July 2024 - openstack-discuss - lists.openstack.org

Assistance Needed: Restricting User List API Access Based on Project Context
by Artem Goncharov 11 Jul '24

11 Jul '24

Hi, 1) in Keystone we are currently working on implementing domain manager persona that allows certain person on a "customer" side to do project and user operations. This includes explicit listing of users in a domain 2) this is conceptually wrong to talk about users in a project, since users are owned by domains and can get access to multiple projects within the domain (and with some tricks to other domains). So you are partially right that role assignments is the way of figuring out access of users to projects. One more challenge though is that such access can be granted using user groups. In this case you actually should also resolve groups access to the desired project. Hope this helps, Artem ---- typed from mobile, auto-correct typos assumed ---- On Thu, Jul 11, 2024, 20:34 Thamanna Farhath <thamanna.f(a)zybisys.com> wrote: > Hello openstack community, > I am currently working on an OpenStack kolla ansible 2023.1. I > have created a custom role " owner " > > *Objective:* > > 1. Users with the owner role can only list users within their project. > 2. Avoid additional API calls for filtering users by project. > > *Current Challenge:* > Using direct API calls, the list users API currently returns all > users without any project-specific filtering. While additional API calls to > the role_assignments endpoint can achieve the desired filtering, this > approach is not efficient and doesn't restrict access at the API level. > > I am considering defining custom Keystone policies to achieve this > restriction. However, I am unsure how to properly configure these policies > to enforce project-specific access control effectively. > > Thanks in advance > > > ------------------------------ > *Disclaimer :** The content of this email and any files transmitted with > it are confidential and intended solely for the use of the individual or > entity to which they are addressed. If you have received this email in > error, please notify the sender and remove the messages from your system. > If you are not the named addressee, it is strictly forbidden for you to > share, circulate, distribute or copy any part of this e-mail to any third > party without the written consent of the sender.* > > > > *E-mail transmission cannot be guaranteed to be secured or error free as > information could be intercepted, corrupted, lost, destroyed, arrive late, > incomplete, or may contain viruses. Therefore, we do not accept liability > for any errors or omissions in the contents of this message, which arise as > a result of e-mail transmission. The recipient should check this e-mail and > any attachments for the presence of viruses. The company accepts no > liability for any damage caused by any virus transmitted by this email."* > >

1 0

[ironic] SNMP hardware type
by Julia Kreger 11 Jul '24

11 Jul '24

Greetings folks, For those that are unaware of it, Ironic has an snmp[0] hardware type which allows for the remote control of power ports on an PDU, which makes Ironic powerful for a variety of non-traditional computing hardware to be leveraged with Ironic. If you are aware of this hardware type and happen to use it, you may want to engage with the Upstream community. Historically we've used a tool called virtualpdu[1] to facilitate testing, and we're facing some challenges with newer pysnmp[2] versions. These challenges have us wondering if there is value for us to fix virtualpdu and continue upstream testing. Realistically, if nobody steps forward to help maintain virtualpdu and the snmp hardware type, upstream testing may become limited or be discontinued for the snmp hardware type entirely, which is likely to impact users of this hardware type. If you're interested in helping maintain the hardware type and its testing, please reach out to the Ironic team via the weekly team meeting[3]. Thanks, -Julia [0]: https://docs.openstack.org/ironic/latest/admin/drivers/snmp.html [1]: https://opendev.org/openstack/virtualpdu [2]: https://pypi.org/project/pysnmp-lextudio/#history [3]: https://wiki.openstack.org/wiki/Meetings/Ironic

1 0

Assistance Needed: Restricting User List API Access Based on Project Context
by Thamanna Farhath 11 Jul '24

11 Jul '24

Hello openstack community, I am currently working on an OpenStack kolla ansible 2023.1. I have created a custom role " owner " Objective: Users with the owner role can only list users within their project. Avoid additional API calls for filtering users by project. Current Challenge: Using direct API calls, the list users API currently returns all users without any project-specific filtering. While additional API calls to the role_assignments endpoint can achieve the desired filtering, this approach is not efficient and doesn't restrict access at the API level. I am considering defining custom Keystone policies to achieve this restriction. However, I am unsure how to properly configure these policies to enforce project-specific access control effectively. Thanks in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 1

