August 2025 - openstack-discuss - lists.openstack.org

[Kolla][Epoxy] Potentially incorrect Debian backports repo in Epoxy container builds?
by Michael Still 07 Aug '25

07 Aug '25

Hello, yesterday I was having troubles building Kolla images for Epoxy. I'm building Debian based images, and the failures were related to the osbpo extrepo not always returning results. However, I noticed this line as part of that adventure: https://github.com/openstack/kolla/blob/stable/2025.1/docker/base/Dockerfil… Specifically, Kolla for Epoxy is using the Dalmatian extrepo: "extrepo enable openstack_dalmatian" Is this somehow intentional? If not, I'll send a patch to correct it to Epoxy. Thanks, Michael

2 1

Guidance Needed: OpenStack(Kolla Ansible 2023.1) + Ceph Production Deployment with RBD Mirroring
by Thamanna Farhath 06 Aug '25

06 Aug '25

Hi all, I’m working on a production deployment using OpenStack (Kolla Ansible 2023.1) and Ceph (via Ceph Ansible). Setup Overview: One control plane with shared core services. Multiple availability zones (AZs), each as a separate Nova Cell. Each AZ has its own Ceph cluster, connected via RBD mirroring for DC/DR. Architecture diagram is attached below Looking for advice on: Best practices for this architecture. Ceph RBD mirroring impact on Glance, Cinder, Nova. Suggestions for high availability and failover strategies in this design. Appreciate any guidance or references! Thanks & regards Thamanna Farhath N Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

1 0

about the server group GET API
by Jiatong Shen 06 Aug '25

06 Aug '25

Hello experts, I have a question about the server group GET rest API. I tried out the GET API and found it was pretty slow (around 200 servers returned in 8 seconds). By skimming through the codebase I am suspecting filtering out group members is heavy ( https://github.com/openstack/nova/blob/4100d4d8fbaa6416ea37d8cb3e64003f40ee… ). So my question is do we clear out the instance_group_member table after deleting instances? If not, why could we not do it? Thank you very much for help. . -- Best Regards, Jiatong Shen

1 0

[all][elections][ptl][tc] Combined PTL/TC 2026.1 cycle Election Season
by Slawomir Kaplonski 06 Aug '25

06 Aug '25

Election details: https://governance.openstack.org/election/ The nomination period officially begins Aug 06, 2025 23:45 UTC. Please read the stipulations and timelines for candidates and electorate contained in these governance documents[1][2][3]. Due to circumstances of timing, PTL and TC elections for the coming cycle will run concurrently; deadlines for their nomination and voting activities are synchronized but will still use separate ballots. Please note, if only one candidate is nominated as PTL for a project team during the PTL nomination period, that candidate will win by acclaim, and there will be no poll. There will only be a poll if there is more than one candidate stepping forward for a project team's PTL position. Similarly, there will only be a TC poll if there are more than 4 candidates stepping forward the available TC positions. All members of the community are encouraged to confirm their email address as described at: https://governance.openstack.org/election/#electorate All candidates and prospective voters need to make sure they have reestablished their individual memberships in the OpenInfra Foundation [4], otherwise their nominations won't be verified and ballots will not be sent. There will be further announcements posted to the mailing list as action is required from the electorate or candidates. This email is for information purposes only. If you have any questions which you feel affect others please reply to this email thread. If you have any questions that you wish to discuss in private please email any of the election officials[5] so that we may address your concerns. Thank you, [1] https://governance.openstack.org/tc/reference/charter.html [2] https://governance.openstack.org/tc/reference/role-of-the-tc.html [3] https://docs.openstack.org/project-team-guide/ptl.html [4] https://lists.openinfra.org/archives/list/foundation@lists.openinfra.org/me… [5] https://governance.openstack.org/election/#election-officials -- Best regards Slawek Kaplonski skaplons(a)redhat.com

1 0

[keystone] User Impersonation feature
by Bram Kranendonk 06 Aug '25

06 Aug '25

Hi folks, I’m looking for a way to execute actions using Admin User X for Regular User Y. I came across the OS-TRUST extension with the impersonation flag, but this does not allow for an admin user to create trusts as another trustor. Are there other ways to accomplish such feature in Keystone? Thanks in advance, . Bram Kranendonk OpenStack Engineer

2 1

[openstack-helm] Nominate Doug Goldstein (cardoe) as a core reviewer
by Vladimir Kozhukalov 05 Aug '25

05 Aug '25

Hi team, I am writing to nominate Doug Goldstein (cardoe) as a member of the Openstack-helm core reviewers team. He's been actively contributing to the project during the last few release cycles and brought many valuable ideas (both technical and organizational). I also think it is important that our project has different companies represented in this important role. Please let me know what you think. -- Best regards, Kozhukalov Vladimir

5 5

[all][ops][qa] Decommissioning RefStack and retiring related software
by Jeremy Stanley 05 Aug '25

05 Aug '25

The RefStack service at refstack.openstack.org has been unused for purposes of qualifying OpenStack trademark licenses[*] since March of last year, after a 2023 board resolution[**] relaxed the former requirement for it. Effective immediately, the service is being decommissioned along with any associated resources, and the related Git repositories in OpenDev (interop, refstack, refstack-client) will be officially retired in the near future as well. Let me know if you have any questions or concerns. [*] https://openinfra.org/legal/trademark-policy [**] https://board.openinfra.org/meetings/minutes/05122023BoardMinutes -- Jeremy Stanley on behalf of the OpenInfra Foundation

4 3

[openstack-helm] GitOps Compatibility with ArgoCD
by aravindh.murugesan＠protonmail.com 05 Aug '25

