August 2022 - openstack-discuss - lists.openstack.org

[kolla][ops] Anyone using the collectd and/or telegraf?
by Radosław Piliszek 02 Aug '22

02 Aug '22

Hi Kolla-flavoured OpenStackers, Any of you using the collectd and/or telegraf with Kolla Ansible? The core team is looking to deprecate their support as it's not tested and collectd is now gone from Ubuntu Jammy. Please reply to this mail. Cheers, Radek -yoctozepto

2 2

[ceilometer][gnocchi][tacker] Internal Server Error in devstack for Zuul gate job
by ueha.ayumu＠fujitsu.com 02 Aug '22

02 Aug '22

Hi telemetry team, I’m Ueha from Tacker team, The Zuul gate job of Tacker failed with the following error. Do you know the solution? The gate job has failed, so we would appreciate it if you could deal it with high priority. Thanks! for reference, the same error occurring in the ceilometer patch. (https://review.opendev.org/c/openstack/ceilometer/+/851338 ‘s telemetry-dsvm-integration-centos-9s job) ------------------ ++ /opt/stack/ceilometer/devstack/plugin.sh:start_ceilometer:322 : /usr/local/bin/ceilometer-upgrade 2022-07-29 05:20:42.125 61523 DEBUG ceilometer.cmd.storage [-] Upgrading Gnocchi resource types upgrade /opt/stack/ceilometer/ceilometer/cmd/storage.py:42 2022-07-29 05:20:42.228 61523 CRITICAL ceilometer [-] Unhandled error: gnocchiclient.exceptions.ClientException: Internal Server Error (HTTP 500) 2022-07-29 05:20:42.228 61523 ERROR ceilometer Traceback (most recent call last): 2022-07-29 05:20:42.228 61523 ERROR ceilometer File "/usr/local/bin/ceilometer-upgrade", line 10, in <module> 2022-07-29 05:20:42.228 61523 ERROR ceilometer sys.exit(upgrade()) 2022-07-29 05:20:42.228 61523 ERROR ceilometer File "/opt/stack/ceilometer/ceilometer/cmd/storage.py", line 49, in upgrade 2022-07-29 05:20:42.228 61523 ERROR ceilometer tenacity.Retrying( ......... omit ......... 2022-07-29 05:20:42.228 61523 ERROR ceilometer File "/usr/local/lib/python3.8/dist-packages/gnocchiclient/client.py", line 52, in request 2022-07-29 05:20:42.228 61523 ERROR ceilometer raise exceptions.from_response(resp, method) 2022-07-29 05:20:42.228 61523 ERROR ceilometer gnocchiclient.exceptions.ClientException: Internal Server Error (HTTP 500) 2022-07-29 05:20:42.228 61523 ERROR ceilometer ------------------ Full log: https://zuul.opendev.org/t/openstack/build/71262e66ecf34827a8a3435657aa9b3f Best Regards, Ueha

4 4

[horizon][security-sig][tc] XStatic and JS dependencies
by Jeremy Stanley 02 Aug '22

