- openstack-discuss - lists.openstack.org

hacluster_corosync container stuck in restarting
by Karera Tony 30 Jan '23

30 Jan '23

Dear Team, I installed Openstack Wallaby using kolla-ansible. Everything is fine except for the hacluster_corosync container stuck in restarting. Below are the corosync logs. Has anyone faced this issue before ? I have two controllers but this issue is on happening on one Jan 30 08:19:42 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:19:42 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:19:42 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:19:42 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:19:42 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:19:42 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:19:42 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:19:42 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:19:42 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:19:42 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Jan 30 08:20:43 [7] controller1 corosync notice [MAIN ] Corosync Cluster Engine 3.0.3 starting up Jan 30 08:20:43 [7] controller1 corosync info [MAIN ] Corosync built-in features: dbus monitoring watchdog augeas systemd xmlconf vqsim nozzle snmp pie relro bindnow Jan 30 08:20:43 [7] controller1 corosync warning [MAIN ] Could not increase RLIMIT_MEMLOCK, not locking memory: Operation not permitted (1) Jan 30 08:20:43 [7] controller1 corosync notice [TOTEM ] Initializing transport (Kronosnet). Jan 30 08:20:43 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:20:43 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:20:43 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:20:43 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:20:43 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:20:43 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:20:43 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:20:43 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:20:43 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:20:43 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Jan 30 08:21:43 [7] controller1 corosync notice [MAIN ] Corosync Cluster Engine 3.0.3 starting up Jan 30 08:21:43 [7] controller1 corosync info [MAIN ] Corosync built-in features: dbus monitoring watchdog augeas systemd xmlconf vqsim nozzle snmp pie relro bindnow Jan 30 08:21:43 [7] controller1 corosync warning [MAIN ] Could not increase RLIMIT_MEMLOCK, not locking memory: Operation not permitted (1) Jan 30 08:21:43 [7] controller1 corosync notice [TOTEM ] Initializing transport (Kronosnet). Jan 30 08:21:44 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:21:44 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:21:44 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:21:44 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:21:44 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:21:44 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:21:44 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:21:44 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:21:44 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:21:44 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Regards Regards Tony Karera

1 0

hacluster_corosync container stuck in restarting
by Karera Tony 30 Jan '23

30 Jan '23

Dear Team, I installed Openstack Wallaby using kolla-ansible. Everything is fine except for hacluster_corosync container stuck in restarting. Below are the corosync logs. Has anyone faced this issue before ? Jan 30 08:19:42 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:19:42 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:19:42 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:19:42 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:19:42 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:19:42 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:19:42 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:19:42 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:19:42 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:19:42 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Jan 30 08:20:43 [7] controller1 corosync notice [MAIN ] Corosync Cluster Engine 3.0.3 starting up Jan 30 08:20:43 [7] controller1 corosync info [MAIN ] Corosync built-in features: dbus monitoring watchdog augeas systemd xmlconf vqsim nozzle snmp pie relro bindnow Jan 30 08:20:43 [7] controller1 corosync warning [MAIN ] Could not increase RLIMIT_MEMLOCK, not locking memory: Operation not permitted (1) Jan 30 08:20:43 [7] controller1 corosync notice [TOTEM ] Initializing transport (Kronosnet). Jan 30 08:20:43 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:20:43 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:20:43 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:20:43 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:20:43 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:20:43 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:20:43 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:20:43 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:20:43 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:20:43 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Jan 30 08:21:43 [7] controller1 corosync notice [MAIN ] Corosync Cluster Engine 3.0.3 starting up Jan 30 08:21:43 [7] controller1 corosync info [MAIN ] Corosync built-in features: dbus monitoring watchdog augeas systemd xmlconf vqsim nozzle snmp pie relro bindnow Jan 30 08:21:43 [7] controller1 corosync warning [MAIN ] Could not increase RLIMIT_MEMLOCK, not locking memory: Operation not permitted (1) Jan 30 08:21:43 [7] controller1 corosync notice [TOTEM ] Initializing transport (Kronosnet). Jan 30 08:21:44 [7] controller1 corosync info [TOTEM ] kronosnet crypto initialized: aes256/sha384 Jan 30 08:21:44 [7] controller1 corosync info [TOTEM ] totemknet initialized Jan 30 08:21:44 [7] controller1 corosync info [KNET ] common: crypto_nss.so has been loaded from /usr/lib/x86_64-linux-gnu/kronosnet/crypto_nss.so Jan 30 08:21:44 [7] controller1 corosync notice [SERV ] Service engine loaded: corosync configuration map access [0] Jan 30 08:21:44 [7] controller1 corosync info [QB ] server name: cmap Jan 30 08:21:44 [7] controller1 corosync error [QB ] Could not bind AF_UNIX (): Address already in use (98) Jan 30 08:21:44 [7] controller1 corosync info [QB ] withdrawing server sockets Jan 30 08:21:44 [7] controller1 corosync error [MAIN ] Can't initialize IPC Jan 30 08:21:44 [7] controller1 corosync error [SERV ] Service engine 'corosync_cmap' failed to load for reason 'qb_ipcs_run error' Jan 30 08:21:44 [7] controller1 corosync error [MAIN ] Corosync Cluster Engine exiting with status 20 at service.c:356. Regards Tony Karera

