June 2022 - openstack-discuss - lists.openstack.org

[release] Release countdown for week R-17, Jun 06 - 10
by Előd Illés 02 Jun '22

02 Jun '22

Development Focus ----------------- The Zed-2 milestone will happen in next month, on July 14th, 2022. Zed-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/ <https://releases.openstack.org/zed/schedule.html>zed <https://releases.openstack.org/zed/schedule.html>/schedule.html <https://releases.openstack.org/zed/schedule.html>for details. General Information ------------------- Please remember that libraries need to be released at least once per milestone period. At milestone 2, the release team will propose releases for any library that has not been otherwise released since milestone 1. Other non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. At milestone-2 we also freeze the contents of the final release. If you have a new deliverable that should be included in the final release, you should make sure it has a deliverable file in: https://opendev.org/openstack/releases/src/branch/master/deliverables/ <https://opendev.org/openstack/releases/src/branch/master/deliverables/zed>zed <https://opendev.org/openstack/releases/src/branch/master/deliverables/zed> You should request a beta release (or intermediary release) for those new deliverables by milestone-2. We understand some may not be quite ready for a full release yet, but if you have something minimally viable to get released it would be good to do a 0.x release to exercise the release tooling for your deliverables. See the MembershipFreeze description for more details: https://releases.openstack.org/ <https://releases.openstack.org/zed/schedule.html#z-mf>zed <https://releases.openstack.org/zed/schedule.html#z-mf>/schedule.html# <https://releases.openstack.org/zed/schedule.html#z-mf>z <https://releases.openstack.org/zed/schedule.html#z-mf>-mf <https://releases.openstack.org/zed/schedule.html#z-mf> Finally, now may be a good time for teams to check on any stable releases that need to be done for your deliverables. If you have bugfixes that have been backported, but no stable release getting those. If you are unsure what is out there committed but not released, in the openstack/releases repo, running the command "tools/list_stable_unreleased_changes.sh <cycle_name>" gives a nice report. Upcoming Deadlines & Dates -------------------------- Zed-2 Milestone: July 14th, 2022 OpenInfra Summit: June 7-9, 2022 (Berlin) Előd Illés irc: elodilles

1 0

[dev][docs][security-sig] Retiring security-analysis process and repo
by Jeremy Stanley 02 Jun '22

02 Jun '22

In 2016, what was then the Security Project Team embarked on an effort to centrally collect security analyses of OpenStack components. It accumulated a total of two, one for Barbican as of the Newton release, and another for KeystoneMiddleware as of Pike. The latter was finalized in 2017 and took nearly a year to merge due to already waning enthusiasm and reviewer availability: https://docs.openstack.org/security-analysis Given this effort was effectively abandoned years ago, the Security SIG members agree that the repository should be retired in order to reduce confusion. The vulnerability management oversight requirements were amended in February to remove any reference to this process, and we reached a consensus that this sort of documentation is better off inside the projects which are writing it rather than collected centrally with a disconnected (or in this case absent) group of reviewers and maintainers. This message serves as notice to the community that we will be pushing changes to follow the usual OpenStack repository retirement process for openstack/security-analysis in the coming days. As usual, the final state of the documents will be found in the parent commit of the one which wipes all the old files, but for posterity I'll link it here as well: https://opendev.org/openstack/security-analysis/src/commit/ac43025 Many thanks to those who attempted to provide and review these analyses in years past. The idea of maintaining information on the security risks and considerations for the systems we design is still a good one, and something I hope our contributor community might find more time to focus on in the years to come; but the place to document those things is right alongside the rest of the software's documentation, there's nothing inherently special or different about it. -- Jeremy Stanley

1 0

[all][tc] Technical Committee next weekly meeting on June 2, 2022 at 1500 UTC
by Ghanshyam Mann 02 Jun '22

02 Jun '22

Hello Everyone, The technical Committee's next weekly meeting is scheduled for June 2, 2022, at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, June 1, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

Resources to learn IT Infrastructure
by Raghav Gururajan 02 Jun '22

02 Jun '22

Hello All, I am stepping into infrastructure side of the IT world and was wondering if any of you could recommend best books, materials or videos for learning? Regards, Raghav "RG" Gururajan.

