October 2024 - openstack-discuss - lists.openstack.org

#eventlet-removal - OFTC IRC meeting time slot poll - Express your choice!
by Herve Beraud 12 Nov '24

12 Nov '24

Hey Stackers, We propose to schedule a one hour OFTC IRC meeting (#opentack-eventlet-removal) each first and third week of each month. Let's find together the right UTC time slot for our one hour OFTC IRC meeting. Once the vote is done, meetings will be scheduled each first and third <selected time slot in the poll> of each month. Please, vote here: https://framadate.org/rUghO3j6ZkRhKD7m Votes will be considered as closed by Nov. 8th First meeting will be forced to 4pm UTC on Tuesday Nov 5th and then moved to the selected time slot for all the following meetings. See the proposed time slots in the poll link above. Join us on the #opentack-eventlet-removal OFTC IRC channel. Thanks in advance for your votes -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/

1 2

OpenStack Cinder - Volume-ID in cinder DB
by Harsh Ailani 12 Nov '24

12 Nov '24

Hello contributors, I am working on clone operation for a volumegroup and in that the volume ID auto-generated by OpenStack is not the one with which the clone volumes are being created on my IBM storage backend. This is as per design that IBM Storage backend will take the source-volume ID in the source-volumegroup and add a suffix to it while cloning. Now since there is a mismatch in the IDs between cinder and storage backend, because of which I am unable to perform any volume operations on this cloned volume. So, I was wondering if I can change the volume ID in cinder DB? I know that it’s a unique key and there is a limit of 36 characters for this field in cinder DB, but since I cannot change the volume in storage backend, I wanted to check if there is a way I can alter the volume ID in cinder DB? Kindly share your thoughts/suggestions on this matter. Thanks and Regards, Harsh Ailani

2 4

[Cinder][Ceph] Volumetria errada no cluster ceph
by lfsilva＠binario.cloud 07 Nov '24

07 Nov '24

Hello, I'm experiencing an issue with the volume usage of the Ceph cluster, which is currently used in OpenStack for volumes. I am working with Ceph version Octopus (15.2.17). When I run the ceph df command, I get this output: --- RAW STORAGE --- CLASS SIZE AVAIL USED RAW USED %RAW USED hdd 120 TiB 33 TiB 87 TiB 87 TiB 72.72 TOTAL 120 TiB 33 TiB 87 TiB 87 TiB 72.72 --- POOLS --- POOL ID PGS STORED OBJECTS USED %USED MAX AVAIL device_health_metrics 1 32 69 MiB 101 137 MiB 0 11 TiB images 2 256 1.3 TiB 166.90k 2.5 TiB 10.72 11 TiB vms 3 64 574 KiB 21 2.5 MiB 0 11 TiB volumes 4 2048 41 TiB 3.94M 82 TiB 79.42 11 TiB backups 5 1024 407 GiB 111.85k 818 GiB 3.63 11 TiB And when I run the rbd du -p volumes command, I get this total: NAME PROVISIONED USED <TOTAL> 14 TiB 8.3 TiB This "volumes" pool is currently set to replica 2, and mirroring is not enabled. I have checked for any locked or deleted snapshots but found none. I also ran a ceph osd pool deep-scrub volumes, but it didn't resolve the issue. Has anyone encountered this problem before? Could someone provide assistance?

