December 2023 - openstack-discuss

Reg Openstack deployment
by Rohit Sansiya 20 Dec '23

20 Dec '23

Dear Sir, please help me ! I have a single compute node and i have to configure nova and neutron on that single compute node only. how to do this kindly help me sir. Thanks Your message is ready to be sent with the following file or link attachments: Rohit Sansiya https://sites.google.com/view/rpgcloud/research-india Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.

2 1

[i18n][infra] Future of translate.openstack.org
by Tony Breeds 20 Dec '23

20 Dec '23

Hello all, The infra team is in the process of replacing older bionic servers with jammy based ones. We're nearing the end of that process and one of the remaining servers is translate.openstack.org. This server is primarily running zanata, which if I understand correctly, is no longer in use by the i18n team. I understand that there is a new platform that requies some tooling, if a dedicated server is needed for that we can spin up a newer jammy based server. So can we just retire this translate.openstack.org? Yours Tony.

3 3

[all][tc][ptls] Eventlet: Python 3.12, and other concerning discoveries
by Jay Faulkner 20 Dec '23

20 Dec '23

Hi all, For those who aren't aware, eventlet (https://github.com/eventlet/eventlet) is a library that almost every OpenStack project depends on and uses heavily. It's the primary method in most OpenStack project for achieving any form of parallelism via greenthreading. A couple of weeks ago it was brought to my attention, in the #openstack-tc IRC channel, that the eventlet library was broken on python 3.12 due to changes to the SSL stdlib in python 3.12. I enlisted a G-Research Open Source Software (GR-OSS) developer from outside the OpenStack community, Itamar, to help dig into what would be required to get python 3.12 support for eventlet, and asked him to do an overall health check on the project. The results were extremely concerning, and are why I'm emailing the list today. First of all, the original concern -- python 3.12 support -- is being worked on right now; there is a PR up to migrate the SSL module here https://github.com/eventlet/eventlet/pull/817 and a PR up here: https://github.com/eventlet/eventlet/pull/820 to begin migrating from nose3, a deprecated testing framework used by eventlet which does not support python 3.12. It's worth noting that in the past (2020) https://github.com/eventlet/eventlet/issues/638 there was resistance to removing nose for testing due to at-the-time-desired python2.7 support. Even if they are able to be merged, these PRs only scratch the surface of the total effort needed to get eventlet working on python 3.12. Furthermore, activity on the eventlet project is extremely slim right now. There have been no commits to the primary branch in nearly eight months and it's been a single maintainer project for an extremely long time. There are also indications there may be external factors impacting the maintainers' availability. This lack of redundancy on a core library that we have no clear migration path off of is concerning as well. As a large community that uses eventlet; I hope we can improve it. Now we get to the cherry on top -- code quality and existing bugs. When Itamar began evaluating the overall state of the project, he found that approximately 80% of the unit tests were passing. Some of the failing unit tests were valid failures. In fact, one of the failure cases -- around locks not being properly greened on upgrade -- explains an Ironic database migrations unit test failure which we spent several weeks off-and-on debugging last cycle. Along these lines; although eventlet has CI configured; those tests have never passed: https://github.com/eventlet/eventlet/actions/workflows/test.yaml?query=is%3… . I don't have a specific proposal for a solution. I do know that right now, OpenStack services are built "all-in" on eventlet, with no obvious or easy migration path off. At least in the short term, keeping eventlet running well is critical to keeping OpenStack running well. I'm sending this email to raise an alarm about this situation, and to hope that community members can work together to solve the problem. Thanks for reading and your help, Jay Faulkner OpenStack TC Chair

8 15

[all] Python 3.12 issues and classes of bugs, helping me fixing them all...
by Thomas Goirand 20 Dec '23

20 Dec '23

Hi there! Since a few days, we have Python 3.12 as available interpreter version in Debian Unstable. All Debian packages were rebuilt by Lucas Neusbaumm, and about 60 Debian RC bugs were filled against the OpenStack related packages. You may have seen it in some of your projects, I was able to fix lots of bugs (so far: 28 bugs fixed since Wednesday morning, and counting...), and forwarded them to upstream OpenStack whenever possible: https://review.opendev.org/c/openstack/os-ken/+/903521 https://review.opendev.org/c/openstack/sahara-plugin-spark/+/903656 https://review.opendev.org/c/openstack/keystonemiddleware/+/903640 https://review.opendev.org/c/openstack/os-ken/+/903521 https://review.opendev.org/c/openstack/sahara-plugin-spark/+/903656 https://review.opendev.org/c/openstack/keystonemiddleware/+/903640 I'd appreciate reviews and merge for these, of course... Many reported issues were problems in a single package (like Eventlet, or taskflow not able to load asyncore), so some bugs were closed without any further action but an attempt of rebuilding the said package to check everything is as expected. However, for a lot of bugs, I do not know how to fix, which leads me to this message. Of course, mostly the hardest bugs are remaining now, as I fixes the most easy ones. Here's a few examples. In Barbican: https://bugs.debian.org/1058183 What is this "KeyError: slice(0, -1, None)" about? Many packages have the same issue (like networking-sfc, neutron-dynamic-routing, neutron-vpnaas, manila, rally and many others), so if I understand this class of bug, I'll be able to fix them all. Help would be very much appreciated on that one. In openstackclient: https://bugs.debian.org/1058097 The stackdump is: File "<frozen importlib._bootstrap>", line 1360, in _find_and_load File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 935, in _load_unlocked File "<frozen importlib._bootstrap>", line 1176, in exec_module File "<frozen codecs>", line 58, in <module> AttributeError: module 'sys' has no attribute 'byteorder' I don't really understand what's going on, but this smells like an issue in Python 3.12 itself. watcher: https://bugs.debian.org/1058377 looks like the interpreter segfauls when importing some modules in watcher.tests.api ?!? Mistral: https://bugs.debian.org/1058182 Manila: https://bugs.debian.org/1058182 AssertionError: Failed to wait for expected result: Execution f2a97f87-7b08-4171-819a-47e30a0a1840 must have reached state SUCCESS state but it is in RUNNING What's going on here? diskimage-builder: I was able to fix the "ModuleNotFoundError: No module named 'imp'" (that's trivial to fix, really...), but now I get: File "/usr/lib/python3/dist-packages/mock/mock.py", line 1245, in _importer thing = __import__(import_path) ^^^^^^^^^^^^^^^^^^^^^^^ ModuleNotFoundError: No module named 'growvols' looks like what I attempted to fix with rewriting a load_source (which is removed from Python 3.12) didn't work. python-pykmip: https://bugs.debian.org/1058411 That one feels tricky. wrap_socket is gone from the standard ssl module, though the example given in here: https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket is to use something like this: with context.wrap_socket(sock, server_hostname=hostname) as ssock: but that wont work with the way pykmip is written. So probably it needs some kind of rewrite? Looks like there's some commits upstream to address it, but no new release, unfortunately. I probably should attempt packaging the last Git commit. oslotest: https://bugs.debian.org/1058373 The broken test case attemps to disable the 'sys' module, but it looks like its failing to do so. Is there a change of behavior in the interpreter? wsgi-intercept: https://bugs.debian.org/1058378 TypeError: HTTPSConnection.__init__() got an unexpected keyword argument 'cert_file' No idea how to fix that one... :/ There's more which I probably didn't classify above. The full list of bugs is here: https://bugs.debian.org/cgi-bin/pkgreport.cgi?which=maint&data=team%2Bopens… Please ignore the first 5 though, which I don't really maintain and don't really care about (these aren't Py 3.12 issues). Many thanks to anyone that will help. Cheers, Thomas Goirand (zigo)

