July 2024 - openstack-discuss - lists.openstack.org

Restricting User Deletion to Project Owners
by Thamanna Farhath 16 Jul '24

16 Jul '24

Hi OpenStack Community, I am working on a policy configuration to ensure that only owners of a project can delete users within their own project. Below is my current setup and the policy rules I have defined. Current Setup OpenStack deployment using Kolla Ansible 2023.1. Created an owner role with permissions to create, delete, and manage users and projects. But it allows you to delete users from other projects as well. So, I need to achieve the below scenario. Policy Rules yaml "admin_required": "role:admin" "admin_or_owner": "rule:admin_required or (role:owner and project_id:%(target.user.project_id)s)" "identity:delete_user": "rule:admin_or_owner" Scenario User demo with owner role of project X creates users newuser1 and newuser2 assigned to project X. User tester with owner role of project Y creates users myuser1 and myuser2 assigned to project Y. With the above configuration, I aim to ensure that: User demo can only delete newuser1 and newuser2 within project X. User tester can only delete myuser1 and myuser2 within project Y. Thank you for your support. Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 3

[keystone] Keystone Single Sign-On for REST API Access
by leon.amtmann＠ibm.com 15 Jul '24

15 Jul '24

Hello OpenStack Community, and greetings especially to the Keystone experts among you. I'm currently co-administering an OpenStack 17.1.3 cluster with a few compute nodes and three controllers. For a better user experience, we've enabled Single Sign-On using OIDC for Horizon, which is working fabulously. To do that, the [mod_auth_openidc module](https://github.com/OpenIDC/mod_auth_openidc) is configured for httpd on the controller nodes. However, we're now facing a novel scenario for us. Basically, we want to interact with the OpenStack REST APIs - but not using a usual token request to `/v3/auth/tokens`, but using Single Sign-On. We've looked at the authentication request that Horizon makes to Keystone after successful authentication with the SSO provider. As far as we can tell: 1. After successful authentication with the SSO identity provider, Keystone redirects back to the redirect URI with a grant_id, id_token and state in the URL fragments (after # in the URL). 2. The redirect URI is `/v3/auth/OS-FEDERATION/websso/openid`, which contains HTML that will read the fragments and POST them as form data to somewhere. 3. Those fragments get POSTed to `/v3/auth/OS-FEDERATION/websso/openid`. 4. The response from Keystone is an HTML document containing an auth token, rigged to get POSTed to Horizon at `/dashboard/auth/websso/` (presumably to start a fresh session). So far, so good. The [Keystone federation documentation](https://docs.openstack.org/keystone/latest/admin/federation/… does show the [Horizon flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct… in action. I can replicate it in part using cURL, by doing the same requests to the same endpoints that my browser does. However, I do not understand or see a request to `/v3/auth/OS-FEDERATION/websso/mapped` where Keystone actually issues a token. Instead, after the `id_token`, `grant_id`, etc. are POSTed to `/v3/auth/OS-FEDERATION/websso/openid`, Keystone responds with an HTML document containing the token (see step 4. in my earlier list). I've only seen this working for Horizon in an actual browser, though. Am I misunderstanding the documentation? Right above that in the documentation, there is a section about an unrelated [OpenID Connect Authentication Flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct…. It contains a graphic in which the first request made is a GET request to `/secure`. A direct GET request yields a `404`, so I assume this is a placeholder for any protected resource. However, if I request any protected resource without a valid token, I do not receive a 302 as the graphic would seem to suggest. Is this a behavior that would need to be configured, first? In short: How does one end up with an unscoped token when trying to SSO against Keystone from something that is not Horizon? I'm just wondering if I am on the correct path in trying to modify the `10-keystone.wsgi` in `/etc/httpd/conf.d/` to use [multiple providers](https://github.com/OpenIDC/mod_auth_openidc/wiki/Multiple-Provid…. If, after starting the SSO process, I end up with a `grant_id` and an `id_token`, where do I post this to to get a Keystone token in return? After going through the documentation, I am still at a loss. I would appreciate any help. Thank you for your time.