3 21

Re: GPU PCI passthrough woes.
by Andy Speagle 04 Nov '24

04 Nov '24

Aye, that seems to have done it. Strange that this wasn't necessary for my old 1080 cards. Thanks! On Wed, 2024-10-30 at 08:12 +0000, Alexander Dibbo - STFC UKRI wrote: > ⚠️CAUTION⚠️ > This email originated outside of Toyon's network. Do not download > attachments or click links unless you know the content is safe. > > Hi Andy, > > We've seen many issues with pci passthrough and I suspect that the > l40s will have a seen similar issues with the a100s > > Here is an alias string that works for our a100s: > `alias = {"vendor_id": "10de", "product_id": "20f1", "device_type": > "type-PF", "name": "nvidia-tesla-a100-pcie-vga"}` > > I believe it is the `device_type` that will be your issue > > Regards > > Alexander Dibbo – Cloud Architect / Cloud Operations Group Leader > For STFC Cloud Documentation visit > https://urldefense.us/v3/__https://stfc.atlassian.net/wiki/spaces/CLOUDKB/o… > To raise a support ticket with the cloud team please email > cloud-support(a)stfc.ac.uk > To receive notifications about the service please subscribe to our > mailing list at: > https://urldefense.us/v3/__https://www.jiscmail.ac.uk/cgi-bin/webadmin?A0=S… > To receive fast notifications or to discuss usage of the cloud please > join our Slack: > https://urldefense.us/v3/__https://stfc-cloud.slack.com/__;!!A4KLn-w15EM4BR… > > -----Original Message----- > From: Andy Speagle <aspeagle(a)toyon.com> > Sent: 30 October 2024 02:15 > To: openstack-discuss(a)lists.openstack.org > Subject: GPU PCI passthrough woes. > > Hey Folks, > > I could use a little assistance getting GPU passthrough working. I > had > this working already for one flavor of nvidia gpu... and I've added > some hosts with a much newer gpu... > > I've updated the pci_alias and pci_passthrough variables and those > seem > to be getting set properly in nova.conf > > passthrough_whitelist = [{"vendor_id":"10de", > "product_id":"1b06"},{"vendor_id":"10de", "product_id":"26b9"}] > > alias = {"name": "gpu", "product_id": "1b06", "vendor_id": "10de"} > alias = {"name": "gpu-l40s", "product_id": "26b9", "vendor_id": > "10de"} > > I believe I have all of the iommu stuff configured and have the pci- > stub module entries... dmesg output shows that the GPUs are being > claimed by the stub module. > > $ openstack flavor show t1.small_gpu_l40s > +----------------------------+--------------------------------------+ > > Field | Value | > +----------------------------+--------------------------------------+ > > OS-FLV-DISABLED:disabled | False | > > OS-FLV-EXT-DATA:ephemeral | 0 | > > access_project_ids | None | > > description | None | > > disk | 0 | > > id | af70c94e-0026-4a39-bc1e-dfb93b286a54 | > > name | t1.small_gpu_l40s | > > os-flavor-access:is_public | True | > > properties | pci_passthrough:alias='gpu-l40s:1' | > > ram | 2048 | > > rxtx_factor | 1.0 | > > swap | 0 | > > vcpus | 1 | > +----------------------------+--------------------------------------+ > > Yet... I can't seem to get an instance to run using that new > flavor... > keeps complaining about there not being enough hosts available. > > Fault: > code: 500 > created: 2024-10-30T02:04:33Z > message: "No valid host was found. There are not enough hosts > available." > details: | > Traceback (most recent call last): > File "/usr/lib/python3/dist- > packages/nova/conductor/manager.py", > line 1580, in schedule_and_build_instances > host_lists = self._schedule_instances(context, > request_specs[0], > File "/usr/lib/python3/dist- > packages/nova/conductor/manager.py", > line 940, in _schedule_instances > host_lists = self.query_client.select_destinations( > File "/usr/lib/python3/dist- > packages/nova/scheduler/client/query.py", line 41, in > select_destinations > return self.scheduler_rpcapi.select_destinations(context, > spec_obj, > File "/usr/lib/python3/dist-packages/nova/scheduler/rpcapi.py", > line 160, in select_destinations > return cctxt.call(ctxt, 'select_destinations', **msg_args) > File "/usr/lib/python3/dist- > packages/oslo_messaging/rpc/client.py", line 189, in call > result = self.transport._send( > File "/usr/lib/python3/dist- > packages/oslo_messaging/transport.py", line 123, in _send > return self._driver.send(target, ctxt, message, > File "/usr/lib/python3/dist- > packages/oslo_messaging/_drivers/amqpdriver.py", line 689, in send > return self._send(target, ctxt, message, wait_for_reply, > timeout, > File "/usr/lib/python3/dist- > packages/oslo_messaging/_drivers/amqpdriver.py", line 681, in _send > raise result > nova.exception_Remote.NoValidHost_Remote: No valid host was > found. > There are not enough hosts available. > > Traceback (most recent call last): > File "/usr/lib/python3/dist- > packages/oslo_messaging/rpc/server.py", line 241, in inner > return func(*args, **kwargs) > > File "/usr/lib/python3/dist- > packages/nova/scheduler/manager.py", > line 223, in select_destinations > selections = self._select_destinations( > > File "/usr/lib/python3/dist- > packages/nova/scheduler/manager.py", > line 250, in _select_destinations > selections = self._schedule( > > File "/usr/lib/python3/dist- > packages/nova/scheduler/manager.py", > line 416, in _schedule > self._ensure_sufficient_hosts( > > File "/usr/lib/python3/dist- > packages/nova/scheduler/manager.py", > line 455, in _ensure_sufficient_hosts > raise exception.NoValidHost(reason=reason) > > nova.exception.NoValidHost: No valid host was found. There are > not > enough hosts available. > > Any clues on how/where to dig into this more to see what might be > missing? Thanks. > > -- > Andy Speagle > -- Andy Speagle Sr. Site Reliability Engineer Toyon Research Corporation 316.617.2431

3 2

Is HPET recommended for x86 instance?
by Jiatong Shen 04 Nov '24

04 Nov '24

Hello Community Experts, I found that to enable the HPET timer for x86 guests, the operator should set hw_time_hpet on the given image. By default, HPET is disabled. My question is what are the pros and cons for using HPET? Thanks. -- Best Regards, Jiatong Shen

2 3

[neutron][ovn-octavia-provider][octavia][ovn] Octavia OVN DBs sync cmd
by Rico Lin 04 Nov '24

04 Nov '24

Hi all I would like to raise attention to the patch set that introduces Octavia OVN DBs sync cmd. patches: https://review.opendev.org/q/topic:%22add-ovn-db-sync-utils%22 With command `octavia-ovn-db-sync-util {--debug}` It should allows us to do the OVN DB sync similar to what `neutron-ovn-db-sync-util` does. And thanks to Fernando Royo, the patches are small and earlier to review in focused functions. Would be great if we could have some more reviews for it. *Rico Lin*

2 1

[devstack][nova][cinder][ironic][glance][swift][neutron][all] Deprecating/removing non-uWSGI deployment mechanisms?
by Stephen Finucane 01 Nov '24

