August 2022 - openstack-discuss - lists.openstack.org

[tacker] IRC meeting on Aug 16 cancelled
by Yasufumi Ogawa 10 Aug '22

10 Aug '22

Hi team, Since many of us are going to have a vacation next week, I'll cancel the meeting on Aug 16th. Thanks, Yasufumi

1 0

Correct way to add firewall rules in tripleo | Wallaby
by Swogat Pradhan 10 Aug '22

10 Aug '22

Hi, I am trying to add a rule for zabbix in my tripleo wallaby setup on top of centos 8 stream. i followed https://docs.openstack.org/project-deploy-guide/tripleo-docs/latest/feature… but got the error message: [ERROR]: Failed, module return: {'msg': 'value of action must be one of: append, insert, got: accept', 'failed': True, 'invocation': {'module_args': {'state': 'present', 'action': 'accept', 'jump': 'ACCEPT', 'chain': 'INPUT', 'protocol': 'tcp', 'source': '172.25.161.50', 'ctstate': ['NEW'], 'ip_version': 'ipv4', 'comment': '301 allow zabbix ipv4', 'destination_port': '10050', 'table': 'filter', 'match': [], 'syn': 'ignore', 'flush': False}}, 'warnings': ["The value 10050 (type int) in a string field was converted to '10050' (type string). If this does not look like what you expect, quote the entire value to ensure it does not change."], '_ansible_parsed': True} [ERROR]: Failed, return data: {'stdout': None, 'stderr': None, 'msg': 'value of action must be one of: append, insert, got: accept', 'cmd': None, 'rc': 0, 'failed': True} 2022-07-21 01:27:33.335477 | 48d539a1-1679-1e80-25fd-000000005aa1 | TASK | Manage firewall rules 2022-07-21 01:27:33.351515 | 48d539a1-1679-1e80-25fd-000000005542 | FATAL | Manage firewall rules | overcloud-controller-0 | error={"changed": false, "cmd": null, "msg": "value of action must be one of: append, insert, got: accept", "rc": 0, "stderr": null, "stdout": null} When i tried the following link: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/15… <https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/15…> my script is running fine but rules are not updated in iptables for zabbix. Can you please suggest a correct approach to open port 10050 in tripleo? With regards, Swogat Pradhan

2 1

Security vulnerabilities in Horizon dashboard | Openstack Wallaby | Tripleo | Openstack Horizon
by Swogat Pradhan 09 Aug '22

09 Aug '22

Hi, I am setting up an openstack wallaby cloud for a client using tripleo. After setting everything up the client ran a WEB scan and found some vulnerabilities (attached snapshot for reference). Can you please guide me on how to fix these vulnerabilities in the dashboard service? With regards, Swogat pradhan

2 3

[openstack-ansible] Meeting on August 16 is cancelled
by Dmitriy Rabotyagov 09 Aug '22

09 Aug '22

Hi everyone, Since several core participants won't be able to present at the meeting it was decided to cancel the Team meeting on 16th of August 2022.

1 0

[nova] Review guide for PCI tracking for Placement patches
by Balazs Gibizer 09 Aug '22

09 Aug '22

Hi Nova, The first batch of patches are up for review for the PCI tracking for Placement feature. These mostly covers two aspects of the spec[1]: 1) renaming [pci]passthrough_whitelist to [pci]device_spec 2) pci inventory reporting to placement, excluding existing PCI allocation healing in placement This covers the first 4 sub chapters of Proposed Change chapter of the spec[1] up until "PCI alias configuration". I noted intentional deviations from the spec in the spec review [2] and I will push a follow up to the spec at some point fixing those. I tried to do it in small steps hence the long list of commits[3]: #2) pci inventory reporting to placement, excluding existing PCI allocation healing in placement 5827d56310 Stop if tracking is disable after it was enabled before a4b5788858 Support [pci]device_spec reconfiguration 10642c787a Reject devname based device_spec config b0ad05fb69 Ignore PCI devs with physical_network tag f5a34ee441 Reject mixed VF rc and trait config c60b26014f Reject PCI dependent device config 5cf7325221 Extend device_spec with resource_class and traits eff0df6a98 Basics for PCI Placement reporting #1) renaming [pci]passthrough_whitelist to [pci]device_spec adfe34080a Rename whitelist in tests ea955a0c15 Rename exception.PciConfigInvalidWhitelist to PciConfigInvalidSpec 55770e4c14 Rename [pci]passthrough_whitelist to device_spec There is a side track branching out from "adfe34080a Rename whitelist in tests" to clean up the device spec handling[4]: 514500b5a4 Move __str__ to the PciAddressSpec base class 3a6198c8fb Fix type annotation of pci.Whitelist class f70adbb613 Remove unused PF checking from get_function_by_ifname b7eef53b1d Clean up mapping input to address spec types 93bbd67101 Poison /sys access via various calls in test 467ef91a86 Remove dead code from PhysicalPciAddress 233212d30f Fix PciAddressSpec descendants to call super.__init__ ad5bd46f46 Unparent PciDeviceSpec from PciAddressSpec cef0d2de4c Extra tests for remote managed dev spec 2fa2825afb Add more test coverage for devname base dev spec adfe34080a Rename whitelist in tests This is not a mandatory part of the feature but I think they improve the code in hand and even fixing some small bugs. I will continue with adding allocation healing for existing PCI allocations. Any feedback is highly appreciated. Cheers, gibi [1] https://specs.openstack.org/openstack/nova-specs/specs/zed/approved/pci-dev… [2] https://review.opendev.org/c/openstack/nova-specs/+/791047 [3] https://review.opendev.org/q/topic:bp/pci-device-tracking-in-placement [4] https://review.opendev.org/q/topic:bp/pci-device-spec-cleanup

