August 2024 - openstack-discuss - lists.openstack.org

[horizon] How to enable MFA {TOTP} on Horizon (with ZED release)
by Shubham Kumar Yadav 05 Aug '24

05 Aug '24

Hi all, I was working on a MFA in openstack (ZED). Is it possible to enable MFA using TOTP on Horizon? I'm using a ZED Openstack with Ubuntu 22.04 , and I know that from the CLI point of view, you can have Multi Factor Authentication, but I don't see that implemented on Horizon. i added MFA using - https://docs.openstack.org/keystone/pike/advanced-topics/auth-totp.html but now the problem is i can use the token issued to run openstack cli but not able to login into Horizon with user and password/totp. I see The Totp support was added to Horizon in the Bobcat (2023.2) release I tried the Bobcat image and TOTP seems to work fine with Google Authenticator but doesnt work with the Zed release i added this with Bobcat release image - https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/920704 *So I would like to ask how it is possible to backport the feature in Horizon in the Zed release.* I would appreciate any help! Thanks!

1 0

Bug Deputy Report 29 July - 04 August
by Elvira Garcia Ruiz 05 Aug '24

05 Aug '24

Hi neutrinos! Here you have the list of bugs reported during last week (29 Jul - 04 Aug) High ------ - https://bugs.launchpad.net/neutron/+bug/2062385 "neutron-tempest-plugin-api-ovn-wsgi" not working with TLS Fix proposed by Rodolfo https://review.opendev.org/c/openstack/neutron/+/925376 - https://bugs.launchpad.net/neutron/+bug/2075151 ovs-master jobs failing with lib/actions.c:4549:9: error: struct ofpact_sample has no member named obs_domain_imm; did you mean obs_domain_id? Fix proposed by Pierre Riteau https://review.opendev.org/c/openstack/neutron/+/925091 Medium ----------- - https://bugs.launchpad.net/neutron/+bug/2075207 Neutron ports don't work for certain names Unassigned Incomplete --------------- - https://bugs.launchpad.net/neutron/+bug/2075529 Unable to delete "access_as_shared" RBAC policy Unassigned. Reporter said they were working on a fix. RFEs -------------- - https://bugs.launchpad.net/neutron/+bug/2075958 [RFE] Allow binding SecurityGroups to Network Unassigned - https://bugs.launchpad.net/neutron/+bug/2075955 [RFE] Limit who may bind security groups Unassigned Best regards, Elvira

1 0

[openstack][kolla-ansible]about upgrading openstack
by Nguyễn Hữu Khôi 04 Aug '24

04 Aug '24

Hello. I read this doc about upgrading openstack https://docs.openstack.org/kolla-ansible/latest/user/operating-kolla.html But I would like to know if We install a new kolla-ansible(version to upgrade) on the new deployment host, apply changes with password.yml, global.yml and multinode and keep old /etc/kolla/config. Finally, we use kolla-ansible deploy instead of kolla-ansible upgrade. Are these steps ok? Pls correct me if I am wrong. Thank you. Regards Nguyen Huu Khoi

3 8

[dev][neutron] Interest for a network-level SecurityGroup binding ?
by David Pineau 02 Aug '24

02 Aug '24

Hello Neutron Team, I'm part of a company that is currently migrating from homemade software to manage the infrastructure for a virtualization-based product towards an openstack based infrastructure. As such, this platform includes both private and public cloud usages, which brings me to our current network problem. Essentially, as administrators of the system, we want to expose a pre-configured network, which provides access to some non-openstack managed resources, via some routing mechanisms. The various VMs on this network must not be able to see each-other, as this network may be exposed to multiple customers/projects. Note that in this context, we're using the OVN driver for our network stack. We were initially looking at external networks for this, but understood through our attempts and experimentations that: - External networks are shared to all projects by default - Default sharing of external networks can be disabled by removing the automatically injected rbac for '*', allowing us to expose the network to only the projects we specify - VMs on this network can communicate with each other - Applying FlowControl does not solve this for VMs on the same Hypervisor (as they're directly communicating, and traffic does not seem to go through the host) - Only security groups can prevent such communication, but since it's associated to a Port, we cannot enforce it - All flow control for the various networks connected to a VM are currently setup on a single bridge interface on the hypervisor First question is simple: Did we miss anything ? Or is our understanding of the mechanisms on point ? In the second case, this leads me to the proposal mentioned in the subject: Offer a Network/SecurityGroup binding mechanism that would automatically/implicitly include its rules to the port's rules. The idea is that this would allow an administrator (and project administrator?) to enforce specific rules via security groups attached to the network itself, effectively providing a category of network aimed at providing connectivity to a specific external service. Additionally, this creates a behavior where unless the administrator allows it, no two VMs on this network may be able to communicate together, as a default. What do you think about this feature ? Is there any major risk/flaw that I might be missing ? Would you, as a community, welcome such an effort ? Kind regards, -- David Pineau Engineer @Shadow IRC nick: joa

