January 2025 - openstack-discuss - lists.openstack.org

[security-sig][ops][neutron] OVN Security issue can impact OpenStack users
by Jay Faulkner 22 Jan '25

22 Jan '25

Hi all, A recent security issue with OVN recently came to light and was fixed in a recent release. Full details are here: https://www.openwall.com/lists/oss-security/2025/01/22/5 . OpenStack deployers running OVN are strongly recommended to upgrade to the new fixed version. No CVE number has been issued yet for this resolved vulnerability. As a note, this was originally reported to the VMT as a neutron bug, but after triage it was responsibly reported to OVN and has been held under embargo. Thank you to the folks who participated in this triage process, including the OVN community for fixing the issue. Please see https://bugs.launchpad.net/ossa/+bug/2088280 for full details on OpenStack handling of this security report. Thanks, Jay Faulkner OpenStack VMT

1 0

[openstack-ansible]: GPU passthrough
by Rambo Rambo 22 Jan '25

22 Jan '25

Hi Experts Release: Wallaby Distribution: Openstack-ansible I am working on enabling GPU computes through PCIpassthrough: I managed to test the GPU PCI passthrough with the direct configuration below. *GPU compute:* /etc/nova/nova.conf [pci] device_spec = { "vendor_id": "10de", "product_id": "25b6" } passthrough_whitelist = { "vendor_id": "10de", "product_id": "25b6" } alias = { "vendor_id": "10de", "product_id": "25b6", "device_type": "type-PCI", "name": "nvidia" } *Nova API container:* /etc/nova/nova.conf enabled_filters = AvailabilityZoneFilter,ComputeFilter,AggregateNumInstancesFilter,AggregateIoOpsFilter,ComputeCapabilitiesFilter,ImagePropertiesFilter,ServerGroupAntiAffinityFilter,ServerGroupAffinityFilter,NUMATopologyFilter, *PciPassthroughFilter* [pci] alias = { "vendor_id": "10de", "product_id": "25b6", "device_type": "type-PF", "name": "nvidia" } Now I need to put the configuration through openstack-ansible. So I need support for the same. *compute:* I intend to use hostvar for the compute configuration: /etc/openstack_deploy/host_vars/compute-<>.yml Can someone please confirm the parameters I need to set in this file and how to implement it? device_spec = ? passthrough_whitelist = ? nova_pci_alias: - '{ "name": "nvidia", "product_id": "25b6", "vendor_id": "10de" }' =====> how can I add *device_type field* here as per the mail.yaml it only have name,product_id and vendor_id field? Run openstack-ansible os-nova-install.yml --tags nova-config --limit <compute name> *For nova_api configuration,* I intend to use below: Below parameter in the user_variable file nova_scheduler_default_filters: - AvailabilityZoneFilter - ComputeFilter - AggregateInstanceExtraSpecsFilter - AggregateNumInstancesFilter - AggregateIoOpsFilter - ComputeCapabilitiesFilter - ImagePropertiesFilter - ServerGroupAntiAffinityFilter - ServerGroupAffinityFilter - NUMATopologyFilter - PciPassthroughFilter nova_pci_alias: - '{ "name": "nvidia", "product_id": "25b6", "vendor_id": "10de" }' =====> how can I add *device_type field here* as per the mail.yaml it only have name,product_id and vendor_id field? Execute: openstack-ansible os-nova-install.yml --tags nova-config --limit <nova api containers> Regards

2 2

[skyline-console] Issue with Skyline Console in Dalmatian Version of OpenStack
by Shubham Kumar Yadav 22 Jan '25

22 Jan '25

Dear Support Team, I hope this message finds you well. I am reaching out to report an issue I am experiencing with the Skyline console in the Dalmatian version of OpenStack. Issue Description: I am unable to list volumes and instances, as well as access volume-related services like Manila. This functionality is critical for my operations. Version Details: I have successfully set up the Skyline console for the Zed version of OpenStack, where everything is functioning as expected. However, the same cannot be said for the Dalmatian version. Troubleshooting Steps Taken: I have checked the service status and confirmed that all necessary services are running. I have attempted to refresh the console and clear the cache, but the issue persists. Request for Assistance: I would appreciate any guidance or troubleshooting steps you could provide to resolve this issue. If there are any logs or additional information you need from my end, please let me know. Also im using same image for both the openstack version - *99cloud/skyline:latest * These are the versions of nova-api & cinder-api *Zed version nova-manage version 26.2.2 cinder-manage version list 21.1.0* *Dalmation versionnova-manage version30.0.1cinder-manage version list* *25.0.0* Thank you for your attention to this matter. I look forward to your prompt response. Best regards, Shubham

