June 2024 - openstack-discuss - lists.openstack.org

[ironic] Notes from Baremetal SIG, June 5 2024
by Jay Faulkner 10 Jun '24

10 Jun '24

Hi all, The Bare Metal SIG met up Wednesday, June 5 2024 at CERN – one day before the large OpenInfra Days event. There were over 2 dozen Ironic operators and contributors present. Riccardo gave a presentation overviewing Metal3. JayF gave a presentation covering the basics of most Ironic features and highlighted several features which were deprecated. While the talks were recorded, I don't believe the recordings are available yet – I do plan on recreating an updated version of my talk for Youtube in the near future for anyone interested. After the presentations and lunch, participants returned to discuss their use cases and ask questions relating to the earlier presentations. The discussion, as well as specific action items/follow-ups, were documented here: https://etherpad.opendev.org/p/baremetal-sig-cern-june-5-2024 – I will be documenting these action items and RFEs as appropriate over the next week. Add in a short afternoon break to tour the CERN data center, seeing the thousands of machines provisioned by Ironic for CERN, and it was a pleasant day discussing and building rapport with the Ironic community. In my over ten years of working in Ironic, this was the most productive operator/contributor feedback session I've had the pleasure of attending – the attendees were engaged and I'm grateful for their participation and attendance. A special thanks to: - Dmitry Tantsur and Julia Kreger connected up remotely to the session to help field questions. Their expertise was a great help! - Arne Wieback and his team at CERN were gracious hosts and provided us a great VIP tour of the datacenter space. If you were at this event, and have feedback on how we can make future ones better, feel free to reach out here or privately with your ideas. Thanks, Jay Faulkner

1 0

[designate] [neutron] DNS and SSL error 524297
by Francesco Di Nucci 10 Jun '24

10 Jun '24

Hi all, I am using Designate with WSGI and switched to a SSL setup after tests. Somehow now there are floating IPs with a DNS name/entry that do not show in DNS zones, and when I try to release them, the neutron WSGI on network node reports this error: /SSL exception connecting to https://my-controller.example.com:9001/zones?name=zone.cloud.example.com.: HTTPSConnectionPool(host='my-controller.example.com', port=9001): Max retries exceeded with url: /zones?name=zone.cloud.example.com. (Caused by SSLError(SSLError(524297, '[SSL] PEM lib (_ssl.c:4065)')))/ I thought of an SSL config error, but the setup is identical to other working endpoints, and when testing with "/openssl s_client -connect my-controller.example.com:9001"/, everything just works Has anyone encountered this error? Thanks in advance Francesco Di Nucci

1 0

[blazar] Next IRC meeting cancelled
by Pierre Riteau 08 Jun '24

08 Jun '24

Hello, Due to unavailability of key participants, the next IRC meeting scheduled for June 13 is cancelled. We will meet again on June 27. Pierre Riteau (priteau)

1 0

[neutron] Please hold off on merging patches
by Brian Haley 07 Jun '24

07 Jun '24

Hi Neutrinos, It was noticed today by Mohammed Naser that the neutron gate was only running the docs and pep8 jobs. We were able to track it down to the RE2 patches that were recently merged [0]. Until the reverts land please don't +W anything since it could merge untested and would just need to be reverted. Other projects might have similar issues if they updated code using the 'negate' directive for regex recently as we found it doesn't actually work with RE2 when using negative lookahead [1]. Thanks, -Brian [0] https://review.opendev.org/q/topic:"files-negate" [1] https://github.com/google/re2/issues/156

4 8

oslopolicy-policy-generator: what is the namespace to use to get Mgnum policy?
by Michel Jouvin 07 Jun '24

07 Jun '24

Hi, I'd like to see the default Magnum (Oslo) policy used with Magnum. With other services, I use oslopolicy-policy-generator and use the service name as the namespace but for Magnum, "--namespace magnum" returns an error saying that there is no "magnum" namespace. Does anybody know what is the namespace to use with Magnum? Or how to display the currently active policy, preferably in YAML format? Thanks in advance. Cheers, Michel

