May 2022 - openstack-discuss - lists.openstack.org

[keystone][swift] audit logs
by Sharath Ck 22 May '22

22 May '22

Hi, I am currently trying to add keystone audit middleware in Swift. Middleware is managed in swift proxy server, hence I have added the audit filter in proxy server conf and have mentioned audit_middleware_notifications driver as log in swift.conf . I can see REST API call flow reaching audit middleware and constructing the audit event with minimal data as Swift is not loading service catalog information. But the audit event is not getting notified as per audit_middleware_notifications. I tried adding oslo_messaging_notifications with the driver as log, but audit events are not getting notified. Below are the changes in swift_proxy_server container, proxy-server.conf [pipeline:main] pipeline = catch_errors gatekeeper healthcheck cache container_sync bulk tempurl ratelimit formpost authtoken keystoneauth audit container_quotas account_quotas slo dlo keymaster encryption proxy-server [filter:audit] paste.filter_factory = keystonemiddleware.audit:filter_factory audit_map_file = /etc/swift/api_audit_map.conf swift.conf [oslo_messaging_notifications] driver = log [audit_middleware_notifications] driver = log Kindly confirm whether the configuration changes are enough or need more changes. Regards, Sharath

2 3

[neutron] Bug deputy report - week of May 16th
by Slawek Kaplonski 22 May '22

22 May '22

Hi, I was Neutron bug deputy last week. It was pretty busy week this time. Below is summary of new bugs opened during that time: ## High * https://bugs.launchpad.net/neutron/+bug/1973783 - [devstack] Segment plugin reports Traceback as placement client not configured - assigned to Yatin, in progress * https://bugs.launchpad.net/neutron/+bug/1974144 - [sqlalchemy-20] Missing DB context in "_get_dvr_hosts_for_subnets" - assigned to Rodolfo, in progress * https://bugs.launchpad.net/neutron/+bug/1974142 - [sqlalchemy-20] Missing DB context in "_update_subnet_postcommit" - assigned to Rodolfo, in progress * https://bugs.launchpad.net/neutron/+bug/1974057 - [neutron-dynamic-routing] Plugin RPC queue should be consumed by RPC workers - assigned to Renat Nurgaliyev, in progress ## Medium * https://bugs.launchpad.net/neutron/+bug/1973726 - [DB] "SubnetPool" exact match queries to non-indexed columns - *needs assignment* * https://bugs.launchpad.net/neutron/+bug/1973765 - LB creation failed due to address already in use - assigned to Fernando, fix proposed https://review.opendev.org/c/openstack/ovn-octavia-provider/+/842107 * https://bugs.launchpad.net/neutron/+bug/1974183 - Neutron allows creation of trunks for VIF_TYPE_HW_VEB ports - *needs assignment* * https://bugs.launchpad.net/neutron/+bug/1974149 - [FT] Test "test_agent_updated_at_use_nb_cfg_timestamp" failing - assigned to Rodolfo, in progress * https://bugs.launchpad.net/neutron/+bug/1974052 - Load Balancer remains in PENDING_CREATE - assigned to Fernando Royo, in progress ## Low * https://bugs.launchpad.net/neutron/+bug/1973656 - meaning of option "router_auto_schedule" is ambiguous - *needs assignment *but I think we need to discuss about it in the team meeting first to decide what naming/behaviour we really want to have, * https://bugs.launchpad.net/neutron/+bug/1973731 - [UT] Error output in "test_metadata_port_on_network_delete" - assigned to Rodolfo * https://bugs.launchpad.net/neutron/+bug/1973780 - PEP 632 – Deprecate distutils module - assigned to Rodolfo, fixes already proposed https://review.opendev.org/c/openstack/neutron/+/842133 and https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/842135 ## Whishlist (RFEs) * https://bugs.launchpad.net/neutron/+bug/1973487 - [RFE] Allow setting --dst-port for all port based protocols at once And that's all. -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

SSL verify failed | Overcloud deploy step 4 | Wallaby | tripleo
by Swogat Pradhan 22 May '22

