January 2024 - openstack-discuss - lists.openstack.org

Re: Security Group
by Rodolfo Alonso Hernandez 23 Jan '24

23 Jan '24

Hello Benyamin: Can you specify what rules are you manually creating the OVN database? The code you are referring to is the sync tool. The goal of this tool is to sync both databases, OVN and Neutron. But please remember that Neutron is the CMS, is the only source of truth and it controls the network backend, in this case OVN. Any definition should be done in Neutron and any manual change in the OVN database will be restored or the environment will fail. Regards. On Tue, Jan 23, 2024 at 11:15 AM benyamin sam khanyani < bsamkhaniyani(a)gmail.com> wrote: > Thanks for your comprehensive reply. > > I apply completely similar rules to what Neutron installs on OVN > Northbound Database and I think it is compatible with LB, OVS, and OVN. I > think the main issue is the sync mechanism between Neutron DB and OVN > Northbound DB[1](Line 244). Clearly, It's not a bug but I think this > function can be enhanced in order to support changes which can be defined > directly in OVN Northbound DB. As there are a variety of functionalities in > ovn-nbctl and ovn-sbctl command line tools, I believe that it could be > beneficial. > > [1] > https://github.com/openstack/neutron/blob/dad8c3fecc4e97764a92f558d9df510fa… > > > On Mon, 22 Jan 2024 at 18:31, Rodolfo Alonso Hernandez < > ralonsoh(a)redhat.com> wrote: > >> Hello Benyamin: >> >> I'm guessing from your mail that you are referring to Neutron security >> groups and you are using ML2/OVN. Any SG rule should be defined in Neutron, >> not in OVN directly. The Neutron SG rules are translated to ACLs and >> applied to a port group. If you are interested in how this is done, please >> check [1]. >> >> If you want to add any new functionality to the SG rules, you should >> create a LP bug [2] with a RFE. This RFE should be a high level description >> of what want to implement. Be aware that we have multiple mechanism drivers >> in-tree: LB, OVS and OVN. This feature should be compatible with all of >> them. The RFE can be discussed during the Neutron drivers meetings [3]. >> >> Regards. >> >> [1] >> https://github.com/openstack/neutron/blob/master/neutron/plugins/ml2/driver… >> [2]https://bugs.launchpad.net/neutron/ >> [3]https://meetings.opendev.org/#Neutron_drivers_Meeting >> >> On Mon, Jan 22, 2024 at 3:41 PM benyamin sam khanyani < >> bsamkhaniyani(a)gmail.com> wrote: >> >>> Hi, >>> >>> I am working on the security group and aim to extend its functionality >>> by applying custom rules based on source and destination ports, arbitrary >>> match criteria, actions, and so on. I did it by using ovn-nbctl commands >>> and everything worked well. Unfortunately, the only issue is that I can not >>> see my custom rules in MariaDB and I didn't find any other solution for >>> defining security group rules with my desired options. So, I want to ask >>> you how I can tackle this issue? >>> >>> Regards, >>> Benjamin Sam >>> >>

1 0

[ops] help with multiattach volume type in cinder
by Shubham Yadav 23 Jan '24

23 Jan '24

Hi, i have a question/issue related to multiattach feature in cinder i have an openstack cluster and i have configured multiattach in the openstack cinder now when i create 1 volume (with volume type multiattach) and attach it to 2 instances test1 and test2 *on test1 sudo mkfs -t ext4 /dev/sdb sudo mkdir /mnt/mydisk sudo mount /dev/sdb /mnt/mydisk touch /mnt/mydisk/shared_file echo "This is some shared content" | sudo tee /mnt/mydisk/shared_fileon test2 sudo mkdir /mnt/mydisksudo mount /dev/sdb /mnt/mydiskls /mnt/mydisk/cat /mnt/mydisk/shared_file* i can see the shared_file now when i add new files on test1 im not able to see it on test2 untill i unmount the volume with directory and mount the directory again to the volume on test2. what could be the solution for it? how can i make the volume share datas instantly between all the instances connected to the volume i have tried with ext4 and xfs file system Hope to hear from you soon Thank you!

