February 2025 - openstack-discuss

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2025.1/R-5)
by Goutham Pacha Ravi 24 Feb '25

24 Feb '25

Hello Stackers, We're a couple of days away from milestone-3 of the 2025.2 ("Epoxy") release cycle [1]. For OpenStack project teams with deliverables following the "cycle-with-rc" release model [2], 2025-02-27 marks a Feature Freeze [2]. Client software releases are also due on this date, and from next week, we'll be actively squashing bugs to tag and ship release candidates. Last week, we concluded the nomination period for project leaders for 40+ OpenStack project teams and for 5 seats on the Technical Committee. We have just enough or fewer nominees than there are positions. Since no polls are needed, Ian Y Choi (ianychoi) and Slawek Kaplonski (slaweq), our election officials, are working with the TC to conclude the process. The TC will also work with project teams to appoint leaders for projects where there were no PTL nominees during the nomination window. More details about this will be shared on this mailing list as soon as they are available. Also, in the past week, the TC made some governance changes regarding the Ironic project. Several project contributors stepped up to be liaisons and adopt the Distributed Project Leadership model for the upcoming release [3]. The team also deprecated ironic-lib [4], as its relevant code has moved into the Ironic service and Ironic Python Agent. === Weekly Meeting === The TC met on OFTC's #openstack-tc channel on 2025-02-18 [5]. Ghanshyam Mann (gmann) and Artem Goncharov (gtema) noted their collaboration with the OSLO project team to expand the core team of the openstackdocstheme and os-api-ref repositories. This expansion is expected to support work to create OpenAPI specifications for OpenStack API services. We discussed the kinds of contributions that qualify individuals as Active Contributors, making them eligible to vote or contest in OpenStack elections. This follows our recent inclusion of governance repositories in the list of repositories counted for contributions. We encouraged project teams to actively nominate additional contributors—those who support their teams through invaluable work such as code review, bug grooming, documentation, mentoring, managing trackers, events, and communication. This can be done by adding "extra-acs" to https://opendev.org/openstack/governance/src/branch/master/reference/projec… before the Extra-AC freeze. The freeze has passed for the 2025.1 release cycle; however, you can propose Extra-ACs for the upcoming cycle now. Besides being eligible as candidates and voters, Extra-ACs will also appear on the release contributor list. We also brought up patches proposing to tag "end-of-life" for "unmaintained" branches: Wallaby [6], Xena [7], and Yoga [8]. These patches will remain open for 30 days, allowing contributors who wish to maintain these branches to step up. If no objections arise, these patches will be merged, and the branches will be deleted. Finally, we analyzed recent CI usage statistics and found that some projects, such as openstack/tacker, had significantly high node usage (averaging 119 nodes per patch in the check queue), consuming approximately 25% of the total aggregate quota. We will summarize our findings in a separate post to this list. The next IRC meeting of the OpenStack TC will be held today, 2025-02-25, at 1800 UTC in the #openstack-tc channel on OFTC. Please find the agenda in the meeting wiki [9]. I hope you'll be able to join us. === Governance Proposals === ==== Merged ==== - Switch Ironic to Distributed Leadership | https://review.opendev.org/c/openstack/governance/+/941935 - Cleanup policy popup leads list | https://review.opendev.org/c/openstack/governance/+/941148 - Deprecate ironic-lib | https://review.opendev.org/c/openstack/governance/+/939278 ==== Open for Review ==== - Add TC/PTL results from 2025.2 election | https://review.opendev.org/c/openstack/governance/+/942507 - Add Extra-ACs to the tech committee repos | https://review.opendev.org/c/openstack/governance/+/942296 - Resolve to adhere to non-biased language | https://review.opendev.org/c/openstack/governance/+/934907 === Upcoming Events === - 2025-02-28: 2025.1 ("Epoxy") Feature Freeze and release milestone 3 [1] - 2025-03-06: SCALE 2025 + OpenInfra Days NA (https://www.socallinuxexpo.org/scale/22x) - 2025-03-11: OpenInfra Board Meeting: https://board.openinfra.org/ - 2025-04-07: OpenInfra PTG Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] "cycle-with-rc" release model: https://releases.openstack.org/reference/release_models.html#cycle-with-rc [2] 2025.1 "Epoxy" Release Schedule: https://releases.openstack.org/epoxy/schedule.html [3] Switch Ironic to Distributed Leadership: https://review.opendev.org/c/openstack/governance/+/941935 [4] Deprecate ironic-lib: https://review.opendev.org/c/openstack/governance/+/939278 [5] TC Meeting IRC Log 2025-02-18: https://meetings.opendev.org/meetings/tc/2025/tc.2025-02-04-18.00.log.html [6] Transition unmaintained/wallaby to EOL: https://review.opendev.org/c/openstack/releases/+/941458 [7] Transition unmaintained/xena to EOL: https://review.opendev.org/c/openstack/releases/+/942201 [8] Transition unmaintained/yoga to EOL: https://review.opendev.org/c/openstack/releases/+/942218 [9] TC Meeting Agenda, 2025-02-25: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

