October 2022 - openstack-discuss - lists.openstack.org

[kolla-ansible][Xena] SSL certificate expired
by wodel youchi 11 Oct '22

11 Oct '22

Hi, My SSL certificate has expired, and now I cannot authenticate into horizon and I have these errors : *WARNING keystoneauth.identity.generic.base [-] Failed to discover available identity versions when contacting https://dashint.cloud.exemple.com:35357 <https://dashint.cloud.exemple.com:35357>. Attempting to parse version from URL.: keystoneauth1.exceptions.connection.SSLError: SSL exception connecting to https:// dashint.cloud.exemple.com <http://dashint.cloud.exemple.com> :35357: HTTPSConnectionPool(host=' dashint.cloud.exemple.com <http://dashint.cloud.exemple.com>', port=35357): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))* In my globals.yml I have this parameter : kolla_verify_tls_backend: "no" 1 - How do I disable SSL verification for now? 2 - How to install a new SSL certificate? Regards.

1 3

[qa][ptg] Virtual PTG Planning
by Martin Kopec 11 Oct '22

11 Oct '22

Hello everyone, here is [1] our etherpad for Antelope PTG. Please, add your topics there if there is anything you would like to discuss / propose ... You can also vote for time slots of our sessions so that they fit your schedule at [2]. We will go with 3 maybe 4 one hour slots, depending on the number of topics. [1] https://etherpad.opendev.org/p/qa-antelope-ptg [2] https://framadate.org/dC2AEBTq8b5rAkvv Thanks, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA IM: kopecmartin

1 2

[neutron] Antelope PTG, agenda and schedule
by Rodolfo Alonso Hernandez 11 Oct '22

11 Oct '22

Hello Neutrinos: Please check the agenda and schedule for the Antelope PTG: https://etherpad.opendev.org/p/neutron-antelope-ptg Some tips: * Remember that on Monday we have the TC sessions. * The first Neutron meeting is on Tuesday. * The Nova-Neutron cross-project sessions are on Thursday (13 - 15 UTC). * The Neutron operator hour is on Friday. See you next week! Regards.

1 0

[tripleo] Gate blocker
by Arx Cruz 11 Oct '22

11 Oct '22

Hello, We have a gate blocker due https://bugs.launchpad.net/tripleo/+bug/1992305 please do not recheck jobs until https://review.opendev.org/c/openstack/tripleo-quickstart/+/860810 get merged. I will let you know when gates are green again. -- Arx Cruz Software Engineer Red Hat EMEA <https://www.redhat.com> arxcruz(a)redhat.com @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 1

[ptl][tc][ops][ptg] Operator + Developers interaction (operator-hours) slots in 2023.1 Antelope PTG
by Ghanshyam Mann 11 Oct '22

11 Oct '22

Hello Everyone/PTL, As you know, one of the challenges we are facing nowadays is less interaction/feedback from operators. To solve that, OpenStack TC has been discussing it in various forum/places (Board, TC meetings). One of the ideas that came from those discussions was to bring operator and developer together in events like summit, PTG etc. On that idea, we are trying to invite more operators (especially form ops meetup attendees) in next virtual PTG. Idea is to have operators join the project PTG slots. To make it easy for operators and less conflict among projects, TC has booked a few slots as 'operator hours' in different time/day. Currently those are booked as 'operator-hour-placeholder'[1]. Project can convert/reserve them to their project operator-hour, for example 'operator-hour-nova'. How project can reserve/book these 'operator hour' (Action item for projects PTL/PTG planner): ----------------------------------------------------------------------------------------------------------------- 1. Request Kendal or Fungi (in #openinfra-events IRC channel) to register the new track 'operator-hour-<your project name>' for example, 'operator-hour-nova' 2. Once track is registered, pick one of the available 'operator-hour-placeholder' slot and book it with newly registered track 'operator-hour-<your project name>'. For example #operator-hour-nova book essex-WedB1 * Idea to book these slots as 'operator-hour-<your project name>' is to give operators a easy way to find and join. Otherwise it will be difficult for them to find such slot/time from etherpads. We request every projects to book at least one 'operator hours' slot for operators to join your PTG slot. Ping me in #openstack-tc or #openinfra-events IRC channel for any query. [1] https://ptg.opendev.org/ptg.html -gmann

1 1

[PTG][PTL][Ops] PTG Etherpads and information discovery
by Julia Kreger 11 Oct '22

11 Oct '22

Greetings folks! We're a little under a week out from the PTG and I came to the realization on a call earlier today that it is a bit difficult to discover relationships between "operator hour" sessions and related projects. Further compounded by the auto-created etherpad links on the PTG website[0]. That being said, it seems we need to make things a little easier to discover by cross-linking in some places, as well as ensuring the correct etherpads are being referenced. If your a PTL: * Please review the links on the PTG etherpad list[0]. If the link is not correct, please use the ptgbot to update it. Be careful to check the prior etherpad for content! * If you have an operator hour scheduled as well, please be mindful that we've already saved the etherpad links to [1] and some of the etherpads already have content. If you intend to use another etherpad, please link and make the information/content discoverable on the primary operator etherpad[1]. Operators and those who have questions for Operators: * The central etherpad of operator hour etherpads is an additional etherpad[1]. * Please add topics to specific operator hour sessions that you feel are appropriate or pertinent. Examples would include: "What versions do you run?" "Downstream patches that made your life easier?" "This $issue issue causes us lots of pain, we would love to see it fixed." Thanks everyone! -Julia [0]: https://ptg.opendev.org/etherpads.html [1]: https://etherpad.opendev.org/p/oct2022-ptg-openstack-ops

1 0

Search for openstack cloud billing dataset
by Daniella kalimumbalo 10 Oct '22

10 Oct '22

Openstack can monitor and bill the cloud users according to their resources consumption. I'm looking for a dataset for resources usage in an openstack cloud infrastructure, that contains the resources consumption metrics and bill of each end-user. That dataset will allow me to work on price prediction of cloud ressources using machine/ Deep learning.Please is it possible to get it?