4 3

[tacker] Cancelling IRC meeting
by Yasufumi Ogawa 15 Jul '24

15 Jul '24

Hi team, I'd like to skip IRC meeting this week since I'll be out of office. Thanks, Yasufumi

1 0

[barbican] Weekly meeting canceled Jul 15th
by Grzegorz Grasza 15 Jul '24

15 Jul '24

Hi all, I'll be traveling during our usual meeting hour, so I'm cancelling it this week. / Greg

1 0

[neutron] Bug Deputy Report July 8 - July 14
by Yatin Karel 15 Jul '24

15 Jul '24

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2072754 - Restarting octavia breaks IPv4 Load Balancers with health checks Assigned to Pavlo Shchelokovskyy - https://bugs.launchpad.net/neutron/+bug/2072567 - neutron-ovn-tempest-postgres-full job fails as oslo_db.exception.DBError: (psycopg2.errors.GroupingError) column "standardattributes_1.id" must appear in the GROUP BY clause or be used in an aggregate function Assigned to Rodolfo Alonso Medium ---------- - https://bugs.launchpad.net/neutron/+bug/2072978 - Show some error in logs when failing to load nb connection certificate Assigned to Chris Buggy Wishlist ---------- - https://bugs.launchpad.net/neutron/+bug/2072505 - [RFE] "External network not reachable from subnet" could take static routes into account Unassigned -- Thanks and Regards Yatin Karel

1 0

Making stestr scheduler smarter with a lot of threads
by Thomas Goirand 14 Jul '24

14 Jul '24

Hi, Currently, it looks like stestr calculate which thread should run which test at the beginning, by calculating some partition, and then launch all tests at once. With a lot of threads, the result is, at the end, only a few cores are in use, with all the others being idle. Would there be a way to have a pool of available threads instead, and have stestr to give threads something to eat when they are available, instead of the current way? How much work would that be? Cheers, Thomas Goirand (zigo)

4 3

Tenacity 8.4.2 breaking at least 4 OpenStack projects
by Thomas Goirand 14 Jul '24

14 Jul '24

Hi, It looks like Tenacity 8.4.2 broke a number of projects: - heat - ironic - octavia - python-octavia-lib I filed this for Octavia: https://bugs.launchpad.net/octavia/+bug/2073044 though I should probably do the same for the other projects. Unfortunately, someone uploaded Tenacity 8.4.2 to Debian unstable, so the packages are currently broken. :/ I'll see if the upload can be temporarily reverted, but the more long term solution is to fix the above projects and up the global requirements. Cheers, Thomas Goirand (zigo)

2 2

Subject: Assistance Needed: Restricting Owner Role to Manage Users and Projects Within Their Own Project
by Thamanna Farhath 13 Jul '24

13 Jul '24

Hi OpenStack Community, I am currently using openstack kolla ansible 2023.1, now facing an issue with the role-based access control in my OpenStack deployment.Could you please assist me in achieving my requirements for proper role configuration and access management? I have created a custom role named "owner" with permissions to create, delete, and manage users and projects, and also to assign users to projects. However, I want to restrict the "owner" role to manage only the users and projects within their own project, and not across other projects. Here is the policy file configuration(/etc/kolla/keystone/policy.yaml) I am using: yaml # Custom rule to allow users with the 'owner' role to manage users and projects identity:create_project: "role:owner or role:admin" admin_or_owner: "rule:admin_required or project_id:%(target.project.id)s" identity:delete_project: "rule:admin_or_owner" identity:delete_user: "rule:admin_or_owner" identity:create_user: "role:owner or role:admin" identity:get_user: "role:owner or role:admin or role:member or role:user" identity:list_users: "role:owner or role:admin" identity:update_user: "role:owner or role:admin" identity:create_grant: "role:owner or role:admin" identity:list_grants: "role:owner or role:admin" I have the following questions: Is the above policy configuration correct for achieving the desired restrictions? Are there any other possibilities or best practices to ensure that the "owner" role can only delete users and projects within their own project? How can I improve or adjust the policy rules to meet these requirements effectively? Thank you in advance for your assistance. ---- On Fri, 12 Jul 2024 10:49:22 +0530 Artem Goncharov <artem.goncharov(a)gmail.com> wrote --- Hi, 1) in Keystone we are currently working on implementing domain manager persona that allows certain person on a "customer" side to do project and user operations. This includes explicit listing of users in a domain 2) this is conceptually wrong to talk about users in a project, since users are owned by domains and can get access to multiple projects within the domain (and with some tricks to other domains). So you are partially right that role assignments is the way of figuring out access of users to projects. One more challenge though is that such access can be granted using user groups. In this case you actually should also resolve groups access to the desired project. Hope this helps, Artem ---- typed from mobile, auto-correct typos assumed ---- On Thu, Jul 11, 2024, 20:34 Thamanna Farhath <mailto:thamanna.f@zybisys.com> wrote: Hello openstack community, I am currently working on an OpenStack kolla ansible 2023.1. I have created a custom role " owner " Objective: Users with the owner role can only list users within their project. Avoid additional API calls for filtering users by project. Current Challenge: Using direct API calls, the list users API currently returns all users without any project-specific filtering. While additional API calls to the role_assignments endpoint can achieve the desired filtering, this approach is not efficient and doesn't restrict access at the API level. I am considering defining custom Keystone policies to achieve this restriction. However, I am unsure how to properly configure these policies to enforce project-specific access control effectively. Thanks in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email." Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