4 3

[Senlin][tc][all] Senlin project marked inactive by TC
by Jay Faulkner 20 Dec '23

20 Dec '23

OpenStack Community, The Technical Committee marked the Senlin project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on Senlin, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support Senlin to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902626 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[ec2-api][tc][all] ec2-api project marked inactive by TC
by Jay Faulkner 20 Dec '23

20 Dec '23

OpenStack Community, The Technical Committee marked the ec2-api project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on ec2-api, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support ec2-api to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902625 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

beginning with [masakari]
by Shubham Kumar Yadav 20 Dec '23

20 Dec '23

Hi, i have recently started working on Masakari (kubernetes in openstack) so i wanted some help with it please i was trying to test the masakari-instance_monitor & masakari-host-monitor but having trouble with it. i have created a pacemaker remote cluster (with pacemaker & corosync on controller nodes and pacemaker remote on compute node. *pcs statusCluster name: lab-clusterCluster Summary: * Stack: corosync * Current DC: lab-11053-26006-ceph-2 (version 2.1.2-ada5c3b36e2) - partition with quorum * Last updated: Thu Dec 14 08:41:41 2023 * Last change: Thu Dec 14 08:41:22 2023 by root via cibadmin on lab-11053-26006-ceph-1 * 6 nodes configured * 3 resource instances configuredNode List: * Online: [ lab-11053-26006-ceph-1 lab-11053-26006-ceph-2 lab-11053-26006-ceph-3 ] * RemoteOnline: [ lab-11053-26006-comp-1.cluster.local lab-11053-26006-comp-2.cluster.local lab-11053-26006-comp-3.cluster.local ]Full List of Resources: * lab-11053-26006-comp-1.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-1 * lab-11053-26006-comp-2.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-2 * lab-11053-26006-comp-3.cluster.local (ocf:pacemaker:remote): Started lab-11053-26006-ceph-3Daemon Status: corosync: active/enabled pacemaker: active/enabled pcsd: active/enabled* i have also created segment and added hosts(computes) in it. when i tried to test the masakari host monitor by manually powering off the compute node, masakari should move the vms from powered off computes to some running compute but after the compute is powered off vms still remains on the powered off compute. Am i missing some conf? is there any need to add some conf in nova and keystone too? in masakari engine logs i see host_failure.evacuate_all_instances = True instance_failure.process_all_instances = False host_failure.add_reserved_host_to_aggregate = False host_failure.ha_enabled_instance_metadata_key = HA_Enabled log_opt_values host_failure.ignore_instances_in_error_state = False host_failure.service_disable_reason = Masakari detected host failed. do you have any suggestion please let me know! Thank You

2 1

[oslo] Nominating tobias-urdin for etcd3gw core
by Takashi Kajinami 20 Dec '23

20 Dec '23

Hi team, I raised this topic in #openstack-oslo today and already got a few acks, but I'm sending this email here for an official proposal as well as record. The etcd3gw library is now extensively used by tooz as the primary implementation for etcd3 backend. Because Tobias is already a core reviewer in the tooz library, I propose adding him to the etcd3gw core as well. Please let me know in case anyone has any thoughts on the proposal. I'll add him to the group next week if we hear no objections. Thank you Takashi Kajinami

2 2

[cinder] Canceling next week's meeting (27th December)
by Rajat Dhasmana 20 Dec '23

20 Dec '23

Hello Argonauts, Since most of the team members will be on year end break, we have decided to cancel next week's cinder meeting that was going to be held on 27th December, 2023. A merry christmas and a happy new year to the team. See you all next year! Thanks Rajat Dhasmana

1 0

Reg the issue
by Rohit Sansiya 20 Dec '23

20 Dec '23

Sir, I want help regarding openstack project creation. While creating the project by using openstack project create then stuck the process and got the error regarding fail to discover available identity versions when contacting the url(http://controller11:5000/v3) & gateway timeout 504 kindly help. Your message is ready to be sent with the following file or link attachments: Rohit Sansiya https://sites.google.com/view/rpgcloud/research-india Note: To protect against computer viruses, e-mail programs may prevent sending or receiving certain types of file attachments. Check your e-mail security settings to determine how attachments are handled.

