June 2022 - openstack-discuss - lists.openstack.org

[rbac][nova][cinder] Canned roles for service users / inter-service communication (e.g. event submission)
by Christian Rohmann 09 Jun '22

09 Jun '22

Hey openstack-discuss, I posted to the ML quite a while ago about an issue of resized (Cinder) volumes not being propagated to the (Nova) instance. See http://lists.openstack.org/pipermail/openstack-discuss/2021-February/020476…. The issue there was Cinder being not allowed to send the "volume-extended" event (or any event for that matter via the Nova API just using the user token. For this a configurable additional "privileged user" was added to the config quite a while back with https://opendev.org/openstack/cinder/commit/04003d7c513ed4dd5129cbd5ad1af14…. While the functionality then works I suppose there should be canned and maintained RBAC roles for such kind of inter service to service communications, e.g. to emit events to others. Otherwise deployments likely will use admin privileged users ignoring the least privilege principle and creating an large attack surface. And there are quite few of those relations even with the most commonly used services. Cinder -> nova, nova-> cincer, nova->ironic, .... nova-> neutron, .... Are such canned RBAC rules for "special" inter service users on the backlog somewhere? Or am I totally misconceiving the issue here? I know there is https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rb… and also the question for feedback at https://etherpad.opendev.org/p/rbac-operator-feedback, but that all seems to focus on the impact of roles used by humans / users and not about service roles at all. Regards Christian

2 3

[all][operator][policy] Operator feedback on 'Consistent and Secure RBAC" (new design for RBAC)
by Ghanshyam Mann 09 Jun '22

09 Jun '22

Hello Everyone, As you might know, we are redesigning the OpenStack default RBAC. The new design target two things: 1. 'new defaults (reader role)' 2. "Scope" concept It is hard to explain the details in email but the below doc is a good place to start understanding this: - https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rb… We as a community think 1st target (reader role) is a good thing to do and it will definitely be useful in many cases. But we need feedback on the "Scope" concept. To understand what it is and how it can impact your existing use case/deployment, please ref the documentation mentioned in the etherpad[1] (if there is any question about its design/usage we are planning, feel free to reply here or contact us in #openstack-tc IRC channel). * If you are an operator, we really need your feedback if the 'Scope' concept is a useful thing for your deployment/use-case or not. * If you are attending events have operators also attending (for example, project operator feedback (like nova[2]), forum sessions in berlin summit, ops meetup or any local operator event), please communicate about the required feedback. * Due to various reasons, many of us involved in RBAC work are not travelling to Berlin and we have this topic to be discussed in Berlin ops meetup[3] but we require someone knowing RBAC new design moderate this topic. Please reach out to us if you would like to help. Central Etherpad to collect feedback (this can be used to collect from various forums/places): * https://etherpad.opendev.org/p/rbac-operator-feedback [1] https://etherpad.opendev.org/p/rbac-operator-feedback [2] https://etherpad.opendev.org/p/nova-berlin-meet-and-greet [3]https://etherpad.opendev.org/p/ops-meetup-berlin-2022-planning#L74 -gmann

4 12

[tripleo] gate blocker - master/wallaby - "SELinux boolean os_enable_vtpm does not exist."
by Ronelle Landy 09 Jun '22

09 Jun '22

Hello All, We have a consistent failure on multiple jobs running on check/gate/integration lines on master and wallaby changes - which shows up as a deployment error: FATAL | Enable os_enable_vtpm SELinux boolean for vTPM | standalone | error={"changed": false, "msg": "SELinux boolean os_enable_vtpm does not exist."} Details of the failure are in: https://bugs.launchpad.net/tripleo/+bug/1977873 We are investigating a fix/workaround. Please hold rechecks - we will post out again with updates. Thank you!

1 3

[kolla] restart mariadb container on host 1
by Gregory Orange 09 Jun '22

09 Jun '22

Hi all, I wanted to temporarily change a mariadb config in /etc/kolla/mariadb/galera.cnf so I intended to stop mariadb on host 1, make the change, start it again, then repeat in turn for hosts 2 and 3. Upon starting it on host 1, it doesn't rejoin, but creates its own separate cluster. Dutiful really, since logs show: WSREP: 'wsrep-new-cluster' option used, bootstrapping the cluster How do I avoid that? General advice on handling this kind of activity would also be welcome. Thank you, Greg.

