- openstack-discuss - lists.openstack.org

[tc] Weekly Meeting tomorrow, Dec 19 at 1800 UTC
by Jay Faulkner 18 Dec '23

18 Dec '23

Hi all, The weekly meeting of the OpenStack Technical Committee is scheduled for tomorrow, December 19, at 1800 UTC in #openstack-tc on OFTC. As a reminder, this will be our last meeting of 2023. Our next scheduled meeting after this will be January 7, 2024. The proposed agenda is: - Roll call - Follow up on tracked action items: https://meetings.opendev.org/meetings/tc/2023/tc.2023-12-12-18.00.html - Spotz - (due Jan 7 2024) Look into updating https://docs.openstack.org/install-guide/openstack-services.html and report back to TC Create TC resolution expressing approval for OIF bylaws change - Gate health check - Leaderless projects (gmann) - Implementation of Unmaintained branch statuses - 2024.1 TC Tracker - https://etherpad.opendev.org/p/tc-2024.1-tracker - Open Discussion and Reviews Thanks, Jay Faulkner OpenStack TC Chair

1 0

[Kolla-ansible] Upgrading from Yoga to Zed HCI deployment
by wodel youchi 18 Dec '23

18 Dec '23

Hi, I need to upgrade my Openstack deployment from Yoga (Rocky Linux 8) to Zed (Rocky Linux 9). My deployment is an HCI deployment with ceph pacific deployed using ceph-ansible. it contains : - 03 controllers that contain also ceph mgr/mon/rgw/cephfs containers - 27 compute/storage nodes I am planning to follow these steps : 1. Upgrade to Rocky 9, starting with the controllers, then the compute/storage nodes. 1. Undeploy 1 controller at a time, upgrade to Rocky 9, re-deploy the controller. 2. Undeploy 3 compute/storage nodes at a time, upgrade to Rocky 9, redeploy the nodes. 2. Stop the Openstack platform 3. Convert the deployed ceph pacific from ceph-ansible to cephadm. 4. Upgrade from Yoga to ZED If you can help me with some insights/thoughts things to do / to avoid, so that the upgrade will move smoothly, that would be great. Regards.

5 5

[neutron] Bug Deputy Report December 11 - December 17
by Yatin Karel 18 Dec '23

18 Dec '23

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2046457 ovn provider fails with "AttributeError: 'Client' object has no attribute 'ports'" Antelope impacted with a recent patch Unassigned Low ---------- - https://bugs.launchpad.net/neutron/+bug/2046392 Service Type Framework cannot handle router flavor provider entry point shortcut with stevedore Assigned to Miguel Lavalle Undecided -------------- - https://bugs.launchpad.net/neutron/+bug/2046510 neutron-servers have high memory usage Report against stable/rocky, requested more information. -- Thanks and Regards Yatin Karel

1 0

[neutron] Cannot reach external network from within VM
by Michael J Turek 17 Dec '23

17 Dec '23

Hey all, We’ve been trying to get our Bobcat openstack cloud working and have been stuck on some networking woes. It’s a flat provider network with one compute node and one controller (plan to expand after this is resolved). 1) We can SSH and ping the VMs but only if we are on the controller and behind the qdhcp network namespace. 2) Once on the VM, we cannot reach the external network. We followed this installation guide [0] and nothing stands out as misconfigured. If anyone can offer some advice on how to debug this, it would be greatly appreciated. [0] https://docs.openstack.org/neutron/latest/install/controller-install-option…