1 0

reg trove - issues in deployment
by Rajendar K 22 Jan '25

22 Jan '25

Dear All, I have the following issues while trying trove service. (i) I have installed using kolla ansible and my trove container version is (trove-conductor:2024.1-debian-bookworm) and all my service is running in healthy state. (ii) trove-taskmanger.log as follows 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall File "/var/lib/kolla/venv/lib/python3.11/site-packages/trove/common/utils.py", line 195, in poll_and_check 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall obj = retriever() 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall ^^^^^^^^^^^ 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall File "/var/lib/kolla/venv/lib/python3.11/site-packages/trove/taskmanager/models.py", line 839, in _service_is_active 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall raise TroveError(_("Service not active, status: %s") % status) 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall trove.common.exception.TroveError: Service not active, status: failed to spawn 2025-01-22 10:41:54.605 7 ERROR oslo.service.loopingcall 2025-01-22 10:41:54.624 7 ERROR trove.taskmanager.models [None req-9aede034-a46c-47ec-a149-d7e164fa82e2 cad362f5da0d4f5b8aa87b0650379ed7 4e4b5450f3514da4af3c282d510d9f71 - - - -] Failed to create instance b53d9ebb-2fc6-4927-91c2-f82379b98cfa, error: Service not active, status: failed to spawn.: trove.common.exception.TroveError: Service not active, status: failed to spawn 2025-01-22 10:41:54.636 7 ERROR trove.taskmanager.models [None req-9aede034-a46c-47ec-a149-d7e164fa82e2 cad362f5da0d4f5b8aa87b0650379ed7 4e4b5450f3514da4af3c282d510d9f71 - - - -] Service status: ERROR, service error description: guestagent error: trove.common.exception.TroveError: Service not active, status: failed to spawn 2025-01-22 10:41:54.645 7 ERROR trove.taskmanager.models [None req-9aede034-a46c-47ec-a149-d7e164fa82e2 cad362f5da0d4f5b8aa87b0650379ed7 4e4b5450f3514da4af3c282d510d9f71 - - - -] Trove instance status: ERROR, Trove instance status description: Build error: guestagent timeout.: trove.common.exception.TroveError: Service not active, status: failed to spawn (iii) Does docker required for the configuration of DB or not need in case I use the image trove-master-guest-ubuntu-jammy.qcow2 directly Kindly help me in this regard, thanks Raj

1 0

[magnum] Proposing Jakub Darmach as core reviewer
by Michał Nasiadka 22 Jan '25

22 Jan '25

Hello, I’d like to propose Jakub Darmach (jakub(a)stackhpc.com) as a core reviewer. He has spent quite a good deal of time to get unmaintained branches CI in a green state. He has also contributed some Heat driver patches in the past and is actively reviewing patches (also going the extra mile of updating these patches to be mergable when the author is not available/responsive). Michał Nasiadka mnasiadka(a)gmail.com

3 3

[telemetry] Stepping down from core team
by Yadnesh Kulkarni 22 Jan '25

22 Jan '25

Dear Team, Due to my role change I will no longer be able to contribute to the Telemetry projects. I’ve decided to step down from the core team. Working on the Telemetry projects has been a truly rewarding and enriching learning experience. I’ve thoroughly enjoyed being part of this incredible journey and have gained a lot from collaborating with such talented and supportive individuals. Thank you all for your guidance, collaboration, and support throughout this time. Wishing the team continued success and growth! -- Yadnesh Kulkarni

2 1

[tc][freezer][watcher][release][requirement][oslo] projects need to refresh the DPL model for the next cycle
by Ghanshyam Mann 21 Jan '25

21 Jan '25

Hi All, As you know, we have five projects (listed below) in the DPL model. As per process[1], we need to reset the DPL model every cycle. The project team either needs to opt-in to the DPL model (refer to the document for exact steps[1]) or plan for the PTL election. 1. Freezer: https://review.opendev.org/c/openstack/governance/+/939484 2. Watcher: https://review.opendev.org/c/openstack/governance/+/939488 3. Release: https://review.opendev.org/c/openstack/governance/+/939486 4. Requirement: https://review.opendev.org/c/openstack/governance/+/939487 5. Oslo: https://review.opendev.org/c/openstack/governance/+/939485 [1] https://governance.openstack.org/tc/reference/distributed-project-leadershi… -gmann

1 1

[nova] Seeking Advice on Adding Multiple CPU Models in One Aggregate for OpenStack
by mina.mohammadi367＠gmail.com 21 Jan '25

21 Jan '25

Hello friends, I am currently working on a deployment scenario in OpenStack where I need to group multiple CPU models within a single aggregate. I’m reaching out to the community to ask if anyone has experience with this type of setup or has any advice on best practices. I would greatly appreciate any input from the community regarding potential challenges or recommendations for managing multiple CPU models within a single aggregate. In particular, any advice on ensuring compatibility and optimizing instance scheduling based on traits would be extremely valuable. For reference, I am considering the solution outlined in the CPU Model Selection documentation: https://specs.openstack.org/openstack/nova-specs/specs/train/implemented/cp… Thank you in advance for your time and assistance.