2 2

[kolla-ansible][kolla] merge_configs module replacing colon to equal
by Sharath Ck 09 Jun '22

09 Jun '22

Hi, In kolla-ansible, I am using the merge_configs module to merge service configs files. I want to merge api-paste.ini config with my custom changes, however while merging if a line consists of one colon, it is getting replaced with equal sign. merge_configs splits the line by considering colon as delimiter and treats two parts as key and value. Later which will be substituted as key = value. Original */v2.1: oscomputeversion_v2* Merged */v2.1= oscomputeversion_v2 * Below, colon will be 1 and equal will be -1, *def _split_key_value(self, line): colon = line.find(':') equal = line.find('=') if colon < 0 and equal < 0: return self.error_invalid_assignment(line) if colon < 0 or (equal >= 0 and equal < colon): key, value = line[:equal], line[equal + 1:] else: key, value = line[:colon], line[colon + 1:] value = value.strip() if value and value[0] == value[-1] and value.startswith(("\"", "'")): value = value[1:-1] return key.strip(), [value]* I want to keep the config as it is and merge only my custom changes. Please let me know how to achieve this or colon can be escaped somehow. Regards, Sharath Regards, Sharath

3 3

[CLOUDKITTY] presentation used in the forum panels
by Rafael Weingärtner 08 Jun '22

08 Jun '22

Hello CloudKitters! It was a pleasure to meet you guys during the OpenStack summit. Also, it was a good surprise to see that so many people already use CloudKitty. I really hope that we can all collaborate together to keep improving CloudKitty, and making it more and more solid. Attached is the presentation we used during the Forum, so you all can consult this material. Also, as always, if you need some guidance/help/or anything else, let us know. Link for the presentation online: https://docs.google.com/presentation/d/15e37xGKCJoTMwbarrGcSlLpECUkcJ2exazW… -- Rafael Weingärtner

2 1

Re: ERROR openstack [-] Resource OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type OS::Neutron::Port and the Neutron service is not available when using ephemeral Heat.| Openstack tripleo wallaby version
by Lokendra Rathour 08 Jun '22

