July 2024 - openstack-discuss - lists.openstack.org

[horizon] How to enable MFA using TOTP on Horizon (ZED)
by Shubham Kumar Yadav 30 Jul '24

30 Jul '24

Hi all, I was working on a MFA in openstack (ZED). Is it possible to enable MFA using TOTP on Horizon? I'm using a ZED Openstack with Ubuntu 22.04 , and I know that from the CLI point of view, you can have Multi Factor Authentication, but I don't see that implemented on Horizon. i added MFA using - https://docs.openstack.org/keystone/pike/advanced-topics/auth-totp.html but now the problem is i can use the token issued to run openstack cli but not able to login into Horizon with user and password/totp. I see The Totp support was added to Horizon in the Bobcat (2023.2) release So i would like to ask how it is possible to backport the feature in Horizon in the zed release. I would appreciate any help! Thanks!

2 1

[ironic] ironic-inspector bugfix branches
by Riccardo Pittau 30 Jul '24

30 Jul '24

Hello ironicers! With the deprecation and the migration of the ironic-inspector functionalities to the new agent interface in ironic we have decided to also stop cutting bugfix branches for the project. The last bugfix branch for ironic-inspector is bugfix/12.2 supported until December 2024. We'll continue with the normal release schedule until full retirement of the project. Thanks Ciao! Riccardo

1 0

[neutron] CI Meeting cancelled for today
by Yatin Karel 30 Jul '24

30 Jul '24

Hello Neutron Team !! I will not be able to chair the CI meeting today as I have to attend some internal meetings. Sorry for the late notice. We have some known issues in CI and all are under track with patches in gate or already merged. There are some issues in the periodic line specific to ovs-master jobs and 9-stream so will report issues for those. -- Thanks and Regards Yatin Karel

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-9)
by Goutham Pacha Ravi 30 Jul '24

30 Jul '24

Hello Stackers, We're counting down 9 weeks to the 2024.2 (Dalmatian) release [1]. OpenStack projects that follow the cycle-with-rc release model [2] will have their code freeze in 4 weeks. Between now and the release, the release team will communicate with us weekly to coordinate deliverables across the community. The elections for OpenStack PTLs and Technical Committee members are around the corner as well, so now is a good time to ensure that you are eligible to vote in these elections! Please navigate to: https://civs1.civs.us/cgi-bin/opt_in.pl Enter your preferred email address on Gerrit and request activation. It only takes a minute! :) The following are updates from the OpenStack Technical Committee during the past week. === Weekly Meeting === The TC had a productive meeting via IRC on OFTC's #openstack-tc channel last week [3]. We discussed follow-ups for the eventlet removal goal proposal [4] and recent updates to inactive and emerging OpenStack projects. We spent some time assessing gate health concerns, including an issue with a change to `setuptools` that requires us to bump the upper constraint on the "packaging" library in stable/2023.1 [5]. This was important to get some CVE fixes landed in various OpenStack code repositories. Finally, we refreshed our understanding of the TC's house rules. To summarize: - Changes to the TC charter require at least 2/3 of the TC voting in favor, while governance motions require at least 1/3 of the TC to vote in favor. - TC members can vote positively, negatively, or abstain (using the “RollCall-Vote” in Gerrit). - Decisions need more positive votes than negative votes (ties mean the proposal is rejected). - Any motion or charter-change is deliberately open at least a week after it was last proposed/updated, allowing the TC and the wider community to participate fully. - Significant governance changes take a while to merge because of the importance of ensuring full TC and community engagement in votes. Our next weekly meeting is tomorrow (2024-07-30) at 1800 UTC via IRC on OFTC's #openstack-tc channel. You can find the agenda on the OpenStack TC wiki page [6]. Please consider joining us and remember, you can edit the wiki and propose new topics! === Governance Proposals === ==== Merged ==== - Add `os-test-images` under glance | https://review.opendev.org/c/openstack/governance/+/925044 ==== Open for review/discussion ==== - [Follow-up] Fix typos in the eventlet proposal | https://review.opendev.org/c/openstack/governance/+/924944 - Update criteria for inactive projects to become active again | https://review.opendev.org/c/openstack/governance/+/921500 - Follow up on the affiliation diversity handling | https://review.opendev.org/c/openstack/governance/+/923876 - Inactive state extensions: Monasca | https://review.opendev.org/c/openstack/governance/+/923919 === Upcoming Events === - 2024-08-12: Call for Proposals due for the OpenInfra Days NA [7] - 2024-08-14: Nominations open for 2025.1 OpenStack PTL+TC elections - 2024-08-24: OpenInfra Days, Vietnam: https://2024.vietopeninfra.org/ - 2024-08-29: Dalmatian-3 milestone - 2024-09-03: OpenInfra Summit Asia, Suwon The OpenStack Technical Committee serves you! We're always willing to chat and would love feedback: === How to contact the TC === You can reach out to the TC in multiple ways: 1. Email: Send an email with the tag [tc] on this email list. 2. Ping us using the 'tc-members' keyword on the #openstack-tc IRC channel. 3. Join us at our weekly meeting: The Technical Committee meets every week on Tuesdays at 1800 UTC [7]. Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] Release Schedule: https://releases.openstack.org/dalmatian/schedule.html [2] OpenStack cycle-with-rc model: https://releases.openstack.org/reference/release_models.html#cycle-with-rc [3] TC Meeting IRC Logs, 2024-07-23: https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-23-18.00.log.html [4] Remove Eventlet From Openstack: https://review.opendev.org/c/openstack/governance/+/902585 [5] Update packaging constraint in stable/2023.1: https://review.opendev.org/c/openstack/requirements/+/924764 [6] TC Meeting, 2024-07-30: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [7] Call for Proposals, OpenInfra Days NA: https://docs.google.com/forms/d/e/1FAIpQLSeFQBL1qGNegDWDHCVTLtu_wLf06w7JJkc…