02 Aug '22

We discussed this at the PTG, and sending out a recap has been on my to do list for a few months. Sorry about the delay! The tl;dr here is that OpenStack is effectively serving as the upstream distributor for (often vulnerable versions of) JavaScript software we didn't make, and downstream consumers like GNU/Linux distributions are then directly repackaging our copies of these things, and assuming we've taken care of any security vulnerabilities for them. In the early days, we needed a way to make it possible for Horizon to consume JavaScript libraries installed on systems, typically supplied by Linux distros via system level package management. XStatic was and still is a good framework for this, providing a means of bundling up metadata which can be adjusted in deployments to tie in local copies of JS libs so that Horizon can find them, and also allowing us to conveniently use the same sorts of mappings for upstream testing as well. The original idea was that we were shipping XStatic metadata packages, and distributions would take care of supplying the actual JS bits since that's not our specialty as a community. To make our own testing easier, we embedded copies of the actual JS within our XStatic packages, which is where all of this started going horribly wrong. The rationale at the time was that distro package maintainers would know to devendor (unbundle and replace) the JS inside our XStatic packages, substituting standard ones from their distribution. What has happened instead, likely due to a confluence of convenience and lack of clear communication on our part, is that the distros took the entirety of these XStatic packages and redistributed them, JS and all. Why is that bad? Well, our approach to Python dependencies is that we freeze the versions we use at the time of our coordinated release, on the assumption that distros backport any relevant security fixes for them. That's generally okay because we're not shipping those dependencies ourselves, someone else does and takes care of fixing and communicating vulnerabilities in them. For many of the XStatic packages Horizon relies on, however, distros are treating us as the upstream supplier of that software, including the JS bundled inside it. We don't (and really can't reliably) track security vulnerabilities in our dependencies, and JS is no exception in this regard. Unfortunately, when it comes to the outdated versions of JS libs we're redistributing inside those packages, many distros assume we are doing exactly that. Worse, it's not just the Linux distros, but even our own deployment projects following the same pattern. How can we address this? The first and fastest thing we should do is to start clearly communicating that we make no effort to track or fix vulnerabilities for JS inside our XStatic packages. Readme files in all of them should get a big disclaimer added, as visible as possible, that the included "convenience" copies of JS libs in them are not for production use and should be considered insecure, to be replaced at deployment time with actual upstream copies instead (this will be noticed not just when browsing our source code, but for any subsequent releases on PyPI too). Also update any places in our documentation where XStatic packages are mentioned to point this situation out. Ideally, we should reach out to distros and deployment projects we know are installing our copies of the embedded JS libs to make sure they're aware of this problem too. In the long term, we really need to gut the JS content from the source trees of our XStatic packages and make our test jobs use something like NPM or Yarn to fetch the relevant versions at deployment time, installing them into the expected locations pointed to by the XStatic metadata. This will make it more obvious that we're not taking responsibility for the security of those libraries, since we're no longer directly supplying them. I've only got the loosest understanding of how XStatic integration works, and not much familiarity with Horizon or its testing, so am relying on Horizon's contributors to weigh in on whether this course of action is sensible and, more importantly, achievable. -- Jeremy Stanley

1 1

[TripleO], Undercloud deployment is failing with with the NTP error
by Veronika Fisarova 02 Aug '22

02 Aug '22

Good day everyone, I was trying to deploy TripleO via tripleo-quickstart following this guide <https://docs.openstack.org/tripleo-quickstart/latest/getting-started.html#>. Working environment has satisfactory requirements following specifications in the guide. Python 3.6.8. is installed. The following deployment script was used: bash quickstart.sh --tags all -R wallaby -X --teardown all -v $VIRTHOST and the deployment is failing with the following error: 2022-08-02 13:05:13,693 p=21797 u=root n=ansible | 2022-08-02 13:05:13.692871 | 008acbda-7e58-575b-6e97-00000000078a | TASK | Ensure system is NTP time synced 2022-08-02 13:10:04,147 p=21797 u=root n=ansible | 2022-08-02 13:10:04.146932 | 008acbda-7e58-575b-6e97-00000000078a | FATAL | Ensure system is NTP time synced | undercloud | error={"changed": true, "cmd": ["chronyc", "waitsync", "30"], "delta": "0:04:50.254002", "end": "2022-08-02 13:10:04.121815", "msg": "non-zero return code", "rc": 1, "start": "2022-08-02 13:05:13.867813", "stderr": "", "stderr_lines": [], "stdout": "try: 1, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 2, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 3, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 4, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 5, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 6, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 7, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 8, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 9, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 10, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 11, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 12, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 13, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 14, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 15, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 16, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 17, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 18, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 19, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 20, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 21, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 22, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 23, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 24, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 25, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 26, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 27, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 28, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 29, refid: 00000000, correction: 0.000000000, skew: 0.000\ntry: 30, refid: 00000000, correction: 0.000000000, skew: 0.000", "stdout_lines": ["try: 1, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 2, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 3, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 4, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 5, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 6, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 7, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 8, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 9, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 10, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 11, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 12, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 13, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 14, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 15, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 16, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 17, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 18, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 19, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 20, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 21, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 22, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 23, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 24, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 25, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 26, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 27, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 28, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 29, refid: 00000000, correction: 0.000000000, skew: 0.000", "try: 30, refid: 00000000, correction: 0.000000000, skew: 0.000"]} 2022-08-02 13:10:04,178 p=21797 u=root n=ansible | PLAY RECAP ********************************************************************* 2022-08-02 13:10:04,178 p=21797 u=root n=ansible | localhost : ok=1 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 2022-08-02 13:10:04,179 p=21797 u=root n=ansible | undercloud : ok=209 changed=110 unreachable=0 failed=1 skipped=50 rescued=0 ignored=2 For more information, please see the copy of the partially deployed undercloud here <https://paste.opendev.org/show/bxKvk87Y8ZH1RdboQaa3/> and here <https://paste.opendev.org/show/banD6k2R1gReYvBjN8bx/>. As far as I know, I can SSH to the deployed undercloud, but I cannot ensure if the undercloud is working properly and how many functions are missing. If you would need any additional information, please email me or use the IRC nick: deydra Any help or suggestions appreciated. -- *Veronika Fisarova* Openstack Validation Framework - Intern Red Hat <http://www.redhat.com>

