August 2025 - openstack-discuss - lists.openstack.org

[PTL][Nova][Swift][Cyborg][Keystone][Neutron][Horizon][Skyline] OpenStack for AI Whitepaper: August 14 Meeting Recording & Recap
by Kendall Nelson 15 Aug '25

15 Aug '25

Hello Everyone! Thank you again to those that were in attendance today and also those that have already been contributing to the whitepaper! We are making some solid progress. For those that weren't able to make it, in today's meeting we did another walkthrough of the working document and outline with the new subsection additions <https://docs.google.com/document/d/1NjxIyWF6aUFg0jb0HewX1JmOyploYV5Dxe3j1Lt…>. I talked a little bit about inclusion of specific images that have been added and that I am trying to keep up with comments and questions in the doc. I also reiterated our timeline (trying to have all the content largely drafted by September 1) and a reminder that providing a reference architecture is open to all OpenInfra Platinum, Gold and Silver members and that case studies can be provided by OpenInfra Platinum and Gold members for inclusion in the whitepaper. The deadline for both reference archs and case studies is September 19th. If you know you will not make the deadline please reach out to us ahead of time and we can try to make accommodations, but largely after that date we will not be able to include additions due to website building and other planning that will be the final phase before publication at the OpenInfra Summit Europe. You can watch the recording of today's meeting here <https://zoom.us/rec/share/JSacqoVVH9hmBriq9XRM69IyxCoRWnNykQj5T0GScln85SDP4…> . WRT OpenStack teams, I want to call out some of the comments and sections in the doc: We are in need of your perspective! I had added some of the PTLs directly in comments, but anyone from any project team is welcome to get involved in the whitepaper. Generally the projects I tagged in the subject line of this email are ones we would love content from, but if there are others that should be or want to be included, we can figure that out as well. As always if you have any questions, please feel free to drop them here or in the working doc <https://docs.google.com/document/d/1NjxIyWF6aUFg0jb0HewX1JmOyploYV5Dxe3j1Lt…>, or generally on the ML. As another reminder, next week will be an asych check in. I look forward to seeing more of your content in the doc by then! Thank you everyone for your effort and collaboration! -- Kendall Nelson *Senior Upstream Developer Advocate* The OpenInfra Foundation <https://openinfra.dev/>

3 2

[nova] Image Encryption patch
by Josephine Seifert 15 Aug '25

15 Aug '25

Hi nova folks, We worked on the LUKS-based image encryption and the patches Cinder and Glance are in a good state now + we also have tempest tests. Here you can see the overall state: https://review.opendev.org/q/topic:%22LUKS-image-encryption%22 There is one patch in nova, which adresses an issue with keys for the encrypted image/volume being either used directly or being hexlified beforehand. We would be really happy if you could review this nova patch: https://review.opendev.org/c/openstack/nova/+/926326 So we can hopefully finish our work on the Image encryption. greetings Josephine (Luzi)

4 6

[Neutron][VPNaaS] VPN service/router stays PENDING_CREATE - 2024.2 Dalmatian
by Shubham Yadav 15 Aug '25

15 Aug '25

Hello, On OpenStack Dalmatian, creating a second IPsec site connection on the same VPN service/router remains stuck in PENDING_CREATE indefinitely. Environment: OpenStack services in Kubernetes (OpenStack-Helm style) Neutron L3 agent with VPNaaS (strongSwan driver) L3 agent hosts the router as master, VPNaas enabled Observed: Works: First IPsec connection renders in ipsec.conf / ipsec.secrets and comes up. Fails (Dalmatian): Adding a second connection on the same VPN service/router: Status: PENDING_CREATE (no progress) No L3/VPNaas logs for the event, no strongSwan activity No config changes in /var/lib/neutron/ipsec/<router_uuid>/etc/ Control test: Switching only the L3 agent container to a Zed image in the same environment → second connection renders immediately and tunnel comes up. Repro Steps: Create router + VPN service. Create IKE/IPsec policies. Create first site connection (OK). Create second site connection (different peer, same VPN service/router). Expected: Second connection renders a new conn in ipsec.conf, appends secret, and comes up. Actual (Dalmatian): No rendering, stuck PENDING_CREATE, no processing logs. This seems like a Dalmatian regression in L3/VPNaas handling of multiple connections per VPN service. waiting for a reply Best regards, Shubham