2 1

Re: Kroxvx rsvxfzwql
by Jeremy Stanley 10 Oct '22

10 Oct '22

The previous message in this thread was spoofed to appear to originate from one of the list subscribers in order to get around our moderation mechanism. Normally the attachments on these sorts of messages are too large to make it through without being held for moderator review, but this one was just small enough to make it onto the list. I've scrubbed the attachment from the archives for safety and set up the listserv to strip "zip" attachments from future posts (since it now seems to be a popular vector for distributing Windows malware by E-mail), but if anyone received the original I strongly recommend not opening it. -- Jeremy Stanley

1 0

[Ceilometer] Pollster cannot get RadosGW metrics when API endpoints are based on URL instead of port number
by Taltavull Jean-François 10 Oct '22

10 Oct '22

Hi All, In our OpenStack deployment, API endpoints are defined by using URLs instead of port numbers and HAProxy forwards requests to the right bakend after having ACLed the URL. In the case of our object-store service, based on RadosGW, the internal API endpoint is "https://<FQDN>/object-store/swift/v1/AUTH_<tenant_id>" When Ceilometer RadosGW pollster tries to connect to the RadosGW admin API with the object-store internal endpoint, the URL becomes https://<FQDN>/admin, as shown by HAProxy logs. This URL does not match any API endpoint from HAProxy point of view. The line of code that rewrites the URL is this one: https://opendev.org/openstack/ceilometer/src/branch/stable/wallaby/ceilomet… What would you think of adding a mechanism based on new Ceilometer configuration option(s) to control the URL rewriting ? Our deployment characteristics: - OpenStack release: Wallaby - Ceph and RadosGW version: 15.2.16 - deployment tool: OSA 23.2.1 and ceph-ansible Best regards, Jean-Francois

2 23

Failed to create user port error
by Lajos Katona 10 Oct '22

10 Oct '22

(Resending it without the attached picture) Hi, It seems more a Neutron exception, and my 1st thought is to check your subnet and add it to your router, you can do it manually with openstack CLI: openstack router add subnet <router name/id> 98a65c6e-2473-48f1-a578-702a08649c73 Not sure if it is possible if you use trove as I never used it. Best wishes Lajos Katona (lajoskatona)

1 0

Kroxvx rsvxfzwql
by nobody 10 Oct '22

10 Oct '22

This message has been removed.

1 0

Failed to create user port error
by Monish Selvaraj 08 Oct '22

08 Oct '22

Hi, Iam recently enabled trove in our kolla-ansible openstack. I can't create an instance in trove. It seems *Failed to create User port for instance 54ab3ff2-ecec-4b22-a736-3c36972542e3: Subnet 98a65c6e-2473-48f1-a578-702a08649c73 is not associated with router.* Also added the following parameter in trove.conf and restarted the docker container. But it's not working. [network] enable_access_check = False [image: image.png]

1 0

[all][tc] What's happening in Technical Committee: summary 2022 Oct 7: Reading: 5 min
by Ghanshyam Mann 08 Oct '22

08 Oct '22

Hello Everyone, Here is this week's summary of the Technical Committee activities. 1. TC Meetings: ============ * We had this week's meeting on Oct 6. Most of the meeting discussions are summarized in this email. Meeting recording is present @ https://www.youtube.com/watch?v=HhL67mf4uAY&t=464s and summary logs are available @ https://meetings.opendev.org/meetings/tc/2022/tc.2022-10-06-15.00.log.html * Next TC weekly meeting will be a video call on Oct 13 Thursday at 15:00 UTC, feel free to add the topic on the agenda[1] by Oct 12. 2. What we completed this week: ========================= * Dedicated Zed release to Ilya Etingof[2] * Selected Ghanshyam as chair [3] 3. Activities In progress: ================== TC Tracker for Zed cycle ------------------------------ * Zed tracker etherpad includes the TC working items[4], Five are completed and other items are in-progress. Open Reviews ----------------- * Six open reviews for ongoing activities[5]. New community-wide goal "Migration CI/CD to Ubuntu 22.04" -------------------------------------------------------------------------------------- Dmitriy proposed to select this goal for 2023.1 cycle [6]. 2023.1 cycle Leaderless projects & TC Chair ---------------------------------------------------- * Zun project PTL appointment is under review[7][8]. * Slaweq volunteer to serve as Vice chair[9]. 2023.1 cycle TC PTG planning ------------------------------------ * Etherpads to add the topics: ** https://etherpad.opendev.org/p/tc-2023-1-ptg ** https://etherpad.opendev.org/p/tc-leaders-interaction-2023-1 * I sent an email about the 'Operator Hours' slots in this PTG, please check and reserve the operator hour slot for your project[10] 2021 User Survey TC Question Analysis ----------------------------------------------- No update on this. The survey summary is up for review[11]. Feel free to check and provide feedback. Fixing Zuul config error ---------------------------- We request projects having zuul config error to fix them, Keep supported stable branches as priority and Extended maintenance stable branch as low priority[12][13]. Project updates ------------------- * None. 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[14]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [15] 3. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [2] https://review.opendev.org/c/openstack/governance/+/859464 [3] https://review.opendev.org/c/openstack/governance/+/858957 [4] https://etherpad.opendev.org/p/tc-zed-tracker [5] https://review.opendev.org/q/projects:openstack/governance+status:open [6] https://review.opendev.org/c/openstack/governance/+/860040 [7] https://review.opendev.org/c/openstack/governance/+/858980 [8] https://review.opendev.org/c/openstack/governance/+/860759 [9] https://review.opendev.org/c/openstack/governance/+/860352 [10] https://lists.openstack.org/pipermail/openstack-discuss/2022-September/0303… [11] https://review.opendev.org/c/openstack/governance/+/836888 [12] https://lists.openstack.org/pipermail/openstack-discuss/2022-September/0305… [13] https://etherpad.opendev.org/p/zuul-config-error-openstack [14] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [15] http://eavesdrop.openstack.org/#Technical_Committee_Meeting -gmann