1 0

Re: about magnum capi for production
by Oliver Weinmann 19 Dec '23

19 Dec '23

4 7

[tc] OpenInfra Foundation Bylaws & TC Charter Changes
by Jay Faulkner 19 Dec '23

19 Dec '23

Hi all, I wanted to inform you we have two TC resolutions up for vote related to recent OpenInfra Foundation bylaws changes. First, https://review.opendev.org/c/openstack/governance/+/903239 is a resolution by the Technical Committee approving the OpenInfra Foundation bylaws changes. Secondly, https://review.opendev.org/c/openstack/governance/+/903236 is an update to the Technical Committee charter required as part of the bylaws changes. This is part of a joint effort between the OpenInfra Foundation and the OpenStack Technical Committee to remove language from the foundation bylaws treating OpenStack differently from other OpenInfra projects. Please take notice! Thanks, Jay Faulkner OpenStack TC Chair

1 0

[neutron] DevStack support for OVN BGP Agent
by Luis Tomas Bolivar 19 Dec '23

19 Dec '23

Hey folks, This is just a heads up we worked on a DevStack plugin for the OVN BGP agent [1], so that it is easier to deploy and test locally, with limited functionality. I also posted about how to use it [2] [1] https://review.opendev.org/c/openstack/ovn-bgp-agent/+/814185 [2] https://ltomasbo.wordpress.com/2023/12/19/deploying-ovn-bgp-agent-with-devs… Best regards, Luis -- LUIS TOMÁS BOLÍVAR Principal Software Engineer Red Hat Madrid, Spain ltomasbo(a)redhat.com

2 1

octavia lb operating status is always offline
by zhengrui20220 19 Dec '23

19 Dec '23

[octavia] hello，i am zhengrui，I have a problem with octavia deployment, my lb can work normally, but 'openstack loadbalancer list' command shows lb's operating status is offline, and my health manager log show 'Exception: 'NoneType' object has no attribute 'encode', then I add 'heartbeat_key = 20e8350e-950f-40fb-bb36-b9259e355523' in octavia.conf ,it shows 2023-12-19 10:38:59.701 1013848 WARNING octavia.amphorae.backends.health_daemon.status_message [-] calculated hmac(hex=True): 37623763633366666565616639383462373865343661616235616431623533363866306638336638653937656262333538303732346339656364623932623339 not equal to msg hmac: 61303433633739663136306366633465363234653535396663373230616636306134623036333339353363353736616339656133616538653961643762383763 dropping packet Now, I have no idea about this problem. | | zhengrui20220 | | zhengrui20220(a)163.com |

3 2

[publiccloud-sig] Skipping meeting next week - next meeting will be January 10th
by Felix Kronlage-Dammers 19 Dec '23

19 Dec '23

Hi everyone, like most (all? ;) of the other teams: Due to the holidays the publiccloud-sig will not meet next week - instead the next meeting will be on January 10th - then as always at 0800 UTC. Enjoy the holidays! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[barbican] Meetings scheduling
by Grzegorz Grasza 19 Dec '23

19 Dec '23

Hi all, As proposed in our last meeting [1], the new meeting time will move to Mondays @ 15:00 UTC. The next meeting is scheduled for Jan 8th 2024. [2] Enjoy the holiday season and I'll see y'all next year! / Greg [1] https://meetings.opendev.org/meetings/barbican/2023/barbican.2023-12-19-12.… [2] https://review.opendev.org/c/opendev/irc-meetings/+/903976

1 0

[kolla] Cancelling weekly meetings until 10th January 2024
by Michał Nasiadka 19 Dec '23

19 Dec '23

Hello Koalas, Since we’re approaching festive season and most of the meeting participants are going to be off - I’m cancelling couple of next weekly meetings. Let’s meet again on 10th of January 2024. Michal

1 0

[zaqar][tc] master and 2023.2 unit tests are broken
by Takashi Kajinami 18 Dec '23

18 Dec '23

Hello, Today I happened to notice that unit tests in zaqar is broken because some tests requires base test class from oslo.db which was removed in 13.0.0 release[1]. The 13.0.0 release of oslo.db was made during 2023.2 cucle so these tests are also broken in stable/2023.2 branch. In addition, py311 job was made voting in master but is broken and we probably need to fix bindep.txt so that it works in Debian 12. I'm sending this mail so that people maintaining the project is aware of the situation. I'll add [tc] tag because if the CI is not fixed then zaqar may become a new candidate for inactive projects. Thank you, Takashi [1] https://review.opendev.org/c/openstack/oslo.db/+/874239

2 1

[tc] Weekly Meeting tomorrow, Dec 19 at 1800 UTC
by Jay Faulkner 18 Dec '23

18 Dec '23

Hi all, The weekly meeting of the OpenStack Technical Committee is scheduled for tomorrow, December 19, at 1800 UTC in #openstack-tc on OFTC. As a reminder, this will be our last meeting of 2023. Our next scheduled meeting after this will be January 7, 2024. The proposed agenda is: - Roll call - Follow up on tracked action items: https://meetings.opendev.org/meetings/tc/2023/tc.2023-12-12-18.00.html - Spotz - (due Jan 7 2024) Look into updating https://docs.openstack.org/install-guide/openstack-services.html and report back to TC Create TC resolution expressing approval for OIF bylaws change - Gate health check - Leaderless projects (gmann) - Implementation of Unmaintained branch statuses - 2024.1 TC Tracker - https://etherpad.opendev.org/p/tc-2024.1-tracker - Open Discussion and Reviews Thanks, Jay Faulkner OpenStack TC Chair

1 0

[Kolla-ansible] Upgrading from Yoga to Zed HCI deployment
by wodel youchi 18 Dec '23

18 Dec '23

Hi, I need to upgrade my Openstack deployment from Yoga (Rocky Linux 8) to Zed (Rocky Linux 9). My deployment is an HCI deployment with ceph pacific deployed using ceph-ansible. it contains : - 03 controllers that contain also ceph mgr/mon/rgw/cephfs containers - 27 compute/storage nodes I am planning to follow these steps : 1. Upgrade to Rocky 9, starting with the controllers, then the compute/storage nodes. 1. Undeploy 1 controller at a time, upgrade to Rocky 9, re-deploy the controller. 2. Undeploy 3 compute/storage nodes at a time, upgrade to Rocky 9, redeploy the nodes. 2. Stop the Openstack platform 3. Convert the deployed ceph pacific from ceph-ansible to cephadm. 4. Upgrade from Yoga to ZED If you can help me with some insights/thoughts things to do / to avoid, so that the upgrade will move smoothly, that would be great. Regards.

