January 2023 - openstack-discuss - lists.openstack.org

[kolla] [senlin] [xena] Self-signed cert errors during Senlin auth
by Rob Jefferson 27 Jan '23

27 Jan '23

Folks, I am deploying OpenStack Xena via Kolla. As part of improving our orchestration offerings, I am investigating the use of Senlin in our deployments. Using `enable_senlin: "yes"`, the containers install as expected. When I attempt to create an initial profile, I get the following error: > HttpException: 500: Server Error for url: https://external:8778/v1/profiles, > Could not find versioned identity endpoints when attempting to authenticate. > Please check that your auth_url is correct. SSL exception connecting > to https://internal:35357: HTTPSConnectionPool(host='internal', > port=35357): Max retries exceeded with url: / (Caused by > SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] > certificate verify failed: self signed certificate in > certificate chain (_ssl.c:1131)'))) I have tried setting `verify_ssl = False` in senlin.conf, but no dice. I don't see this issue on the other services for which we're using the same certificates (e.g., Heat, Keystone, Barbican). Looking in the containers, I don't see <service>-cert.pem or <service>-key.pem files for Senlin as I did for other services. Moreover, the authentication configurations look the same in all relevant respects, between Senlin and the services that do work. I'm positively flummoxed about why the certs aren't getting distributed. When I take a look at the documentation for Kolla TLS [1], I saw the following: > Enabling TLS on the backend services secures communication between the > HAProxy listing on the internal/external VIP and the OpenStack > services. It also enables secure end-to-end communication between > OpenStack services that support TLS termination. The OpenStack services > that support backend TLS termination in Victoria are: Nova, Ironic, > Neutron, Keystone, Glance, Heat, Placement, Horizon, Barbican, and > Cinder. Missing from here is Senlin, and looking at the same document from subsequent OpenStack releases suggests this hasn't changed. I don't know if this is a relevant issue to the problem I've been having (to be fair, I don't see Octavia, which we've also been using, on the list, even though we also haven't been having issues with Octavia certs). Is this something that I can fix via configuration, or is this a thing wherein we need to change how Kolla deploys Senlin, or even adding in SSL termination to the Senlin service? Any help on this would be greatly appreciated. Thanks, Rob [1] https://github.com/openstack/kolla-ansible/blob/stable/xena/doc/source/admi…

1 0

[Openstack][cinder] multiple backend generic volume group issue
by Ignazio Cassano 27 Jan '23

27 Jan '23

Hello All, I created a cinder configuration using multiple backends based on netapp ontap nfs with the same backend name and the same volume type. So my nfsgold1, nfsgold2 and nfsgold3 are addressed by the nfsgold volume backend name and nfsgold volume type. Each one has its own svm on netapp. This help me to distribute nfsgold volumes using scheduler filters based on free capacity. So when I create a volume with volume type nfsgold the scheduler allocates it on nfsgold1 or nfsgold2 or nfsgold3 using the capacity filter. Since some virtual machines need to have volumes on the same backend (for example nfsgold1) because they belong to the same application, I use the cinder scheduler hint. Why I need to store those volumes on the same backend? It is because they must belong to the same generic volume group for snaphotting at the same time. For this reason I need to create a generic volume group. Generic volume group creation need the volume type, in my case nfsgold. But like the volume, when I create a generic volume group, it is scheduled on nfsgold1 or nfsgold2 or nfsgold3 and it is obvious looking in the cinder database. So if I want to groups volumes of an application I must: 1 check if they are on the same backend (nfsgold1/nfsgold2/nfsgold3) 2) check on which backend the volume group is allocated (nfsgold1,/nfsgold2/nfsgold3) and it can be done only looking in the cinder database). Volumes and volume goups must stay on the same real backend. If not, when I create a group snapshot, it gives some errors because it checks the host related to the real backend (nfsgold1/nfsgold2/nfsgold3) and returns errors failing the operation. When I create a volume group by api or by command line, I must specify the volume type but I cannot know which is the real backend associated to it without looking in the cinder database. I think this is a bug. In the above situation, how can obtain consistent volume group snapshot ? Sorry for my bad english. I hope who is reading can understand what I mean. Ignazio

1 0

[openstack-ansible] Meeting on 31st of January 2023 is cancelled
by Dmitriy Rabotyagov 27 Jan '23

27 Jan '23

Hi everyone, Due to limited availability of core members for the upcoming meeting that should have taken place on 31.01.2023, I'm informing you that this meeting will be cancelled. Hoping to see everyone for the next meeting on 7th of February.