1 0

Cinder Bug Report 2024-07-29
by Jon Bernard 29 Jul '24

29 Jul '24

Hello Argonauts, Cinder Bug Meeting Etherpad <https://etherpad.opendev.org/p/cinder-bug-squad-meeting> Undecided - When restoring volume using the imported backup, it is always scheduled to the same host. <https://bugs.launchpad.net/cinder/+bug/2074058> - Status: In Progress (assigned) - The cinder-backup swift driver connects to swift in a different region. <https://bugs.launchpad.net/cinder/+bug/2074126> - Status: In Progress (assigned) - allow_qcow2_backing_file flag cannot be passed into some image_utils operations <https://bugs.launchpad.net/cinder/+bug/2074377> - Status: New (unassigned) Thanks, -- Jon

1 0

[nova][ops] Deprecate AMI/direct kernel boot support
by Dan Smith 29 Jul '24

29 Jul '24

Hi all, tl;dr: We really need ops feedback about any direct need to retain this feature. Since the early days, Nova has supported the notion of "direct linux kernel boot" (with libvirt/kvm at least). This means each bootable image in Glance is actually three parts: a disk image, a ramdisk image, and a kernel. Booting the instance involves putting the kernel and ramdisk into memory in a special way that the kernel can immediately start booting instead of doing things like running the bootloader like a normal system does. This is present in Nova because of long-ago Amazon compatibility, as this is how Xen paravirt guests used to work for them. I think that in the early days of Nova, compatibility with the _actual_ images used on Amazon was important, but I think that is no longer something we need to care about today, just as we have deprecated EC2 API compatibility. It should also be noted that some of it is broken, and the recent CVE fixes have broken it like three times in the last 30 days. Continuing to support it makes the code more complex and fragile, and arguably less secure. So, I'm asking for operator feedback on this question: Do you need this feature, and if so, why? Speak now or expect to see it deprecated for removal very soon. Thanks! --Dan

3 5

[neutron] Bug deputy report (week starting on July 22)
by Bernard Cafarelli 29 Jul '24

