- openstack-discuss - lists.openstack.org

[dev][neutron] Interest for a network-level SecurityGroup binding ?
by David Pineau 02 Aug '24

02 Aug '24

Hello Neutron Team, I'm part of a company that is currently migrating from homemade software to manage the infrastructure for a virtualization-based product towards an openstack based infrastructure. As such, this platform includes both private and public cloud usages, which brings me to our current network problem. Essentially, as administrators of the system, we want to expose a pre-configured network, which provides access to some non-openstack managed resources, via some routing mechanisms. The various VMs on this network must not be able to see each-other, as this network may be exposed to multiple customers/projects. Note that in this context, we're using the OVN driver for our network stack. We were initially looking at external networks for this, but understood through our attempts and experimentations that: - External networks are shared to all projects by default - Default sharing of external networks can be disabled by removing the automatically injected rbac for '*', allowing us to expose the network to only the projects we specify - VMs on this network can communicate with each other - Applying FlowControl does not solve this for VMs on the same Hypervisor (as they're directly communicating, and traffic does not seem to go through the host) - Only security groups can prevent such communication, but since it's associated to a Port, we cannot enforce it - All flow control for the various networks connected to a VM are currently setup on a single bridge interface on the hypervisor First question is simple: Did we miss anything ? Or is our understanding of the mechanisms on point ? In the second case, this leads me to the proposal mentioned in the subject: Offer a Network/SecurityGroup binding mechanism that would automatically/implicitly include its rules to the port's rules. The idea is that this would allow an administrator (and project administrator?) to enforce specific rules via security groups attached to the network itself, effectively providing a category of network aimed at providing connectivity to a specific external service. Additionally, this creates a behavior where unless the administrator allows it, no two VMs on this network may be able to communicate together, as a default. What do you think about this feature ? Is there any major risk/flaw that I might be missing ? Would you, as a community, welcome such an effort ? Kind regards, -- David Pineau Engineer @Shadow IRC nick: joa

3 3

[election] [tc] Notification of non-candidacy; how it impacts TC diversity
by Jay Faulkner 02 Aug '24

02 Aug '24

Hi all, The nomination period for TC members / PTLs is coming up soon. I wanted to inform the community that I do not intend on standing for election for another year on the TC. Now is a good time, especially if you work somewhere other than Red Hat, to consider serving as a TC member to ensure our leadership team contains representation for all perspectives of OpenStack use. I'm happy to speak with anyone privately who is interested in running about what it's like to be on the TC, and to share some strategies I exercised to ensure the value of my TC membership was being communicated to leadership at my job. Thanks, Jay Faulkner Technical Committee Member

6 5

oslo.service
by engineer2024 02 Aug '24

02 Aug '24

Can anyone guide me how to configure and use oslo.service for nova-api service for tracing and debugging ? Thanks elinux

3 2

filter out unsupported volume type for a given compute node
by Jiatong Shen 02 Aug '24

02 Aug '24

Hello Stackers, Our company is operating many sophisticated clusters with different storage types, such Ceph and SAN storage. What makes things trickier is that some compute node cannot use certain volume types. For example, some compute nodes do not have HBA, so they cannot take advantage of FC based SAN storage; the others do not have 10GbE ethernet, so they cannot connect to Ceph. Such deployment sometimes makes resize virtual machine quite tricky. So my question is what is best practice for this situation? Is it possible to determine if certain volume type is usable on a given compute node? Thank you very much for help. -- Best Regards, Jiatong Shen

2 1

[manila] Mid cycle on Aug 12th and 13th
by Carlos Silva 01 Aug '24

01 Aug '24

Hello zorillas and interested stackers! Over the PTG, we have agreed on having a mid-cycle checkpoint meeting, so we can discuss the progress of all things we planned. We have settled on the dates, and it will happen on August 12 and 13, from 14 to 16 UTC both days. We will use a meetpad for the meeting [1]. During the first day we will focus on covering the PTG topics, and for the second day, we will focus on the collaborative review sessions for all of the features being proposed on this cycle. We highly encourage everyone proposing and targeting features for this cycle to participate and propose collaborative review sessions, so we can speed up the reviews on gerrit. The meeting room and some topics are already available in the mid cycle etherpad [1], so please add your topics and propose collaborative review sessions for the features you are working on. [1] https://etherpad.opendev.org/p/manila-dalmatian-mid-cycle-notes Looking forward to it! Regards, carloss

