April 2024 - openstack-discuss - lists.openstack.org

Re: [neutron][magnum][mcapi] floating IP delete permission issue
by Satish Patel 02 Apr '24

02 Apr '24

Thank you Mohammed, It would be really good if we have a flag in template to say release floating IP instead of delete. Technically operator assign floating IPs to project and only that project should use them as per need instead of delete floating ips and put it back to book. Let’s see if we can get some eyeballs on this feature. But this is very important feature for us to control public IP usage. On Mon, Apr 1, 2024 at 10:16 PM Mohammed Naser <mnaser(a)vexxhost.com> wrote: > Hi Satish, > > This is actually something that would have to be handled on the Cluster > API level, since it is the one that owns that resource. > > I would start raising an issue there first, if that gets traction then we > can integrate that with the driver after, however, if it doesn't make sense > for it to be there, we can maybe include a config flag to handle this (but > I'm not sure what other implications this would have) > > Thanks > Mohammed > ------------------------------ > *From:* Satish Patel <satish.txt(a)gmail.com> > *Sent:* April 1, 2024 10:09 PM > *To:* OpenStack Discuss <openstack-discuss(a)lists.openstack.org> > *Subject:* [neutron][magnum][mcapi] floating IP delete permission issue > > Folks, > > For regulatory purposes we set a neutron policy to not let normal users > delete their public floating IPs because they are assigned to specific > customers and we don't want them to delete them. So far that policy works. > > But now when it comes to magnum / mcapi. I am able to create a cluster but > not able to delete because when magnum is going to delete floating IP I am > getting an error saying you are not allowed to delete floating IP and k8s > are stuck in deleting state. > > Is there any way magnum can do floating IP release instead of delete? > > Following error I am seeing in CAPI logs. > > I0402 01:50:03.412447 1 recorder.go:104] "events: Failed to delete > floating IP 101.xx.xx.70: Request forbidden: [DELETE > https://os2.example.com:9696/v2.0/floatingips/492b2c4c-151b-437e-acfc-4778a…] > error message: {\"NeutronError\": {\"type\": \"PolicyNotAuthorized\", > \"message\": \"rule:delete_floatingip is disallowed by policy\", > \"detail\": \"\"}}" type="Warning" > object={"kind":"OpenStackMachine","namespace":"magnum-system","name":"kube-6aqje-csgft-nkz6s","uid":"97acabe1-e547-4bbc-8406-aebc563212cd","apiVersion":" > infrastructure.cluster.x-k8s.io/v1alpha7","resourceVersion":"31170690"} > reason="Faileddeletefloatingip" >

1 0

how to use policy.json in kolla
by mohammad kokabi 02 Apr '24

02 Apr '24

Hello, I'm using OpenStack Kolla Ansible, and I want to define a specific level of access for each user, but I couldn't find any documentation on this matter. For example, I have two users named David and Adrian, and I want the user David to have the ability to delete an instance, while the user Adrian should not have this access. Both users are members of a shared project. The only documentation I found is a sample policy.yaml file, which states that it should be placed in the /etc/nova directory. Could you please clarify where this file should be located for OpenStack Kolla Ansible? https://docs.openstack.org/nova/latest/configuration/sample-policy.html

1 0

[neutron] Bug Deputy Report March 25 - March 31
by Yatin Karel 02 Apr '24

02 Apr '24

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2058908 fix auto_scheduler_network understanding dhcp_agents_per_network Assigned to Sahid Orentino Medium ---------- - https://bugs.launchpad.net/neutron/+bug/2058712 [openvswitch-agent] Trunk extension should not be loaded if service plugin is disabled Assigned to Julien Cosmao Low ----- - https://bugs.launchpad.net/neutron/+bug/2059236 Add a RBAC action field in the query hooks Assigned to Rodolfo Alonso Undecided -------------- - https://bugs.launchpad.net/neutron/+bug/2059716 [ovn] Multihomed backend (IPv4 + IPv6) with floating IP unreachable, requested more information. -- Thanks and Regards Yatin Karel

1 0

[sunbeam][PTG] Sunbeam Dalmatian 2024.2 PTG schedule
by Hemanth N 02 Apr '24

02 Apr '24

Hi All, OpenStack PTG has been scheduled for next week Apr 8th to Apr 12th 2024 [1] and I have scheduled the following time slots for the OpenStack Sunbeam project. Wednesday 10 April 2024 0500 UTC to 0700 UTC Thursday 11 April 2024 1400 UTC to 1600 UTC The meeting links and details are in ptg link [2] or etherpad [3]. Feel free to add the topics of interest to discuss in the etherpad [3]. [1] https://openinfra.dev/ptg/ [2] https://ptg.opendev.org/ptg.html [3] https://etherpad.opendev.org/p/apr2024-ptg-sunbeam Looking forward to seeing you next week! Best Regards, Hemanth Nakkina

1 0

[publiccloud-sig] Reminder - next meeting April 4th - 0700 UTC
by Felix Kronlage-Dammers 02 Apr '24

02 Apr '24

Hi everyone, This Wednesday (April 4th) the next meeting of the public cloud sig is going to happen. We’ll be meeting at 0700 UTC here: https://meetpad.opendev.org/publiccloud-sig See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG This week we’ll likely prepare the vPTG Sessions for next week. This will include our own sessions that happen on Tuesday (April 9th) at 07:00 UTC and Thursday (April 11th) at 14:00 UTC. regards felix -- Felix Kronlage-Dammers Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 1