[nova]Intel RDT CAT Support Missing from OpenStack
by Junya Noguchi (Fujitsu) 24 Feb '25

24 Feb '25

To whom it may concern I have a question regarding the lack of Intel RDT CAT implementation in OpenStack We are planning to commit Resource Monitoring functionality to Openstack for ARM, and are exploring the implementation of Intel RDT on Openstack. We found the following blueprint for the Intel RDT CAT implementation in nova. https://blueprints.launchpad.net/nova/+spec/cat-support However, the Intel RDT CAT feature is not currently implemented in OpenStack. Has the implementation of Intel RDT CAT functionality in Openstack been rejected? Or is it just a development delay? Best regards, Junya Noguchi.

5 9

Keystone Tokenless
by Ryan Belgrave 24 Feb '25

24 Feb '25

Hey All! I've been reading the documentation here https://docs.openstack.org/keystone/latest/admin/configure_tokenless_x509.h… and poking through the Keystone code to figure out how tokenless authentication works. However, It doesn't seem like tokenless auth can be used as a full replacement for usernames and passwords when using ephemeral users? I can manage to get a role assignment created that allows tokenless to work for domain and project scopes but it doesn't seem possible to set up tokenless for the system scope. Without system scope I can't list catalog services or get their endpoints. Re-reading through the documentation it says: This feature is designed to reduce the complexity of user token validation in Keystone auth_token middleware by eliminating the need for service user token for authentication and authorization. Which seems like tokenless should only be used for user token validation and nothing else. It doesn't look like this auth mechanism can be used in the same manner as others for service-to-service communication? I can't really tell if I am doing something wrong or my understanding of the documentation is correct and it should only be used for user token validation. If tokenless should only be used for user token validation are there any plans to support it normally as a full replacement of usernames and passwords? Thanks! - Ryan

1 0

some more Mistral questions.
by Alvin Starr 24 Feb '25

24 Feb '25

I am trying to create a VM with an attached volume. Does someone have a pointer to or an example of a workflow that creates a volume. -- Alvin Starr || land: (647)478-6285 Netvel Inc. || home: (905)513-7688 alvin(a)netvel.net ||

2 2

#eventle-removal - Progress & Updates Epoxy Milestones 2-3
by Herve Beraud 24 Feb '25

24 Feb '25

Today we wanted to share with you the latest updates on our ongoing efforts to phase out Eventlet across our various OpenStack projects. Below you’ll find a summary of our progress, key milestones, and important dates to keep in mind as we continue to move forward with this critical initiative. ## Current Status The lib freeze is next week and we are close from milestone 3. At the time I wrote these lines 105 eventlet removal patches have been submitted on our gerrit and 61 patches are now merged. That shows really good progress. https://review.opendev.org/q/prefixtopic:%22eventlet-removal%22 Eventlet is now in version 0.39.0 and is compatible and ready to be used with Python 3.13, meaning that we are ready for an upgrade of our runtimes within the coming series. ## Achievements Among all the contributions, we can highlight these achievements: - 2 deliverables are now completely migrated: python-manilaclient and mistral-lib; - Neutron implemented their new socket server in replacement of the eventlet WSGI features and they started to migrate their OVN agent other that new server; - Mistral has made excellent progress and significantly reduced their usages of Eventelt. From moving from coroutines to threading, or migrating their messaging executor. We will been soon able to consider mistral as fully migrated; - Glance started a wide clean up of Eventlet into their functional tests; - oslo.service's backend mechanism is now implemented and the Eventlet isolation as been merged, opening the door of its refactoring based on threading; - Almost all Oslo deliverables (apart oslo.vmware) deprecated Eventlet from their usages; - Eventlet's support of Python 3.13 has been implemented and released; - Eventlet stabilization works have been done during the past months and we now observe less negative feedback and less new bugs. No news, good news; - The community goal is now selected, officializing the starting of this initiative. ## Latest Updates There are side conversations concerning the deprecation/removal of oslo.rootwrap and oslo.vmware. Those both deliverables rely on Eventlet and are in some way considered as deprecated or experimental. In parallel to that, we think we should also have a discussion about heat and heat-templates. The activity of these projects seems quite slow and (do not hesitate to correct me if I'm wrong) they are more or less in a way to be replaced with more modern ways to orchestrate OpenStack. Should we not prioritize their deprecation or at least start a wider discussion about their fate? ## Call to Action Epoxy is a SLURP series, and as we are close from lib freeze and from milestone 3, that's the right time to prioritize your deprecations in your deliverables in view of removing these pieces with non-SLURP series. The sooner they are deprecated the better. ## Important Dates Please do not hesitate to join us during our bi-weekly meeting on #openstack-eventlet-removal. Bring your own topics and do not hesitate to ask questions. All the details are available in the links below: - https://wiki.openstack.org/wiki/Eventlet-removal#Recurring_Events - https://etherpad.opendev.org/p/epoxy-eventlet-tracking ## Final Thoughts This series strongly demonstrated the feasibility to remove our dependency to Eventlet. There is still a long way to go but the path is now well cleared. Do not hesitate to take example on the ongoing efforts, and If there are any questions or if you need assistance with your project’s transition away from Eventlet, please join the discussion on the #openstack- eventlet-removal OFTC channels . We will be happy to help you! Thank you for your dedication and hard work! -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/