1 0

Re: [all][stable][ptl] Propose to EOL Rocky series
by Thomas Goirand 28 Jan '23

28 Jan '23

Hi, I understand the gate is broken, however, Rocky is in Debian LTS, and I would like to keep the possibility to merge patches, even with the gate tests disabled. CVE-2022-47951 is an example why this is important... Thomas Goirand (zigo) On Jan 28, 2023 11:54, Radosław Piliszek <radoslaw.piliszek(a)gmail.com> wrote: > > Masakari is happy to EOL Rocky too. > > Radek > -yoctozepto > > On Fri, 27 Jan 2023 at 20:59, Jay Faulkner <jay(a)gr-oss.io> wrote: > > > > Thanks for doing all this cleanup work Elod. Ironic is OK with retirements of these shared resources up to Train. > > > > - > > Jay Faulkner > > > > On Fri, Jan 27, 2023 at 10:12 AM Elõd Illés <elod.illes(a)est.tech> wrote: > >> > >> Hi, > >> > >> Similarly like the Queens branch EOL proposal [1] I would like to propose > >> to transition every project's stable/rocky to End of Life: > >> > >> - gates are mostly broken > >> - minimal number of activity can be seen on this branch > >> - some core projects already transitioned their stable/rocky to EOL > >> recently (like ironic, neutron, nova) > >> - gate job definitions are still using the old, legacy zuul syntax > >> - gate jobs are based on Ubuntu Xenial, which is also beyond its public > >> maintenance window date and hard to maintain > >> > >> Based on the above, if there won't be any project who wants to keep open > >> their stable/rocky, then I'll start the process of EOL'ing Rocky stable > >> series as a whole. If anyone has any objection then please respond to > >> this mail. > >> > >> Thanks, > >> > >> Előd Illés > >> irc: elodilles @ #openstack-stable / #openstack-release > >> > >> [1] https://lists.openstack.org/pipermail/openstack-discuss/2022-October/031030… > >> >

1 0

Pulling plugins from my Github repository
by vincent lee 28 Jan '23

28 Jan '23

Hi everyone, I would like to know where exactly I can replace the path for the GitHub repository. For example, I want to pull some plugins, such as zun_ui, blazar_dashboard, etc., from my own GitHub repository instead of the default GitHub repository. I am currently using Kolla-ansible for deploying OpenStack in the yoga version. Best, Vincent

1 0

[all][tc] What's happening in Technical Committee: summary 2023 Jan 27: Reading: 5 min
by Ghanshyam Mann 28 Jan '23

28 Jan '23

Hello Everyone, Here is this week's summary of the Technical Committee activities. 1. TC Meetings: ============ * We had this week's meeting on Jan 25. Most of the meeting discussions are summarized in this email. Meeting logs are available @ https://meetings.opendev.org/meetings/tc/2023/tc.2023-01-25-16.00.log.html * The next TC weekly meeting will be on Feb 1 Wed at 16:00 UTC, Feel free to add the topic to the agenda[1] by Jan 31. 2. What we completed this week: ========================= * Added Axel to Mistral project DPL list[2] * Remaining two projects (Mistral and Zaqar) which were less active (their release was in question) are green and active now. Their beta releases are also completed[3][4][5][6]. 3. Activities In progress: ================== TC Tracker for the 2023.1 cycle ------------------------------------- * Current cycle working items and their progress are present in the 2023.1 tracker etherpad[7]. Open Reviews ----------------- * Two open reviews for ongoing activities[8]. Cleanup of PyPI maintainer list for OpenStack Projects ---------------------------------------------------------------- The audit process is going on and a few projects have been completed [9]. There is a discussion also going on in ML[10]. The TC discussed it in this week's meeting also and no change in the initial plan for the cleanup of additional PyPi maintainers. The process to find the less active projects early in the cycle: ------------------------------------------------------------------------ I think in every cycle we get some less active projects and that is too little late in the cycle which adds extra work for the release team to release such projects. We discussed in PTG that TC should come up with some process to find such less active projects a little early in the cycle. JayF started the etherpad to collect the data and define the criteria to help in this process[11]. Project updates ------------------- * Add Cinder Huawei charm[12] * Add the woodpecker charm to Openstack charms[13] 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[14]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15:00 UTC [15] 3. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Agenda_Suggesti… [2] https://review.opendev.org/c/openstack/governance/+/871302 [3] https://review.opendev.org/c/openstack/releases/+/869470 [4] https://review.opendev.org/c/openstack/releases/+/869448 [5] https://review.opendev.org/c/openstack/zaqar/+/857924 [6] https://review.opendev.org/c/openstack/releases/+/871399 [7] https://etherpad.opendev.org/p/tc-2023.1-tracker [8] https://review.opendev.org/q/projects:openstack/governance+status:open [9] https://etherpad.opendev.org/p/openstack-pypi-maintainers-cleanup [10] https://lists.openstack.org/pipermail/openstack-discuss/2023-January/031848… [11] https://etherpad.opendev.org/p/project-health-check [12] https://review.opendev.org/c/openstack/governance/+/867588 [13] https://review.opendev.org/c/openstack/governance/+/869752 [14] hhttp://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [15] http://eavesdrop.openstack.org/#Technical_Committee_Meeting -gmann