1 0

[ironic] Future of Metalsmith
by Jay Faulkner 14 Aug '25

14 Aug '25

For almost two years, the Ironic team has had a "maintenance mode" message on the Metalsmith readme: "Please note the Metalsmith project is in maintenance mode and it's functionality is slowly being introduced into Ironic's API and usual clients. No additional features are expected to be added to Metalsmith directly." CI is currently not passing on this repository, and as far as I can tell there are no engaged users of this project upstream, and no current maintainers of Ironic invested in keeping this project afloat. I propose we retire the metalsmith project and exclude it from the Flamingo release. Are there any objections? Thanks, JayF

3 2

[nova] compute's reaction to finding unmanaged VMs
by Bence Romsics 14 Aug '25

14 Aug '25

Hi Nova Team, How does Nova relate to having unmanaged libvirt VMs alongside VMs managed by nova-compute? Is this considered supported, unsupported, or somewhere in between? I know about the warning in [1] and the compute startup time exception in [2]. Colleagues working on a major OpenStack version uplift in a downstream OpenStack distro started encountering the above exception. This distro utilizes some non-Nova-managed VMs (in particular, to orchestrate the OpenStack deployment itself). To reduce the deployment footprint, these VMs are co-located with Nova-managed VMs. AFAIU, this exception was introduced by the stable-compute-uuid blueprint [3]. With that in mind, I found this behavior: * Before the blueprint was implemented, Nova only logged a warning if it found an unmanaged VM. * After stable-compute-uuid, the compute service refuses to start in the same case. * If I make sure that the stable UUID is already present, then it seems to fall back to the earlier warning-only behavior. If I let nova-compute create the stable UUID itself, this leads to somewhat surprising behavior: * If nova-compute finds an unmanaged VM during its first startup, it refuses to start. * If it finds an unmanaged VM only during its second (or subsequent) startup (when the stable UUID has already been generated), it starts and logs a warning only. This made me think that the distro should pre-generate the compute UUID. Then I found in the stable-compute-uuid blueprint (and in the docs [4]) that this approach is clearly supported. It seems the compute service does not look at the metadata present in the libvirt domain definitions, and I started wondering why. AFAICT, the exception introduced by the stable-compute-uuid blueprint only really applies if Nova finds VMs that contain Nova metadata but are unknown to the compute service starting up. And this line of thought led me to my original question and these: * Could/should nova-compute inspect the metadata of libvirt VMs at startup and act differently if an unexpected VM has (or doesn’t have) Nova metadata? Would this be considered a meaningful Nova feature? Or should the distro just pre-generate the stable UUID and ignore the warning (as it did before the blueprint)? * Does Nova currently not look at the libvirt domain definition metadata simply because nobody has implemented this yet? Or is there another reason? * Is it considered supported (and to what level) to have non-Nova-managed VMs co-located with Nova-managed VMs? Thanks in advance, Bence Romsics (rubasov on irc) [1] https://github.com/openstack/nova/blob/54b65d5bf2b23fa8a4612fd3adddc8751192… [2] https://github.com/openstack/nova/blob/54b65d5bf2b23fa8a4612fd3adddc8751192… [3] https://specs.openstack.org/openstack/nova-specs/specs/2023.1/implemented/s… [4] https://docs.openstack.org/nova/latest/admin/compute-node-identification.ht…

4 5

Volume retype fails with Libvirt Nova - disk does not have active block job
by Karl Kloppenborg 14 Aug '25

14 Aug '25

Hi Openstackers. We’re currently migrating between storage backends and for the most part retype works correctly. However some VM’s fail the volume migration/retype quickly with the following error: Stack trace here: https://gist.github.com/inventionlabsSydney/40cd945685c798c489d729d2bcd5ec1e Has anyone else experienced this, we have tried looking around on the web and haven’t seen anything related to this. Much appreciated. Thanks, Karl. Karl Kloppenborg Chief Technology Officer m: +61 437 239 565 resetdata.com<https://resetdata.com/> [cid:reset_69557fc2-1d63-4932-b5fd-93bd4f39ca7b.png] ResetData supports Mandatory Client Related Financial Disclosures – Scope 3 Emissions Reporting For more information on the phasing of these requirements for business please visit; https://treasury.gov.au/sites/default/files/2024-01/c2024-466491-policy-sta…<https://treasury.gov.au/sites/default/files/2024-01/c2024-466491-policy-sta…> This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

[horizon][cinder] service type block-storage not activated
by Eugen Block 14 Aug '25

