- openstack-discuss - lists.openstack.org

[sig][upgrades] IRC meeting Monday 18th->25th
by James Page 15 Feb '19

15 Feb '19

Hi All In a feat of random planning weirdness, both the last and the upcoming Upgrades SIG IRC meeting days have landed on a US holiday. As the last one was a bit of a flop due to this co-incidence I'm proposing we bump back one week and move the IRC meetings from the 18th->25th February. They will be at 0900 and 1600 UTC as usual to cover as many participants as possible! If you're based on the US - have a lovely Presidents day! Cheers James

1 0

kayobe 5.0.0.0rc1 (rocky)
by no-reply＠openstack.org 15 Feb '19

15 Feb '19

Hello everyone, A new release candidate for kayobe for the end of the Rocky cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kayobe/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Rocky release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/rocky release branch at: https://git.openstack.org/cgit/openstack/kayobe/log/?h=stable/rocky Release notes for kayobe can be found at: https://docs.openstack.org/releasenotes/kayobe/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/kayobe and tag it *rocky-rc-potential* to bring it to the kayobe release crew's attention.

1 0

Re: [keystone] adfs SingleSignOn with CLI/API?
by Colleen Murphy 15 Feb '19

15 Feb '19

Forwarding back to list On Mon, Feb 11, 2019, at 5:11 PM, Blake Covarrubias wrote: > > On Feb 11, 2019, at 6:19 AM, Colleen Murphy <colleen(a)gazlene.net> wrote: > > > > Hi Fabian, > > > > On Mon, Feb 11, 2019, at 12:58 PM, Fabian Zimmermann wrote: > >> Hi, > >> > >> Im currently trying to implement some way to do a SSO against our > >> ActiveDirectory. I already tried SAMLv2 and OpenID Connect. > >> > >> Im able to sign in via Horizon, but im unable to find a working way on cli. > >> > >> Already tried v3adfspassword and v3oidcpassword, but im unable to get > >> them working. > >> > >> Any hints / links / docs where to find more information? > >> > >> Anyone using this kind of setup and willing to share KnowHow? > >> > >> Thanks a lot, > >> > >> Fabian Zimmermann > > > > We have an example of authenticating with the CLI here: > > > > https://docs.openstack.org/keystone/latest/admin/federation/configure_feder… > > > > That only covers the regular SAML2.0 ECP type of authentication, which I guess won't work with ADFS, and we seem to have zero ADFS-specific documentation. > > > > From the keystoneauth plugin code, it looks like you need to set identity-provider-url, service-provider-endpoint, service-provider-entity-id, username, password, identity-provider, and protocol (I'm getting that from the loader classes[1][2]). Is that the information you're looking for, or can you give more details on what specifically isn't working? > > > > Colleen > > > > [1] http://git.openstack.org/cgit/openstack/keystoneauth/tree/keystoneauth1/loa… > > [2] http://git.openstack.org/cgit/openstack/keystoneauth/tree/keystoneauth1/ext… > > > > Fabian, > > To add a bit more info, the AD FS plugin essentially uses IdP-initiated > sign-on. The identity provider URL is where the initial authentication > request to AD FS will be sent. An example of this would be > https://HOSTNAME/adfs/services/trust/13/usernamemixed > <https://hostname/adfs/services/trust/13/usernamemixed>. The service > provider’s entity ID must also be sent in the request so that AD FS > knows which Relying Party Trust to associate with the request. > > AD FS will provide a SAML assertion upon successful authentication. The > service provider endpoint is the URL of the Assertion Consumer Service. > If you’re using Shibboleth on the SP, this would be > https://HOSTNAME/Shibboleth.sso/ADFS > <https://hostname/Shibboleth.sso/ADFS>. > > Note: The service-provider-entity-id can be omitted if it is the same > value as the service-provider-endpoint (or Assertion Consumer Service > URL). > > Hope this helps. > > — > Blake Covarrubias >