1 0

[kolla] [senlin] [xena] Self-signed cert errors during Senlin auth
by Rob Jefferson 28 Jan '23

28 Jan '23

Folks, I am deploying OpenStack Xena via Kolla. As part of improving our orchestration offerings, I am investigating the use of Senlin in our deployments. Using `enable_senlin: "yes"`, the containers install as expected. When I attempt to create an initial profile, I get the following error: > HttpException: 500: Server Error for url: https://external:8778/v1/profiles, > Could not find versioned identity endpoints when attempting to authenticate. > Please check that your auth_url is correct. SSL exception connecting > to https://internal:35357: HTTPSConnectionPool(host='internal', > port=35357): Max retries exceeded with url: / (Caused by > SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] > certificate verify failed: self signed certificate in > certificate chain (_ssl.c:1131)'))) I have tried setting `verify_ssl = False` in senlin.conf, but no dice. I don't see this issue on the other services for which we're using the same certificates (e.g., Heat, Keystone, Barbican). Looking in the containers, I don't see <service>-cert.pem or <service>-key.pem files for Senlin as I did for other services. Moreover, the authentication configurations look the same in all relevant respects, between Senlin and the services that do work. I'm positively flummoxed about why the certs aren't getting distributed. When I take a look at the documentation for Kolla TLS [1], I saw the following: > Enabling TLS on the backend services secures communication between the > HAProxy listing on the internal/external VIP and the OpenStack > services. It also enables secure end-to-end communication between > OpenStack services that support TLS termination. The OpenStack services > that support backend TLS termination in Victoria are: Nova, Ironic, > Neutron, Keystone, Glance, Heat, Placement, Horizon, Barbican, and > Cinder. Missing from here is Senlin, and looking at the same document from subsequent OpenStack releases suggests this hasn't changed. I don't know if this is a relevant issue to the problem I've been having (to be fair, I don't see Octavia, which we've also been using, on the list, even though we also haven't been having issues with Octavia certs). Is this something that I can fix via configuration, or is this a thing wherein we need to change how Kolla deploys Senlin, or even adding in SSL termination to the Senlin service? Any help on this would be greatly appreciated. Thanks, Rob [1] https://github.com/openstack/kolla-ansible/blob/stable/xena/doc/source/admi…

1 0

[Openstack][cinder] multiple backend generic volume group issue
by Ignazio Cassano 28 Jan '23

28 Jan '23

Hello All, I created a cinder configuration using multiple backends based on netapp ontap nfs with the same backend name and the same volume type. So my nfsgold1, nfsgold2 and nfsgold3 are addressed by the nfsgold volume backend name and nfsgold volume type. Each one has its own svm on netapp. This help me to distribute nfsgold volumes using scheduler filters based on free capacity. So when I create a volume with volume type nfsgold the scheduler allocates it on nfsgold1 or nfsgold2 or nfsgold3 using the capacity filter. Since some virtual machines need to have volumes on the same backend (for example nfsgold1) because they belong to the same application, I use the cinder scheduler hint. Why I need to store those volumes on the same backend? It is because they must belong to the same generic volume group for snaphotting at the same time. For this reason I need to create a generic volume group. Generic volume group creation need the volume type, in my case nfsgold. But like the volume, when I create a generic volume group, it is scheduled on nfsgold1 or nfsgold2 or nfsgold3 and it is obvious looking in the cinder database. So if I want to groups volumes of an application I must: 1 check if they are on the same backend (nfsgold1/nfsgold2/nfsgold3) 2) check on which backend the volume group is allocated (nfsgold1,/nfsgold2/nfsgold3) and it can be done only looking in the cinder database). Volumes and volume goups must stay on the same real backend. If not, when I create a group snapshot, it gives some errors because it checks the host related to the real backend (nfsgold1/nfsgold2/nfsgold3) and returns errors failing the operation. When I create a volume group by api or by command line, I must specify the volume type but I cannot know which is the real backend associated to it without looking in the cinder database. I think this is a bug. In the above situation, how can obtain consistent volume group snapshot ? Sorry for my bad english. I hope who is reading can understand what I mean. Ignazio

1 0

[openstack-ansible] Meeting on 31st of January 2023 is cancelled
by Dmitriy Rabotyagov 28 Jan '23

28 Jan '23

Hi everyone, Due to limited availability of core members for the upcoming meeting that should have taken place on 31.01.2023, I'm informing you that this meeting will be cancelled. Hoping to see everyone for the next meeting on 7th of February.