1 0

Assistance with Configuring fdb_age_threshold in OVN with Kolla-Ansible
by Jan Wasilewski 21 Jan '25

21 Jan '25

Hi Stackers, Over the past few days, we encountered an issue during the migration of VMs from a customer environment to our OpenStack cloud. Both environments were connected via a cross-connect network (a VLAN-type network spanning the cloud and the customer environment), which resulted in duplicate MAC addresses in our OVN database. This occurred because the migrated VM retained the same MAC address as previously used in the customer's environment(so "ovn-sbctl list fdb" returned a port which was no-longer used and leads to such duplication) . To address the issue, we used the following command to clear the FDB database: ovn-sbctl --all destroy fdb While researching further, we came across the `fdb_age_threshold` configuration [1], which seemed to be a useful feature to prevent similar issues in the future. We attempted to implement it in our Kolla-Ansible environment by adding the following configuration to ` */etc/kolla/config/neutron/ml2_conf.ini*`: [ovn] fdb_age_threshold = 920 After deploying the changes, however, we noticed that the setting did not take effect in OVN. The configuration only applied successfully after we executed a manual script to propagate the setting directly to OVN [2]. Anyway such change is applicable only for exsisting networks, so it is far from perfect solution. Could you provide guidance on whether this behavior is due to incorrect documentation, an error in our configuration process, or an additional requirement needed to enable this feature? Any insights would be greatly appreciated. Thank you in advance for your support! /Jan Wasilewski **References:** [1] https://docs.openstack.org/neutron/latest/configuration/ml2-conf.html#ovn.f… [2] https://paste.openstack.org/show/b9xUcnG6GXmCdSbSReG0/

2 2

[openstack-ansible] issue
by Danish Khan 21 Jan '25

21 Jan '25

Dear All, Whenever I do any activity like Operating system upgrade of compute nodes or openstack major version update then the name of compute host gets updated. I have my compute node with name compute1,2,3.... but after the activity they sometimes become compute1.openstack.local or compute2.mgmt.local. Due to this I get duplicate resource providers. But only the latest provider works properly. and I had manually unset all the vm from old provider and added then into new provider. Is there a way I can avoid this? means I don't want my compute nodes to get renamed with domain. And is there a way I can unset a vm from all provider and heal them automatically instead adding them into new resource proivder? I tried below docs but the healing part is not working so I go with manual process for all vm which is too time consuming. https://docs.openstack.org/nova/yoga/admin/troubleshooting/orphaned-allocat… Regards, Danish Khan

3 2

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2025.1/R-10)
by Goutham Pacha Ravi 20 Jan '25

20 Jan '25

Hello Stackers, We're 10 weeks away from the 2025.1 coordinated "Epoxy" release [1]. Starting this week, there are several deadlines that project teams have adopted to ensure that code, specifications, and documentation changes are adequately peer-reviewed. As Slawek Kaplonski (slaweq) shared to this mailing list [2], the nomination period for the upcoming Technical Committee and Project Team Leads elections will begin on 2025-02-05 and remain open until 2025-02-19. Early nominations are highly encouraged in case you'll be unavailable during this period. In the last week, the OpenStack Technical Committee selected a community goal to migrate away from the eventlet library across its codebase [3]. As with many community goals, this will be a multi-release goal and needs contributors. Please join the #openstack-eventlet-removal IRC channel on OFTC to participate in the discussion. === Weekly Meeting === Dmitriy Rabotyagov (noonedeadpunk) chaired the TC's weekly IRC meeting on 2025-01-14 [4]. We discussed the maintenance of the "openstackdocstheme" Sphinx plugin and called out some early attempts to switch documentation to a stock theme that's more maintainable and sustainable. We also reviewed a proposal from Freezer project maintainers to remove the project team from the "inactive" teams list [5]. The TC also considered requesting an exception for Freezer to release within 2025.1. In this vein, we also highlighted the need for consistent criteria to move projects out of inactive status and better tooling for indicating project health and activity. The next meeting of the OpenStack Technical Committee is today, 2025-01-21. This meeting will be hosted via IRC on OFTC's #openstack-tc channel. Please find the meeting agenda on the wiki [6]. I hope you'll be able to join us there. === Governance Proposals === ==== Merged ==== - Propose to select the eventlet-removal community goal | https://review.opendev.org/c/openstack/governance/+/934936 - Rework the eventlet-removal goal proposal | https://review.opendev.org/c/openstack/governance/+/931254 - Add ansible-role-httpd repo to OSA-owned projects | https://review.opendev.org/c/openstack/governance/+/935694 ==== Open for Review ==== - Resolve to adhere to non-biased language | https://review.opendev.org/c/openstack/governance/+/934907 - Retire Freezer DR | https://review.opendev.org/c/openstack/governance/+/938183 - Retire qdrouterd role | https://review.opendev.org/c/openstack/governance/+/938193 - Remove Freezer from inactive state | https://review.opendev.org/c/openstack/governance/+/938938 - Reset the DPL model for oslo project | https://review.opendev.org/c/openstack/governance/+/939485 - Reset the DPL model for Release project | https://review.opendev.org/c/openstack/governance/+/939486 - Reset the DPL model for Requirement project | https://review.opendev.org/c/openstack/governance/+/939487 - Reset the DPL model for Watcher project | https://review.opendev.org/c/openstack/governance/+/939488 - Define 2025 upstream investment opportunities | https://review.opendev.org/c/openstack/governance/+/939507 === Upcoming Events === - 2025-01-28: OpenInfra Board Monthly Meeting: https://board.openinfra.org/ - 2025-02-01: FOSDEM 2025 (https://fosdem.org/2025/) OpenStack's 15th Birthday Celebration - 2025-02-05: Nominations open for 2025.2 TC/PTL Elections: https://governance.openstack.org/election/ - 2025-02-28: 2025.1 ("Epoxy") Feature Freeze and release milestone 3 [1] - 2025-03-06: SCALE 2025 + OpenInfra Days NA (https://www.socallinuxexpo.org/scale/22x) Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2025.1 "Epoxy" Release Schedule: https://releases.openstack.org/epoxy/schedule.html [2] TC/PTL Election dates for the 2025.2 cycle: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [3] Goal to Remove Eventlet from OpenStack: https://governance.openstack.org/tc/goals/selected/remove-eventlet.html [4] TC Meeting IRC Log 2025-01-14: https://meetings.opendev.org/meetings/tc/2025/tc.2025-01-14-18.00.log.html [5] Remove Freezer from inactive state: https://review.opendev.org/c/openstack/governance/+/938938 [6] TC Meeting Agenda, 2025-01-21: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[Horizon] Need Help - Error with Compress
by info＠patrick-omland.de 20 Jan '25