3 5

kayobe 4.0.0.0rc1 (queens)
by no-reply＠openstack.org 15 Feb '19

15 Feb '19

Hello everyone, A new release candidate for kayobe for the end of the Queens cycle is available! You can find the source code tarball at: https://tarballs.openstack.org/kayobe/ Unless release-critical issues are found that warrant a release candidate respin, this candidate will be formally released as the final Queens release. You are therefore strongly encouraged to test and validate this tarball! Alternatively, you can directly test the stable/queens release branch at: https://git.openstack.org/cgit/openstack/kayobe/log/?h=stable/queens Release notes for kayobe can be found at: https://docs.openstack.org/releasenotes/kayobe/ If you find an issue that could be considered release-critical, please file it at: https://storyboard.openstack.org/#!/project/openstack/kayobe and tag it *queens-rc-potential* to bring it to the kayobe release crew's attention.

1 0

Open Infrastructure Summit Denver - Community Voting Open
by Ashlee Ferguson 15 Feb '19

15 Feb '19

Hi everyone, Community voting for the Open Infrastructure Summit Denver sessions is open! You can VOTE HERE <https://www.openstack.org/summit/denver-2019/vote-for-speakers>, but what does that mean? Now that the Call for Presentations has closed, all submissions are available for community vote and input. After community voting closes, the volunteer Programming Committee members will receive the presentations to review and determine the final selections for Summit schedule. While community votes are meant to help inform the decision, Programming Committee members are expected to exercise judgment in their area of expertise and help ensure diversity of sessions and speakers. View full details of the session selection process here <https://www.openstack.org/summit/denver-2019/call-for-presentations/selecti…>. In order to vote, you need an OSF community membership. If you do not have an account, please create one by going to openstack.org/join <http://openstack.org/join>. If you need to reset your password, you can do that here <https://www.openstack.org/Security/lostpassword>. Hurry, voting closes Monday, February 4 at 11:59pm Pacific Time (Tuesday, February 5 at 7:59 UTC). Continue to visit https://www.openstack.org/summit/denver-2019 <https://www.openstack.org/summit/denver-2019> for all Summit-related information. REGISTER Register for the Summit <https://openinfrasummitandptgdenver.eventbrite.com/> before prices increase in late February! VISA APPLICATION PROCESS Make sure to secure your Visa soon. More information <https://www.openstack.org/summit/denver-2019/travel/#travel-support> about the Visa application process. TRAVEL SUPPORT PROGRAM February 27 is the last day to submit applications. Please submit your applications <https://www.openstack.org/summit/denver-2019/travel/#travel-support> by 11:59pm Pacific Time (February 28 at 7:59am UTC). If you have any questions, please email summit(a)openstack.org. Cheers, Ashlee Ashlee Ferguson OpenStack Foundation ashlee(a)openstack.org

4 5

octavia : diskimage-create.sh ignores -s flag ?
by M. Ranganathan 15 Feb '19

15 Feb '19

Hello, I have been struggling to create a diskimage from an existing qcow2 image. I find that diskimage-builder does the following: 1. apparently ignores DIB_LOCAL_IMAGE environment setting and 2. ignores the -s flag. No matter what -s I supply, it creates a 2gb image. My flags are as follows: bash diskimage-create.sh -s 10 Not sure what I am doing wrong. Any help appreciated. Thanks -- M. Ranganathan

3 4

Zun : Error in "docker network create" with kuryr as driver, as required by Zun
by Nehal Bansal 15 Feb '19

15 Feb '19

Hi, I have installed OpenStack Queens release. I wish to run docker containers on it as first class residents like VMs therefore, I installed Zun. Zun requires Kuryr-libnetwork on the compute node. Everything got installed correctly but verifying the installation with docker network create --driver kuryr --ipam-driver kuryr --subnet 192.168.4.0/24 --gateway=192.168.4.1 test_net gives the following error: Error response from daemon: legacy plugin: Plugin.Activate: {"message":"page not found"} The /var/log/syslog file gives this error: Feb 13 09:25:01 compute dockerd[27830]: time="2019-02-13T09:25:01.006618155+05:30" level=error msg="Handler for POST /v1.39/networks/create returned error: legacy plugin: Plugin.Activate: {\"message\":\"page not found\"}\n". I have asked the question on ask.openstack.org too but have received no answers. I am new to both OpenStack and Docker. Please let me know if you need any more information. Thank you. Regards, Nehal Bansal