01 Nov '24

o/ tl;dr: I'd like to remove the ability to deploy services under mod_wsgi from DevStack. I'd also like to remove the ability to deploy services under eventlet, where this feature is not currently being tested, and deprecate it where it is. I took a foray through DevStack last week and realised that, depending on the service in question, there are currently 3 possible ways an API can be deployed by DevStack: * Eventlet server * Apache + uWSGI * Apache + mod_wsgi In addition, there are a number of overlapping config options that could be set to modify which of these was in use: * ENABLE_HTTPD_MOD_WSGI_SERVICES * WSGI_MODE * Service-specific options like NOVA_USE_MOD_WSGI, CINDER_USE_MOD_WSGI etc. Potential confusion aside, there are two issues I see with this. Firstly, and most obviously, we are working on eventlet removal, which will necessarily involve eventlet server removal [1]. In addition, there is a goal [2][3] to remove use of '.wsgi' scripts in favour of Python module paths. Quite a few services have migrated to this already, and those that haven't are going to need to do so by time pip 25.0 comes out (since that removes the deprecated legacy editable install flow [4] meaning these files will not be generated by pbr and DevStack deployments will start failing...you have been warned). However, mod_wsgi need .wsgi scripts. I didn't realise we cared about mod_wsgi in DevStack still before last week, so to complete the wsgi script -> module migration for services that can be deployed with mod_wsgi (e.g. Keystone), we're going to have to either (a) package a .wsgi script in DevStack or (b) remove the ability to deploy with mod_wsgi. My immediate thought on this was to simply remove all non-uWSGI deployment paths immediately and deprecate the config options for removal to force DevStack plugins to adapt. However, some services still want to test eventlet server for their API while they stabilise support for standard WSGI-based deployments (neutron), while others explicitly rely on evenlet to generate a single standalone binary (ironic, glance, ...). That means we can't just go remove everything now and must instead take a phased approach. I would therefore like to propose we do the following: * Remove the ability to deploy services under mod_wsgi from DevStack and deprecate/remove the WSGI_MODE flag. To be clear, other deployment tools can continue to use mod_wsgi but DevStack won't. * Entirely remove the ability to deploy under eventlet from services that are not currently testing this. This includes Nova and Cinder. * Invert the default for services that are testing eventlet, so that they test with uWSGI by default now and jobs will need to opt-in to eventlet rather than opt-in to uWSGI. I think this just affects Neutron. * Optionally, and likely only one Neutron is no longer testing eventlet (next cycle?), deprecate ENABLE_HTTPD_MOD_WSGI_SERVICES and {SERVICE}_USE_MOD_WSGI config options entirely and replace it with {SERVICE}_STANDALONE options like Glance has. This will affect Ironic and maybe more. I have proposed a series that will do much of this. The WIP patches indicate the things that I am less clear about, such as Swift's readiness for deploying under uWSGI. I would be grateful if folks from the individual service teams could take a look and let me know what they think: https://review.opendev.org/c/openstack/devstack/+/932193/1 Cheers, Stephen [1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [2] https://review.opendev.org/c/openstack/governance/+/902807 [3] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [4] https://ichard26.github.io/blog/2024/08/whats-new-in-pip-24.2/

6 10

[openstack helm] [Cinder] [Ceph] keyring not getting decode when doing cinder-storage-init
by daniel890723＠gmail.com 31 Oct '24

31 Oct '24

Hello today i was testing to deploy openstack with helm in my kubernetes cluster and i encounter an error when trying to deploy cinder Error: UPGRADE FAILED: post-upgrade hooks failed: 1 error occurred: * job cinder-storage-init failed: BackoffLimitExceeded when i print the log of the cinder-storage-init pod it shows 2024-10-30T03:22:14.303+0000 7efc1353d640 -1 auth: failed to load /etc/ceph/ceph.client.admin.keyring: (5) Input/output error 2024-10-30T03:22:14.303+0000 7efc1353d640 -1 auth: error parsing file /etc/ceph/ceph.client.admin.keyring: error setting modifier for [client.admin] type=key val=: Malformed input [buffer:3] 2024-10-30T03:22:14.303+0000 7efc1353d640 -1 auth: failed to load /etc/ceph/ceph.client.admin.keyring: (5) Input/output error 2024-10-30T03:22:14.303+0000 7efc1353d640 -1 monclient: keyring not found [errno 5] RADOS I/O error (error connecting to the cluster) and the keyring secret is use looks like this: apiVersion: v1 data: key: AQDtmCFnh3STCBAAGKQIyIGuZjnmX3L4mPCQXw== kind: Secret metadata: name: pvc-ceph-client-key namespace: openstack after checking secret and the rook-ceph cluster works fine i change the template and makes the pod not executing the command so i can look inside the pod and it's keyrings the keyring looks like this: [client.admin] key = �!g�tȁ�f9�_r��_ so apparently the keyring secert or when it mount into the pod got some problem and change the key into the normal one fix the problem is there a reason why it cause this ? because the secret and ceph-cluster are all works fine

