July 2024 - openstack-discuss - lists.openstack.org

Inconsistent server rebuild behavior
by Andrew Bogott 18 Jul '24

18 Jul '24

I'm puzzled by nova instance rebuilds. When I run 'openstack server rebuild --image <whatever>' on a new test VM, it does what I expect: - throws away the old server image - boots up a brand new server using the requested image with the old user/vendor data - attaches new server to the old network port and cinder volumes. That's just what I want! Alas, when I try this with the actual old VMs in need of update, usually it does a totally different thing: - reboots the server - changes the nova db record to reflect the requested VM (so that the server /looks/ like it was rebuilt in 'openstack server show') - That's it! It absolutely does not rebuild the actual server disk image. So, for instance, any files that were present in '/' of the old server are still present post-rebuild. lsb_release still shows the OS of the original base image, disagreeing with the the OS version displayed by 'openstack server show'. I've been reading logfiles for days but I don't see nova ever complain (in either case) that it's doing something unexpected and in both cases the servers wind up in state 'Active'. Am I misunderstanding what this is supposed to do? If not, does anyone have thoughts about what might be going wrong? I assume nova is encountering a roadbump during the rebuild and doing a graceful revert, but if so it sure isn't telling me. Bobcat, kvm, VM images are hosted on ceph/rbd.

2 3

[rally] possibility to skip admin=True validation
by Benedikt Trefzer 17 Jul '24

17 Jul '24

Hi list I'd like to run rally against barbican. Since all barbican scenarios are tagged with @validation.add("required_platform", platform="openstack", admin=True) we cannot use them since our rally configuration does not have an admin user. (actually test itself should succeed, but the validation fails). Question: Is it somehow possible to skip (or unset admin=True requirement) for validation in the task configuration or do I have to rewrite the scenario ? Cheers Benedikt

1 0

Caracal deliverables for bug 2065145
by Francesco Di Nucci 17 Jul '24

17 Jul '24

Hello, as the bug 2065145 <https://bugs.launchpad.net/neutron/+bug/2065145> fix has been merged into stable/2024.1 branch, are there plans to release a new version of neutron packages that include the fix? If not, should it be advisable to create a proposal for a bugfix release? Thanks -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email:francesco.dinucci@na.infn.it

2 2

General network questions installing OpenStack single node guided
by klaus.becker＠webmen.de 16 Jul '24

16 Jul '24

Dear OpenStackers, I started my 2nd try installing OpenStack single node guided using this link: https://microstack.run/docs/single-node-guided At the point sunbeam cluster bootstrap I have to decide network settings: sudo sunbeam cluster bootstrap Management networks shared by hosts (CIDRs, separated by comma) (192.168.196.0/24): The example given is this: Management networks shared by hosts (CIDRs, separated by comma) (10.20.20.0/24): 172.16.1.0/24 MetalLB address allocation range (supports multiple ranges, comma separated) (10.20.20.10-10.20.20.20): 172.16.1.201-172.16.1.220 Unfortunately there is no information about the LAN the server is running in. What does "Management networks shared by hosts“ mean? I have ONE host (OpenStack) What should be shared? To whom ? I do not understand the clue behind that. The MetalLB addresses are for the VMs, right? So they must be in an address range of my LAN During my first installation (also single node, but not guided) I was not asked for different networks. Finally I was unable to reach Horizon from my LAN. I tried many efforts with routing (nft), but I did not work. Everything seemed live inside my host, but unusable, because I am running Ubuntu Server 24.02 in a Rack using ssh - so: no GUI. I hoped to get another chance with this „guided" installation. What I hoped to get: 1. A dedicated network inside OpenStack where all components are communicating with each other without interfering with my LAN. 2. Access to the Dashboard (Horizon) from my LAN 3. Access to VMs I am using inside OpenStack from my LAN Because I am working over ssh, the host uses an IP number from my LAN (192.168.196.11) There are about 20 IPs free in my LAN The question "Management networks shared by hosts (CIDRs, separated by comma) (192.168.196.0/24):“ shows the whole network (/24) as given. I do not want to run into IP conflicts with other PCs, routers etc. in my LAN. So could someone PLEASE give me a bit more background to this network topic? Thanx a lot! Klaus

2 3

[RALLY 4.1.0] Verifier reconfigure fails when in "no admin" mode
by Jean-François TALTAVULL 16 Jul '24

16 Jul '24

Hi All, I'm using a Rally (4.1.0) deployment with existing users and no admin credentials. So the command "rally env show" outputs "admin": null in the json and it's ok. But the problem is that the command "rally verify configure-verifier -reconfigure" fails with: "rally_openstack.common.credential.OpenStackCredential() argument after ** must be a mapping, not NoneType" I've been struggling with this error for a number of hours with no results :-( Any idea ? I looked for a known bug in launchpad but found nothing. Thanks, Jean-Francois