[nova] "failure domain" scheduler
by Mohammed Naser 11 Jul '24

11 Jul '24

Hi everyone I had a discussion a few days ago in the #openstack-nova about the possibility of introducing the concept of different failure domains, which would be a component inside of an availability zone. The concept is similar to Azure’s availability set feature: https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-o… I’ve built a very similar nova scheduler filter which leverages server groups + another scheduler hint called `different_failure_domain` then it will actually build them inside different failure domains. The failure domains are built similar to AZs in terms of being modeled are using aggregates, so it would use a `failure_domain` aggregate metadata. I’ve managed to build and validate this functionality with my team here: https://github.com/vexxhost/nova-scheduler-filters Now, based on that, I’m wondering if: 1. Is this the best approach to take based on this? 2. Is this something we can upstream into Nova easily as an extra filter? I think this is helpful for a lot of the “VMware” world people. 😊 Thanks, Mohammed

2 1

numa filtering
by Gk Gk 11 Jul '24

11 Jul '24

How does the scheduler check the numa nodes availability in the background ? Does it use any db like placement to calculate the allocation, resource etc for numa ? I need just the logic in the scheduler for this check ? Thanks Y.G

2 1

[nova] Instance stuck in hard reboot
by Francesco Di Nucci 11 Jul '24

11 Jul '24

Hi all, I hard rebooted an instance while a compute node was down, and now on the dashboard/CLI it is stuck in hard rebooting status. I am able to start/stop/reset it through virsh on the compute node, but I can't get it out of this loop in OpenStack, any suggestions? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

2 2

[Swift - proxy server] manually exclude nodes via new middleware
by Olivier Chaze 11 Jul '24

11 Jul '24

Hi all, I am writing to introduce a new middleware component, ExcludeNode, which we've just started to develop to enhance node management within the Swift proxy server. [Middleware Overview] ExcludeNode is designed to dynamically exclude specific nodes from the proxy's operations. This middleware reads a list of nodes to be excluded from a specified file and prevents these nodes from being considered during normal operations. Main reason for developing this middleware is to avoid objects request latency/failure when nodes are down or when rebalancing objects after adding new nodes for example. The main functionalities include: - Node Exclusion Check: Validates if a node (IP:PORT) is listed in the exclusion file. - Dynamic Updates: Allows updating the exclusion list by writing node information to the specified file (IP:PORT). - Clear the exclusion list How to use it ? Assuming 1.2.3.4 storage node is down, requests will fail with : proxy-server: ERROR with Object server 1.2.3.4:6210/sdm re: Trying to GET /v1/AUTH_[...]: ConnectionTimeout (2.0s) (txn: tx19b7067dcb0c442e96a10-0066867068) To ban the disk 1.2.3.4:6210/sdm , on each proxy-server : curl -X POST `hostname`:8080/exclude_node -H "Content-Type: application/json" -d {"ip":"'1.2.3.4","port":6210}"' in proxy-server.log will be logged : proxy-server: Node added to exclusion list: 1.2.3.4:6210 (txn: tx0f292e3b08f940b5be3d9-0066867068) This way, the node won't serve any request and depending the request type, this latter will be redirected to another primary or handoff node. It will remain like this until the disk is manually removed from the exclusion list and every time this node would have been chosen to serve a request you'll get a log : proxy-server: Node 1.2.3.4:6210 (sdm) explicitly excluded by exclude_node middleware. (txn: txeb9f5953ee3343dbb9699-006686707a) I would greatly appreciate the community's feedback on the following: * FUNCTIONALITY: Does the middleware fulfill a common need? * IMPLEMENTATION: Are there any concerns regarding the code implementation or its impact on existing functionalities? We'd like to submmit this middleware upstream but to be efficient and avoid wasting everybody's time I'd like some feedbacks first :) The code itself is quite simple today but we plan to add features like auto excluding a node reported as unmounted by swift-recon for example. exclude_node.py middleware : https://kpaste.infomaniak.com/nRp8AdJGnMuLCoP7czIbL9IBJjlSkyYS#ARXTJo5ZnGa5… server.py modification : https://kpaste.infomaniak.com/Qvy992wlRbc6yEgrIPhAhyrh2V3-Gipy#E2TaKDAXQdXp… proxy-server.conf : [pipeline:main] - pipeline = [...] proxy-server + pipeline = [...] exclude_node proxy-server [filter:exclude_node] use=egg:swift#exclude_node exclude_nodes_filename = /dev/shm/excluded_nodes Thank you in advance for your feedback, Olivier

