January 2024 - openstack-discuss - lists.openstack.org

[nova] Help with support to SGX
by Winicius Allan 05 Feb '24

05 Feb '24

Hello o/ Anyone already work with Nova to provide VMs with SGX support?

6 7

[all] SQLAlchemy 2.x support in Bobcat
by Thomas Goirand 02 Feb '24

02 Feb '24

Hi, As you may know, and to my great frustration, I'm not the maintainer of SQLAlchemy in Debian, even though OpenStack is the biggest consumer of it. The current maintainer insists that he wants to upload SQLA 2.x in Unstable, potentially breaking all of OpenStack. At the present moment, if I understand correctly, we're not there yet, and Bobcat doesn't have such a support. It would be ok for me, *IF* there are patches available on master, that I could backport to Bobcat and maintain in the debian/patches folder of each project. However, the biggest current annoyance, is that I have no idea where we are at. Are we close to such a support? Is there a list of patches to apply on top of Bobcat that is maintained somewhere? Please enlighten me... :) Cheers, Thomas Goirand (zigo)

5 10

RE: [cinder] Inactive 3rd party CIs
by Roquesalane, Jean-Pierre 02 Feb '24

02 Feb '24

Thanks Takashi for driving this. As far as Dell is concerned, those CIs should be marked as unsupported as they are now EOL. * DellEMC SC CI * DellEMC VNX CI * DellEMC XtremIO CI I'll have the CI team to take a look at the Dell PowerMax CI which is supposed to be active. JP Jean-Pierre Roquesalane SW System Sr Principal Engineer - OpenStack Champion Dell Technologies | Security and Ecosystem Software Mobile +33 6 21 86 79 04<tel:1-613-314-8106> Email : jeanpierre.roquesalane(a)dell.com<mailto:jeanpierre.roquesalane@dell.com> [cid:image001.png@01DA545A.5A50B740] Dell SAS, Si?ge Social 1 rond point Benjamin Franklin 34000 Montpellier. Capital 1,946,545.26 Euros, 351 528 229 RCS Montpellier -APE 4651Z -TVA Intracommunautaire FR 20 351 528 229. SIRET 351 528 229 00088 Vat Number : FR 20351528229 (France) / IT00001709997 (Italy) / ESN0012622G (Spain) Internal Use - Confidential

