- openstack-discuss - lists.openstack.org

[nova][horizon] VNC console policy
by Eugen Block 02 Jun '25

02 Jun '25

Hi *, I'm a bit confused regarding the policy requirements to grant a user access to the vnc console via horizon dashboard. Since we have 10 years of history in our cloud, I tried to remove legacy stuff, e.g. old policy files and try with the defaults to see what we're missing. I recently upgraded this cloud to Caracal. It seems like currently, only a user with the admin role has access. Searching for some hints, I found the deprecated policies in (everything is commented): /usr/share/openstack-dashboard/openstack_dashboard/conf/nova_policy.yaml And then the defaults here: /usr/share/openstack-dashboard/openstack_dashboard/conf/default_policies/nova.yaml In the code I found two checks for "os_compute_api:os-consoles:show": class ConsoleTab(policy.PolicyTargetMixin, tabs.Tab): name = _("Console") slug = "console" template_name = "project/instances/_detail_console.html" preload = False policy_rules = (("compute", "os_compute_api:os-consoles:show"),) class InstanceDetailTabs(policy.PolicyTargetMixin, tabs.DetailTabsGroup): slug = "instance_details" tabs = (OverviewTab, InterfacesTab, LogTab, ConsoleTab, AuditTab) sticky = True policy_rules = (("compute", "os_compute_api:os-consoles:show"),) from /usr/share/openstack-dashboard/openstack_dashboard/dashboards/project/instances/tabs.py. But I don't find any policy like that in the defaults. So I'm wondering what the current recommendation would be. Should I add only "os_compute_api:os-consoles:show" to /usr/share/openstack-dashboard/openstack_dashboard/conf/default_policies/nova.yaml? I'm not sure if that would override the other defaults (because of one entry only) or if this would be an additional policy (haven't been playing with those for some time now). Could anyone point me to the best approach? Thanks! Eugen

1 0

[Neutron] Bug deputy - summary from week of May 26th
by Sławek Kapłoński 02 Jun '25

02 Jun '25

Hi, I was bug deputy last week and here is short summary: ### Critical None ### High None ### Medium - https://bugs.launchpad.net/neutron/+bug/2111660 - OVN_AGENT_NEUTRON_SB_CFG_KEY doesn't set when Neutron OVN Agent starts - I marked it as Medium but I don't really have env to confirm it currently, - https://bugs.launchpad.net/neutron/+bug/2111908 - [FT] ``test_subport_delete`` fails - fix proposed already by Rodolfo, - https://bugs.launchpad.net/neutron/+bug/2112110 - [ovn-octavia-provider] LoadBalancer member not coming back after disable-enable - fix already proposed by Fernando, ### Low - https://bugs.launchpad.net/neutron/+bug/2112123 - Functional: privsep helper command exited non-zero test_trunk_creation_with_no_subports - opened by Lajos to track failiure with some functional test, ### RFE - https://bugs.launchpad.net/neutron/+bug/2111899 - [RFE] Use stateless NAT rules for FIPs - proposed by Rodolfo - https://bugs.launchpad.net/neutron/+bug/2111891 - IPv6 Subnet-Router anycast address inappropriately used for gateway_ip when specifying --subnet-range - unassigned, - https://bugs.launchpad.net/neutron/+bug/2112297 - [RFE] Support Policy Based Routing for LRs in Neutron OVN driver ### To triage - https://bugs.launchpad.net/openstack-helm/+bug/2112130 - No port found in network None with IP address 169.254.169.254 - Brian already started looking into this, it seems for me that it is more OpenStack Helm issue rather than Neutron so I added Helm project to it too. -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[telemetry] Nominate Jaromír Wysoglad to Telemetry Core
by Juan Larriba 01 Jun '25

01 Jun '25

Hi, One of the things I wanted to do when becoming PTL of telemetry was to revive the interest in the community as I sensed that telemetry had been left a little bit behind from the rest of the projects. Since then, there has been a lot of movement: new Ceilometer features were added and even new projects (aethos, a prometheus-keystone proxy and grian-ui, a new metric displaying dashboard for Horizon) which has showed that the interest in gathering and displaying better and more scalable metrics is only growing. In these circumstances, the very small core contributor team needs to grow to keep up with all the influx of new features coming from the amazing community and I cannot think of anyone better than Jaromír Wysoglad to fulfill that role. Jaromír has been involved in the telemetry upstream community for years, tirelessly working to, among other things, make the whole telemetry suite to be compatible with Prometheus storage. He has implemented Prometheus compatibility with aodh, python-observabilityclient and many other things, including maintaining and improving the telemetry tempest test suite. Recently he created and is writing from scratch aetos, the new openstack-prometheus compatibility layer. I can't see a better contributor to the core group. If I don't hear any objections for one week, I'll add Jaromír to the group. Best Regards, Juan Larriba

