December 2023 - openstack-discuss

ERROR openstack [-] Resource OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type OS::Neutron::Port and the Neutron service is not available when using ephemeral Heat.| Openstack tripleo wallaby version
by Swogat Pradhan 24 Dec '24

24 Dec '24

Hi, I am currently trying to deploy openstack wallaby using tripleo arch. I created the network jinja templates, ran the following commands also: #openstack overcloud network provision --stack overcloud --output networks-deployed-environment.yaml custom_network_data.yaml # openstack overcloud network vip provision --stack overcloud --output vip-deployed-environment.yaml custom_vip_data.yaml # openstack overcloud node provision --stack overcloud --overcloud-ssh-key /home/stack/sshkey/id_rsa overcloud-baremetal-deploy.yaml and used the environment files in the openstack overcloud deploy command: (undercloud) [stack@hkg2director ~]$ cat deploy.sh #!/bin/bash THT=/usr/share/openstack-tripleo-heat-templates/ CNF=/home/stack/ openstack overcloud deploy --templates $THT \ -r $CNF/templates/roles_data.yaml \ -n $CNF/workplace/custom_network_data.yaml \ -e ~/containers-prepare-parameter.yaml \ -e $CNF/templates/node-info.yaml \ -e $CNF/templates/scheduler-hints.yaml \ -e $CNF/workplace/networks-deployed-environment.yaml \ -e $CNF/workplace/vip-deployed-environment.yaml \ -e $CNF/workplace/overcloud-baremetal-deployed.yaml \ -e $CNF/workplace/custom-net-bond-with-vlans.yaml Now when i run the ./deploy.sh script i encounter an error stating: ERROR openstack [-] Resource OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type OS::Neutron::Port and the Neutron service is not available when using ephemeral Heat. The generated environments from 'openstack overcloud baremetal provision' and 'openstack overcloud network provision' must be included with the deployment command.: tripleoclient.exceptions.InvalidConfiguration: Resource OS::TripleO::Network::Ports::ControlPlaneVipPort maps to type OS::Neutron::Port and the Neutron service is not available when using ephemeral Heat. The generated environments from 'openstack overcloud baremetal provision' and 'openstack overcloud network provision' must be included with the deployment command. 2022-04-19 13:47:16.582 735924 INFO osc_lib.shell [-] END return value: 1 Can someone tell me where the mistake is? With regards, Swogat Pradhan

4 4

[kolla] [openeuler] CI jobs status
by Michał Nasiadka 26 Nov '24

26 Nov '24

Hello Koalas, OpenEuler jobs in master (to be Antelope) are failing for a long time. If no one is interested in maintaining OpenEuler support in Kolla-Ansible - I will propose dropping it’s support on Wednesday Kolla meeting. Best regards, Michal

4 3

Kolla Ansible on Ubuntu 20.04 - cloud-init & other network issues
by Tobias McNulty 10 Oct '24

10 Oct '24

Hi, I'm attempting to use Kolla Ansible 14.6.0 to deploy OpenStack Yoga on a small 3-node Ubuntu 20.04 cluster. The nodes have 128 GB RAM each, dual Xeon processors, and dual 10G Intel NICs. The NICs are connected to access ports on a 10G switch with separate VLANs for the local and external networks. All the playbooks run cleanly, but cloud-init is failing in the Ubuntu 20.04 and 22.04 VMs I attempt to boot. The VM images are unmodified from https://cloud-images.ubuntu.com/, and cloud-init works fine if I mount a second volume with user-data. The error is a timeout attempting to reach 169.254.169.254. This occurs both when booting a VM in an internal routed network and directly in an external network. I tried various neutron plugin agents (ovn, linuxbridge, and openvswitch both with and without firewall_driver = openvswitch <https://docs.openstack.org/kolla-ansible/latest/reference/networking/neutro…>) first with a clean install of the entire OS each time, all with the same result. Running tcpdump looking for 169.254.169.254 shows nothing. As a possible clue, the virtual NICs are unable to pass any traffic (e.g., to reach an external DHCP server) unless I completely disable port security on the interface (even if the associated security group is wide open). But disabling port security does not fix cloud-init (not to mention I don't really want to disable port security). Are there any additional requirements related to deploying OpenStack with Kolla on Ubuntu 20.04? This is a fairly vanilla configuration using the multinode inventory as a starting point. I tried to follow the Quick Start <https://docs.openstack.org/kolla-ansible/yoga/user/quickstart.html> as closely as possible; the only material difference I see is that I'm using the same 3 nodes for control + compute. I am using MAAS so it's easy to get a clean OS install on all three nodes ahead of each attempt. I plan to try again with the standard (non-HWE) kernel just in case, but otherwise I am running out of ideas. In case of any additional clues, here are my globals.yml and inventory file, along with the playbook I'm using to configure the network, images, VMs, etc., after bootstrapping the cluster: https://gist.github.com/tobiasmcnulty/7dbbdbc67abc08cbb013bf5983852ed6 Thank you in advance for any advice! Cheers, Tobias

5 9

Live migration fails
by Szabo, Istvan (Agoda) 07 Aug '24

07 Aug '24

Hi, I have couple of compute nodes where the live migration fails with existing vms. When I quickly spawn a vm and try live migration it works so I assume shouldn't be a big problem with the compute node. However I have many existing vms where it fails with a servername not found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 ERROR nova.conductor.tasks.migrate [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] [instance: 1517a2ac-3b51-4d8d-80b3-89a5614d1ae0] Unable to find record for source node servername on servername: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 WARNING nova.scheduler.utils [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] Failed to compute_task_migrate_server: Compute host servername could not be found.: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.605 227612 WARNING nova.scheduler.utils [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] [instance: 1517a2ac-3b51-4d8d-80b3-89a5614d1ae0] Setting instance to ACTIVE state.: ComputeHostNotFound: Compute host servername could not be found. /var/log/nova/nova-conductor.log:2021-04-21 14:47:12.672 227612 ERROR oslo_messaging.rpc.server [req-f4067a26-a233-4673-8c07-9a8a290980b0 dce35e6eceea4312bb0baa0510cef363 ca7e35079f4440c78bd9870724b9638b - default default] Exception during message handling: ComputeHostNotFound: Compute host am-osfecn-4025 Tried with this command: nova live-migration --block-migrate id. Any idea? Thank you. ________________________________ This message is confidential and is for the sole use of the intended recipient(s). It may also be privileged or otherwise protected by copyright or other legal rules. If you have received it by mistake please let us know by reply email and delete it from your system. It is prohibited to copy this message or disclose its content to anyone. Any confidentiality or privilege is not waived or lost by any mistaken delivery or unauthorized disclosure of the message. All messages sent to and from Agoda may be monitored to ensure compliance with company policies, to protect the company's interests and to remove potential malware. Electronic messages may be intercepted, amended, lost or deleted, or contain viruses.

5 16

[ptl][tc] OpenStack packages PyPi additional external maintainers audit & cleanup
by Ghanshyam Mann 17 May '24

17 May '24

Hi PTLs, As you might know or have seen for your project package on PyPi, OpenStack deliverables on PyPi have additional maintainers, For example, https://pypi.org/project/murano/, https://pypi.org/project/glance/ We should keep only 'openstackci' as a maintainer in PyPi so that releases of OpenStack deliverables can be managed in a single place. Otherwise, we might face the two sets of maintainers' places and packages might get released in PyPi by additional maintainers without the OpenStack project team knowing about it. One such case is in Horizon repo 'xstatic-font-awesome' where a new maintainer is added by an existing additional maintainer and this package was released without the Horizon team knowing about the changes and release. - https://github.com/openstack/xstatic-font-awesome/pull/2 To avoid the 'xstatic-font-awesome' case for other packages, TC discussed it in their weekly meetings[1] and agreed to audit all the OpenStack packages and then clean up the additional maintainers in PyPi (keep only 'openstackci' as maintainers). To help in this task, TC requests project PTL to perform the audit for their project's repo and add comments in the below etherpad. - https://etherpad.opendev.org/p/openstack-pypi-maintainers-cleanup Thanks to knikolla to automate the listing of the OpenStack packages with additional maintainers in PyPi which you can find the result in output.txt at the bottom of this link. I have added the project list of who needs to check their repo in etherpad. - https://gist.github.com/knikolla/7303a65a5ddaa2be553fc6e54619a7a1 Please complete the audit for your project before March 15 so that TC can discuss the next step in vPTG. [1] https://meetings.opendev.org/meetings/tc/2023/tc.2023-01-11-16.00.log.html#… -gmann

18 27

[all][packaging][release][qa] pep-517 and pip 23
by smooney＠redhat.com 06 May '24

06 May '24

hi folks, TL;DR ----- this is a long email so the tl;dr is we should add pyproject.toml ``` [build-system] requires = ["pbr>=5.7.0", "setuptools>=36.6.0", "wheel"] build-backend = "pbr.build" ``` to all openstack projects to supprot pip 23.1+ Long version ------------ As some of you may know the ptg happend last week an done of hte topic raised there was a know limitation in devstack where GLOBAL_VENV=True does not work on centos/fedora derived distros. while i generally dont use centos/fedora derived distros for my daily work i have been using devstack for over 10 years at this point so when im told it broken i ocationlly will go fix it. In this case the issue is not with devstack (it often isnt) and is actully in our collective reliance on a deprecated functionality and how we package openstack today. Back story, for better or worse when openstack was created the landscape of python packaging was significantly different then it is today. To help corodinate our dependcies the openstack comunity went all in on requirements.txt and developed upper-constraits to manage our requirements and developed PBR (python build Reasonableness). both of those approches have served us well and likely will continue to do so for some time. Since then pyproject.toml has started to gain popularity and pep-517 (A build-system independent format for source trees) has been adotpted but so far openstack as a comunity has not embraced those changes. (although pbr already supprot pep-517 :) ). Until now this has not been a problem however with recent release of pip things are now breaking. Problem Context: - openstack does not provide pyporject.toml files - openstack project configure setuptools to use pbr via setup.py - setuptools support generating scripts form entry points(console_scripts) which we use for project binaries( nova- compute, neutron-server, ...) - openstack api services use a pbr extension know as wsgi_scripts which adds a similar functionality for generating wsgi application mains file - devstack due to coming changes in distro to block "sudo pip install" now installs openstack in a single by default on debian distros. on centos/fedora distros it currently almost functional (but not). - devstack installs in editable mode because that is how most developers use devstack for developemnt What changed: - pip 20.2 deprecated support for falling back to calling setup.py when pyproject.toml is not present - https://pip.pypa.io/en/stable/news/#v20-2 - https://github.com/pypa/pip/issues/8368 - at this point when pyproject.yaml is not called pip calls setup.py install [-e] <path to repo or package name> - setup.py invokes pbr to generate wsgi_scripts and other files - in pip 23.1 the fallback was removed https://pip.pypa.io/en/stable/news/#v23-1 - pip now builds a temp local wheel instead of calling setup.py install when pyproject.toml is not found - in editable mode (-e) the default way the wheel is built does not invoke pbr properly to generate the wsgi files - as a result the wsgi files are not installed to the venv bin dir and this causes devstack to fail to start keystone (or any other wsgi api) The fix, there are a few ways to approch this: - clamp pip (https://review.opendev.org/c/openstack/devstack/+/898845) this is a terible idea and it breaks debian - clamping pip below 23.1 works on centos for now however OVS on debian already requires pep 517 for installing - as such when that version of ovs (or other projects start enforcing that) hits centos it will break - add a minimal pyproject.toml to all openstack project - example for keystone https://review.opendev.org/c/openstack/keystone/+/899519 - this example jsut adds the minium pyproject.toml to enable pbr to be used as the build system - it does not remove supprot for setup.py but it will not be used by default going forward whit new version of pip - all config is still in setup.cfg - add pyproject.toml support but remove setup.py support https://review.opendev.org/c/opendev/bindep/+/816741 - this goes one step futrue and actuly nulls out setup.py - we could take this approach if we want to but its not required. The reason for this email is to get agreement on how to support pip 23.1+ My proposal would be to add pyproject.toml with the minimal config required to enable pip 23.2 but not drop the setup.py support in this cycle. i would suggest that we can deprecate installing via setup.py in caracal if that is desirable but not make that change until the next slurp to give time to projects and packages to catch up. if there are no objections to that i would like to ask what is the preferd way to create and submit the patches for the minimal pyproject.toml ``` [build-system] requires = ["pbr>=5.7.0", "setuptools>=36.6.0", "wheel"] build-backend = "pbr.build" ``` i can propose patches to the main project deployed by devstack by default. i.e. nova/neutron ectra but it might be better if someone form the core teams of each project could take on that task and chasing the reviews. if someone has a script to generate a patch for a set of repos that just add the above pyporject.toml then we can use that to keep a consistent topic/commit message across all patches. my proposal for testing this is two fold. in ci we can test the patches are functional by using a DNM patch to devstack to force enable the gloal venv on centos and depend on the set of patches, i will modify https://review.opendev.org/c/openstack/devstack/+/898845 to do that locally we can test that the patch is functional by doing the following substituting keystone for the relevant project. ``` git clone https://opendev.org/openstack/keystone cd keystone python3 -m venv .venv . .venv/bin/activate python3 -m pip install -U pip python3 -m pip install -e . ls .venv/bin/keystone* ``` the ls will not contain the wsgi script with the addition of the pyproject.toml it should. on debian sid i can reproduce the same issue the problem we are seeing on centos 9 now will start impacting other distos eventually so its good to fix this now. if i start proposing this to glance/nova/neutron/cinder/swift/horizon/placement (to get a default devstack working) can i get cores to review? can cores form each project nominate peopel to review or volenteer to do this work. i have created https://etherpad.opendev.org/p/pep-517-and-pip-23 to track this work i have some other work that i think we can do in parallel like addign pyporject.toml support to the pti requirements if we go this way but that i think we can discuss on a governacne patch to updated it. anyway this is a lot to digest so feedback is welcome. if someone else would like to drive this that is also welcome (i.e. tc/release team) regards sean.