1 0

[horizon] Antelope PTG Schedule
by vishal manchanda 07 Oct '22

07 Oct '22

Hello Team, Please Find the Schedule for Horizon PTG in the eherpad [1]. Feel Free to add the topics you want to discuss in the PTG. Don't forget to register for PTG, if not done yet [2]. See you at the PTG! Thanks & Regards, Vishal Manchanda (irc: vishalmanchanda) [1] https://etherpad.opendev.org/p/horizon-antelope-ptg [2] https://openinfra-ptg.eventbrite.com/

1 0

[neutron] Drivers meeting agenda -06.10.2022.
by Lajos Katona 06 Oct '22

06 Oct '22

Hi Neutron Drivers, The agenda for tomorrow's drivers meeting is at [1]. We have the following RFE to discuss: [RFE] Strict minimum bandwidth support for tunnelled networks (#link https://bugs.launchpad.net/neutron/+bug/1991965 ) [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers#Agenda See you at the meeting tomorrow. Lajos Katona (lajoskatona)

1 0

[neutron][tempest][all] Broken CI, any job inherited from "devstack"
by Rodolfo Alonso Hernandez 06 Oct '22

06 Oct '22

Hello all: I broke the OpenStack CI (good start as Neutron PTL). I pushed [1] testing only against the Neutron CI. After making the needed changes [2], I thought any other job would be safe. I've opened [3]. The default OVN version installed in the CI, using Ubuntu 20.04, is v20.03, that is a bit old. I've proposed to bump to v21.06, extensively tested in the Neutron CI. Any tempest job from any project is inherited from this one. Once we have migrated to Ubuntu 22.04 during this cycle, we'll remove this forced OVN installation from source. Regards. [1]https://review.opendev.org/c/openstack/neutron/+/859642 [2]https://review.opendev.org/c/openstack/neutron/+/860078/ [3]https://bugs.launchpad.net/devstack/+bug/1991952 [4]https://review.opendev.org/c/openstack/devstack/+/860577

5 8

Limit Access to a Group for a Project- Openstack 13 & 17
by samir oukessou 06 Oct '22

06 Oct '22

Dears, I have a question regarding Openstack, is it possible to limit access for a user to get read only on a specific project that he can only see the instances in that project and eliminate the actions edit,start,stop or delete instance ? i have tried some tests grant *member* role only to the group but all users in the group were able to do everything with the instances thank you in advance, Samir

2 1

[nova][cinder][glance][manila][masakari][tacker][oslo] Configurable soft-delete
by Stephen Finucane 06 Oct '22

06 Oct '22

👋 I'm planning on bringing this up in the nova rooms at the PTG in a few weeks, but I'm also raising it here since this potentially affects other service projects and I can't attend all of those room :) Many projects use the concept of "soft delete" in their database models. A soft deletable model typically has two additional columns, 'deleted' and 'deleted_at'. When deleting such a model, instead of actually deleting the database row (i.e. 'DELETE FROM table WHERE condition'), we set 'deleted' to 'True' and populate the 'deleted_at' column. This is helpful for auditing purposes (e.g. you can inspect all resources ever created, even after they've been "deleted") but bad for database performance (your tables can grow without bound). To work around the performance issues, most projects implement some kind of archive or purge command that will allow operators to periodically clean up these deleted resources. However, at least in nova, we've long since come to the conclusion that soft deleting isn't as useful as initially suspected and the need to run these commands is additional work for no benefit. We've moved toward not using it for all new models. With this said, it's going to be difficult to get away from soft-delete quickly. Not only are there database migrations involved, but operators will need to rework their tooling to adapt to a new, no-soft-delete world. As such, I'd like to propose a half-way measure of making soft-delete configurable. To do this, I'd like to add a new flag in oslo.db, '[database] enable_soft_delete'. When set to 'False' anyone using the 'SoftDeleteMixin' from oslo.db would see these models hard deleted rather than soft deleted when calling 'soft_delete'. This would avoid the need for operators to run the various project-specific purge tooling. The RFC patch for this is available for review [1]. I can also do this on a project-specific basis and have proposed a similar patch for nova [2], however, doing it in oslo.db means every project that uses 'SoftDeleteMixin' in their models will get this for free. Projects that don't (glance, cinder) can switch to using this mixin and also get it for free. As noted above, I intend to discuss this in the nova room at the PTG, but I'd be interested in people's thoughts ahead of time. Do you think this is a good idea? Should we proceed with it? Perhaps there are there better ways to do this? Let me know! Cheers, Stephen [1] https://review.opendev.org/c/openstack/oslo.db/+/860407 [2] https://review.opendev.org/c/openstack/nova/+/860401