2 6

[all][tc][ptls] Eventlet: Python 3.13 - Attach your seatbelt
by Herve Beraud 07 Jun '24

07 Jun '24

Hi all, As Python 3.13 is close to become a reality, new concerning incompatibilities between this new CPython version and Eventlet also become a reality: - https://github.com/eventlet/eventlet/issues/964 Fedora Python maintainers proposed a patch, but for now the problem remains unsolved. Also, many people reported bugs related to incompatibility between python3.12/dnspython/eventlet/pip-system-cert. There is an example who summarize well the problem https://github.com/eventlet/eventlet/issues/957 Do you have some visibility concerning the adoption of Python 3.13 into Openstack? Turbulences ahead... -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/

2 1

[swift] clean up orphan segment parts
by Rafael Tavares Oliveira 07 Jun '24

07 Jun '24

Hey there! We've been using swift and we came across this bug https://bugs.launchpad.net/swift/+bug/1813202. We decided to work it out and have an ongoing patch to solve this issue alongside ronaldo.maia(a)luizalabs.com, we would like to share and get some feedback before we submit it. To solve this, we took inspiration in obj/expirer.py: In S3 controllers we register task objects in an internal account, each task object points to an orphaned slo object, which can be created in two situations, when a multipart-upload is not completed or when a multipart object is overwritten. These tasks will be checked by the daemon (a new one we made called "s3-slo-expirer") after some time and deleted from the base accounts. Rafael

2 2

[all][tc] Eventlet migration: Call to action
by Jay Faulkner 07 Jun '24

07 Jun '24

Hi all, As you may have read in Goutham's TC summary, the existing eventlet goal[0] is unlikely to gain consensus to merge. This appears to be due to the difference in needs between OpenStack projects, and belief that it's unlikely a single solution would serve them all. Our current situation is: 1) Eventlet usage must be discontinued. The temporary maintainers are just that -- temporary -- and we should not expect eventlet to continue to be a valid path moving forward. 2) We have basic agreement that shared tooling, such as oslo libraries, should not dictate a specific threading model. In lieu of specific technical leadership and guidance from the TC, this leaves it to individual projects to decide what threading model to use instead of eventlet monkey patching. The unmerged spec[0] may be a good starting point if you're wondering where to start. Importantly: do not let this work wait! It is a significant change and will take a long time to complete. Thanks, Jay Faulkner 0: https://review.opendev.org/c/openstack/governance/+/902585

6 7

[neutron] Drivers meeting cancelled tomorrow
by Brian Haley 06 Jun '24

06 Jun '24

Hello Neutrinos: Due to the lack of agenda, Friday's drivers meeting is cancelled. Have a nice weekend! -Brian

1 0

[ironic] Failed when writing image to the device file /dev/sda
by James Leong 06 Jun '24

06 Jun '24

Hi all, I have been exploring ironic, with a simple setup. However, I get the following error messages whenever I attempt to deploy an ISO image to my baremetal node. 1. An agent token generation request is being refused as one is already present for the node 2. Writing image to device /dev/sda failed with exit code 32. stdout: . stderr: lsblk: /dev/sda2: not a block device 3. Invalid or missing agent_token received for node I am not quite sure what is required to be set on my node's property other than vendor and cpu_arch. Any help would be appreciated. Best, James

1 0

[kolla-ansible][Antelope][Keystone] Redelegation Not Working with Heat
by Devin Patterson 06 Jun '24

06 Jun '24

Hello! We are attempting to use role redelegation with Heat and Keystone to deploy a stack that deploys Zaqar subscriptions among other resources. When attempting to scale up the stack, we receive this error: TypeError: '<' not supported between instances of 'NoneType' and 'int') This appears to be sourced from this check in the code in the Keystone core.py file. # expiry times trust_expiry = trust.get('expires_at') redelegated_expiry = redelegated_trust['expires_at'] if trust_expiry: # redelegated trust is from backend and has no tzinfo if redelegated_expiry < trust_expiry.replace(tzinfo=None): raise exception.Forbidden( _('Requested expiration time is more ' 'than redelegated trust can provide')) The issue appears to be related to 'None' values for what is passed into 'expires_at' for 'redelegated_expiry'. We have this config in keystone.conf: [trust] allow_redelegation = True And this in heat.conf: reauthentication_auth_method = trusts allow_trusts_redelegation = True This is how we are scaling the stack: openstack stack resource signal <stack_name> scale_up_policy Any suggestions on how to fix this issue? Thanks, Devin

