June 2025 - openstack-discuss - lists.openstack.org

[heat][ops] Removal of standalone api services (heat-api and heat-cfn-api)
by Takashi Kajinami 01 Jul '25

01 Jul '25

Hello, Historically heat has provided two methods to deploy api services (native heat api and heat CFN api). 1. standalone script based on eventlet 2. wsgi application run by server framework like apache or uwsgi Now the heat team is trying to get rid of eventlet following the global effort to replace it, and the current blocker is 1 because we have no good alternative to re-implement the standaloe service. The global migration strategy is to remove standalone api services using eventlet and provide only wsgi application. So I'm now sending an email to ask for any input, in case if any operator has concern about our current plan below. - Backport deprecation of standalone api scripts to 2025.1 - Remove these scripts during 2025.2 This means that any operators should use 3rd party server framework like uwsgi and apache+mod_wsgi to run heat api from 2025.2 . I understand backporting deprecation is something we won't accept usually, but I've seen this pattern was done in the past for a few exceptions like Hyper-V support removal. If we hear no objections/concerns for a week then, we aim to merge the removal during this cycle. Thank you, Takashi -- Takashi Kajinami irc: tkajinam github: https://github.com/kajinamit launchpad: https://launchpad.net/~kajinamit

1 1

[dev][tc] Replacing CLA enforcement with DCO enforcement
by Jeremy Stanley 30 Jun '25

30 Jun '25

As previously discussed[*], tomorrow (2025-07-01) I'll merge a change[**] switching Gerrit to start requiring Signed-off-by in commit messages when pushing new changes or revisions to changes in OpenStack repositories (existing changes don't need to be amended in order to merge; only when revising, rebasing or backporting to other branches). Agreeing to the OpenInfra ICLA will no longer be necessary. The OpenStack Contributor Guide has already been updated to reflect this[***]. After this update merges, when attempting to push or alter a change's content you may receive an error (from git review/git push at the command line or from the Gerrit WebUI if you're trying to edit a change there) notifying you that you're missing a Signed-off-by trailer in your commit message. You can either add one with git's -s option like... git commit -s (to add when making a new commit) git commit --amend -s (when altering an existing commit) ...or by directly editing the commit message to include a line at the end with your address such as... Signed-off-by: Jeremy Stanley <fungi(a)yuggoth.org> Keep in mind that if you're pushing a series of changes, you may need to update all their commit messages, e.g. through an interactive rebase. If anyone has questions, please don't hesitate to ask! [*] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [**] https://review.opendev.org/950998 [***] https://docs.openstack.org/contributors/common/dco.html -- Jeremy Stanley

1 0

[openstack]Share about OSS which used for my Openstack
by Nguyễn Hữu Khôi 30 Jun '25

30 Jun '25

Hello, I would like to share some open-source software (OSS) that I used for my OpenStack environment. https://github.com/nguyenhuukhoi/openstack-note/blob/main/Cloud%20System%20… I hope this will be helpful for you, especially those who are getting started with OpenStack. Nguyen Huu Khoi

3 4

Re: [openstack]Share about OSS which used for my Openstack
by Nguyễn Hữu Khôi 30 Jun '25

30 Jun '25

Hello, My Openstack system is on bare metal nodes. Nguyen Huu Khoi On Mon, Jun 30, 2025 at 9:01 PM Winicius Allan <winiciusab12(a)gmail.com> wrote: > So do you have a controller baremetal that you create virtual machines on > top of it to use as controller nodes? > > Regards. > > On Mon, Jun 30, 2025, 10:40 Nguyễn Hữu Khôi <nguyenhuukhoinw(a)gmail.com> > wrote: > >> Hello, >> >> I would like to share some open-source software (OSS) that I used for my >> OpenStack environment. >> >> >> https://github.com/nguyenhuukhoi/openstack-note/blob/main/Cloud%20System%20… >> >> >> I hope this will be helpful for you, especially those who are getting >> started with OpenStack. >> Nguyen Huu Khoi >> >

1 0

[oslo][mistral][keystone] broken library gate
by Elõd Illés 30 Jun '25

30 Jun '25

Hi teams in $SUBJECT, The release team usually checks the gate health of libraries which did not have merged patches recently and it seems you have a project with broken gate: oslo.utils: https://review.opendev.org/c/openstack/oslo.utils/+/952914 python-mistralclient: https://review.opendev.org/c/openstack/python-mistralclient/+/952927 python-keystoneclient: https://review.opendev.org/c/openstack/python-keystoneclient/+/952923 Could you please check and fix the gate so that we don't release 2025.2 Flamingo with a broken state. Thanks in advance, Előd Illés irc: elodilles @ #openstack-release