2 1

[tc] Next Technical Committee Meeting Jan 23 2024 1800 UTC
by Jay Faulkner 22 Jan '24

22 Jan '24

Hi all, The next meeting of the Technical Committee will be held on Tuesday, Jan 23 2024 at 1800 UTC. It will be held in #openstack-tc on OFTC. The proposed agenda is: Agenda - Roll call - Follow up on tracked action items - JayF - Email Skyline PTL about status as an emerging project; ask about future plans and investments. - slaweq - Propose patches to retire Monasca - Reach out to potential new outside-OpenStack Monasca maintainers, instruct on next-steps for reviving it in a new OpenDev namespace. - gmann - Attempt, again, to engage Senlin maintainer about next steps for the inactive Senlin project. - Gate health check - Implementation of Unmaintained branch statuses - 2024.1 TC Tracker - https://etherpad.opendev.org/p/tc-2024.1-tracker - Open Discussion and Reviews Thanks, Jay Faulkner OpenStack TC Chair

1 0

[ops] help with multiattach volume type in cinder
by Shubham Kumar Yadav 22 Jan '24

22 Jan '24

Hi, i have a question/issue related to multiattach feature in cinder i have an openstack cluster and i have configured multiattach in the openstack cinder now when i create 1 volume (with volume type multiattach) and attach it to 2 instances test1 and test2 *on test1 * *sudo mkfs -t ext4 /dev/sdb * *sudo mkdir /mnt/mydisk * *sudo mount /dev/sdb /mnt/mydisk * *touch /mnt/mydisk/shared_file echo "This is some shared content" | sudo tee /mnt/mydisk/shared_file* *on test2 * *sudo mkdir /mnt/mydisksudo mount /dev/sdb /mnt/mydiskls /mnt/mydisk/cat /mnt/mydisk/shared_file* i can see the shared_file now when i add new files on test1 im not able to see it on test2 untill i unmount the volume with directory and mount the directory again to the volume on test2. what could be the solution for it? how can i make the volume share datas instantly between all the instances connected to the volume i have tried with ext4 and xfs file system Hope to hear from you soon Thank you!

3 2

[neutron] Bug deputy report for week of January 15th
by Brian Haley 22 Jan '24

22 Jan '24

Hi, I was Neutron bug deputy last week. Below is a short summary about the reported bugs. -Brian Critical bugs ------------- * None High bugs --------- * https://bugs.launchpad.net/neutron/+bug/2049211 - neutron_tempest_plugin.api sorted() Function Issue - https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/905853 Medium bugs ----------- * https://bugs.launchpad.net/neutron/+bug/2049590 - Restore the device namespace if "set_netns" fails - https://review.opendev.org/c/openstack/neutron/+/905836 * https://bugs.launchpad.net/neutron/+bug/2049615 - multisegments: cleaning DHCP process for segment 0 should happen first - https://review.opendev.org/c/openstack/neutron/+/905617 * https://bugs.launchpad.net/neutron/+bug/2049524 - [Neutron/Nova] Need to fix attaching a vip port on VMs - confirmed, needs owner * https://bugs.launchpad.net/neutron/+bug/2049624 - vpnaas problem --- strongswan on rocky 9 - Needs owner * https://bugs.launchpad.net/neutron/+bug/2049909 - MLDv2 packets sent from L3 Agent managed networks cause backup routers to be preferred - Issue was filed regarding Linuxbridge, not sure if it is also happening with ML2/OVS - https://review.opendev.org/c/openstack/neutron/+/906114 - Will need more investigation Low bugs -------- * None Misc bugs --------- * https://bugs.launchpad.net/neutron/+bug/2049546 - neutron-linuxbridge-agent ebtables RULE_DELETE failed (Invalid argument) - Duplicate of https://bugs.launchpad.net/neutron/+bug/2038541 * https://bugs.launchpad.net/neutron/+bug/2049622 - Some Port Properties Cannot Be Set - dns-name tests were failing in their environment, asked for more info on configuration as could be user error Wishlist bugs ------------- * https://bugs.launchpad.net/neutron/+bug/2049623 - [RFE] Refactor OVS Trunk plugin to have one single port