29 Jul '24

Hey neutrinos, here is the list of bugs reported during 2024 week 30 Most are in progress (or already fixed), except these: https://bugs.launchpad.net/bugs/2074207 (endless loop in DHCP agent), https://bugs.launchpad.net/bugs/2073872 (L3 HA routes issue in Yoga) and https://bugs.launchpad.net/neutron/+bug/2074056 (security groups doc/API) Critical * Couple of jobs broken as rpc-server not enabled since patch 924473 - https://bugs.launchpad.net/bugs/2073844 Mentioning for visibility, this was fixed in devstack with https://review.opendev.org/c/openstack/devstack/+/924693 * compute tests involving shelve/snapshots/rescue fails with Image is unacceptable: Image content does not match disk_format - https://bugs.launchpad.net/bugs/2073944 Also for visibility, fixed in nova with https://review.opendev.org/c/openstack/nova/+/924866 High * Switch from distributed to centralized Floating IPs breaks connectivity to the existing FIPs - https://bugs.launchpad.net/neutron/+bug/2073987 Fix in progress by slaweq - https://review.opendev.org/c/openstack/neutron/+/925007 * DHCP agent makes endless attempts to configure a network with MTU < 1280 - https://bugs.launchpad.net/bugs/2074207 Related/follow-up to similar https://bugs.launchpad.net/neutron/+bug/1988069, unassigned Medium * ``ProcessMonitor._check_child_processes`` cannot release the GIL inside a locked method - https://bugs.launchpad.net/bugs/2073743 Patch by Rodolfo - https://review.opendev.org/c/openstack/neutron/+/924581 * [eventlet-deprecation] Reduce the ``IpConntrackManager`` process pool to a single thread - https://bugs.launchpad.net/neutron/+bug/2073745 Patch by Rodolfo - https://review.opendev.org/c/openstack/neutron/+/924582 * "Tagging" extension does not initialize the policy enforcer - https://bugs.launchpad.net/bugs/2073782 Patch by Rodolfo - https://review.opendev.org/c/openstack/neutron/+/924656 * "Tagging" extension cannot add tags with charater "/" - https://bugs.launchpad.net/bugs/2073836 Patches by Rodolfo - https://review.opendev.org/c/openstack/neutron-lib/+/924700 and https://review.opendev.org/c/openstack/neutron/+/924724 * Neutron L3 agent not create ECMP in HA router but in single mode is ok - https://bugs.launchpad.net/bugs/2073872 L3-HA bug reported on Yoga, needs some eyes * IPv6 dns nameservers described with their scope on the IP are not supported - https://bugs.launchpad.net/bugs/2073894 Elvira working on it (fix in oslo.utils) * Subnet pool attribute updates fail when using address scopes - https://bugs.launchpad.net/neutron/+bug/2074092 Possible regression from https://review.opendev.org/c/openstack/neutron/+/667511, fix discussed https://review.opendev.org/c/openstack/neutron/+/924984 * [OVN] Trunk subports should have the same VIF type as the parent port - https://bugs.launchpad.net/neutron/+bug/2074185 Assigned to Rodolfo * OVN maintenance tasks may be delayed 10 minutes in the podified deployment - https://bugs.launchpad.net/bugs/2074209 Assigned to Slaweq Low * Invalid documented security group rule protocol "any" - https://bugs.launchpad.net/neutron/+bug/2074056 Sounds like low-hanging fruit on documentation and security groups * DB semantic violation seen in neutron-tempest-plugin-openvswitch logs deleting router - https://bugs.launchpad.net/bugs/2074312 Assigned to Brian Wishlist * [RFE] Extend "port list" command to show the trunk subports - https://bugs.launchpad.net/bugs/2074187 -- Bernard Cafarelli

1 0

[release][ptl] 2025.1 Epoxy release schedule - review request from teams
by Elõd Illés 29 Jul '24

29 Jul '24

Hi, Let me share the proposed 2025.1 Epoxy release schedule [1] (see the generated page [2] - for Patch Set 2 !!!). PTLs, teams, please review it and let us know your opinions! [1] https://review.opendev.org/c/openstack/releases/+/924671 [2] https://storage.bhs.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/… Cheers, Előd Illés irc: elodilles @ #openstack-release

1 0

how upgrade OpenStack version 5.8.0 to 6.1.0
by kjme001＠gmail.com 29 Jul '24

29 Jul '24

Hello I have OpenStack version 5.8.0, how do I upgrade it to a newer version, e.g. to version 6.1.0? thanks for your help regards

5 6

[nova] rescheduler
by Alex Song (宋文平) 27 Jul '24

27 Jul '24

Hi all, Is the reschedule flow only for building instance? Why evacuate and migration hasn’t? Thanks in advance Alex song

3 2

[qa] Core lists cleanup
by Martin Kopec 26 Jul '24

26 Jul '24

Hi everyone, we're planning to clean up the QA core lists, which have grown over time, to ensure they contain only active contributors. This will help anyone seeking a core reviewer for their patch know whom to contact. A core reviewer's activity will be assessed based on a 2-year period of making reviews. In other words, we will remove all users who haven't made any reviews in the respective repositories in the past 2 years. The cleanup will focus on these 3 core lists: * tempest-core * devstack-core * qa-release We're going to assess the activity and make the changes not sooner than August 12. If this cleanup affects you and you still wish to be included in one of the above core lists and work in a core reviewer capacity, please let me know. Thanks, -- Martin Kopec Principal Software Quality Engineer Red Hat EMEA IM: kopecmartin