1 0

[release] Release countdown for week R-7, Jan 30 - Feb 03
by Elõd Illés 28 Jan '23

28 Jan '23

Development Focus ----------------- We are entering the last weeks of the 2023.1 Antelope development cycle. From now until the final release, we'll send a countdown email like this every week. It's probably a good time for teams to take stock of their library and client work that needs to be completed yet. The non-client library freeze is coming up, followed closely by the client lib freeze. Please plan accordingly to avoid any last minute rushes to get key functionality in. General Information ------------------- Next week is the Extra-ATC freeze, in preparation for elections. All contributions to OpenStack are valuable, but some are not expressed as Gerrit code changes. Please list active contributors to your project team who do not have a code contribution this cycle, and therefore won't automatically be considered an Active Technical Contributor and allowed to vote. This is done by adding extra-atcs to https://opendev.org/openstack/governance/src/branch/master/reference/projec… before the Extra-ATC freeze on February 2nd, 2023. A quick reminder of the upcoming freeze dates. Those vary depending on deliverable type: * General libraries (except client libraries) need to have their last feature release before Non-client library freeze (February 9th, 2023). Their stable branches are cut early. * Client libraries (think python-*client libraries) need to have their last feature release before Client library freeze (February 16th, 2023) * Deliverables following a cycle-with-rc model (that would be most services) observe a Feature freeze on that same date, February 16th, 2023. Any feature addition beyond that date should be discussed on the mailing-list and get PTL approval. After feature freeze, cycle-with-rc deliverables need to produce a first release candidate (and a stable branch) before RC1 deadline (March 2nd, 2023) * Deliverables following cycle-with-intermediary model can release as necessary, but in all cases before Final RC deadline (March 16th, 2023) Finally, now is also a good time to start planning what highlights you want for your deliverables in the cycle highlights. The deadline to submit an initial version for those is set to Feature freeze (February 16th, 2023). Background on cycle-highlights: http://lists.openstack.org/pipermail/openstack-dev/2017-December/125613.html Project Team Guide, Cycle-Highlights: https://docs.openstack.org/project-team-guide/release-management.html#cycle… knelson [at] openstack.org/diablo_rojo on IRC is available if you need help selecting or writing your highlights Upcoming Deadlines & Dates -------------------------- Extra-ATC freeze: February 2nd, 2023 (R-7 week) Non-client library freeze: February 9th, 2023 (R-6 week) Client library freeze: February 16th, 2023 (R-5 week) Antelope-3 milestone: February 16th, 2023 (R-5 week) 2023.2 Bobcat Virtual PTG: March 27-31, 2023 Előd Illés irc: elodilles @ #openstack-release

1 0

cloud dcn01 (edge) not found in External Deployment Post deployment Tasks | tripleo | wallaby | centos 8 stream
by Swogat Pradhan 27 Jan '23

27 Jan '23

Hi, I am trying to deploy DCN and in the final step getting the following error: 2023-01-27 18:31:10.843012 | 48d539a1-1679-1cbd-45d5-0000000000fe | TASK | Nova: Manage aggregate and availability zone and add hosts to the zone Using module file /usr/lib/python3.6/site-packages/ansible/modules/cloud/openstack/os_nova_host_aggregate.py Pipelining is enabled. <localhost> ESTABLISH LOCAL CONNECTION FOR USER: stack <localhost> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-bhcwyaeoxhaczfutgazdvosyznxmddwq ; OS_CLOUD=dcn01 /usr/bin/python3'"'"' && sleep 0' The full traceback is: File "/tmp/ansible_os_nova_host_aggregate_payload_uur0b1qu/ansible_os_nova_host_aggregate_payload.zip/ansible/module_utils/openstack.py", line 159, in openstack_cloud_from_module interface=module.params['interface'], File "/usr/lib/python3.6/site-packages/openstack/__init__.py", line 63, in connect options=options, **kwargs) File "/usr/lib/python3.6/site-packages/openstack/config/__init__.py", line 36, in get_cloud_region return config.get_one(options=parsed_options, **kwargs) File "/usr/lib/python3.6/site-packages/openstack/config/loader.py", line 1107, in get_one config = self._get_base_cloud_config(cloud, profile) File "/usr/lib/python3.6/site-packages/openstack/config/loader.py", line 509, in _get_base_cloud_config name=name)) 2023-01-27 18:31:14.137975 | 48d539a1-1679-1cbd-45d5-0000000000fe | FATAL | Nova: Manage aggregate and availability zone and add hosts to the zone | undercloud | error={ "changed": false, "invocation": { "module_args": { "api_timeout": null, "auth": null, "auth_type": null, "availability_zone": "dcn01", "ca_cert": null, "client_cert": null, "client_key": null, "hosts": [ "dcn01-hci-0.bdxworld.com", "dcn01-hci-1.bdxworld.com", "dcn01-hci-2.bdxworld.com" ], "interface": "public", "metadata": null, "name": "dcn01", "region_name": null, "state": "present", "timeout": 180, "validate_certs": null, "wait": true } }, "msg": "Cloud dcn01 was not found." } 2023-01-27 18:31:14.139916 | 48d539a1-1679-1cbd-45d5 Deploy step: (undercloud) [stack@hkg2director dcn01]$ cat deploy_dcn01.sh #!/bin/bash THT=/usr/share/openstack-tripleo-heat-templates/ CNF=/home/stack/ openstack overcloud deploy \ --stack dcn01 \ --templates $THT \ -r $CNF/dcn01/dcn01_roles.yaml \ -n $CNF/dcn01/custom_network_data.yaml \ -e $CNF/dcn01/node-info.yaml \ -e $CNF/dcn01/scheduler-hints.yaml \ -e $CNF/dcn01/overcloud-networks-deployed.yaml \ -e $CNF/dcn01/vip-deployed-environment.yaml \ -e ~/containers-prepare-parameter.yaml \ -e $THT/environments/services/neutron-ovn-dvr-ha.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/podman.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/dcn-storage.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/cephadm-rbd-only.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/nova-az-config.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/services/etcd.yaml \ -e $CNF/dcn01/dcn01_overcloud-baremetal-deployed.yaml \ -e $CNF/dcn01/glance_dcn01.yaml \ -e $CNF/dcn01/deployed_ceph.yaml \ -e $CNF/dcn01/dcn01_parameters.yaml \ -e $CNF/dcn01/overcloud-export.yaml \ -e $CNF/dcn01/clouddomain.yaml \ --ntp-server 172.25.201.68 -vv Can you please tell me what this issue could be? How to fix it? With regards, Swogat Pradhan

