September 2022 - openstack-discuss

[cinder] experiences with S3 cinder-backup driver // client-side encryption feature
by Christian Rohmann 01 Sep '22

01 Sep '22

Hello openstack-discuss and cinder-backup users! There is an S3 driver available for cinder-backup since the Wallaby release already, see https://docs.openstack.org/releasenotes/cinder/wallaby.html#relnotes-18-0-0…. 1) I was wondering if anybody already used that on a somewhat larger scale and what you experiences are about performance, stability and compatibility? 2) What object storage implementation or external service were / are you using? 3) While there are options like "backup_s3_sse_customer_algorithm" and "backup_s3_sse_customer_key" make use of server-side-encryption (SSE), there seems to be no way to encrypt the data before actually sending it to the remote S3 (read: client-side encryption). Since the boto3 Python SDK by AWS is used, which does not actually implement CSE, like other language SDKs do (see my issue: https://github.com/boto/boto3/issues/3395), it seems obvious why that is not a totally low-hanging fruit. But there are ways to add this, check out the references to e.g. https://github.com/StephenSorriaux/s3-encryption in the mentioned boto3 issue. Encrypting data before sending it off to a potentially externally operated service seems like a nice feature. Even a single encryption key would then protect that data from having to trust a 3rd party. I know encrypted cinder volumes would also work, but they are not as commonly used. * Is CSE something that others would also like to see for the S3 driver? * Cinder devs, would this maybe be worth a spec for the next cycle? Regards Christian

1 0

[ovn-bgp-agent][neutron] - expose_tenant_networks bug
by Satish Patel 01 Sep '22

01 Sep '22

Folks, I am setting up ovn-bgp-agent lab in "BGP mode" and i found everything working great except expose tenant network https://ltomasbo.wordpress.com/2021/02/04/ovn-bgp-agent-testing-setup/ Lab Summary: 1 controller node 3 compute node ovn-bgp-agent running on all compute node because i am using "enable_distributed_floating_ip=True" ovn-bgp-agent config: [DEFAULT] debug=False expose_tenant_networks=True driver=ovn_bgp_driver reconcile_interval=120 ovsdb_connection=unix:/var/run/openvswitch/db.sock I am not seeing my vm on tenant ip getting exposed but when i attach FIP which gets exposed in loopback address. here is the full trace of debug logs: https://paste.opendev.org/show/buHiJ90nFgC1JkQxZwVk/

2 9

help: set ironic inspect autodiscovery failed
by 陈薇 01 Sep '22

01 Sep '22

Hi All, I'm trying the ironic inspect autodiscovery but failed. What I did: Set the inspector.conf 1. [discovery] enroll_node_driver = ipmi [processing] permit_active_introspection = true processing_hooks = $default_processing_hooks,extra_hardware,lldp_basic Configure the python agent: inspection_callback_url: There's no node automatically added. I enter the host and read the log of python agent, no inspect related log. Could anybody give any advice about how to triage or setup correctly? Thanks & Regards, Wei

1 1

[election][openstack-ansible] PTL candidacy for Antelope cycle
by Dmitriy Rabotyagov 01 Sep '22

01 Sep '22

Hello. I want to self-nominate for the role of OpenStack-Ansible PTL for the Antelope release cycle. As always, my goal will be to constantly improve existing code, make deployments and further operations as reliable as possible. For the previous cycle we have reached some of previously defined goals, like adding a `service` role, finally implementing service_token_roles and support of CentOS 9 Stream, but there is still room for improvement for role testing. With the return of live events I will do my best to ensure project presence on them and get in touch with operators to gain feedback for project future improvement. -- Kind regards, Dmitriy Rabotyagov

2 1