3 7

Re: [kolla-ansible][magnum] question
by Oliver Weinmann 01 Feb '24

01 Feb '24

Hi Franck, glad that I was able to help. Sorry I don't know about this one. But a quick google revealed this: https://docs.fedoraproject.org/en-US/fedora-coreos/sysconfig-configure-swap… Looks as if the FCOS image has this enabled somehow. I have updated my blogpost on CAPI in MAGNUM. It is finally working and its way faster to deploy Kubernetes. This will no longer use FCOS images but Ubuntu or FLATCAR. Maybe you want to give it a try: https://www.roksblog.de/openstack-magnum-cluster-api-driver/ Have a nice weekend. Cheers, Oliver Am 05.01.2024 um 17:07 schrieb Franck VEDEL: > Hi Oliver. > Thanks for you help !! > > I took the time to consult the help concerning > Magnum(https://docs.openstack.org/magnum/2023.1/user/) and this > article > (https://www.roksblog.de/deploy-kubernetes-clusters-in-openstack-within-minu…) > > > > I understood a lot of things, even though I'm not a Kubernetes expert. > Everything works as I wanted, except for one detail. > Do you know why we get this type of message (and quite a few minutes > to wait) when creating a node: > Capture d’écran 2024-01-05 à 15.43.04.png > > zram_generator…………. no configuration found. > > This is the last point that I cannot improve. Maybe there's nothing we > can do. > Thank you once again, that’s really very nice. > > > Franck VEDEL > > > > >> Le 3 janv. 2024 à 12:26, Oliver Weinmann <oliver.weinmann(a)me.com> a >> écrit : >> >> Hi Franck, >> >> Great. Glad it works. That is the k8s version and the url where >> magnum will pull the container from. The official docs are quite >> helpful. In the latest Openstack release bobcat there is already some >> support for CAPI. It is not 100% working out of the Box but it looks >> very promising. I have taken my blog post offline since I didn’t >> manage to get it working. But I will look into it again in the next >> couple of days. >> >> Cheers, >> Oliver >> >> Von meinem iPhone gesendet >> >>> Am 03.01.2024 um 12:21 schrieb Franck VEDEL >>> <franck.vedel(a)univ-grenoble-alpes.fr>: >>> >>> Hi Oliver, >>> and thanks a lot for your help. >>> I followed the instructions on the blog and indeed, with [trust] it >>> works. >>> I'm trying to understand everything. what are the parameters for: >>> >>> |--labels kube_tag=v1.21.11-rancher1,hyperkube_prefix=docker.io/rancher/| >>> >>> Thanks in advance >>> >>> Franck >>> >>> >>> >>>> Le 25 déc. 2023 à 19:26, Franck VEDEL >>>> <franck.vedel(a)univ-grenoble-alpes.fr> a écrit : >>>> >>>> Hi Oliver and thanks you for this help. >>>> >>>> I was wrong in my explications. >>>> I had seen this article (roksblog.de ) and I did what it said: >>>> I first tried: >>>> enable_cluster_user_trust = True in globals.yml >>>> It didn't work. >>>> >>>> I then made the modification in /etc/kolla/config/magnum.conf: >>>> cluster_user_trust = True >>>> >>>> Same problem. >>>> >>>> That's why I asked the question. Is this really the way to do it? >>>> If so, I will have to restart the containers (keystone?) >>>> >>>> Franck >>>> >>>> >>>> >>>>> Le 25 déc. 2023 à 18:40, Oliver Weinmann <oliver.weinmann(a)me.com> >>>>> a écrit : >>>>> >>>>> Hi Frank, >>>>> >>>>> According to the official kolla docs the option needs to be in >>>>> globals.yml >>>>> >>>>> Ensure that you understand the consequences before enabling this >>>>> option. In|globals.yml|: >>>>> >>>>> In case this also doesn’t work, you can try: >>>>> >>>>> yoga) [vagrant@seed ~]$ cat /etc/kolla/config/magnum.conf >>>>> [trust] >>>>> cluster_user_trust = True >>>>> >>>>> *www.roksblog.de >>>>> >>>>> Cheers, >>>>> Oliver >>>>> >>>>> Von meinem iPhone gesendet >>>>> >>>>>> Am 25.12.2023 um 18:10 schrieb Franck VEDEL >>>>>> <franck.vedel(a)univ-grenoble-alpes.fr>: >>>>>> >>>>>> enable_cluster_user_trust = True >>>> >>> >

2 2

Keystone LDAP backend: need to change user_id_attribute from CN to SAMAccountName
by Michel Jouvin 01 Feb '24

01 Feb '24

Hi, For historical (and bad) resons, we decided 10 years ago when we created our cloud that the Keystone LDAP backend will use the CN as the user_id_attribute rather than the usual SAMAccountName. Since then it has been a source of various problems with CN changes, accented characters in CN... We'd like to change it to SAMAccountName but there is clearly no easy/supported way of doing it and we are looking for some information on the best way to do it and the risks if somebody has some clues... It should impact ~30 users so not a huge number... What we have in mind is basically: - Change the backend attribute - Import new accounts - Assign the new accounts to the same projects as the ol accounts, with the same role One of the foreseen problemsis that old and new accounts will share the same user_name_attribute, based on SAMAccountName. It is not allowed by openstack if I'm right so for the scenario to work we need to change the user_name_attribute of old accounts to something different (we don't care that the user cannot use the account during the transition peroid as long as it doesn't impact active resources). Is it enough to update it in the database? We'd prefer to keep the old accounts in OpenStack until the end of the transition... Another minor issue is the reassignment of keypairs to the new account. It is poosble to ask the user to reload its public keys but we were wondering it there was a not too risky way of doing it for him/her by updating the DB (I guess there is no API for this). Thanks in advance if you have any thought/information to share. Best regards. Michel