3 3

Cannot create windows image on Openstack
by Ramzi Abdallah 11 Jul '24

11 Jul '24

I have installed openstack version bobcat on Centos 9 Stream. The installation went fine and I am able to login and launch the cirros image. The problem I am facing is with windows images. When I try to upload the Windows Server 2012 R2 Standard Evaluation for OpenStack which I downloaded from cloudebase I get this error: TypeError: Cannot read properties of undefined (reading 'data') - Error: Unable to create the image. At first I though the problem is from the image so I created my own with all the needed drivers and got the same problem. Appreciate any help is someone experienced this before Ramzi

3 4

[nova][libvirt] Timed out during operation: cannot acquire state change lock
by Satish Patel 10 Jul '24

10 Jul '24

Folks, We had ceph storage failure and finally its up and running and in HEALTH_OK state but now I am not able to bring up openstack vms. I am running the Zed release of openstack. I have noticed a very odd error on nova_libvirt and am not sure what the solution is here. root@comp1:~# tail -f /var/log/kolla/libvirt/libvirtd.log 2024-07-08 07:22:07.420+0000: 3160: warning : qemuDomainObjBeginJobInternal:934 : Cannot start job (query, none, none) for domain instance-000014b0; current job is (async nested, none, start) owned by (3159 remoteDispatchDomainCreateWithFlags, 0 <null>, 3159 remoteDispatchDomainCreateWithFlags (flags=0x1)) for (1563s, 0s, 1563s) 2024-07-08 07:22:07.420+0000: 3160: error : qemuDomainObjBeginJobInternal:968 : Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainCreateWithFlags) 2024-07-08 07:22:37.444+0000: 41620: warning : qemuDomainObjBeginJobInternal:934 : Cannot start job (query, none, none) for domain instance-000015b2; current job is (async nested, none, start) owned by (3162 remoteDispatchDomainCreateWithFlags, 0 <null>, 3162 remoteDispatchDomainCreateWithFlags (flags=0x1)) for (1671s, 0s, 1672s) 2024-07-08 07:22:37.444+0000: 41620: error : qemuDomainObjBeginJobInternal:968 : Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainCreateWithFlags) I am noticing the VM in a pause state. Any idea what I can do to fix it. I have rebooted compute nodes also in hope it will free up lock or bad process but no luck root@comp1:~# docker exec -it nova_libvirt virsh list Id Name State ---------------------------------- 1 instance-00001751 paused 2 instance-000015b2 paused 3 instance-000014b0 paused When I try to reboot an instance I see the following error. look like qemu acting up.. root@comp1:~# docker exec -it nova_libvirt virsh reboot instance-00001751 error: Failed to reboot domain 'instance-00001751' error: Timed out during operation: cannot acquire state change lock (held by monitor=remoteDispatchDomainMigratePerform3Params)

2 1

[All] CentOS stream 8 jobs
by Tony Breeds 10 Jul '24

10 Jul '24

Hello all, Letting you all know that I, on behalf of the OpenDev infra team bypassed Zuul to merge: https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/922649 This means that any job on any branch testing with FIPS need to be switched to CentOS-Stream-9. Yours Tony.