1 0

[neutron] Neutron drivers meeting
by Rodolfo Alonso Hernandez 27 Jan '23

27 Jan '23

Hello Neutrinos: This is just a reminder of the meeting we have today at 1400UTC. Please check today's agenda: https://wiki.openstack.org/wiki/Meetings/NeutronDrivers See you in IRC.

1 0

OpenInfra Live - Jan. 26 at 9 am CT / 15:00 UTC
by Kristin Barrientos 26 Jan '23

26 Jan '23

Hi everyone, This week’s OpenInfra Live episode is brought to you by the OpenStack Large Scale SIG. Episode: In the "Large Scale Ops Deep Dive" series, a panel of OpenStack operators invites special guests to talk about their deployment and discuss their operations. For this episode, our guests will be Benjamin Fuhrmann and Stanislav Dmitriev from Ubisoft, the famous video game publisher. Date and time: Jan. 26 at 9 a.m. CT (15:00 UTC) You can watch us live on: YouTube: https://youtu.be/H1DunJM1zoc <https://youtu.be/r8WLM9TM6w4> LinkedIn: https://www.linkedin.com/video/event/urn:li:ugcPost:7017187840652427264/ <https://www.linkedin.com/video/event/urn:li:ugcPost:7004177126690017280/> Facebook: https://www.facebook.com/events/835737927534901 <http://www.facebook.com/events/862505974941677> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Benjamin Fuhrmann, Stanislav Dmitriev, Felix Huettner, Arnaud Morin and Thierry Carrez Have an idea for a future episode? Share it now at ideas.openinfra.live. Thanks, Kristin Barrientos Marketing Coordinator OpenInfra Foundation

1 0

[oslo][ironic] oslo.service (and IPA) TLS v1.3
by Jay Faulkner 26 Jan '23

26 Jan '23

Hey all, Ironic Python Agent uses oslo.service's wsgi module as a wsgi server, with the built in TLS support from sslutils.py. This sslutils.py support only works up to TLS v1.2. It needs some enhancement. It was indicated to me in #openstack-oslo that there's nobody working on this module currently. I know that Ironic can't be the only consumer of this across OpenStack, so this is a call for interested parties and help. We have to update this to support modern TLS. It's not an option. I'd rather not do it alone -- who wants to help? I was tempted to put something up about this at the PTG; but I'm not sure it's significant enough to be worth that discussion so I'm starting here :). Thanks, Jay Faulkner Ironic PTL

2 1

[cinder] Bug Report from 01-25-2023
by Sofia Enriquez 25 Jan '23

25 Jan '23

This is a bug report from 01-18-2022 to 01-25-2023. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Medium - https://bugs.launchpad.net/cinder/+bug/2003804 "Group actions enable, disable and failover replication can leave volume's replication status in transient states enabling, disabling and failing-over respectively." Fix proposed to master. Wishlist - https://bugs.launchpad.net/cinder/+bug/2003300 "[SVf] : Enable support for replication volume with mirror pool option." Fix proposed to master. Opinion - https://bugs.launchpad.net/cinder/+bug/2003245 "[HPE] cinder 3par FC driver not connecting to 3PAR storage." -- Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[kolla-ansible] TASK [Link kolla_logs volume to /var/log/kolla] error after changing docker directory
by A Monster 25 Jan '23

25 Jan '23

THis occurred after I changed the default docker directory from /var/lib/docker to /custom_path because the /var partition's size is not sufficient TASK [common : Link kolla_logs volume to /var/log/kolla] ********************************************************************************************************************************************************** fatal: [Storage]: FAILED! => {"changed": false, "msg": "src file does not exist, use \"force=yes\" if you really want to create the link: /var/lib/docker/volumes/kolla_logs/_data", "path": "/var/log/kolla", "src": "/var/lib/docker/volumes/kolla_logs/_data"} knowing that the changes I made are for only this specific node, the default docker directory is used for the others, so is there a custom configuration I could do in globals.yml file, or add in a custom config file or is it that it's not possible to use custom working directories for docker?