7 9

[zed] OpenInfra Live - October 6 at 1400 UTC
by Allison Price 06 Oct '22

06 Oct '22

Hi everyone, This week’s OpenInfra Live episode is brought to you by the OpenStack community who just delivered its 26th on-time release today! Join us to learn about the latest from community leaders about what was delivered in Zed and what we can expect in Antelope, OpenStack's 27th release targeting early 2023. Episode: OpenStack Zed: The End of the Alphabet, The Beginning of a New Era Date and time: October 6 at 1400 UTC You can watch us live on: YouTube: https://www.youtube.com/watch?v=MSbB3L9_MeY <https://www.youtube.com/watch?v=MSbB3L9_MeY> LinkedIn: https://www.linkedin.com/video/event/urn:li:ugcPost:6982723169144950786/ <https://www.linkedin.com/video/event/urn:li:ugcPost:6982723169144950786/> Facebook: https://www.facebook.com/events/390328576642133 <https://www.facebook.com/events/390328576642133> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Kendall Nelson, OpenInfra Foundation Carlos Silva, Manila Jay Faulkner, Ironic Sylvain Bauza, Nova Lajos Katona, Neutron Wu Wenxiang, Skyline Martin Kopec, Interop Working Group Liye Pang, Venus Have an idea for a future episode? Share it now at ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>. Thanks, Allison

1 1

[SECURITY] Openstack Security Assessments
by jackdaw blues 06 Oct '22

06 Oct '22

Hi all, I am currently leading a team of offensive security engineers and we are trying to create a checklist for each component of Openstack in the context of Security Assessment. At the end of the day what we want to end up with is common exploitable configuration weaknesses for each component. It will be against configuration or installation mistakes that result in unintended privileges or information disclosure, etc. Patch management isn't in scope. Not the exact output, but these links can give a good idea of the contents of the security assessment we are planning (these are for AWS): http://flaws.cloud/ http://flaws2.cloud/ Has anyone had any experience regarding the topic above? If so please feel free to connect. Regardless of the experience, if you want to contribute and at mark zero just like we are, you are still welcome and we can help each other create this assessment checklist. Cheers, Asil

2 1

[nova][placement] add your PTG topics before Oct-06 please !
by Sylvain Bauza 06 Oct '22

06 Oct '22

Hi folks, as I said in the nova meeting, I'd like to create an agenda for our PTG topics. Given the PTG is in 3 weeks, please provide your topics you'd like to discuss at the PTG in [1] so I could look at them and try to provide an agenda for them. Eventually, I'd love to have most of the topics by Oct 6th as I said in the title so the agenda would be on the Friday Oct 7th. Also, if you can't be in the Nova PTG sessions for all the PTG schedule (between Tues and Fri for Nova), just add in the topic when you would like to be around. Thanks, -Sylvain [1] https://etherpad.opendev.org/p/nova-antelope-ptg

1 1

Re: Query about networking-onos for newer OpenStack releases
by Rodolfo Alonso Hernandez 06 Oct '22

