March 2022 - openstack-discuss - lists.openstack.org

Cinder - easy to hit RecursionError with complex config formulas
by bartosz.rabiega＠ovhcloud.com 29 Mar '22

29 Mar '22

Hello, I wanted to share something I've recently discovered - there is a strange issue with cinder evaluating complex configuration formulas. For example when using complex goodness_function it's quite easy to hit: ERROR cinder.scheduler.weights.goodness maximum recursion depth exceeded: RecursionError: maximum recursion depth exceeded I did some tests to find the root cause. It seems that pyparsing module does deep recursive parsing quite a lot (default recursion limit is 1000). Not sure how to solve it but it would be nice to at least have a warning in the docs. Results and methodology below. Tests were done using following code snippet ------------------------------------------- from cinder.scheduler.evaluator.evaluator import evaluate import sys formulas = [ "1", "1 + 1", "max(1, 2, 3)", "max(1 + (10 / 20), 2, 3)", "(1 + max(1 + (10 / 20), 2, 3)) / 100", "((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb", "(((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb) / 100", ] stats = { 'allocated_capacity_gb': 50000, 'total_capacity_gb': 60000, 'free_capacity_gb': 10000, } for f in formulas: for i in range(10, 2000, 10): sys.setrecursionlimit(i) try: res = evaluate(f, stats=stats) print(f"{i}: {f}") break except RecursionError: pass Test results -------------------------------- Cinder 14.3.1, pyparsing<3.0 210: 1 210: 1 + 1 450: max(1, 2, 3) 600: max(1 + (10 / 20), 2, 3) 790: (1 + max(1 + (10 / 20), 2, 3)) / 100 980: ((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb 1160: (((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb) / 100 Cinder 16.4.2, pyparsing<3.0 220: 1 220: 1 + 1 450: max(1, 2, 3) 610: max(1 + (10 / 20), 2, 3) 790: (1 + max(1 + (10 / 20), 2, 3)) / 100 980: ((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb 1170: (((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb) / 100 Cinder 19.1.0, pyparsing<3.0 220: 1 220: 1 + 1 450: max(1, 2, 3) 610: max(1 + (10 / 20), 2, 3) 790: (1 + max(1 + (10 / 20), 2, 3)) / 100 980: ((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb 1170: (((1 + max(1 + (10 / 20), 2, 3)) / 100) + stats.total_capacity_gb) / 100 BR

2 1

[tacker] Zed PTG schedule
by Yasufumi Ogawa 28 Mar '22

28 Mar '22

Hi everyone, The next vPTG will be held on 4-8 April and I've reserved rooms 6-8 UTC from 5th to 8th Apr. If you have any suggestion, add your topic on the etherpad[1]. Please don't forget to register youself before joining[2]. [1] https://etherpad.opendev.org/p/tacker-zed-ptg [2] https://openinfra-ptg.eventbrite.com/ Cheers, Yasufumi

1 0

[keystone] get project info with username and password only?
by Tony Liu 28 Mar '22

28 Mar '22

Hi, Is there any way to know which project(s) a non-admin user is assigned to by username and password only? Or it can only be found out by admin user? The intention is to get the project-scoped token by username and password. Another thing interesting, when tried unscoped auth with Train and Xena, no project info or catalog returned. This is expected. But when tried the same unscoped auth with Ussuri, project info and catalog are returned. This is not expected. Any clues how this could happen? Or how I can look into it? Thanks! Tony

1 0

question on plain text config parameters encryption feature
by Alexander Yeremko 28 Mar '22

28 Mar '22

Dear OpenStack community, we are developing plain text config secrets encryption feature according to the next specification: https://specs.openstack.org/openstack/openstack-ansible-specs/specs/xena/pr… We started from Glance OS service and submitted two patchsets already: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/814865 Now we have two questions that we need to clarify to proceed our work on that feature and finish our development: 1. Is it correct that we need to develop more patchsets to rework some logic of encryption mechanism according to comment to 'files/encypt_secrets.py' script that arised at the second patchset (PatchSet 2) dated Nov/30/2021 ? Comment is by Dmitry Rabotyagov: "We _really_ should make it as an ansible plugin and re-work logic" 2. We wish to have such feature in previous releases also, not just in upcoming Yoga or Zed. Stein, Train and Victoria - it would be excellent to have plain text secrets encryption with these releases also. So question is how is it possible to use our feature in those releases also? Can we push some backports to those releases openstack-ansible repo? Best regards and wishes, Alex Yeremko This E-Mail (including any attachments) may contain privileged or confidential information. It is intended only for the addressee(s) indicated above. The sender does not waive any of its rights, privileges or other protections respecting this information. Any distribution, copying or other use of this E-Mail or the information it contains, by other than an intended recipient, is not sanctioned and is prohibited. If you received this E-Mail in error, please delete it and advise the sender (by return E-Mail or otherwise) immediately. Any calls held by you with Connectria may be recorded by an automated note taking system to ensure prompt follow up and for information collection purposes, and your attendance on any calls with Connectria confirms your consent to this. Any E-mail received by or sent from Connectria is subject to review by Connectria supervisory personnel.

