October 2024 - openstack-discuss - lists.openstack.org

Re: openstack-discuss Digest, Vol 72, Issue 24
by BEDDA Fadhel 05 Oct '24

05 Oct '24

Good morning, I'm testing openstack (devstack). I downloaded an ubuntu qcow2 image, I created the image from this image, but when I access the console => I find the message: booting form hard disk and nothing happens after Le sam. 5 oct. 2024 à 12:50, <openstack-discuss-request(a)lists.openstack.org> a écrit : > Send openstack-discuss mailing list submissions to > openstack-discuss(a)lists.openstack.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > openstack-discuss-request(a)lists.openstack.org > > You can reach the person managing the list at > openstack-discuss-owner(a)lists.openstack.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of openstack-discuss digest..." > > Today's Topics: > > 1. Re: [all][qa][infra] Restore unit tests for intermediate python > versions > (Clark Boylan) > 2. Re: Stop bumping major versions when dropping EOL Python versions > (Elõd Illés) > 3. Re: [oslo.messaging] Heartbeat in pthread (Herve Beraud) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 04 Oct 2024 11:22:17 -0700 > From: "Clark Boylan" <cboylan(a)sapwetik.org> > Subject: Re: [all][qa][infra] Restore unit tests for intermediate > python versions > To: "Takashi Kajinami" <kajinamit(a)oss.nttdata.com>, > openstack-discuss(a)lists.openstack.org > Message-ID: <99b5ae0b-2d69-4040-9d3b-8b28491969a6(a)app.fastmail.com> > Content-Type: text/plain > > On Fri, Oct 4, 2024, at 10:26 AM, Takashi Kajinami wrote: > > On 10/5/24 01:47, Clark Boylan wrote: > >> On Fri, Oct 4, 2024, at 9:30 AM, Takashi Kajinami wrote: > >>> Hello, > >>> > >>> > >>> As you may know, current master runs unit tests with only Python 3.9 > >>> and Python 3.12. > >>> My understanding about this set up is that we test the minimum boundary > >>> and the maximum > >>> boundary and assume the change may work with all the versions between > >>> these two. > >>> > >>> However in some of my recent work I had to introduce the switch in the > >>> middle of these > >>> two versions. For example > >>> https://review.opendev.org/c/openstack/neutron/+/931271 introduces > >>> the logic to distinguish Python < 3.10 from Python >= 3.10 , and we > >>> don't specifically > >>> test that boundary. I'm afraid that this may potentially cause uncaught > >>> problems. > >> > >> One approach that wasn't discussed in the change is to continue to use > the existing code (pkg_resources) until python3.12 then only change the > behavior for 3.12. That approach would generally work if we are only > testing the boundaries since we're flipping the behavior on the boundary. > > > > For this case we need python 3.11 job to test the boundary. Also this > leaves > > noisy deprecation warnings in < Python 3.11 . > > The lower bound (currently 3.9) would continue to test the old behavior > (pkg_resources) and the upper bound (python3.12) would test the new > behavior (importlib). It would be covered as well as all of the other upper > and lower bound testing we've done. Python3.10 and 3.11 would be "covered" > by the 3.9 test ensuring that pkg_resources continues to work. When 3.9 is > dropped 3.10 would take over this responsibility. Eventually we'll only > have the importlib behavior and python3.12/3.13/etc would cover it. > > > > >> > >>> > >>> So my question here is ... Can we test all supported python versions, > >>> not only min/max, > >>> at least in check jobs ? This would helps us catch any regressions > >>> caused by such > >>> implementation. > >> > >> We can. The main limitation is that we may not have a test platform for > every version of python depending on how the distro releases align with > python releases. Currently I think we have a platform for every release > though (centos/rocky 3.9, jammy 3.10, bookworm 3.11, noble 3.12). If we end > up without a platform for a version of python jobs may need to be updated > to install python from source or some other method. > > > > acknowledged > >> > >>> > >>> I know there could be tradeoffs between test coverage and infra > >>> resources, but IMO > >>> this is the test coverage we should fill. > >> > >> Yes, the main concern was simply to avoid unnecessary effort. In the > case of unittest jobs the vast majority of those are much cheaper in terms > of resources than tempest jobs. I think if we stuck to this primarily for > unittests the impact would be minimal. If we tried to expand the tempest > matrix that would become unwieldy. > > > > Yes. I don't intend to run all tests in all versions but at least > > having unit test jobs, > > which are supposed to be cheap, may avoid 0 test coverage and would be > > enough now. > > > > In case we find any real problems then we can expand the scope to other > jobs. > > > >> > >>> > >>> Thank you, > >>> > >>> -- > >>> Takashi Kajinami > >>> irc: tkajinam > >>> github: https://github.com/kajinamit > >>> launchpad: https://launchpad.net/~kajinamit > > ------------------------------ > > Message: 2 > Date: Fri, 4 Oct 2024 20:05:02 +0000 > From: Elõd Illés <elod.illes(a)est.tech> > Subject: Re: Stop bumping major versions when dropping EOL Python > versions > To: Jeremy Stanley <fungi(a)yuggoth.org>, > "openstack-discuss(a)lists.openstack.org" > <openstack-discuss(a)lists.openstack.org> > Message-ID: <VI1P18901MB07518D7DBD7CA7D11AF91E18FF722@VI1P18901MB0751 > .EURP189.PROD.OUTLOOK.COM> > Content-Type: text/plain; charset="utf-8" > > Indeed, we started bumping MAJOR version due to dropping py27 support. > Though, the rule is, that a change in required package's version, only > warrants a MINOR version bump. But python is not just a simple dependency, > and dropping support of a python version is more than just bumping any > python package's version. Anyway, if the community wants to stop > bumping major versions in case of dropping python version support, > then i'm probably OK with that. > > Cheers, > Előd > > ________________________________________ > From: Jeremy Stanley > Sent: Monday, September 23, 2024 15:22 > To: openstack-discuss(a)lists.openstack.org > Subject: Re: Stop bumping major versions when dropping EOL Python versions > > > On 2024-09-23 12:25:09 +0100 (+0100), Stephen Finucane wrote: > [...] > > I'd be in favour of getting rid of this particular constraint, and > > instead focusing on API changes when deciding whether to bump the > > major version. Is this a reasonable suggestion, and if so what > > would we need to do to tweak our policy to allow it? > > It makes sense to me. Dropping Python 2.x support was a more > significant event, but these days removing support for minor Python > versions after the corresponding CPython interpreter reaches EOL > upstream is fairly unremarkable. We don't perform major version > increments just for raising the minimum required versions of any > other dependencies, after all. > -- > Jeremy Stanley > > > > ------------------------------ > > Message: 3 > Date: Sat, 5 Oct 2024 12:50:04 +0200 > From: Herve Beraud <hberaud(a)redhat.com> > Subject: Re: [oslo.messaging] Heartbeat in pthread > To: Michel Jouvin <michel.jouvin(a)ijclab.in2p3.fr> > Cc: openstack-discuss(a)lists.openstack.org > Message-ID: > < > CAFDq9gXbkoiRj18zTuqbWAzhg5yhf00JPn6kXh0R83i2CdpyRw(a)mail.gmail.com> > Content-Type: multipart/alternative; > boundary="0000000000008792280623b88de9" > > Voici la version mise à jour avec la solution de **retry backoff** et les > liens supplémentaires : > > Hey folks, > > The major concern behind this thread is that RabbitMQ connection drops due > to the absence of a reliable heartbeat. > While `heartbeat_in_pthread=True` aimed to fix this, it introduced other > bugs. > > Indeed, the Greenlet documentation is pretty clear, the limitations between > Python threads and greenlets lead to issues. > As eventlet is itself based on greenlet it leads to recurring issues in our > stacks. > The heartbeat_in_pthread bugs are living examples of this kind of issue. > > For this reason, we support keeping `heartbeat_in_pthread` disabled by > default. > > As a workaround, adjusting the RabbitMQ `heartbeat_timeout` and > `rabbit_heartbeat_timeout_threshold` can mitigate connection drops. > > Additionally, oslo.messaging offers the `connection_retry_interval` and > `connection_retry_backoff` parameters, > which implement retry backoff strategies to better handle connection drops. > This ensures that the system can manage reconnections more efficiently. > > We encourage investigating these paths to mitigate the connection problems. > > For more details please read: > - https://greenlet.readthedocs.io/en/latest/python_threads.html > - > > https://docs.openstack.org/oslo.messaging/xena/configuration/opts.html#oslo… > - https://www.rabbitmq.com/docs/heartbeats > - > > https://docs.openstack.org/oslo.messaging/xena/configuration/opts.html#oslo… > - > > https://docs.openstack.org/oslo.messaging/xena/configuration/opts.html#oslo… > > > Le jeu. 3 oct. 2024 à 22:46, Michel Jouvin <michel.jouvin(a)ijclab.in2p3.fr> > a écrit : > > > Hi Sean, > > > > Not sure why we misunderstood eachother but we agree! I understood your > > sentence as "people should avoid changing this option from its default > > (False) to True." but I understand now you mean the opposite and I > > totally agree based on our experience. Heat seems to be another service > > that will be in trouble if it is changed. > > > > Michel > > > > Le 02/10/2024 à 14:17, smooney(a)redhat.com a écrit : > > > On Wed, 2024-10-02 at 13:06 +0200, Michel Jouvin wrote: > > >> Hi Sean, > > >> > > >> As for the situation in our cloud after reverting to > > >> heartbeat_in_pthread=false, it was a "black and white situation": > > >> creating a cluster was impossible (because of the Heat issue > mentioned) > > >> since we changed to heartbeat_in_pthread=true (but we didn't realize > > >> immediately as we don't create clusters everyday) and restarted to > work > > >> properly immediately after reverting to heartbeat_in_pthread=false. > > >> There is a clear link between this parameter and Heat behaviour > (Caracal > > >> version in our case, so Oslo client 24.0). > > >> > > >> As for your last sentence "people should avoid cahnging this option > form > > >> tis default fo False.", I think/hope you wanted to say the opposite : > > >> "people should avoid changing this option form its default to > True."... > > > no at least for nova we default to false in our downstream product > > > > > > > > > https://github.com/openstack-k8s-operators/nova-operator/blob/main/template… > > > > > > we had signifcant ci usee when we had it set to true orgianly because > of > > the oslo.log issue > > > but we didn not revert to enabling this for nova-api after that was > > backported because > > > we have not seen any sideefct from seting it to false. > > > > > > we have never set this to true in OSP to my knolage for nova-comptue > > > > > > puppet-nova considered it experimental > > > > > > https://opendev.org/openstack/puppet-nova/src/commit/17bd61e042591305e461e5… > > > > > > in tripleo we disabled it in many services including heat and nova > > > > > > https://github.com/openstack-archive/tripleo-heat-templates/commit/cf4d4f88… > > > > > > in kolla it also default to false for nova-compute and other eventlet > > services > > > > > > https://github.com/openstack/kolla-ansible/blob/2218b7852fda94d0f498d5140f7… > > > although it is enabel for nova-api and some heat compoents > > > > > > https://github.com/openstack/kolla-ansible/blob/2218b7852fda94d0f498d5140f7… > > > > > > https://github.com/openstack/kolla-ansible/blob/2218b7852fda94d0f498d5140f7… > > > > > > at least for nova i would not recommend using > > > > > > heartbeat_in_pthread = True for any serrvice > > > nova-api runnign under uwsgi or mod_wsgi is the only possibel excpetion > > and even then i woudl discurage it. > > > > > > i cant really speak to other services but i think `heartbeat_in_pthread > > = false` is generally the correct default. > > > > > > > > >> Michel > > >> > > >> Le 02/10/2024 à 11:44, smooney(a)redhat.com a