5 5

[neutron] Bug Deputy Report December 11 - December 17
by Yatin Karel 17 Dec '23

17 Dec '23

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2046457 ovn provider fails with "AttributeError: 'Client' object has no attribute 'ports'" Antelope impacted with a recent patch Unassigned Low ---------- - https://bugs.launchpad.net/neutron/+bug/2046392 Service Type Framework cannot handle router flavor provider entry point shortcut with stevedore Assigned to Miguel Lavalle Undecided -------------- - https://bugs.launchpad.net/neutron/+bug/2046510 neutron-servers have high memory usage Report against stable/rocky, requested more information. -- Thanks and Regards Yatin Karel

1 0

[neutron] Cannot reach external network from within VM
by Michael J Turek 17 Dec '23

17 Dec '23

Hey all, We’ve been trying to get our Bobcat openstack cloud working and have been stuck on some networking woes. It’s a flat provider network with one compute node and one controller (plan to expand after this is resolved). 1) We can SSH and ping the VMs but only if we are on the controller and behind the qdhcp network namespace. 2) Once on the VM, we cannot reach the external network. We followed this installation guide [0] and nothing stands out as misconfigured. If anyone can offer some advice on how to debug this, it would be greatly appreciated. [0] https://docs.openstack.org/neutron/latest/install/controller-install-option…

4 6

Re: openstack-discuss Digest, Vol 62, Issue 59
by Kerem Çeliker 17 Dec '23

17 Dec '23

1 0

[release] Release countdown for week R-15, Dec 18-22
by Elõd Illés 15 Dec '23

15 Dec '23

Development Focus ----------------- The Caracal-2 milestone will happen in next month, on January 11th, 2024. 2024.1 Caracal-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/caracal/schedule.html for details. General Information ------------------- Please remember that libraries need to be released at least once per milestone period. At milestone 2, the release team will propose releases for any library that has not been otherwise released since milestone 1. Other non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. At milestone-2 we also freeze the contents of the final release. If you have a new deliverable that should be included in the final release, you should make sure it has a deliverable file in: https://opendev.org/openstack/releases/src/branch/master/deliverables/carac… You should request a beta release (or intermediary release) for those new deliverables by milestone-2. We understand some may not be quite ready for a full release yet, but if you have something minimally viable to get released it would be good to do a 0.x release to exercise the release tooling for your deliverables. See the MembershipFreeze description for more details: https://releases.openstack.org/caracal/schedule.html#c-mf Finally, now may be a good time for teams to check on any stable releases that need to be done for your deliverables. If you have bugfixes that have been backported, but no stable release getting those. If you are unsure what is out there committed but not released, in the openstack/releases repo, running the command "tools/list_stable_unreleased_changes.sh <cycle_name>" gives a nice report. Upcoming Deadlines & Dates -------------------------- Caracal-2 Milestone: January 11th, 2024 Előd Illés irc: elodilles @ #openstack-release

1 0

[cinder] Festival of XS reviews (15 Dec)
by Rajat Dhasmana 15 Dec '23

15 Dec '23

Hello Argonauts, We will be having our monthly festival of reviews this Friday i.e. 15th December (Friday) from 1400-1600 UTC. Following are the details: Date: 15th December, 2023 Time: 1400-1600 UTC Meeting link: https://meet.google.com/jqg-eigw-rku etherpad: https://etherpad.opendev.org/p/cinder-festival-of-reviews Thanks Rajat Dhasmana

1 1

[neutron] Meetings next few weeks
by Brian Haley 14 Dec '23

14 Dec '23

Hello Neutrinos: With company Holiday shutdowns over the next couple of weeks, just wanted to make sure everyone was aware of our meetings during that time, and of my availability. 12/19: Neutron meeting, chaired by Rodolfo 12/22: Neutron Drivers meeting, if necessary, chaired by Rodolfo 12/26: Neutron meeting cancelled 12/29: Neutron Drivers meeting cancelled 1/2: Neutron meeting, chaired by Rodolfo 1/5: Neutron Drivers meeting, if necessary, chaired by Rodolfo Thanks Rodolfo for doing this while I'm out! I am out the next three weeks, but will occasionally check-in to make sure nothing is on fire :) The first week of 2024 I will not be available at all, please ping other core reviewers in the #openstack-neutron channel with any questions. Thanks, and have a nice holiday break! -Brian, Neutron PTL

1 0

[neutron] Drivers meeting cancelled tomorrow
by Brian Haley 14 Dec '23

14 Dec '23

Hello Neutrinos: Due to the lack of agenda, Friday's drivers meeting is cancelled. Have a nice weekend! -Brian

1 0

[solum][tc][all] Solum project marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the solum project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on solum, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support solum to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902624 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[freezer][tc][all] Freezer marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the freezer project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on freezer, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support freezer to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902623 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[Thank You] OpenInfra Live: Large Scale Ops Deep Dive: Samsung SDS
by Kristin Barrientos 14 Dec '23

14 Dec '23

Hi everyone, Thanks for watching the latest Large Scale Ops Deep Dive episode with Dan Paik from Samsung, SDS. What a great way to wrap up OpenInfra Live for the year. In case you missed the episode, you can find it here: https://www.youtube.com/watch?v=RI9SwY8VdCY&t=1s Do you want to be on OpenInfra Live in 2024? Email me your pitch or fill out the form on ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>[1], and maybe we’ll see you on a future show! Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation [1] https://openinfrafoundation.formstack.com/forms/openinfralive

1 0

[blazar] Next IRC meeting cancelled
by Pierre Riteau 14 Dec '23

14 Dec '23

Hello, The next IRC meeting scheduled for December 28 is cancelled. We will meet again on January 11. I wish everyone a very happy holiday! Pierre Riteau (priteau)

1 0

[ironic] Why do we support RAID level 2?
by Dmitry Tantsur 14 Dec '23

14 Dec '23

Hi folks, I was going through our RAID support and noticed that we declare support for RAID level 2. Per wikipedia [1] it's an extremely rarely used level which offers little benefits. Does anyone remember why we use that? Will anyone cry if we drop it? My worry is officially supporting something that nobody can even test because of lack of hardware or real use case behind it. Dmitry [1] https://en.wikipedia.org/wiki/Standard_RAID_levels#RAID_2

2 1

[cinder]Cannot create volume from snapshot
by Nguyễn Hữu Khôi 14 Dec '23

14 Dec '23

Hello guys. I am using Openstack Yoga and Dell Powerstore 5000T When I create volume from a snapshot then I encounter this error cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] REST Response: 422 with data {"messages":[{"code":"0xE0A040010003","severity":"Error","message_l10n":"The clone cannot be created because the max number of clones: 32, in a family has been reached.","arguments":["32"]}]} ERROR cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] Failed to create clone volume-cc1fdd0b-8dd7-41a2-b63e-1f Do we have any guide about this? Or how we can increase the max number of clones? Thank you. Regards Nguyen Huu Khoi

