May 2022 - openstack-discuss - lists.openstack.org

[ops][heat][rbac] Call for feedback: Splitting stack to "system" stack and "project" stack
by Takashi Kajinami 24 May '22

24 May '22

Hello, tl;dr We are looking for some feedback from anyone developing their tool/software creating/managing heat stacks, about the new requirement we are considering. Recently we've been discussing the issue with Heat and Secure RBAC work[1]. The current target of SRBAC work requires the appropriate scope according to the resources. - Project resources like instance, volume or network can be created by project-scoped token - Project resources like flavor, user, project or role can be created by system-scoped token This is causing a problem with heat stacks which have both project resources and system resources, because heat currently uses the single token provided by the user in a single stack API call. As part of discussions we have discussed the "split stack" concept, which requires creating separate stacks per scope. This means If you want to create project resources and system resources by Heat, you should create two separate heat stacks and call heat stack api separately using different credentials. While we still need to investigate the feasibility of this option (eg. how smooth we can make the migration), we'd like to hear any feedback about the impact of the "split stack" concept on any external toolings depending on Heat, because this would require some workflow/architecture change in the toolings. If we hear many negative feedback/concerns then we would examine different approaches. Thank you, Takashi [1] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rb…

1 1

[GLANCE][VICTORIA] - Multi-backend support with ceph backed swift.
by Gaël THEROND 24 May '22

24 May '22

Hi everyone, I'm currently enabling glance multi backend support for one of our platforms and we're facing a weird situation. This platform is a CentOS 8 Stream based Openstack VICTORIA and when we enable the multi-backends feature, the swift store isn't working properly. When we try to send an image to this store we end up with the following error message: *"ERROR glance_store._drivers.swift.store - A value for swift_store_auth_address is required."* Here is the complete log trace: https://paste.opendev.org/show/bGeCJjSB1C5GwD6JYFvu/ I'm a bit surprised because according to the error message and the glance_store code it means that either my *default_swift_reference* or *auth_address *fromthe *default_swift_reference *isn't set. https://opendev.org/openstack/glance_store/src/branch/stable/victoria/glanc… However as you can see on my glance-api.conf file I've (seems so) correctly set the glance_store directive and the store settings: glance-api.conf: https://paste.opendev.org/show/bjFAPCjlCG6MqINGsIlK/ glance-swift.conf: https://paste.opendev.org/show/bcCfBQDj32T3qgiJj3P7/ I'm only using a single tenant glance container within the admin project. What's really weird is this issue still arise and exist with any known (to me) combination of configuration. I've tried to declare the store right within the glance-api.conf file, but it's not working. I've tried to declare the store right within the glance-api.conf file and with the deprecated swift_store_auth_address directive instead of the auth_address one, it's not working. I've tried to declare the store right within the glance-api.conf file and with the deprecated swift_store_auth_address directive plus the auth_address one, it's not working. I've tried to replace auth_address directive with the deprecated swift_store_auth_address within the glance-swift.conf, same error and issue again. When I replace the default_backend value with performance, uploading an image works perfectly. I know that my swift CEPH RGW backed endpoint works as I use it already to store data. I've even tried to push an image on it both using CLI (openstack object) and cURL API call and it works. I'm a bit lost here, so if anyone is having thoughts on this I would be happy to hear you! Thanks a lot everyone!

1 0

[Monasca] correlating monasca-api metrics resource_id to instance id
by Ivo Palli 24 May '22

24 May '22

Hi all, I'm new to openstack and monasca. I've gotten so far as to retrieve instances with their ID's via the REST API, but I'm running into trouble with getting metrics. The issue is that metrics: - show to which hostname they belong - and you can limit results to a project id But if you have 2 or more servers with the same hostname, you can't link them 1:1 with an instance. Is there a way how I can get that 1:1 link? Regards, Ivo Palli

1 0

Creating VM directly on external network.
by Russell Stather 24 May '22

24 May '22

Hi I have a charm based OpenStack setup. The network topology is as below. Creating vms on the internal network and adding floating ips works as expected. Adding vms on directly on to the ext_net does not. openstack allows me to do it, but I get host is unreachable when trying to connect. Is there some configuration I have missed? Thanks [cid:3699cab3-ea6a-45eb-91c3-65e91056fd71]