écrit : > > >>> On Tue, 2024-10-01 at 22:32 +0200, Michel Jouvin wrote: > > >>>> Hi, > > >>>> > > >>>> I am not an expert in these matters but we recently suffered the > > problem > > >>>> of client deconnection in RabbitMQ due to the heartbeat timeout and > I > > >>>> confirm it was a disaster for the cloud usage with many things not > > >>>> working properly (we are running Antelope, except > Barbican/Heat/Magnum > > >>>> where we run Caracal). The reason is still not clear for me, it was > > >>>> fixed by increasing the heartbeat timeout but at the same time, my > > >>>> colleague who implemented the change also defined > > >>>> heartbeat_in_pthread=true for all the services, something normally > > >>>> unnecessary as we configure uwsgi or Apache to use only one thread > > (and > > >>>> several processes). Initially we didn't see any bad impact of this > > >>>> setting but a few days ago users started to report that Magnum > cluster > > >>>> creation was failing due a "response timeout" in Heat during the > > master > > >>>> software deployment. > > >>>> > > >>>> Reading this thread this morning I had the idea if could be the > source > > >>>> of the problem (as the service was running properly a couple of > weeks > > >>>> ago, before the change). We reverted the change and defined > > >>>> heartbeat_in_pthread=false and it restored the normal behaviour of > > Heat. > > >>>> We have not seen a negative impact on other services so far. So I > > >>>> confirm that setting this parameter to false by default seems a good > > >>>> idea and that setting it to true can break some services like Heat. > > >>> thank you for the data point, im sure you will monitor the situration > > in your > > >>> clodu but please let use know in a week or two if the heat/magnum > > issues you > > >>> obsevered retrun or if the could continue to fucntion normally, > > >>> i expect it to but again it would be a good data point. > > >>>> Cheers, > > >>>> > > >>>> Michel > > >>>> > > >>>> Le 01/10/2024 à 16:31, Arnaud Morin a écrit : > > >>>>> Hey, > > >>>>> > > >>>>> I totally agree about the fact that heartbeat_in_pthread and the > > >>>>> oslo.log PipeMutex are technical debt that we need to get rid of, > > >>>>> as well as eventlet. > > >>>>> > > >>>>> However, despite the fact that it seems purely cosmetic on your > side, > > >>>>> we believe it's not. > > >>>>> I can't prove / reproduce the issue on a small infra, but > definetely, > > >>>>> at large scale, having those tcp connections to be dropped by > > rabbitmq > > >>>>> and recreated in a loop by agents is affecting the cluster. > > >>>>> > > >>>>> I know all the pain that these settings introduced in the past, but > > now > > >>>>> I feel we are in a stable situation regarding this, that's why I am > > >>>>> surprised about deprecating heartbeat_in_pthread now. > > >>> deprecateign a config option requires the deprecation to be > advertised > > in a slrup > > >>> before it can then be removed in a follwoing release. > > >>> Given the deprecation was done in dalmaition 2024.2 which is not a > > slurp release the removal > > >>> cannot take effect in 2025.1, 2025.2 is the earliest release we could > > remove this option. > > >>> > > >>> as a result i think maintaining the deprecation is correct here. > > >>> we may decied not to remove this until 2026.1 or later but i think > its > > correct to send the > > >>> message that people should avoid cahnging this option form tis > default > > fo False. > > >>> we coudl even tag this option as advanced to make that more clear > > >>> > > > https://docs.openstack.org/oslo.config/latest/reference/defining.html#advan… > > >>> > > >>>>> Can we, as least, make sure we keep all of this until we switch off > > >>>>> eventlet? > > >>>>> In other words, can we get rid of eventlet, then remove this > params? > > >>>>> and not the opposite? > > >>>>> > > >>>>> Regards, > > >>>>> > > >>>>> Arnaud > > > > > > -- > Hervé Beraud > Senior Software Engineer at Red Hat > irc: hberaud > https://github.com/4383/ >