2 4

Re: [neutron] ovs: multiple rows in Manager patch
by Brian Haley 16 Jul '24

16 Jul '24

Just sending response to the list in case anyone else has the same issue. On 6/17/24 1:09 PM, stream_unpicked390(a)simplelogin.com wrote: > Hi, > > On 6/13/24 21:38, Brian Haley - haleyb.dev(a)gmail.com wrote: >> Hi, >> >> On 6/13/24 4:53 AM, stream_unpicked390(a)simplelogin.com wrote: >>> Hi Brian, >>> On 6/12/24 23:04, Brian Haley - haleyb.dev(a)gmail.com wrote: >>>> Hi, >>>> >>>> On 6/12/24 12:43 PM, stream_unpicked390(a)simplelogin.com wrote: >>>>> Hi everyone! >>>>> >>>>> this is my first time on a mailing list, so please excuse any >>>>> "obvious" mistakes and feel free to correct me :) >>>>> >>>>> I'm currently setting up a minimal OpenStack system manually on one >>>>> server. The setup is nearly complete but I'm running into issues >>>>> with neutron. After fully completing the neutron setup as mentioned >>>>> in the docs, the neutron-ovs-service refuses to start, showing the >>>>> error message >>>> >>>> Sorry, but I have to ask which "docs" are you using? >>> >>> thanks for your quick answer! I followed the OpenStack install guide >>> under https://docs.openstack.org/2024.1/install/. For neutron >>> specifically, I used the document linked under >>> https://docs.openstack.org/neutron/2024.1/install/install-ubuntu.html. >>> >>> As I mentioned, I'm currently setting up everything on just one >>> server, the documentations scenario describes two servers. This is >>> the only intentional diversion I made from the docs. I've been trying >>> to setup a self-service network. >>> >>>> I don't see ptcp used in any of the examples here for ovsdb_connection: >>>> >>>> https://docs.openstack.org/neutron/latest/install/ >>> >>> I couldn't find any example of the ovsdb_connection and I don't >>> remember modifying any value like that either. The problem existed >>> "right out of the box". Can you point me to the part of the linked >>> documentation where the ovsdb_connection config is discussed? >> >> Instead of trying to go through the details of anything that might be >> wrong, if you are just trying to get a single-node Openstack running >> have you tried using devstack [0]? It would be much simpler if this is >> just for testing purposes. > This is a production setup so devstack was out of the question. Because > of our very tight constraints, we first have to set up a single node, > before being able to add additional servers. Definitely not ideal.. Your > hint about ovsdb_connection helped me out! While I couldn't find any > setting with the name ovsdb_connection already set to an, apparently > wrong, string, I set ovsdb_connection to the value mentioned by you. > This probably overwrote something I couldn't find, because after > restarting neutron, my issues were gone! Thanks again for looking into > my issue and guiding me on the right path! Glad it worked out, thanks for responding. -Brian >> [0] https://github.com/openstack-dev/devstack.git >> >>>>> multiple rows in Manager patch "ptcp:6640:127.0.0.0" >>>> >>>> Two things look wrong here, both the IP address and port. Typically >>>> this string would be "ptcp:127.0.0.1:6640" or "ptcp:0.0.0.0:6640" in >>>> ml2_conf.ini. >>> >>> Thanks! I will try to take a look at the aforementioned config as >>> soon as possible and report back! >>> >>>> >>>> -Brian >>>> >>>>> I dumped the ovs database which only shows one row in the Manager >>>>> table. After many days of debugging and googleing I'm out of ideas >>>>> how this could be solved.. >>>>> I already posted this issue on serverfault >>>>> (https://serverfault.com/questions/1160418/openstack-ovs-multiple-rows-in-ma…) only after that post finding this mailing list! >>>>> >>>>> Best regards >>>>> Talooola >>>>> >>>> >>

2 1

[swift] Weird log corruption or something more serious?
by Sam Morrison 16 Jul '24