5 6

[NOVA] - Instances got stuck at boot with PCI passthrough mechanism enabled
by jeanpierre.roquesalane＠dell.com 24 Feb '25

24 Feb '25

Hello all! Our new env uses Zuul and nodepool for managing vms on which will be executed devstack and tempest. Those VMS are hosted on an openstack cloud with nodepool spinning them up every time a CI job is triggered. This is something very common in OpenStack end users but can be challenging for our powermax product line as it requires HBA which are seen by the host not the guest. We have followed documentation to set it up and I confirm the HBAs are visible to the instances but unfortunately once those cards are seen the instance get stuck at the boot process just like they were waiting for something. Any advice would be highly appreciated. Thank you.

1 0

Separate the read/write SQL requests
by Mia 24 Feb '25

24 Feb '25

Hi OpenStack community, I'm currently working on read/write database splitting in my OpenStack environment using this document: https://docs.openstack.org/large-scale/journey/configure/database.html#reve… Here is what I've done up to this point: - Configured HAProxy as recommended - Added the slave_connection parameter to all service configurations(nova.conf, cinder.conf, etc.) To test this, I enabled MariaDB's general_log on all nodes. However, upon checking the logs, most SELECT queries still reach the first database node instead of the other replicas. Did I miss a configuration step somewhere? Any guidance would be super helpful.

3 3

Re: CLI clients and neutron QoS packet_rate_limit rules
by Nell Jerram 24 Feb '25

24 Feb '25

FYI the attached patches, against openstacksdk 0.62.0 and python-openstackclient 5.8.1, allow me to successfully execute `openstack network qos rule create --type packet-rate-limit --max-kpps 111 --ingress bw-limiter`. (I'm using those old base versions because of testing against a Yoga system.) If I may whinge for a brief moment: it's quite tedious that boilerplate changes are needed in multiple different places for this change. I'm only really saying this in case there are others who agree and my opinion might help to build their case... Best wishes - Nell On Mon, Feb 24, 2025 at 9:46 AM Nell Jerram <nell(a)tigera.io> wrote: > Many thanks Rodolfo. I'll experiment locally with possible fixes here, > and follow up later. > > Best wishes - Nell > > > On Sat, Feb 22, 2025 at 4:22 PM Rodolfo Alonso Hernandez < > ralonsoh(a)redhat.com> wrote: > >> Hi Nell: >> >> The neutronclient project is now deprecated, at least the CLI part. As >> you mentioned, the OSC cannot create these packet rate rules. I'll create a >> bug. >> >> Regards. >> >> On Fri, Feb 21, 2025 at 7:04 PM Nell Jerram <nell(a)tigera.io> wrote: >> >>> Is it just an oversight that the openstack client doesn't support >>> packet_rate_limit rules? [1] >>> >>> Looking at the file names under [2], it looks like that might be true >>> for the neutron client as well. >>> >>> [1] >>> https://github.com/openstack/python-openstackclient/blob/master/openstackcl… >>> >>> [2] >>> https://github.com/openstack/python-neutronclient/tree/master/neutronclient… >>> >>> Best wishes - Nell >>> >>>

2 2

[neutron] Bug deputy report from week of 17th February
by Sławek Kapłoński 24 Feb '25

