January 2023 - openstack-discuss - lists.openstack.org

[cinder] Bug Report from 01-25-2023
by Sofia Enriquez 25 Jan '23

25 Jan '23

This is a bug report from 01-18-2022 to 01-25-2023. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Medium - https://bugs.launchpad.net/cinder/+bug/2003804 "Group actions enable, disable and failover replication can leave volume's replication status in transient states enabling, disabling and failing-over respectively." Fix proposed to master. Wishlist - https://bugs.launchpad.net/cinder/+bug/2003300 "[SVf] : Enable support for replication volume with mirror pool option." Fix proposed to master. Opinion - https://bugs.launchpad.net/cinder/+bug/2003245 "[HPE] cinder 3par FC driver not connecting to 3PAR storage." -- Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[kolla-ansible] TASK [Link kolla_logs volume to /var/log/kolla] error after changing docker directory
by A Monster 25 Jan '23

25 Jan '23

THis occurred after I changed the default docker directory from /var/lib/docker to /custom_path because the /var partition's size is not sufficient TASK [common : Link kolla_logs volume to /var/log/kolla] ********************************************************************************************************************************************************** fatal: [Storage]: FAILED! => {"changed": false, "msg": "src file does not exist, use \"force=yes\" if you really want to create the link: /var/lib/docker/volumes/kolla_logs/_data", "path": "/var/log/kolla", "src": "/var/lib/docker/volumes/kolla_logs/_data"} knowing that the changes I made are for only this specific node, the default docker directory is used for the others, so is there a custom configuration I could do in globals.yml file, or add in a custom config file or is it that it's not possible to use custom working directories for docker?

1 0

Live Snapshot ERROR
by Kaiser Wassilij 25 Jan '23

25 Jan '23

Hi, I want to take a Live-snapshot. The instances are not switched off. Ubuntu 20.04 # Ansible managed DISTRIB_ID="OSA" DISTRIB_RELEASE="25.2.0" DISTRIB_CODENAME="Yoga" DISTRIB_DESCRIPTION="OpenStack-Ansible" nova-25.0.2.dev8.dist-info Compiled against library: libvirt 8.0.0 Using library: libvirt 8.0.0 Using API: QEMU 8.0.0 Running hypervisor: QEMU 4.2.1 ii apparmor 2.13.3-7ubuntu5.1 amd64 user-space parser utility for AppArmor I've also Adjusted virt-aa-helper: #include <tunables/global> profile virt-aa-helper /usr/lib/libvirt/virt-aa-helper flags=(complain) { #include <abstractions/base> #include <abstractions/openssl> # needed for searching directories capability dac_override, capability dac_read_search, # needed for when disk is on a network filesystem network inet, network inet6, deny @{PROC}/[0-9]*/mounts r, @{PROC}/[0-9]*/net/psched r, owner @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, # Used when internally running another command (namely apparmor_parser) @{PROC}/@{pid}/fd/ r, # allow reading libnl's classid file /etc/libnl{,-3}/classid r, # for gl enabled graphics /dev/dri/{,*} r, # for hostdev /sys/devices/ r, /sys/devices/** r, /sys/bus/usb/devices/ r, deny /dev/sd* r, deny /dev/vd* r, deny /dev/dm-* r, deny /dev/drbd[0-9]* r, deny /dev/dasd* r, deny /dev/nvme* r, deny /dev/zd[0-9]* r, deny /dev/mapper/ r, deny /dev/mapper/* r, /usr/lib/libvirt/virt-aa-helper mr, /{usr/,}sbin/apparmor_parser Ux, /etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools audit deny @{HOME}/.* mrwkl, audit deny @{HOME}/.*/ rw, audit deny @{HOME}/.*/** mrwkl, audit deny @{HOME}/bin/ rw, audit deny @{HOME}/bin/** mrwkl, @{HOME}/ r, @{HOME}/** r, /var/lib/libvirt/images/ rw, /var/lib/libvirt/images/** rw, # nova base images (LP: #907269 https://bugs.launchpad.net/bugs/907269 ) /var/lib/nova/images/** rw, /var/lib/nova/instances/_base/** rw, # nova snapshots (LP: #1244694 https://bugs.launchpad.net/bugs/1244694 ) /var/lib/nova/instances/snapshots/** rw, } Filesystem: OCFS2 [keystone_authtoken] insecure = False auth_type = password auth_url = www_authenticate_uri = project_domain_id = default user_domain_id = default project_name = service username = nova password = region_name = RegionOne service_token_roles_required = False service_token_roles = service service_type = compute memcached_servers = token_cache_time = 300 [libvirt] inject_partition = -2 inject_password = False inject_key = False virt_type = kvm live_migration_with_native_tls = true live_migration_scheme = tls live_migration_inbound_addr = xxx.xxx.xxx.xxx hw_disk_discard = ignore disk_cachemodes = iscsi_use_multipath = True Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -r -u libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74) unexpected exit status 1: 2023-01-25 09:46:07.871+0000: 376129: info : libvirt version: 8.0.0, package: 1ubuntu7.1~cloud0 (Openstack Ubuntu Testing Bot <openstack-testing-bot(a)ubuntu.com> Wed, 25 May 2022 14:51:12 +0000) 2023-01-25 09:46:07.871+0000: 376129: info : hostname: bc2bl13 2023-01-25 09:46:07.871+0000: 376129: error : virDomainDiskDefMirrorParse:8800 : unsupported configuration: unknown mirror job type '' virt-aa-helper: error: could not parse XML virt-aa-helper: error: could not get VM definition Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: cannot update AppArmor profile 'libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74' Jan 25 09:46:07 bc2bl13 libvirtd[154472]: Unable to restore security label on /var/lib/nova/instances/snapshots/tmpej9y72fr/c8d4bb94296746d6bff6b747386b4a90.delta