1 0

[python-openstackclient] openstack client can't use swift command
by chunyang wu 10 Jul '24

10 Jul '24

Hello team: The latest version of python-openstackclient on pypi.org is 6.0.0[0], but this version lacks the ability to use commands related to the Swift project due to the absence of the simplejson package. Although this issue was addressed in a recent commit [1]. The fix has not yet been released on pypi.org. I kindly request that the team release a new version to address this issue as soon as possible. thanks [0]: https://pypi.org/project/python-openstackclient/6.6.0/#history [1]: https://review.opendev.org/c/openstack/python-openstackclient/+/920001

1 0

[NON-ZIP][tacker]Troubleshooting Error in CNF Deployment with Tacker and Helm
by yo-kumamoto＠kddi.com 10 Jul '24

10 Jul '24

Hello, I hope this message finds you well. I am currently working on deploying a Cloud-Native Network Function (CNF) using Tacker. For this deployment, I am utilizing Helm charts as the method of deployment. Following the guidelines provided in the official Tacker documentation (https://docs.openstack.org/tacker/latest/user/v2/cnf/deployment_using_helm/…), I encountered an error during the instantiation process. Despite following the steps closely, the deployment did not proceed as expected. I have attached the error logs to this email for your reference. Could you please provide assistance in troubleshooting this issue? Any insights or suggestions would be greatly appreciated. Thank you for your support. Best regards, Yohei Kumamoto

3 3

Magnum Caracal: magnum-conductor fails with after sql QueuePool limit exhaustion
by Michel Jouvin 10 Jul '24

10 Jul '24

Hi, In our tests of Magnum Caracal, we are experiencing a bad error in openstack-magnum-conductor causing it not to work until it is restarted. The problem is caused by a high number of connections to the magnum DB (compared to what can be seen in Antelope version), exceeding the QueuePool limit configured with max_pool_size (+ an overflow of 50). This is described with more details at https://bugs.launchpad.net/magnum/+bug/2067345 that remained mostly unanswered (but with several people joining to say they were experiencing the same issue). Are they people running Magnum Caracal on this list? Are you experiencing the same issue? In our case we are using RDO distribution (EL9-based) and the Magnum DB is on a remote server. Any suggestion welcome! Best regards, Michel

2 2

[magnum] Cancelling meeting
by Jake Yip 10 Jul '24

10 Jul '24

Hi all, I have to cancel today's meeting due to clashing appointments. Regards, Jake

1 0

[adjutant][tc] Checking in on project health
by Goutham Pacha Ravi 09 Jul '24

09 Jul '24

Hello, During a Technical Committee meeting [1], we were made aware that adjutant's CI jobs are perma-failing; and trivial bot-created patches as well as patches from folks addressing CI issues [2] haven't received any review feedback. I wanted to check on the status of development of this project and its deliverables (adjutant, python-adjutantclient, adjutant-ui). If these are not actively developed, perhaps it is time to retire them [3]. Let me know what you think. Thanks, Goutham [1] https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-09-18.00.log.html#… [2] https://review.opendev.org/q/project:openstack/adjutant+status:open [3] https://docs.openstack.org/project-team-guide/repository.html#retiring-a-re…

2 1

Network demand for controller nodes
by William Muriithi 09 Jul '24

09 Jul '24

Hello, Does anyone know if controller nodes are demanding on network needs? I have a situation where I don't have enough 10GB/s port in the switch. Would a cluster be network constrained if I have three controllers using 1GB/s connections and the execution and storage nodes are on 10GB/s connections? Does the VM traffic ever transverse the controller's network cards? In another word, is there a valid requirement for 10GB/s on openstack controllers? Regards, William

4 3

[skyline][tc] Graduating skyline out of the "Emerging Projects" list
by Goutham Pacha Ravi 09 Jul '24

09 Jul '24

Hi, We were discussing in a recent TC meeting that Skyline seems to be ready to lose the "Emerging project" tag [1]. The arguments supporting it's graduation are: - The project is actively maintained, and has had consistent releases since the Zed release [2][3][4][5] - The project is being used in production cloud deployments [6] - Operators have requested skyline's inclusion in deployment and configuration management projects [7][8] Wu Wenxiang / Skyline team - is this assessment correct? If yes, are there any objections to removing Skyline from [1]? If it helps, the project team can re-assess the OpenStack project requirements we have [9] and work on any deficiencies. Thanks, On behalf of the OpenStack TC, Goutham Pacha Ravi OpenStack TC Chair [1] https://governance.openstack.org/tc/reference/emerging-technology-and-inact… [2] https://releases.openstack.org/zed/#skyline-apiserver [3] https://releases.openstack.org/antelope/#skyline-apiserver [4] https://releases.openstack.org/bobcat/#skyline-apiserver [5] https://releases.openstack.org/caracal/#skyline-apiserver [6] https://governance.openstack.org/tc/user_survey/analysis-2023.html#how-do-y… [7] https://review.opendev.org/q/topic:%22osa/skyline%22 [8] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack…