2 4

[manila] 2025.1 Epoxy PTG summary
by Carlos Silva 31 Oct '24

31 Oct '24

Hello everyone! Thank you for the great participation at the PTG last week. We've had great discussions and a good turnout. The recordings for the sessions are available on YouTube [0]. If you would like to check on the notes, please take a look at the PTG etherpad [1]. *2024.2 Dalmatian Retrospective* ========================== - New core reviewers in the manila group were impactful in reviews, we should continue actively working on maintaining/growing the core reviewer team. - We had the mid-cycle and managed to combine it with our well-known collaborative review sessions, around feature proposal freeze. This had a good impact on raising awareness on the changes being proposed, as well as prioritizing the reviews. - Great contributions ranging from new third party drivers to successful internships on manila-ui, bandit and the ongoing OpenAPI internships. *Action items:* - Carlos (carloss) will work with the manila team to help people gain context on the bug czar role and work with the team to rotate it. - Vida Haririan (vhari) will jot down the details of the Bug Czar role - Follow the discussions on teams joining the VMT and get Manila included too. - Spread the word on the removal of the manila client and switch to OpenStackClient *Share backup enhancements* ========================= - Out of place restore isn't supported currently. We have agreed that this is a good use case and that a design specification should be proposed to document this. - DataManager / BackupDriver - forcing the backup process to go through the DataManager service is supported through a config option, but Manila is currently not honoring it. We agreed that this is an issue in the code, and we will review the proposed change [2] to make the data manager honor this config. - DataManager to allow for a backup driver to provide reports on API call progress: Currently, the data manager fetches the progress of a backup using a generic get progress call, but it is failing with the generic backup driver. We suggested that this should be fixed in the base driver. - Context for Backup API calls: currently, only objects representing a Share and Backup are passed to the backup driver. The request context should also be forwarded in these calls. The backup driver interface can be changed for this, but we should be mindful of out of tree drivers that could break. *Action items:* - Zach Goggins (zachgoggins) will look into: - Proposing a spec for the share backup out of place restore. - Updating the backup driver interface and adding context to the methods that need it. - Updating the backup driver interface and adding the abstract methods/capabilities that will help with the `get_restore_progress` and `get_backup_progress` methods. - The manila team will provide feedback on [2] *All things CephFS* =============== *Updates from previous cycles* ------------------------------------------ *State of the Standalone NFS Ganesha protocol helper:* - We added a deprecation warning at the end of the previous SLURP release, and we are planning to complete the removal during the 2025.1/Epoxy release. There were no objections to this so far at the PTG. When this is removed, CephFS-via-NFS will only work with cephadm deployed ceph-nfs clusters. *Testing and stabilization:* - devstack-plugin-ceph has been refactored to deploy a standalone NFS-Ganesha service with a ceph orch deployed cluster. We also dropped support for package-based and container-based installation of ceph. cephadm is used to deploy/orchestrate ceph. - Bumped Ceph version to Reef in Antelope, Bobcat, Caracal, Dalmatian, as well as started testing with Squid. - There are some failures on stable branches jobs which are being triaged and fixed. *Manage/unmanage:* - Implementation completed in Dalmatian and the documentation has been updated. We are currently working to enable the tests on CI permanently, as well as doing some small refactors to the CI jobs. *Ensure shares:* - Merged in Dalmatian but testing is still challenging, as running the tests mean that the service would temporarily have a different status and shares within the backend would have their status changed, which is harmful for test concurrency. *Preferred export locations and export location metadata:* - The core feature merged, but we are still working to get the newly implemented tests passing and merged. *Plans for 2025.1/Epoxy* -------------------------------- - NFSv3 + testing: we are looking into enabling NFSv3 support as soon as the patch is merged in Ceph. We agreed that we should enable the tests within manila-tempest-plugin and make any necessary changes to the tests structure, so we can ensure that we are testing some scenarios with both NFSv3 and NFSv4. - We will start to investigate support for SMB/CIFS shares and look at the necessary changes for setting up devstack and testing. *Action items:* - Carlos (carloss) will write an email to the openstack-discuss mailing list announcing the removal of the deprecated ganesha helper - Carlos pursue the manage/unmanage testing patches to have tests enabled in the CephFS jobs during Epoxy. - Carlos will look into approaches to test ensure shares APIs. - Ashley (ashrod98) will continue working on the export location metadata tempest changes and drive them to completion. - The manila team will look into updating manila-tempest-plugin tests and enabling NFSv3 tests in the Ceph NFS jobs - Goutham (gouthamr) will be submitting a prototype of the SMB/CIFS integration *Tech Debt* ======== *Eventlet removal* ---------------------- Our main concerns: - Performance should not be degraded with the default configuration when we switch. - Synchronous calls do not take a big hit and become asynchronous. - Impact to the SSH Pool (used by many drivers) should be minimal. *Action items for 2025.1 Epoxy:* - Tackle the low-hanging-fruit changes. - Participating in the pop-up team discussions. - Removing the affected console scripts in Manila. - Working on performance tests to understand what will be the impact on the SSH pool that is used by some drivers. - Look into enhancing our rally/browbeat test coverage. *CI and testing images* ------------------------------- We started working on the migration of the CI to Ubuntu 24.04 in all of the manila repositories (manila-image-elements, python-manilaclient, manila-ui, manila, manila-specs). Currently, the Ceph job is broken [3]. *Action items:* - We should clean up our CI job variants, as they have a lot of workarounds and we can start moving away from them. *Stable branches* ---------------------- We currently have 5 "unmaintained" branches, so we should be looking at sunsetting them. *Action items:* - Carlos (carloss) will start the conversation for the transition of some of these branches in the openstack-discuss mailing list. *Allowing force delete of a share network subnet* ======================================= We currently can add subnets (which translates to adding new network interfaces) to a share server but we can't remove them. This is a proposal to add this removal feature and being able to detach a network interface of a share server. We agreed that: - This is a good use case and something that can be enhanced. - The enhancement should add a force-delete API. - We should not allow the last subnet to be deleted, otherwise the shares won't have an export path. - A bug should be filed for a tangential issue that the NetApp driver is using "neutron_net_id" (and possibly "neutron_subnet_id" to name resources on the backend: ipspaces, broadcast domains, and possibly concurrency control / locks. *Action Items:* - sylvanld will look into proposing a spec to document this behavior *NetApp Driver: Enforcing lifs limit per HA pair* ===================================== - The NetApp ONTAP storage has a limit of network interfaces per node in a HA pair. In case the sum of allocated network interfaces in the two nodes of the HA pair is bigger than the limit of the single node, then the failover operation is compromised and will fail. - NetApp maintainers would like to fix this issue, and we agreed that: - The fix should be as dynamic as possible, not relying on users/admin input or configuration. - The ONTAP driver must look up all of the interfaces already created and allow/deny the request in case it would compromise the failover. - The NetApp ONTAP driver should keep an updated capability with the max network interfaces support number, and possible the number of allocated network interfaces at the moment. *NetApp Driver: Implement Certificate based authentication* ================================================ - The NetApp ONTAP driver currently handles only user/password authentication, but in an environment that password should change quarterly, this means updating the local.conf at least every three months. This enhancement proposes also adding the possibility of adding certificate based authentication. - We agreed that this is something that is going to be important for operators and will allow them to add their certificates with a longer expiration date, avoiding the disruptions caused by needing to update the user/password. *Manage Share affinity relationships by annotation/label* ============================================= Currently the manila scheduler uses affinity/anti-affinity hints and we base ourselves on share IDs. The idea now would be to have the affinite hints to be based in an affinity policy, as possible with Nova. We considered the proposed approaches, and agreed that: - If we are adding new policies, they should end up becoming a new resource/entity within the manila database - If there is a way to reuse the share groups mechanism, we should prioritize it *Action items:* - Chuan (chuanm) will propose a design spec to document this new behavior. *Share encryption* ============== This feature is currently waiting for more reviews and testing on gerrit. In the Dalmatian release mid-cycle we talked about the importance of testing this feature against a first party driver, to ensure that the APIs and integration with Barbican and Castellan work. We agreed that: - We should do some research on how to do this testing with the generic driver (which uses Cinder and Nova) - The testing will focus on the APIs and behavior of this feature, not the encryption of the shares. *Action items:* - gouthamr will help with some research on how to test this with the generic driver - The manila team will discuss this again in the upcoming manila weekly meetings. [0] https://www.youtube.com/watch?v=8UxrjEr6yik&list=PLnpzT0InFrqDHGfSDPhiGtSeX… [1] https://etherpad.opendev.org/p/epoxy-ptg-manila [2] https://review.opendev.org/c/openstack/manila/+/907983 [3] https://www.spinics.net/lists/ceph-users/msg83201.html