1 0

Live Snapshot
by Kaiser Wassilij 25 Jan '23

25 Jan '23

Hi, I want to take a Live-snapshot. The instances are not switched off. Ubuntu 20.04 # Ansible managed DISTRIB_ID="OSA" DISTRIB_RELEASE="25.2.0" DISTRIB_CODENAME="Yoga" DISTRIB_DESCRIPTION="OpenStack-Ansible" nova-25.0.2.dev8.dist-info Compiled against library: libvirt 8.0.0 Using library: libvirt 8.0.0 Using API: QEMU 8.0.0 Running hypervisor: QEMU 4.2.1 ii apparmor 2.13.3-7ubuntu5.1 amd64 user-space parser utility for AppArmor I've also Adjusted virt-aa-helper: #include <tunables/global> profile virt-aa-helper /usr/lib/libvirt/virt-aa-helper flags=(complain) { #include <abstractions/base> #include <abstractions/openssl> # needed for searching directories capability dac_override, capability dac_read_search, # needed for when disk is on a network filesystem network inet, network inet6, deny @{PROC}/[0-9]*/mounts r, @{PROC}/[0-9]*/net/psched r, owner @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, # Used when internally running another command (namely apparmor_parser) @{PROC}/@{pid}/fd/ r, # allow reading libnl's classid file /etc/libnl{,-3}/classid r, # for gl enabled graphics /dev/dri/{,*} r, # for hostdev /sys/devices/ r, /sys/devices/** r, /sys/bus/usb/devices/ r, deny /dev/sd* r, deny /dev/vd* r, deny /dev/dm-* r, deny /dev/drbd[0-9]* r, deny /dev/dasd* r, deny /dev/nvme* r, deny /dev/zd[0-9]* r, deny /dev/mapper/ r, deny /dev/mapper/* r, /usr/lib/libvirt/virt-aa-helper mr, /{usr/,}sbin/apparmor_parser Ux, /etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools audit deny @{HOME}/.* mrwkl, audit deny @{HOME}/.*/ rw, audit deny @{HOME}/.*/** mrwkl, audit deny @{HOME}/bin/ rw, audit deny @{HOME}/bin/** mrwkl, @{HOME}/ r, @{HOME}/** r, /var/lib/libvirt/images/ rw, /var/lib/libvirt/images/** rw, # nova base images (LP: #907269 https://bugs.launchpad.net/bugs/907269 ) /var/lib/nova/images/** rw, /var/lib/nova/instances/_base/** rw, # nova snapshots (LP: #1244694 https://bugs.launchpad.net/bugs/1244694 ) /var/lib/nova/instances/snapshots/** rw, } Filesystem: OCFS2 [keystone_authtoken] insecure = False auth_type = password auth_url = www_authenticate_uri = project_domain_id = default user_domain_id = default project_name = service username = nova password = region_name = RegionOne service_token_roles_required = False service_token_roles = service service_type = compute memcached_servers = token_cache_time = 300 [libvirt] inject_partition = -2 inject_password = False inject_key = False virt_type = kvm live_migration_with_native_tls = true live_migration_scheme = tls live_migration_inbound_addr = xxx.xxx.xxx.xxx hw_disk_discard = ignore disk_cachemodes = iscsi_use_multipath = True Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -r -u libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74) unexpected exit status 1: 2023-01-25 09:46:07.871+0000: 376129: info : libvirt version: 8.0.0, package: 1ubuntu7.1~cloud0 (Openstack Ubuntu Testing Bot <openstack-testing-bot(a)ubuntu.com> Wed, 25 May 2022 14:51:12 +0000) 2023-01-25 09:46:07.871+0000: 376129: info : hostname: bc2bl13 2023-01-25 09:46:07.871+0000: 376129: error : virDomainDiskDefMirrorParse:8800 : unsupported configuration: unknown mirror job type '' virt-aa-helper: error: could not parse XML virt-aa-helper: error: could not get VM definition Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: cannot update AppArmor profile 'libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74' Jan 25 09:46:07 bc2bl13 libvirtd[154472]: Unable to restore security label on /var/lib/nova/instances/snapshots/tmpej9y72fr/c8d4bb94296746d6bff6b747386b4a90.delta