08 Jun '22

Hi Swogat, Thanks once again. with the files as shown below I am running the overcloud deploy for wallaby using this command: (undercloud) [stack@undercloud ~]$ cat deploy_overcloud_working_1.sh openstack overcloud deploy --templates \ -n /home/stack/templates/network_data.yaml \ -r /home/stack/templates/roles_data.yaml \ -e /home/stack/templates/environment.yaml \ -e /home/stack/templates/environments/network-isolation.yaml \ -e /home/stack/templates/environments/network-environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-conductor.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-inspector.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-overcloud.yaml \ -e /home/stack/templates/ironic-config.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \ -e /home/stack/containers-prepare-parameter.yaml (undercloud) [stack@undercloud ~]$ This deployment is on ipv6 using triple0 wallaby, templates, as mentioned below, are generated using rendering steps and the network_data.yaml the roles_data.yaml Steps used to render the templates: cd /usr/share/openstack-tripleo-heat-templates/ ./tools/process-templates.py -o ~/openstack-tripleo-heat-templates-rendered_at_wallaby -n /home/stack/templates/network_data.yaml -r /home/stack/templates/roles_data.yaml *Now if i try adding the related to VIP port I do get the error as:* 2022-05-30 10:37:12.792 979387 WARNING tripleoclient.v1.overcloud_deploy.DeployOvercloud [-] rendering j2 template to file: /home/stack/overcloud-deploy/overcloud/tripleo-heat-templates/puppet/controller-role.yaml 2022-05-30 10:37:12.792 979387 WARNING tripleoclient.v1.overcloud_deploy.DeployOvercloud [-] rendering j2 template to file: /home/stack/overcloud-deploy/overcloud/tripleo-heat-templates/puppet/compute-role.yaml 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud [-] Exception occured while running the command: ValueError: The environment is not a valid YAML mapping data type. 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud Traceback (most recent call last): 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/tripleoclient/command.py", line 34, in run 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud super(Command, self).run(parsed_args) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/osc_lib/command/command.py", line 39, in run 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud return super(Command, self).run(parsed_args) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/cliff/command.py", line 185, in run 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud return_code = self.take_action(parsed_args) or 0 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/tripleoclient/v1/overcloud_deploy.py", line 1189, in take_action 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud stack, parsed_args, new_tht_root, user_tht_root) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/tripleoclient/v1/overcloud_deploy.py", line 227, in create_env_files 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud created_env_files, parsed_args, new_tht_root, user_tht_root) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/tripleoclient/v1/overcloud_deploy.py", line 204, in build_image_params 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud cleanup=(not parsed_args.no_cleanup)) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/tripleoclient/utils.py", line 1929, in process_multiple_environments 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud env_path=env_path, include_env_in_files=include_env_in_files) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/heatclient/common/template_utils.py", line 326, in process_environment_and_files 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud env = environment_format.parse(raw_env) 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud File "/usr/lib/python3.6/site-packages/heatclient/common/environment_format.py", line 50, in parse 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud raise ValueError(_('The environment is not a valid ' 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud ValueError: The environment is not a valid YAML mapping data type. 2022-05-30 10:37:14.455 979387 ERROR tripleoclient.v1.overcloud_deploy.DeployOvercloud 2022-05-30 10:37:14.457 979387 ERROR openstack [-] The environment is not a valid YAML mapping data type. 2022-05-30 10:37:14.457 979387 INFO osc_lib.shell [-] END return value: 1 (undercloud) [stack@undercloud ~]$ This is more of a syntax error where it is not able to understand the passed VIP data file: undercloud) [stack@undercloud ~]$ cat /home/stack/templates/vip-data-default-network-isolation.yaml - dns_name: overcloud network: internal_api - dns_name: overcloud network: external - dns_name: overcloud network: ctlplane - dns_name: overcloud network: oc_provisioning - dns_name: overcloud network: j3mgmt Please advise, also please note that similar templates generated in prior releases such as train/ussuri works perfectly. Please check the list of *templates *files: drwxr-xr-x. 2 stack stack 68 May 30 09:22 environments -rw-r--r--. 