2 2

[all] New page for OpenInfra D&I initiatives and survey
by Jeremy Stanley 09 Jul '24

09 Jul '24

For those who weren't aware, the OpenInfra web site has a new page for Diversity and Inclusion initiatives coordinated by the D&I Working Group: https://openinfra.dev/about/diversity Diversity and inclusion efforts are essential to the success and sustainability of open source communities. The D&I WG is chartered by the foundation board of directors to support OpenStack and other OpenInfra communities in identifying and overcoming barriers to creating and maintaining an inclusive and welcoming environment for all of us. This new web page is a dedicated place to learn more about getting involved in ongoing efforts that promote D&I within OpenInfra. In order to assist the foundation in better understanding the diversity and inclusion challenges faced by those participating in (or attempting to participate in) various OpenInfra communities, please complete the latest version of the Diversity and Inclusion Survey: https://openinfrafoundation.formstack.com/forms/openinfra_diversity_inclusi… This survey is completely anonymous, and your responses will remain confidential. Individual responses are not shared outside OpenInfra Foundation staff and board delegates in the D&I Working Group. If you're involved in multiple OpenInfra communities, please complete the survey multiple times (once for each community), and if possible also share the survey link in team meetings or similar community discussions. Thanks for reading, and I look forward to seeing you in future D&I activities! -- Jeremy Stanley

1 0

[publiccloud-sig] Reminder - next meeting July 10th - 0700 UTC
by Felix Kronlage-Dammers 09 Jul '24

09 Jul '24

Hi everyone, This Wednesday (July 10th) the next meeting of the public cloud sig is going to happen. We’ll be meeting at 0700 UTC here: https://meetpad.opendev.org/publiccloud-sig <https://meetpad.opendev.org/publiccloud-sig> See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG <https://wiki.openstack.org/wiki/PublicCloudSIG> See you on Wednesday! felix -- Felix Kronlage-Dammers Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-12)
by Goutham Pacha Ravi 08 Jul '24