06 Oct '22

Hello Aditya: If you don't have any specific requirement, I would choose one of the Neutron in-tree ML2 plugins: ML2/OVS or ML2/OVN (and ML2/SR-IOV, that can run with the other two). About which one you can choose, I won't point you to any of them. I would prefer you to review the different architectures: * OVS: https://docs.openstack.org/liberty/networking-guide/scenario-classic-ovs.ht… (this is an old but still valid document to see the different ML2/OVS deployments) * OVN: https://www.openstack.org/videos/summits/austin-2016/practical-ovn-architec… Regards. On Wed, Oct 5, 2022 at 10:37 PM Aditya Sathish <saditya(a)vt.edu> wrote: > Hi Lajos and Rodolfo, > > First of all thank you for your previous replies. After discussing it with > my team over here, we have decided to look at other alternatives beyond > ONOS for implementing an SDN controller with OpenStack. > > Lajos, as you mentioned about OVN, we can perform SDN control on the VM > instances using this. One extension we would like to do is to use OVN to > control an openflow hardware switch. The idea is to allow different users > over a network to access the VM instances. Any idea if I can get this done > through OVN? > > I also tried to check out OpenDayLight but even this has not been updated > in some time. > > Any replies would be greatly appreciated! > > Regards, > Aditya > > On Thu, Sep 22, 2022 at 12:22 PM Lajos Katona <katonalala(a)gmail.com> > wrote: > >> Seems gmail lost some chars from Rodolfo's address, resending. >> >> Lajos Katona <katonalala(a)gmail.com> ezt írta (időpont: 2022. szept. 22., >> Cs, 17:55): >> >>> Hi, >>> Thanks for considering this question. I do not add this topic now to the >>> agenda, of course it can be discussed any time :-) >>> In openstack OVN as an SDN controller is tested, and more and more >>> companies are using it, so for long term I would check it. >>> OVN is now in-tree in Neutron code base, meaning that you don't need any >>> extra code, you can just use Neutron. >>> OVN uses OVS as soft switch and the OVN code is written in C, and >>> originally started by the same team who develops OVS. >>> >>> If you need any advice, or would like to discuss any topics with the >>> team just ping us on #openstack-neutron channel. >>> >>> Best wishes >>> Lajos Katona (lajoskatona) >>> >>> >>> Aditya Sathish <saditya(a)vt.edu> ezt írta (időpont: 2022. szept. 22., >>> Cs, 17:00): >>> >>>> Hi Lajos, >>>> >>>> Thank you for the email. Unfortunately, I'm not sure if I can dedicate >>>> time to maintain this release-on-release. However, I forked the >>>> networking-onos repository and currently verified it with DevStack Zed >>>> along with tempest. (https://github.com/adityasathis/networking-onos) >>>> Considering the changes so far involved only replacing some code to account >>>> for changes in the ML2 callback interface, I think the support should not >>>> be too time consuming if we assume that the ML2 plugin interface remains >>>> the same. >>>> >>>> If we cannot find a way to support networking-onos for long-term >>>> support, do you know a better way to understand the industry implementation >>>> of using SDN controllers with OpenStack? >>>> >>>> Regards, >>>> Aditya. >>>> >>>> On Thu, Sep 22, 2022 at 10:46 AM Lajos Katona <katonalala(a)gmail.com> >>>> wrote: >>>> >>>>> Hi, >>>>> Do you think that you can maintain networking-onos, if you think yes, >>>>> we can discuss this topic on next drivers meeting (as Rodolfo wrote >>>>> previously). >>>>> Just ping me on IRC (#openstack-neutron lajoskatona) and I add this >>>>> topic for you to the agenda: >>>>> https://wiki.openstack.org/wiki/Meetings/NeutronDrivers >>>>> >>>>> Best Wishes >>>>> Lajos Katona (lajoskatona) >>>>> >>>>> Aditya Sathish <saditya(a)vt.edu> ezt írta (időpont: 2022. szept. 20., >>>>> K, 17:48): >>>>> >>>>>> Hello! >>>>>> >>>>>> I am trying to integrate an SDN controller with our lab's OpenStack >>>>>> network. Currently, we have already deployed a version of ONOS to serve our >>>>>> needs and I have been following the SONA project which uses the >>>>>> networking-onos ML2 plugin with OpenStack. However, it seems that the >>>>>> networking-onos project has been retired since the Train release. >>>>>> >>>>>> Is there any way I can get ONOS to work with OpenStack Yoga? If not, >>>>>> what is the go-to way to integrate an SDN controller with OpenFlow support >>>>>> with Neutron?? >>>>>> >>>>>> Any help will be much appreciated. >>>>>> >>>>>> Regards, >>>>>> Aditya. >>>>>> >>>>>

1 0

[all][tc] Technical Committee next weekly meeting on 2022 Oct 6 at 1500 UTC
by Ghanshyam Mann 06 Oct '22

06 Oct '22

Hello Everyone, The technical Committee's next weekly meeting is scheduled for 2022 Oct 6, at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, Oct 5 at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[Keystone][Swift] Using policy.json to prohibit specific API operations by policy?
by Andrew Boring 06 Oct '22

06 Oct '22

Hi all, I'm looking to support a situation where one class of Keystone users in a given domain can create Swift containers (either within a single, dedicated project or within their own projects) but *cannot* change ACLs on those containers, while a second class of users *can* alter ACLs on their own containers. For example, User A is in the first class (defined by role) and can perform all CRUD operations, EXCEPT update pre-defined ACLmetadata on those containers. User B is in the second class and CAN update ACLs on their respecitive containers, like any other standard user. Something like this AWS policy condition ("Granting permissions to multiple accounts with added conditions") is directionally what I'm trying to achieve: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-polici… Keystone docs imply that I can create policy.json files for all services: "You can define actions for OpenStack service roles in the /etc/PROJECT/policy.yaml files. For example, define actions for Compute service roles in the /etc/nova/policy.yaml file." -https://docs.openstack.org/keystone/yoga/admin/cli-manage-projects-users-and-roles.html But I can't find any indication that Swift actually supports this. So, does Swift support the Oslo policy.json stuff, and if so, is it documented anywhere? Is it simply a "install oslo policy and add it to the pipeline in proxy-server.conf"? If not, is there another/preferred way to achieve the desired restrictions on Swift API operations by policy for a given Keystone domain? Thanks. -- Andrew Boring andrew(a)andrewboring.com

2 1

[tacker] Critical bug report and backport the fix
by Yuta Kazato 06 Oct '22

06 Oct '22

Yasufumi, Ueha, Tacker and Release management team Hi, thanks for your agreements and supports it this issue. We could backport fix patches to stable/zed. I'm glad to release Openstack Zed:) https://releases.openstack.org/zed/ See you next Antelope vPTG! Yuta > Hi Yuta and Yasufumi, > > +1 > > And we have a patch for another critical bug related with pm interface. > The bug report [1] and the fix patch [2] have been already posted. > This patch also requires a backport to stable/zed. > > [1]https://bugs.launchpad.net/tacker/+bug/1990828 > [2]https://review.opendev.org/c/openstack/tacker/+/859377 > > Best Regards, > Ueha > > -----Original Message----- > From: Yasufumi Ogawa <yasufum.o at gmail.com> > Sent: Tuesday, September 27, 2022 10:42 AM > To: openstack-discuss at lists.openstack.org > Subject: Re: [tacker] Critical bug report and backport the fix > > Hi Yuta, > > On 2022/09/26 16:57, Yuta Kazato wrote: > > Hi tacker team, > > > > As you know, new bug report #1990793 [1] related to K8s resource name > > and v2 API is submitted by Masaki. > > The bug will appear if K8s resource name contains `-`. > > > > I think this is a critical issue because users often set resource > > names that contain `-`. > Agree. > > > Fortunately, the fix patch [2] has already been submitted. > > > > I suggest that we should backport the fix patch to the stable/zed > > branch before Zed release. > > What do you think? > We should fix the issue in stable/zed, or this k8s support doesn't work for many usecases. > > Yasufumi > > > > [1] https://bugs.launchpad.net/tacker/+bug/1990793 > > [2] https://review.opendev.org/c/openstack/tacker/+/859206 > > > > Yuta > > -- Yuta Kazato (風戸雄太) NTT Network Innovation Center. tel: +81-422-59-6754 mail:yuta.kazato.nw@hco.ntt.co.jp

