February 2022 - openstack-discuss

Masquerading VM works 99%
by Derek O keeffe 18 Feb '22

18 Feb '22

Hi all, We have an openstack cluster with one controller and 4 computes (Victoria) we have set it up using vlan provider networks with linuxbridge agent, distributed routing & ml2 (I am only partly on the networking so there could be more to that which I can find out if needed) So I was tasked with creating two Instances, one (lets call it the external vm) with an external interface 10.55.9.67 and internal interface 192.168.1.2. A second instance (lets call it the internal vm) would then be placed on the 192.168.1.0 network. I configured masquerading on the "external vm" and tried to ping the outside world from the "internal" vm as per something like this https://kifarunix.com/configure-ubuntu-20-04-as-linux-router/?unapproved=49… Both VM's were instantiated on the same compute host (I've tried it with them on separate hosts as well). I can see the ping leave using tcpdumps along the way and it makes it all the way back to the internal interface on the external machine. It just fails on the last hop to the internal machine. I've tried everything in my power to find why this won't work so I would be grateful for any advice at all. I have added the below to show how I followed the ping manually and where it went and when it failed. Thank you in advance. Following the ping from source to destination and back:Generated on the private VMsent to the internal interface on the external vmsent to the external interface on the external vmsent to the tap interface on the computesent to the physical nic on the computesent to the nic on the network device out to the internet received on nic on the network devicefrom the internet received on physical nic on the computereceived on tap interface on compute received on external interface on the external vmreceived on the internal interface on the external vmNEVER gets to last step on the internal vm Regards,Derek

4 6

[cinder] festival of XS reviews 18 February 2022
by Brian Rosmaita 18 Feb '22

18 Feb '22

Hello Argonauts, Apologies for the lateness of this reminder, but hopefully everyone has already used the handy ICS file [0] to have this event on their personal calendars. The most recent edition of the Cinder Festival of XS Reviews will be held tomorrow (Friday 18 February). who: Everyone! what: The Cinder Festival of XS Reviews when: Friday 18 February 2022 from 1400-1600 UTC where: https://meetpad.opendev.org/cinder-festival-of-reviews etherpad: https://etherpad.opendev.org/p/cinder-festival-of-reviews See you there! brian [0] http://eavesdrop.openstack.org/calendars/cinder-festival-of-reviews.ics

1 0

[neutron] Drivers meeting - Friday 18.2.2022 - cancelled
by Lajos Katona 18 Feb '22

18 Feb '22

Hi Neutron Drivers! As Friday is recharge day for RedHat, and most probably we will not have a quorum for the voting, let's cancel tomorrow's meeting. See You at the meeting next week. Lajos Katona (lajoskatona)

1 0

[TripleO] Gate blocker - ansible version
by Rafael Castillo 17 Feb '22

17 Feb '22

Hi All, We have an issue affecting multiple centos stream 8 gate jobs related to an ansible version conflict. Details: https://bugs.launchpad.net/tripleo/+bug/1961035 We are currently deciding on the best course of action for unblocking this issue. We will post an update once the gate is clear. Until then, please hold on rechecking. Thank you!

1 1

[TripleO] Sergii Golovatiuk for TripleO core reviewer (upgrades-related)
by Jose Luis Franco Arza 17 Feb '22

17 Feb '22

Hello folks, I would like to propose Sergii Golovatiuk [1][2][3] as a core reviewer on the TripleO repositories related to the upgrades workflow (openstack/tripleo-heat-templates, openstack/tripleo-ansible, openstack/python-tripleoclient, openstack/tripleo-ci, openstack/tripleo-quickstart, openstack/tripleo-quickstart-extras). Sergii has been working in OpenStack for the last 10 years, he is already core-reviewer of the tripleo-upgrade <https://github.com/openstack/tripleo-upgrade>repository in which he is providing with very valuable feedback, as well as helping getting relevant patches merged. His deep knowledge of the different OpenStack projects, as well as his involvement in the upgrades/updates workflows for the last 9 OpenStack releases makes him a great code reviewer, being able to catch several issues during the code review process. I will monitor the thread for a week and if no objections are exposed I will add him to the tripleo-core group. PD: Here comes the +1 from my side. Thanks. Cheers, José Luis [1]: https://review.opendev.org/q/owner:sgolovat%2540redhat.com [2]: https://www.stackalytics.io/?project_type=all&metric=commits&user_id=sgolov… [3]: Position #25 in the most active TripleO contributors list <https://www.stackalytics.io/report/contribution?module=tripleo-group&projec…>

13 13

[Tripleo] Issue in Baremetal Provisioning from Overcloud
by Anirudh Gupta 17 Feb '22