4 6

Re: openstack-discuss Digest, Vol 62, Issue 59
by Kerem Çeliker 17 Dec '23

17 Dec '23

1 0

[release] Release countdown for week R-15, Dec 18-22
by Elõd Illés 15 Dec '23

15 Dec '23

Development Focus ----------------- The Caracal-2 milestone will happen in next month, on January 11th, 2024. 2024.1 Caracal-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/caracal/schedule.html for details. General Information ------------------- Please remember that libraries need to be released at least once per milestone period. At milestone 2, the release team will propose releases for any library that has not been otherwise released since milestone 1. Other non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. At milestone-2 we also freeze the contents of the final release. If you have a new deliverable that should be included in the final release, you should make sure it has a deliverable file in: https://opendev.org/openstack/releases/src/branch/master/deliverables/carac… You should request a beta release (or intermediary release) for those new deliverables by milestone-2. We understand some may not be quite ready for a full release yet, but if you have something minimally viable to get released it would be good to do a 0.x release to exercise the release tooling for your deliverables. See the MembershipFreeze description for more details: https://releases.openstack.org/caracal/schedule.html#c-mf Finally, now may be a good time for teams to check on any stable releases that need to be done for your deliverables. If you have bugfixes that have been backported, but no stable release getting those. If you are unsure what is out there committed but not released, in the openstack/releases repo, running the command "tools/list_stable_unreleased_changes.sh <cycle_name>" gives a nice report. Upcoming Deadlines & Dates -------------------------- Caracal-2 Milestone: January 11th, 2024 Előd Illés irc: elodilles @ #openstack-release

1 0

[cinder] Festival of XS reviews (15 Dec)
by Rajat Dhasmana 15 Dec '23

15 Dec '23

Hello Argonauts, We will be having our monthly festival of reviews this Friday i.e. 15th December (Friday) from 1400-1600 UTC. Following are the details: Date: 15th December, 2023 Time: 1400-1600 UTC Meeting link: https://meet.google.com/jqg-eigw-rku etherpad: https://etherpad.opendev.org/p/cinder-festival-of-reviews Thanks Rajat Dhasmana

1 1

[neutron] Meetings next few weeks
by Brian Haley 14 Dec '23

14 Dec '23

Hello Neutrinos: With company Holiday shutdowns over the next couple of weeks, just wanted to make sure everyone was aware of our meetings during that time, and of my availability. 12/19: Neutron meeting, chaired by Rodolfo 12/22: Neutron Drivers meeting, if necessary, chaired by Rodolfo 12/26: Neutron meeting cancelled 12/29: Neutron Drivers meeting cancelled 1/2: Neutron meeting, chaired by Rodolfo 1/5: Neutron Drivers meeting, if necessary, chaired by Rodolfo Thanks Rodolfo for doing this while I'm out! I am out the next three weeks, but will occasionally check-in to make sure nothing is on fire :) The first week of 2024 I will not be available at all, please ping other core reviewers in the #openstack-neutron channel with any questions. Thanks, and have a nice holiday break! -Brian, Neutron PTL

1 0

[neutron] Drivers meeting cancelled tomorrow
by Brian Haley 14 Dec '23

14 Dec '23

Hello Neutrinos: Due to the lack of agenda, Friday's drivers meeting is cancelled. Have a nice weekend! -Brian

1 0

[solum][tc][all] Solum project marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the solum project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on solum, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support solum to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902624 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[freezer][tc][all] Freezer marked inactive by TC
by Jay Faulkner 14 Dec '23

14 Dec '23

OpenStack Community, The Technical Committee marked the freezer project inactive[0] due to failing CI jobs and general lack of contribution. If you rely on freezer, please take notice that without intervention, it will not be part of future OpenStack releases, including 2024.1 (Caracal). The only way for a project to leave inactive status is to become active again, and be removed from the inactive list, or to be retired from OpenStack. For more information, please see our documentation[1] on inactive projects. I encourage the OpenStack community to rally and support freezer to bring it back into active status. If you are an operator and want more information on how to contribute and get this project going, please reply to this email and someone will be glad to help. Thank you, Jay Faulkner OpenStack TC Chair 0: https://review.opendev.org/c/openstack/governance/+/902623 1: https://governance.openstack.org/tc/reference/emerging-technology-and-inact…

1 0

[Thank You] OpenInfra Live: Large Scale Ops Deep Dive: Samsung SDS
by Kristin Barrientos 14 Dec '23

14 Dec '23

Hi everyone, Thanks for watching the latest Large Scale Ops Deep Dive episode with Dan Paik from Samsung, SDS. What a great way to wrap up OpenInfra Live for the year. In case you missed the episode, you can find it here: https://www.youtube.com/watch?v=RI9SwY8VdCY&t=1s Do you want to be on OpenInfra Live in 2024? Email me your pitch or fill out the form on ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>[1], and maybe we’ll see you on a future show! Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation [1] https://openinfrafoundation.formstack.com/forms/openinfralive