1 stack stack 265 May 27 13:47 environment.yaml -rw-rw-r--. 1 stack stack 297 May 27 13:47 init-repo.yaml -rw-r--r--. 1 stack stack 570 May 27 13:47 ironic-config.yaml drwxrwxr-x. 4 stack stack 4096 May 27 13:53 network -rw-r--r--. 1 stack stack 6370 May 27 14:26 network_data.yaml -rw-r--r--. 1 stack stack 11137 May 27 13:53 roles_data.yaml -rw-r--r--. 1 stack stack 234 May 30 09:23 vip-data-default-network-isolation.yaml (undercloud) [stack@undercloud templates]$ cat environment.yaml parameter_defaults: OvercloudControllerFlavor: control OvercloudComputeFlavor: compute ControllerCount: 3 ComputeCount: 1 TimeZone: 'Asia/Kolkata' NtpServer: ['30.30.30.3'] NeutronBridgeMappings: datacentre:br-tenant NeutronFlatNetworks: datacentre (undercloud) [stack@undercloud templates]$ (undercloud) [stack@undercloud templates]$ cat ironic-config.yaml parameter_defaults: NovaSchedulerDefaultFilters: - AggregateInstanceExtraSpecsFilter - AvailabilityZoneFilter - ComputeFilter - ComputeCapabilitiesFilter - ImagePropertiesFilter IronicEnabledHardwareTypes: - ipmi - redfish IronicEnabledPowerInterfaces: - ipmitool - redfish IronicEnabledManagementInterfaces: - ipmitool - redfish IronicCleaningDiskErase: metadata IronicIPXEEnabled: true IronicInspectorSubnets: - ip_range: 172.23.3.100,172.23.3.150 (undercloud) [stack@undercloud templates]$ cat network_data.yaml - name: J3Mgmt name_lower: j3mgmt vip: true vlan: 400 ipv6: true ipv6_subnet: 'fd80:fd00:fd00:4000::/64' ipv6_allocation_pools: [{'start': 'fd80:fd00:fd00:4000::10', 'end': 'fd80:fd00:fd00:4000:ffff:ffff:ffff:fffe'}] mtu: 9000 - name: InternalApi name_lower: internal_api vip: true vlan: 418 ipv6: true ipv6_subnet: 'fd00:fd00:fd00:2000::/64' ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:2000::10', 'end': 'fd00:fd00:fd00:2000:ffff:ffff:ffff:fffe'}] mtu: 9000 - name: External vip: true name_lower: external vlan: 408 ipv6: true gateway_ipv6: 'fd00:fd00:fd00:9900::1' ipv6_subnet: 'fd00:fd00:fd00:9900::/64' ipv6_allocation_pools: [{'start': 'fd00:fd00:fd00:9900::10', 'end': 'fd00:fd00:fd00:9900:ffff:ffff:ffff:fffe'}] mtu: 9000 - name: OCProvisioning vip: true name_lower: oc_provisioning vlan: 412 ip_subnet: '172.23.3.0/24' allocation_pools: [{'start': '172.23.3.10', 'end': '172.23.3.50'}] mtu: 9000 (undercloud) [stack@undercloud templates]$ cat roles_data.yaml ############################################################################### # File generated by TripleO ############################################################################### ############################################################################### # Role: Controller # ############################################################################### - name: Controller description: | Controller role that has all the controller services loaded and handles Database, Messaging, and Network functions. CountDefault: 1 tags: - primary - controller # Create external Neutron bridge for SNAT (and floating IPs when using # ML2/OVS without DVR) - external_bridge networks: External: subnet: external_subnet InternalApi: subnet: internal_api_subnet OCProvisioning: subnet: oc_provisioning_subnet J3Mgmt: subnet: j3mgmt_subnet # For systems with both IPv4 and IPv6, you may specify a gateway network for # each, such as ['ControlPlane', 'External'] default_route_networks: ['External'] HostnameFormatDefault: '%stackname%-controller-%index%' RoleParametersDefault: OVNCMSOptions: "enable-chassis-as-gw" # Deprecated & backward-compatible values (FIXME: Make parameters consistent) # Set uses_deprecated_params to True if any deprecated params are used. uses_deprecated_params: True deprecated_param_extraconfig: 'controllerExtraConfig' deprecated_param_flavor: 'OvercloudControlFlavor' deprecated_param_image: 'controllerImage' deprecated_nic_config_name: 'controller.yaml' update_serial: 1 ServicesDefault: - OS::TripleO::Services::Aide - OS::TripleO::Services::AodhApi - OS::TripleO::Services::AodhEvaluator .. . ..############################################################################### # Role: Compute # ############################################################################### - name: Compute description: | Basic Compute Node role CountDefault: 1 # Create external Neutron bridge (unset if using ML2/OVS without DVR) tags: - compute - external_bridge networks: InternalApi: subnet: internal_api_subnet J3Mgmt: subnet: j3mgmt_subnet HostnameFormatDefault: '%stackname%-novacompute-%index%' RoleParametersDefault: FsAioMaxNumber: 1048576 TunedProfileName: "virtual-host" # Deprecated & backward-compatible values (FIXME: Make parameters consistent) # Set uses_deprecated_params to True if any deprecated params are used. # These deprecated_params only need to be used for existing roles