17 Feb '22

Hi Team I am trying to Provision Bare Metal Node from my tripleo Overcloud. For this, while deploying the overcloud, I have followed the *"default flat" *network approach specified in the below link https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/15… Just to highlight the changes, I have defined the *ironic-config.yaml* parameter_defaults: ... ... IronicIPXEEnabled: true IronicInspectorSubnets: - ip_range: *172.23.3.100,172.23.3.150* IronicInspectorInterface: 'br-baremetal' Also modified the file *~/templates/network-environment.yaml* parameter_defaults: NeutronBridgeMappings: datacentre:br-ex,baremetal:br-baremetal NeutronFlatNetworks: datacentre,baremetal With this I have Followed all the steps of creating br-baremetal bridge on controller, given in the link below: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/15… - type: ovs_bridge name: br-baremetal use_dhcp: false members: - type: interface name: nic3 Post Deployment, I have also create a flat network on "datacentre" physical network and subnet having the range *172.23.3.200,172.23.3.240 *(as suggested subnet is same as of inspector and range is different) and the router Also created a baremetal node and ran *"openstack baremetal node manage bm1", *the state of which was a success. Observation: On executing "openstack baremetal node *provide* bm1", the machine gets power on and ideally it should take an IP from ironic inspector range and PXE Boot. But nothing of this sort happens and we see an IP from neutron range " *172.23.3.239*" (attached the screenshot) [image: image.png] I have checked overcloud ironic inspector podman logs alongwith the tcpdump. In tcpdump, I can only see dhcp discover request on br-baremetal and nothing happens after that. I have tried to explain my issue in detail, but I would be happy to share more details in case still required. Can someone please help in resolving my issue. Regards Anirudh Gupta

5 20

[all][tc] Technical Committee next weekly meeting on Feb 17th at 1500 UTC
by Ghanshyam Mann 17 Feb '22

17 Feb '22

Hello Everyone, Technical Committee's next weekly meeting is scheduled for Feb 17th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, Feb 16th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[kolla-ansible][nova]Problem with distribution of instance on servers
by Franck VEDEL 17 Feb '22

17 Feb '22

Hello, I seem to have a problem that I hadn't seen. I have 3 servers for my openstack, built with Kolla-ansible, I'm in Victoria version. I had simply put the 3 servers in the [compute] part of the multinode file, at first it worked, but for some time all the VMs are placed on server 1. The 3 servers are operational, identical. here are 3 screenshots to show it. (on the images, the instances on servers 2 and 3 are present because it worked correctly, but no more instances are created on these servers now) I tried to understand how the instances are distributed on the servers, but in my case, I don't understand why none are assigned to the 2nd and 3rd server. How to find the problem? It should be nova-scheduler . Do you have to do anything special? Go see if a parameter has a bad value? Thanks in advance if you can help me. Franck VEDEL

4 10

[manila][cinder][glance][nova][devstack][qa] Add fmount to devstack-plugin-ceph core
by Goutham Pacha Ravi 17 Feb '22

17 Feb '22

Hello, As you're aware, we're looking to adopt cephadm within devstack-plugin-ceph to align with the ceph community's recommendations on day0-day2 handling of ceph [1] in devstack. Francesco Pantano has worked a ton on the integration of ceph with tripleo. He has been our go-to person for deploying and using the new nfs daemon with manila. In light of this, to make reviews more productive, I would like to propose fpantano(a)redhat.com (fmount on launchpad and oftc) to the devstack-plugin-ceph-core group [2]. He's aware of our review policies, and will take care not to break existing testing. Any objections? Thank you, Goutham Pacha Ravi [1] http://lists.openstack.org/pipermail/openstack-discuss/2022-January/026778.… [2] https://review.opendev.org/admin/groups/8e51d8f39e33d932a40f03060b861db57a3…

5 5

[keystone] anyone using OpenID with Keystone?
by Francois 16 Feb '22

16 Feb '22

Hi Keystone users! I am wondering if anyone has experience with keystone openid integration. Initially I was using Keystone LDAP backend (using tripleo KeystoneLDAPDomainEnable and KeystoneLDAPBackendConfigs parameters) and it works! Users are able to log in through Horizon or through the cli, roles can be given per LDAP group, and you can click in Horizon and download a working openrc or clouds.yaml file (minus the root CA that has to be added) to authenticate with the cli (and your password ends as an OS_PASSWORD variable in your environment). I am now trying the Keystone Openid backend (using the enable-federation-openidc.yaml provided by tripleo - https://github.com/openstack/tripleo-heat-templates/blob/master/environment…) with a mapping like this: [{"local":[{"user":{"name":"{0}"},"group":{"domain":{"name":"Default"},"name":"federated_users"}}],"remote":[{"type":"HTTP_OIDC_EMAIL"}]}] The SSO works superb with Horizon, however - logging with the cli seems impractical. I see some doc here: https://docs.ukcloud.com/articles/openstack/ostack-how-use-api-sso.html where you need to provide a secret, I am skeptical I want to do that. The openrc file downloaded from Horizon is not usable as is and needs some tuning. And there is no SSO, and the password still ends up in the environment... - I don't see how I can grant roles to groups anymore. It seems I need an extra mechanism to grant permissions (as I used to do that using LDAP groups). I am wondering if anyone is willing to share their experience dealing with Keystone and OpenID. Thanks! Francois (frigo)

5 5