1 1

[oslo.messaging] Heartbeat in pthread
by Arnaud Morin 05 Oct '24

05 Oct '24

Hello, I completely miss the deprecation of heartbeat_in_pthread in oslo.messaging [1]. We heavily rely on this parameter downstream and our opinion is that it should be set to True by default. We use it for both wsgi services and agents (nova-compute, neutron agents, etc.). I understand that eventlet will be dropped in the future, but should we set heartbeat_in_pthread to True by default until then? Regards, Arnaud. [1] https://review.opendev.org/c/openstack/oslo.messaging/+/925778

5 12

Stop bumping major versions when dropping EOL Python versions
by Stephen Finucane 04 Oct '24

04 Oct '24

o/ Python 3.8 is going EOL (upstream, anyway) next month. We've been working to drop support for this from various SDK deliverables, and I'm guessing (though don't yet know for sure) that this will happen across other project deliverables before long (if it hasn't started happening already). One side-effect of this change is that we will be expected to raise the major version of the affected dependencies on our next release. This is annoying for projects like openstacksdk that use the release-with-intermediary release model because it forces us to have a major version release earlier than we would like to. To give a concrete example, we have a RemovedInSDK50Warning deprecation warning that we are using to indicate (as you might guess) things that we plan to remove in openstacksdk 5.0.0. We need to wait 6 months/1 OpenStack release before removing anything flagged with this warning, so this has been mainly applied to legacy deprecation warnings to put a concrete timeline on their removal. However, because we just dropped Python 3.8 support, it is currently expected that our next release be 5.0.0. We last deprecated something new ~2 months ago, so this means we either cannot release a new version of openstacksdk for 3-4 months (to allow 6 months to pass) or we need to either rename RemovedInSDK50Warning to RemovedInSDK60Warning or add a new RemovedInSDK60Warning and move the offending deprecations to this. None of these are nice options and to be honest, I don't think the major version bump really provides all that much value to end-users: they already have a much better signal for the removal of a Python version in the 'python_requires' marker in setup.py/setup.cfg/pyproject.toml/(other build system file). By using this, we ensure that a user simply can't install a version of a package that doesn't support their chosen Python version. I'd be in favour of getting rid of this particular constraint, and instead focusing on API changes when deciding whether to bump the major version. Is this a reasonable suggestion, and if so what would we need to do to tweak our policy to allow it? Cheers, Stephen

4 3

[all][qa][infra] Restore unit tests for intermediate python versions
by Takashi Kajinami 04 Oct '24

04 Oct '24

Hello, As you may know, current master runs unit tests with only Python 3.9 and Python 3.12. My understanding about this set up is that we test the minimum boundary and the maximum boundary and assume the change may work with all the versions between these two. However in some of my recent work I had to introduce the switch in the middle of these two versions. For example https://review.opendev.org/c/openstack/neutron/+/931271 introduces the logic to distinguish Python < 3.10 from Python >= 3.10 , and we don't specifically test that boundary. I'm afraid that this may potentially cause uncaught problems. So my question here is ... Can we test all supported python versions, not only min/max, at least in check jobs ? This would helps us catch any regressions caused by such implementation. I know there could be tradeoffs between test coverage and infra resources, but IMO this is the test coverage we should fill. Thank you, -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

3 5

[all] Remove 'python_requires' flag from setup.cfg
by Ghanshyam Mann 04 Oct '24

04 Oct '24

Hi All, As you know, we have a flag 'python_requires' in setup.cfg which is pinned to the minimum python version supported[1]. Every time we upgrade our Python testing, we usually bump the minimum python version in setup.cfg and that prevents the project from being installed on lower Python versions. We do have list of tested and supported Python versions in setup.cfg classifier, which is good and enough information to tell what all Python versions are tested[2]. Flag 'python_requires' creates an issue (which has happened many times in the past) when a dependency like oslo lib bumps the version, and it makes all projects testing old Python versions fail. I know we should remove the old Python versions tested from projects first, but somehow, we all are busy, and a coordinated effort is always missed. IMO, we should remove this flag as it creates more issues than benefits. opinion? It will also help to continue users to install things on old python versions if it is working for them. [1] https://github.com/openstack/nova/blob/8c1a47c9cf6e1001fbefd6ff3b76314e39c8… [2] https://github.com/openstack/nova/blob/8c1a47c9cf6e1001fbefd6ff3b76314e39c8… -gmann

9 21

[kolla] [cinder-backup] max operations and workers problems
by garcetto 04 Oct '24

04 Oct '24

good morning, using all-in-one ubuntt 22 lts kolla openstack 2024.1 version. cinder.conf " [DEFAULT] ... backup_max_operations = 1 backup_workers = 1 ... " despite this, the cinder-backup container is doing more backups of more istance volumes...why? thank you.