1 0

[puppet][ec2-api] Retiring puppet-ec2api
by Takashi Kajinami 22 Jan '24

22 Jan '24

Hello, As announced earlier, the EC2API project has been marked inactive[1]. We'll carefully watch the discussion between TC and the project, but unless the inactive mark is removed and the project is re-added to 2024.1 releases, I'd propose retiring puppet-ec2api, based on inactivity in the EC2 API project as well as no actual user feedback to our module. In case you have any concern, please let me know. If I get no objections and the project status is not changed, I'll start the retirement process of this module at some point during this cycle (probably m-3 or in worst case no later than GA). Thank you Takashi Kajinami irc: tkajinam [1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack…

2 1

Security Group
by benyamin sam khanyani 22 Jan '24

22 Jan '24

Hi, I am working on the security group and aim to extend its functionality by applying custom rules based on source and destination ports, arbitrary match criteria, actions, and so on. I did it by using ovn-nbctl commands and everything worked well. Unfortunately, the only issue is that I can not see my custom rules in MariaDB and I didn't find any other solution for defining security group rules with my desired options. So, I want to ask you how I can tackle this issue? Regards, Benjamin Sam

2 1

[publiccloud-sig] Reminder - next meeting January 24th - 0800 UTC
by Felix Kronlage-Dammers 22 Jan '24

22 Jan '24

Hi everyone, This Wednesday (January 24th) the next meeting of the public cloud sig is going to happen. Since the majority of participants in the sessions started to like the videocalls, we’ll be doing this as a videocall again. We’ll be meeting at 0800 UTC here: https://conf.scs.koeln:8443/OIF-public-cloud-sig See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG See you Wednesday! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[kolla-ansible] [cinder-backup] does support HA?
by garcetto 22 Jan '24

22 Jan '24

good afternoon, i was trying cinder-backup, deployed on 2 containers. the first one seems to do all work, the second is sitting idle. I have a couple of questions: 1. can i parallelize backup jobs so are ran on both containers? 2. in case of first container down, the second seems not to be able to do backups/restores, nay clue? thank you.

3 3

[murano][heat][mistral][tc] Maintenance of yaql library
by Takashi Kajinami 21 Jan '24

21 Jan '24

Hello, The yaql library is currently maintained under murano's governance and is used by not only murano but a few other projects such as heat and mistral. In heat the library is essential since we introduced yaql function support. Looking at gerrit groups, I noticed the yaql library is maintained by a very small core group[1] and release group[2], but I'm afraid most of the people in these groups are no longer active in the community. Because heat is dependent on the library, I'm wondering if some of the heat cores can be added to these two groups so that we (at least I) can help maintaining the library. I've checked the changes merged into murano repo for these two years but iiuc all of these changes are gate fix. Also a dummy change[3] indicates that its CI is currently broken. If the murano project is no longer active then I'm also willing to take over yaql and bring it to heat's governance (of cause only if it's acceptable). I'll add the current PTL as cc, but please let me know if anyone has any opinion or concern. # I'll add mistral tag because the project is also dependent on yaql. # Also tc is added because this discussion is related to project governance. Thank you Takashi Kajinami [1] https://review.opendev.org/admin/groups/cba4f6fd54c3cc0d5706fc50b5ebd758860… [2] https://review.opendev.org/admin/groups/d5e894b34e5ab5a9fc2938a0d4e7bc76fd2… [3] https://review.opendev.org/c/openstack/murano/+/901888

3 7