3 2

[keystone][horizon] OPENSTACK_KEYSTONE_DOMAIN_DROPDOWN security impact
by Pierre Riteau 30 Jun '25

30 Jun '25

Hello, The documentation for the OPENSTACK_KEYSTONE_DOMAIN_DROPDOWN option in Horizon [1] has this warning: > It is strongly advised NOT to enable this for public clouds, as advertising enabled domains to unauthenticated customers irresponsibly exposes private information. This should only be used for private clouds where the dashboard sits behind a corporate firewall. In a context where this option enables one or multiple domains that would be publicly documented anyway, is there really any issue with using this option on a publicly-accessible Horizon deployment? Thanks, Pierre Riteau (priteau) [1] https://docs.openstack.org/horizon/latest/configuration/settings.html#opens…

1 0

"tag" API in OpenStack, case sensitive
by Rodolfo Alonso Hernandez 30 Jun '25

30 Jun '25

Hello all: I initially found this issue in Neutron [1] but it seems to be more of an OpenStack wide problem. In Neutron, when you try to create a tag with different case (upper, lower), the API fails: $ openstack port create --network private port_tags $ openstack port set --tag tag1 port_tags $ openstack port set --tag TAG1 port_tags # this command will fail with the following message: ConflictException: 409: Client Error for url: http://192.168.10.100/networking/v2.0/ports/21788aea-98b7-4606-bcf4-5f963ce…, Failed to create a duplicate Tag: for attribute(s) ['tags.PRIMARY'] with value(s) 47-TAG1 That happens because in Neutron we don't sanitize the input "tags" and we consider that "tag1" is different to "Tag1", as recommended by [2]: "Tags are case sensitive". But checking the table definitions in OpenStack (for example [3][4][5]), all projects seem to have the same problem: we define the tuple (resource, tag) as the primary key. But if we use a case insensitive table collation (for example "utf8_general_ci" or "utf8mb3_general_ci"), the comparison between "tag1" and "TAG1" will match. In the Neutron API, because we don't consider this scenario, the API raises the mentioned exception. In Nova, for example, the command succeeds but the new tag is not added. So the question here is: * Do we change the API definition to make it case insensitive? That will need, most probably, to revisit all stored tags and convert them to lower case. It will also require sanitizing the API input and making all tags lower case. * Do we enforce a charset and collation case sensitive for these specific tables? Regards. [1]https://bugs.launchpad.net/neutron/+bug/2114819 [2] https://specs.openstack.org/openstack/api-wg/guidelines/tags.html#tags-rest… [3] https://github.com/openstack/neutron/blob/39b183645e071f9c2926f0bd870723fb6… [4] https://github.com/openstack/nova/blob/64ca204c9cf497b0dcfff2d3a24b0dd795a5… [5] https://github.com/openstack/octavia/blob/2fb6ba9343e39f60f058a781afd14b906…

2 1

nova-ovs-hybrid-plug CI jobs failing for Nova
by Michael Still 30 Jun '25

30 Jun '25

Hi, over the weekend it appears that nova-ovs-hybrid-plug CI jobs have been failing for Nova, I think because of this error: "Failed to contact the endpoint at https://200.225.47.11/image for discovery. Fallback to using that endpoint as the base url." https://zuul.opendev.org/t/openstack/build/fcc678f62f584bbb9726821f5992ae90 is an example of such a failure. The CI job then executes: openstack --os-compute-api-version 2.74 server create --image --flavor --nic net-id= --host np0041269081 --wait evacuate-test Which is invalid because it doesn't have an argument to the --image flag. I am unsure who owns 200.225.47.11. Is it possible its offline? Thanks, Michael

3 3

[neutron] Bug deputy report for week 26 of 2025 (June 23th)
by Lajos Katona 30 Jun '25

30 Jun '25

Hi Neutrinos! Last week (week 26, from 23 june) I was the Neutron bug deputy, please check the report for that week. * *Unassigned*: ** https://bugs.launchpad.net/neutron/+bug/2115411 ([ovn-octavia-provider] Exception observe when there no IP available for VIP ): TL;DR: shall we throw http500 or 409 when there's no available IP. ** https://bugs.launchpad.net/neutron/+bug/2115241 (test_spawn_rate_limited_metadata_proxy unit test fails randomly ) ** High Bugs* ** https://bugs.launchpad.net/neutron/+bug/2115327 ([fullstack] Migrate the fullstack tests to other FWs ) ** Medium Bugs* ** https://bugs.launchpad.net/neutron/+bug/2115184 ([S-RBAC] Custom role can't get resources which belongs to different projects ) Owner: Slaweq ** https://bugs.launchpad.net/neutron/+bug/2115189 ( [OVN] ``sync_port_qos_policies`` and ``sync_fip_qos_policies`` only have "repair" mode), owner: Rodolfo, https://review.opendev.org/c/openstack/neutron/+/953081 ** https://bugs.launchpad.net/neutron/+bug/2115242 ([FT] Random errors in ``test_floatingip_mac_bindings``), owner: Rodolfo, https://review.opendev.org/q/Ia153b48aaec72e6a073b313ef2aea8efac6dbbae ** https://bugs.launchpad.net/neutron/+bug/2115510 ([neutron][os-ken] Bug on the BGP loop prevention), assigned: Anas Jouhdy, https://review.opendev.org/c/openstack/os-ken/+/953631 Best wishes, Lajos Katona (lajoskatona)