1 0

[masakari] DB migration failure during upgrade to 2024.1
by Dmitriy Rabotyagov 06 Jun '24

06 Jun '24

Hey folks, Just wanted to let you know, that upgrade of Masakari to 2024.1 is most likely borked due to issue in Alembic migration, where masakari considers taskflow DB as its own, as masakari-manage does not pass correct namespace for alembic. Upgrade path is not tested in CI, which made it possible to slip the issue from the radar. There's a patch existing [1] that fixes the root cause of the issue, though needs to be reviewed and backported. Thus, I wanted to call out Masakari Maintainers for some attention to this issue as well as give operators some awareness about the issue. [1] https://review.opendev.org/c/openstack/masakari/+/920034

1 0

[stackalytics] no "neutron" module for Commits
by Ihar Hrachyshka 06 Jun '24

06 Jun '24

Hi, I noticed that "neutron" is not an option in the Module list when Commits are selected, and no neutron commits are registered since ~Oct 2023. On the other hand, other Neutron program repos (e.g. neutron-lib and neutron-tempest-plugin) are available in the list and do register commits. Also, when Reviews are selected, neutron module is back as an option, and review stats are correctly updated. I checked governance yaml and it doesn't strike me as incorrect: https://opendev.org/openstack/governance/src/commit/5f93b99a3c90b452f6c7368… Any ideas what may have happened? Thanks, Ihar

4 7

[Horizon][Keystone] Multiple OIDC Providers and token deletion at logout
by MIchele Delli Veneri 06 Jun '24

06 Jun '24

Hi, We have configured our keystone and Horizon to work with multiple OIDC Providers and through API I can successfully authenticate with the two providers. When I authenticate through the Horizon dashboard, I can successfully authenticate with both providers if I use two separate browser sessions, If I use the same browser session, I log in with one provider, log out, and then log in with the other, given that the user token is stored, I get an authentication error. The reason for the error is that the token was issued by the first provider and thus it is not accepted as a valid by the second. Is it possible to configure Horizon to revoke/delete a user token at logout or provide session isolation without changes on the provider side? Thank you and best regards, Michele Delli Veneri

1 0

[Horizon][Keystone] Multiple OIDC Providers and token deletion at logout
by Michele Delli Veneri 06 Jun '24

06 Jun '24

Hi, We have configured our keystone and Horizon to work with multiple OIDC Providers and through API I can successfully authenticate with the two providers. When I authenticate through the Horizon dashboard, I can successfully authenticate with both providers if I use two separate browser sessions, If I use the same browser session, I log in with one provider, log out, and then log in with the other, given that the user token is stored, I get an authentication error. The reason for the error is that the token was issued by the first provider and thus it is not accepted as a valid by the second. Is it possible to configure Horizon to revoke/delete a user token at logout or provide session isolation without changes on the provider side? Thank you and best regards, Michele Delli Veneri

1 0

Re: [ops] help with manila
by Alvaro Soto 05 Jun '24

05 Jun '24

[ please hit reply all ] Hi! 1. Your cluster needs to be healthy for Manila to connect. Could you purge your Ceph cluster to free up space? 2. They are very open, but they are OK if they are just for testing. 3. Yes, many resources are out there, but I'll depend on what deployment tool you're using. Cheers!