1 0

placement issue
by Parsa Aminian 01 Aug '24

01 Aug '24

hello Im using kolla-ansible openstack version 2024.1 and all of my nova_compute containers are unhealthy because of this error : ERROR nova.compute.manager nova.exception.ResourceProviderAllocationRetrievalFailed: Failed to retrieve allocations for resource provider 3b09027d-c622-489e-bc73-4c5877069977: {"errors": [{"status": 404, "title": "Not Found", "detail": "The resource could not be found.\n\n No such resource class 0. ", "request_id": "req-a33704ce-4dad-4ac3-a46c-bd5a4d0d126b"}]} How can I solve this problem ? thanks in advance

1 0

[cinder] Stepping down from Cinder core
by Pete Zaitcev 01 Aug '24

01 Aug '24

Hello: Because of a job change, my time available is becoming quite limited, so I'm not going to be able to contribute at the appropriate level. So, I contacted our PTL to get me removed from the core team. Thanks everyone for the help and the journey in Cinder. Greetings, Pete

3 2

nova deploy issue
by Parsa Aminian 30 Jul '24

30 Jul '24

hello when I try to reconfigure nova with kolla ansible this error will be shown : TASK [nova-cell : Waiting for nova-compute services to register themselves] ******************************************************************************************* task path: /usr/local/share/kolla-ansible/ansible/roles/nova-cell/tasks/wait_discover_computes.yml:8 fatal: [control01 -> {{ groups[nova_cell_conductor_group][0] }}]: FAILED! => { "msg": "The conditional check 'inventory_hostname == all_computes_in_batch[0]' failed. The error was: error while evaluating conditional (inventory_hostname == all_computes_in_batch[0]): 'all_computes_in_batch' is undefined\n\nThe error appears to be in '/usr/local/share/kolla-ansible/ansible/roles/nova-cell/tasks/wait_discover_computes.yml': line 8, column 7, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n- block:\n - name: Waiting for nova-compute services to register themselves\n ^ here\n" Does anyone have any idea what I should do ?

1 0

Assistance Needed for Trove Instance Creation
by Thamanna Farhath 30 Jul '24

30 Jul '24

Hello community, I am currently deploying Trove using Kolla Ansible 2023.1, following the guide provided here: https://satishdotpatel.github.io/trove-dbaas-openstack/ . Despite cleaving to the instructions, I am facing an issue where the Trove instance ends up in an error state. trove-guestagent.conf [DEFAULT] transport_url = rabbit://openstack:USI0SmaT7lPF7MJCxHPZ4alm8wiyxoihssD1VlnA@192.168.1.101:5672,openstack:USI0SmaT7lPF7MJCxHPZ4alm8wiyxoihssD1VlnA@192.168.1.102:5672,openstack:USI0SmaT7lPF7MJCxHPZ4alm8wiyxoihssD1VlnA@192.168.1.103:5672// control_exchange = trove root_grant = ALL root_grant_option = True debug = False Docker Status Check: docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES f698ee14d928 mysql:5.7.29 "docker-entrypoint.s…" 18 minutes ago Up 18 minutes 0.0.0.0:3306->3306/tcp, :::3306->3306/tcp, 33060/tcp database Telnet Connection: telnet 192.168.50.78 3306 Trying 192.168.50.78... Connected to 192.168.50.78. Escape character is '^]'. J 5.7.29p+C5 }0^k[zH3mysql_native_password Syslog(SSH into the trove instance) ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)\n": Exception: Running command error: b"mysql: [Warning] Using a password on the command line interface can be insecure.ERROR trove.guestagent.datastore.service [None req-a03ff3dd-5a8f-4fd4-80d5-76e31fa16dd0 - - - - - -] Timeout while waiting for database status to change. Expected state healthy, current state is running When looking for the missing directory, I discovered it in /var/lib/mysql/mysqld.sock and /var/lib/mysql/mysqld.pid paths. How can I get an active instance?Kindly help me resolve this. Thank you in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

3 2

[horizon] How to enable MFA using TOTP on Horizon (ZED)
by Shubham Kumar Yadav 30 Jul '24

30 Jul '24

Hi all, I was working on a MFA in openstack (ZED). Is it possible to enable MFA using TOTP on Horizon? I'm using a ZED Openstack with Ubuntu 22.04 , and I know that from the CLI point of view, you can have Multi Factor Authentication, but I don't see that implemented on Horizon. i added MFA using - https://docs.openstack.org/keystone/pike/advanced-topics/auth-totp.html but now the problem is i can use the token issued to run openstack cli but not able to login into Horizon with user and password/totp. I see The Totp support was added to Horizon in the Bobcat (2023.2) release So i would like to ask how it is possible to backport the feature in Horizon in the zed release. I would appreciate any help! Thanks!

2 1