08 Jul '24

Hello Stackers, Time flies, we're over halfway through our 2024.2 (Dalmatian) release cycle! This second half is usually chock-full of release deadlines, specification and code freezes, and more release action [1]. The past week was a short work week for many folks in the Technical Committee due to local holidays, so this update will be brief. Hervé Beraud (hberaud) and Mike Bayer (zzzeek) joined us at the TC's video meeting last week, and they took us through the goal proposal to remove eventlet from OpenStack [2][3][4][5][6]. The meeting was well attended, and it involved a walkthrough of SQLAlchemy, where zzzeek presented how it supports asyncio and a library that allows non-async definitions to invoke awaitables inside an asyncio application. We didn't merge any new governance proposals this week, but several are in review as noted below. === Weekly Meeting === The weekly meeting was held simultaneously on video and IRC. Please check out the recording posted to the TC's YouTube channel [7] as well as the meeting log on eavesdrop [8]. We have new governance proposals that concern Freezer and Monasca, the two projects that were marked "inactive" during the last release cycle. We discussed providing the Skyline team instructions and time to graduate from being an "emerging" project. The TC reiterated its commitment to ensure that all decisions are made asynchronously and recorded on Gerrit to involve community members in different time zones. The rest of the meeting was focused on the eventlet removal discussion. It was a very informative presentation that I'd recommend all OpenStack maintainers review. We took a note to time-box the reviews on the goal proposal. I'd like to request reviews and any strong objections to be expressed on the proposal as soon as possible. The next Technical Committee meeting is today, 2024-07-09 at 1800 UTC! The meeting will be hosted on OFTC's #openstack-tc channel, and the agenda has been posted to the Meetings Wiki Page [9]. Please consider joining us! === Governance Proposals === Remove Eventlet From Openstack | https://review.opendev.org/c/openstack/governance/+/902585 Update criteria for the inactive projects to become active again | https://review.opendev.org/c/openstack/governance/+/921500 Remove Monasca from inactive list | https://review.opendev.org/c/openstack/governance/+/923466 Transition Watcher project to DPL | https://review.opendev.org/c/openstack/governance/+/923583 Inactive state extensions: Freezer | https://review.opendev.org/c/openstack/governance/+/923441 Retire Kuryr-Kubernetes and Kuryr-Tempest-Plugin | https://review.opendev.org/c/openstack/governance/+/922507 Update to include docs and miscellaneous repos for AC status | https://review.opendev.org/c/openstack/governance/+/915021 Adding a rule to manage the affiliation diversity requirement in the TC | https://review.opendev.org/c/openstack/governance/+/922512 === Upcoming Events === 2024-08-14: Nominations open for 2025.1 OpenStack PTL+TC elections 2024-08-29: Dalmatian-3 milestone Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] Release Schedule: https://releases.openstack.org/dalmatian/schedule.html [2] Remove eventlet from OpenStack: https://review.opendev.org/c/openstack/governance/+/902585 [3] Awaitlet SQLAlchemy: https://awaitlet.sqlalchemy.org/en/latest/ [4] SQLAlchemy Asyncio Facade for oslo.db: https://review.opendev.org/c/openstack/oslo.db/+/922976 [5] zzzeek's async demo: https://github.com/zzzeek/async_demo [6] Presentation Slides: https://docs.google.com/presentation/d/169Bc_Uhv-L-0HzM6WuE6uBsC-1hIlgCOQ4l… [7] TC Meeting Recording, 2024-07-02: https://www.youtube.com/watch?v=KnTDP7Dqit8 [8] TC Meeting IRC Logs, 2024-07-02: https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-02-18.00.log.html [9] TC Meeting, 2024-07-09: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

Re: openstack-discuss Digest, Vol 69, Issue 20
by Gk Gk 08 Jul '24

08 Jul '24

Regarding my question, I mean cli tool which will list all the api calling history of a tenant for nova, neutron, storage etc... On Mon, 8 Jul 2024, 18:35 , <openstack-discuss-request(a)lists.openstack.org> wrote: > Send openstack-discuss mailing list submissions to > openstack-discuss(a)lists.openstack.org > > To subscribe or unsubscribe via email, send a message with subject or > body 'help' to > openstack-discuss-request(a)lists.openstack.org > > You can reach the person managing the list at > openstack-discuss-owner(a)lists.openstack.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of openstack-discuss digest..." > > Today's Topics: > > 1. Re: [nova] Instance stuck in hard reboot (smooney(a)redhat.com) > 2. openstack cli (Gk Gk) > 3. Re: openstack cli (Eugen Block) > 4. Network demand for controller nodes (William Muriithi) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 08 Jul 2024 10:55:20 +0100 > From: smooney(a)redhat.com > Subject: Re: [nova] Instance stuck in hard reboot > To: Francesco Di Nucci <francesco.dinucci(a)na.infn.it>, > openstack-discuss <openstack-discuss(a)lists.openstack.org> > Message-ID: > <940e8f9eeb9314936957807719eaa83b65de489c.camel(a)redhat.com> > Content-Type: text/plain; charset="UTF-8" > > On Mon, 2024-07-08 at 09:32 +0200, Francesco Di Nucci wrote: > > Hi all, > > > > I hard rebooted an instance while a compute node was down, and now on > > the dashboard/CLI it is stuck in hard rebooting status. > > > > I am able to start/stop/reset it through virsh on the compute node, but > > I can't get it out of this loop in OpenStack, any suggestions? > as an admin reset state to error then hard reboot. > as a user you could try issuing a hard reboot again but im not sure > that the preconditions will allow that to complete. > > as always when i mention reset-sate i want to be clear that its is a > action of last resort > and generally unsafe if the error is cause by a move operations. This > situration however > is basically the reason that api action extists. you ahve an instance > stuck in a transitory > state due to an interupted or patial lifecycle operation that does not > change the host. > > if soemting is stuck in rebooting like this reset-set is the tool to reach > for and hard reboot > is the default action that you shoudl recach for to bring it form ERROR to > active. > > > > Thanks in advance > > > > > ------------------------------ > > Message: 2 > Date: Mon, 8 Jul 2024 15:58:38 +0530 > From: Gk Gk <ygk.kmr(a)gmail.com> > Subject: openstack cli > To: openstack-discuss <openstack-discuss(a)lists.openstack.org> > Message-ID: > < > CAJreVFwjABsX+fQkTCeR0tqZa5wEv8nYHTarqJDUFShMxGC0dA(a)mail.gmail.com> > Content-Type: multipart/alternative; > boundary="000000000000192a81061cb9e1d9" > > Hi all, > > Is there a tool available in openstack, using which, as admin, we can list > the operations executed by users like, vm operations , network related etc > given their tenant uuid ? Do you think it is a good idea to have such a > tool ? > > Thanks > Y.G >