1 0

[neutron] Drivers meeting 26.07.2024 cancelled
by Sławek Kapłoński 26 Jul '24

26 Jul '24

Hi, There is no agenda for today's meeting so I am cancelling it. Have a great Friday and weekend. See You on the meeting next week :) -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

keystone credentials
by engineer2024 26 Jul '24

26 Jul '24

Hi all, We are receiving this message while executing keystone playbook to upgrade from yoga to zed through openstack ansible: ---- FAILED! => {"changed": true, "cmd": ["/openstack/venvs/keystone-26.3.0/bin/keystone-manage", "credential_migrate", "--keystone-user", "keystone", "--keystone-group", "keystone"], "msg": "non-zero return code", "rc": 1,} --- Then I tried credential_setup to setup new fernet keys which succeeded, but when trying to do credential_migrate, it is still failing with the above message. The debug log shows something like "unable to decrypt; use the same primary key used for encryption" I even copied the newly setup keys to the other two containers. Stil it does not work. As a last resort , I have destroyed the three keystone containers and recreated and ran the playbook. Then it worked. But in our scenario, this caused downtime for the apps using this keystone setup which attracted an RCA requirement. So, I want to know how to avoid downtime as in a normal upgrade , when creating/destroying containers and the reason for the above error and the workaround... Appreciate your time. Thanks elinux

1 1

Upcoming Student Opportunities
by Kendall Nelson 26 Jul '24

26 Jul '24

Hello Everyone, I have a number of universities looking for projects and mentors for students in the coming semester. Three universities in particular - DIckinson University, Boston University, and the University of Jos in Nigeria. Dickinson University's course takes place over the whole academic year (two semesters) starting the start of September. Students will work in groups of 2-4 with the actual contribution period being October through May. Most students will be in their last year of a Bachelor's degree in CS. Boston University's course takes place across one semester. Groups of students will be 3-5 people and students will also be in their last year of a Bachelor's degree in CS. Students will make their project selections early September and begin contributing soon after. It's likely this course will also take place next semester. *For both universities, I need project proposals and volunteers (if interested of course), by the 23 of August. * The University of Jos partnership is more internship based and has a more flexible timeline. I am still gathering more details on what this will look like, but I wanted to give you all a heads up. If you have questions about any of these opportunities, please let me know!! Likewise, if you're interested, please let me know and I can support you in getting a project proposal together. -- Kendall Nelson *Senior Upstream Developer Advocate* The OpenInfra Foundation <https://openinfra.dev/>

1 0

update ubuntu and nova does not work
by kjme001＠gmail.com 25 Jul '24

25 Jul '24

update ubuntu and nova does not work During the update of ubuntu I selected option Y, as below and broke one node, the new service starts but does not work from the cluster side, what can I do now to fix it? Configuration file '/etc/nova/nova.conf' ==> Modified (by you or by a script) since installation. ==> Package distributor has shipped an updated version. What would you like to do about it ? Your options are: Y or I : install the package maintainer's version N or O : keep your currently-installed version D : show the differences between the versions Z : start a shell to examine the situation The default action is to keep your current version. *** nova.conf (Y/I/N/O/D/Z) [default=N] ?

2 1

[manila] Proposing Kiran Pawar to manila core
by Carlos Silva 25 Jul '24

25 Jul '24

Hello everyone, I would like to add Kiran Pawar to the OpenStack Manila core team. Kiran has been contributing with reviews [1], new features, bug fixes [2] to the OpenStack Manila components for several cycles and has clearly acquired knowledge on many areas of Manila. He has designed and worked in the implementation of several features in the core of Manila, such as share backups, deferred deletion for shares and snapshots, and most recently has been working on shares encryption and integrating Manila with Barbican. He's clearly demonstrated understanding not only on the manila core, but also in the integrations with share drivers. The participation on PTGs and other events evolving Manila has also been strong, and very impactful. Kiran also brings knowledge on large cloud environments, having worked closely on large deployments and finding solutions for their problems. This addition also means more diversity among the Manila core group, and maintaining a healthy community with different companies sharing the responsibility of maintaining an open source project. Kiran brings a lot of experience with cloud environments to the table and has been helpful on reviews and contributing with a lot of code to Manila, making him a good candidate to join the core team. In case there are no objections, I will add him to the core team in 1 week from now. [1] https://bit.ly/manila-contribution-60-days [2] https://bit.ly/kpdev-code-contributions-to-manila Thank you! Regards, carloss