10 27

Accessing virsh in openstack wallaby | tripleo
by Swogat Pradhan 24 Mar '24

24 Mar '24

Hi, Can someone please tell me how can i access the virsh utility on the compute node on openstack wallaby? Previously we used nova_libvirt but in wallaby there are multiple containers and i am unable to use virsh utility to edit my domain.xml file. List of containers: [root@dcn01-hci-2 ~]# podman ps | grep nova 10d981158842 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 2 months ago nova_virtlogd_wrapper e91667516afc 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 2 months ago nova_virtsecretd a4b07fe0e833 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 2 months ago nova_virtnodedevd d7e1db393e9c 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 2 months ago nova_virtstoraged 5308a171793e 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 2 months ago nova_virtqemud f490a6249ba1 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo kolla_start 2 months ago Up 6 weeks ago nova_virtproxyd ab0441e56957 172.25.201.68:8787/tripleomaster/openstack-nova-compute:current-tripleo kolla_start 2 months ago Up 2 months ago (healthy) nova_migration_target f35fbba5b690 172.25.201.68:8787/tripleomaster/openstack-nova-compute:current-tripleo kolla_start 2 months ago Up 6 weeks ago (unhealthy) nova_compute 82bc01993106 172.25.201.68:8787/tripleomaster/openstack-nova-libvirt:current-tripleo /usr/sbin/virtlog... 2 months ago Up 2 months ago Can someone please suggest how I can i edit an instance xml file in this setup? With regards, Swogat Pradhan

2 5

[Freezer] Is Freezer dead?
by pi3.14＠tuta.io 19 Mar '24

19 Mar '24

Hi folks, is Freezer still supported? I don't see any real development going on with it. Is it recommended to use in a production Cloud environment? Are there other free and open source alternatives to Freezer? Thanks Roby

8 19

[swift] Increase part power on account/container ring
by Thiago De Moraes Teixeira 13 Mar '24

13 Mar '24

Morning, Here we have a cluster with Accounts/Containers ring with part power 8 and our Objects ring with part power 20 (builted later). Now we want to migrate the 'old' Accounts/Containers ring to a new one, with higher part power, like 20. Is there a better way to do this? I'm doing some crazy tests with SAIO and multiples storage nodes, based in build a new ring with part power 20 and just swap the old files (account/container.ring.gz) with the new ones and let the replicators do their jobs, moving *.db files to their new home partition. Until today these tests worked fine, but I don't know how to do it on a large scale, with some terabytes of data. Just wondering about some ways to do that :) And before/after this change, is there any command in swift that i can audit this entire process, ensuring that cluster data remains the same? Thanks! -- _‘Esta mensagem é direcionada apenas para os endereços constantes no cabeçalho inicial. Se você não está listado nos endereços constantes no cabeçalho, pedimos-lhe que desconsidere completamente o conteúdo dessa mensagem e cuja cópia, encaminhamento e/ou execução das ações citadas estão imediatamente anuladas e proibidas’._ * **‘Apesar do Magazine Luiza tomar todas as precauções razoáveis para assegurar que nenhum vírus esteja presente nesse e-mail, a empresa não poderá aceitar a responsabilidade por quaisquer perdas ou danos causados por esse e-mail ou por seus anexos’.*

3 8

[cinder][glance][nova][telemetry][monasca][oslo][vmware] Can we deprecate(and remove) VMWare support ?
by Takashi Kajinami 07 Mar '24

07 Mar '24

Hi all, As you might know, some of the OpenStack projects currently support usage of VMWare component. However recently the VMware virt driver in nova was marked experimental in 2023.2 release [1] and it has been discussed that the driver will be removed in 2023.2 release[2], after deprecation is backported to 2023.1. (Please someone from nova team correct me if I'm wrong) So my current question is; Does it make sense to deprecate all of the features to support VMWare component ? My understanding is that these features were added to be used along with VMWare virt driver in nova, but once the virt driver is removed this use case is voided. I'll list up the features within the discussion scope below. nova: VMWare virt driver (this is already experimental by [1]) cinder: VMware Storage Driver (vmdk) glance: VMWare Datastore (I proposed deprecating this in [3][4]) ceilometer: VMWare virt driver (this was deprecated by [5]) os-brick: VmdkConnector monasca-agent: vcenter collector (*1) oslo.vmware: the whole project NOTE: These features are found based on dependency on oslo.vmware but there can be a few not listed here. Outside of OpenStack's governance, there are two projects dependent on oslo.vmware, networking-vsphere and vmware-nsx but both of these look inactive. Because of SLURP, we have to complete deprecation during in 2024.1 release so that we can drop the feature right after 2024.1. If we fail then we have to maintain these features until 2025.1 (the features already deprecated can be removed earlier, though). So I'd like to get feedback and decision before deadline for 2024.1 Thank you, Takashi (*1) Monasca is now inactive so I doubt anyone would work on this topic before it is retired. [1] https://review.opendev.org/c/openstack/nova/+/863911 [2] https://review.opendev.org/c/openstack/nova/+/897017 [3] https://review.opendev.org/c/openstack/glance_store/+/893696 [4] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [5] https://review.opendev.org/c/openstack/ceilometer/+/894540

6 21

[Watcher] How use Watcher to scheduler Openstack resource without cpu_usage
by Nguyễn Hữu Khôi 06 Mar '24

06 Mar '24

Hello guys. I want to use watcher to scheduler openstack resources but some openstack versions are missing cpu_usage metric. How do we use Watcher without it? Thank you. Nguyen Huu Khoi

3 5

[openstack][skyline] Some works with skyline
by Nguyễn Hữu Khôi 26 Feb '24

26 Feb '24

Hello guys. I am working on Skyline. I can integrate my monitor tab on it. I will try to do something about it. If it works properly, I can contribute. It is a very nice project. I hope it will grow and grow in the future. Thanks Skyline Team. [image: image.png] Nguyen Huu Khoi

3 7

[neutron][vpnaas][ovn] Pushing VPNaaS support through OVN
by Mohammed Naser 12 Feb '24

12 Feb '24

Hi all! One of the biggest show stoppers for us for OVN is VPNaaS but I think it’s time that we’d like to be involved in getting it over the line, I want to thank Bodo who has shown a lot of patience in getting the code necessary, and it seems that the code works for them in production as well. I’d like to ask if possible for folks to review these two outstanding changes: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/847007 https://review.opendev.org/c/openstack/neutron-vpnaas/+/765353 I know Slawek had some concerns, so hoping that raising via the email list if Bodo can address those and over the next bit of time we can get this landed in, since it even has actual proper testing both in CI and with user feedback. Thanks! Mohammed

6 8

about magnum capi for production
by Nguyễn Hữu Khôi 07 Feb '24

07 Feb '24

Hello guys. Could you share with me some experience about using Magnum CAPI in production? https://github.com/vexxhost/magnum-cluster-api Thank you so much. Nguyen Huu Khoi

6 44

[all] SQLAlchemy 2.x support in Bobcat
by Thomas Goirand 02 Feb '24

02 Feb '24

Hi, As you may know, and to my great frustration, I'm not the maintainer of SQLAlchemy in Debian, even though OpenStack is the biggest consumer of it. The current maintainer insists that he wants to upload SQLA 2.x in Unstable, potentially breaking all of OpenStack. At the present moment, if I understand correctly, we're not there yet, and Bobcat doesn't have such a support. It would be ok for me, *IF* there are patches available on master, that I could backport to Bobcat and maintain in the debian/patches folder of each project. However, the biggest current annoyance, is that I have no idea where we are at. Are we close to such a support? Is there a list of patches to apply on top of Bobcat that is maintained somewhere? Please enlighten me... :) Cheers, Thomas Goirand (zigo)

5 10

What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova
by Christian Rohmann 31 Jan '24

31 Jan '24

Hey openstack-discuss, I am a little confused about correct and required Ceph authx permissions for the RBD clients in Cinder, Glance and also Nova: When Glance is requested to delete an image it will check if this image has depended children, see https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. The children of Glance images usually are (Cinder) volumes, which therefore live in a different RBD pool "volumes". But if such children do exist a 500 error is thrown by Glance API. There also is an bug about this issue on Launchpad [3]. Manually using the RBD client shows the same error: > # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p > images children $IMAGE_ID > > 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 > librbd::image::OpenRequest: failed to retrieve name: (1) Operation not > permitted > 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: > 0x5639fdd5af60 failed to open image: (1) Operation not permitted > rbd: listing children failed: (1) Operation not permitted > 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: > list_descendants: failed to open descendant b7078ed7ace50d from pool > instances:(1) Operation not permitted So it's a permission error. Following either the documentation of Glance [1] or Ceph [2] on configuring the ceph auth caps there is no mention of granting anything towards the volume pool to Glance. So this is what I currently have configured: > client.cinder > key: REACTED > caps: [mgr] profile rbd pool=volumes, profile rbd-read-only > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=volumes, profile rbd-read-only > pool=images > > client.glance > key: REACTED > caps: [mgr] profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=images > > client.nova > key: REACTED > caps: [mgr] profile rbd pool=instances, profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=instances, profile rbd pool=images > When granting the glance client e.g. "rbd-read-only" to the volumes pool via: > > # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd > pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd > pool=images, profile rbd-read-only pool=volumes' > the error is gone. I am wondering through if this is really just a documentation bug (at OpenStack AND Ceph equally) and if Glance really needs read-only on the whole volumes pool or if there is some other capability that covers asking for child images. All in all I am simply wondering what the correct and least-privilege ceph auth caps for the RBD clients in Cinder, Glance and Nova would look like. Thanks Christian [1] https://docs.openstack.org/glance/latest/configuration/configuring.html#con… [2] https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-authen… [3] https://bugs.launchpad.net/glance/+bug/2045158

6 15

[murano][heat][mistral][tc] Maintenance of yaql library
by Takashi Kajinami 21 Jan '24

21 Jan '24

Hello, The yaql library is currently maintained under murano's governance and is used by not only murano but a few other projects such as heat and mistral. In heat the library is essential since we introduced yaql function support. Looking at gerrit groups, I noticed the yaql library is maintained by a very small core group[1] and release group[2], but I'm afraid most of the people in these groups are no longer active in the community. Because heat is dependent on the library, I'm wondering if some of the heat cores can be added to these two groups so that we (at least I) can help maintaining the library. I've checked the changes merged into murano repo for these two years but iiuc all of these changes are gate fix. Also a dummy change[3] indicates that its CI is currently broken. If the murano project is no longer active then I'm also willing to take over yaql and bring it to heat's governance (of cause only if it's acceptable). I'll add the current PTL as cc, but please let me know if anyone has any opinion or concern. # I'll add mistral tag because the project is also dependent on yaql. # Also tc is added because this discussion is related to project governance. Thank you Takashi Kajinami [1] https://review.opendev.org/admin/groups/cba4f6fd54c3cc0d5706fc50b5ebd758860… [2] https://review.opendev.org/admin/groups/d5e894b34e5ab5a9fc2938a0d4e7bc76fd2… [3] https://review.opendev.org/c/openstack/murano/+/901888

3 7

[heat] Propose retirement of heat-cfnclient
by Takashi Kajinami 17 Jan '24

17 Jan '24

Hello, In heat project, we have had the heat-cfnclient library which contains the client utilities to consume AWS-compatible APIs in heat. However this repository is not properly maintained and I doubt that anyone is using (or even can use) it with recent Heat. - The repository still contains the utility for CloudWatch API which was already removed from heat - The heat-cfn command relies on Keystone v2 instead of v3 - No release has been made since the repository was created Based on the current situation I'd propose retiring the repository. I'd appreciate any feedback and if I hear no objections then I'll start the official process to retire the repository. Thank you, Takashi

2 3

[nova][release][tooz] Hold your rechecks
by Sylvain Bauza 10 Jan '24

10 Jan '24

Hey folks, FWIW, our grenade check on SLURP upgrades is 100% failing now [1] due to a behavioural change in the tooz library [2] that's pulled by Cinder and which was released [3] and delivered to upper-contraints yesterday [4] There are different possibilities in order to unblock the gate, but until one of them is agreed and merged, please avoid wasting our CI resources by asking to recheck for something which will fail. Thanks, -Sylvain (who will send an email once the job is back up) [1] https://zuul.opendev.org/t/openstack/builds?job_name=grenade-skip-level-alw… [2] https://review.opendev.org/c/openstack/tooz/+/891355 [3] https://review.opendev.org/c/openstack/releases/+/899966 [4] https://review.opendev.org/c/openstack/requirements/+/901131

4 6

[designate] Proposal to deprecate the agent framework and agent based backends
by Michael Johnson 09 Jan '24