1 0

OpenStack Zed is officially released!
by Előd Illés 05 Oct '22

05 Oct '22

Hello OpenStack community, The official OpenStack Zed release announcement has been sent out: http://lists.openstack.org/pipermail/openstack-announce/2022-October/002061… Thanks to all who were a part of the Zed development cycle! This marks the official opening of the openstack/releases repository for 2023.1 Antelope releases, and freezes are now lifted. stable/zed is now a fully normal stable branch, and the normal stable policy applies from now on. Thanks, Előd Illés and the Release Management team

5 4

[release][ironic] Release desired for Ironic bugfix/N branches
by Jay Faulkner 05 Oct '22

05 Oct '22

Hey all, I was attempting to perform a release of all maintained Ironic branches. The long term support branches cut as part of the integrated OpenStack release have been requested via gerrit, as documented ( https://review.opendev.org/c/openstack/releases/+/860125 ). We have intermediate bugfix releases as well, and I was hoping to get patch releases cut from these as well. As far as I can tell, there is no automation for performing these releases, or an official place to request them. If this is wrong; please correct me and I'm happy to go through the proper process. We know that the majority of consumers pull these from git directly; but checking pypi release notes, we had over 6000 downloads of the 21.0.0 and 20.2.0 releases during the 2/4 months of the Zed cycle they had respectively been released, so I do think there's value in releasing these even if it might be a small amount of manual effort. Below is a list of the Ironic projects, and associated bugfix/ branches I'd like to have a patch (bugfix) release cut for: ironic - bugfix/21.0 - bugfix/20.2 - bugfix/19.0 - bugfix/18.1 ironic-inspector - bugfix/11.0 - bugfix/10.12 - bugfix/10.9 - bugfix/10.7 ironic-python-agent - bugfix/9.0 - bugfix/8.6 - bugfix/8.3 - bugfix/8.1 Thanks, Jay Faulkner

5 8

[Swift][Ussuri] Erasure Coding Quarantines
by Reid Guyett 05 Oct '22

05 Oct '22

Hello, I'm not sure if it is related, but I am testing reimaging a node from Ubuntu 18.04 to 20.04 (Cloud Archive Ussuri 2.25.1 to Focal Repo Ussuri 2.25.2) in a 3-node cluster. I have a lot of servers to upgrade, and the environments will be mixed for a while, so I have left this mixed for a week. Now the 18.04 servers are starting to accumulate quarantined EC objects. The 20.04 server has log messages indicating that it is unable to get enough responses from the reconstructor. The 18.04 servers have a couple EC messages. "...liberasurecode[30807]: Invalid fragment header information!" followed by "...object-server: Quarantined object /srv/node/d9/objects-4/10321/b2e/50a3dce515aafc6f222824ec5c7dfb2e/1664002866.33100#8#d.data: Invalid EC metadata at offset 0x0 Is there any thing you can think of that would cause this issue? My steps to reproduce: 1. Create a container in an EC policy 2. Upload object to EC container 3. Wait a bit of time (It looks like the object-server is quarantining but not sure on the trigger) 4. Try to download the file and it will give a 504 Looking at python3-swift dependencies and the package versions I thought may affect this: 20.04 libjerasure2 = 2.0.0+2017.04.10.git.de1739cc84-1 python3-pyeclib = 1.6.0-6build1 python3-xattr = 0.9.6-1.1 18.04 libjerasure2 = 2.0.0+2017.04.10.git.de1739cc84-1 python3-pyeclib = 1.3.1-1ubuntu3 python3-xattr = 0.9.2-0ubuntu1 Thanks! Reid Important Notice: This email is intended to be received only by persons entitled to receive the confidential and legally privileged information it presumptively contains, and this notice constitutes identification as such. Any reading, disclosure, copying, distribution or use of this information by or to someone who is not the intended recipient, is prohibited. If you received this email in error, please notify us immediately at legal(a)kaseya.com, and then delete it. To opt-out of receiving emails Please click here<https://info.kaseya.com/email-subscription-center.html>. The term 'this e-mail' includes any and all attachments.