1 0

Antelope Barbican/Keystone: failure to delete secrets (Keystone TrustNotFound)
by Michel Jouvin 05 Jun '24

05 Jun '24

Hi, I've been validating Yoga -> Antelope on our preprod cloud. It was working successfully but "suddenly" (i.e. without a kwown/identified change!) when deleting Magnum clusters, the deletion of Barbican secrets (after stack deletion) fail. In the Magnum log, I find the following error: ---- Failed to delete trust: keystoneauth1.exceptions.http.Unauthorized: The request you have made requires authentication. (HTTP 401) (Request-ID: req-a4400250-e8d5-46ec-a28a-dcb97a682512) (traceback skipped for readability) 2024-05-29 10:43:09.750 2078 INFO magnum.common.cert_manager.barbican_cert_manager [None req-94df560b-d6da-4fba-83a9-34e0b08c64c8 - - - - - -] Recursively deleting certificate container https://os-77023.lal.in2p3.fr:9311/v1/containers/edd8487a-6cf1-4f4c-9f53-17… from Barbican. 2024-05-29 10:43:09.750 2078 INFO barbicanclient.base [None req-94df560b-d6da-4fba-83a9-34e0b08c64c8 - - - - - -] Calculated Containers uuid ref: containers/edd8487a-6cf1-4f4c-9f53-173dfae7a8b2 2024-05-29 10:43:09.760 2078 ERROR barbicanclient.client [None req-94df560b-d6da-4fba-83a9-34e0b08c64c8 - - - - - -] 4xx Client error: Not Found: Secrets container not found. 2024-05-29 10:43:09.761 2078 ERROR magnum.common.cert_manager.barbican_cert_manager [None req-94df560b-d6da-4fba-83a9-34e0b08c64c8 - - - - - -] Error recursively deleting certificate container https://os-77023.lal.in2p3.fr:9311/v1/containers/edd8487a-6cf1-4f4c-9f53-17…: barbicanclient.exceptions.HTTPClientError: Not Found: Secrets container not found. ---- In Keystone log, I find with the same timestamp the following error that seems related to the one above: ---- 2024-05-29 10:43:09.690 1713 WARNING keystone.api._shared.authentication [None req-a4400250-e8d5-46ec-a28a-dcb97a682512 - - - - - -] Could not find trust: cf4b1b6082594025a1ff9e48df383566.: keystone.exception.TrustNotFound: Could not find trust: cf4b1b6082594025a1ff9e48df383566. 2024-05-29 10:43:09.693 1713 WARNING keystone.server.flask.application [None req-a4400250-e8d5-46ec-a28a-dcb97a682512 - - - - - -] Authorization failed. The request you have made requires authentication. from 134.158.77.23: keystone.exception.Unauthorized: The request you have made requires authentication. 2024-05-29 10:43:09.746 1723 ERROR keystone.server.flask.application [None req-8c76f304-c2a3-418c-8372-02c706ed356e 44d8cb3192b3485790ababe29991491a - 5b67a8641dd041089e018ceea9884eac - 5b67a8641dd041089e018ceea9884eac -] Could not find user: 527ec32509d849e8a49b41c3dc4c4c32.: keystone.exception.UserNotFound: Could not find user: 527ec32509d849e8a49b41c3dc4c4c32. ---- It is not clear for me if the ERROR is releated to the 2 warnings as the request is not the same but it seems to happen every time this way. In Barbican logs, there is not much things related except a 401 status for the request corresponding ot the TrustNotFound. I'm looking for advices on how to troubleshoot this. In particular, when the trust should be created and whether I should find somewhere a matching error at the time of the trust creation. It seems the error is only affecting deletion but I may be wrong. for the record, when starting Magnum there is an error complaining about /etc/magnum/keystone_auth_default_policy.json being not found but ignored it so far. And in Keystone an error seems to occur at Magnum cluster creation time: --- 2024-05-29 10:17:17.530 1711 WARNING py.warnings [None req-f484cc35-3e54-4d7f-8688-e6442c90344f a22b1199c74f4a819a49f3ac037a5e44 1dd67113c8bb4ef0a31dfca53335ffbd - - defaul t default] /usr/lib/python3.9/site-packages/oslo_policy/policy.py:1129: UserWarning: Policy "identity:list_services": "role:reader and system_scope:all" failed scope check. The token used to make the request was project scoped but the policy requires ['system'] scope. This behavior may change in the future where using the intended scope is re quired ---- Thanks in advance for any hint. Best regards, Michel