1 0

[security-sig] Cancelling our August meeting
by Jeremy Stanley 02 Aug '22

02 Aug '22

Apologies for the late notice, but I have travel for an appointment conflicting with our meeting and will be unable to chair it this month. If someone else wants to run the meeting please feel free, though we don't have any pressing agenda items so it's probably fine to skip. I'm also open to holding the meeting next week instead, if anybody is interested in rescheduling. Barring any ad hoc meetings in the interim, our next scheduled meeting is 15:00 UTC on Thursday, September 1. In the meantime, Security SIG folks can be found in the #openstack-security channel on OFTC or by prepending subjects to this ML with [security-sig] of course! -- Jeremy Stanley

1 0

Horizon dashboard query
by KK CHN 02 Aug '22

02 Aug '22

Hi everyone! I need a guide or advice or anything. I am administering a private cloud in openstack. As I am using the Horizon dashboard for the VM provisioning and administering activities. But the users are sending requests in mail and creating the VMs for them. can we make workflow automation for the request and approval and provisioning automatically in the Horizon dashboard on approval? Has anyone already done /have idea on these kinds of solutions for your openstack cloud ??. Is there some kind of documentation that could help me?. Any guidance much appreciated, where to start, what to refer and which tool/programming language best if I need to code from scratch. thanks in advance. Krish

5 6

[neutron] CI meeting agenda for 2.08.2022
by Slawek Kaplonski 02 Aug '22

02 Aug '22

Hi, It's just a reminder that today at 1500 UTC we will have our CI meeting. It will be on video this time [1]. Agenda is on etherpad [2]. [1] https://meetpad.opendev.org/neutron-ci-meetings [2] https://etherpad.opendev.org/p/neutron-ci-meetings -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

resize or migrate problem
by f.loghmani 02 Aug '22

02 Aug '22

hello I use OpenStack and I create some VMs in different compute in one region. when I resize the VM. if the compute doesn't have enough space, automatically the vm will be migrated to another compute. but my problem is here that when it migrated, the _base file doesn't migrate and remains in the first compute that it doesn't have enough space. because of this, the VM appears with an error status in OpenStack. if I move the _base from first compute to final compute and reboot the server this problem has been solved. so i need to not transfer _base manually and if it migrated to another compute the disk and _base transfer with each other. could you please help me to solve this problem? thanks in advance

1 0

[Triple0 - Wallaby] Overcloud deployment getting failed with SSL
by Lokendra Rathour 02 Aug '22