1 0

[release] Release countdown for week R-7, Jan 30 - Feb 03
by Elõd Illés 27 Jan '23

27 Jan '23

Development Focus ----------------- We are entering the last weeks of the 2023.1 Antelope development cycle. From now until the final release, we'll send a countdown email like this every week. It's probably a good time for teams to take stock of their library and client work that needs to be completed yet. The non-client library freeze is coming up, followed closely by the client lib freeze. Please plan accordingly to avoid any last minute rushes to get key functionality in. General Information ------------------- Next week is the Extra-ATC freeze, in preparation for elections. All contributions to OpenStack are valuable, but some are not expressed as Gerrit code changes. Please list active contributors to your project team who do not have a code contribution this cycle, and therefore won't automatically be considered an Active Technical Contributor and allowed to vote. This is done by adding extra-atcs to https://opendev.org/openstack/governance/src/branch/master/reference/projec… before the Extra-ATC freeze on February 2nd, 2023. A quick reminder of the upcoming freeze dates. Those vary depending on deliverable type: * General libraries (except client libraries) need to have their last feature release before Non-client library freeze (February 9th, 2023). Their stable branches are cut early. * Client libraries (think python-*client libraries) need to have their last feature release before Client library freeze (February 16th, 2023) * Deliverables following a cycle-with-rc model (that would be most services) observe a Feature freeze on that same date, February 16th, 2023. Any feature addition beyond that date should be discussed on the mailing-list and get PTL approval. After feature freeze, cycle-with-rc deliverables need to produce a first release candidate (and a stable branch) before RC1 deadline (March 2nd, 2023) * Deliverables following cycle-with-intermediary model can release as necessary, but in all cases before Final RC deadline (March 16th, 2023) Finally, now is also a good time to start planning what highlights you want for your deliverables in the cycle highlights. The deadline to submit an initial version for those is set to Feature freeze (February 16th, 2023). Background on cycle-highlights: http://lists.openstack.org/pipermail/openstack-dev/2017-December/125613.html Project Team Guide, Cycle-Highlights: https://docs.openstack.org/project-team-guide/release-management.html#cycle… knelson [at] openstack.org/diablo_rojo on IRC is available if you need help selecting or writing your highlights Upcoming Deadlines & Dates -------------------------- Extra-ATC freeze: February 2nd, 2023 (R-7 week) Non-client library freeze: February 9th, 2023 (R-6 week) Client library freeze: February 16th, 2023 (R-5 week) Antelope-3 milestone: February 16th, 2023 (R-5 week) 2023.2 Bobcat Virtual PTG: March 27-31, 2023 Előd Illés irc: elodilles @ #openstack-release

1 0

cloud dcn01 (edge) not found in External Deployment Post deployment Tasks | tripleo | wallaby | centos 8 stream
by Swogat Pradhan 27 Jan '23

27 Jan '23

Hi, I am trying to deploy DCN and in the final step getting the following error: 2023-01-27 18:31:10.843012 | 48d539a1-1679-1cbd-45d5-0000000000fe | TASK | Nova: Manage aggregate and availability zone and add hosts to the zone Using module file /usr/lib/python3.6/site-packages/ansible/modules/cloud/openstack/os_nova_host_aggregate.py Pipelining is enabled. <localhost> ESTABLISH LOCAL CONNECTION FOR USER: stack <localhost> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-bhcwyaeoxhaczfutgazdvosyznxmddwq ; OS_CLOUD=dcn01 /usr/bin/python3'"'"' && sleep 0' The full traceback is: File "/tmp/ansible_os_nova_host_aggregate_payload_uur0b1qu/ansible_os_nova_host_aggregate_payload.zip/ansible/module_utils/openstack.py", line 159, in openstack_cloud_from_module interface=module.params['interface'], File "/usr/lib/python3.6/site-packages/openstack/__init__.py", line 63, in connect options=options, **kwargs) File "/usr/lib/python3.6/site-packages/openstack/config/__init__.py", line 36, in get_cloud_region return config.get_one(options=parsed_options, **kwargs) File "/usr/lib/python3.6/site-packages/openstack/config/loader.py", line 1107, in get_one config = self._get_base_cloud_config(cloud, profile) File "/usr/lib/python3.6/site-packages/openstack/config/loader.py", line 509, in _get_base_cloud_config name=name)) 2023-01-27 18:31:14.137975 | 48d539a1-1679-1cbd-45d5-0000000000fe | FATAL | Nova: Manage aggregate and availability zone and add hosts to the zone | undercloud | error={ "changed": false, "invocation": { "module_args": { "api_timeout": null, "auth": null, "auth_type": null, "availability_zone": "dcn01", "ca_cert": null, "client_cert": null, "client_key": null, "hosts": [ "dcn01-hci-0.bdxworld.com", "dcn01-hci-1.bdxworld.com", "dcn01-hci-2.bdxworld.com" ], "interface": "public", "metadata": null, "name": "dcn01", "region_name": null, "state": "present", "timeout": 180, "validate_certs": null, "wait": true } }, "msg": "Cloud dcn01 was not found." } 2023-01-27 18:31:14.139916 | 48d539a1-1679-1cbd-45d5 Deploy step: (undercloud) [stack@hkg2director dcn01]$ cat deploy_dcn01.sh #!/bin/bash THT=/usr/share/openstack-tripleo-heat-templates/ CNF=/home/stack/ openstack overcloud deploy \ --stack dcn01 \ --templates $THT \ -r $CNF/dcn01/dcn01_roles.yaml \ -n $CNF/dcn01/custom_network_data.yaml \ -e $CNF/dcn01/node-info.yaml \ -e $CNF/dcn01/scheduler-hints.yaml \ -e $CNF/dcn01/overcloud-networks-deployed.yaml \ -e $CNF/dcn01/vip-deployed-environment.yaml \ -e ~/containers-prepare-parameter.yaml \ -e $THT/environments/services/neutron-ovn-dvr-ha.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/dcn-storage.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/cephadm-rbd-only.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/nova-az-config.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/etcd.yaml \ -e $CNF/dcn01/dcn01_overcloud-baremetal-deployed.yaml \ -e $CNF/dcn01/glance_dcn01.yaml \ -e $CNF/dcn01/deployed_ceph.yaml \ -e $CNF/dcn01/dcn01_parameters.yaml \ -e $CNF/dcn01/overcloud-export.yaml \ -e $CNF/dcn01/clouddomain.yaml \ --ntp-server 172.25.201.68 -vv Can you please tell me what this issue could be? How to fix it? With regards, Swogat Pradhan