20 Jan '25

I need help with Horizon; when I run the following command ./manage.py compress, I get the following error: (venv) root@fsn1-controller01 /var/lib/horizon # ./manage.py compress /var/lib/horizon/venv/lib/python3.11/site-packages/debreach/__init__.py:6: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead. version_info = version.StrictVersion(__version__).version CommandError: An error occurred during rendering _stylesheets.html: Error: File to import not found or unreadable: /horizon/lib/font_awesome/scss/font-awesome.scss. on line 12:1 of dashboard/scss/horizon.scss from line 6:9 of stdin >> @import "/horizon/lib/font_awesome/scss/font-awesome.scss"; ^ (venv) root@fsn1-controller01 /var/lib/horizon # ll total 124 -rw-r--r-- 1 root root 77 Jan 20 19:13 babel-django.cfg -rw-r--r-- 1 root root 258 Jan 20 19:13 babel-djangojs.cfg -rw-r--r-- 1 root root 233 Jan 20 19:13 bindep.txt -rw-r--r-- 1 root root 600 Jan 20 19:13 CONTRIBUTING.rst drwxr-xr-x 3 root root 4096 Jan 20 19:13 doc -rw-r--r-- 1 root root 579 Jan 20 19:13 HACKING.rst drwxr-xr-x 19 root root 4096 Jan 20 19:15 horizon -rw-r--r-- 1 root root 10143 Jan 20 19:13 LICENSE -rwxr-xr-x 1 root root 831 Jan 20 19:13 manage.py -rw-r--r-- 1 root root 634 Jan 20 19:13 MANIFEST.in drwxr-xr-x 6 root root 4096 Jan 20 19:15 openstack_auth drwxr-xr-x 18 root root 4096 Jan 20 19:15 openstack_dashboard -rw-r--r-- 1 root root 1023 Jan 20 19:13 package.json drwxr-xr-x 8 root root 4096 Jan 20 19:13 playbooks -rw-r--r-- 1 root root 2188 Jan 20 19:13 plugin-registry.csv -rw-r--r-- 1 root root 1920 Jan 20 19:13 README.rst drwxr-xr-x 4 root root 4096 Jan 20 19:13 releasenotes -rw-r--r-- 1 root root 120 Jan 20 19:13 reno.yaml -rw-r--r-- 1 root root 2664 Jan 20 19:13 requirements.txt drwxr-xr-x 5 root root 4096 Jan 20 19:13 roles -rw-r--r-- 1 root root 1937 Jan 20 19:13 setup.cfg -rw-r--r-- 1 root root 698 Jan 20 19:13 setup.py drwxr-xr-x 9 root root 4096 Jan 20 19:15 static -rw-r--r-- 1 root root 379 Jan 20 19:13 test-requirements.txt -rw-r--r-- 1 root root 3198 Jan 20 19:13 test-shim.js drwxr-xr-x 2 root root 4096 Jan 20 19:13 tools -rw-r--r-- 1 root root 7537 Jan 20 19:13 tox.ini drwxr-xr-x 6 root root 4096 Jan 20 19:13 venv (venv) root@fsn1-controller01 /var/lib/horizon # I have installed Horizon in a virtual Python 3 environment (Debian Bookworm) and I also clone the Horizon Github Repo, then I installed all requirements using pip install -r requirements.txt. Anyone have an idea?

