January 2025 - openstack-discuss - lists.openstack.org

[kolla-ansible][keystone]problem using LDAP and TLS
by Franck VEDEL 14 Jan '25

14 Jan '25

Hello, with all previous versions, to authenticate users from an Active Directory domain, using an LDAP connector worked without any problem on my labs, with or without using TLS. With TLS the file used is the following: /etc/kolla/config/keystone/domains/keystone.DOM1.conf [identity] driver = ldap [ldap] url = ldap://172.16.60.41 user = CN=ldapconnect,OU=openstack,DC=dom1,DC=loc password = XXXXXXXXXX suffix = DC=dom1,DC=loc user_tree_dn = OU=openstack,DC=dom1,DC=loc user_objectclass = person user_filter = (|(memberOf=CN=openstack-users,OU=openstack,DC=dom1,DC=loc)(memberOf=CN=openstack-admins,OU=openstack,DC=dom1,DC=loc)) user_id_attribute = sAMAccountName user_name_attribute = sAMAccountName user_mail_attribute = mail user_pass_attribute = user_enabled_attribute = userAccountControl user_enabled_mask = 2 user_enabled_default = 512 user_attribute_ignore = password,tenant_id,tenants group_objectclass = group group_tree_dn = OU=openstack,DC=dom1,DC=loc group_filter = (|(CN=openstack-users)(CN=openstack-admins)) group_id_attribute = cn group_name_attribute = name query_scope = sub chase_referrals = false use_tls = True tls_certificate = /etc/kolla/certificates/adserv.crt tls_req_cert = never I want to see if it works with Dalmatian (to update my lab, which I can't do with the Bobcat and Caracal versions because bugs block me). Without TLS (use_tls = False) , no problem, it works, my AD users can use Horizon and have access to their project. If I put "use_tls = True" and tls_certificate = /etc/kolla/certificates/adserv.crt .... It doesn't work with Dalmatian, certificate problem. Indeed, the certificate is not copied into the keystone container, so it can't use it. In the keystone logs (/var/kolla/keystone/keystone.log) there is an error message: 2025-01-15 08:36:04.477 1084 ERROR keystone.server.flask.request_processing.middleware.auth_context OSError: tls_cacertfile /etc/kolla/certificates/adserv.crt not found or is not a file However, my adserv.crt file has not changed, is valid, and is in /etc/kolla/certificates directory. What could have changed with the Dalmatian version? I tried to change parameters, but I can't find the solution. How should I proceed to make it work with TLS. I specify again that it works without TLS so the problem is really to use this certificate correctly, so to put it in the right place with the right parameter: tls_certificate or a new one? My lab use ubuntu 2204. Thanks a lot for your help Franck VEDEL

1 0

Facing issue while creating image in Open stack using Barbican
by Shalini Srivastava 14 Jan '25

14 Jan '25

Hi Sir, I have created openstack image with the help of Barbican key-manager but it is not coming in active mode from past two days. It is still showing in queue mode only. Since i have searched a lot reagarding the same issue but could not find any solution to fix the same. Hope to hear from you soon. Thanks & Regards Shalini Srivastava Project Associate /प्रोजेक्ट एसोसिएट Centre for Development of Advanced Computing(C-DAC) / प्रगत संगणन विकास केन्द्र(सी-डैक) Tidel Park”, 8th Floor, “D” Block, (North &South) / “टाइडल पार्क”,8वीं मंजिल, “डी” ब्लॉक, (उत्तर और दक्षिण) No.4, Rajiv Gandhi Salai / नं.4, राजीव गांधी सलाई Taramani / तारामणि Chennai / चेन्नई – 600113 Ph.No.:044-22542226/27 Fax No.: 044-22542294 ------------------------------------------------------------------------------------------------------------ [ C-DAC is on Social-Media too. Kindly follow us at: Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ] This e-mail is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email is strictly prohibited and appropriate legal action will be taken. ------------------------------------------------------------------------------------------------------------

1 0

[dev] Invitation to participate in a survey on flaky tests spanning multiple OpenStack projects
by xiao＠ait.kyushu-u.ac.jp 14 Jan '25

14 Jan '25

Hello there, My name is Tao Xiao, Assistant Professor at Kyushu University (Japan), and togather with a team from Canada and China. Our research specifically investigates cross-project flakiness by analyzing information available on the Gerrit Code Review platform. Through our study, we have observed a significant number of flaky tests spanning multiple OpenStack projects and categorized several potential causes behind this phenomenon. Our next step is to validate our empirical findings and gather real developers' perceptions to improve the OpenStack ecosystem through a developer survey. If you have at most 10 minutes, we have designed a simple survey to capture your perceptions. The survey link is here: https://forms.gle/dUMWRL8MNALQE6kG8 This questionnaire is totally anonymized, and the survey was approved by the Kyushu University, Japan ethics board (2024-26). Again, thank you so much for your time, and please feel free to contact us for more information. Tao Xiao on Behalf of Our Team Assistant Professor Faculty of Information Science and Electrical Engineering Kyushu University, Japan xiao(a)ait.kyushu-u.ac.jp <mailto:xiao@ait.kyushu-u.ac.jp> Team Members and their homepages: Tao Xiao – https://tao-xiao.github.io/ Dong Wang – https://dong-w.github.io/ Shane McIntosh – https://shanemcintosh.org/ Hideaki Hata – https://hideakihata.github.io/ Yasutaka Kamei – https://posl.ait.kyushu-u.ac.jp/~kamei/