3 6

Bug Report - 10-05-2022
by Sofia Enriquez 05 Oct '22

05 Oct '22

This is a bug report from 09-28-2022 to 10-05-2022. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Low - https://bugs.launchpad.net/cinder/+bug/1991634 "Toyou drivers report allocated_capacity_gb." Fix proposed to master. - https://bugs.launchpad.net/cinder/+bug/1991217 "[docs] Unsupported option in docs for cinder-manage quota check/sync." Fix proposed to master. - https://bugs.launchpad.net/cinder/+bug/1991154 "[docs] Service tokens documentation is misleading." Fix proposed to master. Cheers, -- Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[kolla-ansible] How to recover from unfinished upgrade
by wodel youchi 05 Oct '22

05 Oct '22

Hi, I am testing the upgrade from xena to yoga and I made a mistake in globals.yml, I forgot to specify the correct name of gnocchi ceph pool, so my deployment went wrong. I interrupted the deployment Ctrl+C I corrected the mistake, then I restarted the upgrade and it got stuck somewhere else, but I couldn't find where, I interrupted then restarted the deployment again and it got stuck at the same place. My questions : - Is there a way to rollback the upgrade in case of a problem, then start over? - What is the best way to restart a broken upgrade process? Regards.

2 2

[barbican] New team meeting time
by Grzegorz Grasza 05 Oct '22

05 Oct '22

Hi Team, At our last meeting, it was proposed to move the meeting forward 1 hour (an hour early), from 1300 to 1200 UTC. [1] If there are no objections, I'll be making the change by the end of the week, before the next meeting takes place. / Greg [1] https://meetings.opendev.org/meetings/barbican/2022/barbican.2022-10-04-13.…

1 0

[horizon] Cancelling Today's Weekly meeting
by vishal manchanda 05 Oct '22

05 Oct '22

Hello Team, Since there are no agenda items [1] to discuss for today's horizon weekly meeting. Also, Today is a holiday for me. So let's cancel today's weekly meeting. Thanks & regards, Vishal Manchanda(irc:vishalmanchanda) [1] https://etherpad.opendev.org/p/horizon-release-priorities#L38

1 0

[TripleO] TripleO Antelope PTG Topics
by Rabi Mishra 05 Oct '22

05 Oct '22

Hi All, Please add your session proposals to this etherpad[1]. We'll reserve time allocation based on proposed topics and work out a schedule in the coming weeks. [1] https://etherpad.opendev.org/p/tripleo-antelope-topics -- Regards, Rabi Mishra

2 4

[I18n] Zanata status + call for volunteers on Weblate migration
by Ian Y. Choi 05 Oct '22

05 Oct '22

Hi all, First, thank you all for contributing to OpenStack with globalization by contributing translations, coordinating translations with artifacts, and making sure that those translations are shipped with releases to all over the world (we are calling it I18n - Internationalization). While OpenStack I18n could be healthier with the tremendous help from translators as well as many OpenStack upstream contributors & teams such as infrastructure, release management, and documentation, the current translation platform we are using on https://translate.openstack.org relies on Zanata, an open-source translation platform which upstream activities were stopped [1]. Currently, there are several issues reported - most things have been resolved while it repeats / worses as time goes: - OpenID authentication issues for new registration users on translate.openstack.org [2] - Translation job failure issues since Zanata client did not work with a newer Java / job compatibility issues with Python versions [3] - Missing translation jobs for Xena/Yoga stable versions on Zanata [4] Considering the situation, to solve the root cause of the situation, I am calling for volunteers on Weblate migration. The detailed activities would continue from what the previous I18n PTL already investigated, identified, and documented to [5] [6]. There would be diverse work items with developer perspective as well as translators and operators. Hope that there are many volunteers to move forward. Meanwhile, I updated the "Translations & Priority" part on https://translate.openstack.org homepage. Note that stable versions are minimized to Horizon and dashboard projects, and ping me if there would be lots of translation work especially during R-3 to R-1. Looking forward to an enhanced open source translation platform landing soon with OpenInfra. With many thanks, /Ian [1] https://lists.fedoraproject.org/archives/list/trans@lists.fedoraproject.org… [2] https://lists.openstack.org/pipermail/openstack-i18n/2022-February/003550.h… [3] https://review.opendev.org/c/openstack/project-config/+/850962 [4] https://lists.openstack.org/pipermail/openstack-discuss/2021-December/02644… [5] https://blueprints.launchpad.net/openstack-i18n/+spec/renew-translation-pla… [6] https://etherpad.opendev.org/p/I18n-weblate-migration

2 1

OpenStack Ansible Service troubleshooting
by John Ratliff 05 Oct '22

05 Oct '22

We've started deploying new Xena clusters with openstack-ansible. We keep running into problems with some parts of openstack not working. A service will fail or need restarted, but it's not clear which one or why. Recently, one of our test clusters (2 hosts) stopped working. I could login to horizon, but I could not create instances. At first it told me that a message wasn't answered quick enough. I assumed the problem was rabbitmq and restarted the container, but this didn't help. I eventually restarted every container and the nova- compute and haproxy services on the host. But this didn't help either. I eventually rebooted both hosts, but this made things worse (I think I broke the galera cluster doing this). After bootstrapping the galera cluster, I can log back into horizon, but I still cannot create hosts. It tells me "Exceeded maximum number of retries. Exhausted all hosts available for retrying build failures for instance [UUID]" If I look at the journal for nova-compute, I see this error: "libvirt.libvirtError: Failed to activate service 'org.freedesktop.machine1': timed out " Looking at systemd-machined, it won't start due to "systemd- machined.service: Job systemd-machined.service/start failed with result 'dependency'." I'm not sure what "dependency" it's referring to. In the cluster that does work, this service is running. But on both hosts on the cluster that do not, this service is not running. What should I be looking at here to fix? -- John Ratliff Systems Automation Engineer GlobalNOC @ Indiana University