3 3

[election] [tc] Notification of non-candidacy; how it impacts TC diversity
by Jay Faulkner 02 Aug '24

02 Aug '24

Hi all, The nomination period for TC members / PTLs is coming up soon. I wanted to inform the community that I do not intend on standing for election for another year on the TC. Now is a good time, especially if you work somewhere other than Red Hat, to consider serving as a TC member to ensure our leadership team contains representation for all perspectives of OpenStack use. I'm happy to speak with anyone privately who is interested in running about what it's like to be on the TC, and to share some strategies I exercised to ensure the value of my TC membership was being communicated to leadership at my job. Thanks, Jay Faulkner Technical Committee Member

6 5

oslo.service
by engineer2024 02 Aug '24

02 Aug '24

Can anyone guide me how to configure and use oslo.service for nova-api service for tracing and debugging ? Thanks elinux

3 2

filter out unsupported volume type for a given compute node
by Jiatong Shen 01 Aug '24

01 Aug '24

Hello Stackers, Our company is operating many sophisticated clusters with different storage types, such Ceph and SAN storage. What makes things trickier is that some compute node cannot use certain volume types. For example, some compute nodes do not have HBA, so they cannot take advantage of FC based SAN storage; the others do not have 10GbE ethernet, so they cannot connect to Ceph. Such deployment sometimes makes resize virtual machine quite tricky. So my question is what is best practice for this situation? Is it possible to determine if certain volume type is usable on a given compute node? Thank you very much for help. -- Best Regards, Jiatong Shen

2 1

[manila] Mid cycle on Aug 12th and 13th
by Carlos Silva 01 Aug '24

01 Aug '24

Hello zorillas and interested stackers! Over the PTG, we have agreed on having a mid-cycle checkpoint meeting, so we can discuss the progress of all things we planned. We have settled on the dates, and it will happen on August 12 and 13, from 14 to 16 UTC both days. We will use a meetpad for the meeting [1]. During the first day we will focus on covering the PTG topics, and for the second day, we will focus on the collaborative review sessions for all of the features being proposed on this cycle. We highly encourage everyone proposing and targeting features for this cycle to participate and propose collaborative review sessions, so we can speed up the reviews on gerrit. The meeting room and some topics are already available in the mid cycle etherpad [1], so please add your topics and propose collaborative review sessions for the features you are working on. [1] https://etherpad.opendev.org/p/manila-dalmatian-mid-cycle-notes Looking forward to it! Regards, carloss

1 0

placement issue
by Parsa Aminian 01 Aug '24

01 Aug '24

hello Im using kolla-ansible openstack version 2024.1 and all of my nova_compute containers are unhealthy because of this error : ERROR nova.compute.manager nova.exception.ResourceProviderAllocationRetrievalFailed: Failed to retrieve allocations for resource provider 3b09027d-c622-489e-bc73-4c5877069977: {"errors": [{"status": 404, "title": "Not Found", "detail": "The resource could not be found.\n\n No such resource class 0. ", "request_id": "req-a33704ce-4dad-4ac3-a46c-bd5a4d0d126b"}]} How can I solve this problem ? thanks in advance

1 0

[cinder] Stepping down from Cinder core
by Pete Zaitcev 01 Aug '24

01 Aug '24

Hello: Because of a job change, my time available is becoming quite limited, so I'm not going to be able to contribute at the appropriate level. So, I contacted our PTL to get me removed from the core team. Thanks everyone for the help and the journey in Cinder. Greetings, Pete

3 2