1 0

[keystone] Weekly Meeting Canceled 17-Jul-2024
by Dave Wilde 12 Jul '24

12 Jul '24

Hello, I'm canceling the Keystone weekly meeting for 17-Jul-2024 as I'll be on PTO. Please reach out to the mailing list or #openstack-keystone on IRC for assistance. Thanks, /Dave

1 0

Assistance Needed: Restricting User List API Access Based on Project Context
by Artem Goncharov 12 Jul '24

12 Jul '24

Hi, 1) in Keystone we are currently working on implementing domain manager persona that allows certain person on a "customer" side to do project and user operations. This includes explicit listing of users in a domain 2) this is conceptually wrong to talk about users in a project, since users are owned by domains and can get access to multiple projects within the domain (and with some tricks to other domains). So you are partially right that role assignments is the way of figuring out access of users to projects. One more challenge though is that such access can be granted using user groups. In this case you actually should also resolve groups access to the desired project. Hope this helps, Artem ---- typed from mobile, auto-correct typos assumed ---- On Thu, Jul 11, 2024, 20:34 Thamanna Farhath <thamanna.f(a)zybisys.com> wrote: > Hello openstack community, > I am currently working on an OpenStack kolla ansible 2023.1. I > have created a custom role " owner " > > *Objective:* > > 1. Users with the owner role can only list users within their project. > 2. Avoid additional API calls for filtering users by project. > > *Current Challenge:* > Using direct API calls, the list users API currently returns all > users without any project-specific filtering. While additional API calls to > the role_assignments endpoint can achieve the desired filtering, this > approach is not efficient and doesn't restrict access at the API level. > > I am considering defining custom Keystone policies to achieve this > restriction. However, I am unsure how to properly configure these policies > to enforce project-specific access control effectively. > > Thanks in advance > > > ------------------------------ > *Disclaimer :** The content of this email and any files transmitted with > it are confidential and intended solely for the use of the individual or > entity to which they are addressed. If you have received this email in > error, please notify the sender and remove the messages from your system. > If you are not the named addressee, it is strictly forbidden for you to > share, circulate, distribute or copy any part of this e-mail to any third > party without the written consent of the sender.* > > > > *E-mail transmission cannot be guaranteed to be secured or error free as > information could be intercepted, corrupted, lost, destroyed, arrive late, > incomplete, or may contain viruses. Therefore, we do not accept liability > for any errors or omissions in the contents of this message, which arise as > a result of e-mail transmission. The recipient should check this e-mail and > any attachments for the presence of viruses. The company accepts no > liability for any damage caused by any virus transmitted by this email."* > >