1 0

Re: Re: [vdi][daas][ops] What are your solutions to VDI/DaaS on OpenStack?
by Ümit Seren 02 Jun '22

02 Jun '22

We are using xpra (https://xpra.org/) together with VirtualGL (https://www.virtualgl.org/) on our virtualized OpenStack based SLURM cluster to support OpenGL accelerated applications such as MorphoGraphX (https://morphographx.org/) for our users. This works pretty well. There was a bit of work involved because it requires an X11 server to run on the compute nodes but once this was done it worked fairly well. Best Ümit On 02.06.22, 01:10, "Andy Botting" <andy(a)andybotting.com> wrote: Hi Radosław, > I am wondering if and how OpenStackers are approaching the subject of > VDI (Virtual Desktop Infrastructure), also nowadays commonly called > DaaS (Desktop as a Service) offering. > To be more specific, I am looking forward to a solution covering both > Linux and Windows desktops, pre-OS screen access optional, > well-integrated (i.e., having automation) with OpenStack Nova, > preferably also with Cinder and Glance, optionally with Keystone > (apart from self-auth of course!) and Heat, 3D acceleration optional > (most of the desktops here don't need it), nice to have read-only > sharing of screen. We just launched a service like this on the Nectar Research Cloud. Like you, I looked around but couldn't find any Open Source projects that would be suitable. In the end, we based ours on a project from the University of Melbourne that did initially support Windows, but we removed some of that support to simplify our codebase as we didn't need it. We called it Bumblebee, and the code is here: https://github.com/NeCTAR-RC/bumblebee It's a Django web app with a Redis-based task scheduler that launches Nova instances, booted from a Cinder volume, cloned from a base OS image. The Django app directly modifies Guacamole's database to create the connections once the OpenStack resources have been provisioned and provides the user with a link that takes them to their desktop. We used Keycloak with OIDC for authentication on the web app and Guacamole and it's fairly seamless transitioning between the two. We did initially look at using Heat, but we wanted to support a workflow of being able to destroy the VM and archive the OS image to Swift (and restore again later if needed) so it was easier to just manage the resources directly. There's no 3D acceleration in our solution yet, but we're planning on looking at things like virtual GPUs later on. Sadly, I'm not going to make it to Berlin either, but I was thinking it might make for a good talk at the next summit. I'm in the process of properly documenting it now, so I don't have much to share at this point, but I'm happy to go into more detail about anything. cheers, Andy

1 0

[all][tc] Lets talk about Flake8 E501
by Miro Tomaska 01 Jun '22

01 Jun '22

Hello All, This is probably going to be a hot topic but I was wondering if the community ever considered raising the default 79 characters line limit. I have seen some places where even a very innocent line of code needs to be split into two lines. I have also seen some code where I feel like variable names were abbreviated on purpose to squeeze everything into one line. How does the community feel about raising the E501 limit to 119 characters? The 119 character limit is the second most popular limit besides the default one. It's long enough to give a developer enough room for descriptive variables without being forced to break lines too much. And it is short enough for a diff between two files to look OK. The only downside I can see right now is that it's not easy to convert an existing code. So we will end up with files where the new code is 79+ characters and the "old" code is <=79. I can also see an argument where someone might have trouble reviewing a patch on a laptop screen (assuming standard 14" screen) ? Here is an example of one extreme, a diff of two files maxing out at 119 characters https://review.opendev.org/c/opendev/sandbox/+/843697/1..2 Thank you for your time and I am looking forward to this conversation :) -- Miro Tomaska irc: mtomaska Red Hat

9 11

[keystone] how to use v3tokenlessauth
by hai wu 01 Jun '22

01 Jun '22

I could not find any example/usage of v3tokenlessauth, using environment variables. There are no documents to be found. I assume we could need to have this one at least: export OS_AUTH_TYPE="v3tokenlessauth" What other environment variables are required if using this auth type? Would like to use HTTPs x509 auth. This is the only relevant doc found: https://docs.openstack.org/keystone/train/admin/configure_tokenless_x509.ht… [keystone_authtoken] memcached_servers = localhost:11211 cafile = /etc/keystone/ca.pem project_domain_name = Default project_name = service auth_url = https://192.168.0.10/identity/v3 auth_type = v3tokenlessauth certfile = /etc/glance/certs/glance.pem keyfile = /etc/glance/private/glance_private_key.pem But there are no environment variables mentioned in the above doc.