3 6

[Octavia] Next weekly meetings cancelled
by Gregory Thiemonge 14 Dec '23

14 Dec '23

Hi Folks, As discussed yesterday during our weekly meeting, the next Octavia weekly meetings (Dec 20 and 27) are cancelled, the next meeting will be held on January 3rd. Thanks, Greg

1 0

[taskflow][all] Taskflow still using removed asyncore
by Thomas Goirand 14 Dec '23

14 Dec '23

Hi, As per this document: https://docs.python.org/3/whatsnew/3.12.html > Removed > asynchat and asyncore > > These two modules have been removed according to the schedule in > PEP 594, having been deprecated in Python 3.6. Use asyncio instead. > (Contributed by Nikita Sobolev in gh-96580.) Therefore, building the taskflow package (and many other packages that depends on it, like Cinder) fails. Can someone write a patch to get rid of the use of asyncore? Will using asincio instead fail because of our use of Eventlet? Cheers, Thomas Goirand (zigo)

3 2

RE: openstack-discuss Digest, Vol 62, Issue 44 Neutron - Issue Urgent
by Asma Naz Shariq 13 Dec '23

13 Dec '23

Hi Openstack Neutron Team, I have deployed Multinode cluster of Openstack through kolla-ansible zed release. The problem I am facing is instances created cannot pick any Ip addresses( Rather than loop back ip or ipv6 addresses) from the assigned networks which I have created provider and self-service flat network type. Hence, I may not be able to ping and ssh instance from the controller node and these instances won’t be able to connect to the internet. Can you guide me how to resolve these issues related to network connectivity so I may able to send you the required files to troubleshoot easily? Thanks -----Original Message----- From: openstack-discuss-request(a)lists.openstack.org <openstack-discuss-request(a)lists.openstack.org> Sent: Thursday, December 14, 2023 12:26 AM To: openstack-discuss(a)lists.openstack.org Subject: openstack-discuss Digest, Vol 62, Issue 44 Send openstack-discuss mailing list submissions to openstack-discuss(a)lists.openstack.org To subscribe or unsubscribe via email, send a message with subject or body 'help' to openstack-discuss-request(a)lists.openstack.org You can reach the person managing the list at openstack-discuss-owner(a)lists.openstack.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openstack-discuss digest..." Today's Topics: 1. What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Christian Rohmann) 2. Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Jonathan Rosser) 3. Re: [tripleo][ironic][wallaby] Partition Table: loop (Alexey Kashavkin) 4. Re: [all][tc][ptls] Eventlet: Python 3.12, and other concerning discoveries (Jay Faulkner) ---------------------------------------------------------------------- Message: 1 Date: Wed, 13 Dec 2023 18:00:46 +0100 From: Christian Rohmann <christian.rohmann(a)inovex.de> Subject: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss <openstack-discuss(a)lists.openstack.org> Message-ID: <a65d9057-67a2-4ab0-a2b6-fe327d185f06(a)inovex.de> Content-Type: text/plain; charset=UTF-8; format=flowed Hey openstack-discuss, I am a little confused about correct and required Ceph authx permissions for the RBD clients in Cinder, Glance and also Nova: When Glance is requested to delete an image it will check if this image has depended children, see https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. The children of Glance images usually are (Cinder) volumes, which therefore live in a different RBD pool "volumes". But if such children do exist a 500 error is thrown by Glance API. There also is an bug about this issue on Launchpad [3]. Manually using the RBD client shows the same error: > # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p > images children $IMAGE_ID > > 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 > librbd::image::OpenRequest: failed to retrieve name: (1) Operation not > permitted > 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: > 0x5639fdd5af60 failed to open image: (1) Operation not permitted > rbd: listing children failed: (1) Operation not permitted > 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: > list_descendants: failed to open descendant b7078ed7ace50d from pool > instances:(1) Operation not permitted So it's a permission error. Following either the documentation of Glance [1] or Ceph [2] on configuring the ceph auth caps there is no mention of granting anything towards the volume pool to Glance. So this is what I currently have configured: > client.cinder > key: REACTED > caps: [mgr] profile rbd pool=volumes, profile rbd-read-only > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=volumes, profile rbd-read-only > pool=images > > client.glance > key: REACTED > caps: [mgr] profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=images > > client.nova > key: REACTED > caps: [mgr] profile rbd pool=instances, profile rbd > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=instances, profile rbd > pool=images > When granting the glance client e.g. "rbd-read-only" to the volumes pool via: > > # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd > pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd > pool=images, profile rbd-read-only pool=volumes' > the error is gone. I am wondering through if this is really just a documentation bug (at OpenStack AND Ceph equally) and if Glance really needs read-only on the whole volumes pool or if there is some other capability that covers asking for child images. All in all I am simply wondering what the correct and least-privilege ceph auth caps for the RBD clients in Cinder, Glance and Nova would look like. Thanks Christian [1] https://docs.openstack.org/glance/latest/configuration/configuring.html#con… [2] https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-authen… [3] https://bugs.launchpad.net/glance/+bug/2045158 ------------------------------ Message: 2 Date: Wed, 13 Dec 2023 17:40:44 +0000 From: Jonathan Rosser <jonathan.rosser(a)rd.bbc.co.uk> Subject: Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss(a)lists.openstack.org Message-ID: <fb421a48-b0f6-4a6c-8d72-5b2ed8532b52(a)rd.bbc.co.uk> Content-Type: text/plain; charset=UTF-8; format=flowed Hi Christain, If you dig through the various deployment tooling then you'll find things like https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory… Hope this is helpful, Jonathan. On 13/12/2023 17:00, Christian Rohmann wrote: > Hey openstack-discuss, > > I am a little confused about correct and required Ceph authx > permissions for the RBD clients in Cinder, Glance and also Nova: > > When Glance is requested to delete an image it will check if this > image has depended children, see > https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. > The children of Glance images usually are (Cinder) volumes, which > therefore live in a different RBD pool "volumes". But if such children > do exist a 500 error is thrown by Glance API. There also is an bug > about this issue on Launchpad [3]. > > Manually using the RBD client shows the same error: > >> # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p >> images children $IMAGE_ID >> >> 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 >> librbd::image::OpenRequest: failed to retrieve name: (1) Operation >> not permitted >> 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: >> 0x5639fdd5af60 failed to open image: (1) Operation not permitted >> rbd: listing children failed: (1) Operation not permitted >> 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: >> list_descendants: failed to open descendant b7078ed7ace50d from pool >> instances:(1) Operation not permitted > > So it's a permission error. Following either the documentation of > Glance [1] or Ceph [2] on configuring the ceph auth caps there is no > mention of granting anything towards the volume pool to Glance. > So this is what I currently have configured: > >> client.cinder >> key: REACTED >> caps: [mgr] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> >> client.glance >> key: REACTED >> caps: [mgr] profile rbd pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=images >> >> client.nova >> key: REACTED >> caps: [mgr] profile rbd pool=instances, profile rbd >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=instances, profile rbd >> pool=images >> > > When granting the glance client e.g. "rbd-read-only" to the volumes > pool via: >> >> # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' >> > the error is gone. > > > I am wondering through if this is really just a documentation bug (at > OpenStack AND Ceph equally) and if Glance really needs read-only on > the whole volumes pool or if there is some other capability that > covers asking for child images. > > > All in all I am simply wondering what the correct and least-privilege > ceph auth caps for the RBD clients in Cinder, Glance and Nova would > look like. > > > > Thanks > > > Christian > > > > > [1] > https://docs.openstack.org/glance/latest/configuration/configuring.htm > l#configuring-the-rbd-storage-backend > [2] > https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-a > uthentication [3] https://bugs.launchpad.net/glance/+bug/2045158 > > > ------------------------------ Message: 3 Date: Thu, 14 Dec 2023 01:05:41 +0600 From: Alexey Kashavkin <akashavkin(a)gmail.com> Subject: Re: [tripleo][ironic][wallaby] Partition Table: loop To: Julia Kreger <juliaashleykreger(a)gmail.com> Cc: openstack-discuss(a)lists.openstack.org Message-ID: <0F672C26-BC74-4D16-92FC-292F1D2BF62F(a)gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BE0F9200-A2C4-458F-B2C4-31E6043ACAA2" Greetings Julia, Thank you so much for your reply and clarification. > On 12 Dec 2023, at 20:22, Julia Kreger <juliaashleykreger(a)gmail.com> wrote: > > Greetings Alexey, > > That would do it. Whenever we do not see a kernel/ramdisk with an image file, we assume it is a whole disk image, and as a result, we don't partition, we only write out what we've been provided. This is rooted in the image convention storage with Glance, because you need a kernel/ramdisk to boot a partition, but you can "just boot" a whole disk image. > > The disk utilities, in this specific case when you look at the disk, it thinks it is looking at a partition image on a loopback due to the lack of the partition table. > > That being said, whole disk images are the preferred path given you have greater flexibility in the partition/structure/layout of the deployed host. > > Hope that helps explain and provides the extra context. > > -Julia > > > > On Tue, Dec 12, 2023 at 2:56 AM Alexey Kashavkin <akashavkin(a)gmail.com <mailto:akashavkin@gmail.com>> wrote: >> I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