1 0

Live Snapshot ERROR
by Kaiser Wassilij 25 Jan '23

25 Jan '23

Hi, I want to take a Live-snapshot. The instances are not switched off. Ubuntu 20.04 # Ansible managed DISTRIB_ID="OSA" DISTRIB_RELEASE="25.2.0" DISTRIB_CODENAME="Yoga" DISTRIB_DESCRIPTION="OpenStack-Ansible" nova-25.0.2.dev8.dist-info Compiled against library: libvirt 8.0.0 Using library: libvirt 8.0.0 Using API: QEMU 8.0.0 Running hypervisor: QEMU 4.2.1 ii apparmor 2.13.3-7ubuntu5.1 amd64 user-space parser utility for AppArmor I've also Adjusted virt-aa-helper: #include <tunables/global> profile virt-aa-helper /usr/lib/libvirt/virt-aa-helper flags=(complain) { #include <abstractions/base> #include <abstractions/openssl> # needed for searching directories capability dac_override, capability dac_read_search, # needed for when disk is on a network filesystem network inet, network inet6, deny @{PROC}/[0-9]*/mounts r, @{PROC}/[0-9]*/net/psched r, owner @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, # Used when internally running another command (namely apparmor_parser) @{PROC}/@{pid}/fd/ r, # allow reading libnl's classid file /etc/libnl{,-3}/classid r, # for gl enabled graphics /dev/dri/{,*} r, # for hostdev /sys/devices/ r, /sys/devices/** r, /sys/bus/usb/devices/ r, deny /dev/sd* r, deny /dev/vd* r, deny /dev/dm-* r, deny /dev/drbd[0-9]* r, deny /dev/dasd* r, deny /dev/nvme* r, deny /dev/zd[0-9]* r, deny /dev/mapper/ r, deny /dev/mapper/* r, /usr/lib/libvirt/virt-aa-helper mr, /{usr/,}sbin/apparmor_parser Ux, /etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools audit deny @{HOME}/.* mrwkl, audit deny @{HOME}/.*/ rw, audit deny @{HOME}/.*/** mrwkl, audit deny @{HOME}/bin/ rw, audit deny @{HOME}/bin/** mrwkl, @{HOME}/ r, @{HOME}/** r, /var/lib/libvirt/images/ rw, /var/lib/libvirt/images/** rw, # nova base images (LP: #907269 https://bugs.launchpad.net/bugs/907269 ) /var/lib/nova/images/** rw, /var/lib/nova/instances/_base/** rw, # nova snapshots (LP: #1244694 https://bugs.launchpad.net/bugs/1244694 ) /var/lib/nova/instances/snapshots/** rw, } Filesystem: OCFS2 [keystone_authtoken] insecure = False auth_type = password auth_url = www_authenticate_uri = project_domain_id = default user_domain_id = default project_name = service username = nova password = region_name = RegionOne service_token_roles_required = False service_token_roles = service service_type = compute memcached_servers = token_cache_time = 300 [libvirt] inject_partition = -2 inject_password = False inject_key = False virt_type = kvm live_migration_with_native_tls = true live_migration_scheme = tls live_migration_inbound_addr = xxx.xxx.xxx.xxx hw_disk_discard = ignore disk_cachemodes = iscsi_use_multipath = True Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -r -u libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74) unexpected exit status 1: 2023-01-25 09:46:07.871+0000: 376129: info : libvirt version: 8.0.0, package: 1ubuntu7.1~cloud0 (Openstack Ubuntu Testing Bot <openstack-testing-bot(a)ubuntu.com> Wed, 25 May 2022 14:51:12 +0000) 2023-01-25 09:46:07.871+0000: 376129: info : hostname: bc2bl13 2023-01-25 09:46:07.871+0000: 376129: error : virDomainDiskDefMirrorParse:8800 : unsupported configuration: unknown mirror job type '' virt-aa-helper: error: could not parse XML virt-aa-helper: error: could not get VM definition Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: cannot update AppArmor profile 'libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74' Jan 25 09:46:07 bc2bl13 libvirtd[154472]: Unable to restore security label on /var/lib/nova/instances/snapshots/tmpej9y72fr/c8d4bb94296746d6bff6b747386b4a90.delta