1 0

[skyline] Administrator Page not available for an admin user in another domain
by Joao Antonio 30 Jun '25

30 Jun '25

Hello, When I access skyline using admin@Default I'm able to access the Administrator Page. When I access skyline using taikun@taikun I'm not able to access the Administrator Page. Some idea why? openstack domain show taikun +-------------+----------------------------------+ | Field | Value | +-------------+----------------------------------+ | id | ab2384baf3cc43f7ae1fda0ce7e6ae71 | | name | taikun | | enabled | True | | description | None | | options | {} | +-------------+----------------------------------+ openstack project list --domain taikun +----------------------------------+-----------+ | ID | Name | +----------------------------------+-----------+ | 02c534188ec74a3a89ec530b6d224249 | taikun | +----------------------------------+-----------+ openstack user list --domain taikun +----------------------------------+--------+ | ID | Name | +----------------------------------+--------+ | 659c6b30bbc54f32a7e90b63d92a9d9d | taikun | +----------------------------------+--------+ openstack role add --project taikun --user taikun --project-domain taikun --user-domain taikun admin openstack role assignment list --project taikun --project-domain taikun --names --effective --user taikun --user-domain taikun +---------+---------------+-------+---------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +---------+---------------+-------+---------------+--------+--------+-----------+ | admin | taikun@taikun | | taikun@taikun | | | False | | manager | taikun@taikun | | taikun@taikun | | | False | | member | taikun@taikun | | taikun@taikun | | | False | | reader | taikun@taikun | | taikun@taikun | | | False | +---------+---------------+-------+---------------+--------+--------+-----------+ openstack role assignment list --project taikun --project-domain taikun +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | abeef1135b254247b3ed7e82d67a74ff | 659c6b30bbc54f32a7e90b63d92a9d9d | | 02c534188ec74a3a89ec530b6d224249 | | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ openstack role list +----------------------------------+-------------------------------+ | ID | Name | +----------------------------------+-------------------------------+ | 030aa5e0f28a4e229469478d4bc3a041 | heat_stack_user | | 12c79c14d89a4d9bae40f57f7334430f | load-balancer_observer | | 58f7e34845f946b99d02ad8ceafeabe5 | service | | 6ad502b80f8146fa8bf84ea46ad4f279 | load-balancer_global_observer | | 8176fa996c014ced9ac93e057712baa4 | reader | | 9a61d8d430c944b2b95a3773b472347d | member | | 9babd66862fc4df8922c88311640fee6 | load-balancer_quota_admin | | abeef1135b254247b3ed7e82d67a74ff | admin | | b06622b5167d4f5ca1c08f63f6da3be4 | load-balancer_member | | eb3cf02635894e5d8f80cfc93398520e | load-balancer_admin | | fd01d0c357b64d3da37dd482d80d14f7 | manager | +----------------------------------+-------------------------------+ openstack role assignment list --project admin --project-domain Default --names --effective --user admin --user-domain Default +---------+---------------+-------+---------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +---------+---------------+-------+---------------+--------+--------+-----------+ | admin | admin@Default | | admin@Default | | | False | | manager | admin@Default | | admin@Default | | | False | | member | admin@Default | | admin@Default | | | False | | reader | admin@Default | | admin@Default | | | False | +---------+---------------+-------+---------------+--------+--------+-----------+ openstack role assignment list --project admin --project-domain Default +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | abeef1135b254247b3ed7e82d67a74ff | 4eabf78b22254a7f99a34a02c09bd45e | | 0667c5c9c4da4584815880d94f649524 | | | False | | abeef1135b254247b3ed7e82d67a74ff | 659c6b30bbc54f32a7e90b63d92a9d9d | | 0667c5c9c4da4584815880d94f649524 | | | False | | abeef1135b254247b3ed7e82d67a74ff | 659c6b30bbc54f32a7e90b63d92a9d9d | | 0667c5c9c4da4584815880d94f649524 | | | True | | abeef1135b254247b3ed7e82d67a74ff | c2d61ab27c6a4563bb96fa549eae2ee8 | | 0667c5c9c4da4584815880d94f649524 | | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+

2 4