09 Jan '24

TLDR: The Designate team would like to deprecate the backend agent framework and the agent based backends due to lack of development and design issues with the current implementation. The following backends would be deprecated: Bind9 (Agent), Denominator, Microsoft DNS (Agent), Djbdns (Agent), Gdnsd (Agent), and Knot2 (Agent). Designate includes many backend DNS server drivers[1], many of which are "native" (also known as xfr type backends) backend implementations. In addition to the "native" backends, Designate has an agent backend[2] that supports other backends via an agent process. To quote the agent backend documentation[2]: This backend uses an extension[3] of the DNS protocol itself to send management requests to the remote agent processes, where the requests will be actioned. The rpc traffic between designate and the agent is both unauthenticated and unencrypted. Do not run this traffic over unsecured networks. Here are the reasons we are proposing to deprecate the agent framework now: 1. The agent protocol used by Designate is using an "unassigned"[4][5] DNS opcode (14) that is causing problems with the dnspython library >= 2.3.0 which is now validating the opcode when building DNS messages. It is a bad practice to use "unassigned" values as they may be officially assigned at any time, likely with an incompatible message format. 2. The agent backends are not tested in the OpenStack jobs[1]. 3. Many of the agent backends have been marked as "Experimental" since 2016 with no additional contributions beyond general repository code maintenance. 4. The protocol between the Designate worker process and the agent process is unauthenticated and unencrypted. 5. We do not know of a development resource to rewrite the agent framework protocol to address issue #1 and #4 above. 6. The introduction of catalog zones[6] may eliminate the need for some of the agent based backend drivers. By marking the agent framework and agent based backends "deprecated" in the Antelope cycle, we would remove the code no earlier than the "C" release of OpenStack (per the OpenStack deprecation policy[7]). In the meantime, issue #1 has been worked around by overriding the dnspython opcode validation[7] as needed in the Designate code (similar to a monkey patch). This is not a sustainable long term solution. The following backend agent based drivers would be marked "deprecated" in addition to the agent framework itself: Bind9 (Agent) Denominator Microsoft DNS (Agent) Djbdns (Agent) Gdnsd (Agent) Knot2 (Agent) We plan to propose patches for the deprecation over the next week, but will not merge them until at least January 24th to allow time for comment from the community. If you have concerns about this deprecation plan or are interested in rewriting the agent framework protocol to address the above issues, please reply to this announcement. Michael [1] https://docs.openstack.org/designate/latest/admin/support-matrix.html [2] https://docs.openstack.org/designate/latest/admin/backends/agent.html [3] https://github.com/openstack/designate/blob/master/designate/backend/privat… [4] https://www.rfc-editor.org/rfc/rfc6895.html#section-2.2 [5] https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-pa… [6] https://www.ietf.org/archive/id/draft-ietf-dnsop-dns-catalog-zones-08.txt [7] https://docs.openstack.org/project-team-guide/deprecation.html [8] https://review.opendev.org/c/openstack/designate/+/870678

3 13

[octavia][neutron] ask about LB with DVR
by Nguyễn Hữu Khôi 09 Jan '24

09 Jan '24

Hello guys. I see that more and more people use Octavia but it depends on network nodes which cause bottlenecks or single point of failure . I would like to know if we have some plan to make Octavia works without network nodes. Thank you. Nguyen Huu Khoi

2 4

LVM Cinder
by Jorge Visentini 08 Jan '24

08 Jan '24

Hi all! My scenario: We currently use oVirt and are studying the possibility of migrating to OpenStack in the future. Today we use Storages Enterprise 3PAR and Dell PowerVault. I've even tried to integrate 3PAR, but it's too complex for me for now... Stupid question... If I work directly with LVM, that is, deliver a LUN to all my hosts, create an LVM and deliver it to Cinter, will I have the Live Migration, HA instances, snapshot and other features ? Cheers! -- Att, Jorge Visentini +55 55 98432-9868

6 10

reset-state instances with Api in openstack
by Parsa Aminian 06 Jan '24

06 Jan '24

hello Is there any Api for reset-state instance status to active or error on openstack api ?

5 5

Issue when connecting to openstack object storage with openstacksdk
by sadir＠free.fr 05 Jan '24

05 Jan '24

Hello, I am currently developing a software application to access the OpenStack object store service on an IBM Spectrum Scale server. I first created a Python application which is manipulating objects and containers thru the OpenStack's object storage REST API (https://docs.openstack.org/api-ref/object-store) It works fine and I had no issue to access the server object store service by this way. But I also need to access the OpenStack object store service thru the openstacksdk (https://docs.openstack.org/openstacksdk/latest) Unfortunately, the connection does not seem to work properly in this case, even when using the same identifiers than in the working Python/REST application. The connection stalls and goes into some sort of timeout. I also made some tests by putting wrong identifiers, and then it fails immediately with a different error message. It makes me think that something goes wrong after the authentication process. The error message I have is this one: Failed to contact the endpoint at http://yeti.ds.eurecom.fr:8080/v1/AUTH_da0d8589692741d1b2a82956568227e6 for discovery. Fallback to using that endpoint as the base url. I am wondering if there is some additional configuration to perform on the server or the network to make it work as expected. Could you please provide me with some support so that I can sort out what's going on? I could of course share the Python piece of code I am using for my testing. Thank you for your help.

5 4

[TC][Monasca] Proposal to mark Monasca as an inactive project
by Sławek Kapłoński 05 Jan '24

05 Jan '24

Hi, I just proposed patch [1] to mark Monasca as inactive project. It was discussed during last TC meeting on 03.10.2023. Reasons for that are described in the commit message of the [1] but I will also put all of it here: previous cycle there wasn't almost any contributions to that project and most active contributors in last 180 days were Elod Illes and Dr. Jens Harbott who were fixing some Zuul configuration issues only. Here are detailed statistics about Monasca projects: Validating Gerrit... * There are 7 ready for review patches generated within 180 days * There are 2 not reviewed patches generated within 180 days * There are 5 merged patches generated within 180 days * Unreviewed patch rate for patches generated within 180 days is 28.0 % * Merged patch rate for patches generated within 180 days is 71.0 % * Here's top 10 owner for patches generated within 180 days (Name/Account_ID: Percentage): - Dr. Jens Harbott : 42.86% - Joel Capitao : 28.57% - Elod Illes : 28.57% Validate Zuul... Set buildsets fetch size to 500 * Repo: openstack/monasca-log-api gate job builds success rate: 82% * Repo: openstack/monasca-statsd gate job builds success rate: 95% * Repo: openstack/monasca-tempest-plugin gate job builds success rate: 81% * Repo: openstack/monasca-common gate job builds success rate: 84% * Repo: openstack/monasca-kibana-plugin gate job builds success rate: 83% * Repo: openstack/monasca-ceilometer gate job builds success rate: 100% * Repo: openstack/monasca-events-api gate job builds success rate: 83% * Repo: openstack/monasca-ui gate job builds success rate: 88% * Repo: openstack/monasca-specs gate job builds success rate: 100% * Repo: openstack/monasca-grafana-datasource gate job builds success rate: 100% * Repo: openstack/monasca-persister gate job builds success rate: 98% * Repo: openstack/monasca-notification gate job builds success rate: 93% * Repo: openstack/monasca-thresh gate job builds success rate: 100% * Repo: openstack/monasca-api gate job builds success rate: 76% * Repo: openstack/monasca-agent gate job builds success rate: 98% * Repo: openstack/python-monascaclient gate job builds success rate: 100% * Repo: openstack/monasca-transform gate job builds success rate: 100% What's next? According to the "Emerging and inactive projects" document [2] if there will be no volunteers who will step up and want to maintain this project before Milestone-2 of the 2024.1 cycle (week of Jan 08 2024) there will be no new release of Monasca in the 2024.1 cycle and TC will discuss if project should be retired. So if You are interested in keeping Monasca alive and active, please reach out to the TC to discuss that ASAP. Thx in advance. [1] https://review.opendev.org/c/openstack/governance/+/897520 [2] https://governance.openstack.org/tc/reference/emerging-technology-and-inact… -- Slawek Kaplonski Principal Software Engineer Red Hat

8 14

[magnum] magnum-capi management cluster controle plane in HA
by Satish Patel 04 Jan '24

04 Jan '24

Folks, In the lab I have deployed a magnum-capi driver with a single node kind cluster and it works great. Now I want to take it to production and make sure my capi management cluster runs on a HA environment of k8s and survives all kinds of failure. I have deployed 3 node k8s using kubespray and deployed CAPI applications on top of it using clusterctl init command but it default created a replica of 1/1 for all pods. How do I tell clusterctl to create a replica with 3 for HA and how does data replication work? How do I take backup/restore of data in k8s cluster using clusterctl for disaster recovery? I have checked official documents but it's a little confusing so I'm asking question here to clear my doubts. Cheers! ~S

3 6

ceilometer cli client install help
by garcetto 01 Jan '24

01 Jan '24

good afternoon, i have a running kolla-ansible openstack all-in-one cluster, so far so good (zed version based on ubuntu). i have installed ceilometer, and then i am trying to use this command to show metrics, but seems i cannot find the right command option, what am i missing? " (my-virt-env) marcello@mg-ostack-119:~$ openstack metric resource list openstack: 'metric resource list' is not an openstack command. See 'openstack --help'. Did you mean one of these? service create service delete service list service provider create service provider delete service provider list service provider set service provider show service set service show " thank you.

3 2

[kolla] ceilometer and nova compute agent
by garcetto 01 Jan '24

01 Jan '24

good morning, i would like to measure instances metrics but i cannot understand if i need to add this package on nova containers or the apt package is already installed (or do i need to create a custom nova container?) https://docs.openstack.org/ceilometer/latest/install/install-compute-ubuntu… thank you.

3 2

Trove installation filed
by Tamim Wasif 01 Jan '24

01 Jan '24

Hello openstack team I can not install openstack database service Trove. its some times showing this error "No valid host was found" "polling request timed out" "can not create volume for instance ..." what can be the solution? from Tamim Wasif Software Engineer Teton Private limited

3 2

[trove][victoria] can't connect to trove DB from outside - although ssh to the trove instance works
by ddorra＠t-online.de 31 Dec '23

31 Dec '23

Hello, I can't connect to to my trove mysql DB from an instance in a selfservice network. Strange thing is I CAN connect to the trove instance via ssh: ubuntu@dozbox2:~$ telnet 192.168.0.176 22 Trying 192.168.0.176... Connected to 192.168.0.176. Escape character is '^]'. SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.7 But I CANNOT reach the DB port from on the troave instance: ubuntu@box2:~$ telnet 192.168.0.176 3306 Trying 192.168.0.176... telnet: Unable to connect to remote host: No route to host Within the Trove instance I CAN work with the client... root@ms3:/var/log/trove# mysql -h 192.168.0.176 -u dbadmin -p -P 3306 Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 331 The security group for that trove instance allows ssh AND 3306 (see additional infos/rules below). Any help is really appreciated! ------- Additional Infos ------------------ root@voscontrol:~# openstack server show 534fe146-0d51-4848-98ed-95dc9aaf89b1 +-------------------------------------+------------------------------------------------------------------+ | Field | Value | +-------------------------------------+------------------------------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | nova | | OS-EXT-SRV-ATTR:host | voscompute2 | | OS-EXT-SRV-ATTR:hypervisor_hostname | voscompute2 | | OS-EXT-SRV-ATTR:instance_name | instance-000000d0 | | OS-EXT-STS:power_state | Running | | OS-EXT-STS:task_state | None | | OS-EXT-STS:vm_state | active | | OS-SRV-USG:launched_at | 2023-12-18T23:05:15.000000 | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | doznet=192.168.0.176; trovemgmt=10.10.10.134 | | config_drive | True | | created | 2023-12-18T23:04:59Z | | flavor | m1.large (72a7e41e-e0e9-48fe-abc2-8c64838e9e4a) | | hostId | 618af9a8f27a256f291621d611d30ae2186de8c2e8fa03e5a5ba2081 | | id | 534fe146-0d51-4848-98ed-95dc9aaf89b1 | | image | trove-guest-ubuntu-bionic (773aeec6-9caa-48a3-a80a-f9bf440b0d9e) | | key_name | trovekey | | name | ms3 | | progress | 0 | | project_id | d2e35c5479c441dc9ba4dba8e9b914bc | | properties | | | security_groups | name='trove_sg-27547af3-9bb0-4df5-b4ff-e85daa72c6ef' | | | name='default' | | status | ACTIVE | | updated | 2023-12-18T23:05:15Z | | user_id | a72e578837da479895fe4207107ca2fa | | volumes_attached | id='bff9037e-2831-473b-b6ae-8027ee4053dc' | +-------------------------------------+------------------------------------------------------------------+ root@voscontrol:~# openstack security group show trove_sg-27547af3-9bb0-4df5-b4ff-e85daa72c6ef +-----------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +-----------------+----------------------------------------------------------------------------------- | created_at | 2023-12-18T23:04:51Z | description | Security group for trove instance 27547af3-9bb0-4df5-b4ff-e85daa72c6ef | id | d73ff24a-5288-486b-b10b-fe9902f80e15 | name | trove_sg-27547af3-9bb0-4df5-b4ff-e85daa72c6ef | project_id | d2e35c5479c441dc9ba4dba8e9b914bc | revision_number | 3 | rules | created_at='2023-12-18T23:04:52Z', direction='ingress', ethertype='IPv4', id='0484ddff-c945-45d0-b271-7d30e7fbf619', port_range_max='3306', port_range_min='3306', protocol='tcp', remote_ip_prefix='0.0.0.0/0', updated_at='2023-12-18T23:04:52Z' | | | created_at='2023-12-18T23:04:51Z', direction='egress', ethertype='IPv6', id='27ed1225-984a-454e-86da-656de3669038', updated_at='2023-12-18T23:04:51Z' | | | created_at='2023-12-18T23:10:33Z', direction='ingress', ethertype='IPv4', id='c2c7c390-8b13-4b00-ab7c-0a8a7687ac08', port_range_max='22', port_range_min='22', protocol='tcp', remote_ip_prefix='0.0.0.0/0', updated_at='2023-12-18T23:10:33Z' | | | created_at='2023-12-18T23:04:51Z', direction='egress', ethertype='IPv4', id='d1fdc662-fc24-46bd-80db-3aca725f96aa', updated_at='2023-12-18T23:04:51Z' | | stateful | True | tags | [] | updated_at | 2023-12-18T23:10:33Z +---------------------------------------------------------------------------------------------+

4 8

[cinder] 2024.1 Caracal Midcycle-1 Summary
by Rajat Dhasmana 27 Dec '23

27 Dec '23

Hello Argonauts, Following is the summary of the 2024.1 Caracal Midcycle-1 held on Date: 6th December, 2023 Time: 1400-1600 UTC https://wiki.openstack.org/wiki/CinderCaracalMidCycleSummary Please go through the discussion points and action items assigned to you and let me know if any modification is required. Thanks Rajat Dhasmana

1 0

Could not find requested endpoint in Service Catalog - nova-compute empty
by vpa.vishnupa＠gmail.com 27 Dec '23

27 Dec '23

Hi all, I am working on a project to setup OpenStack HCI. I am following these documentation https://www.server-world.info/en/note?os=Ubuntu_22.04&p=openstack_yoga&f=15 along with https://docs.openstack.org/install-guide/ .. While configuring nova I am facing with this error "Could not find requested endpoint in Service Catalog." while listing openstack compute service list --service nova-compute. Can somebody help me. Why this error is happening - nova-compute empty. Thank you.