1 0

Live Snapshot
by Kaiser Wassilij 25 Jan '23

25 Jan '23

Hi, I want to take a Live-snapshot. The instances are not switched off. Ubuntu 20.04 # Ansible managed DISTRIB_ID="OSA" DISTRIB_RELEASE="25.2.0" DISTRIB_CODENAME="Yoga" DISTRIB_DESCRIPTION="OpenStack-Ansible" nova-25.0.2.dev8.dist-info Compiled against library: libvirt 8.0.0 Using library: libvirt 8.0.0 Using API: QEMU 8.0.0 Running hypervisor: QEMU 4.2.1 ii apparmor 2.13.3-7ubuntu5.1 amd64 user-space parser utility for AppArmor I've also Adjusted virt-aa-helper: #include <tunables/global> profile virt-aa-helper /usr/lib/libvirt/virt-aa-helper flags=(complain) { #include <abstractions/base> #include <abstractions/openssl> # needed for searching directories capability dac_override, capability dac_read_search, # needed for when disk is on a network filesystem network inet, network inet6, deny @{PROC}/[0-9]*/mounts r, @{PROC}/[0-9]*/net/psched r, owner @{PROC}/[0-9]*/status r, @{PROC}/filesystems r, # Used when internally running another command (namely apparmor_parser) @{PROC}/@{pid}/fd/ r, # allow reading libnl's classid file /etc/libnl{,-3}/classid r, # for gl enabled graphics /dev/dri/{,*} r, # for hostdev /sys/devices/ r, /sys/devices/** r, /sys/bus/usb/devices/ r, deny /dev/sd* r, deny /dev/vd* r, deny /dev/dm-* r, deny /dev/drbd[0-9]* r, deny /dev/dasd* r, deny /dev/nvme* r, deny /dev/zd[0-9]* r, deny /dev/mapper/ r, deny /dev/mapper/* r, /usr/lib/libvirt/virt-aa-helper mr, /{usr/,}sbin/apparmor_parser Ux, /etc/apparmor.d/libvirt/* r, /etc/apparmor.d/libvirt/libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, # for backingstore -- allow access to non-hidden files in @{HOME} as well # as storage pools audit deny @{HOME}/.* mrwkl, audit deny @{HOME}/.*/ rw, audit deny @{HOME}/.*/** mrwkl, audit deny @{HOME}/bin/ rw, audit deny @{HOME}/bin/** mrwkl, @{HOME}/ r, @{HOME}/** r, /var/lib/libvirt/images/ rw, /var/lib/libvirt/images/** rw, # nova base images (LP: #907269 https://bugs.launchpad.net/bugs/907269 ) /var/lib/nova/images/** rw, /var/lib/nova/instances/_base/** rw, # nova snapshots (LP: #1244694 https://bugs.launchpad.net/bugs/1244694 ) /var/lib/nova/instances/snapshots/** rw, } Filesystem: OCFS2 [keystone_authtoken] insecure = False auth_type = password auth_url = www_authenticate_uri = project_domain_id = default user_domain_id = default project_name = service username = nova password = region_name = RegionOne service_token_roles_required = False service_token_roles = service service_type = compute memcached_servers = token_cache_time = 300 [libvirt] inject_partition = -2 inject_password = False inject_key = False virt_type = kvm live_migration_with_native_tls = true live_migration_scheme = tls live_migration_inbound_addr = xxx.xxx.xxx.xxx hw_disk_discard = ignore disk_cachemodes = iscsi_use_multipath = True Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: Child process (LIBVIRT_LOG_OUTPUTS=3:stderr /usr/lib/libvirt/virt-aa-helper -r -u libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74) unexpected exit status 1: 2023-01-25 09:46:07.871+0000: 376129: info : libvirt version: 8.0.0, package: 1ubuntu7.1~cloud0 (Openstack Ubuntu Testing Bot <openstack-testing-bot(a)ubuntu.com> Wed, 25 May 2022 14:51:12 +0000) 2023-01-25 09:46:07.871+0000: 376129: info : hostname: bc2bl13 2023-01-25 09:46:07.871+0000: 376129: error : virDomainDiskDefMirrorParse:8800 : unsupported configuration: unknown mirror job type '' virt-aa-helper: error: could not parse XML virt-aa-helper: error: could not get VM definition Jan 25 09:46:07 bc2bl13 libvirtd[154472]: internal error: cannot update AppArmor profile 'libvirt-c6aa0368-8ae5-4fe4-8ae5-93a92329aa74' Jan 25 09:46:07 bc2bl13 libvirtd[154472]: Unable to restore security label on /var/lib/nova/instances/snapshots/tmpej9y72fr/c8d4bb94296746d6bff6b747386b4a90.delta

1 0

Retiring untested and unmaintained modules (murano, rally and tacker)
by Takashi Kajinami 25 Jan '23

25 Jan '23

Hello, In Puppet OpenStack projects we have multiple modules to support multiple OpenStack components. However unfortunately some of these have not been attracting enough interest from developers and have been unmaintained. During the past few cycles we retired a few incomplete modules but I'm wondering if we can retire a few unmaintained modules now, to reduce our maintenance/release effort. I checked the modules we have currently, and I think the following three can be first candidates. - puppet-murano - puppet-rally - puppet-tacker We haven't seen any feedback from users about these modules for a long time. Most of the changes for the past 2~3 years are proposed by me but I am not really using these components. These modules do not have proper test coverage and it's quite difficult for us to catch any breakage and honestly I'm not quite sure these modules can work properly with the latest code. Actually we've often caught up with the latest requirements several years after the change was made in the software side, and I'm afraid these are not well-maintained. eg. - support for tacker-conductor was added 4 years after the service was added - we didn't noticed that the openstack plugin was split out from the core rally package for several years If anybody has concerns with retiring these modules, then please let us know. If we don't hear any objections for a while, then I'll start proposing changes for project retirement. Thank you, Takashi -- ---------- Takashi Kajinami

1 1

[all][tc] Technical Committee next weekly meeting on 2023 Jan 25 at 1600 UTC
by Ghanshyam Mann 25 Jan '23

25 Jan '23

Hello Everyone, The technical Committee's next weekly meeting is scheduled for 2023 Jan 25, at 1600 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Tuesday, Jan 24 at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

openstack client integration to fetch and provide OIDC access tokens (v3oidcaccesstoken)?
by Christian Rohmann 25 Jan '23