1 0

[neutron] Neutron drivers meeting
by Rodolfo Alonso Hernandez 27 Jan '23

27 Jan '23

Hello Neutrinos: This is just a reminder of the meeting we have today at 1400UTC. Please check today's agenda: https://wiki.openstack.org/wiki/Meetings/NeutronDrivers See you in IRC.

1 0

OpenInfra Live - Jan. 26 at 9 am CT / 15:00 UTC
by Kristin Barrientos 25 Jan '23

25 Jan '23

Hi everyone, This week’s OpenInfra Live episode is brought to you by the OpenStack Large Scale SIG. Episode: In the "Large Scale Ops Deep Dive" series, a panel of OpenStack operators invites special guests to talk about their deployment and discuss their operations. For this episode, our guests will be Benjamin Fuhrmann and Stanislav Dmitriev from Ubisoft, the famous video game publisher. Date and time: Jan. 26 at 9 a.m. CT (15:00 UTC) You can watch us live on: YouTube: https://youtu.be/H1DunJM1zoc <https://youtu.be/r8WLM9TM6w4> LinkedIn: https://www.linkedin.com/video/event/urn:li:ugcPost:7017187840652427264/ <https://www.linkedin.com/video/event/urn:li:ugcPost:7004177126690017280/> Facebook: https://www.facebook.com/events/835737927534901 <http://www.facebook.com/events/862505974941677> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Benjamin Fuhrmann, Stanislav Dmitriev, Felix Huettner, Arnaud Morin and Thierry Carrez Have an idea for a future episode? Share it now at ideas.openinfra.live. Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation

1 0

[oslo][ironic] oslo.service (and IPA) TLS v1.3
by Jay Faulkner 25 Jan '23

25 Jan '23

Hey all, Ironic Python Agent uses oslo.service's wsgi module as a wsgi server, with the built in TLS support from sslutils.py. This sslutils.py support only works up to TLS v1.2. It needs some enhancement. It was indicated to me in #openstack-oslo that there's nobody working on this module currently. I know that Ironic can't be the only consumer of this across OpenStack, so this is a call for interested parties and help. We have to update this to support modern TLS. It's not an option. I'd rather not do it alone -- who wants to help? I was tempted to put something up about this at the PTG; but I'm not sure it's significant enough to be worth that discussion so I'm starting here :). Thanks, Jay Faulkner Ironic PTL

2 1

[cinder] Bug Report from 01-25-2023
by Sofia Enriquez 25 Jan '23

25 Jan '23

This is a bug report from 01-18-2022 to 01-25-2023. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Medium - https://bugs.launchpad.net/cinder/+bug/2003804 "Group actions enable, disable and failover replication can leave volume's replication status in transient states enabling, disabling and failing-over respectively." Fix proposed to master. Wishlist - https://bugs.launchpad.net/cinder/+bug/2003300 "[SVf] : Enable support for replication volume with mirror pool option." Fix proposed to master. Opinion - https://bugs.launchpad.net/cinder/+bug/2003245 "[HPE] cinder 3par FC driver not connecting to 3PAR storage." -- Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[kolla-ansible] TASK [Link kolla_logs volume to /var/log/kolla] error after changing docker directory
by A Monster 25 Jan '23

25 Jan '23

THis occurred after I changed the default docker directory from /var/lib/docker to /custom_path because the /var partition's size is not sufficient TASK [common : Link kolla_logs volume to /var/log/kolla] ********************************************************************************************************************************************************** fatal: [Storage]: FAILED! => {"changed": false, "msg": "src file does not exist, use \"force=yes\" if you really want to create the link: /var/lib/docker/volumes/kolla_logs/_data", "path": "/var/log/kolla", "src": "/var/lib/docker/volumes/kolla_logs/_data"} knowing that the changes I made are for only this specific node, the default docker directory is used for the others, so is there a custom configuration I could do in globals.yml file, or add in a custom config file or is it that it's not possible to use custom working directories for docker?

1 0