1 0

[blazar] Next IRC meeting cancelled
by Pierre Riteau 14 Dec '23

14 Dec '23

Hello, The next IRC meeting scheduled for December 28 is cancelled. We will meet again on January 11. I wish everyone a very happy holiday! Pierre Riteau (priteau)

1 0

[ironic] Why do we support RAID level 2?
by Dmitry Tantsur 14 Dec '23

14 Dec '23

Hi folks, I was going through our RAID support and noticed that we declare support for RAID level 2. Per wikipedia [1] it's an extremely rarely used level which offers little benefits. Does anyone remember why we use that? Will anyone cry if we drop it? My worry is officially supporting something that nobody can even test because of lack of hardware or real use case behind it. Dmitry [1] https://en.wikipedia.org/wiki/Standard_RAID_levels#RAID_2

2 1

[cinder]Cannot create volume from snapshot
by Nguyễn Hữu Khôi 14 Dec '23

14 Dec '23

Hello guys. I am using Openstack Yoga and Dell Powerstore 5000T When I create volume from a snapshot then I encounter this error cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] REST Response: 422 with data {"messages":[{"code":"0xE0A040010003","severity":"Error","message_l10n":"The clone cannot be created because the max number of clones: 32, in a family has been reached.","arguments":["32"]}]} ERROR cinder.volume.drivers.dell_emc.powerstore.client [req-3384117a-0832-4983-96aa-fd701d68c8eb 6371ebfe0fce499983b1f07e7c34bf6d 4f6902ccd37f4e8f8a1a910641845866 - - -] Failed to create clone volume-cc1fdd0b-8dd7-41a2-b63e-1f Do we have any guide about this? Or how we can increase the max number of clones? Thank you. Regards Nguyen Huu Khoi

3 6

[Octavia] Next weekly meetings cancelled
by Gregory Thiemonge 14 Dec '23

14 Dec '23

Hi Folks, As discussed yesterday during our weekly meeting, the next Octavia weekly meetings (Dec 20 and 27) are cancelled, the next meeting will be held on January 3rd. Thanks, Greg

1 0

[taskflow][all] Taskflow still using removed asyncore
by Thomas Goirand 14 Dec '23

14 Dec '23

Hi, As per this document: https://docs.python.org/3/whatsnew/3.12.html > Removed > asynchat and asyncore > > These two modules have been removed according to the schedule in > PEP 594, having been deprecated in Python 3.6. Use asyncio instead. > (Contributed by Nikita Sobolev in gh-96580.) Therefore, building the taskflow package (and many other packages that depends on it, like Cinder) fails. Can someone write a patch to get rid of the use of asyncore? Will using asincio instead fail because of our use of Eventlet? Cheers, Thomas Goirand (zigo)

3 2

RE: openstack-discuss Digest, Vol 62, Issue 44 Neutron - Issue Urgent
by Asma Naz Shariq 14 Dec '23