1 0

[qa][all] stable/2023.1 gate is blocked (hold the recheck)
by Ghanshyam Mann 31 Oct '24

31 Oct '24

Hello Everyone, Yatin pointed out that the python 3.8 drops impacted the stable/2023.1 focal jobs also. As per the stable/2023.1 testing runtime[1], we run at least one job on focal and the rest all on jammy. Python 3.8 drops broke the focal job[2]. To solve this, we need to pin the Tempest on stable/2023.1 testing (Yatin has proposed it[3]) We are testing it on neutron gate - https://review.opendev.org/c/openstack/neutron/+/933705 Until the fixes[3] are merged, please hold off on rechecking stable/2023.1 focal job failure. [1] https://governance.openstack.org/tc/reference/runtimes/2023.1.html#addition… [2] https://bugs.launchpad.net/devstack/+bug/2085886 [3] https://review.opendev.org/q/topic:%22bug/2085886%22 -gmann

1 1

[python-openstackclient] List security group IDs used by a VM with "openstack server show"
by Sebastian Luna Valero 31 Oct '24

31 Oct '24

Hello, Currently "openstack server show" provides the list of security groups used by the VM. However, this is a list of names only [1]. Therefore a VM may contain multiple security groups with the same name but different IDs. However, getting the IDs of the security groups used by a VM seems possible according to the API [2]. Would it be possible to make this available via the python-openstackclient CLI? Many thanks, Sebastian [1] https://docs.openstack.org/api-ref/compute/#show-server-details [2] https://docs.openstack.org/api-ref/compute/#list-security-groups-by-server

2 1

[barbican] KMIP integration
by przemyslaw.kuczynski＠ochk.pl 31 Oct '24

31 Oct '24

Why KMIP integration always create OPAQUE secret with name Opaque Object . There can be created only 1 entry Is there bug ? https://bugs.launchpad.net/barbican/+bug/2033620