02 Aug '22

Hi Team, We were trying to install overcloud with SSL enabled for which the UC is installed, but OC install is getting failed at step 4: ERROR :nectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'undercloud.com'\",),))\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} 2022-07-08 17:03:23.606739 | 5254009a-6a3c-adb1-f96f-0000000072ac | FATAL | Clean up legacy Cinder keystone catalog entries | undercloud | item={'service_name': 'cinderv3', 'service_type': 'volume'} | error={"ansible_index_var": "cinder_api_service", "ansible_loop_var": "item", "changed": false, "cinder_api_service": 1, "item": {"service_name": "cinderv3", "service_type": "volume"}, "module_stderr": "Failed to discover available identity versions when contacting https://[fd00:fd00:fd00:9900::2ef]:13000. Attempting to parse version from URL.\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 600, in urlopen\n chunked=chunked)\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 343, in _make_request\n self._validate_conn(conn)\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 839, in _validate_conn\n conn.connect()\n File \"/usr/lib/python3.6/site-packages/urllib3/connection.py\", line 378, in connect\n _match_hostname(cert, self.assert_hostname or server_hostname)\n File \"/usr/lib/python3.6/site-packages/urllib3/connection.py\", line 388, in _match_hostname\n match_hostname(cert, asserted_hostname)\n File \"/usr/lib64/python3.6/ssl.py\", line 291, in match_hostname\n % (hostname, dnsnames[0]))\nssl.CertificateError: hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'undercloud.com'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 449, in send\n timeout=timeout\n File \"/usr/lib/python3.6/site-packages/urllib3/connectionpool.py\", line 638, in urlopen\n _stacktrace=sys.exc_info()[2])\n File \"/usr/lib/python3.6/site-packages/urllib3/util/retry.py\", line 399, in increment\n raise MaxRetryError(_pool, url, error or ResponseError(cause))\nurllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'undercloud.com'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1022, in _send_request\n resp = self.session.request(method, url, **kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 533, in request\n resp = self.send(prep, **send_kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/sessions.py\", line 646, in send\n r = adapter.send(request, **kwargs)\n File \"/usr/lib/python3.6/site-packages/requests/adapters.py\", line 514, in send\n raise SSLError(e, request=request)\nrequests.exceptions.SSLError: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'undercloud.com'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 138, in _do_create_plugin\n authenticated=False)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 610, in get_discovery\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 1452, in get_discovery\n disc = Discover(session, url, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 536, in __init__\n authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/discover.py\", line 102, in get_version_data\n resp = session.get(url, headers=headers, authenticated=authenticated)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1141, in get\n return self.request(url, 'GET', **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 931, in request\n resp = send(**kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1026, in _send_request\n raise exceptions.SSLError(msg)\nkeystoneauth1.exceptions.connection.SSLError: SSL exception connecting to https://[fd00:fd00:fd00:9900::2ef]:13000: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'undercloud.com'\",),))\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"<stdin>\", line 102, in <module>\n File \"<stdin>\", line 94, in _ansiballz_main\n File \"<stdin>\", line 40, in invoke_module\n File \"/usr/lib64/python3.6/runpy.py\", line 205, in run_module\n return _run_module_code(code, init_globals, run_name, mod_spec)\n File \"/usr/lib64/python3.6/runpy.py\", line 96, in _run_module_code\n mod_name, mod_spec, pkg_name, script_name)\n File \"/usr/lib64/python3.6/runpy.py\", line 85, in _run_code\n exec(code, run_globals)\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 185, in <module>\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 181, in main\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/module_utils/openstack.py\", line 407, in __call__\n File \"/tmp/ansible_openstack.cloud.catalog_service_payload_7ikyjf7t/ansible_openstack.cloud.catalog_service_payload.zip/ansible_collections/openstack/cloud/plugins/modules/catalog_service.py\", line 141, in run\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 517, in search_services\n services = self.list_services()\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 492, in list_services\n if self._is_client_version('identity', 2):\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 460, in _is_client_version\n client = getattr(self, client_name)\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/_identity.py\", line 32, in _identity_client\n 'identity', min_version=2, max_version='3.latest')\n File \"/usr/lib/python3.6/site-packages/openstack/cloud/openstackcloud.py\", line 407, in _get_versioned_client\n if adapter.get_endpoint():\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/adapter.py\", line 291, in get_endpoint\n return self.session.get_endpoint(auth or self.auth, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/session.py\", line 1243, in get_endpoint\n return auth.get_endpoint(self, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 380, in get_endpoint\n allow_version_hack=allow_version_hack, **kwargs)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 271, in get_endpoint_data\n service_catalog = self.get_access(session).service_catalog\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/base.py\", line 134, in get_access\n self.auth_ref = self.get_auth_ref(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 206, in get_auth_ref\n self._plugin = self._do_create_plugin(session)\n File \"/usr/lib/python3.6/site-packages/keystoneauth1/identity/generic/base.py\", line 161, in _do_create_plugin\n 'auth_url is