March 2022 - openstack-discuss - lists.openstack.org

question on plain text config parameters encryption feature
by Alexander Yeremko 28 Mar '22

28 Mar '22

Dear OpenStack community, we are developing plain text config secrets encryption feature according to the next specification: https://specs.openstack.org/openstack/openstack-ansible-specs/specs/xena/pr… We started from Glance OS service and submitted two patchsets already: https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/814865 Now we have two questions that we need to clarify to proceed our work on that feature and finish our development: 1. Is it correct that we need to develop more patchsets to rework some logic of encryption mechanism according to comment to 'files/encypt_secrets.py' script that arised at the second patchset (PatchSet 2) dated Nov/30/2021 ? Comment is by Dmitry Rabotyagov: "We _really_ should make it as an ansible plugin and re-work logic" 2. We wish to have such feature in previous releases also, not just in upcoming Yoga or Zed. Stein, Train and Victoria - it would be excellent to have plain text secrets encryption with these releases also. So question is how is it possible to use our feature in those releases also? Can we push some backports to those releases openstack-ansible repo? Best regards and wishes, Alex Yeremko This E-Mail (including any attachments) may contain privileged or confidential information. It is intended only for the addressee(s) indicated above. The sender does not waive any of its rights, privileges or other protections respecting this information. Any distribution, copying or other use of this E-Mail or the information it contains, by other than an intended recipient, is not sanctioned and is prohibited. If you received this E-Mail in error, please delete it and advise the sender (by return E-Mail or otherwise) immediately. Any calls held by you with Connectria may be recorded by an automated note taking system to ensure prompt follow up and for information collection purposes, and your attendance on any calls with Connectria confirms your consent to this. Any E-mail received by or sent from Connectria is subject to review by Connectria supervisory personnel.

2 1

[neutron] deputy report late
by Bence Romsics 28 Mar '22

28 Mar '22

Hi Team, I miscalculated a bit about how much time I have early this week and did not have time to compile the deputy report. Sorry for that. Later this week I'll catch up with the bugs still belonging to my week and make sure to send out the report so it can be discussed on next week's meeting. Cheers, Bence

1 0

[cinder] reminder: this week's meeting in video+IRC
by Brian Rosmaita 28 Mar '22

28 Mar '22

Quick reminder that this week's Cinder team meeting on Wednesday 30 March, being the final meeting of the month, will be held in both videoconference and IRC at the regularly scheduled time of 1400 UTC. Given that this is the final meeting of the Yoga development cycle, we're going to do a retrospective during the meeting. It would be helpful to get things rolling if you filled out one (or both) of the following 3 question forms: Cinder Wallaby-Xena-Yoga Retrospective - https://rosmaita.wufoo.com/forms/m1gc1dfo1s42947/ Cinder W-X-Y Retrospective Survey for Drivers - https://rosmaita.wufoo.com/forms/zab0fdr1dg4nwo/ As a reminder, these are the video meeting rules we've agreed to: * Everyone will keep IRC open during the meeting. * We'll take notes in IRC to leave a record similar to what we have for our regular IRC meetings. * Some people are more comfortable communicating in written English. So at any point, any attendee may request that the discussion of the current topic be conducted entirely in IRC. * The meeting will be recorded. connection info: https://bluejeans.com/3228528973 meeting agenda: https://etherpad.opendev.org/p/cinder-yoga-meetings cheers, brian

1 0

[sdk] Fixing role assignment for groups on a domain different than default
by Pedro Alvarez 28 Mar '22