and not for # composable roles. uses_deprecated_params: True deprecated_param_image: 'NovaImage' deprecated_param_extraconfig: 'NovaComputeExtraConfig' deprecated_param_metadata: 'NovaComputeServerMetadata' deprecated_param_scheduler_hints: 'NovaComputeSchedulerHints' deprecated_param_ips: 'NovaComputeIPs' deprecated_server_resource_name: 'NovaCompute' deprecated_nic_config_name: 'compute.yaml' update_serial: 25 ServicesDefault: - OS::TripleO::Services::Aide - OS::TripleO::Services::AuditD - OS::TripleO::Services::BootParams (undercloud) [stack@undercloud templates]$ cat environments/network-environment.yaml #This file is an example of an environment file for defining the isolated #networks and related parameters. resource_registry: # Network Interface templates to use (these files must exist). You can # override these by including one of the net-*.yaml environment files, # such as net-bond-with-vlans.yaml, or modifying the list here. # Port assignments for the Controller OS::TripleO::Controller::Net::SoftwareConfig: OS::Heat::None # Port assignments for the Compute OS::TripleO::Compute::Net::SoftwareConfig: OS::Heat::None parameter_defaults: # This section is where deployment-specific configuration is done # ServiceNetMap: IronicApiNetwork: oc_provisioning IronicNetwork: oc_provisioning # This section is where deployment-specific configuration is done ControllerNetworkConfigTemplate: 'templates/bonds_vlans/bonds_vlans.j2' ComputeNetworkConfigTemplate: 'templates/bonds_vlans/bonds_vlans.j2' # Customize the IP subnet to match the local environment J3MgmtNetCidr: 'fd80:fd00:fd00:4000::/64' # Customize the IP range to use for static IPs and VIPs J3MgmtAllocationPools: [{'start': 'fd80:fd00:fd00:4000::10', 'end': 'fd80:fd00:fd00:4000:ffff:ffff:ffff:fffe'}] # Customize the VLAN ID to match the local environment J3MgmtNetworkVlanID: 400 # Customize the IP subnet to match the local environment InternalApiNetCidr: 'fd00:fd00:fd00:2000::/64' # Customize the IP range to use for static IPs and VIPs InternalApiAllocationPools: [{'start': 'fd00:fd00:fd00:2000::10', 'end': 'fd00:fd00:fd00:2000:ffff:ffff:ffff:fffe'}] # Customize the VLAN ID to match the local environment InternalApiNetworkVlanID: 418 # Customize the IP subnet to match the local environment ExternalNetCidr: 'fd00:fd00:fd00:9900::/64' # Customize the IP range to use for static IPs and VIPs # Leave room if the external network is also used for floating IPs ExternalAllocationPools: [{'start': 'fd00:fd00:fd00:9900::10', 'end': 'fd00:fd00:fd00:9900:ffff:ffff:ffff:fffe'}] # Gateway router for routable networks ExternalInterfaceDefaultRoute: 'fd00:fd00:fd00:9900::1' # Customize the VLAN ID to match the local environment ExternalNetworkVlanID: 408 # Customize the IP subnet to match the local environment OCProvisioningNetCidr: '172.23.3.0/24' # Customize the IP range to use for static IPs and VIPs OCProvisioningAllocationPools: [{'start': '172.23.3.10', 'end': '172.23.3.50'}] # Customize the VLAN ID to match the local environment OCProvisioningNetworkVlanID: 412 # List of Neutron network types for tenant networks (will be used in order) NeutronNetworkType: 'geneve,vlan' # Neutron VLAN ranges per network, for example 'datacentre:1:499,tenant:500:1000': NeutronNetworkVLANRanges: 'datacentre:1:1000' # Customize bonding options, e.g. "mode=4 lacp_rate=1 updelay=1000 miimon=100" # for Linux bonds w/LACP, or "bond_mode=active-backup" for OVS active/backup. BondInterfaceOvsOptions: "bond_mode=active-backup" (undercloud) [stack@undercloud templates]$ (undercloud) [stack@undercloud templates]$ cat environments/network-isolation.yaml # NOTE: This template is now deprecated, and is only included for compatibility # when upgrading a deployment where this template was originally used. For new # deployments, set "ipv6: true" on desired networks in network_data.yaml, and # include network-isolation.yaml. # # Enable the creation of Neutron networks for isolated Overcloud # traffic and configure each role to assign ports (related # to that role) on these networks. resource_registry: # networks as defined in network_data.yaml OS::TripleO::Network::J3Mgmt: ../network/j3mgmt_v6.yaml OS::TripleO::Network::InternalApi: ../network/internal_api_v6.yaml OS::TripleO::Network::External: ../network/external_v6.yaml OS::TripleO::Network::OCProvisioning: ../network/oc_provisioning.yaml # Port assignments for the VIPs OS::TripleO::Network::Ports::J3MgmtVipPort: ../network/ports/j3mgmt_v6.yaml OS::TripleO::Network::Ports::InternalApiVipPort: ../network/ports/internal_api_v6.yaml OS::TripleO::Network::Ports::ExternalVipPort: ../network/ports/external_v6.yaml OS::TripleO::Network::Ports::OCProvisioningVipPort: ../network/ports/oc_provisioning.yaml # Port assignments by role, edit role definition to assign networks to roles. # Port assignments for the Controller OS::TripleO::Controller::Ports::J3MgmtPort: ../network/ports/j3mgmt_v6.yaml