1 0

[ironic] SNMP hardware type
by Julia Kreger 12 Jul '24

12 Jul '24

Greetings folks, For those that are unaware of it, Ironic has an snmp[0] hardware type which allows for the remote control of power ports on an PDU, which makes Ironic powerful for a variety of non-traditional computing hardware to be leveraged with Ironic. If you are aware of this hardware type and happen to use it, you may want to engage with the Upstream community. Historically we've used a tool called virtualpdu[1] to facilitate testing, and we're facing some challenges with newer pysnmp[2] versions. These challenges have us wondering if there is value for us to fix virtualpdu and continue upstream testing. Realistically, if nobody steps forward to help maintain virtualpdu and the snmp hardware type, upstream testing may become limited or be discontinued for the snmp hardware type entirely, which is likely to impact users of this hardware type. If you're interested in helping maintain the hardware type and its testing, please reach out to the Ironic team via the weekly team meeting[3]. Thanks, -Julia [0]: https://docs.openstack.org/ironic/latest/admin/drivers/snmp.html [1]: https://opendev.org/openstack/virtualpdu [2]: https://pypi.org/project/pysnmp-lextudio/#history [3]: https://wiki.openstack.org/wiki/Meetings/Ironic

1 0

Assistance Needed: Restricting User List API Access Based on Project Context
by Thamanna Farhath 12 Jul '24

12 Jul '24

Hello openstack community, I am currently working on an OpenStack kolla ansible 2023.1. I have created a custom role " owner " Objective: Users with the owner role can only list users within their project. Avoid additional API calls for filtering users by project. Current Challenge: Using direct API calls, the list users API currently returns all users without any project-specific filtering. While additional API calls to the role_assignments endpoint can achieve the desired filtering, this approach is not efficient and doesn't restrict access at the API level. I am considering defining custom Keystone policies to achieve this restriction. However, I am unsure how to properly configure these policies to enforce project-specific access control effectively. Thanks in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 1

[nova] "failure domain" scheduler
by Mohammed Naser 11 Jul '24

11 Jul '24

Hi everyone I had a discussion a few days ago in the #openstack-nova about the possibility of introducing the concept of different failure domains, which would be a component inside of an availability zone. The concept is similar to Azure’s availability set feature: https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-o… I’ve built a very similar nova scheduler filter which leverages server groups + another scheduler hint called `different_failure_domain` then it will actually build them inside different failure domains. The failure domains are built similar to AZs in terms of being modeled are using aggregates, so it would use a `failure_domain` aggregate metadata. I’ve managed to build and validate this functionality with my team here: https://github.com/vexxhost/nova-scheduler-filters Now, based on that, I’m wondering if: 1. Is this the best approach to take based on this? 2. Is this something we can upstream into Nova easily as an extra filter? I think this is helpful for a lot of the “VMware” world people. 😊 Thanks, Mohammed

2 1

numa filtering
by Gk Gk 11 Jul '24

11 Jul '24

How does the scheduler check the numa nodes availability in the background ? Does it use any db like placement to calculate the allocation, resource etc for numa ? I need just the logic in the scheduler for this check ? Thanks Y.G

2 1

[nova] Instance stuck in hard reboot
by Francesco Di Nucci 11 Jul '24

11 Jul '24

Hi all, I hard rebooted an instance while a compute node was down, and now on the dashboard/CLI it is stuck in hard rebooting status. I am able to start/stop/reset it through virsh on the compute node, but I can't get it out of this loop in OpenStack, any suggestions? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

2 2

[Swift - proxy server] manually exclude nodes via new middleware
by Olivier Chaze 11 Jul '24