22 May '22

Hi, I am currently stuck in deploy step 4 with the following error: FATAL | Clean up legacy Cinder keystone catalog entries | undercloud | item={'service_name': 'cinderv3', 'service_type': 'volume'} | error={"ansible_index_var": "cinder_api_service", "ansible_loop_var": "item", "changed": false, "cinder_api_service": 1, "item": {"service_name": "cinderv3", "service_type": "volume"}, "module_stderr": "Failed to discover available identity versions when contacting https://overcloud.bdxworld.com:13000. Attempting to parse version from URL.\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 677, in urlopen\n chunked=chunked,\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 381, in make_request\n self._validate_conn(conn)\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 978, in _validate_conn\n conn.connect()\n File \"/usr/lib/python3.6/site-packages/urllib3/connection.py\", line 371, in connect\n ssl_context=context,\n File \"/usr/lib/python3.6/site-packages/urllib3/util/ssl.py\", line 384, in ssl_wrap_socket\n return context.wrap_socket(sock, server_hostname=server_hostname)\n File \"/usr/lib64/python3.6/ssl.py\", line 365, in wrap_socket\n context=self, _session=session)\n File \"/usr/lib64/python3.6/ssl.py\", line 776, in __init\n self.do_handshake()\n File \"/usr/lib64/python3.6/ssl.py\", line 1036, in do_handshake\n self._sslobj.do_handshake()\n File \"/usr/lib64/python3.6/ssl.py\", line 648, in do_handshake\n self._sslobj.do_handshake()\nssl.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 449, in send\n timeout=timeout\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 727, in urlopen\n method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]\n File \"/usr/lib/python3.6/site-packages/urllib3/util/retry.py\", line 439, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='overcloud.bdxworld.com', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1022, in _send_request\n resp = self.session.request(method, url, *kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 542, in request\n resp = self.send(prep, **send_kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 655, in send\n r = adapter.send(request, **kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='overcloud.bdxworld.com', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 138, in _do_create_plugin\n authenticated=False)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 610, in get_discovery\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 1452, in get_discovery\n disc = Discover(session, url, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 536, in __init_\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 102, in get_version_data\n resp = session.get(url, headers=headers, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1141, in get\n return self.request(url, 'GET', **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 931, in request\n resp = send(**kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1026, in _send_request\n raise exceptions.SSLError(msg)\nkeystoneauth1.exceptions.connection.SSLError: SSL exception connecting to https://overcloud.bdxworld.com:13000: HTTPSConnectionPool(host='overcloud.bdxworld.com', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"<stdin>\", line 102, in <module>\n File \"<stdin>\", line 94, in _ansiballz_main\n File \"<stdin>\", line 40, in invoke_module\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n mod_name, mod_spec, pkg_name, script_name)\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 185, in <module>\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 181, in main\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py\", line 407, in __call_\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 102, in get_version_data\n resp = session.get(url, headers=headers, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1141, in get\n return self.request(url, 'GET', **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 931, in request\n resp = send(**kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1026, in _send_request\n raise exceptions.SSLError(msg)\nkeystoneauth1.exceptions.connection.SSLError: SSL exception connecting to https://overcloud.bdxworld.com:13000: HTTPSConnectionPool(host='overcloud.bdxworld.com', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"<stdin>\", line 102, in <module>\n File \"<stdin>\", line 94, in _ansiballz_main\n File \"<stdin>\", line 40, in invoke_module\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n mod_name, mod_spec, pkg_name, script_name)\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 185, in <module>\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 181, in main\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py\", line 407, in __call__\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_yfxm9irl/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 141, in run\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 517, in search_services\n services = self.list_services()\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 492, in list_services\n if self._is_client_version('identity', 2):\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 460, in _is_client_version\n client = getattr(self, client_name)\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 32, in _identity_client\n 'identity', min_version=2, max_version='3.latest')\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 407, in _get_versioned_client\n if adapter.get_endpoint():\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/adapter.py\", line 291, in get_endpoint\n return self.session.get_endpoint(auth or self.auth, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1243, in get_endpoint\n return auth.get_endpoint(self, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 380, in get_endpoint\n allow_version_hack=allow_version_hack, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 271, in get_endpoint_data\n service_catalog = self.get_access(session).service_catalog\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 134, in get_access\n self.auth_ref = self.get_auth_ref(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 206, in get_auth_ref\n self._plugin = self._do_create_plugin(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 161, in _do_create_plugin\n 'auth_url is correct. %s' % e)\nkeystoneauth1.exceptions.discovery.DiscoveryFailure: Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. SSL exception connecting to https://overcloud.bdxworld.com:13000: HTTPSConnectionPool(host=' overcloud.bdxworld.com', port=13000): Max retries exceeded with url: / (Caused by SSLError(SSLError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:897)'),))\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} *Catalog list:* +-----------+----------------+--------------------------------------------------------------------------------------+ | Name | Type | Endpoints | +-----------+----------------+--------------------------------------------------------------------------------------+ | aodh | alarming | regionOne | | | | internal: http://172.25.201.250:8042 | | | | regionOne | | | | public: http://172.25.201.150:8042 | | | | regionOne | | | | admin: http://172.25.201.250:8042 | | | | | | placement | placement | regionOne | | | | admin: http://172.25.201.250:8778/placement | | | | regionOne | | | | internal: http://172.25.201.250:8778/placement | | | | regionOne | | | | public: http://172.25.201.150:8778/placement | | | | | | gnocchi | metric | regionOne | | | | public: http://172.25.201.150:8041 | | | | regionOne | | | | internal: http://172.25.201.250:8041 | | | | regionOne | | | | admin: http://172.25.201.250:8041 | | | | | | glance | image | regionOne | | | | internal: http://172.25.201.250:9292 | | | | regionOne | | | | admin: http://172.25.201.250:9292 | | | | regionOne | | | | public: http://172.25.201.150:9292 | | | | | | keystone | identity | regionOne | | | | internal: http://172.25.201.250:5000 | | | | regionOne | | | | admin: http://172.25.201.250:35357 | | | | regionOne | | | | public: https://overcloud.bdxworld.com:13000 | | | | | | heat-cfn | cloudformation | regionOne | | | | internal: http://172.25.201.250:8000/v1 | | | | regionOne | | | | public: http://172.25.201.150:8000/v1 | | | | regionOne | | | | admin: http://172.25.201.250:8000/v1 | | | | | | neutron | network | regionOne | | | | admin: http://172.25.201.250:9696 | | | | regionOne | | | | public: http://172.25.201.150:9696 | | | | regionOne | | | | internal: http://172.25.201.250:9696 | | | | | | heat | orchestration | regionOne | | | | internal: http://172.25.201.250:8004/v1/5d922243077045c48fe4b075e386551b | | | | regionOne | | | | public: http://172.25.201.150:8004/v1/5d922243077045c48fe4b075e386551b | | | | regionOne | | | | admin: http://172.25.201.250:8004/v1/5d922243077045c48fe4b075e386551b | | | | | | octavia | load-balancer | regionOne | | | | public: http://172.25.201.150:9876 | | | | regionOne | | | | admin: http://172.25.201.250:9876 | | | | regionOne | | | | internal: http://172.25.201.250:9876 | | | | | | cinderv3 | volumev3 | regionOne | | | | internal: http://172.25.201.250:8776/v3/5d922243077045c48fe4b075e386551b | | | | regionOne | | | | public: http://172.25.201.150:8776/v3/5d922243077045c48fe4b075e386551b | | | | regionOne | | | | admin: http://172.25.201.250:8776/v3/5d922243077045c48fe4b075e386551b | | | | | | swift | object-store | regionOne | | | | public: http://172.25.201.150:8080/swift/v1/AUTH_5d922243077045c48fe4b075e386551b | | | | regionOne | | | | admin: http://172.25.202.50:8080/swift/v1/AUTH_5d922243077045c48fe4b075e386551b | | | | regionOne | | | | internal: http://172.25.202.50:8080/swift/v1/AUTH_5d922243077045c48fe4b075e386551b | | | | | | nova | compute | regionOne | | | | admin: http://172.25.201.250:8774/v2.1 | | | | regionOne | | | | internal: http://172.25.201.250:8774/v2.1 | | | | regionOne | | | | public: http://172.25.201.150:8774/v2.1 | | | | *Host entries:* [stack@hkg2director ~]$ cat /etc/hosts # START_HOST_ENTRIES_FOR_STACK: overcloud 172.25.201.68 hkg2director.ctlplane.bdxworld.com hkg2director.ctlplane hkg2director.ctlplane.bdxcloud.bdxworld.com 172.25.201.91 overcloud.ctlplane.bdxworld.com 172.25.202.50 overcloud.storage.bdxworld.com 172.25.202.90 overcloud.storagemgmt.bdxworld.com 172.25.201.250 overcloud.internalapi.bdxworld.com 172.25.201.150 overcloud.bdxworld.com 172.25.201.212 overcloud-controller-0.bdxworld.com overcloud-controller-0 172.25.202.13 overcloud-controller-0.storage.bdxworld.com overcloud-controller-0.storage 172.25.202.75 overcloud-controller-0.storagemgmt.bdxworld.com overcloud-controller-0.storagemgmt 172.25.201.212 overcloud-controller-0.internalapi.bdxworld.com overcloud-controller-0.internalapi 172.25.202.143 overcloud-controller-0.tenant.bdxworld.com overcloud-controller-0.tenant 172.25.201.144 overcloud-controller-0.external.bdxworld.com overcloud-controller-0.external 172.25.201.106 overcloud-controller-0.ctlplane.bdxworld.com overcloud-controller-0.ctlplane 172.25.201.205 overcloud-controller-1.bdxworld.com overcloud-controller-1 172.25.202.18 overcloud-controller-1.storage.bdxworld.com overcloud-controller-1.storage 172.25.202.76 overcloud-controller-1.storagemgmt.bdxworld.com overcloud-controller-1.storagemgmt 172.25.201.205 overcloud-controller-1.internalapi.bdxworld.com overcloud-controller-1.internalapi 172.25.202.142 overcloud-controller-1.tenant.bdxworld.com overcloud-controller-1.tenant 172.25.201.149 overcloud-controller-1.external.bdxworld.com overcloud-controller-1.external 172.25.201.105 overcloud-controller-1.ctlplane.bdxworld.com overcloud-controller-1.ctlplane 172.25.201.201 overcloud-controller-2.bdxworld.com overcloud-controller-2 172.25.202.12 overcloud-controller-2.storage.bdxworld.com overcloud-controller-2.storage 172.25.202.74 overcloud-controller-2.storagemgmt.bdxworld.com overcloud-controller-2.storagemgmt 172.25.201.201 overcloud-controller-2.internalapi.bdxworld.com overcloud-controller-2.internalapi 172.25.202.149 overcloud-controller-2.tenant.bdxworld.com overcloud-controller-2.tenant 172.25.201.139 overcloud-controller-2.external.bdxworld.com overcloud-controller-2.external 172.25.201.97 overcloud-controller-2.ctlplane.bdxworld.com overcloud-controller-2.ctlplane 172.25.201.209 overcloud-controller-no-ceph-3.bdxworld.com overcloud-controller-no-ceph-3 172.25.202.17 overcloud-controller-no-ceph-3.storage.bdxworld.com overcloud-controller-no-ceph-3.storage 172.25.202.79 overcloud-controller-no-ceph-3.storagemgmt.bdxworld.com overcloud-controller-no-ceph-3.storagemgmt 172.25.201.209 overcloud-controller-no-ceph-3.internalapi.bdxworld.com overcloud-controller-no-ceph-3.internalapi 172.25.202.135 overcloud-controller-no-ceph-3.tenant.bdxworld.com overcloud-controller-no-ceph-3.tenant 172.25.201.137 overcloud-controller-no-ceph-3.external.bdxworld.com overcloud-controller-no-ceph-3.external 172.25.201.103 overcloud-controller-no-ceph-3.ctlplane.bdxworld.com overcloud-controller-no-ceph-3.ctlplane 172.25.201.202 