2 3

Antelope Magnum: creating a new cluster makes the/some others unhealthy
by Michel Jouvin 05 Jun '24

05 Jun '24

Hi, I have been playing with Magnum (Antelope), creating a lot of clusters with the same template and varying the number of masters and/or nodes, having ~10 clusters started in the same project. I observed recently that cluster configuration that used to work well were not working any more (CREATE_FAILED during the master deployment in general). I have not found any evidence of the cause digging in various logs but I observed that with the current list of active clusters, if add a new one (even with a configuration as minimal as 1 master and 1 node), not only its creation fails but also the other (or at least) running clusters become unhealthy. If I delete the failed cluster, the other clusters return to the healthy state. It seems very reproducible (I did it more than 10 times) but I still don't see any message in the logs that could help to identify the cause. I've the feeling (but may be wrong) that it is related to either an insufficient project quota or an insufficient limit on one of the OpenStack service. Any idea on a possible cause or any advice on where to look for some information? Thanks in advance. Michel

2 6

Antelope: weird problem with member role after upgrade (Nova and Glance)
by Michel Jouvin 05 Jun '24

05 Jun '24

Hi, I just upgraded Nova/Cinder/Glance of our production cloud from Yoga to Antelope (after upgrading Keystone yesterday) and since the upgrade, users who are not admin cannot do anything basically, despite we changed nothing to service configuration or user's roles since Yoga. We enabled scoped tokens a while ago (several months). For (bad) historical reasons, the role "member" was called "users" but it had no impact (I was surprised), despite we are using standard policies. We thought it may be a consequence of this and we renamed the role back to "member". It was not enough to fix the problem, even after restart memcached on all servers just in case. We thought that there was may be some caching done somewhere with the old role name and modified slightly the policy rules defining what is a member or read with: "project_member_api": "(role:member or role:users) and project_id:%(project_id)s" "project_reader_api": "(role:reader or role:users) and project_id:%(project_id)s" It first works but the change was reverted by mistake and now it doesn't work anymore. I am really completely stuck, without any clue about what happen and on how to troubleshoot it. I googled a bit but was not able to find something looking similar... Any help would be greatly appreciated. Best regards, Michel -- Michel