2 3

[Glance] Weekly meeting cancelled - 28th Dec
by Pranali Deore 27 Dec '23

27 Dec '23

Hello, Due to year end holidays, most of the team members are not around this week, so cancelling tomorrow's meeting. Next Glance meeting will be on January 4th !! Thanks, Pranali Deore

1 0

[kolla-ansible][magnum]
by Franck VEDEL 26 Dec '23

26 Dec '23

Hello everyone. Here's a problem I can't solve. In my test cluster (2 nodes, Ubuntu 2022.4, Cinder LVM, kolla-ansible Antelope, 2023.1) everything is fine. In a month, my students will be able to start from scratch and build an Openstack cluster with quite a few features in around twenty hours. The challenge is to guide them in building a cluster, ensuring that they seek to solve problems, without it being too difficult. So you have to guide them, start with virtual machines then move on to real servers. In the end, I wanted to test "magnum" because they know Kubernetes. I edit globals.yml, reconfigure, grab Fedorac-coreos (qcow2 file) and add the image to peek. In Horizon, I create a cluster template. everything is working. Then, with the admin account, I try to create a cluster from the model and there I have the problem Failed to create trustee XXX in domain XXX” Okay, I create the file /etc/kolla/config/magnum.conf with enable_cluster_user_trust = True I reconfigure but it doesn't work. I'm looking for other solutions but I can't find them. Should we give special rights to the admin user (for my example) on the magnum domain? Franck

3 7

openstack user_data inject in Api
by Parsa Aminian 26 Dec '23

26 Dec '23

hello how can I run shell script after vm creation on openstack with api ? I check nova api document and there is no thing about user_data api in nova documents

2 2

[openstack][neutron]Cannot schedule router to specified AZ
by Nguyễn Hữu Khôi 25 Dec '23

25 Dec '23

Hello. I am planning to separate network AZ looks like: 2 network nodes for AZ1 2 network nodes for AZ2 I can select AZ when creating a router from AZ hints but It wont work as I expect. Router should only schedule on my selected AZ. Could you correct me if I am wrong. Thank you. Nguyen Huu Khoi

1 1

[swift][osprofiler][telemetry] What is the current state of tracing for Swift?
by Matheus Victorello 23 Dec '23

23 Dec '23

Hello, There is no OSProfiler for Swift, right? Is someone developing it? Is there anything related to OpenTelemetry in the context of Swift? I need to know the entire path of a request, how much time is spent in each middleware, every call to external APIs made by middlewares, which proxy was used, and which storage nodes were utilized. The best I have so far is to instrument the parts that interest me with Jaeger, simply because we already use it for other services. -- _‘Esta mensagem é direcionada apenas para os endereços constantes no cabeçalho inicial. Se você não está listado nos endereços constantes no cabeçalho, pedimos-lhe que desconsidere completamente o conteúdo dessa mensagem e cuja cópia, encaminhamento e/ou execução das ações citadas estão imediatamente anuladas e proibidas’._ * **‘Apesar do Magazine Luiza tomar todas as precauções razoáveis para assegurar que nenhum vírus esteja presente nesse e-mail, a empresa não poderá aceitar a responsabilidade por quaisquer perdas ou danos causados por esse e-mail ou por seus anexos’.*

5 4

After a power outage - Cinder Scheduler reports Volume Service as down on only 1 node
by Abhijit Anand 23 Dec '23

23 Dec '23

Hi, Problem Statement: - “openstack volume service list” shows “volume service” down on 1 node. - Cinder scheduler logs show this. 2023-12-22 09:00:19.779 7 WARNING cinder.scheduler.host_manager [None req-40e35d10-9441-43c2-9647-6630cba21e1c - - - - - -] volume service is down. (host: compute2@rbd-1) - Why is the host_manager of Cinder-Scheduler showing “compute2” as down? Versions: - Openstack version 2023.1 Installed using kolla-ansible on ubuntu 22.04 - Ceph version 18.2.0 More info: - I’ve got a 3 node openstack deployment with one of them doubling up as both compute as well as controller node. - Backend storage for cinder volumes and backups is a 3 node Ceph cluster deployed using cephadm. - a power outage resulted in all nodes shutting down. - once back up, the “openstack volume service list” command shows that cinder-volume and cinder-backup services are down on “compute2”. Refer “Output #1” below. - I enabled “debug=True” on both the “good” i.e. compute1, as well as “bad” i.e. “compute2” nodes. I dont see any errors or issues in the cinder-volume and cinder-backup logs of either. Refer outputs #2 and #3 below. - I don’t see any errors related to compute2 in ceph or cephadm logs. - No config has been changed. The only “change” was the forced shutdown. - I’ve restarted the docker containers (cinder volume, cinder backup, cinder-scheduler on controller). I’ve even rebooted the controller and the “bad” node. - All containers come back as healthy - Please see output #4, it shows, what appear to be “All Good!” updates from the “bad” node. Then why is the scheduler considering this node as down? Outputs: #1: openstack volume service list abanand@Abhijits-MacBook-Air ~ % openstack volume service list +------------------+------------------+------+---------+-------+----------------------------+ | Binary | Host | Zone | Status | State | Updated At | +------------------+------------------+------+---------+-------+----------------------------+ | cinder-scheduler | controller | nova | enabled | up | 2023-12-22T03:44:22.000000 | | cinder-volume | compute1@rbd-1 | nova | enabled | up | 2023-12-22T03:44:21.000000 | | cinder-volume | compute2@rbd-1 | nova | enabled | down | 2023-12-22T03:42:04.000000 | | cinder-volume | controller@rbd-1 | nova | enabled | up | 2023-12-22T03:44:20.000000 | | cinder-backup | compute2 | nova | enabled | down | 2023-12-22T03:42:02.000000 | | cinder-backup | compute1 | nova | enabled | up | 2023-12-22T03:44:20.000000 | | cinder-backup | controller | nova | enabled | up | 2023-12-22T03:44:19.000000 | +------------------+------------------+------+---------+-------+——————————————+ #2: compute2 - “Bad” node logs after enabling debug=true 2023-12-22 09:25:28.041 23 DEBUG oslo_service.periodic_task [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] Running periodic task VolumeManager.publish_service_capabilities run_periodic_tasks /var/lib/kolla/venv/lib/python3.10/site-packages/oslo_service/periodic_task.py:210 2023-12-22 09:25:28.043 23 DEBUG cinder.volume.drivers.rbd [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] connecting to cinder@ceph (conf=/etc/ceph/ceph.conf, timeout=15). _do_conn /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/volume/drivers/rbd.py:597 2023-12-22 09:25:28.074 23 DEBUG cinder.volume.drivers.rbd [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] connecting to cinder@ceph (conf=/etc/ceph/ceph.conf, timeout=15). _do_conn /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/volume/drivers/rbd.py:597 2023-12-22 09:25:28.103 23 DEBUG cinder.manager [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] Notifying Schedulers of capabilities ... _publish_service_capabilities /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/manager.py:202 #3: compute1 - “Good” node logs after enabling debug=true 2023-12-22 09:25:28.041 23 DEBUG oslo_service.periodic_task [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] Running periodic task VolumeManager.publish_service_capabilities run_periodic_tasks /var/lib/kolla/venv/lib/python3.10/site-packages/oslo_service/periodic_task.py:210 2023-12-22 09:25:28.043 23 DEBUG cinder.volume.drivers.rbd [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] connecting to cinder@ceph (conf=/etc/ceph/ceph.conf, timeout=15). _do_conn /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/volume/drivers/rbd.py:597 2023-12-22 09:25:28.074 23 DEBUG cinder.volume.drivers.rbd [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] connecting to cinder@ceph (conf=/etc/ceph/ceph.conf, timeout=15). _do_conn /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/volume/drivers/rbd.py:597 2023-12-22 09:25:28.103 23 DEBUG cinder.manager [None req-8388d960-ae3a-46d3-838a-24c112929683 - - - - - -] Notifying Schedulers of capabilities ... _publish_service_capabilities /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/manager.py:202 #4: Output from Cinder Scheduler logs 2023-12-22 09:35:18.861 7 DEBUG cinder.scheduler.host_manager [None req-09c91b17-3861-4c95-b85e-e4d39c17923c - - - - - -] Received backup service update from compute2: {'backend_state': True, 'driver_name': 'cinder.backup.drivers.ceph.CephBackupDriver', 'availability_zone': 'nova'} update_service_capabilities /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/scheduler/host_manager.py:597 2023-12-22 09:35:29.659 7 DEBUG cinder.scheduler.host_manager [None req-ba4bd917-52a8-4b02-92a3-5f989c5d70ae - - - - - -] Received volume service update from compute2@rbd-1: {'vendor_name': 'Open Source', 'driver_version': '1.3.0', 'storage_protocol': 'ceph', 'total_capacity_gb': 14649.52, 'free_capacity_gb': 14216.63, 'reserved_percentage': 0, 'multiattach': True, 'thin_provisioning_support': True, 'max_over_subscription_ratio': '20.0', 'location_info': 'ceph:/etc/ceph/ceph.conf:d524a89e-60eb-11ee-a0c3-7db08f4d9091:cinder:volumes', 'backend_state': 'up', 'qos_support': True, 'volume_backend_name': 'rbd-1', 'replication_enabled': False, 'allocated_capacity_gb': 1031, 'filter_function': None, 'goodness_function': None} update_service_capabilities /var/lib/kolla/venv/lib/python3.10/site-packages/cinder/scheduler/host_manager.py:628

3 4

[all] Posting results from generative "AI" (LLM) queries
by Jeremy Stanley 22 Dec '23

22 Dec '23

I'm refraining from calling out any particular participant on this (for now), but we've gotten a lot of recent and very enthusiastic answers to people's questions which look very much like the results of blindly pasting them into an LLM (e.g. ChatGPT) and then passing the response off as the sender's own experience. This quickly falls apart when there are multiple open source projects with the same name and the LLM gives a response about the "wrong" project with that name, revealing that the person posting it really doesn't even know the difference between them. Users post their questions to this list because they've exhausted other avenues and are hoping to hear responses derived from (human) subscribers' own personal/professional experiences. If you've legitimately run the software and actually know what the question means, then please do answer. But if users wanted to see the results of pasting their question into ChatGPT then they'd just do that (and likely already have). I don't want to institute "AI" oriented policies for this list like other forums have been forced to in recent months, so please (everyone!) just make it clear when the information you're posting is the result of consulting another source, and state what source it came from. Thanks! -- Jeremy Stanley

1 0

Re: [swift][osprofiler][telemetry] What is the current state of tracing for Swift?
by Matheus Victorello 22 Dec '23

22 Dec '23

While reading your response, I realized that my question was a bit unclear. I was referring to OpenStack Object Storage 'Swift', which is why I asked about OSProfiler. I mention this because it got confusing since I mentioned OpenTelemetry. I came across the association between OpenTelemetry and the Swift programming language while researching and ended up including that in my question. Just to clarify, I want to do tracing of OpenStack Swift. Sorry for the confusion. -- _‘Esta mensagem é direcionada apenas para os endereços constantes no cabeçalho inicial. Se você não está listado nos endereços constantes no cabeçalho, pedimos-lhe que desconsidere completamente o conteúdo dessa mensagem e cuja cópia, encaminhamento e/ou execução das ações citadas estão imediatamente anuladas e proibidas’._ * **‘Apesar do Magazine Luiza tomar todas as precauções razoáveis para assegurar que nenhum vírus esteja presente nesse e-mail, a empresa não poderá aceitar a responsabilidade por quaisquer perdas ou danos causados por esse e-mail ou por seus anexos’.*

1 0

[openstack][kolla-ansible] kolla-ansible stucked when reconfigure
by Nguyễn Hữu Khôi 22 Dec '23

22 Dec '23

Hello guys. I am operating an openstack cluster with kolla but sometimes I cannot reconfigure. It stucked at some hosts(gather fact) and I need to restart docker service on the stucked host to continue. I tried to google but I cannot find the root cause. Would you share some experiences on it because my solution causes instances on host to timeout some seconds. Thank you. Nguyen Huu Khoi

2 7

Devstack, Cinder, Nova versus memcached
by Pete Zaitcev 21 Dec '23

21 Dec '23

Hello: We all know how Cinder and Nova use memcached to save Keystone tokens (technically, authtoken middleware does it for them). That is expected. However, devstack leaves a config for Cinder that looks like this: [nova] region_name = RegionOne memcached_servers = localhost:11211 Does anyone remember how that is used? I looked at Cinder and python-novaclient, and neither use memcached for anything there. Thanks in advance, -- Pete

3 8

[neutron] Next week CI meeting is cancelled
by Yatin Karel 21 Dec '23

21 Dec '23

Hello Neutron Team !! With the holiday season, next week's CI meeting is cancelled. Wish you happy holidays. Next CI meeting will be now on 02nd January, 2024. -- Thanks and Regards Yatin Karel

1 0

[kolla-ansible][zun] Intention to drop support for Zun for the 2023.1 and path forward
by Jan Gutter 21 Dec '23