overcloud-novacompute-0.bdxworld.com overcloud-novacompute-0 172.25.202.19 overcloud-novacompute-0.storage.bdxworld.com overcloud-novacompute-0.storage 172.25.201.202 overcloud-novacompute-0.internalapi.bdxworld.com overcloud-novacompute-0.internalapi 172.25.202.140 overcloud-novacompute-0.tenant.bdxworld.com overcloud-novacompute-0.tenant 172.25.201.107 overcloud-novacompute-0.ctlplane.bdxworld.com overcloud-novacompute-0.ctlplane 172.25.201.207 overcloud-novacompute-1.bdxworld.com overcloud-novacompute-1 172.25.202.15 overcloud-novacompute-1.storage.bdxworld.com overcloud-novacompute-1.storage 172.25.201.207 overcloud-novacompute-1.internalapi.bdxworld.com overcloud-novacompute-1.internalapi 172.25.202.144 overcloud-novacompute-1.tenant.bdxworld.com overcloud-novacompute-1.tenant 172.25.201.112 overcloud-novacompute-1.ctlplane.bdxworld.com overcloud-novacompute-1.ctlplane 172.25.201.200 overcloud-novacompute-2.bdxworld.com overcloud-novacompute-2 172.25.202.20 overcloud-novacompute-2.storage.bdxworld.com overcloud-novacompute-2.storage 172.25.201.200 overcloud-novacompute-2.internalapi.bdxworld.com overcloud-novacompute-2.internalapi 172.25.202.138 overcloud-novacompute-2.tenant.bdxworld.com overcloud-novacompute-2.tenant 172.25.201.100 overcloud-novacompute-2.ctlplane.bdxworld.com overcloud-novacompute-2.ctlplane 172.25.201.199 overcloud-novacompute-3.bdxworld.com overcloud-novacompute-3 172.25.202.9 overcloud-novacompute-3.storage.bdxworld.com overcloud-novacompute-3.storage 172.25.201.199 overcloud-novacompute-3.internalapi.bdxworld.com overcloud-novacompute-3.internalapi 172.25.202.141 overcloud-novacompute-3.tenant.bdxworld.com overcloud-novacompute-3.tenant 172.25.201.104 overcloud-novacompute-3.ctlplane.bdxworld.com overcloud-novacompute-3.ctlplane 172.25.201.198 overcloud-novacompute-4.bdxworld.com overcloud-novacompute-4 172.25.202.16 overcloud-novacompute-4.storage.bdxworld.com overcloud-novacompute-4.storage 172.25.201.198 overcloud-novacompute-4.internalapi.bdxworld.com overcloud-novacompute-4.internalapi 172.25.202.139 overcloud-novacompute-4.tenant.bdxworld.com overcloud-novacompute-4.tenant 172.25.201.109 overcloud-novacompute-4.ctlplane.bdxworld.com overcloud-novacompute-4.ctlplane 172.25.202.14 overcloud-cephstorage-0.bdxworld.com overcloud-cephstorage-0 172.25.202.14 overcloud-cephstorage-0.storage.bdxworld.com overcloud-cephstorage-0.storage 172.25.202.72 overcloud-cephstorage-0.storagemgmt.bdxworld.com overcloud-cephstorage-0.storagemgmt 172.25.201.101 overcloud-cephstorage-0.ctlplane.bdxworld.com overcloud-cephstorage-0.ctlplane 172.25.202.6 overcloud-cephstorage-1.bdxworld.com overcloud-cephstorage-1 172.25.202.6 overcloud-cephstorage-1.storage.bdxworld.com overcloud-cephstorage-1.storage 172.25.202.78 overcloud-cephstorage-1.storagemgmt.bdxworld.com overcloud-cephstorage-1.storagemgmt 172.25.201.92 overcloud-cephstorage-1.ctlplane.bdxworld.com overcloud-cephstorage-1.ctlplane 172.25.202.11 overcloud-cephstorage-2.bdxworld.com overcloud-cephstorage-2 172.25.202.11 overcloud-cephstorage-2.storage.bdxworld.com overcloud-cephstorage-2.storage 172.25.202.85 overcloud-cephstorage-2.storagemgmt.bdxworld.com overcloud-cephstorage-2.storagemgmt 172.25.201.111 overcloud-cephstorage-2.ctlplane.bdxworld.com overcloud-cephstorage-2.ctlplane 172.25.202.10 overcloud-cephstorage-3.bdxworld.com overcloud-cephstorage-3 172.25.202.10 overcloud-cephstorage-3.storage.bdxworld.com overcloud-cephstorage-3.storage 172.25.202.87 overcloud-cephstorage-3.storagemgmt.bdxworld.com overcloud-cephstorage-3.storagemgmt 172.25.201.96 overcloud-cephstorage-3.ctlplane.bdxworld.com overcloud-cephstorage-3.ctlplane 172.25.201.68 hkg2director.ctlplane.bdxworld.com hkg2director.ctlplane hkg2director.ctlplane.bdxcloud.bdxworld.com # END_HOST_ENTRIES_FOR_STACK: overcloud # START_HOST_ENTRIES_FOR_STACK: undercloud 172.25.201.68 hkg2director.bdxworld.com hkg2director 172.25.201.68 hkg2director.external.bdxworld.com hkg2director.external 172.25.201.68 hkg2director.ctlplane.bdxworld.com hkg2director.ctlplane 172.25.201.68 bdxworld.com 172.25.201.68 bdxworld.com # END_HOST_ENTRIES_FOR_STACK: undercloud 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 172.25.201.68 hkg2director.bdxworld.com hkg2director bdxworld.com NOTE: my overcloud nodes are in the DMZ. Any help would be appreciated. With regards, Swogat Pradhan