2 4

[cinder] cancelling this week's meeting
by Rajat Dhasmana 04 Oct '22

04 Oct '22

Hello Argonauts, I won't be around to take the cinder meeting tomorrow (i.e. 05th October, 2022) and we are close to the PTG so there aren't many things to discuss. The agenda as of now is empty[1] so it shouldn't be a problem to skip this week's meeting. Also I would like to take this opportunity to remind everyone to add topics to the PTG etherpad[2] and that would be a better utilization of the cinder upstream meeting time. [1] https://etherpad.opendev.org/p/cinder-zed-meetings#L102 [2] https://etherpad.opendev.org/p/antelope-ptg-cinder-planning Thanks and regards Rajat Dhasmana

1 0

PTG Schedule and Reminders
by Kendall Nelson 03 Oct '22

03 Oct '22

Hello Everyone! The October 2022 Project Teams Gathering is right around the corner and the schedule is being setup by your team leads! Slots are going fast, so make sure to get your time booked ASAP! You can find the schedule and available slots on the PTGbot website [1]. The PTGbot site is the during-event website to keep track of what's being discussed and any last-minute schedule changes. It is driven via commands in the #openinfra-events IRC channel (on the OFTC network) where the PTGbot listens. If you have questions about the commands that you can give the bot, check out the documentation here[2]. Also, if you haven’t connected to IRC before, here are some docs on how to get setup![3] Lastly, please don't forget to register[4] (it is free after all!). Please let us know if you have any questions via email to ptg(a)openinfra.dev. Thanks! -Kendall (diablo_rojo) [1] PTGbot Site: https://ptg.opendev.org/ptg.html [2] PTGbot Documentation: https://github.com/openstack/ptgbot#open-infrastructure-ptg-bot [3] Setup IRC: https://docs.openstack.org/contributors/common/irc.html [4] PTG Registration: https://openinfra-ptg.eventbrite.com

1 0

[neutron] PTG topics and scheduling
by Rodolfo Alonso Hernandez 03 Oct '22

03 Oct '22

Hello all: Based on the schedule polls results, I've booked the Neutron meetings from Tuesday to Thursday in Mitaka channel [1], from 13UTC to 16UTC. Of course, if that is not enough, we can always use Friday to continue any pending conversation. The operator hour (actually 2), will be on Friday (pending for reservation), from 13UTC to 15UTC. Please continue adding any topic you want to discuss in the Neutron etherpad [2]. There is a specific section for the Nova-Neutron cross-team meeting. If you have any doubt or question, do not hesitate to let me know (IRC: ralonsoh, mail: ralonsoh(a)redhat.com) You can also ping any core reviewer in #openstack-neutron channel. See you in a few weeks! [1]https://ptg.opendev.org/ptg.html [2]https://etherpad.opendev.org/p/neutron-antelope-ptg

3 3

[neutron] Bug deputy 26 September to 2 October
by Rodolfo Alonso Hernandez 03 Oct '22

03 Oct '22

Hello Neutrinos: This is the list of bugs of the past week: Medium: * https://bugs.launchpad.net/neutron/+bug/1991092: Retry port provisioning for "nova:xxx" device_owner ports only. Assigned * https://bugs.launchpad.net/neutron/+bug/1991222: neutron.provisioningblocks WSREP: referenced FK check fail. Assigned Low: * https://bugs.launchpad.net/neutron/+bug/1990999: Install and configure compute node in Neutron. Unassigned * https://bugs.launchpad.net/neutron/+bug/1991398: Update port with given IPv6 address on SLAAC/stateless_dhpc subnets fails always when IP address is given. Assigned Wishlist: * https://bugs.launchpad.net/neutron/+bug/1990842: [RFE] Expose Open vSwitch other_config column in the API. Assigned * https://bugs.launchpad.net/neutron/+bug/1991000: [tripleo] Provide a tag to the container that will be used to kill it. Assigned Regards.

1 0

suggestion goal for zed: getting swift and glance to support uwsgi
by Thomas Goirand 03 Oct '22

03 Oct '22

Hi, As you may know, almost all of OpenStack now supports running on UWSGI. However, 2 projects remain incompatible with it: Glance and Swift. I've heard that it's now fixed with Glance, but I haven't checked the fact for myself. Has anyone already run Glance (with Swift as backend) under uwsgi, instead of eventlet? What's the status? Has all of the remaining issues been tackled? As for Swift, while upstream has even examples on how to run Swift over uwsgi, experience (in heavy load production) demonstrated that there are many issues running under uwsgi. That's a shame, because the uwsgi server makes most services (proxy, object, container and account servers) run twice as fast. Currently, the proxy and object servers aren't following the RFCs, and are incompatible with uwsgi, especially when chunks are involved (SLO/DLO in the pipeline). Also, it doesn't look like the Swift servers are thread safe. Switching to more than one thread just fails under heavy load. As a result, in production, we had to run double the amount of servers to handle the load. That's a huge waste of resources, IMO. It'd be great if upstream took it seriously to propose a uwsgi binary by default, and if the CI was using it. Note that I've already proposed such a patch [1], but it received zero votes, and not really getting attention upstream. Your thoughts anyone? Cheers, Thomas Goirand (zigo) P.S: This is just a suggestion for the work in the next cycle, I don't think I have the bandwidth to work on each individual project, and that my time is better spent on what I do best: Debian packaging of OpenStack and cluster deployment integration. [1] https://review.opendev.org/c/openstack/swift/+/821192

2 2