August 2024 - openstack-discuss - lists.openstack.org

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-8)
by Goutham Pacha Ravi 05 Aug '24

05 Aug '24

Hello Stackers, It's been a quiet-yet-busy week for the OpenStack Technical Committee as we approach the tail end of the 2024.2 (Dalmatian) release cycle [1]. We're 8 weeks away from the release date (2024-10-02) and three weeks away from the feature code freeze across many OpenStack code repositories (2024-08-29). If you are a maintainer of an OpenStack repository with any Zuul jobs, I'd encourage you to check if your repository is flagged with any configuration errors [2]. It's possible you're referencing a nodeset or a code repository that isn't there anymore (for example, CentOS-8-Stream was recently deleted [3]). Or, it's possible that you have deprecated syntax. There's a lot of prior art if you would like to fix your Zuul configuration. If you're unsure what to do, please send an email to this list or chat with a Zuul maintainer on OFTC's #opendev channel. The nomination period for PTL positions and the OpenStack TC begins next week (2024-08-14). Election officials will be sharing more context over the next week. If you are a PTL or a member of the TC, motivate individuals to take on these leadership roles and support their enthusiasm. === Weekly Meeting === The TC had a productive meeting over IRC last week [4]. We discussed phased updates to the eventlet removal proposal [5] and the health of the CI system over the past week. Several contributors helped land CVE fixes in the past couple of weeks, which required bumping up package constraints within older stable branches. The removal of CentOS-8-Stream nodesets and the Linaro arm64 region from Zuul caused some gate instability; the Infrastructure team will be glad to assist anyone who's triaging failures caused by these actions. The TC noted the need to delay the retirement of "kuryr-kubernetes" until the Tacker project team has stopped relying on it. The next meeting is on Tuesday (2024-08-06), and it will be simultaneously hosted on Zoom and IRC. Information to join this meeting and the meeting's agenda are on our Wiki page [6]. I hope you'll be able to join us there. === Governance Proposals === ==== Merged ==== Follow up on the affiliation diversity handling | https://review.opendev.org/c/openstack/governance/+/923876 Add os-test-images under glance | https://review.opendev.org/c/openstack/governance/+/925044 [follow up] Fix typos in the eventlet removal proposal | https://review.opendev.org/c/openstack/governance/+/924944 ==== Open for Review/Discussion ==== Update criteria for inactive projects to become active again | https://review.opendev.org/c/openstack/governance/+/921500 Inactive state extensions: Monasca | https://review.opendev.org/c/openstack/governance/+/923919 === Upcoming Events === 2024-08-06: OpenInfra Board Meeting: https://board.openinfra.dev/meetings/2024-08-06 2024-08-12: Call for Proposals due for the OpenInfra Days NA [8] 2024-08-14: Nominations open for 2025.1 OpenStack PTL+TC elections 2024-08-24: Open Infra Days, Vietnam: https://2024.vietopeninfra.org/ 2024-08-29: Dalmatian-3 milestone 2024-09-03: OpenInfra Summit Asia, Suwon Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] Release Schedule: https://releases.openstack.org/dalmatian/schedule.html [2] Zuul Configuration Errors: https://zuul.opendev.org/t/openstack/config-errors [3] CentOS-8-Stream node pool removal: https://lists.opendev.org/archives/list/service-announce@lists.opendev.org/… [4] TC Meeting IRC Logs, 2024-07-30: https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-30-18.00.log.html [5] Remove Eventlet From Openstack: https://review.opendev.org/c/openstack/governance/+/902585 [6] TC Meeting, 2024-08-06: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

Assistance needed - Application Credential
by Naveen Anbarasu 05 Aug '24

05 Aug '24

Hi team, I have created an application credential for the compute service and successfully obtained a token. Access rule: "service": "compute", "method": "GET", "path": "/v2.1/servers" However, when using the token to retrieve the server list, I receive a Error 403 Forbidden error with the message: 'Policy doesn't allow os_compute_api:servers to be performed. But i have a necessary permission within the respective project (member role) How can I solve this problem? Thanks in advance

7 12

designate-sink and find_records()
by Andrew Bogott 05 Aug '24

05 Aug '24

Hello! I use a custom designate sink driver to detect when VMs have been deleted in order to clean up associated resources specific to our cloud: certs, proxies, etc. When deleting proxies I relied on the find_records() call to get a list of IPs associated with the deleted VM; for example: records = central_api.find_records(context, crit) if records: ip = records[0].data LOG.debug("Cleaning up proxy records for IP %s" % ip) self._delete_proxies_for_ip(data["project_name"], ip) Now that the find_records() rpc call has been removed I'm at a bit of a loss. I don't think I can call back into nova for the IPs because by the time sink knows about a VM deletion it has most likely already been deleted from nova. Can anyone suggest a workaround for answering the question "what IPs were associated with that VM that just got deleted?" Or, better yet, is there someplace else in my infra where I should have my special deletion handler outside of designate-sink? Thank you for entertaining this very obscure question :) -Andrew

1 0

[publiccloud-sig] Reminder - next meeting August 7th - 0700 UTC
by Felix Kronlage-Dammers 05 Aug '24

05 Aug '24

Hi everyone, This Wednesday (August 7th) the next meeting of the public cloud sig is going to happen. We’ll be meeting at 0700 UTC here: https://meetpad.opendev.org/publiccloud-sig <https://meetpad.opendev.org/publiccloud-sig> See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG <https://wiki.openstack.org/wiki/PublicCloudSIG> See you on Wednesday! felix -- Felix Kronlage-Dammers Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[horizon] How to enable MFA {TOTP} on Horizon (with ZED release)
by Shubham Kumar Yadav 05 Aug '24