1 0

Octavia Amphora staying in PENDING_CREATE forever.
by Russell Stather 22 May '22

22 May '22

4 6

Issue creating octavia loadbalancer
by Russell Stather 22 May '22

22 May '22

Hi Trying to create a load balancer. Get the following error. igadmin@ig-umh-maas:~$ openstack loadbalancer create -f value -c vip_port_id --name lb1 --vip-subnet-id 66690e99-44b2-4233-8f16-d539c8a05090 Provider 'amphora' reports error: Port security must be enabled on the VIP network. (HTTP 500) (Request-ID: req-642a4b4d-0d45-4a08-ba47-d4232a350703) igadmin@ig-umh-maas:~$ !1067 openstack network set --enable-port-security int_net BadRequestException: 400: Client Error for url: https://10.0.110.231:9696/v2.0/networks/be5f8494-1964-466b-a47a-8e5430976009, Unrecognized attribute(s) 'port_security_enabled' Anyone come across this issue? Thanks Russell

2 2

Magnum CSI Cinder Plugin broken in Yoga?
by Oliver Weinmann 21 May '22

21 May '22

Hi, I just updated to Yoga in order to fix the problem with the broken metrics-server, but now I had problems deploying GITLAB and the errors lead to problems with mounting PVs. So I had a look at the csi-cinder-plugin and saw this: kolla-yoga) [oliweilocal@gedasvl99 images]$ kubectl get pods -n kube-system | grep -i csi csi-cinder-controllerplugin-0 4/5 CrashLoopBackOff 168 (4m53s ago) 14h csi-cinder-nodeplugin-7kh9q 2/2 Running 0 14h csi-cinder-nodeplugin-q5bfq 2/2 Running 0 14h csi-cinder-nodeplugin-x4vrk 2/2 Running 0 14h I re-deployed the cluster and the error stays. Is there anything known about this? I have a small Ceph Pacific cluster. I can do some testing with an NFS backend as well and see if the problem goes away. Best Regards, Oliver

2 3

updating the overcloud domain in undercloud.conf | Wallaby | Tripleo
by Swogat Pradhan 20 May '22

20 May '22

Hi, I am currently deploying openstack wallaby using tripleo method, and my overcloud is up, now i want to change the overcloud domain specified in the udercloud domain and then redeploy the overcloud again. So if I change the undercloud.conf to the new domain and run openstack undercloud install, will it affect the already inspected nodes, provisioned network, ceph and nodes? Do I have to do introspection and other activities again? My plan was to : 1. change the domain in undercloud.conf 2. run openstack undercloud install (hoping it doesn't affect anything else and just updates the domain name) 3. redeploy overcloud stack only using openstack overcloud deploy (no introspection, no node provision and other activities ). With regards, Swogat Pradhan

1 0

[all][tc] What's happening in Technical Committee: summary May 20, 2022: Reading: 5 min
by Ghanshyam Mann 20 May '22