4 4

[manila] Proposing Ashley Rodrigues to python-manilaclient and manila-ui core
by Carlos Silva 25 Jul '24

25 Jul '24

Hello everyone, I would like to nominate Ashley Rodriguez as python-manilaclient and manila-ui core. Ashley started contributing to OpenStack Manila more than three years ago, and managed to work on a couple of features such as the integration of Manila with OpenStack SDK, metadata for shares and share snapshots, several enhancements to the Ceph drivers testing on CI and several other bug fixes [1], which helped her in acquiring precious knowledge on the code bases, testing and providing feedback. Ashley has also been working as a mentor for many mentorship initiatives we have been promoting in Manila (Outreachy, NDSU, GHC and CMU), where we focused on different repositories, but she always demonstrated the ability to guide the interns providing insightful reviews, debugging and demonstrating good knowledge on python-manilaclient and manila-ui. This addition to the core team is one more step into maintaining a healthy community, as well as a very good way to recognize all the work and dedication Ashley has been putting on these repositories in different ways. In case there are no objections, I will add Ashley to the python-manilaclient and manila-ui core sub groups in 1 week from now. [1] https://review.opendev.org/q/owner:ashrod98@redhat.com [2] https://bit.ly/manila-contribution-60-days Thank you! Regards, carloss

4 4

Updating Instance Flavor Properties in OpenStack Cluster Without Downtime
by Mia smith 25 Jul '24

25 Jul '24

Hello OpenStack Community, In our OpenStack cluster, we recently updated some flavor properties. As a result, we need to apply these changes to all currently active instances that were created with the old flavor properties. We are looking for a solution that allows us to update these instance properties without causing any downtime or needing to resize the instances. Could anyone provide suggestions on how to achieve this? Is there a recommended method or ad-hoc command that can be used to safely update the properties directly in the database? Thank you for your assistance!

3 8

[Openstack-ansible][train] multi node deployment with CEPH-ansible
by Danish Khan 25 Jul '24

25 Jul '24

Dear Team, I am trying to deploy an openstack-ansible train with Ceph-ansible. I am stuck in a loophole due to python dependencies. As suggested, I applied a fix for the rabbitmq version and I am able to deploy openstack-ansible train successfully without ceph. But when I am deploying it with ceph then it is getting stuck at below: TASK [ceph_client : Install ceph packages] ********************************************************************************************************************************* FAILED - RETRYING: Install ceph packages (5 retries left). FAILED - RETRYING: Install ceph packages (4 retries left). FAILED - RETRYING: Install ceph packages (3 retries left). FAILED - RETRYING: Install ceph packages (2 retries left). FAILED - RETRYING: Install ceph packages (1 retries left). fatal: [sp-uat-infra-c1]: FAILED! => {"attempts": 5, "cache_update_time": 1721053914, "cache_updated": false, "changed": false, "msg": "'/usr/bin/apt-get -y -o \"Dpkg::Options::=--force-confdef\" -o \"Dpkg::Options::=--force-confold\" install 'ceph-common' 'python-ceph'' failed: E: Unable to correct problems, you have held broken packages.\n", "rc": 100, "stderr": "E: Unable to correct problems, you have held broken packages.\n", "stderr_lines": ["E: Unable to correct problems, you have held broken packages."], "stdout": "Reading package lists...\nBuilding dependency tree...\nReading state information...\nSome packages could not be installed. This may mean that you have\nrequested an impossible situation or if you are using the unstable\ndistribution that some required packages have not yet been created\nor been moved out of Incoming.\nThe following information may help to resolve the situation:\n\nThe following packages have unmet dependencies:\n python-ceph : Depends: python-cephfs (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed\n Depends: python-rados (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed\n Depends: python-rbd (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed\n", "stdout_lines": ["Reading package lists...", "Building dependency tree...", "Reading state information...", "Some packages could not be installed. This may mean that you have", "requested an impossible situation or if you are using the unstable", "distribution that some required packages have not yet been created", "or been moved out of Incoming.", "The following information may help to resolve the situation:", "", "The following packages have unmet dependencies:", " python-ceph : Depends: python-cephfs (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed", " Depends: python-rados (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed", " Depends: python-rbd (>= 12.2.13-0ubuntu0.18.04.11) but it is not going to be installed"]} python-ceph is not getting install due to dependencies: #vi /etc/ansible/roles/ceph_client/vars/debian.yml. python_ceph_packages: - python-ceph - python3-rados - python3-rbd I tried to update *python-ceph* with *python3-ceph* and the deployment was successful but the cinder-volume service is not coming up due to python error: #journalctl -u cinder-volume.service -f 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service [req-53d87e63-50ab-4976-b531-2b8ffdb82900 - - - - -] Error starting thread.: TypeError: expected bytes, str found 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service Traceback (most recent call last): 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/oslo_service/service.py", line 810, in run_service 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service service.start() 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/service.py", line 229, in start 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service service_id=Service.service_id) 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/manager.py", line 444, in init_host 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service self._init_host(added_to_cluster, **kwargs) 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/manager.py", line 478, in _init_host 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service self.driver.init_capabilities() 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/driver.py", line 760, in init_capabilities 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service stats = self.get_volume_stats(True) 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/drivers/rbd.py", line 643, in get_volume_stats 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service self._update_volume_stats() 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/drivers/rbd.py", line 620, in _update_volume_stats 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service free_capacity, total_capacity = self._get_pool_stats() 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "/openstack/venvs/cinder-20.2.6/lib/python3.6/site-packages/cinder/volume/drivers/rbd.py", line 549, in _get_pool_stats 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service '{"prefix":"df", "format":"json"}', '') 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service File "rados.pyx", line 1067, in rados.Rados.mon_command 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service TypeError: expected bytes, str found 2024-07-15 21:18:43.753 1277912 ERROR oslo_service.service Regards, Danish Khan