1 0

[Horizon] Need Help - Error with Compress
by info＠patrick-omland.de 20 Jan '25

20 Jan '25

I need help with Horizon; when I run the following command ./manage.py compress, I get the following error: (venv) root@fsn1-controller01 /var/lib/horizon # ./manage.py compress /var/lib/horizon/venv/lib/python3.11/site-packages/debreach/__init__.py:6: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead. version_info = version.StrictVersion(__version__).version CommandError: An error occurred during rendering _stylesheets.html: Error: File to import not found or unreadable: /horizon/lib/font_awesome/scss/font-awesome.scss. on line 12:1 of dashboard/scss/horizon.scss from line 6:9 of stdin >> @import "/horizon/lib/font_awesome/scss/font-awesome.scss"; ^ (venv) root@fsn1-controller01 /var/lib/horizon # ll total 124 -rw-r--r-- 1 root root 77 Jan 20 19:13 babel-django.cfg -rw-r--r-- 1 root root 258 Jan 20 19:13 babel-djangojs.cfg -rw-r--r-- 1 root root 233 Jan 20 19:13 bindep.txt -rw-r--r-- 1 root root 600 Jan 20 19:13 CONTRIBUTING.rst drwxr-xr-x 3 root root 4096 Jan 20 19:13 doc -rw-r--r-- 1 root root 579 Jan 20 19:13 HACKING.rst drwxr-xr-x 19 root root 4096 Jan 20 19:15 horizon -rw-r--r-- 1 root root 10143 Jan 20 19:13 LICENSE -rwxr-xr-x 1 root root 831 Jan 20 19:13 manage.py -rw-r--r-- 1 root root 634 Jan 20 19:13 MANIFEST.in drwxr-xr-x 6 root root 4096 Jan 20 19:15 openstack_auth drwxr-xr-x 18 root root 4096 Jan 20 19:15 openstack_dashboard -rw-r--r-- 1 root root 1023 Jan 20 19:13 package.json drwxr-xr-x 8 root root 4096 Jan 20 19:13 playbooks -rw-r--r-- 1 root root 2188 Jan 20 19:13 plugin-registry.csv -rw-r--r-- 1 root root 1920 Jan 20 19:13 README.rst drwxr-xr-x 4 root root 4096 Jan 20 19:13 releasenotes -rw-r--r-- 1 root root 120 Jan 20 19:13 reno.yaml -rw-r--r-- 1 root root 2664 Jan 20 19:13 requirements.txt drwxr-xr-x 5 root root 4096 Jan 20 19:13 roles -rw-r--r-- 1 root root 1937 Jan 20 19:13 setup.cfg -rw-r--r-- 1 root root 698 Jan 20 19:13 setup.py drwxr-xr-x 9 root root 4096 Jan 20 19:15 static -rw-r--r-- 1 root root 379 Jan 20 19:13 test-requirements.txt -rw-r--r-- 1 root root 3198 Jan 20 19:13 test-shim.js drwxr-xr-x 2 root root 4096 Jan 20 19:13 tools -rw-r--r-- 1 root root 7537 Jan 20 19:13 tox.ini drwxr-xr-x 6 root root 4096 Jan 20 19:13 venv (venv) root@fsn1-controller01 /var/lib/horizon # I have installed Horizon in a virtual Python 3 environment (Debian Bookworm) and I also clone the Horizon Github Repo, then I installed all requirements using pip install -r requirements.txt. Anyone have an idea?

1 0

How to know the openstack client's default microversion?
by berndbausch＠gmail.com 20 Jan '25

20 Jan '25

Without the version option e.g. --os-compute-api-version, the openstack client submits API requests with certain default microversions. The precise microversions vary with the openstack client's version and the specific task. For example, the --debug option reveals that openstack client 7.1.3 uses Nova microversion 2.89 when attaching a volume to an instance. Is there a simpler way than --debug to find out which microversions the client uses? Is there a command, or perhaps a website where this is documented? Thanks for your ideas! Bernd.