21 Dec '23

Hi folks, In yesterday's Kolla IRC meeting we discussed the path forward for Zun [1] and came to the conclusion that it might be better for all involved to drop support for Zun for the 2023.1 release until it can be updated to support the necessary dependencies. More specific details at the end of the message. With this in mind, the plan is to start this process in a week from now, unless a better solution is presented. There is still some time for discussion, please don't hesitate! There are two paths forward after this: If Zun can be updated to support the dependencies during the maintenance timeframe of 2023.1, then support would be restored. If no support is available at the time Caracal releases, however, it will be considered for removal in kolla and kolla-ansible. What this means: Kolla-ansible operators currently running Zun should hold off migration to 2023.1. Any development help would of course be appreciated. Please coordinate with the Zun project to help with development. Details on the dependency problems: * Currently, Zun has an external dependency on Docker 20.x, and uses a feature that has been removed in later versions of Docker. * This Docker feature also relies on an older version of etcd (3.3) * The mitigation [2] is to pin to the old versions of Docker and etcd, but this is not possible with Debian Bookworm hosts. Why this is a problem in Kolla-ansible (and Kolla): * This can't easily be solved by vendoring in an older version of etcd: the migration path it introduces to operators would incur a significant amount of risk. * Host level involvement is also particularly painful, the host version of Docker needs to connect to the etcd service running in the containers. * Even though the containers can be kept buildable and the configuration and inventory settings could be maintained, a working setup is not testable in CI. Thanks very much for everyone's patience, contributions and time! [1]: https://meetings.opendev.org/meetings/kolla/2023/kolla.2023-09-13-13.00.log… [2]: https://bugs.launchpad.net/zun/+bug/2007142

2 2

[neutron] Neutron drivers meeting cancelled
by Rodolfo Alonso Hernandez 21 Dec '23

21 Dec '23

Hello Neutrinos: Due to the lack of agenda [1], tomorrow's meeting is cancelled. Have a nice weekend and happy holidays. [1]https://wiki.openstack.org/wiki/Meetings/NeutronDrivers

1 0

[nova] Next two weekly meetings CANCELLED
by Sylvain Bauza 21 Dec '23

21 Dec '23

That's it. See you back on Jan 9th :)

1 0

[Glance] Cancelling Today's Weekly Meeting
by Pranali Deore 21 Dec '23

21 Dec '23

Hello, Since most of the team members are not around and there is nothing much on agenda too, cancelling today's (21st Dec) weekly meeting. Thanks & Regards, Pranali Deore

1 0

Reg Openstack deployment
by Rohit Sansiya 21 Dec '23

21 Dec '23

Dear Sir, please help me ! I have a single compute node and i have to configure nova and neutron on that single compute node only. how to do this kindly help me sir. Thanks Your message is ready to be sent with the following file or link attachments: Rohit Sansiya https://sites.google.com/view/rpgcloud/research-india Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.

2 1

[i18n][infra] Future of translate.openstack.org
by Tony Breeds 21 Dec '23

21 Dec '23

Hello all, The infra team is in the process of replacing older bionic servers with jammy based ones. We're nearing the end of that process and one of the remaining servers is translate.openstack.org. This server is primarily running zanata, which if I understand correctly, is no longer in use by the i18n team. I understand that there is a new platform that requies some tooling, if a dedicated server is needed for that we can spin up a newer jammy based server. So can we just retire this translate.openstack.org? Yours Tony.

3 3

[all][tc][ptls] Eventlet: Python 3.12, and other concerning discoveries
by Jay Faulkner 20 Dec '23

20 Dec '23

Hi all, For those who aren't aware, eventlet (https://github.com/eventlet/eventlet) is a library that almost every OpenStack project depends on and uses heavily. It's the primary method in most OpenStack project for achieving any form of parallelism via greenthreading. A couple of weeks ago it was brought to my attention, in the #openstack-tc IRC channel, that the eventlet library was broken on python 3.12 due to changes to the SSL stdlib in python 3.12. I enlisted a G-Research Open Source Software (GR-OSS) developer from outside the OpenStack community, Itamar, to help dig into what would be required to get python 3.12 support for eventlet, and asked him to do an overall health check on the project. The results were extremely concerning, and are why I'm emailing the list today. First of all, the original concern -- python 3.12 support -- is being worked on right now; there is a PR up to migrate the SSL module here https://github.com/eventlet/eventlet/pull/817 and a PR up here: https://github.com/eventlet/eventlet/pull/820 to begin migrating from nose3, a deprecated testing framework used by eventlet which does not support python 3.12. It's worth noting that in the past (2020) https://github.com/eventlet/eventlet/issues/638 there was resistance to removing nose for testing due to at-the-time-desired python2.7 support. Even if they are able to be merged, these PRs only scratch the surface of the total effort needed to get eventlet working on python 3.12. Furthermore, activity on the eventlet project is extremely slim right now. There have been no commits to the primary branch in nearly eight months and it's been a single maintainer project for an extremely long time. There are also indications there may be external factors impacting the maintainers' availability. This lack of redundancy on a core library that we have no clear migration path off of is concerning as well. As a large community that uses eventlet; I hope we can improve it. Now we get to the cherry on top -- code quality and existing bugs. When Itamar began evaluating the overall state of the project, he found that approximately 80% of the unit tests were passing. Some of the failing unit tests were valid failures. In fact, one of the failure cases -- around locks not being properly greened on upgrade -- explains an Ironic database migrations unit test failure which we spent several weeks off-and-on debugging last cycle. Along these lines; although eventlet has CI configured; those tests have never passed: https://github.com/eventlet/eventlet/actions/workflows/test.yaml?query=is%3… . I don't have a specific proposal for a solution. I do know that right now, OpenStack services are built "all-in" on eventlet, with no obvious or easy migration path off. At least in the short term, keeping eventlet running well is critical to keeping OpenStack running well. I'm sending this email to raise an alarm about this situation, and to hope that community members can work together to solve the problem. Thanks for reading and your help, Jay Faulkner OpenStack TC Chair

8 15

[all] Python 3.12 issues and classes of bugs, helping me fixing them all...
by Thomas Goirand 20 Dec '23

20 Dec '23

Hi there! Since a few days, we have Python 3.12 as available interpreter version in Debian Unstable. All Debian packages were rebuilt by Lucas Neusbaumm, and about 60 Debian RC bugs were filled against the OpenStack related packages. You may have seen it in some of your projects, I was able to fix lots of bugs (so far: 28 bugs fixed since Wednesday morning, and counting...), and forwarded them to upstream OpenStack whenever possible: https://review.opendev.org/c/openstack/os-ken/+/903521 https://review.opendev.org/c/openstack/sahara-plugin-spark/+/903656 https://review.opendev.org/c/openstack/keystonemiddleware/+/903640 https://review.opendev.org/c/openstack/os-ken/+/903521 https://review.opendev.org/c/openstack/sahara-plugin-spark/+/903656 https://review.opendev.org/c/openstack/keystonemiddleware/+/903640 I'd appreciate reviews and merge for these, of course... Many reported issues were problems in a single package (like Eventlet, or taskflow not able to load asyncore), so some bugs were closed without any further action but an attempt of rebuilding the said package to check everything is as expected. However, for a lot of bugs, I do not know how to fix, which leads me to this message. Of course, mostly the hardest bugs are remaining now, as I fixes the most easy ones. Here's a few examples. In Barbican: https://bugs.debian.org/1058183 What is this "KeyError: slice(0, -1, None)" about? Many packages have the same issue (like networking-sfc, neutron-dynamic-routing, neutron-vpnaas, manila, rally and many others), so if I understand this class of bug, I'll be able to fix them all. Help would be very much appreciated on that one. In openstackclient: https://bugs.debian.org/1058097 The stackdump is: File "<frozen importlib._bootstrap>", line 1360, in _find_and_load File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 935, in _load_unlocked File "<frozen importlib._bootstrap>", line 1176, in exec_module File "<frozen codecs>", line 58, in <module> AttributeError: module 'sys' has no attribute 'byteorder' I don't really understand what's going on, but this smells like an issue in Python 3.12 itself. watcher: https://bugs.debian.org/1058377 looks like the interpreter segfauls when importing some modules in watcher.tests.api ?!? Mistral: https://bugs.debian.org/1058182 Manila: https://bugs.debian.org/1058182 AssertionError: Failed to wait for expected result: Execution f2a97f87-7b08-4171-819a-47e30a0a1840 must have reached state SUCCESS state but it is in RUNNING What's going on here? diskimage-builder: I was able to fix the "ModuleNotFoundError: No module named 'imp'" (that's trivial to fix, really...), but now I get: File "/usr/lib/python3/dist-packages/mock/mock.py", line 1245, in _importer thing = __import__(import_path) ^^^^^^^^^^^^^^^^^^^^^^^ ModuleNotFoundError: No module named 'growvols' looks like what I attempted to fix with rewriting a load_source (which is removed from Python 3.12) didn't work. python-pykmip: https://bugs.debian.org/1058411 That one feels tricky. wrap_socket is gone from the standard ssl module, though the example given in here: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket is to use something like this: with context.wrap_socket(sock, server_hostname=hostname) as ssock: but that wont work with the way pykmip is written. So probably it needs some kind of rewrite? Looks like there's some commits upstream to address it, but no new release, unfortunately. I probably should attempt packaging the last Git commit. oslotest: https://bugs.debian.org/1058373 The broken test case attemps to disable the 'sys' module, but it looks like its failing to do so. Is there a change of behavior in the interpreter? wsgi-intercept: https://bugs.debian.org/1058378 TypeError: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file' No idea how to fix that one... :/ There's more which I probably didn't classify above. The full list of bugs is here: https://bugs.debian.org/cgi-bin/pkgreport.cgi?which=maint&data=team%2Bopens… Please ignore the first 5 though, which I don't really maintain and don't really care about (these aren't Py 3.12 issues). Many thanks to anyone that will help. Cheers, Thomas Goirand (zigo)

4 3

[Senlin][tc][all] Senlin project marked inactive by TC
by Jay Faulkner 20 Dec '23

20 Dec '23

OpenStack Community, The Technical Committee marked the Senlin project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on Senlin, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support Senlin to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902626 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[ec2-api][tc][all] ec2-api project marked inactive by TC
by Jay Faulkner 20 Dec '23

20 Dec '23

OpenStack Community, The Technical Committee marked the ec2-api project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on ec2-api, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support ec2-api to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902625 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

beginning with [masakari]
by Shubham Kumar Yadav 20 Dec '23

20 Dec '23

Hi, i have recently started working on Masakari (kubernetes in openstack) so i wanted some help with it please i was trying to test the masakari-instance_monitor & masakari-host-monitor but having trouble with it. i have created a pacemaker remote cluster (with pacemaker & corosync on controller nodes and pacemaker remote on compute node. *pcs statusCluster name: lab-clusterCluster Summary: * Stack: corosync * Current DC: lab-11053-26006-ceph-2 (version 2.1.2-ada5c3b36e2) - partition with quorum * Last updated: Thu Dec 14 08:41:41 2023 * Last change: Thu Dec 14 08:41:22 2023 by root via cibadmin on lab-11053-26006-ceph-1 * 6 nodes configured * 3 resource instances configuredNode List: * Online: [ lab-11053-26006-ceph-1 lab-11053-26006-ceph-2 lab-11053-26006-ceph-3 ] * RemoteOnline: [ lab-11053-26006-comp-1.cluster.local lab-11053-26006-comp-2.cluster.local lab-11053-26006-comp-3.cluster.local ]Full List of Resources: * lab-11053-26006-comp-1.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-1 * lab-11053-26006-comp-2.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-2 * lab-11053-26006-comp-3.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-3Daemon Status: corosync: active/enabled pacemaker: active/enabled pcsd: active/enabled* i have also created segment and added hosts(computes) in it. when i tried to test the masakari host monitor by manually powering off the compute node, masakari should move the vms from powered off computes to some running compute but after the compute is powered off vms still remains on the powered off compute. Am i missing some conf? is there any need to add some conf in nova and keystone too? in masakari engine logs i see host_failure.evacuate_all_instances = True instance_failure.process_all_instances = False host_failure.add_reserved_host_to_aggregate = False host_failure.ha_enabled_instance_metadata_key = HA_Enabled log_opt_values host_failure.ignore_instances_in_error_state = False host_failure.service_disable_reason = Masakari detected host failed. do you have any suggestion please let me know! Thank You

2 1

[oslo] Nominating tobias-urdin for etcd3gw core
by Takashi Kajinami 20 Dec '23

20 Dec '23

Hi team, I raised this topic in #openstack-oslo today and already got a few acks, but I'm sending this email here for an official proposal as well as record. The etcd3gw library is now extensively used by tooz as the primary implementation for etcd3 backend. Because Tobias is already a core reviewer in the tooz library, I propose adding him to the etcd3gw core as well. Please let me know in case anyone has any thoughts on the proposal. I'll add him to the group next week if we hear no objections. Thank you Takashi Kajinami

2 2

[cinder] Canceling next week's meeting (27th December)
by Rajat Dhasmana 20 Dec '23

20 Dec '23

Hello Argonauts, Since most of the team members will be on year end break, we have decided to cancel next week's cinder meeting that was going to be held on 27th December, 2023. A merry christmas and a happy new year to the team. See you all next year! Thanks Rajat Dhasmana

1 0

Reg the issue
by Rohit Sansiya 20 Dec '23

20 Dec '23

Sir, I want help regarding openstack project creation. While creating the project by using openstack project create then stuck the process and got the error regarding fail to discover available identity versions when contacting the url(http://controller11:5000/v3) & gateway timeout 504 kindly help. Your message is ready to be sent with the following file or link attachments: Rohit Sansiya https://sites.google.com/view/rpgcloud/research-india Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.