24 Feb '25

Hi, I was bug deputy last week. Here's summary of what new bugs do we have and their current state: ### Critical - none ### High - none ### Medium - https://bugs.launchpad.net/neutron/+bug/2098996 - empty_string_filtering extension is not enabled for ML2/OVN - fix already proposed: https://review.opendev.org/c/openstack/neutron/+/942387 - https://bugs.launchpad.net/neutron/+bug/2099450 - Incorrect ovsdb_connection validation - fix already proposed https://review.opendev.org/c/openstack/neutron/+/942412 - https://bugs.launchpad.net/neutron/+bug/2099706 - [OVN][QoS] QoS rule addition to an exiting net work policy only updates the first port - assigned to Rodolfo, patch proposed https://review.opendev.org/c/openstack/neutron/+/942516 - https://bugs.launchpad.net/neutron/+bug/2099755 - # [whitebox-neutron-tempest-plugin] ``QosTestExternalNetwork.test_dscp_bwlimit_external_network`` must check BW with VMs on different compute nodes - assigned to Rodolfo ### Low - https://bugs.launchpad.net/neutron/+bug/2098815 - # attempting to write bad value to column external_ids (ovsdb error: expected string, got <class 'NoneType'>) - assigned to Terry and already have fix proposed, - https://bugs.launchpad.net/neutron/+bug/2099798 - error when running `osken` in os_ken CLI in python 3.13 - this is osken bug impacting osken CLI tool (I didn't even know there is something like that there :)) - needs volunteer if we want to fix it, - https://bugs.launchpad.net/neutron/+bug/2099799 - `os_ken.topology.switches` cannot be stopped when observing links - yet another os-ken bug, needs volunteer ### RFE - https://bugs.launchpad.net/neutron/+bug/2098736 - [RFE] Use quota engine to replace config option "max_allowed_address_pair" - needs owner, - https://bugs.launchpad.net/neutron/+bug/2098737 - # Create a restricted default policy for undefined API calls - this needs owner but I may most likely take ownership of it, it may also require some oslo_policy changes but I am not sure about it yet, - https://bugs.launchpad.net/neutron/+bug/2099818 - ovn-sync add -reported by and already assigned to Kevin Carter, ### To triage - https://bugs.launchpad.net/neutron/+bug/2099675 - trunk subport vnic_type not inherited from parent, DHCP for baremetal ports does not work - this one deeds to be checked by someone who knows more about trunk and baremetal ports in OVN, ### Invalid (for Neutron) - https://bugs.launchpad.net/python-openstackclient/+bug/2098980 - "openstack port list -c" showing non existing columns - I moved it to be OSC bug, not the neutron one, needs assignment, should be low-hanging-fruit bug to fix -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[designate] Kubernetes External-DNS webhook provider for OpenStack Designate
by Christian Rohmann 22 Feb '25

22 Feb '25

Hello openstack-discuss, the external-dns [1] controller is the de-facto standard to integrate Kubernetes with DNS services, one of them being OpenStack Designate. 1) For quite a while there is a push to move the provider specific code out of tree, see [2], [3]. With (larger) changes not being reviewed / merged for the in-tree Designate code, [4] we bit the bullet and wrote a webhook provider implementation for OpenStack Designate, [5], which I also proposed to be added to the list of new providers via [6]. If you are running Kubernetes on top of OpenStack, I kindly ask you to give this webhook a try and see if it works or if there are still some kinks to iron out. If so: Open helpful issues, send PRs! 2) I am also reaching out to see if potentially you would even want to adopt this project as OpenStack Designate. While one could argue that it's out of OpenStack Designates element to care about Kubernetes. I believe a good integration and well working interfaces are key to keep OpenStack attractive as a platform (to run Kubernetes on). And with the webhook provider being an independent piece of software, just implementing the webhook provider interface [7], the contact surface with Kubernetes is very limited to non-existing. It's mostly Gophercloud ([8]) calling the Designate-API for the DNS record management actions external-dns requires. Looking a bit more closely to this widely used controller hitting the Designate-API might give also provide good insights or ideas for improvements or in the very least facilitates adoption. Regards Christian [1] https://github.com/kubernetes-sigs/external-dns [2] https://github.com/kubernetes-sigs/external-dns/issues/4347 [3] https://github.com/kubernetes-sigs/external-dns?tab=readme-ov-file#status-o… [4] https://github.com/kubernetes-sigs/external-dns/pull/3024 [5] https://github.com/inovex/external-dns-designate-webhook [6] https://github.com/kubernetes-sigs/external-dns/pull/5115 [7] https://kubernetes-sigs.github.io/external-dns/v0.15.1/docs/tutorials/webho… [8] https://github.com/gophercloud/gophercloud

1 0