20 May '22

Hello Everyone, Here is this week's summary of the Technical Committee activities. 1. TC Meetings: ============ * We had this week's meeting on May 19. Most of the meeting discussions are summarized in this email. Meeting summary logs are available @https://meetings.opendev.org/meetings/tc/2022/tc.2022-05-19-15.00.log.html * Next TC weekly meeting will be on May 26 Thursday at 15:00 UTC, feel free to add the topic on the agenda[1] by May 25. 2. What we completed this week: ========================= * Changed new release cadence terminology from tick-tock to "SLURP" [2][3]. 3. Activities In progress: ================== TC Tracker for Zed cycle ------------------------------ * Zed tracker etherpad includes the TC working items[4], we have started the many items. Open Reviews ----------------- * Seven open reviews for ongoing activities[5]. Change OpenStack release naming policy proposal ----------------------------------------------------------- As the next step, we will have a voice call to figure out how to use the number/name in our development cycle/tooling. Meeting detail is shared in ML[6] New release cadence "SLURP" open items -------------------------------------------------- 1. release notes strategy: Brian will be proposing the agreed approach for release notes for the "SLURP" releases. Improve project governance --------------------------------- Slawek has the proposal the framework up and it is under review[7]. New ELK service dashboard: e-r service ----------------------------------------------- Not much update in this than last week. TripleO team and dpawlik are working on the e-r repo merge and hosting part. Consistent and Secure Default RBAC ------------------------------------------- We will have our next call on May 24[8], feel free to add the topic you would like to discuss in etherpad[9]. We will try to cover the heat topic if there is feedback on Takashi sent an email asking the feedback about the 'split stack' approach[10] 2021 User Survey TC Question Analysis ----------------------------------------------- No update on this. The survey summary is up for review[11]. Feel free to check and provide feedback. Zed cycle Leaderless projects ---------------------------------- No updates on this. Only Adjutant project is leaderless/maintainer-less. We will check Adjutant's the situation again on ML and hope Braden will be ready with their company side permission[12]. Fixing Zuul config error ---------------------------- Requesting projects with zuul config error to look into those and fix them which should not take much time[13][14]. Project updates ------------------- * None 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[15]. [2] https://governance.openstack.org/tc/goals/selected/fips.html 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [16] 3. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [2] https://review.opendev.org/c/openstack/governance/+/840354 [3] http://lists.openstack.org/pipermail/openstack-discuss/2022-May/028540.html [4] https://etherpad.opendev.org/p/tc-zed-tracker [5] https://review.opendev.org/q/projects:openstack/governance+status:open [6] http://lists.openstack.org/pipermail/openstack-discuss/2022-May/028618.html [7] https://review.opendev.org/c/openstack/governance/+/839880 [8] https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popu… [9] https://etherpad.opendev.org/p/rbac-zed-ptg#L97 [10] http://lists.openstack.org/pipermail/openstack-discuss/2022-May/028490.html [11] https://review.opendev.org/c/openstack/governance/+/836888 [12] http://lists.openstack.org/pipermail/openstack-discuss/2022-March/027626.ht… [13] https://etherpad.opendev.org/p/zuul-config-error-openstack [14] http://lists.openstack.org/pipermail/openstack-discuss/2022-May/028603.html [15] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [16] http://eavesdrop.openstack.org/#Technical_Committee_Meeting -gmann

1 0

[stable][glance] backport exception request for external HTTP API response code change
by Brian Rosmaita 20 May '22

20 May '22

Hello stable maintenance core team, We recently noticed that an Image API call implemented in Yoga, which returns no content, is returning a 200 instead of a 202 (as the design [0] had specified). We would like to correct this in master (Zed development) and in the stable/yoga branch. Here are our reasons why we think this is a legitimate exception to the no-http-api-changes-backport policy: (1) Even ignoring the lack of a response body, a 200 (OK) is misleading because operation initiated by the PUT /v2/cache/{image_id} request may not succeed. A 202 (Accepted) signals more clearly to the operator that some followup is necessary to be sure the image has been cached. (2) This is intended as an admin-only API call; the default policy is admin-only. So it has not been exposed to end-users. (3) The change [1] was first released in Yoga and there has not been much time for admins to begin consuming this feature. Further, there has not yet been a release from stable/yoga after glance 24.0.0. For these reasons, we request that the glance team be allowed to make this change. Thank you for considering this proposal! [0] https://opendev.org/openstack/glance-specs/blame/commit/2638ada23d92f714f54… [1] https://review.opendev.org/c/openstack/glance/+/792022

3 2

Call for OpenStack projects virtual updates
by Sunny Cai 20 May '22

20 May '22

Hi everyone, As the Berlin Summit is approaching in June, we are collecting project update recordings from each OpenInfa community to showcase what each project has accomplished in the past year/release. Please let me know if you’re interested in doing a prerecorded video of your project’s most recent updates. We will post all recordings on the OpenInfra Foundation YouTube channel and promote them at the Summit. Recordings will also be posted in the project navigator. We recommend the recordings to be less than 10 minutes long. If you would like to present with slides, here is a slide deck template if you need [1]. If you can submit your project recording to me by Friday, May 27, we’d love to promote them at the upcoming Berlin Summit. If you prefer to submit it after the Summit, I’ll send out another reminder on June 15 to collect any reminding recordings. Please let me know if you have any questions. [1] https://docs.google.com/presentation/d/1SlWayfGc9CYAsKnS43UxVjO8NYr1pR-0Gi4… Thanks, Sunny Cai OpenInfra Foundation Marketing & Community

1 1