1 0

Re: about magnum capi for production
by Oliver Weinmann 20 Dec '23

20 Dec '23

4 7

[tc] OpenInfra Foundation Bylaws & TC Charter Changes
by Jay Faulkner 19 Dec '23

19 Dec '23

Hi all, I wanted to inform you we have two TC resolutions up for vote related to recent OpenInfra Foundation bylaws changes. First, https://review.opendev.org/c/openstack/governance/+/903239 is a resolution by the Technical Committee approving the OpenInfra Foundation bylaws changes. Secondly, https://review.opendev.org/c/openstack/governance/+/903236 is an update to the Technical Committee charter required as part of the bylaws changes. This is part of a joint effort between the OpenInfra Foundation and the OpenStack Technical Committee to remove language from the foundation bylaws treating OpenStack differently from other OpenInfra projects. Please take notice! Thanks, Jay Faulkner OpenStack TC Chair

1 0

[neutron] DevStack support for OVN BGP Agent
by Luis Tomas Bolivar 19 Dec '23

19 Dec '23

Hey folks, This is just a heads up we worked on a DevStack plugin for the OVN BGP agent [1], so that it is easier to deploy and test locally, with limited functionality. I also posted about how to use it [2] [1] https://review.opendev.org/c/openstack/ovn-bgp-agent/+/814185 [2] https://ltomasbo.wordpress.com/2023/12/19/deploying-ovn-bgp-agent-with-devs… Best regards, Luis -- LUIS TOMÁS BOLÍVAR Principal Software Engineer Red Hat Madrid, Spain ltomasbo(a)redhat.com

2 1

octavia lb operating status is always offline
by zhengrui20220 19 Dec '23

19 Dec '23

[octavia] hello，i am zhengrui，I have a problem with octavia deployment, my lb can work normally, but 'openstack loadbalancer list' command shows lb's operating status is offline, and my health manager log show 'Exception: 'NoneType' object has no attribute 'encode', then I add 'heartbeat_key = 20e8350e-950f-40fb-bb36-b9259e355523' in octavia.conf ,it shows 2023-12-19 10:38:59.701 1013848 WARNING octavia.amphorae.backends.health_daemon.status_message [-] calculated hmac(hex=True): 37623763633366666565616639383462373865343661616235616431623533363866306638336638653937656262333538303732346339656364623932623339 not equal to msg hmac: 61303433633739663136306366633465363234653535396663373230616636306134623036333339353363353736616339656133616538653961643762383763 dropping packet Now, I have no idea about this problem. | | zhengrui20220 | | zhengrui20220(a)163.com |

3 2

[publiccloud-sig] Skipping meeting next week - next meeting will be January 10th
by Felix Kronlage-Dammers 19 Dec '23

19 Dec '23

Hi everyone, like most (all? ;) of the other teams: Due to the holidays the publiccloud-sig will not meet next week - instead the next meeting will be on January 10th - then as always at 0800 UTC. Enjoy the holidays! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[barbican] Meetings scheduling
by Grzegorz Grasza 19 Dec '23

19 Dec '23

Hi all, As proposed in our last meeting [1], the new meeting time will move to Mondays @ 15:00 UTC. The next meeting is scheduled for Jan 8th 2024. [2] Enjoy the holiday season and I'll see y'all next year! / Greg [1] https://meetings.opendev.org/meetings/barbican/2023/barbican.2023-12-19-12.… [2] https://review.opendev.org/c/opendev/irc-meetings/+/903976

1 0

[kolla] Cancelling weekly meetings until 10th January 2024
by Michał Nasiadka 19 Dec '23

19 Dec '23

Hello Koalas, Since we’re approaching festive season and most of the meeting participants are going to be off - I’m cancelling couple of next weekly meetings. Let’s meet again on 10th of January 2024. Michal

1 0

[zaqar][tc] master and 2023.2 unit tests are broken
by Takashi Kajinami 19 Dec '23

19 Dec '23

Hello, Today I happened to notice that unit tests in zaqar is broken because some tests requires base test class from oslo.db which was removed in 13.0.0 release[1]. The 13.0.0 release of oslo.db was made during 2023.2 cucle so these tests are also broken in stable/2023.2 branch. In addition, py311 job was made voting in master but is broken and we probably need to fix bindep.txt so that it works in Debian 12. I'm sending this mail so that people maintaining the project is aware of the situation. I'll add [tc] tag because if the CI is not fixed then zaqar may become a new candidate for inactive projects. Thank you, Takashi [1] https://review.opendev.org/c/openstack/oslo.db/+/874239

2 1

[tc] Weekly Meeting tomorrow, Dec 19 at 1800 UTC
by Jay Faulkner 18 Dec '23

18 Dec '23

Hi all, The weekly meeting of the OpenStack Technical Committee is scheduled for tomorrow, December 19, at 1800 UTC in #openstack-tc on OFTC. As a reminder, this will be our last meeting of 2023. Our next scheduled meeting after this will be January 7, 2024. The proposed agenda is: - Roll call - Follow up on tracked action items: https://meetings.opendev.org/meetings/tc/2023/tc.2023-12-12-18.00.html - Spotz - (due Jan 7 2024) Look into updating https://docs.openstack.org/install-guide/openstack-services.html and report back to TC Create TC resolution expressing approval for OIF bylaws change - Gate health check - Leaderless projects (gmann) - Implementation of Unmaintained branch statuses - 2024.1 TC Tracker - https://etherpad.opendev.org/p/tc-2024.1-tracker - Open Discussion and Reviews Thanks, Jay Faulkner OpenStack TC Chair

1 0

[Kolla-ansible] Upgrading from Yoga to Zed HCI deployment
by wodel youchi 18 Dec '23

18 Dec '23

Hi, I need to upgrade my Openstack deployment from Yoga (Rocky Linux 8) to Zed (Rocky Linux 9). My deployment is an HCI deployment with ceph pacific deployed using ceph-ansible. it contains : - 03 controllers that contain also ceph mgr/mon/rgw/cephfs containers - 27 compute/storage nodes I am planning to follow these steps : 1. Upgrade to Rocky 9, starting with the controllers, then the compute/storage nodes. 1. Undeploy 1 controller at a time, upgrade to Rocky 9, re-deploy the controller. 2. Undeploy 3 compute/storage nodes at a time, upgrade to Rocky 9, redeploy the nodes. 2. Stop the Openstack platform 3. Convert the deployed ceph pacific from ceph-ansible to cephadm. 4. Upgrade from Yoga to ZED If you can help me with some insights/thoughts things to do / to avoid, so that the upgrade will move smoothly, that would be great. Regards.

5 5

[neutron] Bug Deputy Report December 11 - December 17
by Yatin Karel 18 Dec '23

18 Dec '23

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2046457 ovn provider fails with "AttributeError: 'Client' object has no attribute 'ports'" Antelope impacted with a recent patch Unassigned Low ---------- - https://bugs.launchpad.net/neutron/+bug/2046392 Service Type Framework cannot handle router flavor provider entry point shortcut with stevedore Assigned to Miguel Lavalle Undecided -------------- - https://bugs.launchpad.net/neutron/+bug/2046510 neutron-servers have high memory usage Report against stable/rocky, requested more information. -- Thanks and Regards Yatin Karel

1 0

[neutron] Cannot reach external network from within VM
by Michael J Turek 18 Dec '23

18 Dec '23

Hey all, We’ve been trying to get our Bobcat openstack cloud working and have been stuck on some networking woes. It’s a flat provider network with one compute node and one controller (plan to expand after this is resolved). 1) We can SSH and ping the VMs but only if we are on the controller and behind the qdhcp network namespace. 2) Once on the VM, we cannot reach the external network. We followed this installation guide [0] and nothing stands out as misconfigured. If anyone can offer some advice on how to debug this, it would be greatly appreciated. [0] https://docs.openstack.org/neutron/latest/install/controller-install-option…

4 6

Re: openstack-discuss Digest, Vol 62, Issue 59
by Kerem Çeliker 17 Dec '23

17 Dec '23

1 0

[release] Release countdown for week R-15, Dec 18-22
by Elõd Illés 15 Dec '23

15 Dec '23

Development Focus ----------------- The Caracal-2 milestone will happen in next month, on January 11th, 2024. 2024.1 Caracal-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/caracal/schedule.html for details. General Information ------------------- Please remember that libraries need to be released at least once per milestone period. At milestone 2, the release team will propose releases for any library that has not been otherwise released since milestone 1. Other non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. At milestone-2 we also freeze the contents of the final release. If you have a new deliverable that should be included in the final release, you should make sure it has a deliverable file in: https://opendev.org/openstack/releases/src/branch/master/deliverables/carac… You should request a beta release (or intermediary release) for those new deliverables by milestone-2. We understand some may not be quite ready for a full release yet, but if you have something minimally viable to get released it would be good to do a 0.x release to exercise the release tooling for your deliverables. See the MembershipFreeze description for more details: https://releases.openstack.org/caracal/schedule.html#c-mf Finally, now may be a good time for teams to check on any stable releases that need to be done for your deliverables. If you have bugfixes that have been backported, but no stable release getting those. If you are unsure what is out there committed but not released, in the openstack/releases repo, running the command "tools/list_stable_unreleased_changes.sh <cycle_name>" gives a nice report. Upcoming Deadlines & Dates -------------------------- Caracal-2 Milestone: January 11th, 2024 Előd Illés irc: elodilles @ #openstack-release

1 0

[cinder] Festival of XS reviews (15 Dec)
by Rajat Dhasmana 15 Dec '23

15 Dec '23

Hello Argonauts, We will be having our monthly festival of reviews this Friday i.e. 15th December (Friday) from 1400-1600 UTC. Following are the details: Date: 15th December, 2023 Time: 1400-1600 UTC Meeting link: https://meet.google.com/jqg-eigw-rku etherpad: https://etherpad.opendev.org/p/cinder-festival-of-reviews Thanks Rajat Dhasmana

1 1

[neutron] Meetings next few weeks
by Brian Haley 15 Dec '23

15 Dec '23

Hello Neutrinos: With company Holiday shutdowns over the next couple of weeks, just wanted to make sure everyone was aware of our meetings during that time, and of my availability. 12/19: Neutron meeting, chaired by Rodolfo 12/22: Neutron Drivers meeting, if necessary, chaired by Rodolfo 12/26: Neutron meeting cancelled 12/29: Neutron Drivers meeting cancelled 1/2: Neutron meeting, chaired by Rodolfo 1/5: Neutron Drivers meeting, if necessary, chaired by Rodolfo Thanks Rodolfo for doing this while I'm out! I am out the next three weeks, but will occasionally check-in to make sure nothing is on fire :) The first week of 2024 I will not be available at all, please ping other core reviewers in the #openstack-neutron channel with any questions. Thanks, and have a nice holiday break! -Brian, Neutron PTL

1 0

[neutron] Drivers meeting cancelled tomorrow
by Brian Haley 15 Dec '23

15 Dec '23

Hello Neutrinos: Due to the lack of agenda, Friday's drivers meeting is cancelled. Have a nice weekend! -Brian

1 0

[solum][tc][all] Solum project marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the solum project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on solum, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support solum to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902624 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[freezer][tc][all] Freezer marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the freezer project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on freezer, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support freezer to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902623 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[Thank You] OpenInfra Live: Large Scale Ops Deep Dive: Samsung SDS
by Kristin Barrientos 14 Dec '23

14 Dec '23

Hi everyone, Thanks for watching the latest Large Scale Ops Deep Dive episode with Dan Paik from Samsung, SDS. What a great way to wrap up OpenInfra Live for the year. In case you missed the episode, you can find it here: https://www.youtube.com/watch?v=RI9SwY8VdCY&t=1s Do you want to be on OpenInfra Live in 2024? Email me your pitch or fill out the form on ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>[1], and maybe we’ll see you on a future show! Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation [1] https://openinfrafoundation.formstack.com/forms/openinfralive

1 0

[blazar] Next IRC meeting cancelled
by Pierre Riteau 14 Dec '23

14 Dec '23

Hello, The next IRC meeting scheduled for December 28 is cancelled. We will meet again on January 11. I wish everyone a very happy holiday! Pierre Riteau (priteau)

1 0

[ironic] Why do we support RAID level 2?
by Dmitry Tantsur 14 Dec '23

14 Dec '23

Hi folks, I was going through our RAID support and noticed that we declare support for RAID level 2. Per wikipedia [1] it's an extremely rarely used level which offers little benefits. Does anyone remember why we use that? Will anyone cry if we drop it? My worry is officially supporting something that nobody can even test because of lack of hardware or real use case behind it. Dmitry [1] https://en.wikipedia.org/wiki/Standard_RAID_levels#RAID_2

2 1

[cinder]Cannot create volume from snapshot
by Nguyễn Hữu Khôi 14 Dec '23

14 Dec '23

Hello guys. I am using Openstack Yoga and Dell Powerstore 5000T When I create volume from a snapshot then I encounter this error cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] REST Response: 422 with data {"messages":[{"code":"0xE0A040010003","severity":"Error","message_l10n":"The clone cannot be created because the max number of clones: 32, in a family has been reached.","arguments":["32"]}]} ERROR cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] Failed to create clone volume-cc1fdd0b-8dd7-41a2-b63e-1f Do we have any guide about this? Or how we can increase the max number of clones? Thank you. Regards Nguyen Huu Khoi

3 6

[Octavia] Next weekly meetings cancelled
by Gregory Thiemonge 14 Dec '23

14 Dec '23

Hi Folks, As discussed yesterday during our weekly meeting, the next Octavia weekly meetings (Dec 20 and 27) are cancelled, the next meeting will be held on January 3rd. Thanks, Greg

1 0

[taskflow][all] Taskflow still using removed asyncore
by Thomas Goirand 14 Dec '23

14 Dec '23

Hi, As per this document: https://docs.python.org/3/whatsnew/3.12.html > Removed > asynchat and asyncore > > These two modules have been removed according to the schedule in > PEP 594, having been deprecated in Python 3.6. Use asyncio instead. > (Contributed by Nikita Sobolev in gh-96580.) Therefore, building the taskflow package (and many other packages that depends on it, like Cinder) fails. Can someone write a patch to get rid of the use of asyncore? Will using asincio instead fail because of our use of Eventlet? Cheers, Thomas Goirand (zigo)