2 1

[openstack-ansible] : libvirtd debug logs after Wallaby upgrade
by Rambo Rambo 20 Jan '25

20 Jan '25

Hi Team I have recently done Victoria to Wallaby upgrade on my openstack-ansible installation. After the upgrade we observe that /var/log/libvirt/ size on all the computes was growing due to libvirtd.log file. Further checking this file it can be seen that there are debug logs. 2025-01-19 11:15:20.817+0000: 2943565: *debug *: virNetlinkEventCallback:862 : dispatching to max 0 clients, called from event watch 7 2025-01-19 11:15:20.817+0000: 2943565:* debug* : virNetlinkEventCallback:876 : event not handled. 2025-01-19 11:15:20.821+0000: 2943605: *debug :* udevHandleOneDevice:1492 : udev action: 'add' ... libvirtd configuration file on compute shows log_level=1 cat libvirtd.conf # Ansible managed # enabling debug mode according to http://wiki.libvirt.org/page/DebugLogs log_level = 1 log_filters="3:remote 4:event 3:json 3:rpc" log_outputs="1:file:/var/log/libvirt/libvirtd.log" listen_tls = 0 listen_tcp = 0 unix_sock_group = "libvirt" unix_sock_ro_perms = "0777" unix_sock_rw_perms = "0770" auth_unix_ro = "none" auth_unix_rw = "none" auth_tcp = "sasl" No related parameter was changed/updated in user_variable file during the upgrade? Any information what could have enabled the debug logs for libvirtd on all the computes? Also how can I turn-off this using the openstack-ansible and what could be impact during the procedure? Regards

2 3

Openstack Ansible
by engineer2024 20 Jan '25

20 Jan '25

It seems that the ssh to containers from the deploy node, is removed in the caracal release by default in OSA. The new containers don't have the ssh service inside them. Is there a way to enable it via a variable ?

2 2

[neutron] Bug deputy week 3 2025 (2025-01-13 - 2025-01-19)
by Lajos Katona 20 Jan '25

20 Jan '25

Hi Neutrinos, The bug list for week 3 of 2025. * Critical ** https://bugs.launchpad.net/neutron/+bug/2094970 (rally ovn job timing out with eventlet 0.38.2) *** https://review.opendev.org/c/openstack/neutron/+/939315 Merged * High ** https://bugs.launchpad.net/neutron/+bug/2094736 ([OVN] Missing ``LogicalSwitchPortUpdateUpEvent`` when a port is bound) *** WIP: https://review.opendev.org/c/openstack/neutron/+/939345 ** https://bugs.launchpad.net/neutron/+bug/2094810 (neutron-status upgrade check fails on checking if ovn_alembic_version table exists) *** https://review.opendev.org/c/openstack/neutron/+/939248 ** https://bugs.launchpad.net/neutron/+bug/2094842 ("ovs.db.error.Error: ovsdb error: 0 values when type requires between 1 and 9223372036854775807" when router is attached to network without subnet ) *** Unassigned ** https://bugs.launchpad.net/neutron/+bug/2095000 (ovs-agent: Failed to store metadata for trunk ...: Cannot find Bridge with name=tbr-... ) Assigned ** https://bugs.launchpad.net/neutron/+bug/2095044 (test_ip_lib calls to sudo and fails (sometimes?)) *** https://review.opendev.org/c/openstack/neutron/+/939435 Merged ** https://bugs.launchpad.net/neutron/+bug/2095167 (BW limit not applied to external/provider network) *** https://review.opendev.org/c/x/whitebox-neutron-tempest-plugin/+/939539 ** https://bugs.launchpad.net/neutron/+bug/2095180 (test_agent_metadata_port_dhcp_reenable_event fails when ovsdb-server combines create and later update into a single create event for monitor) *** https://review.opendev.org/c/openstack/neutron/+/939542 ** https://bugs.launchpad.net/neutron/+bug/2095195 ( VM fails to receive IPv4 from DHCP agent because the agent has not updated the network config for dnsmasq after port was created) ** https://bugs.launchpad.net/neutron/+bug/2095196 (functional: test_virtual_port_host_update failed due to ovsdb SB transaction timeout, "Unreasonably long 25512ms poll interval (0ms user, 26ms system)" in ovsdb-server log) *** https://review.opendev.org/c/openstack/neutron/+/939558 ** https://bugs.launchpad.net/neutron/+bug/2095224 (Functional jobs randomly timed out, possible load issues on the host ) *** perhaps duplicate of bug/2095196 ( https://bugs.launchpad.net/neutron/+bug/209519) * Medium ** https://bugs.launchpad.net/neutron/+bug/2094846 (neutron.tests.functional.services.trunk.drivers.ovn.test_trunk_driver.TestOVNTrunkDriver.test_subport_delete fails because remove_subports fails to update OVN db due to revision number inconsistency) *** Unassigned ** https://bugs.launchpad.net/neutron/+bug/2095084 ([OVN] Error in ``_delete_router_remove_external_gateways``: "'NoneType' object has no attribute 'network_id'") *** https://review.opendev.org/c/openstack/neutron/+/939451 ** https://bugs.launchpad.net/neutron/+bug/2095097 (500 error creating resource with emoji for name) Unassigned ** https://bugs.launchpad.net/neutron/+bug/2095152 (ovs-agent: Leftover tpi/spi interfaces after VM boot/delete with trunk port(s)) Unassigned ** https://bugs.launchpad.net/neutron/+bug/2095185 test_legacy_router_conntrack_helper failed as "neutron_lib.exceptions.BridgeDoesNotExist: Bridge test-bre0e2da16 does not exist" when router attempted to plug interface *** Unassigned, Was seen on stable, but can happen on master * Low ** https://bugs.launchpad.net/neutron/+bug/2095091 (test_metadata_ipv6_only_network failed looking for QUERY_MSG) Unassigned Lajos Katona (lajoskatona)