16 Jul '24

Hi, We are debugging a weird issue with our swift cluster (currently running 2.29.2) We got a report from a user that they were getting upload failures and then sent us this from their logs: 2024-06-25 23:30:06,829 | swiftclient.service | ERROR | Object PUT failed: https://swift-host/v1/PROJECT_ID_A/prod_result/195e5e8e-334a-11ef-ba70-0a58… 401 Unauthorized [first 60 chars of response] b'<html><h1>Unauthorized</h1><p>This server could not verify t' (txn: txab25fcfcf3354bbbaf105-00667b52fe) Searching our logs for that transaction ID I found: 203.101.227.241 127.0.0.1 25/Jun/2024/23/30/06 PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/blobs/default/content/vol-27/chap-25/6bc30bae-4f5e-40a8-bc63-096679af1a58.bytes HTTP/1.0 401 - rclone/v1.59.0%2Cpython-swiftclient-4.2.0 gAAAAABme1L7tlfE... - 131 - txab25fcfcf3354bbbaf105-00667b52fe - 0.0440 - - 1719358206.765954018 1719358206.809994936 0 Note this is a completely different project ID from our side, timestamp is correct too. We also have this: ERROR WSGI: code 400, message Bad request syntax ('\x89PNG') (txn: txab25fcfcf3354bbbaf105-00667b52fe) (client_ip: XX.XX.XX.XX) Upon further analysis we see this quite a lot, mostly from attempted hackers but lots from real users and lots seem to be related to rclone. Eg. Jun 27 08:24:46 swift-host proxy-server[70043]: ERROR WSGI: code 400, message Bad request syntax ('PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/elasticsearch/nexus/nodes/0/indices/42b6a6a76dae683a647546ac02a6883108ac7df5/0/index/segments_4PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/elasticsearch/nexus/nodes/0/indices/4db62ff1327dfe236d85b1dd1a6a9e8139e7e4cf/0/index/_67t.cfs HTTP/1.1') (txn: txd57a3d00bb1942c6a390e-00667c952a) (client_ip: XX.XX.XX.XX) Anyone know what is going on here? Thanks, Sam

1 1

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-11)
by Goutham Pacha Ravi 16 Jul '24

16 Jul '24

Hello Stackers, The 2024.2 release train is chugging along, and its final stop is 11 weeks away [1]. In the past week, the OpenStack Technical Committee updated its charter to enforce its affiliation diversity requirements during TC elections [2]. If an election results in over 50% of the TC being affiliated with the same organization, we've adopted a rule to vacate the least favored candidate elected from that organization and accommodate a non-elected candidate with a different affiliation, if one exists. We're also ideating on how to handle situations where there are no candidates from other organizations [3]. Your views are greatly appreciated. Nominations for the TC (and PTL) elections for 2025.2 open on 2024-08-14. You'll begin to receive election-specific emails soon. In other news, Jeremy Stanley (fungi) shared the OpenInfra Foundation's Diversity and Inclusion Working Group updates on this list recently [4]. I encourage you to participate in the survey that the group has put together [5]. It's open year-round, and the feedback gathered will be incorporated continuously. === Weekly Meeting === Last week's Technical Committee meeting was well attended, and the meeting was logged to eavesdrop [6]. We discussed project activity and gate issues in Monasca, Freezer, Skyline, Tacker, Masakari, Zaqar, and Adjutant. We're very glad to see the project teams' responsiveness to the concerns raised. Monasca and Freezer teams have expressed their desire to remain "inactive" through this release cycle. A proposal has been made to move Skyline from the list of "Emerging" projects. The TC will review these proposals in the coming week. The retirement of the "kuryr-kubernetes" repository was held off temporarily to address dependencies within Tacker. The next Technical Committee meeting is tomorrow, 2024-07-16! The meeting will be hosted on OFTC's #openstack-tc channel, and the agenda has been posted to the Meetings Wiki Page [7]. Please consider joining us! === Governance Proposals === ==== Merged ==== Adding a rule to manage the affiliation diversity requirement in the TC | https://review.opendev.org/c/openstack/governance/+/922512 ==== Open for review/discussion ==== Follow up on the affiliation diversity handling | https://review.opendev.org/c/openstack/governance/+/923876 Move Skyline out from the "Emerging Projects" list | https://review.opendev.org/c/openstack/governance/+/924109 Transition Watcher project to DPL | https://review.opendev.org/c/openstack/governance/+/923583 Inactive state extensions: Monasca | https://review.opendev.org/c/openstack/governance/+/923919 Update to include docs and miscellaneous repos for AC status | https://review.opendev.org/c/openstack/governance/+/915021 Update criteria for the inactive projects to become active again | https://review.opendev.org/c/openstack/governance/+/921500 Inactive state extensions: Freezer | https://review.opendev.org/c/openstack/governance/+/923441 Retire kuryr-kubernetes and kuryr-tempest-plugin | https://review.opendev.org/c/openstack/governance/+/922507 Remove Eventlet From OpenStack | https://review.opendev.org/c/openstack/governance/+/902585 The OpenStack Technical Committee serves you! We're always willing to chat with you and would love feedback: === How to contact the TC === You can reach out to the TC in multiple ways: 1. Email: you can send the email with the tag [tc] on this email list. 2. Ping us using the 'tc-members' keyword on the #openstack-tc IRC channel 3. Join us at our weekly meeting: The Technical Committee meets every week on Tuesdays at 1800 UTC [7] === Upcoming Events === 2024-08-14: Nominations open for 2025.1 OpenStack PTL+TC elections 2024-08-24: OpenInfra Days, Vietnam: https://2024.vietopeninfra.org/ 2024-08-29: Dalmatian-3 milestone Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] Release Schedule: https://releases.openstack.org/dalmatian/schedule.html [2] TC Diversity Requirement: https://governance.openstack.org/tc/reference/charter.html#tc-diversity-req… [3] Following up on affiliation diversity: https://review.opendev.org/c/openstack/governance/+/923876 [4] OpenInfra D&I initiatives and survey: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [5] D&I survey: https://openinfrafoundation.formstack.com/forms/openinfra_diversity_inclusi… [6] TC Meeting IRC Logs, 2024-07-09: https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-09-18.00.log.html [7] TC Meeting, 2024-07-16: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