3 2

RE: openstack-discuss Digest, Vol 62, Issue 44 Neutron - Issue Urgent
by Asma Naz Shariq 14 Dec '23

14 Dec '23

Hi Openstack Neutron Team, I have deployed Multinode cluster of Openstack through kolla-ansible zed release. The problem I am facing is instances created cannot pick any Ip addresses( Rather than loop back ip or ipv6 addresses) from the assigned networks which I have created provider and self-service flat network type. Hence, I may not be able to ping and ssh instance from the controller node and these instances won’t be able to connect to the internet. Can you guide me how to resolve these issues related to network connectivity so I may able to send you the required files to troubleshoot easily? Thanks -----Original Message----- From: openstack-discuss-request(a)lists.openstack.org <openstack-discuss-request(a)lists.openstack.org> Sent: Thursday, December 14, 2023 12:26 AM To: openstack-discuss(a)lists.openstack.org Subject: openstack-discuss Digest, Vol 62, Issue 44 Send openstack-discuss mailing list submissions to openstack-discuss(a)lists.openstack.org To subscribe or unsubscribe via email, send a message with subject or body 'help' to openstack-discuss-request(a)lists.openstack.org You can reach the person managing the list at openstack-discuss-owner(a)lists.openstack.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openstack-discuss digest..." Today's Topics: 1. What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Christian Rohmann) 2. Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Jonathan Rosser) 3. Re: [tripleo][ironic][wallaby] Partition Table: loop (Alexey Kashavkin) 4. Re: [all][tc][ptls] Eventlet: Python 3.12, and other concerning discoveries (Jay Faulkner) ---------------------------------------------------------------------- Message: 1 Date: Wed, 13 Dec 2023 18:00:46 +0100 From: Christian Rohmann <christian.rohmann(a)inovex.de> Subject: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss <openstack-discuss(a)lists.openstack.org> Message-ID: <a65d9057-67a2-4ab0-a2b6-fe327d185f06(a)inovex.de> Content-Type: text/plain; charset=UTF-8; format=flowed Hey openstack-discuss, I am a little confused about correct and required Ceph authx permissions for the RBD clients in Cinder, Glance and also Nova: When Glance is requested to delete an image it will check if this image has depended children, see https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. The children of Glance images usually are (Cinder) volumes, which therefore live in a different RBD pool "volumes". But if such children do exist a 500 error is thrown by Glance API. There also is an bug about this issue on Launchpad [3]. Manually using the RBD client shows the same error: > # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p > images children $IMAGE_ID > > 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 > librbd::image::OpenRequest: failed to retrieve name: (1) Operation not > permitted > 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: > 0x5639fdd5af60 failed to open image: (1) Operation not permitted > rbd: listing children failed: (1) Operation not permitted > 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: > list_descendants: failed to open descendant b7078ed7ace50d from pool > instances:(1) Operation not permitted So it's a permission error. Following either the documentation of Glance [1] or Ceph [2] on configuring the ceph auth caps there is no mention of granting anything towards the volume pool to Glance. So this is what I currently have configured: > client.cinder > key: REACTED > caps: [mgr] profile rbd pool=volumes, profile rbd-read-only > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=volumes, profile rbd-read-only > pool=images > > client.glance > key: REACTED > caps: [mgr] profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=images > > client.nova > key: REACTED > caps: [mgr] profile rbd pool=instances, profile rbd > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=instances, profile rbd > pool=images > When granting the glance client e.g. "rbd-read-only" to the volumes pool via: > > # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd > pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd > pool=images, profile rbd-read-only pool=volumes' > the error is gone. I am wondering through if this is really just a documentation bug (at OpenStack AND Ceph equally) and if Glance really needs read-only on the whole volumes pool or if there is some other capability that covers asking for child images. All in all I am simply wondering what the correct and least-privilege ceph auth caps for the RBD clients in Cinder, Glance and Nova would look like. Thanks Christian [1] https://docs.openstack.org/glance/latest/configuration/configuring.html#con… [2] https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-authen… [3] https://bugs.launchpad.net/glance/+bug/2045158 ------------------------------ Message: 2 Date: Wed, 13 Dec 2023 17:40:44 +0000 From: Jonathan Rosser <jonathan.rosser(a)rd.bbc.co.uk> Subject: Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss(a)lists.openstack.org Message-ID: <fb421a48-b0f6-4a6c-8d72-5b2ed8532b52(a)rd.bbc.co.uk> Content-Type: text/plain; charset=UTF-8; format=flowed Hi Christain, If you dig through the various deployment tooling then you'll find things like https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory… Hope this is helpful, Jonathan. On 13/12/2023 17:00, Christian Rohmann wrote: > Hey openstack-discuss, > > I am a little confused about correct and required Ceph authx > permissions for the RBD clients in Cinder, Glance and also Nova: > > When Glance is requested to delete an image it will check if this > image has depended children, see > https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. > The children of Glance images usually are (Cinder) volumes, which > therefore live in a different RBD pool "volumes". But if such children > do exist a 500 error is thrown by Glance API. There also is an bug > about this issue on Launchpad [3]. > > Manually using the RBD client shows the same error: > >> # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p >> images children $IMAGE_ID >> >> 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 >> librbd::image::OpenRequest: failed to retrieve name: (1) Operation >> not permitted >> 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: >> 0x5639fdd5af60 failed to open image: (1) Operation not permitted >> rbd: listing children failed: (1) Operation not permitted >> 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: >> list_descendants: failed to open descendant b7078ed7ace50d from pool >> instances:(1) Operation not permitted > > So it's a permission error. Following either the documentation of > Glance [1] or Ceph [2] on configuring the ceph auth caps there is no > mention of granting anything towards the volume pool to Glance. > So this is what I currently have configured: > >> client.cinder >> key: REACTED >> caps: [mgr] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> >> client.glance >> key: REACTED >> caps: [mgr] profile rbd pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=images >> >> client.nova >> key: REACTED >> caps: [mgr] profile rbd pool=instances, profile rbd >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=instances, profile rbd >> pool=images >> > > When granting the glance client e.g. "rbd-read-only" to the volumes > pool via: >> >> # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' >> > the error is gone. > > > I am wondering through if this is really just a documentation bug (at > OpenStack AND Ceph equally) and if Glance really needs read-only on > the whole volumes pool or if there is some other capability that > covers asking for child images. > > > All in all I am simply wondering what the correct and least-privilege > ceph auth caps for the RBD clients in Cinder, Glance and Nova would > look like. > > > > Thanks > > > Christian > > > > > [1] > https://docs.openstack.org/glance/latest/configuration/configuring.htm > l#configuring-the-rbd-storage-backend > [2] > https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-a > uthentication [3] https://bugs.launchpad.net/glance/+bug/2045158 > > > ------------------------------ Message: 3 Date: Thu, 14 Dec 2023 01:05:41 +0600 From: Alexey Kashavkin <akashavkin(a)gmail.com> Subject: Re: [tripleo][ironic][wallaby] Partition Table: loop To: Julia Kreger <juliaashleykreger(a)gmail.com> Cc: openstack-discuss(a)lists.openstack.org Message-ID: <0F672C26-BC74-4D16-92FC-292F1D2BF62F(a)gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BE0F9200-A2C4-458F-B2C4-31E6043ACAA2" Greetings Julia, Thank you so much for your reply and clarification. > On 12 Dec 2023, at 20:22, Julia Kreger <juliaashleykreger(a)gmail.com> wrote: > > Greetings Alexey, > > That would do it. Whenever we do not see a kernel/ramdisk with an image file, we assume it is a whole disk image, and as a result, we don't partition, we only write out what we've been provided. This is rooted in the image convention storage with Glance, because you need a kernel/ramdisk to boot a partition, but you can "just boot" a whole disk image. > > The disk utilities, in this specific case when you look at the disk, it thinks it is looking at a partition image on a loopback due to the lack of the partition table. > > That being said, whole disk images are the preferred path given you have greater flexibility in the partition/structure/layout of the deployed host. > > Hope that helps explain and provides the extra context. > > -Julia > > > > On Tue, Dec 12, 2023 at 2:56 AM Alexey Kashavkin <akashavkin(a)gmail.com <mailto:akashavkin@gmail.com>> wrote: >> I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

1 0

Re: [tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 13 Dec '23

13 Dec '23

I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

2 2

[Reminder] OpenInfra Live: Large Scale Ops Deep Dive Ft: Samsung SDS Dec. 14 at 15UTC
by Kristin Barrientos 13 Dec '23

13 Dec '23

Hi Everyone, Tune in this week for another episode of OpenInfra Live, brought to you by the Large Scale SIG. Episode: In the "Large Scale Ops Deep Dive" series, a panel of OpenStack operators invites special guests to talk about their deployment and discuss their operations. For this episode, our guest will be Dan Paik from Samsung SDS. Date and time: Thursday, Dec 14, 15 UTC YouTube: https://www.youtube.com/watch?v=RI9SwY8VdCY LinkedIn:https://www.linkedin.com/events/7125892582139654144/comments/ WeChat: The recording will be posted on OpenInfra Foundation WeChat after the live stream Speakers: Dan Paik, Arnaud Morin, Felix Huettner, Thierry Carrez, Kristin Barrientos Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation

1 0

openstack cinder client help
by garcetto 13 Dec '23

13 Dec '23

good afternoon, i am trying to use the openstackclient ( https://docs.openstack.org/newton/user-guide/common/cli-install-openstack-c…) but it seems than I cannot use it to see cinder volume snapshot, even the doc say it is possible ( https://docs.openstack.org/python-openstackclient/latest/cli/decoder.html#c… ) [image: image.png] it says " (my-virt-env) user@ostack:~$ openstack snapshot list openstack: 'snapshot list' is not an openstack command. See 'openstack --help'. Did you mean one of these? endpoint add project endpoint create endpoint delete endpoint group add project endpoint group create ... " what am i missing? thank you.

3 2

[keystone] Keystone integration with Keycloak
by Franciszek Przewoźny 13 Dec '23

13 Dec '23

Hi all, I'm having some troubles integrating Keystone with Keycloak - pulling username and email from Keycloak using OIDC to Keystone works fine, but pulling groups (list of groups) doesn't. Keycloak provides such data in userinfo (pulled from Google, mapped in Keycloak and added to user): "usergroups": [ "group-a", "group-b", ], Keystone seems to be getting group names, but incorrectly parsing (?) it to a string with commas (instead of semicolon as it's required for multiple group entries to work: https://docs.openstack.org/keystone/latest/admin/federation/mapping_combina…) 2023-12-13 08:22:13.399 1076680 DEBUG keystone.federation.utils [None req-e8b8519a-c639-450e-b4e7-ca2ea8a0f3bc - - - - - -] updating a direct mapping: ['group-a,group-b'] _verify_all_requirements /usr/lib/python3/dist-packages/keystone/federation/utils.py:867 And tries to map user to group with names group-a,group-b: 2023-12-13 09:42:54.914 1084357 DEBUG keystone.federation.utils [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] mapped_properties: {'user': {'name': 'xxxxxxxx', 'email': 'xxxxxxx(a)yyyy.zzz', 'domain': {'id': 'default'}, 'type': 'ephemeral'}, 'group_ids': [], 'group_names': [{'name': 'group-a,group-b', 'domain': {'id': 'default'}}], 'projects': []} process /usr/lib/python3/dist-packages/keystone/federation/utils.py:562 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] 'method' object is not subscriptable: TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application Traceback (most recent call last): 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1513, in full_dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application rv = self.dispatch_request() 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1499, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 467, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = resource(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/views.py", line 83, in view 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.dispatch_request(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 582, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = meth(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/server/flask/common.py", line 1064, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return f(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 386, in get 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self._perform_auth(idp_id, protocol_id) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 380, in _perform_auth 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application token = authentication.federated_authenticate_for_token( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 251, in federated_authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return authenticate_for_token(auth) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 185, in authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application authenticate(auth_info, auth_context) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 152, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = method.authenticate(auth_info.get_method_data(method_name)) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 59, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application response_data = handle_unscoped_token(auth_payload, 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 225, in handle_unscoped_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application mapped_properties, mapping_id = apply_mapping_filter( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 321, in apply_mapping_filter 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application utils.validate_mapped_group_ids(group_ids, mapping_id, identity_api) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application My current setup: Google (user and groups membership) OIDC -> Keycloak OIDC -> Keystone Mapping rules (without parameters related to group settings works fine): [ { "local": [ { "user": { "name": "{0}", "email": "{1}", "domain": { "id": "default" } } }, { "group": { "name": "{2}", "domain": { "id": "default" } } } ], "remote": [ { "type": "OIDC-preferred_username" }, { "type": "OIDC-email" }, { "type": "OIDC-usergroups" } ] } ] WSGI Apache: ## WSGI configuration WSGIApplicationGroup %{GLOBAL} WSGIDaemonProcess keystone display-name=keystone group=keystone processes=4 threads=1 user=keystone WSGIProcessGroup keystone WSGIScriptAlias / "/usr/lib/cgi-bin/keystone/keystone" WSGIPassAuthorization On LoadModule auth_openidc_module modules/mod_auth_openidc.so OIDCClaimPrefix "OIDC-" OIDCResponseType "id_token" OIDCScope "openid email profile" OIDCProviderMetadataURL "https://keycloak.yyyy.zzz/realms/master/.well-known/openid-configuration <https://keycloak.opera.software/realms/master/.well-known/openid-configurat…>" OIDCClientID "openstack" Any help appreciated! Thanks in advance, Franciszek Przewoźny