[qa][ptg] Virtual Dalmatian vPTG Planning
by Martin Kopec 02 Apr '24

02 Apr '24

Hello everyone, here is [1] our etherpad for the Dalmatian/2024.2 virtual PTG. Please, add your topics there if there is anything you would like to discuss / propose ... You can also vote for time slots for our sessions so that they fit your schedule at [2]. We will most likely go with 1-hour slot per day, as they usually fit easier into everyone's schedule. The number of slots will depend on the number of topics proposed in [1]. [1] https://etherpad.opendev.org/p/apr2024-ptg-qa [2] https://framadate.org/pklG59pH47w6ZdJI Thanks, -- Martin Kopec Principal Software Quality Engineer Red Hat EMEA IM: kopecmartin

1 1

[all][tc] Technical Committee next weekly meeting on April 2nd 2024 at 1800 UTC
by Ghanshyam Mann 02 Apr '24

02 Apr '24

Hello Everyone, Below is the agenda for the next TC meeting scheduled on April 2nd 2024 at 1800 UTC Location: Zoom Video Meeting: https://us06web.zoom.us/j/87108541765?pwd=emlXVXg4QUxrUTlLNDZ2TTllWUM3Zz09 * Roll call * Follow up on past action items * Gate health check * Implementation of Unmaintained branch statuses * TC vPTG 2024.2 ** https://etherpad.opendev.org/p/apr2024-ptg-os-tc * TC Chair Election ** Incoming TC needs to select a new chair and vice chair: https://governance.openstack.org/tc/reference/charter.html#tc-chair *Open Discussion and Reviews -gmann

1 0

[neutron][magnum][mcapi] floating IP delete permission issue
by Satish Patel 02 Apr '24

02 Apr '24

Folks, For regulatory purposes we set a neutron policy to not let normal users delete their public floating IPs because they are assigned to specific customers and we don't want them to delete them. So far that policy works. But now when it comes to magnum / mcapi. I am able to create a cluster but not able to delete because when magnum is going to delete floating IP I am getting an error saying you are not allowed to delete floating IP and k8s are stuck in deleting state. Is there any way magnum can do floating IP release instead of delete? Following error I am seeing in CAPI logs. I0402 01:50:03.412447 1 recorder.go:104] "events: Failed to delete floating IP 101.xx.xx.70: Request forbidden: [DELETE https://os2.example.com:9696/v2.0/floatingips/492b2c4c-151b-437e-acfc-4778a…] error message: {\"NeutronError\": {\"type\": \"PolicyNotAuthorized\", \"message\": \"rule:delete_floatingip is disallowed by policy\", \"detail\": \"\"}}" type="Warning" object={"kind":"OpenStackMachine","namespace":"magnum-system","name":"kube-6aqje-csgft-nkz6s","uid":"97acabe1-e547-4bbc-8406-aebc563212cd","apiVersion":" infrastructure.cluster.x-k8s.io/v1alpha7","resourceVersion":"31170690"} reason="Faileddeletefloatingip"

1 0

[manila] PTG topics reminder
by Carlos Silva 01 Apr '24

01 Apr '24

Hello, Zorillas! Sending this kind last reminder to please add your topics to the PTG topics etherpad [1] by tomorrow (Apr 2nd). I will be working on the slots on Wednesday and intend to share the agenda with you in this Thursday's weekly meeting. [1] https://etherpad.opendev.org/p/dalmatian-ptg-manila-planning Thank you! Regards, carloss

1 0

One Week Out! PTG April 2024 Registration & Schedule
by Kendall Nelson 01 Apr '24

01 Apr '24

Hello Everyone! The April 2024 Project Teams Gathering is right around the corner and the schedule has been largely set up! Slots are going fast, so make sure to get your time booked ASAP! You can find the schedule and available slots on the PTGbot website [1]. *REMINDER: The default meeting rooms are no longer Zoom rooms, they are meetpad rooms. When the PTGbot was setup initially, the meetpad rooms had been configured to match the etherpads auto generated by the bot. If your team has updated the etherpad and also wants to maintain the meetpad integration, your meetpad room URL will need to be updated as well. One thing to keep in mind about this integration - meetpad is not case sensitive, but etherpad is so to keep the integration your etherpad URL should be all lowercase. Your team does not HAVE to use meetpad (or make use of the integration with etherpad) however; just as before, the URL can be updated by your team moderator to use a different meeting tool.* The PTGbot site is regularly updated both before *and* during the PTG. Be sure to bookmark the page so you can keep track of what's being discussed and any last-minute schedule changes. It is driven via commands in the #openinfra-events IRC channel (on the OFTC network) where the PTGbot listens. If you have questions about the commands that you can give the bot, check out the documentation here[2]. Also, if you haven’t connected to IRC before, here are some docs on how to get setup![3] Lastly, please don't forget to register[4] - It’s FREE. Please let us know if you have any questions via email to ptg(a)openinfra.dev. Thanks! -Kendall (diablo_rojo) [1] PTGbot Site: https://ptg.opendev.org/ptg.html [2] PTGbot Documentation: https://opendev.org/openstack/ptgbot/src/branch/master/README.rst [3] Setup IRC: https://docs.openstack.org/contributors/common/irc.html [4] PTG Registration: https://ptg2024.openinfra.dev/

1 0