14 Aug '25

Hi all, during further testing of my upgraded Epoxy cloud (before upgrading our production cloud) I noticed this error message in the browser console when analyzing the response times with the dev tools: > Possibly unhandled rejection: Diensttyp ist nicht aktiviert: block-storage "Diensttyp ist nicht aktiviert" translates to "service type is not activated". But looking at the service versions, there is an entry for "block-storage": root@controller01:~# openstack versions show | grep storage Could not load 'message_list': module 'zaqarclient.queues.v2.cli' has no attribute 'OldListMessages' Could not load 'message_post': module 'zaqarclient.queues.v2.cli' has no attribute 'OldPostMessages' | RegionOne | block-storage | 3.0 | CURRENT | https://controller.domain:8776/v3/ | 3.0 | 3.71 | I remembered this thread [0] and read it again, but I'm still insecure if I need to change anything or not. Our production cloud has been created around 10 years ago, so I'm pretty sure there are many legacy things one could clean up. But could anyone please clarify if something is missing here or not? Or is it a red herring in horizon? I'd really appreciate any pointers! Thanks! Eugen [0] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack…

1 2

[nova][elections][ptl] Application for the PTL role 2026.1
by René Ribaud 13 Aug '25

13 Aug '25

Hello, I am announcing my new candidacy for the PTL role for Nova and Placement. Serving as PTL in the Flamingo cycle was both a rewarding and instructive experience. It allowed me to learn the responsibilities and workload of the role, build stronger connections across the community, and help contributors move their work forward. In the next cycle, I want to continue fostering a welcoming and collaborative environment for all contributors. I will continue and improve our efforts to enhance bug triage, reduce the number of open bugs, and support timely reviews to help features progress toward completion. I am also eager to follow and participate in the Eventlet removal effort, which began in Flamingo and represents a major step for OpenStack. This is a particularly interesting challenge—not highly visible to most users, but crucial for the long-term health, performance, and maintainability of the project. My main focus, and the most important thing to me, will remain ensuring that Nova and Placement stay robust, maintainable, and aligned with our users’ needs. Thank you for your trust so far, I’d be happy to continue serving in this role. Thanks, René

1 0

[cinder] IBM SVf driver callhome
by Vivek Pandey 13 Aug '25

13 Aug '25

Hi Joe/ Brian, Since we didn’t get a chance to discuss the patch [IBM SVf driver] Adding support for callhome plugin, we can continue the conversation here. Patch : https://review.opendev.org/c/openstack/cinder/+/951829. We need callhome enabled as default for which we have introduced a parameter “callhome” in cinder.conf. This feature is to fecth the os_version, cinder-manage version and ispbhaenabled. Note: We are not fetching any customer’s sensitive data. Please let me know if you’ve had a chance to review NetApp’s ActiveIQ implementation. Netapp’s ActiveIQ code ref : https://github.com/openstack/cinder/blob/master/cinder/volume/drivers/netap… As we have discussed during the 9th July cinder call, Anoop from NetApp confirmed that they are enabling it by default and EMS details are being captured from the logs. Based on that, do you think we can align or extend our current IBM callhome implementation (from the patch above) to follow a similar approach? Thanks, Vivek

5 7

[publiccloud-sig] Public Cloud SIG meeting d.d. 13 August
by Kees Meijs | Nefos 12 Aug '25

12 Aug '25

Hello Stackers, On Wednesday 13 August the bi-weekly Public Cloud SIG meeting will be held again. The publicly available video meeting will be conducted from 07:00 hrs UTC (09:00 hrs CEST) and on here: https://meetpad.opendev.org/publiccloud-sig Additional information to be found on https://wiki.openstack.org/wiki/PublicCloudSIG Since I'm vacationing during the meeting, I won't be joining myself. Cheers, Kees __ Kees Meijs BICT Nefos Cloud & IT <https://nefos.com/contact> Nefos IT bv Burgemeester Mollaan 34a 5582 CK Waalre - NL kvk 66494931 +31 (0)88 2088 188 <tel:+31882088188> nefos.com <https://nefos.com/contact> The information contained in this message is intended for the addressee only and may contain classified information. If you are not the addressee, please delete this message and notify the sender; you should not copy or distribute this message or disclose its contents to anyone. Any views or opinions expressed in this message are those of the individual(s) and not necessarily of the organization. No reliance may be placed on this message without written confirmation from an authorised representative of its contents. No guarantee is implied that this message or any attachment is virus free or has not been intercepted and amended. General terms and conditions ("The NLdigital Terms") apply to all our products and services.

1 1