OS::TripleO::Controller::Ports::InternalApiPort: ../network/ports/internal_api_v6.yaml OS::TripleO::Controller::Ports::ExternalPort: ../network/ports/external_v6.yaml OS::TripleO::Controller::Ports::OCProvisioningPort: ../network/ports/oc_provisioning.yaml # Port assignments for the Compute OS::TripleO::Compute::Ports::J3MgmtPort: ../network/ports/j3mgmt_v6.yaml OS::TripleO::Compute::Ports::InternalApiPort: ../network/ports/internal_api_v6.yaml parameter_defaults: # Enable IPv6 environment for Manila ManilaIPv6: True (undercloud) [stack@undercloud templates]$ On Tue, May 24, 2022 at 5:04 PM Lokendra Rathour <lokendrarathour(a)gmail.com> wrote: > Thanks, I'll check them out. > will let you know in case it works out. > > On Tue, May 24, 2022 at 2:37 PM Swogat Pradhan <swogatpradhan22(a)gmail.com> > wrote: > >> Hi, >> Please find the below templates: >> These are for openstack wallaby release: >> >> (undercloud) [stack@hkg2director workplace]$ cat custom_network_data.yaml >> - name: Storage >> name_lower: storage >> vip: true >> mtu: 1500 >> subnets: >> storage_subnet: >> ip_subnet: 172.25.202.0/26 >> allocation_pools: >> - start: 172.25.202.6 >> end: 172.25.202.20 >> vlan: 1105 >> - name: StorageMgmt >> name_lower: storage_mgmt >> vip: true >> mtu: 1500 >> subnets: >> storage_mgmt_subnet: >> ip_subnet: 172.25.202.64/26 >> allocation_pools: >> - start: 172.25.202.72 >> end: 172.25.202.87 >> vlan: 1106 >> - name: InternalApi >> name_lower: internal_api >> vip: true >> mtu: 1500 >> subnets: >> internal_api_subnet: >> ip_subnet: 172.25.201.192/26 >> allocation_pools: >> - start: 172.25.201.198 >> end: 172.25.201.212 >> vlan: 1104 >> - name: Tenant >> vip: false # Tenant network does not use VIPs >> mtu: 1500 >> name_lower: tenant >> subnets: >> tenant_subnet: >> ip_subnet: 172.25.202.128/26 >> allocation_pools: >> - start: 172.25.202.135 >> end: 172.25.202.150 >> vlan: 1108 >> - name: External >> name_lower: external >> vip: true >> mtu: 1500 >> subnets: >> external_subnet: >> ip_subnet: 172.25.201.128/26 >> allocation_pools: >> - start: 172.25.201.135 >> end: 172.25.201.150 >> gateway_ip: 172.25.201.129 >> vlan: 1103 >> >> (undercloud) [stack@hkg2director workplace]$ cat custom_vip_data.yaml >> - network: ctlplane >> #dns_name: overcloud >> ip_address: 172.25.201.91 >> subnet: ctlplane-subnet >> - network: external >> #dns_name: overcloud >> ip_address: 172.25.201.150 >> subnet: external_subnet >> - network: internal_api >> #dns_name: overcloud >> ip_address: 172.25.201.250 >> subnet: internal_api_subnet >> - network: storage >> #dns_name: overcloud >> ip_address: 172.25.202.50 >> subnet: storage_subnet >> - network: storage_mgmt >> #dns_name: overcloud >> ip_address: 172.25.202.90 >> subnet: storage_mgmt_subnet >> >> (undercloud) [stack@hkg2director workplace]$ cat >> overcloud-baremetal-deploy.yaml >> - name: Controller >> count: 4 >> defaults: >> networks: >> - network: ctlplane >> vif: true >> - network: external >> subnet: external_subnet >> - network: internal_api >> subnet: internal_api_subnet >> - network: storage >> subnet: storage_subnet >> - network: storage_mgmt >> subnet: storage_mgmt_subnet >> - network: tenant >> subnet: tenant_subnet >> network_config: >> template: /home/stack/templates/controller.j2 >> default_route_network: >> - external >> instances: >> - hostname: overcloud-controller-0 >> name: dc1-controller2 >> #provisioned: false >> - hostname: overcloud-controller-1 >> name: dc2-controller2 >> #provisioned: false >> - hostname: overcloud-controller-2 >> name: dc1-controller1 >> #provisioned: false >> - hostname: overcloud-controller-no-ceph-3 >> name: dc2-ceph2 >> #provisioned: false >> #- hostname: overcloud-controller-3 >> #name: dc2-compute3 >> #provisioned: false >> >> - name: Compute >> count: 5 >> defaults: >> networks: >> - network: ctlplane >> vif: true >> - network: internal_api >> subnet: internal_api_subnet >> - network: tenant >> subnet: tenant_subnet >> - network: storage >> subnet: storage_subnet >> network_config: >> template: /home/stack/templates/compute.j2 >> instances: >> - hostname: overcloud-novacompute-0 >> name: dc2-compute1 >> #provisioned: false >> - hostname: overcloud-novacompute-1 >> name: dc2-ceph1 >> #provisioned: false >> - hostname: overcloud-novacompute-2 >> name: dc1-compute1 >> #provisioned: false >> - hostname: overcloud-novacompute-3 >> name: dc1-compute2 >> #provisioned: false >> - hostname: overcloud-novacompute-4 >> name: dc2-compute3 >> #provisioned: false >> >> - name: CephStorage >> count: 4 >> defaults: >> networks: >> - network: ctlplane >> vif: true >> - network: internal_api >> subnet: internal_api_subnet >> - network: storage >> subnet: storage_subnet >> - network: storage_mgmt >> subnet: storage_mgmt_subnet >> network_config: >> template: /home/stack/templates/ceph-storage.j2 >> instances: >> - hostname: overcloud-cephstorage-0 >> name: dc2-controller1 >> #provisioned: false >> # - hostname: overcloud-cephstorage-1 >> # name: dc2-ceph2 >> - hostname: overcloud-cephstorage-1 >> name: dc1-ceph1 >> # provisioned: false >> - hostname: overcloud-cephstorage-2 >> name: dc1-ceph2 >> #provisioned: false >> - hostname: overcloud-cephstorage-3 >> name: dc2-compute2 >> #provisioned: false >> >> >> You must use these templates to provision network, vip and nodes. >> You must use the output files generated during the provisioning step in >> openstack overcloud deploy command using -e parameter. >> >> With regards, >> Swogat Pradhan >> >> >> On Mon, May 23, 2022 at 8:33 PM Lokendra Rathour < >> lokendrarathour(a)gmail.com> wrote: >> >>> Hi Swogat, >>> I tried checking your solution and my templates but could not relate >>> much. >>> But issue seems the same >>> >>> http://lists.openstack.org/pipermail/openstack-discuss/2022-May/028401.html >>> >>> I tried somemore ways but looks like some issue with templates. >>> Can you please share the templates used to deploy the overcloud. >>> >>> Mysetup have 3 controller and 1 compute. >>> >>> Thanks once again for reading my mail. >>> >>> Waiting for your reply. >>> >>> -Lokendra >>> >>> On Fri, 20 May 2022, 08:25 Swogat Pradhan, <swogatpradhan22(a)gmail.com> >>> wrote: >>> >>>> Hi, >>>> Yes I was able to find the issue and fix it. >>>> The issue was with the overcloud-baremetal-deployed.yaml file i was >>>> trying to provision controller-0, controller-1 and controller-3 and kept >>>> controller-2 aside for later, but the tripleo scripts are built in such a >>>> way that they were taking controller- 0, 1 and 2 inplace of controller-3, >>>> so the network ports and vip were created for controller 0,1 and 2 but not >>>> for 3 , so this error was popping off. Also i would request you to check >>>> the jinja nic templates and once the node provisioning is done check the >>>> /etc/os-net-config/config.json/yaml file for syntax if using bonded nic >>>> template. >>>> If you need any more infor please let me know. >>>> >>>> With regards, >>>> Swogat Pradhan >>>> >>>> >>>> >>>> On Fri, May 20, 2022 at 8:01 AM Lokendra Rathour < >>>> lokendrarathour(a)gmail.com> wrote: >>>> >>>>> Hi Swogat, >>>>> Thanks for raising this issue. >>>>> Did you find any solution? to this problem ? >>>>> >>>>> Please let me know it might be helpful >>>>> >>>>> >>>>> On Tue, Apr 19, 2022 at 12:43 PM Swogat Pradhan < >>>>> swogatpradhan22(a)gmail.com> wrote: >>>>> >>>>>> Hi, >>>>>> I am currently trying to deploy openstack wallaby using tripleo arch. >>>>>> I created the network jinja templates, ran the following commands >>>>>> also: >>>>>> >>>>>> #openstack overcloud network provision --stack overcloud --output >>>>>> networks-deployed-environment.yaml custom_network_data.yaml >>>>>> # openstack overcloud network vip provision --stack overcloud >>>>>> --output vip-deployed-environment.yaml custom_vip_data.yaml >>>>>> # openstack overcloud node provision --stack overcloud >>>>>> --overcloud-ssh-key /home/stack/sshkey/id_rsa >>>>>> overcloud-baremetal-deploy.yaml >>>>>> >>>>>> and used the environment files in the openstack overcloud deploy >>>>>> command: >>>>>> >>>>>> (undercloud) [stack@hkg2director ~]$ cat deploy.sh >>>>>> #!/bin/bash >>>>>> THT=/usr/share/openstack-tripleo-heat-templates/ >>>>>> CNF=/home/stack/ >>>>>> openstack overcloud deploy --templates $THT \ >>>>>> -r $CNF/templates/roles_data.yaml \ >>>>>> -n $CNF/workplace/custom_network_data.yaml \ >>>>>> -e ~/containers-prepare-parameter.yaml \ >>>>>> -e $CNF/templates/node-info.yaml \ >>>>>> -e $CNF/templates/scheduler-hints.yaml \ >>>>>> -e $CNF/workplace/networks-deployed-environment.yaml \ >>>>>> -e $CNF/workplace/vip-deployed-environment.yaml \ >>>>>> -e $CNF/workplace/overcloud-baremetal-deployed.yaml \ >>>>>> -e $CNF/workplace/custom-net-bond-with-vlans.yaml >>>>>> >>>>>> Now when i run the ./deploy.sh script i encounter an error stating: >>>>>> >>>>>> ERROR openstack [-] Resource >>>>>> OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type >>>>>> OS::Neutron::Port and the Neutron service is not available when using >>>>>> ephemeral Heat. The generated environments from 'openstack overcloud >>>>>> baremetal provision' and 'openstack overcloud network provision' must be >>>>>> included with the deployment command.: >>>>>> tripleoclient.exceptions.InvalidConfiguration: Resource >>>>>> OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type >>>>>> OS::Neutron::Port and the Neutron service is not available when using >>>>>> ephemeral Heat. The generated environments from 'openstack overcloud >>>>>> baremetal provision' and 'openstack overcloud network provision' must be >>>>>> included with the deployment command. >>>>>> 2022-04-19 13:47:16.582 735924 INFO osc_lib.shell [-] END return >>>>>> value: 1 >>>>>> >>>>>> Can someone tell me where the mistake is? >>>>>> >>>>>> With regards, >>>>>> Swogat Pradhan >>>>>> >>>>> >>>>> >>>>>