11 Jul '24

Hi all, I am writing to introduce a new middleware component, ExcludeNode, which we've just started to develop to enhance node management within the Swift proxy server. [Middleware Overview] ExcludeNode is designed to dynamically exclude specific nodes from the proxy's operations. This middleware reads a list of nodes to be excluded from a specified file and prevents these nodes from being considered during normal operations. Main reason for developing this middleware is to avoid objects request latency/failure when nodes are down or when rebalancing objects after adding new nodes for example. The main functionalities include: - Node Exclusion Check: Validates if a node (IP:PORT) is listed in the exclusion file. - Dynamic Updates: Allows updating the exclusion list by writing node information to the specified file (IP:PORT). - Clear the exclusion list How to use it ? Assuming 1.2.3.4 storage node is down, requests will fail with : proxy-server: ERROR with Object server 1.2.3.4:6210/sdm re: Trying to GET /v1/AUTH_[...]: ConnectionTimeout (2.0s) (txn: tx19b7067dcb0c442e96a10-0066867068) To ban the disk 1.2.3.4:6210/sdm , on each proxy-server : curl -X POST `hostname`:8080/exclude_node -H "Content-Type: application/json" -d {"ip":"'1.2.3.4","port":6210}"' in proxy-server.log will be logged : proxy-server: Node added to exclusion list: 1.2.3.4:6210 (txn: tx0f292e3b08f940b5be3d9-0066867068) This way, the node won't serve any request and depending the request type, this latter will be redirected to another primary or handoff node. It will remain like this until the disk is manually removed from the exclusion list and every time this node would have been chosen to serve a request you'll get a log : proxy-server: Node 1.2.3.4:6210 (sdm) explicitly excluded by exclude_node middleware. (txn: txeb9f5953ee3343dbb9699-006686707a) I would greatly appreciate the community's feedback on the following: * FUNCTIONALITY: Does the middleware fulfill a common need? * IMPLEMENTATION: Are there any concerns regarding the code implementation or its impact on existing functionalities? We'd like to submmit this middleware upstream but to be efficient and avoid wasting everybody's time I'd like some feedbacks first :) The code itself is quite simple today but we plan to add features like auto excluding a node reported as unmounted by swift-recon for example. exclude_node.py middleware : https://kpaste.infomaniak.com/nRp8AdJGnMuLCoP7czIbL9IBJjlSkyYS#ARXTJo5ZnGa5… server.py modification : https://kpaste.infomaniak.com/Qvy992wlRbc6yEgrIPhAhyrh2V3-Gipy#E2TaKDAXQdXp… proxy-server.conf : [pipeline:main] - pipeline = [...] proxy-server + pipeline = [...] exclude_node proxy-server [filter:exclude_node] use=egg:swift#exclude_node exclude_nodes_filename = /dev/shm/excluded_nodes Thank you in advance for your feedback, Olivier

3 3

Cannot create windows image on Openstack
by Ramzi Abdallah 11 Jul '24

11 Jul '24

I have installed openstack version bobcat on Centos 9 Stream. The installation went fine and I am able to login and launch the cirros image. The problem I am facing is with windows images. When I try to upload the Windows Server 2012 R2 Standard Evaluation for OpenStack which I downloaded from cloudebase I get this error: TypeError: Cannot read properties of undefined (reading 'data') - Error: Unable to create the image. At first I though the problem is from the image so I created my own with all the needed drivers and got the same problem. Appreciate any help is someone experienced this before Ramzi

3 4

[nova][libvirt] Timed out during operation: cannot acquire state change lock
by Satish Patel 11 Jul '24

11 Jul '24

Folks, We had ceph storage failure and finally its up and running and in HEALTH_OK state but now I am not able to bring up openstack vms. I am running the Zed release of openstack. I have noticed a very odd error on nova_libvirt and am not sure what the solution is here. root@comp1:~# tail -f /var/log/kolla/libvirt/libvirtd.log 2024-07-08 07:22:07.420+0000: 3160: warning : qemuDomainObjBeginJobInternal:934 : Cannot start job (query, none, none) for domain instance-000014b0; current job is (async nested, none, start) owned by (3159 remoteDispatchDomainCreateWithFlags, 0 <null>, 3159 remoteDispatchDomainCreateWithFlags (flags=0x1)) for (1563s, 0s, 1563s) 2024-07-08 07:22:07.420+0000: 3160: error : qemuDomainObjBeginJobInternal:968 : Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainCreateWithFlags) 2024-07-08 07:22:37.444+0000: 41620: warning : qemuDomainObjBeginJobInternal:934 : Cannot start job (query, none, none) for domain instance-000015b2; current job is (async nested, none, start) owned by (3162 remoteDispatchDomainCreateWithFlags, 0 <null>, 3162 remoteDispatchDomainCreateWithFlags (flags=0x1)) for (1671s, 0s, 1672s) 2024-07-08 07:22:37.444+0000: 41620: error : qemuDomainObjBeginJobInternal:968 : Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainCreateWithFlags) I am noticing the VM in a pause state. Any idea what I can do to fix it. I have rebooted compute nodes also in hope it will free up lock or bad process but no luck root@comp1:~# docker exec -it nova_libvirt virsh list Id Name State ---------------------------------- 1 instance-00001751 paused 2 instance-000015b2 paused 3 instance-000014b0 paused When I try to reboot an instance I see the following error. look like qemu acting up.. root@comp1:~# docker exec -it nova_libvirt virsh reboot instance-00001751 error: Failed to reboot domain 'instance-00001751' error: Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainMigratePerform3Params)

2 1

[All] CentOS stream 8 jobs
by Tony Breeds 11 Jul '24

11 Jul '24

Hello all, Letting you all know that I, on behalf of the OpenDev infra team bypassed Zuul to merge: https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/922649 This means that any job on any branch testing with FIPS need to be switched to CentOS-Stream-9. Yours Tony.