05 Aug '24

Hi all, I was working on a MFA in openstack (ZED). Is it possible to enable MFA using TOTP on Horizon? I'm using a ZED Openstack with Ubuntu 22.04 , and I know that from the CLI point of view, you can have Multi Factor Authentication, but I don't see that implemented on Horizon. i added MFA using - https://docs.openstack.org/keystone/pike/advanced-topics/auth-totp.html but now the problem is i can use the token issued to run openstack cli but not able to login into Horizon with user and password/totp. I see The Totp support was added to Horizon in the Bobcat (2023.2) release I tried the Bobcat image and TOTP seems to work fine with Google Authenticator but doesnt work with the Zed release i added this with Bobcat release image - https://review.opendev.org/c/openstack/charm-openstack-dashboard/+/920704 *So I would like to ask how it is possible to backport the feature in Horizon in the Zed release.* I would appreciate any help! Thanks!

1 0

Bug Deputy Report 29 July - 04 August
by Elvira Garcia Ruiz 05 Aug '24

05 Aug '24

Hi neutrinos! Here you have the list of bugs reported during last week (29 Jul - 04 Aug) High ------ - https://bugs.launchpad.net/neutron/+bug/2062385 "neutron-tempest-plugin-api-ovn-wsgi" not working with TLS Fix proposed by Rodolfo https://review.opendev.org/c/openstack/neutron/+/925376 - https://bugs.launchpad.net/neutron/+bug/2075151 ovs-master jobs failing with lib/actions.c:4549:9: error: struct ofpact_sample has no member named obs_domain_imm; did you mean obs_domain_id? Fix proposed by Pierre Riteau https://review.opendev.org/c/openstack/neutron/+/925091 Medium ----------- - https://bugs.launchpad.net/neutron/+bug/2075207 Neutron ports don't work for certain names Unassigned Incomplete --------------- - https://bugs.launchpad.net/neutron/+bug/2075529 Unable to delete "access_as_shared" RBAC policy Unassigned. Reporter said they were working on a fix. RFEs -------------- - https://bugs.launchpad.net/neutron/+bug/2075958 [RFE] Allow binding SecurityGroups to Network Unassigned - https://bugs.launchpad.net/neutron/+bug/2075955 [RFE] Limit who may bind security groups Unassigned Best regards, Elvira

1 0

[openstack][kolla-ansible]about upgrading openstack
by Nguyễn Hữu Khôi 04 Aug '24

04 Aug '24

Hello. I read this doc about upgrading openstack https://docs.openstack.org/kolla-ansible/latest/user/operating-kolla.html But I would like to know if We install a new kolla-ansible(version to upgrade) on the new deployment host, apply changes with password.yml, global.yml and multinode and keep old /etc/kolla/config. Finally, we use kolla-ansible deploy instead of kolla-ansible upgrade. Are these steps ok? Pls correct me if I am wrong. Thank you. Regards Nguyen Huu Khoi

3 8

[dev][neutron] Interest for a network-level SecurityGroup binding ?
by David Pineau 02 Aug '24

02 Aug '24

Hello Neutron Team, I'm part of a company that is currently migrating from homemade software to manage the infrastructure for a virtualization-based product towards an openstack based infrastructure. As such, this platform includes both private and public cloud usages, which brings me to our current network problem. Essentially, as administrators of the system, we want to expose a pre-configured network, which provides access to some non-openstack managed resources, via some routing mechanisms. The various VMs on this network must not be able to see each-other, as this network may be exposed to multiple customers/projects. Note that in this context, we're using the OVN driver for our network stack. We were initially looking at external networks for this, but understood through our attempts and experimentations that: - External networks are shared to all projects by default - Default sharing of external networks can be disabled by removing the automatically injected rbac for '*', allowing us to expose the network to only the projects we specify - VMs on this network can communicate with each other - Applying FlowControl does not solve this for VMs on the same Hypervisor (as they're directly communicating, and traffic does not seem to go through the host) - Only security groups can prevent such communication, but since it's associated to a Port, we cannot enforce it - All flow control for the various networks connected to a VM are currently setup on a single bridge interface on the hypervisor First question is simple: Did we miss anything ? Or is our understanding of the mechanisms on point ? In the second case, this leads me to the proposal mentioned in the subject: Offer a Network/SecurityGroup binding mechanism that would automatically/implicitly include its rules to the port's rules. The idea is that this would allow an administrator (and project administrator?) to enforce specific rules via security groups attached to the network itself, effectively providing a category of network aimed at providing connectivity to a specific external service. Additionally, this creates a behavior where unless the administrator allows it, no two VMs on this network may be able to communicate together, as a default. What do you think about this feature ? Is there any major risk/flaw that I might be missing ? Would you, as a community, welcome such an effort ? Kind regards, -- David Pineau Engineer @Shadow IRC nick: joa

3 3

[election] [tc] Notification of non-candidacy; how it impacts TC diversity
by Jay Faulkner 01 Aug '24

01 Aug '24

Hi all, The nomination period for TC members / PTLs is coming up soon. I wanted to inform the community that I do not intend on standing for election for another year on the TC. Now is a good time, especially if you work somewhere other than Red Hat, to consider serving as a TC member to ensure our leadership team contains representation for all perspectives of OpenStack use. I'm happy to speak with anyone privately who is interested in running about what it's like to be on the TC, and to share some strategies I exercised to ensure the value of my TC membership was being communicated to leadership at my job. Thanks, Jay Faulkner Technical Committee Member

6 5

oslo.service
by engineer2024 01 Aug '24

01 Aug '24

Can anyone guide me how to configure and use oslo.service for nova-api service for tracing and debugging ? Thanks elinux

3 2