1 2

[publiccloud-sig] A new start for Public Cloud SIG
by Tobias Rydberg 09 Aug '22

09 Aug '22

Hi everyone, In Berlin it became clear that there is a big interest in restarting the Public Cloud SIG. Thank you all for your contributions in that forum session [0] and the interest in participating in the work of this SIG. A lot of good ideas of what we should focus on was identified, with a clear focus of interoperability and standardization, to make the experience of using OpenStack as an end-user even better. Standardization of images and flavors - naming, metadata etc - being one of them, working closely with InterOp WG regarding the checks and governance of the OpenStack Powered Program another. The ultimate goal could be to reach a state where it is possible to start to federate between the public clouds, but for that to be possible on a more global scale we need to start with aligning the simple things. To kick this off, we will start with bi-weekly IRC meetings again, shape the goals kick of some work towards identified goals. Since we have an IRC channel (#openstck-publiccloud) my suggestion is that we will start there. Let's decide on suggestions for day and time for our bi-weekly meetings during the kick off meeting. Kick off meeting =========== When: Wednesday 10th of August at 1400 UTC Where: IRC in channel #openstack-publiccloud I created an etherpad for our first meeting [1], feel free to add items to the agenda or other suggestions on goals etc that you might have prior to the meeting. Hope to see at IRC in August! [0] https://etherpad.opendev.org/p/berlin-summit-future-public-cloud-sig [1] https://etherpad.opendev.org/p/publiccloud-sig-kickoff BR, Tobias Rydberg

2 2

[announcement] [debian] Debian Buster with OpenStack Rocky will receive LTS support
by Thomas Goirand 08 Aug '22

08 Aug '22

Hi! After some discussion with the folks taking care of the Debian LTS project, we decided that we will attempt to support OpenStack Rocky, running on Debian 10 (aka: Buster), for another 2 years, together with the rest of the distribution. In the past, we decided that we wouldn't do it, and that OpenStack would be part of the list of unsupported packages, because it was too difficult to maintain. However, it is my opinion that this has changed, because: - The codebase is evolving slower - I do have all the tooling to re-do a Rocky deployment if needed - There's a lot less CVE per year than it used to be (10 years ago, it was 1 every 2 weeks on average, now we have like 2 grave issue per year...). - I'm confident that if there's a grave issue, I'll be able to find help from the this wonderful community (it happened in the past...). Also, some sponsors of the Debian LTS project are actually running OpenStack Rocky on Debian. So it makes sense to help them. It is to be noted that I will not be the person doing the actual security backports, but I'll be there in case the person doing it needs help from me (for example, to do a deployment and manual regression testing). Hoping this will help OpenStack users running on Debian, Cheers, Thomas Goirand (zigo)

1 0

[all] Automatic update of Python jobs in Zuul project configuration
by Pierre Riteau 08 Aug '22

08 Aug '22

Hello, A patch submitted to python-blazarclient by yoctozepto [1] made me realise the automatic change of Python jobs from yoga to zed missed various repositories [2], mostly python clients. Is there a reason for this? Also, one can easily find projects which are using even older job templates (xena or earlier). Thanks, Pierre Riteau (priteau) [1] https://review.opendev.org/c/openstack/python-blazarclient/+/851903 [2] https://codesearch.openstack.org/?q=openstack-python3-yoga-jobs&i=nope&lite…

3 6

[kolla-ansible] why does not the bootstrap create the docker bridge?
by wodel youchi 08 Aug '22

08 Aug '22

Hi, The bootstrap installs docker but it does not create the docker bridge, why? Regards.

2 1

[Oslo] IRC meeting.
by Daniel Mats Niklas Bengtsson 08 Aug '22

08 Aug '22

Hi there, I'm sorry, I was on vacation and then I had personal problems. We are still in the summer period and I think there are still people on vacation, I suggest resuming meetings in September. What do you think?

1 0