3 3

Create image error
by BEDDA Fadhel 31 May '25

31 May '25

Hi everyone, I installed OpenStack (DevStack). At first, I was able to create three images (Ubuntu, Debian, and Windows) in addition to the Cirros image. When I tried to add another image, everything got stuck. I couldn't add any images, and I got the infamous error 550. HttpException: 502: Server Error for url:

2 1

[ops] Matrix room created #openstack-ops:opendev.org
by Jeremy Stanley 30 May '25

30 May '25

Discussion during today's Ops Radio Hour at one point led to talking about real-time/synchronous chat platforms. Consensus seemed to be that it was worth starting a Matrix room on the OpenDev Collaboratory's homeserver for OpenStack Ops discussions, and see how it works out for everyone. Visit https://matrix.to/#/#openstack-ops:opendev.org if you want to check it out. If you're already logged into your Matrix account then the "Continue" button should take you right to the room. If you're not logged in then it should prompt you to pick a client (choose Element and continue in your browser if you don't feel like installing a client right now) and then to sign in or create an account. If you choose to create an account at that point, it painlessly walks you through creating one on matrix.org (though you can join with an account from any other homeserver instead, if you prefer). -- Jeremy Stanley

1 0

Create image
by BEDDA Fadhel 30 May '25

30 May '25

Aidez moi svp HttpException: 502: Server Error for url: http://192.168.30.10/image/v2/images/2440ca4f-7a35-4fd1-88b2-5e4f269ef5d8/f…, 502 Bad Gateway: Bad Gateway: The proxy server received an invalid: response from an upstream server.: Apache/2.4.58 (Ubuntu) Server at 192.168.30.10 Port 80 Cdt

1 0

[ops] ops radio May 30 2025
by Chris Morgan 30 May '25

30 May '25

Hey Folks, Tomorrow the openstack ops meetups team (such as it is) would like to try something different, we're calling it "ops radio" a bit like talk radio. I posted a little about it here https://fosstodon.org/@osopsmeetup/114585889262579171 Time : 14:00 UTC which is 10am here (NYC). Just an hour free-form meeting on openinfra's jitsi so it's quite like just another zoom meeting. The jitsi link and agenda link are here on the ops meetups wiki: https://wiki.openstack.org/wiki/Operations/Meetups The idea is if people like this we could aim to do it regularly since in-person meetups have become much rarer and harder to do and since the community seems to be somewhat distributed across reddit, linkedin, mastodon, irc, mailing lists, bluesky, matrix, slack etc. technical topics will include the usual things like architecture. tools, upgrades, pain points depending on what people who attend want to discuss. Chris -- Chris Morgan <mihalis68(a)gmail.com>

1 1

some operations are available only to the administrator, regardless of the policies?
by sluge＠mail.ru 29 May '25

29 May '25

Hi everyone, I'm currently writing a custom nova's policy for my new role myrole. The current task is to create a role for a user with member role already assigned to see servers from other project. For example, I got a token for my user in project1, but want to see servers on project2, where my user has a member and myrole roles also. I added to nova's policy.json line: "os_compute_api:servers:show": "rule:project_reader_or_admin or role:myrole" I already assigned to my user roles member and myrole in the project1 and project2. But I always got a 404 error when I want to show servers from project2. I get 404 even when I use "os_compute_api:servers:show": "" i.e. always true. It only works if I use token of admin user or my user has admin role in project2. It looks like some operations are available for admins only?

3 3

[openstack-helm][loci] Retire Centos based images
by Vladimir Kozhukalov 28 May '25

28 May '25

Hi team, We have a bunch of Centos related stuff in the Loci repo. However we've not been building and testing centos based images for quite some time. Is anybody still interested in having/maintaining this stuff? I am talking about [1] - [5]. [1] https://opendev.org/openstack/loci/src/branch/master/dockerfiles/centos [2] https://opendev.org/openstack/loci/src/branch/master/scripts/install.sh#L37… [3] https://opendev.org/openstack/loci/src/branch/master/scripts/collect_info.s… [4] https://opendev.org/openstack/loci/src/branch/master/scripts/install_packag… [5] https://opendev.org/openstack/loci/src/branch/master/scripts/cleanup.sh#L14… -- Best regards, Kozhukalov Vladimir

1 1

Re: [neutron] Switching the ML2 driver in-place from linuxbridge to OVN for an existing Cloud
by Ohnsorge Borys 28 May '25

28 May '25

Hi James, I know this topic is old, but have you had the time/opportunity to describe the migration process based on openstack-ansible You mentioned? __ Best regards Borys Ohnsorge

2 1