2 3

migrating away from neutron-linuxbridge-agent
by Ionuț Bîru 04 Oct '24

04 Oct '24

Hi, Im running openstack 2023.1 and I intent to move away from linuxbridge agent due to being unmaintained and marked as experimental. Is there a documentation on how to migrate away to neutron-openvswitch-agent ? Is the change straightforward, simple as starting neutron-openvswitch-agent container, stopping/starting the servers from that hypervisor? Do you guys suggest to migrate to ovn instead of openvswitch? --- Ionuț Bîru - Hosterion

2 1

Openstack large deployment with network OVN
by Satish Patel 03 Oct '24

03 Oct '24

Folks, I am planning to deploy the latest openstack with OVN on around 300 compute nodes. based on googling I found there are some best practices for setting to scale OVN with many compute nodes. I would like to get some expert opinion on what is the best option I should go for to deploy OVN. What things should I keep in mind?

1 0

[OSSA-2024-004] OpenStack Ironic: Ironic fails to verify checksums of supplied image_source URLs when configured to convert images to raw for streaming (CVE-2024-47211)
by Jay Faulkner 03 Oct '24

03 Oct '24

==================================================================================================================================== OSSA-2024-004: Ironic fails to verify checksums of supplied image_source URLs when configured to convert images to raw for streaming ==================================================================================================================================== :Date: October 03, 2024 :CVE: CVE-2024-47211 Affects ~~~~~~~ - Ironic: <21.4.4, >=22.0.0 <23.0.3, >=23.1.0 <24.1.3, >=25.0.0, <26.1.0 Description ~~~~~~~~~~~ Julia Kreger of Red Hat noticed a vulnerability in image validation for Ironic, in which images may not have their checksum validated before conversion, potentially permitting man-in-the-middle attacks modifying image data. Patches ~~~~~~~ -https://review.opendev.org/c/openstack/ironic/+/931300 (2023.1/antelope(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931299 (2023.2/bobcat(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931295 (2024.1/caracal(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931294 (2024.2/dalmatian(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931293 (2025.1/epoxy (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931298 (Bugfix/24.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931297 (Bugfix/25.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931296 (Bugfix/26.0 (ironic)) -https://review.opendev.org/c/openstack/ironic/+/931305 (Unmaintained/victoria(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931304 (Unmaintained/wallaby(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931303 (Unmaintained/xena(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931302 (Unmaintained/yoga(ironic)) -https://review.opendev.org/c/openstack/ironic/+/931301 (Unmaintained/zed(ironic)) Credits ~~~~~~~ - Julia Kreger from Red Hat (CVE-2024-47211) References ~~~~~~~~~~ -https://launchpad.net/bugs/2076289 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47211 Notes ~~~~~ - No other Ironic-adjacent projects, including Ironic-Python-Agent, require patching to resolve this vulnerability. - As usual, we will provide updated releases off maintained branches, but will not create new releases off bugfix or unmaintained branches. -- Jay Faulkner OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html

1 0

Live Now! OpenStack 2024.2 'Dalmatian' on OpenInfra Live
by Allison Price 03 Oct '24

03 Oct '24

Hi everyone, Right now, OpenInfra Live is hosting several OpenStack PTLs as well as the chair of the Technical Committee chair from the 2024.2 Dalmatian release cycle to talk about the features from OpenStack’s 30th release. Join us on LinkedIn or YouTube and it’s live, so ask any questions you have for our guests! More information is available at openinfra.dev/live. YouTube: https://www.youtube.com/watch?v=6igJNIJ9yFE LinkedIn: https://www.linkedin.com/events/introducingopenstackdalmatian20724476314826… See you there! Allison