correct. %s' % e)\nkeystoneauth1.exceptions.discovery.DiscoveryFailure: Could not find versioned identity endpoints when attempting to authenticate. Please check that your auth_url is correct. SSL exception connecting to https://[fd00:fd00:fd00:9900::2ef]:13000: HTTPSConnectionPool(host='fd00:fd00:fd00:9900::2ef', port=13000): Max retries exceeded with url: / (Caused by SSLError(CertificateError(\"hostname 'fd00:fd00:fd00:9900::2ef' doesn't match 'overcloud.example.com'\",),))\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1} 2022-07-08 17:03:23.609354 | 5254009a-6a3c-adb1-f96f-0000000072ac | TIMING | Clean up legacy Cinder keystone catalog entries | undercloud | 0:11:01.271914 | 2.47s 2022-07-08 17:03:23.611094 | 5254009a-6a3c-adb1-f96f-0000000072ac | TIMING | Clean up legacy Cinder keystone catalog entries | undercloud | 0:11:01.273659 | 2.47s PLAY RECAP ********************************************************************* localhost : ok=0 changed=0 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 overcloud-controller-0 : ok=437 changed=104 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0 overcloud-controller-1 : ok=436 changed=101 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0 overcloud-controller-2 : ok=431 changed=101 unreachable=0 failed=0 skipped=214 rescued=0 ignored=0 overcloud-novacompute-0 : ok=345 changed=83 unreachable=0 failed=0 skipped=198 rescued=0 ignored=0 undercloud : ok=28 changed=7 unreachable=0 failed=1 skipped=3 rescued=0 ignored=0 2022-07-08 17:03:23.647270 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Summary Information ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2022-07-08 17:03:23.647907 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Total Tasks: 1373 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ in the deploy.sh: openstack overcloud deploy --templates \ -r /home/stack/templates/roles_data.yaml \ --networks-file /home/stack/templates/custom_network_data.yaml \ --vip-file /home/stack/templates/custom_vip_data.yaml \ --baremetal-deployment /home/stack/templates/overcloud-baremetal-deploy.yaml \ --network-config \ -e /home/stack/templates/environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-conductor.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-inspector.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ironic-overcloud.yaml \ -e /home/stack/templates/ironic-config.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/external-ceph.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/ptp.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-ip.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \ -e /home/stack/containers-prepare-parameter.yaml Addition lines as highlighted in yellow were passed with modifications: tls-endpoints-public-ip.yaml: Passed as is in the defaults. enable-tls.yaml: # ******************************************************************* # This file was created automatically by the sample environment # generator. Developers should use `tox -e genconfig` to update it. # Users are recommended to make changes to a copy of the file instead # of the original, if any customizations are needed. # ******************************************************************* # title: Enable SSL on OpenStack Public Endpoints # description: | # Use this environment to pass in certificates for SSL deployments. # For these values to take effect, one of the tls-endpoints-*.yaml # environments must also be used. parameter_defaults: # Set CSRF_COOKIE_SECURE / SESSION_COOKIE_SECURE in Horizon # Type: boolean HorizonSecureCookies: True # Specifies the default CA cert to use if TLS is used for services in the public network. # Type: string PublicTLSCAFile: '/etc/pki/ca-trust/source/anchors/overcloud-cacert.pem' # The content of the SSL certificate (without Key) in PEM format. # Type: string SSLRootCertificate: | -----BEGIN CERTIFICATE----- ----*** CERTICATELINES TRIMMED ** -----END CERTIFICATE----- SSLCertificate: | -----BEGIN CERTIFICATE----- ----*** CERTICATELINES TRIMMED ** -----END CERTIFICATE----- # The content of an SSL intermediate CA certificate in PEM format. # Type: string SSLIntermediateCertificate: '' # The content of the SSL Key in PEM format. # Type: string SSLKey: | -----BEGIN PRIVATE KEY----- ----*** CERTICATELINES TRIMMED ** -----END PRIVATE KEY----- # ****************************************************** # Static parameters - these are values that must be # included in the environment but should not be changed. # ****************************************************** # The filepath of the certificate as it will be stored in the controller. # Type: string DeployedSSLCertificatePath: /etc/pki/tls/private/overcloud_endpoint.pem # ********************* # End static parameters # ********************* inject-trust-anchor.yaml # ******************************************************************* # This file was created automatically by the sample environment # generator. Developers should use `tox -e genconfig` to update it. # Users are recommended to make changes to a copy of the file instead # of the original, if any customizations are needed. # ******************************************************************* # title: Inject SSL Trust Anchor on Overcloud Nodes # description: | # When using an SSL certificate signed by a CA that is not in the default # list of CAs, this environment allows adding a custom CA certificate to # the overcloud nodes. parameter_defaults: # The content of a CA's SSL certificate file in PEM format. This is evaluated on the client side. # Mandatory. This parameter must be set by the user. # Type: string SSLRootCertificate: | -----BEGIN CERTIFICATE----- ----*** CERTICATELINES TRIMMED ** -----END CERTIFICATE----- resource_registry: OS::TripleO::NodeTLSCAData: ../../puppet/extraconfig/tls/ca-inject.yaml The procedure to create such files was followed using: Deploying with SSL — TripleO 3.0.0 documentation (openstack.org) <https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/feature…> Idea is to deploy overcloud with SSL enabled i.e* Self-signed IP-based certificate, without DNS. * Any idea around this error would be of great help. -- skype: lokendrarathour