3 2

[ops] help with manila
by Shubham Kumar Yadav 04 Jun '24

04 Jun '24

hello, I'm trying to install manila in my openstack cloud but having problem with "*Authorizing the driver to communicate with Ceph*" *1 -> *i have created a configmap with these confs and mounted it on manila-share pod [client.manila]client mount uid = 0client mount gid = 0log file = /opt/stack/logs/ceph-client.manila.logadmin socket = /opt/stack/status/stack/ceph-$name.$pid.asokkeyring = /etc/ceph/manila.keyring *2 -> *then i have created a secret with client.manila keyring and attached it to the manila-share pod at keyring = /etc/ceph/manila.keyring *3 -> *inside manila-share pod i see the logs 2024-06-03 09:00:53.682 6 INFO manila.share.drivers.cephfs.driver [None req-22cd7b29-a383-44cd-8cb8-1c639a3034dc - - - - - -] [CEPHFSNATIVE1] Ceph client found, connecting... 2024-06-03 09:00:53.713 6 ERROR manila.share.manager [None req-22cd7b29-a383-44cd-8cb8-1c639a3034dc - - - - - -] Error encountered during initialization of driver CephFSDriver@lab-11053-26006-ceph-2@cephfsnative1: manila.exception.ShareBackendException: [%(be)s] Ceph client failed to connect. 2024-06-03 09:00:53.713 6 ERROR manila.share.manager Traceback (most recent call last): 2024-06-03 09:00:53.713 6 ERROR manila.share.manager File "/var/lib/openstack/lib/python3.10/site-packages/manila/share/drivers/cephfs/driver.py", line 421, in rados_client 2024-06-03 09:00:53.713 6 ERROR manila.share.manager self._rados_client.connect() 2024-06-03 09:00:53.713 6 ERROR manila.share.manager File "rados.pyx", line 690, in rados.Rados.connect 2024-06-03 09:00:53.713 6 ERROR manila.share.manager rados.IOError: [errno 5] RADOS I/O error (error connecting to the cluster) 2024-06-03 09:00:53.713 6 ERROR manila.share.manager 2024-06-03 09:00:53.713 6 ERROR manila.share.manager During handling of the above exception, another exception occurred: 2024-06-03 09:00:53.713 6 ERROR manila.share.manager 2024-06-03 09:00:53.713 6 ERROR manila.share.manager Traceback (most recent call last): 2024-06-03 09:00:53.713 6 ERROR manila.share.manager File "/var/lib/openstack/lib/python3.10/site-packages/manila/share/manager.py", line 371, in _driver_setup 2024-06-03 09:00:53.713 6 ERROR manila.share.manager self.driver.do_setup(ctxt) 2024-06-03 09:00:53.713 6 ERROR manila.share.manager File "/var/lib/openstack/lib/python3.10/site-packages/manila/share/drivers/cephfs/driver.py", line 274, in do_setup 2024-06-03 09:00:53.713 6 ERROR manila.share.manager rados_client=self.rados_client, 2024-06-03 09:00:53.713 6 ERROR manila.share.manager File "/var/lib/openstack/lib/python3.10/site-packages/manila/share/drivers/cephfs/driver.py", line 424, in rados_client 2024-06-03 09:00:53.713 6 ERROR manila.share.manager raise exception.ShareBackendException( 2024-06-03 09:00:53.713 6 ERROR manila.share.manager manila.exception.ShareBackendException: [%(be)s] Ceph client failed to connect. 2024-06-03 09:00:53.713 6 ERROR manila.share.manager 2024-06-03 09:00:53.714 6 DEBUG manila.utils [None req-22cd7b29-a383-44cd-8cb8-1c639a3034dc - - - - - -] Finished call to 'manila.share.manager.ShareManager.init_host.<locals>._driver_setup' after 2222.651(s), this was the 12th time calling it. log_it /var/lib/openstack/lib/python3.10/site-packages/tenacity/after.py:44 2024-06-03 09:00:53.714 6 DEBUG manila.utils [None req-22cd7b29-a383-44cd-8cb8-1c639a3034dc - - - - - -] Retrying manila.share.manager.ShareManager.init_host.<locals>._driver_setup in 600.0 seconds as it raised ShareBackendException: [%(be)s] Ceph client failed to connect.. log_it /var/lib/openstack/lib/python3.10/site-packages/tenacity/before_sleep.py:65 *4 -> *and in manila-api i see logs Mon Jun 3 09:41:18 2024 - *** uWSGI listen queue of socket "0.0.0.0:8786" (fd: 3) full !!! (101/100) *** Mon Jun 3 09:41:19 2024 - *** uWSGI listen queue of socket "0.0.0.0:8786" (fd: 3) full !!! (101/100) *** even when i have set manila: DEFAULT: wsgi_default_pool_size: 1000 Hope to hear from you soon with a solution Thank you!