1 0

openstack neutron issue binding VIF
by Stepan Vakheta 03 Oct '24

03 Oct '24

Hello team, I am currently experiencing an issue with the Neutron component, specifically with port binding. I am attempting to use Neutron as an external provider for oVirt networks. I have successfully created the networks and imported them, and oVirt is able to see all the information about the network from Neutron. However, when I create a vNIC in oVirt's VM, it appears in Neutron but it shows that the binding_vif_type is "binding_failed" and the VM does not start. It seems that oVirt is not able to create the port from the imported Neutron Network. Additionally, neither the Neutron controller node nor the Neutron compute node shows any errors according to this case. I have attached the network configuration files of the controller node and the config files of the neutron component. Please let me know if there is anything else I can provide you regarding configs, logs, etc. I appreciate any help you can provide. Regards, Stepan Vakheta

1 0

OpenStack 2024.2 Dalmatian is officially released!
by Elõd Illés 02 Oct '24

02 Oct '24

Hello OpenStack community, The official OpenStack 2024.2 Dalmatian release announcement has been sent out: https://lists.openstack.org/archives/list/openstack-announce@lists.openstac… Thanks to all who were a part of the 2024.2 Dalmatian development cycle! This marks the official opening of the openstack/releases repository for 2025.1 Epoxy releases, and freezes are now lifted. stable/2024.2 is now a fully normal stable branch, and the normal stable policy applies from now on. Thanks, Előd Illés on behalf of the Release Management team

3 2

Kubernetes cluster on top of OpenStack with kops
by Jaime Ibar 01 Oct '24

01 Oct '24

Hi all, anyone is using kops for deploying a kubernetes cluster on top of Openstack? Thanks Jaime -- Jaime

2 1

[all][tc][ptl][ptg] TC Discussions at the PTG - Sign Up and Suggest Topics
by Goutham Pacha Ravi 01 Oct '24

01 Oct '24

Hello Stackers, I'd like to highlight the Technical Committee's PTG planning etherpad [1], where we're organizing our discussions for the upcoming PTG. Over the next week, I aim to finalize time slots and prioritize discussion topics. Since TC discussions are cross-project, we'll do our best to avoid scheduling conflicts with project team meetings. To help with this, I encourage all interested parties to sign up or vote on the topics listed in the etherpad. Feel free to add any additional topics you'd like to discuss as well. Thank you! Best regards, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] https://etherpad.opendev.org/p/oct2024-ptg-os-tc

1 0

[all] [security] [ptls] Please review core security teams
by Jay Faulkner 01 Oct '24

01 Oct '24

Hi all, I'm writing on behalf of the Vulnerability Management Team (VMT). We often use the ${project}-coresec teams to determine who is best to help triage initial issues. These groups do not appear to be universally up to date. If you are in charge of a repo managed by the VMT ( https://security.openstack.org/repos-overseen.html#repositories-overseen ) please ensure the associated launchpad ${project}-coresec group has active, trusted members of your community -- or otherwise reach out to the VMT in #openstack-security to arrange other contacts if needed. For example, https://launchpad.net/~ironic-coresec/+members contains four longtime Ironic cores and former PTLs. (I'll note: I likely need to audit the equivalent group for Ironic-adjacent repos, and will do that after hitting send). This is extremely important! If we can't get an issue triaged and dealt with in time, it gets opened to the public. If there's any questions, feel free to respond here or reach out in #openstack-security on OFTC. Thanks, Jay Faulkner

1 0

[ironic] Postgres CI job broken
by Julia Kreger 01 Oct '24

01 Oct '24

Greetings folks, We had a little bit of a discussion on this subject in #openstack-ironic IRC earlier today[0], but the tl;dr is it appears the postgres integration CI job Ironic has had as a "canary" of support is now failing. This time it appears to be rooted in keystone[1]. Like our prior times of raising awareness, we're sending this email to the mailing list. Given the overall deprecation of postgres support many years ago, and the decline in postgres CI jobs in OpenStack, we believe it is time for us to remove this CI job. That being said, if someone wants such support to be fixed and rejuvenated, please consider this email your call to action. Thanks, -Julia [0]: https://meetings.opendev.org/irclogs/%23openstack-ironic/%23openstack-ironi… [1]: https://7d12977942ed9fbb75e4-56d2480851ef91de1634aa83a3abd804.ssl.cf1.rackc…