2 1

How best to find a compatible cpu model for disparate CPUs?
by Andy Speagle 31 Oct '24

31 Oct '24

Hey Folks, I have some wildly disparate CPUs throughout my nova-compute environment and I'm trying to figure out the best way to find the correct cpu_model and any "extra_flags" that might need to be passed. According to "virsh capabilities" I have Broadwell-IBRS, Skylake- Server-IBRS and SapphireRapids-noTSX ... And... my attempts at finding a compatible model/flags has failed miserably. I tried getting all of the "capabilities" in one file and passing that through "virsh cpu-baseline" but that returned something completely incompatible with the Broadwell ... I looked at "virsh domcapabilities" and found that they all support "Broadwell-noTSX-IBRS" ... and nova- compute will start up using that... but, live migrations between the Broadwell and Skylake CPUs to the SapphireRapids doesn't work properly. tl;dr ... any tips on making this work with wildly disparate CPUs? -- Andy Speagle

3 2

[skyline]Using multi-domain management with the skyline UI
by 啧啧啧 31 Oct '24

31 Oct '24

Hi , Skyline Team I'm trying the skyline UI using multi-domain management, find some problems。 I created a new domain for domain-test1 using the openstack backend, create a test1 project under domain-test1. I used the skyline UI to add users to the test1 project and found that the user under the default domain could be added and given the admin role, but it was not available. I understand that this assignment is wrong and that the roles of project management should be different for projects that are not in the same domain. At the same time, I used skyline to try to integrate keystone LDAP. Reference https://docs.openstack.org/keystone/latest/admin/configurati…. I used the openstack backend to create a new domain for domain-test2 and create a test2 project under domain-test2 to configure ldap. I used the skyline ui to view the users in the domain-test2 domain, and all the users configured in ldap could be queried. The project in the domain-test2 domain could not manage the view users and was authorized.

1 0

[skyline]Using multi-domain management with the skyline UI
by 任亮 30 Oct '24

30 Oct '24

Hi , Skyline Team I'm trying the skyline UI using multi-domain management, find some problems。 I created a new domain for domain-test1 using the openstack backend, create a test1 project under domain-test1.  I used the skyline UI to add users to the test1 project and found that the user under the default domain could be added and given the admin role, but it was not available. I understand that this assignment is wrong and that the roles of project management should be different for projects that are not in the same domain. At the same time, I used skyline to try to integrate keystone LDAP. Reference https://docs.openstack.org/keystone/latest/admin/…. I used the openstack backend to create a new domain for domain-test2 and create a test2 project under domain-test2 to configure ldap. I used the skyline ui to view the users in the domain-test2 domain, and all the users configured in ldap could be queried.  The project in the domain-test2 domain could not manage the view users and was authorized.

1 0

[PTL][release][stable] 2023.1 Antelope transition to Unmaintained
by Elõd Illés 30 Oct '24

30 Oct '24

Hi teams, As 2024.2 Dalmatian was released last week and we are in a less busy period, now is the good time to call your attention to the following: At the end of October 2023.1 Antelope is planned to transition to Unmaintained phase [1] (planned date: 2024-10-30). I have generated the list of the current *open* and *unreleased* changes in stable/2023.1 for every repositories [2] (where there are such patches). These lists could help the teams who are planning to do a *final* release on Antelope before moving stable/2023.1 branches to unmaintained/2023.1. Feel free to edit and extend these lists to track your team's progress! Note that the last hash on stable/2023.1 branch will be tagged ('<series>-eom' tag) and transition patches will be generated soon. After the tagging and cutting unmaintained/2023.1 branch, the new unmaintained branch will be open to for bug fixes, but there won't be official releases for 2023.1 Antelope anymore. (You can get some information about the Unmaintained state on stable policy page [3]). *NOTE*: teams, please focus on wrapping up your libraries first if there is any concern about the changes, in order to avoid broken (final!!) releases! [1] https://releases.openstack.org/ [2] https://etherpad.opendev.org/p/2023.1-antelope-final-release-before-eom [3] https://docs.openstack.org/project-team-guide/stable-branches.html#unmainta… Thanks, Előd Illés irc: elodilles @ #openstack-release

2 1

[manila] Cancelling Oct 31 weekly meeting
by Carlos Silva 30 Oct '24

30 Oct '24

Hello everyone! Traditionally in the past cycles we cancelled the upstream weekly meeting that followed the PTG to get closure to some PTG AIs. I believe we can continue that tradition this time too. We'll get back to the weekly meetings next week, Nov 7th. If you have something urgent, please ping me on IRC. Regards, carloss

1 0

[tooz] Recommended driver
by William Szumski 30 Oct '24

30 Oct '24

Hi all, Just wondering what the recommend driver is these days. The docs[1] seem to suggest zookeeper is the most stable and feature rich. Is that still the case? Is it advisable to use zookeeper over redis/valkey? What gets the most testing in upstream CI? Thanks, Will [1] https://docs.openstack.org/tooz/latest/user/drivers.html

3 2

[Openstack-Helm] 2025.1 Epoxy PTG session summary
by Vladimir Kozhukalov 30 Oct '24