2 5

[ops] [ec2-api] DB duplicate entry with ec2 list-images
by Massimo Sgaravatto 25 Jul '24

25 Jul '24

Dear all On a Yoga installation I see a problem with the ec2-api: [sgaravat@lxsgaravat ~]$ euca-describe-images -I ${EC2_ACCESS_KEY} -S ${EC2_SECRET_KEY} euca-describe-images: error (DBDuplicateEntry): Unknown error occurred. [sgaravat@lxsgaravat ~]$ In the log I see a duplicate entry errore [*] It's not fully clear to me what the problem is and why this query should add an entry in that table ... Any help is appreciated Thanks, Massimo PS: yes, I am aware that the ec2-api project is "dead" and not part of recent OpenStack distributions [*] 2024-07-25 14:49:11.052 37118 ERROR ec2api.api oslo_db.exception.DBDuplicateEntry: (pymysql.err.IntegrityError) (1062, "Duplicate entry '4ae7a803-d7cd-4725-8b2e-65797a64ef94' for key 'items.items_os_id_idx'") 2024-07-25 14:49:11.052 37118 ERROR ec2api.api [SQL: INSERT INTO items (id, project_id, vpc_id, os_id, data) VALUES (%(id)s, %(project_id)s, %(vpc_id)s, %(os_id)s, %(data)s)] 2024-07-25 14:49:11.052 37118 ERROR ec2api.api [parameters: {'id': 'ami-e561c280', 'project_id': '56c3f5c047e74a78a71438c4412e6e13', 'vpc_id': None, 'os_id': '4ae7a803-d7cd-4725-8b2e-65797a64ef94', 'data': '{"is_public": true}'}] 2024-07-25 14:49:11.052 37118 ERROR ec2api.api (Background on this error at: https://sqlalche.me/e/14/gkpj) 2024-07-25 14:49:11.052 37118 ERROR ec2api.api 2024-07-25 14:49:11.055 37118 ERROR ec2api.api [req-cda08c1a-009c-4c7d-b019-c30bce32baa4 9bd03f63fa9d4beb8de31e6c2f2c8d12 56c3f5c047e74a78a71438c4412e6e13 - - -] Environment: {"wsgi.url_scheme": "http", "REQUEST_METHOD": "POST", "SCRIPT_NAME": "", "RAW_PATH_INFO": "/services/Cloud", "PATH_INFO": "/services/Cloud", "CONTENT_TYPE": "application/x-www-form-urlencoded", "CONTENT_LENGTH": "53", "SERVER_PROTOCOL": "HTTP/1.0", "SERVER_NAME": "192.168.60.42", "SERVER_PORT": "8788", "REMOTE_ADDR": "192.168.60.229", "REMOTE_PORT": "33840", "GATEWAY_INTERFACE": "CGI/1.1", "HTTP_ACCEPT_ENCODING": "gzip, deflate", "HTTP_ACCEPT": "*/*", "HTTP_USER_AGENT": "euca2ools/3.4.1 (CPython 2.7.5; Linux 3.10.0-1160.92.1.el7.x86_64; x86_64) requestbuilder/0.7.1 requests/2.19.1", "HTTP_HOST": " cloud-areapd-test.pd.infn.it:8788", "HTTP_X_AMZ_CONTENT_SHA256": "afe617936fea90d9c62d9f87dd3e9d18e1fc5178d08aeebfb8737f32042a0b6d", "HTTP_X_AMZ_DATE": "20240725T124910Z", "HTTP_AUTHORIZATION": "AWS4-HMAC-SHA256 Credential=220cd4ffe5aa435cb56adfd5a9a3b234/20240725/undefined-15030/ec2/aws4_request, SignedHeaders=accept;accept-encoding;content-length;content-type;host;x-amz-content-sha256;x-amz-date, Signature=c0cc81d64a4477db4dc8be0d478b8746bb013f7273b6460f411d95a5d6efe946", "HTTP_X_FORWARDED_PROTO": "https", "HTTP_X_FORWARDED_FOR": "193.205.157.174", "HTTP_CONNECTION": "close"}: oslo_db.exception.DBDuplicateEntry: (pymysql.err.IntegrityError) (1062, "Duplicate entry '4ae7a803-d7cd-4725-8b2e-65797a64ef94' for key 'items.items_os_id_idx'") 2024-07-25 14:49:11.055 37118 INFO ec2api.api [req-cda08c1a-009c-4c7d-b019-c30bce32baa4 9bd03f63fa9d4beb8de31e6c2f2c8d12 56c3f5c047e74a78a71438c4412e6e13 - - -] 0.811724s 192.168.60.229 POST /services/Cloud DescribeImages 500 [euca2ools/3.4.1 (CPython 2.7.5; Linux 3.10.0-1160.92.1.el7.x86_64; x86_64) requestbuilder/0.7.1 requests/2.19.1] application/x-www-form-urlencoded text/xml 2024-07-25 14:49:11.056 37118 INFO ec2api.wsgi.server [req-cda08c1a-009c-4c7d-b019-c30bce32baa4 9bd03f63fa9d4beb8de31e6c2f2c8d12 56c3f5c047e74a78a71438c4412e6e13 - - -] 193.205.157.174,192.168.60.229 "POST /services/Cloud HTTP/1.1" status: 500 len: 348 time: 0.8139334 2024-07-25 14:49:14.391 37119 INFO ec2api.api [req-417ab595-646d-4468-9464-f19c7392c201 9bd03f63fa9d4beb8de31e6c2f2c8d12 56c3f5c047e74a78a71438c4412e6e13 - - -] 4.822310s 192.168.60.229 POST /services/Cloud DescribeInstances 200 [euca2ools/3.4.1 (CPython 2.7.5; Linux 3.10.0-1062.9.1.el7.x86_64; x86_64) requestbuilder/0.7.1 requests/2.19.1] application/x-www-form-urlencoded text/xml 2024-07-25 14:49:14.392 37119 INFO ec2api.wsgi.server [req-417ab595-646d-4468-9464-f19c7392c201 9bd03f63fa9d4beb8de31e6c2f2c8d12 56c3f5c047e74a78a71438c4412e6e13 - - -] 193.206.210.240,192.168.60.229 "POST /services/Cloud HTTP/1.1" status: 200 len: 11274 time: 4.8234410

1 0

[ironic] Call for maintainers: terraform-provider-ironic
by Dmitry Tantsur 25 Jul '24

25 Jul '24

Hi folks! In OpenShift, we used to use https://github.com/openshift-metal3/terraform-provider-ironic to drive Ironic and Inspector during the initial installation process before the control plane is up. Now that we have moved away from Terraform for this purpose, the project is on minimal support with the intention of completely abandoning it once no stable versions of OpenShift use it to provision the control plane. Are there any parties interested in maintaining terraform-provider-ironic after that point? It supports several features like inspection, BIOS settings, RAID. It does not, to the best of my knowledge, support Keystone authentication and has not been migrated away from Inspector. Dmitry

1 0

[cinder] No meeting today (7/24)
by Jon Bernard 24 Jul '24

24 Jul '24

Hello all, I failed in my effort to secure adequate childcare today, so I need to cancel today's meeting. Hope to see you in the next one. -- Jon