28 Mar '22

Hi all, Some time ago I discovered that I wasn't able to add groups as members of a project (when not in the default domain) using "openstack.cloud.role_assignment". I spent some time debugging and figured what was the issue, and that a solution was already in place for "users", and not "groups". I also noticed that the master branch had all this part of the codebase rewritten, and probably the bug doesn't exist in there, but I believe that version of the sdk won't work with Xena. Additionally just noticed that the stable/yoga branch also has the issue. So, I'm sending a patch to fix this issue, hoping the next tag/release of openstacksdk could have the fix. You can find them here: https://review.opendev.org/q/topic:pedro%252Ffix-group-assignment-on-domain My guess is that the only relevant one would be the one for 'stable/yoga' and I can drop the other. Also I'm assuming that Zuul is taking its time to run CI, and I'll need to update some unit tests before it can be merged. Just wanted to know your thoughts before I finish with the tests. Thanks, Pedro. PS: An example of the current issue: The full traceback is: File "/tmp/ansible_openstack.cloud.role_assignment_payload_hcrpn6hu/ansible_openstack.cloud.role_assignment_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py", line 407, in __call__ results = self.run() File "/tmp/ansible_openstack.cloud.role_assignment_payload_hcrpn6hu/ansible_openstack.cloud.role_assignment_payload.zip/ansible_collections/openstack/cloud/plugins/modules/role_assignment.py", line 178, in run File "/home/ollivander/.local/lib/python3.9/site-packages/openstack/cloud/_identity.py", line 1379, in grant_role raise exc.OpenStackCloudException( failed: [localhost] (item={'name': 'sa', 'groups': ['openstack-sa', 'openstack-pe', 'openstack-technology']}) => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python3" }, "ansible_loop_var": "item", "changed": false, "extra_data": { "data": null, "details": "None", "response": "None" }, "invocation": { "module_args": { "api_timeout": null, "auth": null, "auth_type": null, "availability_zone": null, "ca_cert": null, "client_cert": null, "client_key": null, "domain": "LDAP", "group": "openstack-pe", "interface": "public", "project": "sa", "region_name": null, "role": "member", "state": "present", "timeout": 180, "user": null, "validate_certs": null, "wait": true } }, "item": { "groups": [ "openstack-sa", "openstack-pe", "openstack-technology" ], "name": "sa" }, "msg": "Must specify either a user or a group" }

1 0

[neutron] CI meetings next 2 weeks
by Slawek Kaplonski 28 Mar '22

28 Mar '22

Hi, I can't chair CI meeting this week (29.03) because of some personal appointment in the same time. Next week (5.04) there is PTG so lets cancel CI meeting this and next week. See You on the CI meeting after the PTG week, on Tuesday 12.04 -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[neutron] Week 13 meetings (starting from 28 March)
by Lajos Katona 28 Mar '22

28 Mar '22

Hi Neutrinos, Let's cancel this week's Team and Drivers meeting as we have PTG next week anyway. See you next week during the PTG Cheers Lajos Katona (lajoskatona)

1 0

[kolla-ansible] OVS br-ex configuration for OVN SNAT gateway along with HAProxy
by Tony Liu 26 Mar '22

26 Mar '22

Hi, My goal is to have OVN SNAT gateway (with OVS bridge) and HAProxy co-exist. Here is the networking configuration (partial) before deployment. eth1, no address, neutron_external_interface eth1.40, external address, kolla_external_vip_interface After deployment, I'd like to see this. br-ex eth1 eth1.40 tag 40 eth1.40 with external address But actually, only eth1 is put on br-ex by Kolla Ansible. Need eth1.40 on br-ex, because the external network is also one of the provider networks. Need eth1 on br-ex, to support other provider networks (different VLANs). It works fine when deploy with TripleO with os-net-config. Is it supported by Kolla Ansible? It seems Kolla Ansible only puts one interface (neutron_external_interface) on br-ex? I know a few workarounds in case that's not supported, just want to confirm. Thanks! Tony

2 2

[neutron] Feedback on slides (driver's meeting topic)
by Rodolfo Alonso Hernandez 26 Mar '22

26 Mar '22

Hello Neutrinos (and Lajos on this topic): I would also add: - OVN BW scheduling aware (in progress during the last two cycles but almost ready). - OVN QoS GW IP (actually the patch was merged, so for sure we'll have this feature that closes the gap between OVN and OVS). Regards.