1 0

Novice question
by tim+openstack.org＠coote.org 01 Jun '22

01 Jun '22

Hullo Naïve question follows. Sorry. I’m trying a minimal OS install on a Virtualbox VM on a mac. I’d like to get to the point where I can launch a compute node. I’ve failed with `packstack` and I’m trying `devstack`. Should this work out of the box: ie Spin up a vm with vagrant: I’m using Centos Stream 9 to ensure that I get a current(ish) version of Python. It has 9GB RAM Ensure that SELinux and firewalls are turned off Clone devstack, cd to the directory and run `stack.sh` as user `vagrant` (this fails 1/3 of the time as some repo or other resets a connection. `stack.sh` doesn’t seem to be idempotent as reinvoking it may or may not install and run the OS environment Upload a ssh keypair through the web interface Use the web interface to launch the m1.nano flavor with Cirros image (I think that this flavor is quite new as some of the documentation refers to creating such a flavor with 64MB, whereas this one has 128MB. I did try the 64MB route [with `packstack`] and concluded that at least 96MB was needed and the documentation was wrong. I couldn’t log into launchpad.net <http://launchpad.net/> to report this ☹ At this point the launch process fails with the error message: “Build of instance 157bfa1d-7f8c-4a6c-ba3a-b02fb4f4b6a9 aborted: Failed to allocate the network(s), not rescheduling.” In the web ui Afaict, the vm has enough memory (just: it’s using a bit of swap, but more cache, so it could reclaim that). I’d expected the instance to launch, and I can well believe that I’ve missed something, but the documentation seems to point all over the place for various logs. Should this approach work? Is there an alternative that’s better (e.g. use Ubuntu: I’m not keen on apt/dpkg/.deb based distros as I’ve been tripped up in the past over the dependency handling and systemd integration, so I’ve avoided this, but I can see that Canonical is spending money on OS. But so is IBM/Redhat)? Where can I find info on how to trouble shoot the failing process? tia Tim

3 5

[neutron][networking-ovn] Propose to EOL stable/queens, stable/rocky and stable/stein branches of networking-ovn
by Lajos Katona 01 Jun '22

01 Jun '22

Hi, The Queens, Rocky and Stein branches of networking-ovn see little activity and maintaining them and keeping their jobs running is a big effort. We discussed this topic during the team meeting (see [1]), and agreed to propose stable/queens, stable/rocky and stable/stein branches of networking-ovn End Of Life. I will wait until the end of next week for anyone who would like to step up as maintainer of those branches and who would at least try to fix CI of them. If there will be no volunteers for that, I will EOL those branches in networking-ovn. [1]: https://meetings.opendev.org/meetings/networking/2022/networking.2022-05-31… Lajos Katona (lajoskatona)

1 0

[neutron][tap-as-a-service] Propose to EOL stable/queens, stable/rocky and stable/stein branches of tap-as-a-service
by Lajos Katona 01 Jun '22

01 Jun '22

Hi, The Queens, Rocky and Stein branches of tap-as-a-service see little activity and maintaining them and keeping their jobs running is a big effort. We discussed this topic during the team meeting (see [1]), and agreed to propose stable/queens, stable/rocky and stable/stein branches of tap-as-a-service End Of Life. I will wait until the end of next week for anyone who would like to step up as maintainer of those branches and who would at least try to fix CI of them. If there will be no volunteers for that, I will EOL those branches in tap-as-a-service. [1]: https://meetings.opendev.org/meetings/networking/2022/networking.2022-05-31… Lajos Katona (lajoskatona)

1 0