- openstack-discuss - lists.openstack.org

[keystone] Keystone integration with Keycloak
by Franciszek Przewoźny 13 Dec '23

13 Dec '23

Hi all, I'm having some troubles integrating Keystone with Keycloak - pulling username and email from Keycloak using OIDC to Keystone works fine, but pulling groups (list of groups) doesn't. Keycloak provides such data in userinfo (pulled from Google, mapped in Keycloak and added to user): "usergroups": [ "group-a", "group-b", ], Keystone seems to be getting group names, but incorrectly parsing (?) it to a string with commas (instead of semicolon as it's required for multiple group entries to work: https://docs.openstack.org/keystone/latest/admin/federation/mapping_combina…) 2023-12-13 08:22:13.399 1076680 DEBUG keystone.federation.utils [None req-e8b8519a-c639-450e-b4e7-ca2ea8a0f3bc - - - - - -] updating a direct mapping: ['group-a,group-b'] _verify_all_requirements /usr/lib/python3/dist-packages/keystone/federation/utils.py:867 And tries to map user to group with names group-a,group-b: 2023-12-13 09:42:54.914 1084357 DEBUG keystone.federation.utils [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] mapped_properties: {'user': {'name': 'xxxxxxxx', 'email': 'xxxxxxx(a)yyyy.zzz', 'domain': {'id': 'default'}, 'type': 'ephemeral'}, 'group_ids': [], 'group_names': [{'name': 'group-a,group-b', 'domain': {'id': 'default'}}], 'projects': []} process /usr/lib/python3/dist-packages/keystone/federation/utils.py:562 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] 'method' object is not subscriptable: TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application Traceback (most recent call last): 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1513, in full_dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application rv = self.dispatch_request() 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1499, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 467, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = resource(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/views.py", line 83, in view 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.dispatch_request(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 582, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = meth(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/server/flask/common.py", line 1064, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return f(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 386, in get 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self._perform_auth(idp_id, protocol_id) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 380, in _perform_auth 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application token = authentication.federated_authenticate_for_token( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 251, in federated_authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return authenticate_for_token(auth) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 185, in authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application authenticate(auth_info, auth_context) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 152, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = method.authenticate(auth_info.get_method_data(method_name)) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 59, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application response_data = handle_unscoped_token(auth_payload, 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 225, in handle_unscoped_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application mapped_properties, mapping_id = apply_mapping_filter( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 321, in apply_mapping_filter 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application utils.validate_mapped_group_ids(group_ids, mapping_id, identity_api) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application My current setup: Google (user and groups membership) OIDC -> Keycloak OIDC -> Keystone Mapping rules (without parameters related to group settings works fine): [ { "local": [ { "user": { "name": "{0}", "email": "{1}", "domain": { "id": "default" } } }, { "group": { "name": "{2}", "domain": { "id": "default" } } } ], "remote": [ { "type": "OIDC-preferred_username" }, { "type": "OIDC-email" }, { "type": "OIDC-usergroups" } ] } ] WSGI Apache: ## WSGI configuration WSGIApplicationGroup %{GLOBAL} WSGIDaemonProcess keystone display-name=keystone group=keystone processes=4 threads=1 user=keystone WSGIProcessGroup keystone WSGIScriptAlias / "/usr/lib/cgi-bin/keystone/keystone" WSGIPassAuthorization On LoadModule auth_openidc_module modules/mod_auth_openidc.so OIDCClaimPrefix "OIDC-" OIDCResponseType "id_token" OIDCScope "openid email profile" OIDCProviderMetadataURL "https://keycloak.yyyy.zzz/realms/master/.well-known/openid-configuration <https://keycloak.opera.software/realms/master/.well-known/openid-configurat…>" OIDCClientID "openstack" Any help appreciated! Thanks in advance, Franciszek Przewoźny

