bexar (we'll use the same virtual room for all our sessions) *What if you can't join the whole days ?* No worries ! Just make sure you use an IRC client and just go to the #openstack-nova channel. Once you're there, add your IRC in the etherpad for every topic you'd like to be around and then I'll ping you when we start discussing for those topics you added your nick. *What if I want to add some topic I'd like to discuss ?* Easy peasy. Two possibilities : - you are a contributor and you want to add a new feature in nova. Just add your topic in the main etherpad (link above). Make sure your name is marked in the topic title (like every other topic) and I'll ping you when we start discussing your topic. - you are an operator and you want to discuss wishlists or bugs or whatever else. Good news, we have specific timeslots for you ! See the agenda above, we have *operator hours* that are intended for operators to join and engage on specific deployment and operational topics. Just then look at https://etherpad.opendev.org/p/oct2022-ptg-operator-hour-nova and add your points, we'll discuss them during the operator hours (given above). Hope you'll find your way and you'll appreciate the PTG as much productive as we do. In any case, my IRC nick is bauzas. Don't hesitate to bug me over IRC (#openstack-dev, #openstack-nova or #openinfra-events) or reach me by email (sbauza(a)redhat.com) I'll try to answer you as much as I can. HTH and thanks, -Sylvain

1 0