3 5

sqlite vs NULL
by Pete Zaitcev 01 Feb '24

01 Feb '24

Greetings: In short: Should it be possible to select by key that is NULL in our DBs? This is needed for Cinder, review 657543[1]. Tests run on sqlite. Long explanation: The review tinkers with SQL Alchemy's query, so it may be doing it wrong. However, I looked at the queries and this seems to happen. A query for everything finds the NULL entry. The query looks like this: SELECT backups.created_at AS backups_created_at, (... very many AS ...) FROM backups LEFT OUTER JOIN backup_metadata AS backup_metadata_1 ON backup_metadata_1.backup_id = backups.id AND backup_metadata_1.deleted = false WHERE backups.deleted = false AND backups.host = %(host_1)s So, the entry is in the database. However, this one returns everything that matches the arguments, but not the one with key of NULL: SELECT backups.created_at AS backups_created_at, (... very many AS ...) FROM backups LEFT OUTER JOIN backup_metadata AS backup_metadata_1 ON backup_metadata_1.backup_id = backups.id AND backup_metadata_1.deleted = false WHERE backups.deleted = false AND backups.status IN (%(status_1)s, %(status_2)s, %(status_3)s, %(status_4)s, %(status_5)s, %(status_6)s, NULL) AND backups.host = %(host_1)s ORDER BY backups.created_at DESC, backups.id DESC The backup with a NULL status is in the DB, but I cannot get it with objects.BackupList.get_all(ctxt, filters={'status': (None,)}) One other thing: Is there an easy way to make negative query through SQLalchemy? My real task is to find all the backups that are not stable (complete and error), so that I can restart it. Thanks for any suggestions, -- Pete [1] https://review.opendev.org/c/openstack/cinder/+/657543

3 3

Cinder Bug Report 2024-01-31
by Jon Bernard 31 Jan '24

31 Jan '24

Hello Argonauts, Apologies for the hiatus. Between holidays, snow days, and sick days, January has been quite a month. Here are current bugs for this week, we will resume the bug meetings after the weekly upstream meeting next week. Cinder Bug Meeting Etherpad <https://etherpad.opendev.org/p/cinder-bug-squad-meeting> Undecided - Support for the "bring your own keys" approach for Cinder <https://bugs.launchpad.net/cinder/+bug/2051108> - Status: New - Documentation of Ceph auth caps for RBD clients used by Cinder / Glance / Nova is missing or inconsistent <https://bugs.launchpad.net/cinder/+bug/2051244> - Status: New - Dell PowerMax driver issues restapi version 92 for Unisphere 10.1 <https://bugs.launchpad.net/cinder/+bug/2051828> - Status: In Progress - Dell PowerMax: Add timeout when PowerMax does not return RESTAPI call <https://bugs.launchpad.net/cinder/+bug/2051830> - Status: In Progress - Fibre channel not scanning all targets <https://bugs.launchpad.net/os-brick/+bug/2051237> - Status: In Progress Thanks, -- Jon

1 0

What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova
by Christian Rohmann 31 Jan '24