1 1

[all][tc][cinder] deprecating cinderlib
by Brian Rosmaita 13 Dec '23

13 Dec '23

As discussed at our midcycle meeting last week [0], the Cinder project team hereby announces the deprecation of cinderlib, a library that allows the direct usage of Cinder backend drivers without the cinder services. Cinderlib is a cycle-trailing release, and thus this announcement comes on the heels of the 2023.2 (Bobcat) release of cinderlib, which happened just last week. The Cinder project team will continue to support cinderlib in the stable Maintained branches for their normal lifecycles, as specified by the OpenStack Stable Branch Policy: - stable/2023.2: end of maintenance Spring 2025 - stable/2023.1: end of maintenance Fall 2024 - stable/zed: end of maintenance Spring 2024 The stable/victoria through stable/yoga branches are in Unmaintained status. If you have questions or concerns about the deprecation of cinderlib, please reply to this email or leave a comment on the governance patch: https://review.opendev.org/c/openstack/governance/+/903259 Thank you for your attention to this matter. [0] https://wiki.openstack.org/wiki/CinderCaracalMidCycleSummary

2 1

[openstack-ansible] December and January meetings schedule
by Neil Hanlon 13 Dec '23

13 Dec '23

Hello all, and happy holidays :) The OSA team will be skipping our regularly scheduled meetings on December 26th and January 2nd due to the Christmas/New Year festivities. We'll be meeting once more before the end of the year, next Tuesday, December 19th. Thank you, and I wish you all the best in 2024! Cheers, Neil

1 0

System configuration in OpenStack
by lostghost1＠yandex.ru 12 Dec '23

12 Dec '23

Hi all, Sorry if this has been asked already, but is it feasible to use OpenStack to configure running systems - including virtual instances, containers, and the physical nodes themselves. I know that conceptually OpenStack takes a hands-off approach - it deals with images in abstract and further configuration is delegated to tools such as Ansible. Same for bare metal nodes - you provision them with Ironic, flash an image to them, and that's where configuaration ends for OpenStack. At least this is how I understand it, may be wrong. I was thinking about introducing systems configuration as a first-class concept into OpenStack - that means integration with the package manager, writing of config files from templates, filesystem management in general. The most well thought-out "solution" that there is for systems configuration is Nix in my opinion. I could intergrate it into OpenStack, I could write my own package manager. I haven't decided yet, these are just ideas for a pet project. So if I were to do such a thing, how would I go about achieving it? Obviously I would need to write a Horizon console module for the web UI. But beyond that I'd also need integration with other components. What do you all think?

3 6

[publiccloud-sig] Reminder - next meeting December 13th - 0800 UTC
by Felix Kronlage-Dammers 12 Dec '23

12 Dec '23

Hi everyone, This Wednesday the next meeting of the public cloud sig is going to happen. Since we do every other meeting as a videosession, we’ll be meeting at 0800 UTC here: https://conf.scs.koeln:8443/OIF-public-cloud-sig We’re going to continue our discussion on user stories for the discoverability of flavors and alike. Please see https://etherpad.opendev.org/p/publiccloud-sig-meeting for further infos. See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG See you tomorrow! felix -- Felix Kronlage-Dammers Product Owner IaaS & Operations Sovereign Cloud Stack Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

Issuse with OVN DVR generate too much flow on compute node
by Sang Tran Quoc 12 Dec '23

12 Dec '23

Hi OpenStack Community, I've indicated very weird behavior about ovn flows when VM is associated with vrouter, I use one new compute node with only 1 VM for testing and result as below: * When VM attach to vRouter without external network: Only add new 2047 flows. * When vRouter attach to external network (provider-net2): It will generate 147k flows immediately ? * We've tested with VM direct attach to provider-net2 also generate 147k flows. [cid:image001.png@01DA2D02.780FB210] My environment is OpenStack Victoria version, neutron deployed with OVN, DVR, Distributed FIP mode, and provider-net2 using VLAN setup. The problems lead to the heavily process of sync flow which slows down the normal VM operations and packet drop a little bit while update large flow on the ovswitch. Could anyone has experienced this behavior before or have a solution config/patch neutron to address this? Any suggestions are highly appreciated. Thank and regards, Sang Tran

1 0

Re: [URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 12 Dec '23

12 Dec '23

Hey team, Thanks for those who replied off list. Thankfully we figured it out, it was due to underlying resolver config mysterious mulching AAAA records instead of requesting A records… Probably goes to say, Openstack needs to have some seriously heavier logging 😃 haha. Thanks! Karl. From: Dmitriy Rabotyagov <noonedeadpunk(a)gmail.com> Date: Tuesday, 12 December 2023 at 5:35 pm To: Karl Kloppenborg <kkloppenborg(a)resetdata.com.au> Subject: Re: [URGENT] - Help needed with open stack services hung Hey, > stopping services from processing requests I assume this means that services are started and do not report any errors in logs? What happens with requests themselves? Are they answered with error or just hang? Also how environment was deployed? Some deployment tooling or manually with packages, k8s? On Tue, Dec 12, 2023, 05:30 Karl Kloppenborg <kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au>> wrote: Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

[tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 12 Dec '23

12 Dec '23

I have an issue with nodes provisioning. All my nodes are getting a partition table - loop. I forcefully specified 'disk_label:gpt/msdos' in the capabilities properties, but it didn't help. I can't figure out at what moment it creates a partition for the entire disk size: Model: Virtio Block Device (virtblk) Disk /dev/vda: 53.7GB Sector size (logical/physical): 512B/512B Partition Table: loop Disk Flags: Number Start End Size File system Flags 1 0.00B 53.7GB 53.7GB xfs This causes the following error: Failed to check the number of primary partitions present on /dev/vda for node 8d5ed008-efea-4df7-a190-aab8274a3bd5. Error: The device /dev/vda does not have a valid MBR partition table I tried to find in the ironic documentation where exactly a partition can be partitioned to the whole disk, but I couldn't find it. Perhaps it is somehow affected by the fact that 'is_whole_disk_image = true' is specified in the deployment process. I also have an x86_64 host as a compute node, it boots in legacy mode. I got the image for it from here - https://images.rdoproject.org/centos8/wallaby/rdo_trunk/current-tripleo/ I also get the same error on it. What could affect this? Full log of one of the nodes - https://pastebin.pl/view/5a6a7587 Node Show output of this node - https://pastebin.pl/view/ec5950b6

1 0

[URGENT] - Help needed with open stack services hung
by Karl Kloppenborg 12 Dec '23

12 Dec '23

Hi Openstack Community, Unfortunately we’ve had a weird situation arise where one of our regions has just stopped dead in it’s tracks, all management systems have been rebooted but there seems to be something stopping services from processing requests. Database, RabbitMQ Memcached have all been individually tested and I cannot find fault with them. Could any openstack consultants who are available for immediate emergency work please contact me off list. Thanks, Karl. Kind Regards, Karl Kloppenborg BCompSc, CNCF-[KCNA, CKA, CKAD], LFCE, CompTIA Linux+ XK0-004 Chief Technology Officer m: +61 437 239 565<mailto:+61%20437%20239%20565> | e: kkloppenborg(a)resetdata.com.au<mailto:kkloppenborg@resetdata.com.au> | w: https://resetdata.com [signature_2024530915][Image] This email transmission is intended only for the addressee / person responsible for delivery of the message to such person and may contain confidential or privileged information. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you, nor may you use, review, disclose, disseminate or copy any information contained in or attached to it. Whilst this email has been checked for viruses, the sender does not warrant that any attachments are free from viruses or other defects. You assume all liability for any loss, damage or other consequences which may arise from opening or using the attachments. If you received this e-mail in error please delete it and any attachments and kindly notify us by immediately sending an email to contact(a)resetdata.com.au<mailto:contact@resetdata.com.au>

1 0

Individual Board Director nominations: 3d left
by Kurt Garloff 12 Dec '23

12 Dec '23

Hi, the Open Infra communities have many strengths. One of them is a well-balanced board of directors that has representatives from all member classes, the Platinum members, the Gold members, and from individuals [1] that are part of the communities and elected -- each class contributing 1/3 of the seats.[4] I am worried about the individual class though: There are currently only 3 candidates that have enough nominations to be on the ballot [2]. 3 more needing a few more nominations. But I believe there should be a few more candidates on the ballot, otherwise it becomes an election without choice, something that is not good IMVHO. So please identify individuals that want to serve and nominate [3] them. This makes the elections meaningful and allows the board to do its work with also the individual members well represented. And there are only 3 more days to go for this! [1] https://openinfra.dev/election/2024-individual-director-election [2] https://openinfra.dev/election/2024-individual-director-election/candidates [3] https://openinfra.dev/a/community/members [4] https://openinfra.dev/about/board/ Thanks, -- Kurt Garloff <openstack(a)garloff.de>, Cologne CTO Sovereign Cloud Stack project @ OSB Alliance e.V.

2 1