14 Dec '23

Hi Openstack Neutron Team, I have deployed Multinode cluster of Openstack through kolla-ansible zed release. The problem I am facing is instances created cannot pick any Ip addresses( Rather than loop back ip or ipv6 addresses) from the assigned networks which I have created provider and self-service flat network type. Hence, I may not be able to ping and ssh instance from the controller node and these instances won’t be able to connect to the internet. Can you guide me how to resolve these issues related to network connectivity so I may able to send you the required files to troubleshoot easily? Thanks -----Original Message----- From: openstack-discuss-request(a)lists.openstack.org <openstack-discuss-request(a)lists.openstack.org> Sent: Thursday, December 14, 2023 12:26 AM To: openstack-discuss(a)lists.openstack.org Subject: openstack-discuss Digest, Vol 62, Issue 44 Send openstack-discuss mailing list submissions to openstack-discuss(a)lists.openstack.org To subscribe or unsubscribe via email, send a message with subject or body 'help' to openstack-discuss-request(a)lists.openstack.org You can reach the person managing the list at openstack-discuss-owner(a)lists.openstack.org When replying, please edit your Subject line so it is more specific than "Re: Contents of openstack-discuss digest..." Today's Topics: 1. What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Christian Rohmann) 2. Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova (Jonathan Rosser) 3. Re: [tripleo][ironic][wallaby] Partition Table: loop (Alexey Kashavkin) 4. Re: [all][tc][ptls] Eventlet: Python 3.12, and other concerning discoveries (Jay Faulkner) ---------------------------------------------------------------------- Message: 1 Date: Wed, 13 Dec 2023 18:00:46 +0100 From: Christian Rohmann <christian.rohmann(a)inovex.de> Subject: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss <openstack-discuss(a)lists.openstack.org> Message-ID: <a65d9057-67a2-4ab0-a2b6-fe327d185f06(a)inovex.de> Content-Type: text/plain; charset=UTF-8; format=flowed Hey openstack-discuss, I am a little confused about correct and required Ceph authx permissions for the RBD clients in Cinder, Glance and also Nova: When Glance is requested to delete an image it will check if this image has depended children, see https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. The children of Glance images usually are (Cinder) volumes, which therefore live in a different RBD pool "volumes". But if such children do exist a 500 error is thrown by Glance API. There also is an bug about this issue on Launchpad [3]. Manually using the RBD client shows the same error: > # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p > images children $IMAGE_ID > > 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 > librbd::image::OpenRequest: failed to retrieve name: (1) Operation not > permitted > 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: > 0x5639fdd5af60 failed to open image: (1) Operation not permitted > rbd: listing children failed: (1) Operation not permitted > 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: > list_descendants: failed to open descendant b7078ed7ace50d from pool > instances:(1) Operation not permitted So it's a permission error. Following either the documentation of Glance [1] or Ceph [2] on configuring the ceph auth caps there is no mention of granting anything towards the volume pool to Glance. So this is what I currently have configured: > client.cinder > key: REACTED > caps: [mgr] profile rbd pool=volumes, profile rbd-read-only > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=volumes, profile rbd-read-only > pool=images > > client.glance > key: REACTED > caps: [mgr] profile rbd pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=images > > client.nova > key: REACTED > caps: [mgr] profile rbd pool=instances, profile rbd > pool=images > caps: [mon] profile rbd > caps: [osd] profile rbd pool=instances, profile rbd > pool=images > When granting the glance client e.g. "rbd-read-only" to the volumes pool via: > > # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd > pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd > pool=images, profile rbd-read-only pool=volumes' > the error is gone. I am wondering through if this is really just a documentation bug (at OpenStack AND Ceph equally) and if Glance really needs read-only on the whole volumes pool or if there is some other capability that covers asking for child images. All in all I am simply wondering what the correct and least-privilege ceph auth caps for the RBD clients in Cinder, Glance and Nova would look like. Thanks Christian [1] https://docs.openstack.org/glance/latest/configuration/configuring.html#con… [2] https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-authen… [3] https://bugs.launchpad.net/glance/+bug/2045158 ------------------------------ Message: 2 Date: Wed, 13 Dec 2023 17:40:44 +0000 From: Jonathan Rosser <jonathan.rosser(a)rd.bbc.co.uk> Subject: Re: What are the correct auth caps for Ceph RBD clients of Cinder / Glance / Nova To: openstack-discuss(a)lists.openstack.org Message-ID: <fb421a48-b0f6-4a6c-8d72-5b2ed8532b52(a)rd.bbc.co.uk> Content-Type: text/plain; charset=UTF-8; format=flowed Hi Christain, If you dig through the various deployment tooling then you'll find things like https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory… Hope this is helpful, Jonathan. On 13/12/2023 17:00, Christian Rohmann wrote: > Hey openstack-discuss, > > I am a little confused about correct and required Ceph authx > permissions for the RBD clients in Cinder, Glance and also Nova: > > When Glance is requested to delete an image it will check if this > image has depended children, see > https://opendev.org/openstack/glance_store/src/commit/6f5011d1f05c99894fb8b…. > The children of Glance images usually are (Cinder) volumes, which > therefore live in a different RBD pool "volumes". But if such children > do exist a 500 error is thrown by Glance API. There also is an bug > about this issue on Launchpad [3]. > > Manually using the RBD client shows the same error: > >> # rbd -n client.glance -k /etc/ceph/ceph.client.glance.keyring -p >> images children $IMAGE_ID >> >> 2023-12-13T16:51:48.131+0000 7f198cf4e640 -1 >> librbd::image::OpenRequest: failed to retrieve name: (1) Operation >> not permitted >> 2023-12-13T16:51:48.131+0000 7f198d74f640 -1 librbd::ImageState: >> 0x5639fdd5af60 failed to open image: (1) Operation not permitted >> rbd: listing children failed: (1) Operation not permitted >> 2023-12-13T16:51:48.131+0000 7f1990c474c0 -1 librbd::api::Image: >> list_descendants: failed to open descendant b7078ed7ace50d from pool >> instances:(1) Operation not permitted > > So it's a permission error. Following either the documentation of > Glance [1] or Ceph [2] on configuring the ceph auth caps there is no > mention of granting anything towards the volume pool to Glance. > So this is what I currently have configured: > >> client.cinder >> key: REACTED >> caps: [mgr] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=volumes, profile rbd-read-only >> pool=images >> >> client.glance >> key: REACTED >> caps: [mgr] profile rbd pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=images >> >> client.nova >> key: REACTED >> caps: [mgr] profile rbd pool=instances, profile rbd >> pool=images >> caps: [mon] profile rbd >> caps: [osd] profile rbd pool=instances, profile rbd >> pool=images >> > > When granting the glance client e.g. "rbd-read-only" to the volumes > pool via: >> >> # ceph auth caps client.glance mon 'profile rbd' osd 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' mgr 'profile rbd >> pool=images, profile rbd-read-only pool=volumes' >> > the error is gone. > > > I am wondering through if this is really just a documentation bug (at > OpenStack AND Ceph equally) and if Glance really needs read-only on > the whole volumes pool or if there is some other capability that > covers asking for child images. > > > All in all I am simply wondering what the correct and least-privilege > ceph auth caps for the RBD clients in Cinder, Glance and Nova would > look like. > > > > Thanks > > > Christian > > > > > [1] > https://docs.openstack.org/glance/latest/configuration/configuring.htm > l#configuring-the-rbd-storage-backend > [2] > https://docs.ceph.com/en/latest/rbd/rbd-openstack/#setup-ceph-client-a > uthentication [3] https://bugs.launchpad.net/glance/+bug/2045158 > > > ------------------------------ Message: 3 Date: Thu, 14 Dec 2023 01:05:41 +0600 From: Alexey Kashavkin <akashavkin(a)gmail.com> Subject: Re: [tripleo][ironic][wallaby] Partition Table: loop To: Julia Kreger <juliaashleykreger(a)gmail.com> Cc: openstack-discuss(a)lists.openstack.org Message-ID: <0F672C26-BC74-4D16-92FC-292F1D2BF62F(a)gmail.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BE0F9200-A2C4-458F-B2C4-31E6043ACAA2" Greetings Julia, Thank you so much for your reply and clarification. > On 12 Dec 2023, at 20:22, Julia Kreger <juliaashleykreger(a)gmail.com> wrote: > > Greetings Alexey, > > That would do it. Whenever we do not see a kernel/ramdisk with an image file, we assume it is a whole disk image, and as a result, we don't partition, we only write out what we've been provided. This is rooted in the image convention storage with Glance, because you need a kernel/ramdisk to boot a partition, but you can "just boot" a whole disk image. > > The disk utilities, in this specific case when you look at the disk, it thinks it is looking at a partition image on a loopback due to the lack of the partition table. > > That being said, whole disk images are the preferred path given you have greater flexibility in the partition/structure/layout of the deployed host. > > Hope that helps explain and provides the extra context. > > -Julia > > > > On Tue, Dec 12, 2023 at 2:56 AM Alexey Kashavkin <akashavkin(a)gmail.com <mailto:akashavkin@gmail.com>> wrote: >> I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