1 0

Re: [tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 13 Dec '23

13 Dec '23

I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

2 2

[Reminder] OpenInfra Live: Large Scale Ops Deep Dive Ft: Samsung SDS Dec. 14 at 15UTC
by Kristin Barrientos 13 Dec '23

13 Dec '23

Hi Everyone, Tune in this week for another episode of OpenInfra Live, brought to you by the Large Scale SIG. Episode: In the "Large Scale Ops Deep Dive" series, a panel of OpenStack operators invites special guests to talk about their deployment and discuss their operations. For this episode, our guest will be Dan Paik from Samsung SDS. Date and time: Thursday, Dec 14, 15 UTC YouTube: https://www.youtube.com/watch?v=RI9SwY8VdCY LinkedIn:https://www.linkedin.com/events/7125892582139654144/comments/ WeChat: The recording will be posted on OpenInfra Foundation WeChat after the live stream Speakers: Dan Paik, Arnaud Morin, Felix Huettner, Thierry Carrez, Kristin Barrientos Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation

1 0

openstack cinder client help
by garcetto 13 Dec '23

13 Dec '23

good afternoon, i am trying to use the openstackclient ( https://docs.openstack.org/newton/user-guide/common/cli-install-openstack-c…) but it seems than I cannot use it to see cinder volume snapshot, even the doc say it is possible ( https://docs.openstack.org/python-openstackclient/latest/cli/decoder.html#c… ) [image: image.png] it says " (my-virt-env) user@ostack:~$ openstack snapshot list openstack: 'snapshot list' is not an openstack command. See 'openstack --help'. Did you mean one of these? endpoint add project endpoint create endpoint delete endpoint group add project endpoint group create ... " what am i missing? thank you.