Restricting User Deletion to Project Owners
by Thamanna Farhath 16 Jul '24

16 Jul '24

Hi OpenStack Community, I am working on a policy configuration to ensure that only owners of a project can delete users within their own project. Below is my current setup and the policy rules I have defined. Current Setup OpenStack deployment using Kolla Ansible 2023.1. Created an owner role with permissions to create, delete, and manage users and projects. But it allows you to delete users from other projects as well. So, I need to achieve the below scenario. Policy Rules yaml "admin_required": "role:admin" "admin_or_owner": "rule:admin_required or (role:owner and project_id:%(target.user.project_id)s)" "identity:delete_user": "rule:admin_or_owner" Scenario User demo with owner role of project X creates users newuser1 and newuser2 assigned to project X. User tester with owner role of project Y creates users myuser1 and myuser2 assigned to project Y. With the above configuration, I aim to ensure that: User demo can only delete newuser1 and newuser2 within project X. User tester can only delete myuser1 and myuser2 within project Y. Thank you for your support. Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 3

[keystone] Keystone Single Sign-On for REST API Access
by leon.amtmann＠ibm.com 16 Jul '24

16 Jul '24

Hello OpenStack Community, and greetings especially to the Keystone experts among you. I'm currently co-administering an OpenStack 17.1.3 cluster with a few compute nodes and three controllers. For a better user experience, we've enabled Single Sign-On using OIDC for Horizon, which is working fabulously. To do that, the [mod_auth_openidc module](https://github.com/OpenIDC/mod_auth_openidc) is configured for httpd on the controller nodes. However, we're now facing a novel scenario for us. Basically, we want to interact with the OpenStack REST APIs - but not using a usual token request to `/v3/auth/tokens`, but using Single Sign-On. We've looked at the authentication request that Horizon makes to Keystone after successful authentication with the SSO provider. As far as we can tell: 1. After successful authentication with the SSO identity provider, Keystone redirects back to the redirect URI with a grant_id, id_token and state in the URL fragments (after # in the URL). 2. The redirect URI is `/v3/auth/OS-FEDERATION/websso/openid`, which contains HTML that will read the fragments and POST them as form data to somewhere. 3. Those fragments get POSTed to `/v3/auth/OS-FEDERATION/websso/openid`. 4. The response from Keystone is an HTML document containing an auth token, rigged to get POSTed to Horizon at `/dashboard/auth/websso/` (presumably to start a fresh session). So far, so good. The [Keystone federation documentation](https://docs.openstack.org/keystone/latest/admin/federation/… does show the [Horizon flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct… in action. I can replicate it in part using cURL, by doing the same requests to the same endpoints that my browser does. However, I do not understand or see a request to `/v3/auth/OS-FEDERATION/websso/mapped` where Keystone actually issues a token. Instead, after the `id_token`, `grant_id`, etc. are POSTed to `/v3/auth/OS-FEDERATION/websso/openid`, Keystone responds with an HTML document containing the token (see step 4. in my earlier list). I've only seen this working for Horizon in an actual browser, though. Am I misunderstanding the documentation? Right above that in the documentation, there is a section about an unrelated [OpenID Connect Authentication Flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct…. It contains a graphic in which the first request made is a GET request to `/secure`. A direct GET request yields a `404`, so I assume this is a placeholder for any protected resource. However, if I request any protected resource without a valid token, I do not receive a 302 as the graphic would seem to suggest. Is this a behavior that would need to be configured, first? In short: How does one end up with an unscoped token when trying to SSO against Keystone from something that is not Horizon? I'm just wondering if I am on the correct path in trying to modify the `10-keystone.wsgi` in `/etc/httpd/conf.d/` to use [multiple providers](https://github.com/OpenIDC/mod_auth_openidc/wiki/Multiple-Provid…. If, after starting the SSO process, I end up with a `grant_id` and an `id_token`, where do I post this to to get a Keystone token in return? After going through the documentation, I am still at a loss. I would appreciate any help. Thank you for your time.

4 3