1 0

Re: [tripleo][ironic][wallaby] Partition Table: loop
by Alexey Kashavkin 13 Dec '23

13 Dec '23

I realized what was wrong in my case. I have a partition image, and I added the ramdisk and kernel path to 'baremetal_deployment.yaml'. This helped.

2 2

[Reminder] OpenInfra Live: Large Scale Ops Deep Dive Ft: Samsung SDS Dec. 14 at 15UTC
by Kristin Barrientos 13 Dec '23

13 Dec '23

Hi Everyone, Tune in this week for another episode of OpenInfra Live, brought to you by the Large Scale SIG. Episode: In the "Large Scale Ops Deep Dive" series, a panel of OpenStack operators invites special guests to talk about their deployment and discuss their operations. For this episode, our guest will be Dan Paik from Samsung SDS. Date and time: Thursday, Dec 14, 15 UTC YouTube: https://www.youtube.com/watch?v=RI9SwY8VdCY LinkedIn:https://www.linkedin.com/events/7125892582139654144/comments/ WeChat: The recording will be posted on OpenInfra Foundation WeChat after the live stream Speakers: Dan Paik, Arnaud Morin, Felix Huettner, Thierry Carrez, Kristin Barrientos Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation

1 0

openstack cinder client help
by garcetto 13 Dec '23

13 Dec '23

good afternoon, i am trying to use the openstackclient ( https://docs.openstack.org/newton/user-guide/common/cli-install-openstack-c…) but it seems than I cannot use it to see cinder volume snapshot, even the doc say it is possible ( https://docs.openstack.org/python-openstackclient/latest/cli/decoder.html#c… ) [image: image.png] it says " (my-virt-env) user@ostack:~$ openstack snapshot list openstack: 'snapshot list' is not an openstack command. See 'openstack --help'. Did you mean one of these? endpoint add project endpoint create endpoint delete endpoint group add project endpoint group create ... " what am i missing? thank you.

3 2

[keystone] Keystone integration with Keycloak
by Franciszek Przewoźny 13 Dec '23

13 Dec '23

Hi all, I'm having some troubles integrating Keystone with Keycloak - pulling username and email from Keycloak using OIDC to Keystone works fine, but pulling groups (list of groups) doesn't. Keycloak provides such data in userinfo (pulled from Google, mapped in Keycloak and added to user): "usergroups": [ "group-a", "group-b", ], Keystone seems to be getting group names, but incorrectly parsing (?) it to a string with commas (instead of semicolon as it's required for multiple group entries to work: https://docs.openstack.org/keystone/latest/admin/federation/mapping_combina…) 2023-12-13 08:22:13.399 1076680 DEBUG keystone.federation.utils [None req-e8b8519a-c639-450e-b4e7-ca2ea8a0f3bc - - - - - -] updating a direct mapping: ['group-a,group-b'] _verify_all_requirements /usr/lib/python3/dist-packages/keystone/federation/utils.py:867 And tries to map user to group with names group-a,group-b: 2023-12-13 09:42:54.914 1084357 DEBUG keystone.federation.utils [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] mapped_properties: {'user': {'name': 'xxxxxxxx', 'email': 'xxxxxxx(a)yyyy.zzz', 'domain': {'id': 'default'}, 'type': 'ephemeral'}, 'group_ids': [], 'group_names': [{'name': 'group-a,group-b', 'domain': {'id': 'default'}}], 'projects': []} process /usr/lib/python3/dist-packages/keystone/federation/utils.py:562 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application [None req-df016b4f-1ab4-4e1a-bd9f-314d9434b302 - - - - - -] 'method' object is not subscriptable: TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application Traceback (most recent call last): 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1513, in full_dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application rv = self.dispatch_request() 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/app.py", line 1499, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.ensure_sync(self.view_functions[rule.endpoint])(**req.view_args) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 467, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = resource(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask/views.py", line 83, in view 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self.dispatch_request(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/flask_restful/__init__.py", line 582, in dispatch_request 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = meth(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/server/flask/common.py", line 1064, in wrapper 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return f(*args, **kwargs) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 386, in get 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return self._perform_auth(idp_id, protocol_id) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/auth.py", line 380, in _perform_auth 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application token = authentication.federated_authenticate_for_token( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 251, in federated_authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application return authenticate_for_token(auth) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 185, in authenticate_for_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application authenticate(auth_info, auth_context) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/api/_shared/authentication.py", line 152, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application resp = method.authenticate(auth_info.get_method_data(method_name)) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 59, in authenticate 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application response_data = handle_unscoped_token(auth_payload, 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 225, in handle_unscoped_token 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application mapped_properties, mapping_id = apply_mapping_filter( 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application File "/usr/lib/python3/dist-packages/keystone/auth/plugins/mapped.py", line 321, in apply_mapping_filter 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application utils.validate_mapped_group_ids(group_ids, mapping_id, identity_api) 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application TypeError: 'method' object is not subscriptable 2023-12-13 09:42:54.920 1084357 ERROR keystone.server.flask.application My current setup: Google (user and groups membership) OIDC -> Keycloak OIDC -> Keystone Mapping rules (without parameters related to group settings works fine): [ { "local": [ { "user": { "name": "{0}", "email": "{1}", "domain": { "id": "default" } } }, { "group": { "name": "{2}", "domain": { "id": "default" } } } ], "remote": [ { "type": "OIDC-preferred_username" }, { "type": "OIDC-email" }, { "type": "OIDC-usergroups" } ] } ] WSGI Apache: ## WSGI configuration WSGIApplicationGroup %{GLOBAL} WSGIDaemonProcess keystone display-name=keystone group=keystone processes=4 threads=1 user=keystone WSGIProcessGroup keystone WSGIScriptAlias / "/usr/lib/cgi-bin/keystone/keystone" WSGIPassAuthorization On LoadModule auth_openidc_module modules/mod_auth_openidc.so OIDCClaimPrefix "OIDC-" OIDCResponseType "id_token" OIDCScope "openid email profile" OIDCProviderMetadataURL "https://keycloak.yyyy.zzz/realms/master/.well-known/openid-configuration <https://keycloak.opera.software/realms/master/.well-known/openid-configurat…>" OIDCClientID "openstack" Any help appreciated! Thanks in advance, Franciszek Przewoźny