05 Aug '25

Hello everyone, Hope you're all doing well. I’ve recently started exploring OpenStack-Helm to evaluate its suitability for our long-term needs, and one of the key aspects we’re considering is GitOps integration. While testing a deployment of the Keystone chart using ArgoCD, I noticed that the init container for Keystone waits for certain jobs (like db-init and bootstrap) to complete. However, ArgoCD doesn’t seem to trigger these jobs as expected—likely because it’s still waiting for the pods to become ready. I came across earlier discussions from Doug and Vlad around this topic during a previous PTG, but I wanted to bring it up again in case there have been any updates or ideas on making OpenStack-Helm charts more compatible with GitOps tools like ArgoCD or Flux. I really appreciate the effort and time that this community puts into maintaining and improving these charts. Any guidance or suggestions on how we might adapt this workflow would be incredibly helpful. Thanks so much in advance! Best regards, Aravindh

1 0

[kolla][barbican] Secure password management in Kolla-Ansible using Castellan
by elnazcloud＠gmail.com 05 Aug '25

05 Aug '25

Hi all, I have deployed an OpenStack environment using Kolla Ansible. I'm looking for a way to avoid storing service passwords (e.g., database, keystone, etc.) in clear text inside the configuration files. Is there any recommended method to integrate Barbican and Castellan so that services like Nova, Keystone, or Cinder can fetch secrets securely during runtime using oslo.config? If not natively supported, are there best practices or known workarounds for achieving this securely in a Kolla-based deployment? Thanks in advance!

7 12

[Zed][Neutron][OVN] Severe VM Network Performance Degradation Compared to Host
by Jeff Yang 05 Aug '25

05 Aug '25

Hi all, I'm running OpenStack Zed with OVN as the Neutron backend. I've encountered a severe VM network performance degradation issue and would appreciate any insights from the community. 🔹 **Environment** - OpenStack version: Zed - Neutron backend: OVN - Two VMs (each 4 vCPUs, 8 GB RAM) launched on two different compute nodes - Multi-queue is enabled on the VM vNICs 🔹 **Issue** The network performance inside the VMs is significantly worse than on the host nodes, with high packet retransmissions observed. 🔹 **Test results** **Host-to-Host (VTEP IPs)** ``` $ iperf3 -c 192.168.152.152 Connecting to host 192.168.152.152, port 5201 [ 5] local 192.168.152.153 port 45352 connected to 192.168.152.152 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 1.38 GBytes 11.8 Gbits/sec 0 3.10 MBytes [ 5] 1.00-2.00 sec 1.37 GBytes 11.8 Gbits/sec 0 3.10 MBytes [ 5] 2.00-3.00 sec 1.42 GBytes 12.2 Gbits/sec 0 3.10 MBytes [ 5] 3.00-4.00 sec 1.39 GBytes 11.9 Gbits/sec 0 3.10 MBytes [ 5] 4.00-5.00 sec 1.38 GBytes 11.8 Gbits/sec 0 3.10 MBytes [ 5] 5.00-6.00 sec 1.43 GBytes 12.3 Gbits/sec 0 3.10 MBytes [ 5] 6.00-7.00 sec 1.41 GBytes 12.1 Gbits/sec 0 3.10 MBytes [ 5] 7.00-8.00 sec 1.41 GBytes 12.1 Gbits/sec 0 3.10 MBytes [ 5] 8.00-9.00 sec 1.41 GBytes 12.1 Gbits/sec 0 3.10 MBytes [ 5] 9.00-10.00 sec 1.42 GBytes 12.2 Gbits/sec 0 3.10 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 14.0 GBytes 12.0 Gbits/sec 0 sender [ 5] 0.00-10.04 sec 14.0 GBytes 12.0 Gbits/sec receiver iperf Done. ``` **VM-to-VM (through overlay network)** ``` $ iperf3 -c 10.0.6.10 Connecting to host 10.0.6.10, port 5201 [ 5] local 10.0.6.37 port 56710 connected to 10.0.6.10 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 499 MBytes 4.19 Gbits/sec 263 463 KBytes [ 5] 1.00-2.00 sec 483 MBytes 4.05 Gbits/sec 467 367 KBytes [ 5] 2.00-3.00 sec 482 MBytes 4.05 Gbits/sec 491 386 KBytes [ 5] 3.00-4.00 sec 483 MBytes 4.05 Gbits/sec 661 381 KBytes [ 5] 4.00-5.00 sec 472 MBytes 3.95 Gbits/sec 430 391 KBytes [ 5] 5.00-6.00 sec 480 MBytes 4.03 Gbits/sec 474 350 KBytes [ 5] 6.00-7.00 sec 510 MBytes 4.28 Gbits/sec 567 474 KBytes [ 5] 7.00-8.00 sec 521 MBytes 4.37 Gbits/sec 565 387 KBytes [ 5] 8.00-9.00 sec 509 MBytes 4.27 Gbits/sec 632 483 KBytes [ 5] 9.00-10.00 sec 514 MBytes 4.30 Gbits/sec 555 495 KBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-10.00 sec 4.84 GBytes 4.15 Gbits/sec 5105 sender [ 5] 0.00-10.05 sec 4.84 GBytes 4.14 Gbits/sec receiver iperf Done. ``` As you can see, there's a sharp drop in performance inside the VMs (from ~12 Gbps down to ~4 Gbps), with a lot of retransmissions in 10 seconds. Has anyone encountered a similar issue with OVN and VM networking performance? What could be the potential causes? Any suggestions or debugging tips are welcome. Thanks in advance! Best regards,

5 4