March 2024 - openstack-discuss - lists.openstack.org

[cinder][PTG] Cinder 2024.2 Dalmatian PTG planning
by Jon Bernard 27 Mar '24

27 Mar '24

Hi All, We will be conducting the Cinder 2024.2 (Dalmatian) PTG in a couple of weeks from Tuesday April 9th to Friday April 12th from 1300-1700 UTC[1]. The etherpad and schedule for Cinder PTG is here[2]. [1] https://ptg.opendev.org/ptg.html [2] https://etherpad.opendev.org/p/dalmatian-ptg-cinder Please add any topics or ideas you wish to propose for discussion to the "planning" section of the etherpad. Once we have the final set of topics, they will be distributed across our available days. Following are the details of the event: Dates: 9 April (Tuesday) - 12 April (Friday), 2024 Time: 1300 - 1700 UTC Room: Newton Video conference Tool: Zoom (Link can be found on the PTG page[1] by clicking on Cinder slot) Thanks! -- Jon

2 1

[cinder] This week's meeting (today) will be in video+IRC
by Rajat Dhasmana 27 Mar '24

27 Mar '24

Hello Argonauts, As we keep last meeting of the month in video + IRC mode, this week's meeting (today) will be held in video + IRC mode with the following details: Date: 27th March, 2024 Time: 1400 UTC Meeting link: https://meet.google.com/zya-oxpp-qre IRC Channel: #openstack-meeting-alt Make sure you're connected to both the gmeet meeting and IRC as discussion can happen at both places depending on how the author wants to conduct it. Thanks Rajat Dhasmana

1 0

Network would be shown to a member but IP allocation would be denied?
by Mika Saari 27 Mar '24

27 Mar '24

Hi, I am currently testing kolla-ansible using the latest release. During the creation of an external/provider network ("public"), I have observed that a non-admin project ("test") can view the network and allocate IP addresses for routers, for example. I would like to restrict this behavior so that the external network is listable (openstack network list), but IP allocation is denied. I have experimented with RBAC rules, creating a new role ("view-only") and assigning it to a user ("user") in the "test" project. I modified the policy.yaml files in both Neutron and Horizon as outlined in the documentation ( https://docs.openstack.org/kolla-ansible/latest/admin/advanced-configuratio… ). Below are the snippets from my neutron/policy.yaml and horizon/neutron_policy.yaml files created following the sample https://docs.openstack.org/neutron/2023.2/configuration/policy-sample.html policy.yaml get_network: "(rule:admin_only) or (role:view_only)" get_subnet: "(rule:admin_only) or (role:view_only)" get_port: "(rule:admin_only) or (role:view_only)" get_router: "(rule:admin_only) or (role:view_only)" neutron_policy.yaml get_network: "(rule:admin_only) or (role:view_only)" get_subnet: "(rule:admin_only) or (role:view_only)" get_port: "(rule:admin_only) or (role:view_only)" get_router: "(rule:admin_only) or (role:view_only)" After deploying Neutron and Horizon, I adjusted the default RBAC policy so that the "External Network" action only affects the "admin" project, not "*". While the admin can still see the public network, the test project user with the "view_only" role cannot see the "public" network. Enabling the RBAC policy for the "test" project allows the network to be visible, but it also enables the member of the project ("user") to reserve IP addresses for network components. I'm seeking guidance on where to find more information about policies to achieve the desired functionality. Should I redeploy all the services, or is depolying Neutron and Horizon sufficient? Am I on the right track with my policy tests, or is there a simpler way to achieve this functionality? Thank you very much for your assistance!

2 6

[ansible][aio][bobcat] How to contract on AWS EC2 instance (Only one instance)
by Tatsuro Makita 27 Mar '24

27 Mar '24

Hi I try to contract using openstack-ansible aio on AWS EC2 instance (only one node). refer to construction steps: https://docs.openstack.org/openstack-ansible/latest/user/aio/quickstart.html but it will occurred some problems with below, i can't proceed on this way. https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… My purpose is what it checks any functions(version = 28.0.1 or 27.0.1). anyone tell me an easy way to build on a single instance on AWS EC2? Or is there a procedure to build on several instances without VLANs? EC2 does not allow VLANs. Could you support / share any information? Thanks regards.