1 1

[all][tc][cinder] deprecating cinderlib
by Brian Rosmaita 13 Dec '23

13 Dec '23

As discussed at our midcycle meeting last week [0], the Cinder project team hereby announces the deprecation of cinderlib, a library that allows the direct usage of Cinder backend drivers without the cinder services. Cinderlib is a cycle-trailing release, and thus this announcement comes on the heels of the 2023.2 (Bobcat) release of cinderlib, which happened just last week. The Cinder project team will continue to support cinderlib in the stable Maintained branches for their normal lifecycles, as specified by the OpenStack Stable Branch Policy: - stable/2023.2: end of maintenance Spring 2025 - stable/2023.1: end of maintenance Fall 2024 - stable/zed: end of maintenance Spring 2024 The stable/victoria through stable/yoga branches are in Unmaintained status. If you have questions or concerns about the deprecation of cinderlib, please reply to this email or leave a comment on the governance patch: https://review.opendev.org/c/openstack/governance/+/903259 Thank you for your attention to this matter. [0] https://wiki.openstack.org/wiki/CinderCaracalMidCycleSummary

2 1

[openstack-ansible] December and January meetings schedule
by Neil Hanlon 13 Dec '23

13 Dec '23

Hello all, and happy holidays :) The OSA team will be skipping our regularly scheduled meetings on December 26th and January 2nd due to the Christmas/New Year festivities. We'll be meeting once more before the end of the year, next Tuesday, December 19th. Thank you, and I wish you all the best in 2024! Cheers, Neil

1 0

System configuration in OpenStack
by lostghost1＠yandex.ru 12 Dec '23

12 Dec '23

Hi all, Sorry if this has been asked already, but is it feasible to use OpenStack to configure running systems - including virtual instances, containers, and the physical nodes themselves. I know that conceptually OpenStack takes a hands-off approach - it deals with images in abstract and further configuration is delegated to tools such as Ansible. Same for bare metal nodes - you provision them with Ironic, flash an image to them, and that's where configuaration ends for OpenStack. At least this is how I understand it, may be wrong. I was thinking about introducing systems configuration as a first-class concept into OpenStack - that means integration with the package manager, writing of config files from templates, filesystem management in general. The most well thought-out "solution" that there is for systems configuration is Nix in my opinion. I could intergrate it into OpenStack, I could write my own package manager. I haven't decided yet, these are just ideas for a pet project. So if I were to do such a thing, how would I go about achieving it? Obviously I would need to write a Horizon console module for the web UI. But beyond that I'd also need integration with other components. What do you all think?

3 6