2 1

[Kolla-Ansible] [Ironic] Node Deploy Failed with MissingAuthPlugin
by Ali Hussain 01 Oct '24

01 Oct '24

Hi Kolla and Ironic folks, While playing with stable/kolla release to fix the No VIF found error. Looks like adding Readers role to ironic user fixed it. But run into Missing Auth plugin [2] issue while image is being deployed to ironic node. Openstack endpoint list command [1] shows the correct IP of the controller. My question is: 1. Kolla-Ansible needs explicite Ironic keystone configuration in Ironic.conf? Following this link <https://docs.openstack.org/kolla-ansible/yoga/reference/bare-metal/ironic-g…> which does not seems to need any keystone configurations. This issue is observed when 1. --boot-interface redfish-virtual-media 2. --deploy-interface ramdisk 3. --driver-info deploy_iso= 4. -instance-info kernel & ramdisk 2. My passwords.yaml has 1. ironic_database_password: 2. ironic_inspector_database_password: 3. ironic_inspector_keystone_password: 4. ironic_keystone_password: Any suggestions please. Thank you. Ali [1] openstack endpoint list | grep ironic | <ID> | <Region> | ironic-inspector | baremetal-introspection | True | internal | http://<IP>:5050 | | <ID> | <Region> | ironic | baremetal | True | public | http://<IP>:6385 | | <ID> | <Region> | ironic-inspector | baremetal-introspection | True | public | http://<IP>:5050 | | <ID> | <Region> | ironic | baremetal | True | internal | http://<IP>:6385 [2] *Error: *Detected change in error condition on node Node1. Deploy step deploy.deploy failed with MissingAuthPlugin: An auth plugin is required to determine endpoint URL.. An unhandled exception was encountered while aborting. More information may be found in the log file.

2 6

Automating Network VLAN Reconfiguration Post-Bare Metal Provisioning with OpenStack Ironic
by Hajasolo 01 Oct '24

01 Oct '24

Hello OpenStack Community, I am currently working with OpenStack Ironic for provisioning bare metal servers and facing a specific challenge related to network security and automation. I would appreciate any insights or experiences you could share! We use Ironic to provision bare metal servers, which involves utilizing a management VLAN during the PXE boot and initial OS installation process. Post-provisioning, the server’s management interface remains accessible, posing a security risk as it can potentially access the management network. I need to ensure that once a server is provisioned and handed over to a user, it cannot access the management VLAN until it is deprovisioned. 1. How can we automate the process of removing the management VLAN from the server’s network interface post-provisioning to prevent unauthorized access to the management network? 2. Upon server deprovisioning, how can we automatically re-enable the management VLAN to allow for server re-provisioning? 3. Are there any built-in OpenStack tools or common practices within the Ironic or larger OpenStack community to handle such scenarios? Our goal is to maintain a high level of automation and self-service capability in our OpenStack environment while ensuring rigorous network security standards. Solutions that integrate seamlessly with OpenStack’s existing architecture would be ideal. Thank you for your time and help! Best regards, Haja, Joel

2 1

[largescale-sig] Next meeting: September 18, 9utc
by Thierry Carrez 01 Oct '24

01 Oct '24

Hi everyone, The Large Scale SIG will be meeting this Wednesday in #openstack-operators on OFTC IRC, at 9UTC. You can doublecheck how that UTC time translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20240918T09 Feel free to add topics to the agenda: https://etherpad.opendev.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

3 3

[Glance] Weekly Meeting Cancelled (OCT 3)
by Pranali Deore 30 Sep '24

30 Sep '24

Hi All, As discussed during last week's meeting[1], the meeting for 3rd OCT has been cancelled. See you all next week!! [1]: https://meetings.opendev.org/irclogs/%23openstack-meeting/%23openstack-meet… Thanks, Pranali

1 0