May 2023 - openstack-discuss - lists.openstack.org

[OpenvSwitch][Neutron] native flow based firewall Vs LinuxBridge Iptables firewall
by Satish Patel 02 May '23

02 May '23

Folks, As we know, openvswitch uses a linuxbridge based firewall to implement security-groups on openstack. It works great but it has so many packet hops. It also makes troubleshooting a little complicated. OpenvSwitch does support native firewall features in flows, Does it mature enough to implement in production and replace it with LinuxBridge based IPtables firewall? ~S

3 3

[tc] Reminder: 2023-05-10 OpenInfra Board Sync
by Jeremy Stanley 02 May '23

02 May '23

The Open Infrastructure Foundation Board of Directors is endeavoring to engage in regular check-ins with official OpenInfra projects. The goal is for a loosely structured discussion one-hour in length, involving members of the board and the OpenStack TC, along with other interested community members. This is not intended to be a formal presentation, and no materials need to be prepared in advance. I've started an Etherpad where participants can brainstorm potential topics of conversation, time-permitting: https://etherpad.opendev.org/p/2023-05-board-openstack-sync As previously announced[*], we're planning to hold the next call at 20:00 UTC on Wednesday, May 10. A link to the conference bridge will be added to the pad prior to that time. [*] https://lists.openstack.org/pipermail/openstack-discuss/2023-April/033244.h… -- Jeremy Stanley

1 0

[horizon][nova][masakari] Instances created with "Any AZ" problem
by Nguyễn Hữu Khôi 02 May '23

02 May '23

Hello guys. I playing with Nova AZ and Masakari https://docs.openstack.org/nova/latest/admin/availability-zones.html Masakari will move server by nova scheduler. Openstack Docs describe that: If the server was not created in a specific zone then it is free to be moved to other zones, i.e. the AvailabilityZoneFilter <https://docs.openstack.org/nova/latest/admin/scheduling.html#availabilityzo…> is a no-op. I see that everyone usually creates instances with "Any Availability Zone" on Horzion and also we don't specify AZ when creating instances by cli. By this way, when we use Masakari or we miragrated instances( or evacuate) so our instance will be moved to other zones. Can we attach AZ to server create requests API based on Any Availability Zone to limit instances moved to other zones? Thank you. Regards Nguyen Huu Khoi

5 20

[kolla-ansible][all][nova][zed][latest] USB passthrough / Hot-plug / Cold-plug
by Modyngs 02 May '23

02 May '23

090c090cFolks, A USB device (not necessarily a mass/Flash drive) needs to be connected to one of the VMs (an openstack instance). Openstack installed with kolla-ansible{Latest version/ Also tested on Zed} ALL IN ONE Deployments on ubuntu server 22.04 ( Core i9 12900K). I found the [nova-libvirt] container which contains *virsh *and is able to edit it or use custom config for VMs. I've gone through lots of the docs, to name a few: https://libvirt.org/formatdomain.html https://wiki.openstack.org/wiki/Nova/USB_device_hot_cold_plug https://wiki.openstack.org/wiki/Nova/proposal_about_usb_passthrough https://documentation.suse.com/sles/15-SP1/html/SLES-all/cha-libvirt-config… https://wiki.openstack.org/wiki/Nova/USB_device_hot_cold_plug https://docs.nxp.com/bundle/GUID-487B2E69-BB19-42CB-AC38-7EF18C0FE3AE/page/… but none of them worked for me!! To reproduce: *Cold-Plug :* *$ lsusb (on host)* Bus 001 Device 014: ID 090c:1000 Silicon Motion >>>> Note Device number changed every time I disconnect the device. So it might be different in the changed attempt shown below) *$ docker exec -it nova_libvirt /bin/bash* *%Turn the Desired VM off* *# virsh list --all* Id Name State --------------------------------------------- 2 instance-00000002 running 19 instance-00000008 running - instance-0000000a shut off *# virsh edit instance-0000000a* Add the changes [1][2][3][4],... ( many efforts have been done but few samples of them are) [1]: under <devices> added <hostdev mode='subsystem' type='usb'> <source> <vendor id='0x090c'/> <product id='0x1000'/> </source> </hostdev> [2]:under <devices> added <controller type='usb' index='0'/> <hostdev mode='subsystem' type='usb'> <source> <vendor id='0x090c'/> <product id='0x1000'/> </source> </hostdev> [3]: under <devices> added <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x090c'/> <product id='0x1000'/> </source> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </hostdev> [4]: under <devices> added <controller type='usb' model='nec-xhci' index='0'/> <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x090c'/> <product id='0x1000'/> </source> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </hostdev> [5]: <controller type='usb' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/> </controller> <hostdev mode='subsystem' type='usb' managed='yes'> <source> <vendor id='0x090c'/> <product id='0x1000'/> </source> <address type='usb' bus='1' port='2'/> <controller type='usb' index='0'/> </hostdev> *%Start the VM* *expected behavior:* when login to the VM, lsusb or df -h shows the USB *what happened:* it wont show the USB from the VM *OR *virsh dumpxml instance-0000000a > instance-0000000a.xml and then change the configs as above and then virsh attach-device instance-0000000a --file /path/to/updated-instance-0000000a.xml --config *Hot-Plug :* *$ lsusb (on host)* Bus 001 Device 014: ID 090c:1000 Silicon Motion >>>> Note Device number changed every time I disconnect the device. So it might be different in the changed attempt shown below) *$ docker exec -it nova_libvirt /bin/bash* *# virsh list --all* Id Name State --------------------------------------------- 2 instance-00000002 running 19 instance-00000008 running 20 instance-0000000a running *#nano USB.xml* *%add changes explained in *[1][2][3][4],... *$ virsh attach-device instance-0000000a /path/to/USB.xml/file* *expected behavior:* lsusb or df -h shows the USB *what happened:* it wont show the USB from the VM *Can you please guide me through this? Any recommendation would be much appreciated!Any custom changes comes to your mind ( Reply it) would be solution for this problem /;* Thanks Best regards