1 0

Retiring untested and unmaintained modules (murano, rally and tacker)
by Takashi Kajinami 25 Jan '23

25 Jan '23

Hello, In Puppet OpenStack projects we have multiple modules to support multiple OpenStack components. However unfortunately some of these have not been attracting enough interest from developers and have been unmaintained. During the past few cycles we retired a few incomplete modules but I'm wondering if we can retire a few unmaintained modules now, to reduce our maintenance/release effort. I checked the modules we have currently, and I think the following three can be first candidates. - puppet-murano - puppet-rally - puppet-tacker We haven't seen any feedback from users about these modules for a long time. Most of the changes for the past 2~3 years are proposed by me but I am not really using these components. These modules do not have proper test coverage and it's quite difficult for us to catch any breakage and honestly I'm not quite sure these modules can work properly with the latest code. Actually we've often caught up with the latest requirements several years after the change was made in the software side, and I'm afraid these are not well-maintained. eg. - support for tacker-conductor was added 4 years after the service was added - we didn't noticed that the openstack plugin was split out from the core rally package for several years If anybody has concerns with retiring these modules, then please let us know. If we don't hear any objections for a while, then I'll start proposing changes for project retirement. Thank you, Takashi -- ---------- Takashi Kajinami

1 1

[all][tc] Technical Committee next weekly meeting on 2023 Jan 25 at 1600 UTC
by Ghanshyam Mann 25 Jan '23

25 Jan '23

Hello Everyone, The technical Committee's next weekly meeting is scheduled for 2023 Jan 25, at 1600 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Tuesday, Jan 24 at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

openstack client integration to fetch and provide OIDC access tokens (v3oidcaccesstoken)?
by Christian Rohmann 25 Jan '23

25 Jan '23

Hey openstack-discuss, while there is support for OpenID Connect and its various flows in the openstack client (https://docs.openstack.org/python-openstackclient/latest/cli/man/openstack.…) I would like to have the user authenticate only with central IdP login via a web page and then receive an access token and not have each user's openstack cli be a full OIDC client handling credentials and authenticating against the IdP via the users password itself. The tricky bit here is having good tooling for users to authenticate via the existing SSO and then to get and refresh tokens which are then fed to the openstack CLI. I was wondering if anybody knows of some nice integrations / plugins / hooks to make it easy for users to deal with the authentication (usually via some web site) and then to inject the token (v3oidcaccesstoken) into openstack-cli? I found that Fedcloud.eu (https://www.fedcloud.eu/) does something like this (see https://fedcloudclient.fedcloud.eu/usage.html#authentication) via OIDC-Agent. But most platforms making use of OIDC seem to configure the openstack client with client_id and secret and have it authenticate directly with the IdP. Regards, Christian

3 5

podman manifest error | status 404 | openstack wallaby
by Swogat Pradhan 24 Jan '23

24 Jan '23

Hi, I am currently trying DCN for my openstack and when running the deployment command for the edge site i am getting the following error: FATAL | Pre-fetch all the containers | dcn01-hci-0 | item= 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo | error={"ansible_loop_var": "prefetch_image", "changed": false, "msg": "Failed to pull image 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo", "prefetch_image": " 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo"} Can someone please guide me on how to fix this issue? With regards, Swogat Pradhan

1 0

[Glance] No weekly meeting this week
by Pranali Deore 24 Jan '23

24 Jan '23

Hello, Thursday, 26th Jan is public holiday in India and almost half of the team will not be around, so cancelling glance weekly meeting for this week. Thanks & Regards, Pranali

1 0

[horizon][xstatic] xstatic-font-awesome and xstatic-jquery.tablesorter leaving OpenStack
by Radomir Dopieralski 24 Jan '23

24 Jan '23

Hi everyone, a few years ago we have a adopted under the OpenStack umbrella a number of xstatic packages used by Horizon and its plugins, because they seemed to be unmaintained at the time, and we needed to keep them secure. A few weeks ago one of those packages, xstatic-font-awesome, got a new release by its original authors – the good people at the MoinMoin Wiki project, where the XStatic mechanism originated. That surprised us a little, and raised some concerns, since the release wasn't done using the OpenStack process, so we reached out to clear this situation. After discussion, we have decided to remove two xstatic packages: xstatic-font-awesome and xstatic-jquery.tablesorter from the OpenStack repositories and let them be maintained by the MoinMoin Wiki contributors instead, together with many other xstatic packages they use, so that there is no more confusion about who is responsible for them. We will continue to use pinned versions of those packages in Horizon, but we will no longer keep them as part of the OpenStack project. We will start the retirement process on the repositories for those packages shortly. -- Radomir Dopieralski

1 0