1 0

[python-openstackclient] openstack client can't use swift command
by chunyang wu 10 Jul '24

10 Jul '24

Hello team: The latest version of python-openstackclient on pypi.org is 6.0.0[0], but this version lacks the ability to use commands related to the Swift project due to the absence of the simplejson package. Although this issue was addressed in a recent commit [1]. The fix has not yet been released on pypi.org. I kindly request that the team release a new version to address this issue as soon as possible. thanks [0]: https://pypi.org/project/python-openstackclient/6.6.0/#history [1]: https://review.opendev.org/c/openstack/python-openstackclient/+/920001

1 0

[NON-ZIP][tacker]Troubleshooting Error in CNF Deployment with Tacker and Helm
by yo-kumamoto＠kddi.com 10 Jul '24

10 Jul '24

Hello, I hope this message finds you well. I am currently working on deploying a Cloud-Native Network Function (CNF) using Tacker. For this deployment, I am utilizing Helm charts as the method of deployment. Following the guidelines provided in the official Tacker documentation (https://docs.openstack.org/tacker/latest/user/v2/cnf/deployment_using_helm/…) I encountered an error during the instantiation process. Despite following the steps closely, the deployment did not proceed as expected. I have attached the error logs to this email for your reference. Could you please provide assistance in troubleshooting this issue? Any insights or suggestions would be greatly appreciated. Thank you for your support. Best regards, Yohei Kumamoto

3 3

Magnum Caracal: magnum-conductor fails with after sql QueuePool limit exhaustion
by Michel Jouvin 10 Jul '24

10 Jul '24

Hi, In our tests of Magnum Caracal, we are experiencing a bad error in openstack-magnum-conductor causing it not to work until it is restarted. The problem is caused by a high number of connections to the magnum DB (compared to what can be seen in Antelope version), exceeding the QueuePool limit configured with max_pool_size (+ an overflow of 50). This is described with more details at https://bugs.launchpad.net/magnum/+bug/2067345 that remained mostly unanswered (but with several people joining to say they were experiencing the same issue). Are they people running Magnum Caracal on this list? Are you experiencing the same issue? In our case we are using RDO distribution (EL9-based) and the Magnum DB is on a remote server. Any suggestion welcome! Best regards, Michel

2 2

[magnum] Cancelling meeting
by Jake Yip 10 Jul '24

10 Jul '24

Hi all, I have to cancel today's meeting due to clashing appointments. Regards, Jake

1 0

[adjutant][tc] Checking in on project health
by Goutham Pacha Ravi 10 Jul '24

10 Jul '24

Hello, During a Technical Committee meeting [1], we were made aware that adjutant's CI jobs are perma-failing; and trivial bot-created patches as well as patches from folks addressing CI issues [2] haven't received any review feedback. I wanted to check on the status of development of this project and its deliverables (adjutant, python-adjutantclient, adjutant-ui). If these are not actively developed, perhaps it is time to retire them [3]. Let me know what you think. Thanks, Goutham [1] https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-09-18.00.log.html#… [2] https://review.opendev.org/q/project:openstack/adjutant+status:open [3] https://docs.openstack.org/project-team-guide/repository.html#retiring-a-re…

2 1

Network demand for controller nodes
by William Muriithi 10 Jul '24

10 Jul '24

Hello, Does anyone know if controller nodes are demanding on network needs? I have a situation where I don't have enough 10GB/s port in the switch. Would a cluster be network constrained if I have three controllers using 1GB/s connections and the execution and storage nodes are on 10GB/s connections? Does the VM traffic ever transverse the controller's network cards? In another word, is there a valid requirement for 10GB/s on openstack controllers? Regards, William

4 3