2 1

Is it possible to rename a role?
by Michel Jouvin 04 Jun '24

04 Jun '24

Hi, I just upgraded Nova/Cinder/Glance of our production cloud from Yoga to Antelope (after upgrading Keystone yesterday) and since the upgrade, users who are not admin cannot do anything basically with Glance and Nova, despite we changed nothing to service configuration or user's roles since Yoga. We enabled scoped tokens a while ago (several months). After some research, we found that it was linked to the fact that for (bad) historical reasons, the person who created the cloud 10 years ago renamed the role "member" to "users". It has been working without bad impact up to know. I was surprised of this absence of impact when we switched to scope tokens and enforced new rules. I realize that it is because several (all?) services up to Yoga was still supporting the old rules in addition to the new ones. On Cinder and Keystone for example, if using oslopolicy-policy-generator, it reports deprecated rules that are not defined in our configuration and I guess it is because old rules are not yet deleted on these services. Our first attempt to fix the problem has been to rename the users role (that every non-admin user has instead of the no-longer existing member role) back to its original name, member. Unfortunately it didn't solve the problem, even after restarting memcached everywhere (not sure it may have an impact) and the API services on Glance and Nova. We found a workaround modifying slightly the policy rules defining what is a member or reader with the following for Nova (and something similar for Glance, even if more rules have to be modified as there is no rule defining what is a member or reader): "project_member_api": "(role:member or role:users) and project_id:%(project_id)s" "project_reader_api": "(role:reader or role:users) and project_id:%(project_id)s" *My question is:* why renaming the role was not enough? The fact that "openstack role set --name" exists suggests that it should work, isn't it? We can probably leave with the workound we found but it would make the configuration simpler if we could fix the role name and keep the standard rules... Thanks in advance for any suggestion on how to do it or to troubleshoot the fact it doesn't work... Best regards, Michel

1 0

Is it possible to rename a role?
by Michel Jouvin 04 Jun '24

04 Jun '24

Hi, I just upgraded Nova/Cinder/Glance of our production cloud from Yoga to Antelope (after upgrading Keystone yesterday) and since the upgrade, users who are not admin cannot do anything basically with Glance and Nova, despite we changed nothing to service configuration or user's roles since Yoga. We enabled scoped tokens a while ago (several months). After some research, we found that it was linked to the fact that for (bad) historical reasons, the person who created the cloud 10 years ago renamed the role "member" to "users". It has been working without bad impact up to know. I was surprised of this absence of impact when we switched to scope tokens and enforced new rules. I realize that it is because several (all?) services up to Yoga was still supporting the old rules in addition to the new ones. On Cinder and Keystone for example, if using oslopolicy-policy-generator, it reports deprecated rules that are not defined in our configuration and I guess it is because old rules are not yet deleted on these services. Our first attempt to fix the problem has been to rename the users role (that every non-admin user has instead of the no-longer existing member role) back to its original name, member. Unfortunately it didn't solve the problem, even after restarting memcached everywhere (not sure it may have an impact) and the API services on Glance and Nova. We found a workaround modifying slightly the policy rules defining what is a member or reader with the following for Nova (and something similar for Glance, even if more rules have to be modified as there is no rule defining what is a member or reader): "project_member_api": "(role:member or role:users) and project_id:%(project_id)s" "project_reader_api": "(role:reader or role:users) and project_id:%(project_id)s" My question is: why renaming the role was not enough? The fact that "openstack role set --name" exists suggests that it should work, isn't it? We can probably leave with the workound we found but it would make the configuration simpler if we could fix the role name and keep the standard rules... Thanks in advance for any suggestion on how to do it or to troubleshoot the fact it doesn't work... Best regards, Michel -- Michel

1 0

Nova live migration
by Gk Gk 04 Jun '24

04 Jun '24

Hi, I see this in the latest nova configuration: This option is deprecated for removal since 15.0.0. Its value may be silently ignored in the future. Reason: live_migration_uri is deprecated for removal in favor of two other options that allow to change live migration scheme and target URI: live_migration_scheme and live_migration_inbound_addr respectively. So, if I want to use live_migration_scheme, what are its values ? If I use the live_migration_scheme option, can I remove the live_migration_uri option ? Thanks

3 9

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-17)
by Goutham Pacha Ravi 03 Jun '24