1 0

[horizon][puppet-openstack] Proper Python snippets placement
by Francesco Di Nucci 24 Jul '24

24 Jul '24

Hello, some time ago I found that on EL9 Horizon searches for extra Python snippets in "/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.d", while puppet-horizon places dashboards snippets in "/etc/openstack-dashboard/local_settings.d", so these are not loaded. At the same time, "/usr/share/openstack-dashboard/openstack_dashboard/local/local_settings.py" is a symlink to "/etc/openstack-dashboard/local_settings". Of the following, what should be adopted as proper approach on a machine? * Having symlinks to /etc/openstack-dashboard for both local_settings.py and local_settings.d * Editing files in /usr/share/openstack-dashboard without having symlinks * Using a symlink for local_settings.py but placing snippets under /usr/share/openstack-dashboard Best regards -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email:francesco.dinucci@na.infn.it

4 4

[kolla-ansible]Material choices for ephemerals
by Franck VEDEL 24 Jul '24

24 Jul '24

Hello. I would like your opinion regarding a hardware configuration and my Openstack cluster project. I have the possibility of purchasing 6 servers to build this cluster for students, my current Openstack being too small. I have a proposition from the manufacturer (DELL): 6 servers with characteristics per server: - BOSS-N1 controller card + with 2 M.2 960GB (RAID 1) - 5 x 3.84TB Data Center NVMe Read Intensive AG Drive U2 Gen4 with Carrier - 12 x 64GB RDIMM, 4800MT/s Dual Rank My problem is: BOSS is used to install the system (Ubuntu 22.04 in my case). But, various tests on a small cluster with SSD disks showed that the solution with ephemerals was really the most interesting for what I want to do. Problem: I don't believe you can have the system on the BOSS and the ephemerals on the NVMe disks. So my questions are: 1) am I wrong and ephemerals are possible on NVMe (I use kolla-ansible to deploy, I haven't seen how to do that)? 2) or the solution is to create a Ceph cluster on the NVME of the 6 servers 3) or a better solution exists Thank you in advance if you can help me make these choices. Franck

2 2

Unrestricted AC Access Rules: "You must upgrade keystonemiddleware on all services"
by openstack＠tr.id.au 24 Jul '24

24 Jul '24

Hey there, I'm interested in creating an unrestricted Application Credential (AC) which is still constrained by Access Rules. A use could be allowing admins to use automation to generate read-only ACs for various purposes. The AC for automatically generating other ACs would need to be unrestricted, but should still only have the minimal privileges required to create its children. However, when attempting this with multiple versions of keystone, including 2024.1, I get the following error in the keystone service log: ``` Attempted to use application credential access rules with a middleware that does not understand them. You must upgrade keystonemiddleware on all services that accept application credentials as an authentication method.: NoneType: None ``` A minimal way to reproduce this: 1. Install keystone according to https://docs.openstack.org/keystone/latest/install/keystone-install-ubuntu.…. (I've also tested with keystone running in a virtualenv and in a kolla container.) 2. Generate a "parent" AC using the bootstrap admin: `openstack application credential create --max-width 120 --role admin --access-rules '[ { "path": "/v3/**", "method": "POST", "service": "identity" }, { "path": "/v3/**", "method": "GET", "service": "identity" } ]' --expiration '2024-07-31T23:59:59' --unrestricted test_unrestricted` (This gives expected output, including an AC id and secret.) 3. In another terminal, load the parent AC and then try to generate the child: `openstack application credential create --max-width 120 --role admin --access-rules '[ { "path": "/v3/**", "method": "GET", "service": "identity" } ]' --expiration '2024-07-31T23:59:59' test_read_only`. (This returns `Invalid application credential: Cannot create an application credential with unassigned role` in the client, as well as the earlier error about upgrading middleware in keystone service log.) I've tested that the parent/unrestricted AC *can* generate the child successfully when the parent does *not* have Access Rules. I didn't see anything about these errors or constraints when going through the application credential documentation (eg https://docs.openstack.org/keystone/latest/user/application_credentials.html) or in a web search, or in a search of the openstack-discuss archives. I may raise a bug report/feature request, but before I do that, I just wondered if I have likely overlooked some possible extra configuration or documentation which could explain what I've done wrong? Alternatively, if this were raised as a feature request, would it likely be supported, or would the functionality I'm imagining be too difficult or impossible to implement? Cheers, Tim

1 0