31 Jan '24

Hey openstack-discuss, I am a little confused about correct and required Ceph authx permissions for the RBD clients in Cinder, Glance and also Nova: When Glance is requested to delete an image it will check if this image has depended children, see https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. The children of Glance images usually are (Cinder) volumes, which therefore live in a different RBD pool "volumes". But if such children do exist a 500 error is thrown by Glance API. There also is an bug about this issue on Launchpad [3]. Manually using the RBD client shows the same error: > # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p > images children $IMAGE_ID > > 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 > librbd::image::OpenRequest: failed to retrieve name: (1) Operation not > permitted > 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: > 0x5639fdd5af60 failed to open image: (1) Operation not permitted > rbd: listing children failed: (1) Operation not permitted > 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: > list_descendants: failed to open descendant b7078ed7ace50d from pool > instances:(1) Operation not permitted So it's a permission error. Following either the documentation of Glance [1] or Ceph [2] on configuring the ceph auth caps there is no mention of granting anything towards the volume pool to Glance. So this is what I currently have configured: > client.cinder > key: REACTED > caps: [mgr] profile rbd pool=volumes, profile rbd-read-only > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=volumes, profile rbd-read-only > pool=images > > client.glance > key: REACTED > caps: [mgr] profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=images > > client.nova > key: REACTED > caps: [mgr] profile rbd pool=instances, profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=instances, profile rbd pool=images > When granting the glance client e.g. "rbd-read-only" to the volumes pool via: > > # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd > pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd > pool=images, profile rbd-read-only pool=volumes' > the error is gone. I am wondering through if this is really just a documentation bug (at OpenStack AND Ceph equally) and if Glance really needs read-only on the whole volumes pool or if there is some other capability that covers asking for child images. All in all I am simply wondering what the correct and least-privilege ceph auth caps for the RBD clients in Cinder, Glance and Nova would look like. Thanks Christian [1] https://docs.openstack.org/glance/latest/configuration/configuring.html#con… [2] https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-authen… [3] https://bugs.launchpad.net/glance/+bug/2045158

6 15

[cinder] This week's meeting will be in video+IRC
by Rajat Dhasmana 31 Jan '24

31 Jan '24

Hello Argonauts, As we keep last meeting of the month in video + IRC mode, this week's meeting (today) will be held in video + IRC mode with details as follows: Date: 31st January, 2024 Time: 1400 UTC Meeting link: https://meet.google.com/mmb-fhtd-sjm IRC Channel: #openstack-meeting-alt Make sure you're connected to both the gmeet meeting and IRC. Thanks Rajat Dhasmana

1 0

[all][oslo][ironic][tc] Eventlet version bumps (topic:bump-eventlet in gerrit)
by Jay Faulkner 31 Jan '24

31 Jan '24

Hi all, https://review.opendev.org/q/topic:%22bump-eventlet%22 was pushed recently, to bump eventlet versions to a consistent lower bound across OpenStack projects. I saw some concerns about this across various OpenStack IRC channels, and wanted to start a larger conversation around the changes rather than having what would be my third separate small conversation about it :). I cannot speak to exactly why Herve pushed these changes, but I think they are a good idea and should be merged. If you're unaware or haven't read up on the context; versions of eventlet before 0.34 were released with minimal/failing CI, and done so with known bugs in many cases. A group of developers has taken the last months to improve the state of eventlet considerably, enhancing and improving CI, discovering and fixing known issues and enabling support for Python 3.12. From my perspective; this is a significant enough improvement to warrant our community moving forward generally[0] with setting a new higher low bound for eventlet -- the versions that are maintained. I do think that we can do a better job of advertising the value of this change in gerrit to other OpenStack contributors; simply stating it's for python 3.12 support downplays the significant improvements made across that project and the overall value of landing the version bump. I am unsure if we should advertise the improvements in a user/operator facing manner; I lean towards not doing so. From a single project perspective (with my Ironic PTL hat on): I have no desire to troubleshoot bugs in Ironic, or related projects, that only occur in eventlet versions prior to 0.34. This leads me to believe landing those changes in Ironic are the good path forward, and I'll be advocating for that inside Ironic. Thanks, Jay Faulkner OpenStack TC Chair OpenStack Ironic PTL 0: I'll note this should not be read as a suggestion of a mandate; only that it's a good idea to bump this requirement in OpenStack projects and should be done unless cores for that project see a specific reason why not.

2 6