25 Jan '23

Hey openstack-discuss, while there is support for OpenID Connect and its various flows in the openstack client (https://docs.openstack.org/python-openstackclient/latest/cli/man/openstack.…) I would like to have the user authenticate only with central IdP login via a web page and then receive an access token and not have each user's openstack cli be a full OIDC client handling credentials and authenticating against the IdP via the users password itself. The tricky bit here is having good tooling for users to authenticate via the existing SSO and then to get and refresh tokens which are then fed to the openstack CLI. I was wondering if anybody knows of some nice integrations / plugins / hooks to make it easy for users to deal with the authentication (usually via some web site) and then to inject the token (v3oidcaccesstoken) into openstack-cli? I found that Fedcloud.eu (https://www.fedcloud.eu/) does something like this (see https://fedcloudclient.fedcloud.eu/usage.html#authentication) via OIDC-Agent. But most platforms making use of OIDC seem to configure the openstack client with client_id and secret and have it authenticate directly with the IdP. Regards, Christian

3 5

podman manifest error | status 404 | openstack wallaby
by Swogat Pradhan 25 Jan '23

25 Jan '23

Hi, I am currently trying DCN for my openstack and when running the deployment command for the edge site i am getting the following error: FATAL | Pre-fetch all the containers | dcn01-hci-0 | item= 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo | error={"ansible_loop_var": "prefetch_image", "changed": false, "msg": "Failed to pull image 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo", "prefetch_image": " 172.25.201.68:8787/tripleomaster/openstack-etcd:current-tripleo"} Can someone please guide me on how to fix this issue? With regards, Swogat Pradhan

1 0

[Glance] No weekly meeting this week
by Pranali Deore 24 Jan '23

24 Jan '23

Hello, Thursday, 26th Jan is public holiday in India and almost half of the team will not be around, so cancelling glance weekly meeting for this week. Thanks & Regards, Pranali

1 0

[horizon][xstatic] xstatic-font-awesome and xstatic-jquery.tablesorter leaving OpenStack
by Radomir Dopieralski 24 Jan '23

24 Jan '23

Hi everyone, a few years ago we have a adopted under the OpenStack umbrella a number of xstatic packages used by Horizon and its plugins, because they seemed to be unmaintained at the time, and we needed to keep them secure. A few weeks ago one of those packages, xstatic-font-awesome, got a new release by its original authors – the good people at the MoinMoin Wiki project, where the XStatic mechanism originated. That surprised us a little, and raised some concerns, since the release wasn't done using the OpenStack process, so we reached out to clear this situation. After discussion, we have decided to remove two xstatic packages: xstatic-font-awesome and xstatic-jquery.tablesorter from the OpenStack repositories and let them be maintained by the MoinMoin Wiki contributors instead, together with many other xstatic packages they use, so that there is no more confusion about who is responsible for them. We will continue to use pinned versions of those packages in Horizon, but we will no longer keep them as part of the OpenStack project. We will start the retirement process on the repositories for those packages shortly. -- Radomir Dopieralski

1 0

[charms] Release of charmhub Openstack dedicated ussuri, victoria, wallaby for Ubuntu 20.04 (focal) LTS
by Alex Kavanagh 24 Jan '23

24 Jan '23

Hello As the charm-guide [1] explains, OpenStack, Ceph, OVN and supporting charms moved from a single stable charm (for each OpenStack component) that supported multiple OpenStack releases, to individual tracks that each targets a specific release [2]. The current Zed release also recently [6] became stable. Today, we have (re)released updated individual charms to the ussuri/stable, victoria/stable and wallaby/stable tracks. These are derived from the stable 21.10 charms (that supported queens -> xena). We have also released the Ceph octopus/stable track to support ussuri and victoria, and the existing Ceph pacific (which was already stable) that supports wallaby (and xena). The full list of charms for the Xena, Victoria and Wallaby OpenStack systems, includiong Ceph, OVN, mysql8, hacluster, rabbitmq-server, vault and others can be seen in the docs at [3]. The ussuri, victoria, wallaby, and xena tracks have been designed to be upgradable from the 21.10 charms if you are running the associated OpenStack version, but please do read the docs [4] about how to go about upgrading charms. The relevant track (e.g. victoria/stable) is also able to upgrade from the previous version. Please again consult the docs [5] for upgrading advice. This was a significant piece of work by all those involved, so many, many thanks to all who contributed and made this happen! Thanks! [1] https://docs.openstack.org/charm-guide/latest/project/charm-delivery.html [2] https://juju.is/docs/olm/deploy-a-charm-from-charmhub#heading--specify-a-ch… [3] https://docs.openstack.org/charm-guide/latest/project/charm-delivery.html#c… [4] https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/late… [5] https://docs.openstack.org/project-deploy-guide/charm-deployment-guide/late… [6] https://lists.openstack.org/pipermail/openstack-discuss/2023-January/031872… -- Alex Kavanagh OpenStack Engineering - Canonical Ltd

1 0

[neutron] CI meeting 24.01.2023 cancelled
by Slawek Kaplonski 24 Jan '23

24 Jan '23

Hi, Due to overlapping internal meeting this week I will not be able to chair neutron ci meeting. There is nothing critical to discuss there so with Rodolfo we decided to cancel that meeting this week. See You all on the CI meeting next week. -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0