1 0

[kolla-ansible] No such file or directory: '/var/lib/kolla/config_files/config.json'"]
by Satish Patel 08 Jul '24

08 Jul '24

Folks, Running openstack Zed release. I am adding new compute nodes and getting this error at nova-cell task., any idea what is wrong here? I searched for bugs and people reported but never found any solution. Any idea what we can do? TASK [nova-cell : Get a list of existing cells] *************************************************************************************************************************************************************************************************************************************************** fatal: [comp7 -> ctrl3]: FAILED! => {"changed": false, "failed_when_result": true, "msg": "Container exited with non-zero return code 2", "rc": 2, "stderr": "INFO:__main__:Loading config file at /var/lib/kolla/config_files/config.json\nERROR:__main__:Unexpected error:\nTraceback (most recent call last):\n File \"/usr/local/bin/kolla_set_configs\", line 417, in main\n config = load_config()\n File \"/usr/local/bin/kolla_set_configs\", line 290, in load_config\n config = load_from_file()\n File \"/usr/local/bin/kolla_set_configs\", line 280, in load_from_file\n with open(config_file) as f:\nFileNotFoundError: [Errno 2] No such file or directory: '/var/lib/kolla/config_files/config.json'\n", "stderr_lines": ["INFO:__main__:Loading config file at /var/lib/kolla/config_files/config.json", "ERROR:__main__:Unexpected error:", "Traceback (most recent call last):", " File \"/usr/local/bin/kolla_set_configs\", line 417, in main", " config = load_config()", " File \"/usr/local/bin/kolla_set_configs\", line 290, in load_config", " config = load_from_file()", " File \"/usr/local/bin/kolla_set_configs\", line 280, in load_from_file", " with open(config_file) as f:", "FileNotFoundError: [Errno 2] No such file or directory: '/var/lib/kolla/config_files/config.json'"], "stdout": "", "stdout_lines": []}

1 0

[ironic] Docs audit complete; results available
by Jay Faulkner 08 Jul '24

08 Jul '24

Hi all, Two PTGs ago, Ironic contributors had a topic about documentation -- we acknowledged our documentation was at times comprehensive, but at times incomprehensible :). This led us to enlist a professional technical writer, Dave Welsch, to assist. Dave has been working over the last few months to get feedback from Ironic users and contributors, as well as auditing our documentation and has put his final findings here: https://docs.google.com/document/d/1e9URuPHKNTx5QXdkCFAzsS0EAAxPJ-xQC4BEpDw… . Actionable bugs were a desired outcome of this, which was achieved. We filed several bugs against Ironic, tagged "docs-audit-2024" -- you can see the list here: https://bugs.launchpad.net/ironic/+bugs?field.tag=docs-audit-2024. I know that identifying issues is only part of the work needed; but it's our hope that by breaking this down and creating a path towards better docs, we'll be able to make it a less daunting task for contributors -- possibly even doable by folks from an outreachy-like program. Thanks for those who participated in this process. Feel free to reach out here if you have any questions, or to me privately. Thanks, Jay Faulkner