3 2

[keystone] Keystone integration with Keycloak
by Franciszek Przewoźny 13 Dec '23

13 Dec '23

Hi all, I'm having some troubles integrating Keystone with Keycloak - pulling username and email from Keycloak using OIDC to Keystone works fine, but pulling groups (list of groups) doesn't. Keycloak provides such data in userinfo (pulled from Google, mapped in Keycloak and added to user): "usergroups": [ "group-a", "group-b", ], Keystone seems to be getting group names, but incorrectly parsing (?) it to a string with commas (instead of semicolon as it's required for multiple group entries to work: https://docs.openstack.org/keystone/latest/admin/federation/mapping_combina…) 2023-12-13 08:22:13.399 1076680 DEBUG keystone.federation.utils [None req-e8b8519a-c639-450e-b4e7-ca2ea8a0f3bc - - - - - -] updating a direct mapping: ['group-a,group-b'] _verify_all_requirements /usr/lib/python3/dist-packages/keystone/federation/utils.py:867 And tries to map user to group with names group-a,group-b: 2023-12-13 09:42:54.914 1084357 DEBUG keystone.federation.utils [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] mapped_properties: {'user': {'name': 'xxxxxxxx', 'email': 'xxxxxxx(a)yyyy.zzz', 'domain': {'id': 'default'}, 'type': 'ephemeral'}, 'group_ids': [], 'group_names': [{'name': 'group-a,group-b', 'domain': {'id': 'default'}}], 'projects': []} process /usr/lib/python3/dist-packages/keystone/federation/utils.py:562 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] 'method' object is not subscriptable: TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application Traceback (most recent call last): 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1513, in full_dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application rv = self.dispatch_request() 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1499, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 467, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = resource(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/views.py", line 83, in view 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.dispatch_request(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 582, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = meth(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/server/flask/common.py", line 1064, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return f(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 386, in get 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self._perform_auth(idp_id, protocol_id) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 380, in _perform_auth 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application token = authentication.federated_authenticate_for_token( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 251, in federated_authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return authenticate_for_token(auth) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 185, in authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application authenticate(auth_info, auth_context) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 152, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = method.authenticate(auth_info.get_method_data(method_name)) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 59, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application response_data = handle_unscoped_token(auth_payload, 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 225, in handle_unscoped_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application mapped_properties, mapping_id = apply_mapping_filter( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 321, in apply_mapping_filter 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application utils.validate_mapped_group_ids(group_ids, mapping_id, identity_api) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application My current setup: Google (user and groups membership) OIDC -> Keycloak OIDC -> Keystone Mapping rules (without parameters related to group settings works fine): [ { "local": [ { "user": { "name": "{0}", "email": "{1}", "domain": { "id": "default" } } }, { "group": { "name": "{2}", "domain": { "id": "default" } } } ], "remote": [ { "type": "OIDC-preferred_username" }, { "type": "OIDC-email" }, { "type": "OIDC-usergroups" } ] } ] WSGI Apache: ## WSGI configuration WSGIApplicationGroup %{GLOBAL} WSGIDaemonProcess keystone display-name=keystone group=keystone processes=4 threads=1 user=keystone WSGIProcessGroup keystone WSGIScriptAlias / "/usr/lib/cgi-bin/keystone/keystone" WSGIPassAuthorization On LoadModule auth_openidc_module modules/mod_auth_openidc.so OIDCClaimPrefix "OIDC-" OIDCResponseType "id_token" OIDCScope "openid email profile" OIDCProviderMetadataURL "https://keycloak.yyyy.zzz/realms/master/.well-known/openid-configuration <https://keycloak.opera.software/realms/master/.well-known/openid-configurat…>" OIDCClientID "openstack" Any help appreciated! Thanks in advance, Franciszek Przewoźny

1 1

[all][tc][cinder] deprecating cinderlib
by Brian Rosmaita 13 Dec '23

13 Dec '23

As discussed at our midcycle meeting last week [0], the Cinder project team hereby announces the deprecation of cinderlib, a library that allows the direct usage of Cinder backend drivers without the cinder services. Cinderlib is a cycle-trailing release, and thus this announcement comes on the heels of the 2023.2 (Bobcat) release of cinderlib, which happened just last week. The Cinder project team will continue to support cinderlib in the stable Maintained branches for their normal lifecycles, as specified by the OpenStack Stable Branch Policy: - stable/2023.2: end of maintenance Spring 2025 - stable/2023.1: end of maintenance Fall 2024 - stable/zed: end of maintenance Spring 2024 The stable/victoria through stable/yoga branches are in Unmaintained status. If you have questions or concerns about the deprecation of cinderlib, please reply to this email or leave a comment on the governance patch: https://review.opendev.org/c/openstack/governance/+/903259 Thank you for your attention to this matter. [0] https://wiki.openstack.org/wiki/CinderCaracalMidCycleSummary

2 1

[openstack-ansible] December and January meetings schedule
by Neil Hanlon 12 Dec '23

12 Dec '23

Hello all, and happy holidays :) The OSA team will be skipping our regularly scheduled meetings on December 26th and January 2nd due to the Christmas/New Year festivities. We'll be meeting once more before the end of the year, next Tuesday, December 19th. Thank you, and I wish you all the best in 2024! Cheers, Neil

1 0

System configuration in OpenStack
by lostghost1＠yandex.ru 12 Dec '23

12 Dec '23

Hi all, Sorry if this has been asked already, but is it feasible to use OpenStack to configure running systems - including virtual instances, containers, and the physical nodes themselves. I know that conceptually OpenStack takes a hands-off approach - it deals with images in abstract and further configuration is delegated to tools such as Ansible. Same for bare metal nodes - you provision them with Ironic, flash an image to them, and that's where configuaration ends for OpenStack. At least this is how I understand it, may be wrong. I was thinking about introducing systems configuration as a first-class concept into OpenStack - that means integration with the package manager, writing of config files from templates, filesystem management in general. The most well thought-out "solution" that there is for systems configuration is Nix in my opinion. I could intergrate it into OpenStack, I could write my own package manager. I haven't decided yet, these are just ideas for a pet project. So if I were to do such a thing, how would I go about achieving it? Obviously I would need to write a Horizon console module for the web UI. But beyond that I'd also need integration with other components. What do you all think?

3 6

[publiccloud-sig] Reminder - next meeting December 13th - 0800 UTC
by Felix Kronlage-Dammers 11 Dec '23

11 Dec '23

Hi everyone, This Wednesday the next meeting of the public cloud sig is going to happen. Since we do every other meeting as a videosession, we’ll be meeting at 0800 UTC here: https://conf.scs.koeln:8443/OIF-public-cloud-sig We’re going to continue our discussion on user stories for the discoverability of flavors and alike. Please see https://etherpad.opendev.org/p/publiccloud-sig-meeting for further infos. See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG See you tomorrow! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

Issuse with OVN DVR generate too much flow on compute node
by Sang Tran Quoc 11 Dec '23

11 Dec '23

Hi OpenStack Community, I've indicated very weird behavior about ovn flows when VM is associated with vrouter, I use one new compute node with only 1 VM for testing and result as below: * When VM attach to vRouter without external network: Only add new 2047 flows. * When vRouter attach to external network (provider-net2): It will generate 147k flows immediately ? * We've tested with VM direct attach to provider-net2 also generate 147k flows. [cid:image001.png@01DA2D02.780FB210] My environment is OpenStack Victoria version, neutron deployed with OVN, DVR, Distributed FIP mode, and provider-net2 using VLAN setup. The problems lead to the heavily process of sync flow which slows down the normal VM operations and packet drop a little bit while update large flow on the ovswitch. Could anyone has experienced this behavior before or have a solution config/patch neutron to address this? Any suggestions are highly appreciated. Thank and regards, Sang Tran