1 0

[glance][ops] proposal to remove the glance-scrubber
by Brian Rosmaita 19 Jan '25

19 Jan '25

Hello Glance users, The Glance project team wants to determine whether anyone is using the glance-scrubber utility [0]. If not, we are thinking of deprecating it this cycle to be removed in the appropriate future cycle. If you have not previously heard of the glance-scrubber, that's most likely because it's only useful for particular deployment configurations of which yours is not one. See the doc [0] for details if you are curious. Our suspicion is that the glance-scrubber may have outlived its usefulness for modern OpenStack configurations. (The last time I remember it being discussed at a PTG was during the snowstorm in Dublin, which I believe was the Rocky development cycle). On the other hand, the team also has some ideas for improving the scrubber, but there's no point doing that if it's not actually being used in the first place. So if removal of the glance-scrubber would negatively affect you, please respond to this email so we can get some data points. Thanks! [0] https://docs.openstack.org/glance/latest/cli/glancescrubber.html

2 2

[i18n][infra][horizon] Zanata translation job failures after Python 3.8 deprecation
by Ian Y. Choi 19 Jan '25

19 Jan '25

Hi all, During last week's PTG, the I18n SIG identified Zanata translation job failures for Horizon (and likely related plugins). The root cause appears to be Python 3.8 deprecation on Horizon [1]. Failed jobs have been observed on Zuul [2], and translation proposals were made on Gerrit [3]. Since translation sync on Horizon stable branches is functioning correctly, the error message seems to be related to Python 3.8 deprecation: ERROR: Cannot install -r doc/requirements.txt (line 3) due to conflicting package version dependencies. To address this, I'd like to raise two points: 1/ To resolve the issue, would you support updating translation sync jobs with Bionic-based Zuul jobs by either upgrading to Jammy or modifying the Bionic image to support Python >3.8? 2/ At least me from I18n SIG acknowledges that recognizing these translation job errors was delayed. Moving forward, would it be beneficial to implement periodic (e.g., monthly) reporting on translation job successes and failures? Thank you, /Ian [1] https://docs.openstack.org/releasenotes/horizon/2024.2.html#upgrade-notes [2] https://zuul.opendev.org/t/openstack/builds?job_name=propose-translation-up… [3] https://review.opendev.org/q/owner:proposal-bot+project:openstack/horizon+b…

2 2

[magnum] GPU support with magnum
by Satish Patel 18 Jan '25

18 Jan '25

Folks, We are running magnum with openstack to spin up k8s clusters and everything works as expected. Now I want GPU support so we can do some AI/ML stuff with k8s. Does magnum support GPU and how does it work? In the past I used GPU in passthrough mode to expose hardware to VMs but not sure how it works for k8s and what are the challenges?

5 16

[neutron][upgrades] Linuxbridge driver removal and migration
by Brian Haley 17 Jan '25

17 Jan '25

Hi Stackers, In 2022, during the Zed cycle, the Neutron team took a step at marking some items as experimental. One of those was the Linuxbridge driver. The reason was due to it being unmaintained for a number of cycles, and no one was able to take on its ownership. The implication of this decision was that it was consider deprecated, even if not given an official warning message. In doing this, all gate jobs were moved into the experimental queue, feature-parity with other drivers was deemed unnecessary, and bug fixing was considered best-effort. Since then, both major distros have stopped supporting new deployments using Linuxbridge, and have been mainly focused on OVN. So what does this mean? We (the neutron cores) have come to the conclusion that it is time to take the next step and remove the code from the tree [1]. After 5 cycles of being considered experimental without any investment it just makes sense. We plan on doing this in the current Epoxy cycle. We realize that there are still deployments using Linuxbridge, and hopefully they have been looking at migration strategies since we originally marked the code experimental. This email is another push to the user community to start looking at this, especially if you are planning any new deployments. There has been at least one migration guide written at [2] (thanks Jim!), and at this point I would encourage those still using Linuxbridge to look at it and start asking any questions they have so we have the chance to make it better and can make that process easier. Thanks for reading, -Brian, Neutron PTL [0] https://review.opendev.org/c/openstack/neutron/+/845181 [1] https://review.opendev.org/c/openstack/neutron/+/927216 [2] https://www.jimmdenton.com/migrating-lxb-to-ovn/

11 14

openstack ssl
by engineer2024 17 Jan '25

17 Jan '25

The present model for openstack API services uses keystone for authentication mechanism for the REST API. is it possible to test the api calls directly using the server/port of a API service, bypassing the keystone URI ? does this require any modification in the configuration of the openstack service ? Thanks