2 1

[tripleo] Plan around switching Podman to default
by Emilien Macchi 14 Feb '19

14 Feb '19

Pacemaker provided by CentOS7 doesn't work with Podman, and only works with Docker. Podman is already the default on the Undercloud, and this is fine, as we don't deploy Pacemaker on this node. However for the Overcloud, it causes problem as upstream is tested on CentOS7 and downstream is being tested on RHEL8. With that said, I propose that we: - Keep Docker as the default on the Overcloud until CentOS8 is out. - Switch downstream to use Podman on the Overcloud (since we run RHEL8 it's fine). - Switch all CI jobs except OVB to NOT deploy Pacemaker and switch to Podman. - Once CentOS8 is out, we revert the downstream only patch and land it upstream. Any feedback / concerns are welcome. -- Emilien Macchi

2 3

[nova][dev][ops] can we get rid of 'project_only' in the DB layer?
by melanie witt 14 Feb '19

14 Feb '19

Hey all, Recently, we had a customer try the following command as a non-admin with a policy role granted in policy.json to allow live migrate: "os_compute_api:os-migrate-server:migrate_live": "rule:admin_api or role:Operator" The scenario is that they have a server in project A and a user in project B with role:Operator and the user makes a call to live migrate the server. But when they call the API, they get the following error response: {"itemNotFound": {"message": "Instance <uuid server 1> could not be found.", "code": 404}} A superficial look through the code shows that the live migrate should work, because we have appropriate policy checks in the API, and the request makes it past those checks because the policy.json has been set correctly. A common pattern in our APIs is that we first compute_api.get() the instance object and then we call the server action (live migrate, stop, start, etc) with it after we retrieve it. In this scenario, the compute_api.get() fails with NotFound. And the reason it fails with NotFound is because, much lower level, at the DB layer, we have a keyword arg called 'project_only' which, when True, will scope a database query to the RequestContext.project_id only. We have hard-coded 'project_only=True' for the instance get query. So, when the user in project B with role:Operator tries to retrieve the instance record in project A, with appropriate policy rules set, it will fail because 'project_only=True' and the request context is project B, while the instance is in project A. My question is: can we get rid of the hard-coded 'project_only=True' at the database layer? This seems like something that should be enforced at the API layer and not at the database layer. It reminded me of an effort we had a few years ago where we removed other hard-coded policy enforcement from the database layer [1][2]. I've uploaded a WIP patch to demonstrate the proposed change [3]. Can anyone think of any potential problems with doing this? I'd like to be able to remove it so that operators are able use policy to allow non-admin users with appropriately configured roles to run server actions. Cheers, -melanie [1] https://blueprints.launchpad.net/nova/+spec/nova-api-policy-final-part [2] https://review.openstack.org/#/q/topic:bp/nova-api-policy-final-part+(statu… [3] https://review.openstack.org/637010

3 2

[release] Release countdown for week R-7, February 18-22
by Sean McGinnis 14 Feb '19

14 Feb '19

Welcome to this weeks release countdown email. Development Focus ----------------- The non-client library freeze is getting, followed closely by the client lib freeze. Teams should be focusing on wrapping up work that will require library changes to complete. General Information ------------------- As we get closer to the end of the cycle, we have deadlines coming up for client and non-client libraries to ensure any dependency issues are worked out and we have time to make any critical fixes before the final release candidates. To this end, it is good practice to release libraries throughout the cycle once they have accumulated any significant functional changes. Upcoming Deadlines & Dates -------------------------- Non-client library freeze: February 28 Stein-3 milestone: March 7 RC1 deadline: March 21 -- Sean McGinnis (smcginnis)

1 0