2 2

[Openstack] [shibboleth] Seeking Advice: Shibboleth Integration with OpenStack
by Abubakur Sait 26 Mar '24

26 Mar '24

Hello, I'm currently engaged in PhD research focused on integrating Shibboleth with OpenStack. I've encountered a challenge as many of the available resources seem to be outdated, with the most recent OpenStack version mentioned being Queens. I'm reaching out to the community for assistance: - Which operating system version are you using for this setup? - What version of OpenStack are you currently running with Shibboleth? Additionally, if you have any up-to-date tutorials or books on Shibboleth that you could recommend, I would greatly appreciate it. Thank you in advance for your help. Best regards, Abubakur Sait

2 1

[nova][ptg] Etherpad for next April vPTG
by Sylvain Bauza 25 Mar '24

25 Mar '24

Hi folks, As a reminder, we'll have another round of nova sessions at the PTG. You'll find all the connection details and the timeslots in the etherpad but you'll also have the opportunity to chime on the discussions by providing your own subjects in the etherpad. Feel free to add your topics with your IRC name at the bottom of https://etherpad.opendev.org/p/nova-dalmatian-ptg The more, the merrier. Thanks, -Sylvain

1 0

[tc][ptg] Topic proposals: Re-visioning OpenStack; Raising the bar for Activity
by Jay Faulkner 25 Mar '24

25 Mar '24

Hi all, I added two semi-related PTG topics to the TC etherpad that I wanted to evangelize to the community. Both have details on https://etherpad.opendev.org/p/apr2024-ptg-os-tc, starting around line 65. The first topic, 'Re-visioning OpenStack aka "What is OpenStack Now?"', is centered around a couple of related things; the last time we made a vision document for OpenStack was 2019 -- five years ago. We need to revisit what our vision for OpenStack is, better defining what projects are in and out of scope of OpenStack. There are more details on the linked etherpad; I look forward to your comments there. The second topic, "Raising the bar for Activity", is centered around a singular focus: preventing us from having another situation where there is a severe security vulnerability in an OpenStack project which cannot be fixed. In fact, when reviewing the OpenInfra Foundation's Project Confirmation Guidelines ( https://board.openinfra.dev/en/ProjectConfirmationGuidelines ) -- a standard OpenStack in the aggregate is supposed to meet -- we have many projects that would not pass this if viewed more singularly. There are more details on the linked etherpad; I look forward to your comments there. Thanks, Jay Faulkner OpenStack TC Chair

1 0

[ironic] canceling meetings April 1st and April 8th
by Riccardo Pittau 25 Mar '24

25 Mar '24

Hello ironicers! We're canceling the ironic weekly meetings for the next 2 weeks: - April 1st is bank holiday in many countries in Europe and America and most of the cores won't be available - April 8th is the first day of the PTG Next meeting will be held on April 15th Ciao Riccardo

1 0

[tc] Next TC Meeting Tomorrow, March 26, 1800 UTC
by Jay Faulkner 25 Mar '24

25 Mar '24

Hi all, The next TC meeting is scheduled for tomorrow at 1800 UTC in #openstack-tc on OFTC. The proposed agenda is: - Roll call - Follow up on tracked action items - Gate health check - Implementation of Unmaintained branch statuses - 2024.2 Dalmatian TC Election - Election results cannot be merged due to affiliation diversity policy https://review.opendev.org/c/openstack/governance/+/913912 - TC vPTG 2024.2 - https://etherpad.opendev.org/p/apr2024-ptg-os-tc - Open Discussion and Reviews Thanks, Jay Faulkner OpenStack TC Chair

1 0

[nova] Instance migration/resize changes availability zone
by Marc Vorwerk 25 Mar '24

25 Mar '24

Dear OpenStack Community, I am reaching out for support with an issue that is specifically affecting a single instance during migration or resize operations in our OpenStack environment. I want to emphasize that this problem is isolated and does not reflect a broader issue within our cloud setup. The issue arises when attempting a resize of the instance's flavor, which only differs in RAM+CPU specification. Unexpectedly, the instance attempts to switch its availability zone from az1 to az2, which is not the intended behavior. The instance entered an error state during the resize or migration process, with a fault message indicating 'ImageNotFound', because after the availability zone change the volume cant be reached. We use seperate ceph clusters per az. To debug this issue we enabled debug logs for the nova scheduler and found that the scheduler does not filter out any node with any of our enabled filter plugins. As a quick test we disabled a couple of compute nodes and could also verify that the ComputeFilter of the nova-scheduler still just returns the full list of all nodes in the cluster. So it seems to us that for some reason the nova-scheduler just ignores all enabled filter plugins for mentioned instance. It's worth noting that other instances with the same flavor on the same compute node do not exhibit these issues, highlighting the unique nature of this problem. Furthermore we checked all relevant database tables to see if for some reason something strange is saved for this instance but it seems to us that the instance has exactly the same attributes as other instances on this node. We are seeking insights or suggestions from anyone who might have experienced similar issues or has knowledge of potential causes and solutions. What specific logs or configuration details would be helpful for us to provide to facilitate further diagnosis? We greatly appreciate any guidance or assistance the community can offer. Best regards, Marc Vorwerk + Maximilian Stinsky

5 6