1 0

[neutron] Using address scopes in a DVR environment breaks floating IPs
by Lukas Steiner 17 Jan '25

17 Jan '25

Hi all, I hope to get some advice here if we’re doing something wrong or ran into a bug. We have an OpenStack environment (wallaby) with Distributed Virtual Router (DVR) enabled (compute nodes use DVR_NO_EXTERNAL agent mode, network nodes use DVR_SNAT) and we would like to onboard our provider network to a subnet pool part of an address scope to allow routed self-service networks. But as soon as the provider network is part of an address scope, the floating IP feature stops working. After debugging we found that adding the network to an address scope results in an additional set of firewall rules in the router and snat network namespaces which blocks cross-scope traffic. But floating IPs should be the exception to that and there are indeed rules that explicitly allow them by setting a mark in the iptables mangle table: -A neutron-l3-agent-floatingip -d <floating-ip>/32 -i qg-<random-id> -j MARK --set-xmark 0x4000000/0xffff0000 We can find these rules in the qrouter namespaces, but they’re missing in the snat namespaces. If we add the rule manually to the snat namespace, the floating IP is working again. If we switch the compute nodes to DVR agent mode, it also works, as the snat namespace is not used. I have already searched for bugs and changes in the DVR router code since wallaby but can’t find anything which is not already patched in wallaby. So, I’m wondering if we have an unsupported setup with combining dynamic routing with DVR and centralized network nodes or facing a long running neutron bug. Maybe someone has a similar setup or can confirm that this use case should be supported? Regards, Lukas

1 0

Re: Dalmatian Devstack: Empty Port Binding section in Horizon
by Lajos Katona 17 Jan '25

17 Jan '25

Hi, I checked and I hoped that this SDK patch : https://review.opendev.org/c/openstack/openstacksdk/+/915902 or SDK 4.2.0 is enough (for binding details at least) but something else is missing. Could you please open a bug report for this issue, I try to check where to fix it. Lajos Katona (lajoskatona) <berndbausch(a)gmail.com> ezt írta (időpont: 2025. jan. 14., K, 13:25): > Thanks much, Lajos! > > > > It was installed by Devstack with git_clone https://opendev.org/openstack/horizon.git > /opt/stack/horizon stable/2024.2. Furthermore, under /opt/stack/horizon/ > horizon.egg-info I find a file named pbr.json, which contains > > > > {"git_version": "4bcc3dcea", "is_release": false} > > > > I hope that makes it clear what I am using! Or is there another way of > obtaining the Horizon release number? > > > > Of the list of patches you shared, the ones that seem relevant (SDK for > neutron ports, SDK for neutron networks) were merged in August and June, > respectively, which makes me think that should be included in my release. > > > > And since this is an HTML message now, I am adding two screenshots. Not > only port binding info, but also network provider info is missing. I can > confirm that this is the admin user. > > > > Kind regards, > > > > Bernd > > > > > > *From:* Lajos Katona <katonalala(a)gmail.com> > *Sent:* Tuesday, January 14, 2025 5:22 PM > *To:* berndbausch(a)gmail.com > *Cc:* openstack-discuss <openstack-discuss(a)lists.openstack.org> > *Subject:* Re: Dalmatian Devstack: Empty Port Binding section in Horizon > > > > Hi Bernd, > > Shall I ask which version of Horizon do you use? Recently some patches > were merged for changing to SDK in the background: > > > https://review.opendev.org/q/project:openstack/horizon+topic:%22bug/1999774… > > And to be sure if you hit an issue from that change series or something > else. > > > > Best wishes > > Lajos Katona (lajoskatona) > > > > <berndbausch(a)gmail.com> ezt írta (időpont: 2025. jan. 14., K, 4:43): > > Is there a known bug, either in Devstack or Horizon, that prevents Neutron > port binding details from being displayed? My googling did not find > anything. > > As admin, I open a port's details, and in the Binding section at the end of > the page, all I get is a bold text "VNIC Type". The CLI command "openstack > port show" does provide the details. Also on a Xena Devstack, Horizon > displays them[1]. Horizon's setup.py seems to be identical on both > releases, > as far as Neutron configuration is concerned. > > Thanks for any input. > > Bernd. > > [1] The Binding details I expect: > > Binding > > VNIC Type Normal > Host xena-202 > Profile None > VIF Type ovs > VIF Details > connectivity l2 > port_filter True > ovs_hybrid_plug False > datapath_type system > bridge_name br-int > >

2 1

[qa] QA office hours new time
by Ghanshyam Mann 16 Jan '25

16 Jan '25

Hi All, As informed by Martin[1], we are changing the QA office hours to Wed biweekly at 18.00 UTC. I have updated the meeting info[2] and wiki page[3]. This time might not suit many of you, so feel free to ping me on IRC if any topic/review needs urgent attention. [1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [2] https://review.opendev.org/c/opendev/irc-meetings/+/939480 [3] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee -gmann

1 0