03 Jun '24

Hello Stackers, The 2024.2 release cycle is chugging along, and its last stop is 17 weeks away [1]. This week is the 2024.1 "cycle-trailing" release deadline for projects that follow this model. Typically, these are configuration management, packaging, and deployment tooling projects. In the past week, we undertook several governance activities that I'd like to summarize for you. We made a significant change to the "Distributed Leadership" model of project governance [2]. A project's governance will default to the PTL model during elections; if the project community would like to pursue the DPL model, they can do so by nominating liaisons for that release cycle. There's also going to be a TC liaison to each project following the DPL model. The TC liaison will follow the project's activity at regular intervals and interface with the TC. These changes will hopefully help signal project health concerns earlier. The TC also clarified that we'd adopt a "formal-vote" process for project team retirements. A formal vote would mean a third of the TC endorses a change through a "roll call" vote. We also cleaned up the emerging and inactive projects list [3]. Members of the TaCT SIG have started the arduous process of cleaning up PyPi, where we had a number of human maintainer accounts for OpenStack packages [4]. === Weekly Meeting === The OpenStack Technical Committee (TC) meeting on May 28, 2024, covered several topics [5]. Concerns were raised about the inactivity of projects like Freezer, Monasca, and Watcher. Discussions focused on adding TC members as temporary core reviewers to inactive projects to maintain them until new maintainers are found or to retire them if no interest is shown. A vote was held on whether the TC should be added to the Gerrit approving group for inactive projects, resulting in a split decision (4 yes, 3 no). For now, we decided to maintain the status quo. The revival of Watcher is being spearheaded by Dan Smith (dansmith) and aided by Ghanshyam Mann (gmann) and Slawek Kaplonski (slaweq). Our next weekly meeting will be held tomorrow (June 4, 2024) simultaneously on video (Zoom) and IRC. The meeting agenda and the details on how to join are in [6]. I hope that you're able to join us! === Governance Proposals === ==== Merged ==== - Remove retired project from Inactive project list | https://review.opendev.org/c/openstack/governance/+/920146 - Mark migrate-ci-jobs-to-ubuntu-jammy goal completed | https://review.opendev.org/c/openstack/governance/+/920143 - Add DPL model & liaison reset policy | https://review.opendev.org/c/openstack/governance/+/916833 - Clarify the project retirement vs project's repository retirement | https://review.opendev.org/c/openstack/governance/+/919984 - Simplifying house rule for project-updates | https://review.opendev.org/c/openstack/governance/+/920318 ==== Open for review/discussion ==== - Appoint ChunYang Wu as PTL of Trove | https://review.opendev.org/c/openstack/governance/+/920462 - Migrate eventlet usages to asyncio | https://review.opendev.org/c/openstack/governance/+/902585 - Update to include docs and miscellaneous repos for AC status | https://review.opendev.org/c/openstack/governance/+/915021 The OpenStack Technical Committee serves you! We're always willing to chat with you and would love feedback: === How to contact the TC === You can reach out to the TC in multiple ways: 1. Email: you can send the email with the tag [tc] on this email list. 2. Ping us using the 'tc-members' keyword on the #openstack-tc IRC channel. 3. Join us at our weekly meeting: The Technical Committee meets every week on Tuesdays at 1800 UTC [6]. Finally, if you got this far, I hope you found this update helpful. I'd appreciate it if you had any feedback regarding the format, content, frequency, or timing of this weekly email. Please feel free to email me off-list if you're more comfortable doing so. Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] https://releases.openstack.org/dalmatian/schedule.html [2] https://governance.openstack.org/tc/reference/distributed-project-leadershi… [3] https://governance.openstack.org/tc/reference/emerging-technology-and-inact… [4] https://etherpad.opendev.org/p/openstack-pypi-maintainers-cleanup#L52 [5] https://meetings.opendev.org/meetings/tc/2024/tc.2024-05-28-18.00.log.html [6] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[ironic] Having issue with deploying ISO image to node
by James Leong 03 Jun '24

03 Jun '24

Hi all, I am trying to play around with ironic, and I am having an issue with deploying an Ubuntu 20.04 ISO image onto my bare metal node. Since I am quite new to bare metal, I am not entirely sure what went wrong as I couldn't find any error messages shown on my log file (ironic-conductor, ironic-api, ironic_neutron_agent, and nova-compute-ironic). This might be my guess; the ironic inspection is hitting timeout, which is causing the deployment to timeout. However, I have no idea why the inspection is failing at timeout. Any help would be appreciated. Best, James

3 4