1 1

[all][tc][cinder] deprecating cinderlib
by Brian Rosmaita 13 Dec '23

13 Dec '23

As discussed at our midcycle meeting last week [0], the Cinder project team hereby announces the deprecation of cinderlib, a library that allows the direct usage of Cinder backend drivers without the cinder services. Cinderlib is a cycle-trailing release, and thus this announcement comes on the heels of the 2023.2 (Bobcat) release of cinderlib, which happened just last week. The Cinder project team will continue to support cinderlib in the stable Maintained branches for their normal lifecycles, as specified by the OpenStack Stable Branch Policy: - stable/2023.2: end of maintenance Spring 2025 - stable/2023.1: end of maintenance Fall 2024 - stable/zed: end of maintenance Spring 2024 The stable/victoria through stable/yoga branches are in Unmaintained status. If you have questions or concerns about the deprecation of cinderlib, please reply to this email or leave a comment on the governance patch: https://review.opendev.org/c/openstack/governance/+/903259 Thank you for your attention to this matter. [0] https://wiki.openstack.org/wiki/CinderCaracalMidCycleSummary

2 1

[openstack-ansible] December and January meetings schedule
by Neil Hanlon 13 Dec '23

13 Dec '23

Hello all, and happy holidays :) The OSA team will be skipping our regularly scheduled meetings on December 26th and January 2nd due to the Christmas/New Year festivities. We'll be meeting once more before the end of the year, next Tuesday, December 19th. Thank you, and I wish you all the best in 2024! Cheers, Neil

1 0

System configuration in OpenStack
by lostghost1＠yandex.ru 12 Dec '23

12 Dec '23

Hi all, Sorry if this has been asked already, but is it feasible to use OpenStack to configure running systems - including virtual instances, containers, and the physical nodes themselves. I know that conceptually OpenStack takes a hands-off approach - it deals with images in abstract and further configuration is delegated to tools such as Ansible. Same for bare metal nodes - you provision them with Ironic, flash an image to them, and that's where configuaration ends for OpenStack. At least this is how I understand it, may be wrong. I was thinking about introducing systems configuration as a first-class concept into OpenStack - that means integration with the package manager, writing of config files from templates, filesystem management in general. The most well thought-out "solution" that there is for systems configuration is Nix in my opinion. I could intergrate it into OpenStack, I could write my own package manager. I haven't decided yet, these are just ideas for a pet project. So if I were to do such a thing, how would I go about achieving it? Obviously I would need to write a Horizon console module for the web UI. But beyond that I'd also need integration with other components. What do you all think?

3 6

[publiccloud-sig] Reminder - next meeting December 13th - 0800 UTC
by Felix Kronlage-Dammers 12 Dec '23

12 Dec '23

Hi everyone, This Wednesday the next meeting of the public cloud sig is going to happen. Since we do every other meeting as a videosession, we’ll be meeting at 0800 UTC here: https://conf.scs.koeln:8443/OIF-public-cloud-sig We’re going to continue our discussion on user stories for the discoverability of flavors and alike. Please see https://etherpad.opendev.org/p/publiccloud-sig-meeting for further infos. See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG See you tomorrow! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

Issuse with OVN DVR generate too much flow on compute node
by Sang Tran Quoc 12 Dec '23

12 Dec '23

Hi OpenStack Community, I've indicated very weird behavior about ovn flows when VM is associated with vrouter, I use one new compute node with only 1 VM for testing and result as below: * When VM attach to vRouter without external network: Only add new 2047 flows. * When vRouter attach to external network (provider-net2): It will generate 147k flows immediately ? * We've tested with VM direct attach to provider-net2 also generate 147k flows. [cid:image001.png@01DA2D02.780FB210] My environment is OpenStack Victoria version, neutron deployed with OVN, DVR, Distributed FIP mode, and provider-net2 using VLAN setup. The problems lead to the heavily process of sync flow which slows down the normal VM operations and packet drop a little bit while update large flow on the ovswitch. Could anyone has experienced this behavior before or have a solution config/patch neutron to address this? Any suggestions are highly appreciated. Thank and regards, Sang Tran

1 0

Re: [URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 12 Dec '23

12 Dec '23

Hey team, Thanks for those who replied off list. Thankfully we figured it out, it was due to underlying resolver config mysterious mulching AAAA records instead of requesting A records… Probably goes to say, Openstack needs to have some seriously heavier logging 😃 haha. Thanks! Karl. From: Dmitriy Rabotyagov <noonedeadpunk(a)gmail.com> Date: Tuesday, 12 December 2023 at 5:35 pm To: Karl Kloppenborg <kkloppenborg(a)resetdata.com.au> Subject: Re: [URGENT] - Help needed with open stack services hung Hey, > stopping services from processing requests I assume this means that services are started and do not report any errors in logs? What happens with requests themselves? Are they answered with error or just hang? Also how environment was deployed? Some deployment tooling or manually with packages, k8s? On Tue, Dec 12, 2023, 05:30 Karl Kloppenborg <kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au>> wrote: Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

[tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 12 Dec '23

12 Dec '23

I have an issue with nodes provisioning. All my nodes are getting a partition table - loop. I forcefully specified 'disk_label:gpt/msdos' in the capabilities properties, but it didn't help. I can't figure out at what moment it creates a partition for the entire disk size: Model: Virtio Block Device (virtblk) Disk /dev/vda: 53.7GB Sector size (logical/physical): 512B/512B Partition Table: loop Disk Flags: Number Start End Size File system Flags 1 0.00B 53.7GB 53.7GB xfs This causes the following error: Failed to check the number of primary partitions present on /dev/vda for node 8d5ed008-efea-4df7-a190-aab8274a3bd5. Error: The device /dev/vda does not have a valid MBR partition table I tried to find in the ironic documentation where exactly a partition can be partitioned to the whole disk, but I couldn't find it. Perhaps it is somehow affected by the fact that 'is_whole_disk_image = true' is specified in the deployment process. I also have an x86_64 host as a compute node, it boots in legacy mode. I got the image for it from here - https://images.rdoproject.org/centos8/wallaby/rdo_trunk/current-tripleo/ I also get the same error on it. What could affect this? Full log of one of the nodes - https://pastebin.pl/view/5a6a7587 Node Show output of this node - https://pastebin.pl/view/ec5950b6

1 0

[URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 12 Dec '23

12 Dec '23

Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

Individual Board Director nominations: 3d left
by Kurt Garloff 12 Dec '23

12 Dec '23

Hi, the Open Infra communities have many strengths. One of them is a well-balanced board of directors that has representatives from all member classes, the Platinum members, the Gold members, and from individuals [1] that are part of the communities and elected -- each class contributing 1/3 of the seats.[4] I am worried about the individual class though: There are currently only 3 candidates that have enough nominations to be on the ballot [2]. 3 more needing a few more nominations. But I believe there should be a few more candidates on the ballot, otherwise it becomes an election without choice, something that is not good IMVHO. So please identify individuals that want to serve and nominate [3] them. This makes the elections meaningful and allows the board to do its work with also the individual members well represented. And there are only 3 more days to go for this! [1] https://openinfra.dev/election/2024-individual-director-election [2] https://openinfra.dev/election/2024-individual-director-election/candidates [3] https://openinfra.dev/a/community/members [4] https://openinfra.dev/about/board/ Thanks, -- Kurt Garloff <openstack(a)garloff.de>, Cologne CTO Sovereign Cloud Stack project @ OSB Alliance e.V.

2 1

[kolla] [2023.1] [masakari] Orphaned instances on node shutdown
by Rob Jefferson 12 Dec '23

12 Dec '23

Folks, I'm running into an issue with instances appearing to be running, even though they shouldn't be. The environment in this case is a virtualized OpenStack Kolla (2023.1) cluster, with three compute nodes and three control plane nodes. I am trying to see what happens when I create and terminate instances, in an attempt to figure out failover behavior. The three computes are in a single segment. I created four instances: +--------------------+--------+---------------------------+ | Name | Status | Host | +--------------------+--------+---------------------------+ | rj_testinstance_04 | ACTIVE | devtest-libvirt1-muon1005 | | rj_testinstance_03 | ACTIVE | devtest-libvirt1-muon1004 | | rj_testinstance_02 | ACTIVE | devtest-libvirt1-muon1006 | | rj_testinstance | ACTIVE | devtest-libvirt1-muon1005 | +--------------------+--------+---------------------------+ I decided to see what would happen if I went in and shutdown devtest-libvirt1-muon-1005 (which has two instances running). So I ssh'd into the machine and entered (as root): `echo c > /proc/sysrq-trigger` to force a crash, which duly occurred. I then made sure the host was seen as down: +---------------------------+-------+ | Hypervisor Hostname | State | +---------------------------+-------+ | devtest-libvirt1-muon1005 | down | | devtest-libvirt1-muon1004 | up | | devtest-libvirt1-muon1006 | up | +---------------------------+-------+ But even after this, the instances seem to still be up, including on the now crashed machine: +--------------------+--------+---------------------------+ | Name | Status | Host | +--------------------+--------+---------------------------+ | rj_testinstance_04 | ACTIVE | devtest-libvirt1-muon1005 | | rj_testinstance_03 | ACTIVE | devtest-libvirt1-muon1004 | | rj_testinstance_02 | ACTIVE | devtest-libvirt1-muon1006 | | rj_testinstance | ACTIVE | devtest-libvirt1-muon1005 | +--------------------+--------+---------------------------+ I would have expected the instances to have been regenerated on other compute hosts, or some sort of error. The nodes are on the same segment, so Masakari should have at least attempted to roll over the instances to other computes in the segment. But checking the instance details suggests that nothing has happened. The instances are just... lost. The Masakari host monitor log file reflects reality: 2023-12-11 19:21:49.953 8 INFO masakarimonitors.hostmonitor.host_handler.handle_host [-] 'devtest-libvirt1-muon1005' is 'offline' (current: 'offline'). Needless to say, I'm very confused here and am sure what's going on. Any advice would help. Thanks, Rob

1 1

[neutron][ovn] Outbound SNAT behavior
by James Denton 12 Dec '23

12 Dec '23

Hi everyone, While looking at an OVS->OVN migration, we came across a use-case that doesn’t provide 1:1 compatibility and I wanted to check with the community to see if there were any suggestions or ideas on how to proceed. In an OVS-based environment, we have users with a typical layout: <external provider network> | <neutron router> | | <tenantnet1> <tenantnet2> The users have implemented static routes on the Neutron router using the extraroutes API, which works great, and the default SNAT behavior implemented within the qrouter namespace handles any network traffic egressing the router, not just directly-connected tenant networks (see iptables entries below): -A neutron-l3-agent-snat -j neutron-l3-agent-float-snat -A neutron-l3-agent-snat -o qg-700f84b0-6b -j SNAT --to-source 168.47.160.223 --random-fully -A neutron-l3-agent-snat -m mark ! --mark 0x2/0xffff -m conntrack --ctstate DNAT -j SNAT --to-source 168.47.160.223 --random-fully -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-l3-agent-snat OVN, on the other hand, appears to implement snat rules in the logical router based on directly-connected tenant networks, which means that traffic sourcing from other networks (not managed by Neutron but routable within a Neutron router, including to a VM or appliance) is not source NAT’d and egresses the router as its real IP. This behavior results in the traffic being effectively blackholed, as there’s no return route and no real desire to have exposed those IPs anyway. Here’s an example of the nat list which includes the directly connected tenant network: root@lab-controller01:~# ovn-nbctl lr-nat-list neutron-edfd7115-5a81-46b7-9692-fe227d395b0b TYPE GATEWAY_PORT EXTERNAL_IP EXTERNAL_PORT LOGICAL_IP EXTERNAL_MAC LOGICAL_PORT snat 192.168.3.33 10.254.254.0/24 The extraroute in the router is: destination: 172.16.0.0/24, nexthop: 10.254.254.6 I can add an entry manually, which allows the snat for the secondary network to work as expected, but results in some other issues where the snat(s) don’t get added back on a disable/enable of the router: root@lab-controller01:~# ovn-nbctl lr-nat-add neutron-edfd7115-5a81-46b7-9692-fe227d395b0b snat 192.168.3.33 172.16.0.0/24 root@lab-controller01:~# ovn-nbctl lr-nat-list neutron-edfd7115-5a81-46b7-9692-fe227d395b0b TYPE GATEWAY_PORT EXTERNAL_IP EXTERNAL_PORT LOGICAL_IP EXTERNAL_MAC LOGICAL_PORT snat 192.168.3.33 10.254.254.0/29 snat 192.168.3.33 172.16.0.0/24 I understand this is probably not a supported usecase, but one that worked nonetheless, so any suggestions on how to mirror this functionality in a supported way would be greatly appreciated. Thanks, James

1 0

[tc] Technical Committee Meeting Tomorrow, Dec 12
by Jay Faulkner 11 Dec '23

11 Dec '23

Hi all, The weekly meeting of the Technical Committee will be held Tuesday, Dec 12 at 1800 UTC in #openstack-tc on OFTC. See below for the proposed agenda: - Roll call - Follow up on tracked action items: https://meetings.opendev.org/meetings/tc/2023/tc.2023-12-05-18.00.html - Gmann - Create TC resolution expressing approval for OIF bylaws change - Create TC charter change in response to OIF bylaws changes - JayF - Communicate deadline for approval of above OIF bylaws related governance changes - Gate health check - Leaderless projects (gmann) - Implementation of Unmaintained branch statuses - 2024.1 TC Tracker - https://etherpad.opendev.org/p/tc-2024.1-tracker - Open Discussion and Reviews Thanks all, Jay Faulkner TC Chair

1 0

[kolla-ansible] rocky spice containers missing
by Michael Knox 11 Dec '23

11 Dec '23

Hi all. I was looking to use SPICE instead of VNC, but noticed that there are no rocky containers for it on quay.io. I found a ticket for CentOS 8 source, is this still the same reason? https://bugs.launchpad.net/kolla-ansible/+bug/1955549 Cheers Michael

3 3