4 21

[dev][requirements][tripleo] Return of the revenge of lockfile strikes back part II
by Jeremy Stanley 01 Aug '22

01 Aug '22

It became apparent in a Python community discussion[0] yesterday that lockfile has been designated as a "critical project" by PyPI, even though it was effectively abandoned in 2010. Because our release automation account is listed as one of its maintainers, I looked into whether we still need it for anything... For those who have been around here a while, you may recall that the OpenStack project temporarily assumed maintenance[1] of lockfile in late 2014 and uploaded a few new releases for it, as a stop-gap until we could replace our uses with oslo.concurrency. That work was completed[2] early in the Liberty development cycle. Unfortunately for us, that's not the end of the story. I looked yesterday expecting to see that we've not needed lockfile for 7 years, and was disappointed to discover it's still in our constraints list. Why? After much wailing and gnashing of teeth and manually installing multiple bisections of the requirements list, I narrowed it down to one dependency: ansible-runner. Apparently, ansible-runner currently depends[3] on python-daemon, which still has a dependency on lockfile[4]. Our uses of ansible-runner seem to be pretty much limited to TripleO repositories (hence tagging them in the subject), so it's possible they could find an alternative to it and solve this dilemma. Optionally, we could try to help the ansible-runner or python-daemon maintainers with new implementations of the problem dependencies as a way out. Whatever path we take, we're long overdue. The reasons we moved off lockfile ages ago are still there, and the risk to us has only continued to increase in the meantime. I'm open to suggestions, but we really ought to make sure we have it out of our constraints list by the Zed release. [0] https://discuss.python.org/t/17219 [1] https://lists.openstack.org/pipermail/openstack-dev/2014-June/038387.html [2] https://review.openstack.org/151224 [3] https://github.com/ansible/ansible-runner/issues/379 [4] https://pagure.io/python-daemon/issue/42 -- Jeremy Stanley

4 7