1 0

Re: [URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 11 Dec '23

11 Dec '23

Hey team, Thanks for those who replied off list. Thankfully we figured it out, it was due to underlying resolver config mysterious mulching AAAA records instead of requesting A records… Probably goes to say, Openstack needs to have some seriously heavier logging 😃 haha. Thanks! Karl. From: Dmitriy Rabotyagov <noonedeadpunk(a)gmail.com> Date: Tuesday, 12 December 2023 at 5:35 pm To: Karl Kloppenborg <kkloppenborg(a)resetdata.com.au> Subject: Re: [URGENT] - Help needed with open stack services hung Hey, > stopping services from processing requests I assume this means that services are started and do not report any errors in logs? What happens with requests themselves? Are they answered with error or just hang? Also how environment was deployed? Some deployment tooling or manually with packages, k8s? On Tue, Dec 12, 2023, 05:30 Karl Kloppenborg <kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au>> wrote: Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

[tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 11 Dec '23

11 Dec '23

I have an issue with nodes provisioning. All my nodes are getting a partition table - loop. I forcefully specified 'disk_label:gpt/msdos' in the capabilities properties, but it didn't help. I can't figure out at what moment it creates a partition for the entire disk size: Model: Virtio Block Device (virtblk) Disk /dev/vda: 53.7GB Sector size (logical/physical): 512B/512B Partition Table: loop Disk Flags: Number Start End Size File system Flags 1 0.00B 53.7GB 53.7GB xfs This causes the following error: Failed to check the number of primary partitions present on /dev/vda for node 8d5ed008-efea-4df7-a190-aab8274a3bd5. Error: The device /dev/vda does not have a valid MBR partition table I tried to find in the ironic documentation where exactly a partition can be partitioned to the whole disk, but I couldn't find it. Perhaps it is somehow affected by the fact that 'is_whole_disk_image = true' is specified in the deployment process. I also have an x86_64 host as a compute node, it boots in legacy mode. I got the image for it from here - https://images.rdoproject.org/centos8/wallaby/rdo_trunk/current-tripleo/ I also get the same error on it. What could affect this? Full log of one of the nodes - https://pastebin.pl/view/5a6a7587 Node Show output of this node - https://pastebin.pl/view/ec5950b6

1 0

[URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 11 Dec '23

11 Dec '23

Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

Individual Board Director nominations: 3d left
by Kurt Garloff 11 Dec '23

11 Dec '23

Hi, the Open Infra communities have many strengths. One of them is a well-balanced board of directors that has representatives from all member classes, the Platinum members, the Gold members, and from individuals [1] that are part of the communities and elected -- each class contributing 1/3 of the seats.[4] I am worried about the individual class though: There are currently only 3 candidates that have enough nominations to be on the ballot [2]. 3 more needing a few more nominations. But I believe there should be a few more candidates on the ballot, otherwise it becomes an election without choice, something that is not good IMVHO. So please identify individuals that want to serve and nominate [3] them. This makes the elections meaningful and allows the board to do its work with also the individual members well represented. And there are only 3 more days to go for this! [1] https://openinfra.dev/election/2024-individual-director-election [2] https://openinfra.dev/election/2024-individual-director-election/candidates [3] https://openinfra.dev/a/community/members [4] https://openinfra.dev/about/board/ Thanks, -- Kurt Garloff <openstack(a)garloff.de>, Cologne CTO Sovereign Cloud Stack project @ OSB Alliance e.V.

2 1

[kolla] [2023.1] [masakari] Orphaned instances on node shutdown
by Rob Jefferson 11 Dec '23

11 Dec '23

Folks, I'm running into an issue with instances appearing to be running, even though they shouldn't be. The environment in this case is a virtualized OpenStack Kolla (2023.1) cluster, with three compute nodes and three control plane nodes. I am trying to see what happens when I create and terminate instances, in an attempt to figure out failover behavior. The three computes are in a single segment. I created four instances: +--------------------+--------+---------------------------+ | Name | Status | Host | +--------------------+--------+---------------------------+ | rj_testinstance_04 | ACTIVE | devtest-libvirt1-muon1005 | | rj_testinstance_03 | ACTIVE | devtest-libvirt1-muon1004 | | rj_testinstance_02 | ACTIVE | devtest-libvirt1-muon1006 | | rj_testinstance | ACTIVE | devtest-libvirt1-muon1005 | +--------------------+--------+---------------------------+ I decided to see what would happen if I went in and shutdown devtest-libvirt1-muon-1005 (which has two instances running). So I ssh'd into the machine and entered (as root): `echo c > /proc/sysrq-trigger` to force a crash, which duly occurred. I then made sure the host was seen as down: +---------------------------+-------+ | Hypervisor Hostname | State | +---------------------------+-------+ | devtest-libvirt1-muon1005 | down | | devtest-libvirt1-muon1004 | up | | devtest-libvirt1-muon1006 | up | +---------------------------+-------+ But even after this, the instances seem to still be up, including on the now crashed machine: +--------------------+--------+---------------------------+ | Name | Status | Host | +--------------------+--------+---------------------------+ | rj_testinstance_04 | ACTIVE | devtest-libvirt1-muon1005 | | rj_testinstance_03 | ACTIVE | devtest-libvirt1-muon1004 | | rj_testinstance_02 | ACTIVE | devtest-libvirt1-muon1006 | | rj_testinstance | ACTIVE | devtest-libvirt1-muon1005 | +--------------------+--------+---------------------------+ I would have expected the instances to have been regenerated on other compute hosts, or some sort of error. The nodes are on the same segment, so Masakari should have at least attempted to roll over the instances to other computes in the segment. But checking the instance details suggests that nothing has happened. The instances are just... lost. The Masakari host monitor log file reflects reality: 2023-12-11 19:21:49.953 8 INFO masakarimonitors.hostmonitor.host_handler.handle_host [-] 'devtest-libvirt1-muon1005' is 'offline' (current: 'offline'). Needless to say, I'm very confused here and am sure what's going on. Any advice would help. Thanks, Rob

1 1