3 8

[cinder] Bug deputy report for week of 06-08-2022
by Sofia Enriquez 08 Jun '22

08 Jun '22

This is a bug report from 06-01-2022 to 06-08-2022. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Low - https://bugs.launchpad.net/cinder/+bug/1976499 "[IBM Storwize] lsfcportsetmember is being called in the wrong SVC code level." Fix proposed to master. Wishlist - https://bugs.launchpad.net/cinder/+bug/1977868 "When create volume from image, image is fetched twice." Unassigned. Cheers, -- Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[Tripleo] - Provisioning Baremetal Instances in Wallaby Openstack
by Anirudh Gupta 08 Jun '22

08 Jun '22

Hi Harald/Julia/Openstack Team I had successfully installed Ironic Service in Tripleo Train, Ussuri Release with the help of openstack discuss team members. https://lists.openstack.org/pipermail/openstack-discuss/2022-February/02704… I had custom network configuration for which I had passed Service net map as below in network-environment file. parameter_defaults: ServiceNetMap: IronicApiNetwork: oc_provisioning IronicNetwork: oc_provisioning But with the Wallaby Release, since the deployment format has changed There is no network-environment file. So I tried passing it in a separate environment.yaml file along with the templates. Command to deploy in wallaby: openstack overcloud deploy --templates \ --networks-file /home/stack/templates/custom_network_data.yaml \ --vip-file /home/stack/templates/custom_vip_data.yaml \ --baremetal-deployment /home/stack/templates/overcloud-baremetal-deploy.yaml --deployed-server \ --network-config \ -e /home/stack/templates/environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-conductor.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-inspector.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-overcloud.yaml \ -e /home/stack/templates/ironic-config.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ptp.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \ -e /home/stack/containers-prepare-parameter.yaml Without Service Net Map, deployment was successful but TFTP of image was an issue since we are going with custom network approach. Passing Service Net map details in a seperate file environment.yaml, is giving the below error: 24d-f43f-6f76-000000006ce9 | TASK | Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_3 2022-06-07 11:16:46.806982 | | WARNING | ERROR: Can't run container ironic_db_sync stderr: Error: statfs /var/lib/config-data/puppet-generated/ironic_api: no such file or directory 2022-06-07 11:16:46.809252 | 525400fd-f24d-f43f-6f76-000000006c79 | FATAL | Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_3 | overcloud-controller-1 | error={"changed": false, "msg": "Failed containers: ironic_db_sync"} 2022-06-07 11:16:46.810197 | 525400fd-f24d-f43f-6f76-000000006c79 | TIMING | tripleo_container_manage : Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_3 | overcloud-controller-1 | 0:11:40.574944 | 10.62s 2022-06-07 11:16:47.683400 | | WARNING | ERROR: Can't run container ironic_db_sync stderr: Error: statfs /var/lib/config-data/puppet-generated/ironic_api: no such file or directory 2022-06-07 11:16:47.684455 | 525400fd-f24d-f43f-6f76-000000006ce9 | FATAL | Create containers managed by Podman for /var/lib/tripleo-config/container-startup-config/step_3 | overcloud-controller-2 | error={"changed": false, "msg": "Failed containers: ironic_db_sync"} Can you please suggest the place we can pass the service net map details in Wallaby Release to resolve this issue? Regards Anirudh Gupta

2 3

Using infiniband for openstack network communications
by A Monster 07 Jun '22

07 Jun '22

Is it possible to use the infiniband port for openstack networks without having to use the infiniband port as an ethernet port ?

4 3