2 1

[neutron] deputy report late
by Bence Romsics 28 Mar '22

28 Mar '22

Hi Team, I miscalculated a bit about how much time I have early this week and did not have time to compile the deputy report. Sorry for that. Later this week I'll catch up with the bugs still belonging to my week and make sure to send out the report so it can be discussed on next week's meeting. Cheers, Bence

1 0

[cinder] reminder: this week's meeting in video+IRC
by Brian Rosmaita 28 Mar '22

28 Mar '22

Quick reminder that this week's Cinder team meeting on Wednesday 30 March, being the final meeting of the month, will be held in both videoconference and IRC at the regularly scheduled time of 1400 UTC. Given that this is the final meeting of the Yoga development cycle, we're going to do a retrospective during the meeting. It would be helpful to get things rolling if you filled out one (or both) of the following 3 question forms: Cinder Wallaby-Xena-Yoga Retrospective - https://rosmaita.wufoo.com/forms/m1gc1dfo1s42947/ Cinder W-X-Y Retrospective Survey for Drivers - https://rosmaita.wufoo.com/forms/zab0fdr1dg4nwo/ As a reminder, these are the video meeting rules we've agreed to: * Everyone will keep IRC open during the meeting. * We'll take notes in IRC to leave a record similar to what we have for our regular IRC meetings. * Some people are more comfortable communicating in written English. So at any point, any attendee may request that the discussion of the current topic be conducted entirely in IRC. * The meeting will be recorded. connection info: https://bluejeans.com/3228528973 meeting agenda: https://etherpad.opendev.org/p/cinder-yoga-meetings cheers, brian

1 0

[sdk] Fixing role assignment for groups on a domain different than default
by Pedro Alvarez 28 Mar '22

28 Mar '22

Hi all, Some time ago I discovered that I wasn't able to add groups as members of a project (when not in the default domain) using "openstack.cloud.role_assignment". I spent some time debugging and figured what was the issue, and that a solution was already in place for "users", and not "groups". I also noticed that the master branch had all this part of the codebase rewritten, and probably the bug doesn't exist in there, but I believe that version of the sdk won't work with Xena. Additionally just noticed that the stable/yoga branch also has the issue. So, I'm sending a patch to fix this issue, hoping the next tag/release of openstacksdk could have the fix. You can find them here: https://review.opendev.org/q/topic:pedro%252Ffix-group-assignment-on-domain My guess is that the only relevant one would be the one for 'stable/yoga' and I can drop the other. Also I'm assuming that Zuul is taking its time to run CI, and I'll need to update some unit tests before it can be merged. Just wanted to know your thoughts before I finish with the tests. Thanks, Pedro. PS: An example of the current issue: The full traceback is: File "/tmp/ansible_openstack.cloud.role_assignment_payload_hcrpn6hu/ansible_openstack.cloud.role_assignment_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py", line 407, in __call__ results = self.run() File "/tmp/ansible_openstack.cloud.role_assignment_payload_hcrpn6hu/ansible_openstack.cloud.role_assignment_payload.zip/ansible_collections/openstack/cloud/plugins/modules/role_assignment.py", line 178, in run File "/home/ollivander/.local/lib/python3.9/site-packages/openstack/cloud/_identity.py", line 1379, in grant_role raise exc.OpenStackCloudException( failed: [localhost] (item={'name': 'sa', 'groups': ['openstack-sa', 'openstack-pe', 'openstack-technology']}) => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python3" }, "ansible_loop_var": "item", "changed": false, "extra_data": { "data": null, "details": "None", "response": "None" }, "invocation": { "module_args": { "api_timeout": null, "auth": null, "auth_type": null, "availability_zone": null, "ca_cert": null, "client_cert": null, "client_key": null, "domain": "LDAP", "group": "openstack-pe", "interface": "public", "project": "sa", "region_name": null, "role": "member", "state": "present", "timeout": 180, "user": null, "validate_certs": null, "wait": true } }, "item": { "groups": [ "openstack-sa", "openstack-pe", "openstack-technology" ], "name": "sa" }, "msg": "Must specify either a user or a group" }

1 0

[neutron] CI meetings next 2 weeks
by Slawek Kaplonski 28 Mar '22

28 Mar '22

Hi, I can't chair CI meeting this week (29.03) because of some personal appointment in the same time. Next week (5.04) there is PTG so lets cancel CI meeting this and next week. See You on the CI meeting after the PTG week, on Tuesday 12.04 -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[neutron] Week 13 meetings (starting from 28 March)
by Lajos Katona 28 Mar '22

28 Mar '22

Hi Neutrinos, Let's cancel this week's Team and Drivers meeting as we have PTG next week anyway. See you next week during the PTG Cheers Lajos Katona (lajoskatona)

1 0

[kolla-ansible] OVS br-ex configuration for OVN SNAT gateway along with HAProxy
by Tony Liu 26 Mar '22

26 Mar '22

Hi, My goal is to have OVN SNAT gateway (with OVS bridge) and HAProxy co-exist. Here is the networking configuration (partial) before deployment. eth1, no address, neutron_external_interface eth1.40, external address, kolla_external_vip_interface After deployment, I'd like to see this. br-ex eth1 eth1.40 tag 40 eth1.40 with external address But actually, only eth1 is put on br-ex by Kolla Ansible. Need eth1.40 on br-ex, because the external network is also one of the provider networks. Need eth1 on br-ex, to support other provider networks (different VLANs). It works fine when deploy with TripleO with os-net-config. Is it supported by Kolla Ansible? It seems Kolla Ansible only puts one interface (neutron_external_interface) on br-ex? I know a few workarounds in case that's not supported, just want to confirm. Thanks! Tony

2 2