4 4

Recreate virsh xml
by Szabo, Istvan (Agoda) 24 May '22

24 May '22

Hi, I have a node which has been live-migrated to another node and it is running on the new node BUT there isn't any xml definition file (/etc/libvirt/qemu/instance-*.xml) of it which is automatically generated. How I solve this issue normally is to respawn that vm with the same disk and ip that it has before, but I wonder is there any easier way to just simply recreate the automatically generated definition file. The file which I'm talking about auto generated is this one: /etc/libvirt/qemu/instance-*.xml starts like this so I guess I can't create by myself.  <domain type='kvm'> <name>instance-00006580</name> <uuid>ac8cf83e-6819-417a-9f83-de73c28567e9</uuid> <metadata> .... Thank you ________________________________ This message is confidential and is for the sole use of the intended recipient(s). It may also be privileged or otherwise protected by copyright or other legal rules. If you have received it by mistake please let us know by reply email and delete it from your system. It is prohibited to copy this message or disclose its content to anyone. Any confidentiality or privilege is not waived or lost by any mistaken delivery or unauthorized disclosure of the message. All messages sent to and from Agoda may be monitored to ensure compliance with company policies, to protect the company's interests and to remove potential malware. Electronic messages may be intercepted, amended, lost or deleted, or contain viruses.

2 1

Question about lp 1950186
by Seyeong Kim 24 May '22

24 May '22

Hello, I have a question about lp https://bugs.launchpad.net/nova/+bug/1950186 if this can be fixed in near future or if there is any plan? Thanks in advance.

2 1

[neutron][neutron-vpnaas] neutron-tempest-plugin coverage
by Mohammed Naser 24 May '22

24 May '22

Hiya, As part of cleaning up VPNaaS, I decided to explore fixing the longstanding failures of the `neutron-tempest-plugin-vpnaas-libreswan-centos` job that was always failing and non-voting. Upon trying to flip the switch on it in a test change[1], I noticed that much of the test results seem to be simply exercising the API[2], essentially making the fact that we run that job on CentOS a bit redundant. The tests that actually exercise more than the API and validate connectivity are the functional tests, which currently run for "StrongSwan" only on Ubuntu. My question to the Neutron team is: 1. Should we get rid of the functional jobs and move them into neutron-tempest-plugin, and run that for different platforms? 2. Should we get rid of the neutron-tempest-plugin job under CentOS and add functional jobs for CentOS? My inclination seems to be #2, since that is what other stadium projects seem to be doing (no one seems to run platform-specific neutron-tempest-plugin jobs). It also keeps maintainability simpler since it remains in the hands of the VPNaaS team. Thanks Mohammed [1]: https://review.opendev.org/c/openstack/neutron-vpnaas/+/843005 [2]: https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/… -- Mohammed Naser VEXXHOST, Inc.

2 1

[qa][openeuler] QA wants to drop openeuler job
by Martin Kopec 24 May '22

24 May '22

Hi everyone, we're considering dropping the devstack-platform-openEuler-20.03-SP2 job. It's been failing for a long time and based on the fact that no one has complained about it, we assume that there isn't much interest in having the job around. If that's not the case, please, reach out and let's discuss updating the job. Thanks, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA IM: kopecmartin

1 1

[cinder] This week's meeting will be in video+IRC
by Rajat Dhasmana 24 May '22

24 May '22

Hello Argonauts, This week's meeting will be held in video + IRC mode with details as follows: Date: 25th May, 2022 Time: 1400 UTC Meeting link: https://bluejeans.com/556681290 IRC Channel: #openstack-meeting-alt Make sure you're connected to both the bluejeans meeting and IRC since we do roll call and also summarize the discussion points on IRC. Note: Every last meeting of the month is held in video + IRC mode to provide flexibility to communicate their thoughts via written or verbal way. It also acts as a medium to meet the team (virtually) every month. Thanks and regards Rajat Dhasmana

1 0

[Neutron] CI meeting - 24.05.2022
by Slawek Kaplonski 24 May '22

24 May '22

Hi, Just quick reminder that today at 1500 UTC we will have Neutron CI meeting. It will be on Jitsi [1] this week. Agenda can be found at [2]. See You there :) [1] https://meetpad.opendev.org/neutron-ci-meetings[1] [2] https://etherpad.opendev.org/p/neutron-ci-meetings[2] -- Slawek Kaplonski Principal Software Engineer Red Hat -------- [1] https://meetpad.opendev.org/neutron-ci-meetings [2] https://etherpad.opendev.org/p/neutron-ci-meetings

1 0