2 1

[cinder][kolla][OpenstackAnsible] 2023.1 Antelope Cycle-Trailing Release Deadline
by Elõd Illés 02 May '23

02 May '23

Hello teams with trailing projects, The 2023.1 Antelope cycle-trailing release deadline is in ~1 months [1], and all projects following the cycle-trailing release model must release their 2023.1 Antelope deliverables by June 1st, 2023. The following trailing projects haven't been released yet for 2023.1 Antelope (aside the release candidates versions if exists). Cinder team's deliverables: - cinderlib OSA team's deliverables: - openstack-ansible-roles - openstack-ansible Kolla team's deliverables: - kayobe - kolla - kolla-ansible - ansible-collection-kolla This is just a friendly reminder to allow you to release these projects in time. Do not hesitate to ping us if you have any questions or concerns. [1] https://releases.openstack.org/bobcat/schedule.html#b-cycle-trail Thanks, Előd irc: elodilles @ #openstack-release

1 0

[openstack-helm] Cancelling monthly meetings
by Vladimir Kozhukalov 02 May '23

02 May '23

Dear Openstack-helmers, I would like to announce that we are going to stop having monthly IRC meetings due to the lack of interest. There are two major concerns: 1) It is usually not a good idea to wait few weeks for the next meeting to happen if you have something to discuss 2) If only few people are attending the meeting then it is anyway not enough to have a strong community consensus and to make any important decisions We discussed this a couple months ago in the IRC meeting and now it is time to do the next step and to cancel it. So, if you have something to discuss please feel free to start the discussion directly in the #openstack-helm Slack chat (Slack is our preferable way of communication). Today's meeting (May/02/2023) is also canceled. -- Best regards, Kozhukalov Vladimir

1 0

[tripleo] hold rechecks content provider gate blocker - CentOS-9 stream mirrors
by Ronelle Landy 02 May '23

02 May '23

Hello All, We have a check/gate blocker impacting all CentOS-9 jobs. Details are in: https://bugs.launchpad.net/tripleo/+bug/2018265 - CentOS-9 stream mirrors are returning Status code: 404. Per https://review.opendev.org/868392 - the Rackspace mirrors are being used to sync CentOS-9 repos - so possibly there is a lag/roll back there. We will post out once there is a fix/workaround or if the situation gets unblocked dueto an update. Thank you.

1 1

Offline Openstack Release:Train Deployment
by Vineet Thakur 02 May '23

02 May '23

Greetings openstack community members, It's regarding the deployment of openstack release: train on CentoOS 7.9 environment by using openstack-ansible tool. (Offline environment) We are facing challenges to download the packages, some package links are not accessible or somewhere PIP packages are not available as per the constraint requirement list. See: https://artifacts.ci.centos.org/sig-cloudinstance/centos-7-191001/x86-64/ce… For pip packages: https://opendev.org/openstack/requirements/raw/0cfc2ef6318b639bb4287fa051ea… During installation we are facing a lot of errors, and not sure what would be the best approach in such scenarios where packages are not available or need to be downloaded from random sites. We are in the mid of a mega deployment and appreciate it if you can guide us through. Awaiting your response, thank you. Kind Regards, Vineet Thakur

3 3

[tc] Technical Committee next weekly meeting on May 2, 2023
by Nikolla, Kristi 01 May '23

01 May '23

Hi all, This is a reminder that the next weekly Technical Committee meeting is to be held tomorrow (May 2) at 1800 UTC on Zoom. Items can be proposed by editing the wiki page at https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting At the end of today I will send out an email with the finalized agenda. Thank you, Kristi Nikolla

1 1

[kolla-ansible] How to test local docker registry
by Satish Patel 01 May '23

01 May '23

Folks, I have 3 controller nodes and on controller01 I have configured the local registry and pushed all images into the local registry. I have pointed out 2 other nodes to use controller01 local registry. When i run "kolla-ansible -i multinode deploy" it works on controller01 and docker start all containers but one controller02 and 03 I encounter error related docker registry Error: https://paste.opendev.org/show/bmwbM3PB33a8hrA1Wi6e/ docker daemon.json file on controller02 and 03 (docker-reg is point to controller01) root@controller02:~# cat /etc/docker/daemon.json { "bridge": "none", "insecure-registries": [ "docker-reg:4000" ], "ip-forward": false, "iptables": false, "log-opts": { "max-file": "5", "max-size": "50m" } How do I check my docker registry is functioning? I have tried following commands on 02 and 03 nodes but following error. root@controller02:~# docker pull docker-reg:4000/openstack.kolla/ubuntu-source-fluentd Using default tag: latest Error response from daemon: manifest for docker-reg:4000/openstack.kolla/ubuntu-source-fluentd:latest not found: manifest unknown: manifest unknown Are there any way to test if my registry is functional and nothing wrong. There are no network issues. I have a test with port ping using the nc command.

1 1