1 0

How to setup filters into oslo_notification/cinder
by Helder Ardachnikoff Gomes 08 Jul '24

08 Jul '24

I am working on a project with cinder and we keep listening to events from cinder through oslo messaging. We wish to set up cinder config in order to not receive events with the following event_type: volumes.exist. I read on chatgpt that I could setup my config like that: [oslo_messaging_notifications] driver = messagingv2 topics = notifications notification_format = both notification_filters = -volume.exist But, I am not quite confident about that, may someone help me ? -- _‘Esta mensagem é direcionada apenas para os endereços constantes no cabeçalho inicial. Se você não está listado nos endereços constantes no cabeçalho, pedimos-lhe que desconsidere completamente o conteúdo dessa mensagem e cuja cópia, encaminhamento e/ou execução das ações citadas estão imediatamente anuladas e proibidas’._ * **‘Apesar do Magazine Luiza tomar todas as precauções razoáveis para assegurar que nenhum vírus esteja presente nesse e-mail, a empresa não poderá aceitar a responsabilidade por quaisquer perdas ou danos causados por esse e-mail ou por seus anexos’.*

1 0

[Neutron] Is there a way to work around "External network not reachable from subnet" by setting a static route?
by Florian Haas 08 Jul '24

08 Jul '24

Hi everyone, here's a question I've been chewing on for some time. Please bear with me while I illustrate the background. 1. Suppose you have a regular (internal) Neutron network, subnet, and router. You now plug the subnet into the router and set an external gateway. You then create a port on the subnet. You associate a floating IP with that port. All is well. 2. Suppose instead you do plug the subnet into the router, but you don't set an external gateway on it. You try to associate a floating IP with that port. This creates a BadRequest because: "External network <uuid> is not reachable from subnet <uuid>". 3. Suppose instead you do set an external gateway on the router, but you don't connect the subnet to it. Again, you try to associate a floating IP with that port. This also creates a BadRequest because: "External network <uuid> is not reachable from subnet <uuid>". So far, so good. Up to this point, everything is behaving according to intuitive expectations. Now suppose we have * the external network, * an "outer" internal network, * a Neutron router connecting the two (that is, the router has the external network as its gateway, and has an interface to the "outer" subnet), * an "inner" internal network, * a Nova server (let's call that the "gateway"), which connects the "inner" and "outer" networks, a * another Nova server (the "worker") that sits on the "inner" network. (Suppose, for the sake of discussion, that the "gateway" runs some kind of web application firewall or other virtual security appliance, and the "worker" is a general-purpose Linux instance.) Now I can give the Neutron router a static route so that traffic to the "inner" network uses the "gateway" as its nexthop. Provided the "gateway" does its forwarding correctly, this means that the "worker" has internet connectivity via the "gateway" (which, in turn, achieves this via the router). This, too, works fine for outbound connections originating with the "worker". If I now want to assign a floating IP to the "worker", then routing-wise there really should be no problem: the router should take care of SNAT/DNAT, it would translate the floating IP into a private IP on the "inner" network, would consult its routing table, and throw packets for that "inner" network to the "gateway" to handle, per the static route that's been set. But when I try to associate a floating IP to the "worker" in this scenario, I *still* get the "External network not reachable from subnet" error, because the associated internal check[1] does not take the existing static route into account. This appears to have been an issue in other contexts as well: the defunct Tricircle project appears to have worked around this limitation via a service plugin that just omitted that check.[2] Now my questions are these: 1. Shouldn't this be fixed in core, instead? It would seem to me like the default check is too simplistic, but I might be missing something. 2. Is there a way to make this check take static routes into account, other than providing a service plugin like Tricircle used to do? Thanks! Cheers, Florian References: [1] get_router_for_floatingip(): https://opendev.org/openstack/neutron/src/commit/ebed620aafdff75a05fb5d42ad… [2] get_router_for_floatingip(): https://opendev.org/openstack/tricircle/src/commit/8db8fb30f5757c46a953962d…

2 4