30 Oct '24

Hi Openstack-Helmers, Thank you for attending our 3 hours 2025.1 (Epoxy) PTG session. The session etherpad is here [0] and the following is the short summary. Items listed below are more or less sorted by their priority. ### Charts Agreed to fix the issue regarding overriding charts when publishing them with the same version. There must be a spec that clearly describes the workflow of how we are going to bump versions, build and publish charts. Items: - Migrate from Helm API v1 to Helm API v2 for Chart.yaml (including tracking dependencies in the Chart.yaml file instead of requirements.yaml) - Move overrides to a separate directory - Add CHANGELOG.md to every chart - Since we are using kubernetes-entrypoint [1] for orchestration, let's consider removing post-* hooks. This is going to make it easier to integrate with third party CI/CDs. - Let's consider switching to the same major version for all charts. If the subchart is changed the minor chart version must be bumped. ### Secrets Some upstream charts provide the possibility to refer to existing secrets. See for example [2]. This allows easy integration with various CI/CDs. We agreed to create a design spec and implement a similar pattern to make it possible for users to get sensitive info from external predeployed secrets. Also in some cases users would like to stick to third party projects when talking about Openstack backend like MariaDB and RabbitMQ. The spec must also describe the way how we are going to make OSH charts compatible with this. In case of Rook Ceph we use `ceph-adapter-rook` chart which takes care of creating secrets that are then consumed by the rest of charts. Probably the same approach can work for other cases. ### Images - We agreed to de-duplicate the image build code for Openstack images and switch to using Loci images. - Loci tries to go its own way using one Dockerfile for building all Openstack projects. This leads to having project/version specific parts in the build workflow that makes it harder for users to customise the build workflow. Let's be more straightforward here. There are examples like this [3] where per project Dockerfiles are used that utilize two base images for `python-venv-builder` and `python-runtime`. Let's consider adopting this approach. Agreed to prepare a spec for this. ### Gateway API, Ingress, NetworkPolicy, PodDisruptionBudget ... Gateway API is coming and is supposed to substitute the Ingress API. We agreed to prepare the design to support Gateway API. Also let's try to re-factor the way how the Openstack-Helm charts deploy Ingress objects and try to follow more common practices regarding this. Instead of having these two types of Ingresses cluster and namespace it is better to have a way for a user to define explicitly the list of Ingresses with their routes. Let's also use similar pattern for managing other optional K8s API obejects like NetworkPolicies and PodDisruptionBudget. It is better for users when they are able to define explicitly what they want to deploy instead of using hidden logic like what we have for managing Ingresses. Design spec is needed. ### Noble It is not clear at the moment whether Ceph will officially support Noble by 2025.1. So perhaps we'll be forced to build 2025.1 Jammy images. Anyway we are going to have two sets of test jobs with Jammy and Noble as a host OS. This is to make sure users can upgrade the host OS smothly. At the moment there are no volunteers to add support any other OS. ### Testing There are lots of test cases and having all these test jobs in the check pipeline not necessary. Instead we agreed to have a meta layer for tracking all these test cases and generate zuul jobs files programmatically. ### OceanBase OceanBase is a distributed database compatible with MariaDB. This is the blog post [4] about how it can be used with Openstack as the DB backend. The OceanBase team showed a demo during OpenInfra days in Asia in Sep/2024. We agreed that this use case can be interesting at least for some users so let's have a test job for this. [0] https://etherpad.opendev.org/p/oct2024-ptg-os-helm [1] https://github.com/airshipit/kubernetes-entrypoint.git [2] https://github.com/bitnami/charts/blob/f14d986d3713716a9b263075ac784ef74943… [3] https://github.com/vexxhost/atmosphere/tree/main/images [4] https://en.oceanbase.com/blog/13879352832 -- Best regards, Kozhukalov Vladimir

1 0

[cinder] No meeting today (10/30)
by Jon Bernard 30 Oct '24

30 Oct '24

Hello all, I'm not feeling well today and need to cancel today's meeting. See you all next wednesday. -- Jon

1 0

[horizon][ptg] 2025.1 Epoxy PTG summary
by Radomir Dopieralski 30 Oct '24

30 Oct '24

We had two days of Horizon discussion on the last PTG, first the internal one: https://etherpad.opendev.org/p/horizon-epoxy-ptg and then the cross-project sessions with other teams: https://etherpad.opendev.org/p/horizon-feature-gap On the first day we looked back at the previous cycle and summarized what was achieved, and what needs further attention. We mentioned the work done for Neutron API migrating it to OpenStackSDK, the improvements of integration and UI tests, and the work done by our Outreachy student. We discussed ways to make Horizon easier to approach for new developers. We also discussed the problems with AngularJS and a plan to remove it from Horizon. On the second day, we met with other project teams and discussed what needs to be done in Horizon to bring it up to speed with the progress made in other projects. We also discussed further work on migrating to OpenStackSDK. After further discussion, we decided to focus in this cycle on the following issues: • New SASS compiler library • Remove AngularJS • Research Unified Limits • Placement API Discussion — follow-up meeting with the Nova team • Use "direct" upload mode by default in the operator configuration • Start migration to OpenStackSDK for Nova • GUI for managing Keystone 2FA • Configuring integration tests for different themes • Better grooming of upstream bugs and easy-to-start issues In addition, if there are new contributors or we have spare time, we consider working on: • Keystone Re-enable user • Refresh Cinder API microversions • Hidden image in Glance • Filtering of images dropdown in rebuild dialog • Show backends in Glance information