1 0

[openstack][octavia] How clients can debug their LB
by Nguyễn Hữu Khôi 14 Jan '25

14 Jan '25

Hello. I would like to know how clients can debug their LB such as access log or monitor LB performance? Thank you. Regards Nguyen Huu Khoi

5 7

[ironic] Ironic-Lib being deprecated
by Jay Faulkner 14 Jan '25

14 Jan '25

Hi all, As many of you know, at the recent PTG the Ironic community made a decision to move any functionality out of ironic-lib into ironic / ironic-python-agent. This library has been documented, since it's inception, as for use by Ironic projects only, so there should be little to no impact to deployers other than having one less python package to deploy in their IPA ramdisks and Ironic services. We will keep the repository's stable (and unmaintained) branches open for as long as their Ironic/IPA counterparts are also supported in order to fulfill our support obligation. Remaining patches to complete this deprecation are here: https://review.opendev.org/q/topic:%22ironic-lib-deprecation%22 -- please reach out if there are any questions or concerns. I thought it wise to inform the mailing list of this change. We'll ensure it's highlighted in Ironic cycle highlights for epoxy as well. Thanks, Jay Faulkner

1 0

[release] [upgrades] Seeking OpenStack Upgrade Success Stories
by Allison Price 14 Jan '25

14 Jan '25

Hi everyone, Ahead of the OpenStack 2025.1 ‘Epoxy’ release, the OpenInfra Foundation marketing team wants to work with the OpenStack community to highlight how upgrades have become simplified with the implementation of SLURP. This will include leveraging the governance docs to draft articles around the upstream progress as well as operator success stories for organizations who have upgraded their own deployments or customer deployments to a SLURP release. The goal is to further increase awareness on the improvements made to the upgrade process and reduce common perceptions that OpenStack upgrades remain complex. Here [1] is an etherpad where we are collecting names of volunteers who can either review materials promoting the upstream progress or share operator success stories. If you have any questions, please let me know. [1] https://etherpad.opendev.org/p/OpenStackUpgrades Cheers, Allison Allison Price VP of Marketing & Community p: +1-214-686-6821

1 0

[all] Foundation Individual Director election voting underway
by Jeremy Stanley 14 Jan '25

14 Jan '25

Voting is open now for the 2025 OpenInfra Foundation Individual Director Election. You must have joined the Open Infrastructure Foundation as an Individual Member by Sunday, July 14, 2024 to vote in this election, per the bylaws: https://openinfra.org/legal/bylaws Individual Directors serve as board representatives for the Individual Members who elect them, so are the most effective way we as participants in OpenStack can influence board decisions on the general direction of our supporting foundation. Voting in these elections, once you're eligible to do so, is also necessary in order to maintain your individual membership. To vote, check your email (or your spam folder) for your personal link to vote. It will have been sent to the primary address in your foundation member profile. The subject line is: "OpenInfra Foundation 2025 Individual Director Election" You can review the candidates here: https://openinfra.dev/election/2025-individual-director-election/candidates Voting will close this Friday, January 17th, 2025 at 1900 UTC. Please contact secretary(a)openinfra.dev with any questions you may have about the election. -- Jeremy Stanley

1 0

[kolla] [wallaby] [openvswitch]
by Albert Braden 14 Jan '25

14 Jan '25

One of our busiest clusters was rebuilt on Wallaby a few months ago (kolla-ansible) and deletions are taking a long time for VMs on some hypervisors. When I look at the ovs-vswitchd.log on the slow hypervisors I see lots of errors that apparently refer to a missing VM interface: 2024-12-27T19:06:10.482Z|01793|bridge|WARN|could not open network device qvo0430a2f7-cd (No such device) For most network devices I see "added" and "deleted" lines in the log. This one has an "added" line but no "deleted". I tried restarting the neutron_openvswitch_agent and openvswitch_vswitchd containers but that didn't make a difference. How can I get OVS to stop choking on this missing interface?

2 17

[ironic][networking] Baremetal Networking Working Group resuming 2/15
by Julia Kreger 14 Jan '25

14 Jan '25

Greetings everyone, Now that we are in the new year and a number of ironic contributors are back from PTO, we're going to resume the networking meetings. One aspect which we discussed in December was to focus the discussion. To that end, after some follow-up discussion, we're going to try and focus the meeting a bit more using the agenda. We have an agenda posted to the etherpad[0], along with a meeting link. If you have additional topics, please feel free to add to that agenda, but also be mindful between the use cases of standalone usage and openstack integrated usage and explicitly call out the use case. As a reminder, the meeting will be at 1500 UTC. Meeting link in the etherpad! Thanks! -Julia [0]: https://etherpad.opendev.org/p/ironic-networking

1 0

[publiccloud-sig] Reminder: first meeting of the new year - January 15th at 0800 UTC
by Felix Kronlage-Dammers 14 Jan '25

14 Jan '25

Hi everyone, This upcoming Wednesday (January 15th) the next meeting of the publiccloud-sig is going to happen. We’ll be meeting at 0800 UTC here: https://meetpad.opendev.org/publiccloud-sig See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG felix -- Felix Kronlage-Dammers Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0