3 2

[all][tc] What's happening in Technical Committee: summary Mar 25th, 21: Reading: 10 min
by Ghanshyam Mann 26 Mar '22

26 Mar '22

Hello Everyone, Here is this week's summary of the Technical Committee activities. 1. TC Meetings: ============ * We had this week's meeting on Mar 24th. Most of the meeting discussions are summarized below (Completed or in-progress activities section). Meeting full logs are available @https://meetings.opendev.org/meetings/tc/2022/tc.2022-03-24-15.00.log.html * Due to OpenInfra episode and PTG, we have cancelled the next two meetings[1] and will be meeting on April 14th Thursday 15:00 UTC, feel free to add the topic on the agenda[2] by April 13th. 2. What we completed this week: ========================= * None for this week. 3. Activities In progress: ================== TC Tracker for Yoga cycle ------------------------------ * This etherpad includes the Yoga cycle targets/working items for TC[3]. 4 out of 9 items are completed and many are in progress. Open Reviews ----------------- * Five open reviews for ongoing activities[4]. Consistent and Secure Default RBAC -------------------------------------------- I sent the updates for Yoga timeline target on ML[5] and created the etherpad to track this goal for all the milestone[6]. The quick summary is, along with keystone, Nova has completed the work and neutron is in progress. Community-wide goals readiness checklist -------------------------------------------------- As we received the feedback in Yoga PTG TC+PTL interaction session, I have proposed the checklist which can help us to check if the goal is ready to start or not[7], please review and let us know if more items need to be added. Zed cycle Leaderless projects ---------------------------------- No updates on this. I am still waiting for Zaqar PTL +1 on the PTL appointment patch[8] and we will discuss Adjutant in PTG, hoping Braden will be ready with their company side permission[9]. PTG Preparation -------------------- Nothing much to share on this but please continue adding the topics in etherpad[10]. Dropping tags framework ------------------------------ Along with deprecation tag removal[11], we are removing the complete framework now[12]. Fixing Zuul config error ---------------------------- Requesting projects with zuul config error to look into those and fix them which should not take much time[13]. Project updates ------------------- * None for this week. 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[14]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [15] 3. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] http://lists.openstack.org/pipermail/openstack-discuss/2022-March/027828.ht… [2] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [3] https://etherpad.opendev.org/p/tc-yoga-tracker [4] https://review.opendev.org/q/projects:openstack/governance+status:open [5] http://lists.openstack.org/pipermail/openstack-discuss/2022-March/027837.ht… [6] https://etherpad.opendev.org/p/rbac-goal-tracking [7] https://review.opendev.org/c/openstack/governance/+/835102 [8] https://review.opendev.org/c/openstack/governance/+/831123 [9] http://lists.openstack.org/pipermail/openstack-discuss/2022-March/027626.ht… [10] https://etherpad.opendev.org/p/tc-zed-ptg [11] https://review.opendev.org/c/openstack/governance/+/834327 [12] https://review.opendev.org/c/openstack/governance/+/834798/3 [13] https://etherpad.opendev.org/p/zuul-config-error-openstack [14] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [15] http://eavesdrop.openstack.org/#Technical_Committee_Meeting -gmann

1 0

[magnum] kube_cluster_deploy timing out
by Chris DiLorenzo 25 Mar '22

25 Mar '22

Hello, I'm trying to deploy a kubernetes cluster using CoreOS 33. I have also tried with CoreOS 35/. 1 master, 1 worker. Ths VMs are deploying without issue. However, the stack is timing out on kube_cluster_deploy. It appears the kubernetes API isn't running: [root@tes-001-pkjawhk66slm-master-0 log]# podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES a08cbea59a57 docker.io/openstackmagnum/heat-container-agent:wallaby-stable-1 /usr/bin/start-he... 21 minutes ago Up 21 minutes ago heat-container-agent [root@tes-001-pkjawhk66slm-master-0 log]# ss -ln | grep 8080 -> nothing [root@tes-001-pkjawhk66slm-master-0 heat-config-script]# tail -f 8d8fa128-bca4-485e-946f-90732ebb4cf0-tes-001-pkjawhk66slm-kube_cluster_config-bwkfqwjxzk36.log + sleep 5 ++ kubectl get --raw=/healthz The connection to the server localhost:8080 was refused - did you specify the right host or port? + '[' ok = '' ']' + sleep 5 ++ kubectl get --raw=/healthz The connection to the server localhost:8080 was refused - did you specify the right host or port? + '[' ok = '' ']' + sleep 5 ++ kubectl get --raw=/healthz Not sure where else to look. Thanks Chris

1 0