March 2024 - openstack-discuss - lists.openstack.org

[tacker] Patches cannot pass zuul check for RC1
by Yasufumi Ogawa 15 Mar '24

15 Mar '24

Hi team, We still have several patches remained for unexpected failures on zuul check tests. All the failures happen in codes other than we updated and are not always happened. It might be the difficulty we usually meet at the end of releases because of lack of resources on the environment. Unfortunately, it's already over the deadline of RC1 although it can be merged if we have enough time to recheck unitll it's passsed. So, I'd like to fix Tacker's Caracal release and propose to backport the remained patches later. Thank you for your contribution. https://review.opendev.org/c/openstack/tacker/+/908878 https://review.opendev.org/c/openstack/tacker/+/910504 https://review.opendev.org/c/openstack/tacker/+/911639 https://review.opendev.org/c/openstack/tacker/+/907022 https://review.opendev.org/c/openstack/tacker/+/907025 https://review.opendev.org/c/openstack/tacker/+/908752 https://review.opendev.org/c/openstack/tacker/+/907026 https://review.opendev.org/c/openstack/tacker/+/907694 Regards, Yasufumi

1 0

OSSN-0093: Unresolved Vulnerability in OpenStack Murano
by Jeremy Stanley 14 Mar '24

14 Mar '24

OSSN-0093 Unresolved Vulnerability in OpenStack Murano ### Summary ### A severe security vulnerability in all versions of the Murano service will be disclosed at a later date. Murano is an inactive project[*], so no fix is currently under development for this vulnerability. It is strongly recommended that any OpenStack deployments disable or fully remove Murano, if installed, at the earliest opportunity. This security note will be amended at the time of public disclosure to include further details and context, but action should be taken as soon as possible in order to minimize the risk it poses. [*] https://governance.openstack.org/tc/reference/emerging-technology-and-inact… ### Affected Services / Software ### - murano: all versions ### Discussion ### This security note is a redacted placeholder, and will be amended with complete details once the associated bug report becomes public. ### Recommended Actions ### Disable the Murano service in, or fully remove it from, all OpenStack deployments at the earliest opportunity. ### Credits ### Not yet disclosed. ### Contacts / References ### Authors: - Jeremy Stanley, OpenStack Vulnerability Coordinator This OSSN: https://wiki.openstack.org/wiki/OSSN/OSSN-0093 Original bug: https://launchpad.net/bugs/2048114 (not yet public) Mailing List : [security-sig] openstack-discuss(a)lists.openstack.org -- Jeremy Stanley, OpenStack Vulnerability Coordinator

1 1

[requirements][releases][heat][mistral][murano] Requirements freeze exception for yaql
by Takashi Kajinami 14 Mar '24

14 Mar '24

Hello, I have another exception request... A critical security issue[1] was discovered recently and we are updating yaql to fix the issue. The required change was already merged into yaql and I've proposed a new yaql release[2]. I'd like to request a requirement freeze exception to pull the fixed version into upper constraints for 2024.1. Please let me know if you have any concern. Thank you, Takashi [1] https://bugs.launchpad.net/yaql/+bug/2048114 [2] https://review.opendev.org/c/openstack/releases/+/913230 -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

3 2

[nova][placement] Zombie placement allocations DB records
by hai wu 14 Mar '24

14 Mar '24

Sometimes there are zombie placement allocations records left for hypervisors, meaning there are no mapping VMs running on those hosts, but the placement allocation records still show up in the database. Does this mean that nova conductor/scheduler would still think those resources have already been allocated, while in reality, there's no existing VMs mapped to those zombie placement allocations records?

3 3

[openstack][octavia] Multi LB Management Networks
by Nguyễn Hữu Khôi 14 Mar '24

14 Mar '24

Hello. Is there any way to configure multi lb mnt network for amphorae instances? I am planning to design multiple AZs with separate networks for my system. I am reading this link: https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/17… Thank you. Nguyen Huu Khoi

2 2

[Zun] Docker in rootless mode
by Francesco Di Nucci 14 Mar '24

14 Mar '24

Hello, I am working on a 2023.2 instance to install Zun. While we're still in the design phase, I was wondering if it is possible to run Docker as a non-root user together with Kata Containers for enhanced security. Has anyone tried this solution? Regards Francesco Di Nucci

2 4

[cloudkitty][ptg] Virtual Dalmatian vPTG Planning
by Rafael Weingärtner 14 Mar '24

14 Mar '24

Hello guys, Here is [1] our etherpad for the Dalmatian/2024.2 virtual PTG. Please, add your topics there if there is anything you would like to discuss/propose. I have already created a basic structure in the etherpad. I already scheduled the room and time slots. If you guys have any other suggestions, please let me know. [1] https://etherpad.opendev.org/p/apr2024-ptg-cloudkitty -- Rafael Weingärtner

1 0

What deployment tools do you use? What do you like in them?
by Ruslanas Gžibovskis 13 Mar '24

13 Mar '24

Hi team, Could you, please, share your opinion and your experience with deployment methods. Also what are the tools you use? I have some deployments running TripleO tool. What I like is that we can deploy on empty servers and customizable OpenStack Installation. Sadly TripleO stopped working on new releases last year. Question: Which deployment method you would recommend which would support deploying on empty servers? My plan is to use CentOS Stream as base OS. My setup: 3x controller and 10+ computes. All with generic things except cinder, I do not have volumes and telemetry. But this year I need to add SR-IOV and some computes with RT kernels. Suggestions? My research: OSP-ansible - looks like it could deploy without containerization (I find it as a benefit). (could someone share sample config you use?) Kolla-ansible - looks like old time here and most used? (could someone share sample config you use?) But all above are deploying on existing OS. Tho I have found the Kayobe, quite new to me, have you tried? How multi-controller and multicompute deployment config looks like? Thank you for your opinion or sharing your experience with the tools you use. -- Ruslanas Gžibovskis +370 6030 7030

3 4

[Cinder] Storage not detected when instance boots from ISO
by Francesco Di Nucci 13 Mar '24

13 Mar '24

Hello, premised that probably I am misunderstanding default behavior, I'm experiencing a weird issue with storage/volumes: * Cinder storage has only a NFS backend, with "cinder.volume.drivers.nfs.NfsDriver" driver * When I launch an instance through Horizon from a QCOW2 cloud image and with an associated volume, everything is ok (instances start, changes to the instance are persistent and remain through reboots etc) * But if I launch an instance from an ISO (CentOS, Debian, Ubuntu - DVD or minimal, seems to be OS-independent) and with an associated volume, I can use the installer through the noVNC console but it does not detect disks. Even if the volume is attached, the OS booted from ISO does not report/find it, and the installation can't proceed Is this normal/default behavior or is something wrong with my install? Best regards Francesco Di Nucci

1 0

Security Group Rules on Octavia Amphorae
by Kees Meijs | Nefos 13 Mar '24

13 Mar '24

Hello list, When creating a new load balancer using Octavia, I noticed the VIP network port gets assigned a dynamic created Security Group. The Security Group does not contain a rule allowing ICMP, therefore the VIP not being "pingable". Other than harder diagnostics, it could pose PMTU issues and such. Is it maybe possible to either just enable ICMP, or maybe template the dynamic Security Groups? Thanks in advance! Cheers, Kees

2 2