1 0

[Horizon] Cancelling weekly IRC meeting tomorrow
by Tatiana Ovchinnikova 29 Oct '24

29 Oct '24

Hello team, Thank you for joining the vPTG last week! Since there's a week of chaos because of the time change, and part of the team is on PTO, I'm canceling our weekly meeting tomorrow. See you all next Wednesday! With kind regards, Tatiana

1 0

[i18n][ptg] I18n SIG vPTG summary
by Ian Y. Choi 29 Oct '24

29 Oct '24

Hi all, I would like to share with you a summary of the recent discussions held during the 2025.1 Epoxy PTG regarding the Internationalization (I18n) Special Interest Group (SIG). During the period, the I18n SIG explored approaches to improve multilingual support, discussing Weblate migration, AI-based translation implementation, sustainable documentation translation strategies, and addressing current translation tool issues. Special thank you to TC and Nova team for elaborate discussions. Please refer to the below brief summary from Etherpad: https://etherpad.opendev.org/p/oct2024-ptg-i18n . 1. Overall Translation Status discussion - Clarifying that StringFreezes applies to Horizon and dashboard plugin projects [1] - Confusion exists about the current state of translations. Horizon translations were added months ago but not proposed by the tooling. : No translation proposals on the master branch after April 19, 2024. [2] : Horizon removed Python 3.8 support [3], while translation jobs depend on Ubuntu Bionic. 2. Towards sustainable Documentation Translation - Discussion on utilizing AI machine translation: : Proposal to use Weblate's machine translation feature. : Consideration of open-source tools like LibreTranslate [4]. : Concerns raised about legal issues. - Emphasis on the necessity of human reviewers: : Suggestion to create a 'language-moderator' group in Gerrit? : Need to add voting labels for translation patches. 3. Weblate Migration - Ongoing migration of translated project files from Zanata to Weblate. - Integration with Zuul is the second-phase goal. - Difficulties encountered due to API usage issues. 4. Weblate Issues - There was an authentication issue with Weblate and openinfraid (note: but it appears to be resolved now. Thank you @rosmaita!) 5. AI Translation Approach - Step-by-step ways a. Model selection b. Community review of the model c. Model utilization d. Model + RAG (Reviewed/Translated OpenStack documents, glossary) utilization - Plan to conduct PoC with Nova RST documents. 6. Action items - To start a 3-month PoC to test AI translation with Nova RST files (ianychoi) - Zuul investigation for Weblate migration (seongsoocho) - Horizon Zuul job issue check (discussion with other teams) Thank you all, /Ian [1] https://review.opendev.org/c/openstack/releases/+/930929 [2] https://review.opendev.org/q/owner:proposal-bot+project:openstack/horizon+b… [3] https://docs.openstack.org/releasenotes/horizon/2024.2.html#upgrade-notes [4] https://github.com/LibreTranslate/LibreTranslate

1 0

[all[qa] Tempest dropping python 3.8 support
by Ghanshyam Mann 29 Oct '24

29 Oct '24

Hello Everyone, As you know, services and Oslo libs are dropping Python 3.8 in this cycle. Tempest is branchless, and we use Tempest master to test all supported stable branches (currently 2023.1 to 2024.2). Because Python 3.8 is still supported in stable/2023.1 to stable/2024.1 Initially, we thought of continuing the py 3.8 support in Tempest, but without Oslo libs, Tempest cannot support it. One way is to keep the python 3.8 constraints separately (either a separate file in Tempest or separate constraints for python3.8 in requirements), which stops Tempest from adding any new features from oslo/deps. Another way (this is what we did in the previous Python version bump) is to drop the Python 3.8 support, and if anyone wants to test the cloud with Python 3.8, they can install and run Tempest on Python >=3.9 virtual env. In upstream testing, we also install and run Tempest from the virtual environment. or use the Tempest 41.0.0 (the last release which supports py3.8) to test python 3.8 cloud. This is what we did during py3.6/3.7 support removal. - https://review.opendev.org/c/openstack/tempest/+/933398 -gmann

1 1

Re: [Cinder][Ceph] Volumetria errada no cluster ceph
by Luiz Fernando Silva 29 Oct '24

29 Oct '24

I am sending the file with the ceph osd df tree and ceph pg ls-by-pool volumes output as an attachment. ceph -s: cluster: id: ccdcc86e-c0e7-49ba-b2cc-f8c162a42f91 health: HEALTH_OK services: mon: 3 daemons, quorum hc-node02,hc-node04,hc-node03 (age 5w) mgr: hc-node02(active, since 4M) osd: 54 osds: 54 up (since 14h), 54 in (since 3M) task status: data: pools: 5 pools, 3424 pgs objects: 4.25M objects, 43 TiB usage: 88 TiB used, 32 TiB / 120 TiB avail pgs: 3424 active+clean io: client: 16 MiB/s rd, 5.7 MiB/s wr, 856 op/s rd, 483 op/s wr Thank you very much, we will adjust to replica 3.

1 0