- openstack-discuss - lists.openstack.org

[auto-scaling] SIG PTG schedule. please join us :)
by Rico Lin 01 Nov '19

01 Nov '19

Hi all PTG is right next week, so if you're interested in Auto-scaling features, please join us. Our session will be hosted on 11/6 for Half-day from 9:00 am to 12:30 pm in room 431. You can suggest PTG sessions in our etherpad: https://etherpad.openstack.org/p/PVG-auto-scaling-sig Feel free to join our IRC channel as well: #openstack-auto-scaling Also, you can check out our new documents for autoscaling: https://docs.openstack.org/auto-scaling-sig And provide any feedback/ bug report for any Auto-scaling issue related to OpenStack in https://storyboard.openstack.org/#!/project/openstack/auto-scaling-sig Here's my Wechat ID: RicoLinCloudGeek See you all in Shanghai! -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 2

[cinder][ptg] team dinner in Shanghai
by Brian Rosmaita 01 Nov '19

01 Nov '19

This event is open to anyone who will be in Shanghai on Thursday 7 November and who has a constructive interest in Cinder. I know we have a few contributors in Shanghai who won't be at the PTG; hopefully, they'll be able to join us so we can meet face-to-face. We're planning for a 5:00 pm dinner; it's kind of early, but the restaurant is a close walk from the Expo Center, so I figured it would be easier to go directly there instead of dispersing to our hotels and regrouping later. Plus, an early dinner will enable people to attend the (unofficial) Game Night [0]. Details and a signup sheet (we need a head count) are at the top of the Cinder PTG etherpad: https://etherpad.openstack.org/p/shanghai-ptg-cinder I haven't been able to confirm the time and location yet, but I will keep the above etherpad updated with that info. cheers, brian [0] https://etherpad.openstack.org/p/pvg-game-night

1 0

[cinder] changing the weekly meeting time
by Brian Rosmaita 01 Nov '19

01 Nov '19

(Just to be completely clear -- we're only gathering information at this point. The Cinder weekly meeting is still Wednesdays at 16:00 UTC.) As we discussed at today's meeting [0], a request has been made to hold the weekly meeting earlier so that it would be friendlier for people in Asia time zones. Based on the people in attendance today, it seems that a move to 14:00 UTC is not out of the question. Thus, the point of this email is to solicit comments on whether we should change the meeting time to 14:00 UTC. As you consider the impact on yourself, if you are in a TZ that observes Daylight Savings Time, keep in mind that most TZs go back to standard time over the next few weeks. (I was going to insert an opinion here, but I will wait and respond in this thread like everyone else.) cheers, brian [0] http://eavesdrop.openstack.org/meetings/cinder/2019/cinder.2019-10-23-16.00…

3 3

[ops] preliminary ops meetup proposal, jan 2020, London
by Chris Morgan 01 Nov '19

01 Nov '19

Please see https://twitter.com/osopsmeetup/status/1190365967106412544?s=20 We find this method of getting news out about operators meetups gets good engagement, so please also follow if of interest to you. Chris -- Chris Morgan <mihalis68(a)gmail.com>

1 0

[tripleo] TripleO CI Summary: Sprint 38
by Rafael Folco 01 Nov '19

01 Nov '19

Greetings, The TripleO CI team has just completed Sprint 38 / Unified Sprint 17 (Oct 10 thru Oct 30). The following is a summary of completed work during this sprint cycle: - Tested the temporary manifest implementation in the new promoter for not breaking promotion workflow. Issues to be bootstrapped in the next sprint. - Implemented CI jobs in zuul to build and run tests against ceph-ansible and podman pull requests in github. A PoC has been created to validate the usage of zuul-distro-jobs project for dealing with RPM builds. - Ceph-ansible: initial standalone job added to test pull requests - Podman: integration with RDO software factory is done - Closed-out Train release branching in both upstream and periodic realms as part of the mid-cycle technical debt. - Addressed required changes for building a CentOS8 node for upcoming distro release support across TripleO CI jobs. - All RDO third party and upstream multinode (master/train) jobs are now moved to os_tempest ansible role provided by Openstack-ansible team. - (Pushed to next sprint): Improve tests for verifying a full promotion workflow running on the staging environment. The planned work for the next sprint [1] are: - Evaluate and implement CI jobs in Zuul that deal with RPM build artifacts for ceph-ansible and podman 3rd party testing. - Design and create a PoC for individual component testing in the promotion pipeline. This effort will add an additional verification layer to check OpenStack components (compute, networking, storage, etc) with stable builds, and ease root cause determination when it breaks the code. - Continue to improve and fix the new promotion code by deploying and bootstrapping an isolated promoter server. The Ruck and Rover for this sprint are Sagi Shnaidman (sshnaidm) and Ronelle Landy (rlandy). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes are being tracked in etherpad [2]. Thanks, rfolco [1] https://tree.taiga.io/project/tripleo-ci-board/taskboard/unified-sprint-18 [2] https://etherpad.openstack.org/p/ruckroversprint18

1 0

[keystone] Federated users who wish to use CLI
by Jason Anderson 31 Oct '19

31 Oct '19

Hi all, I'm in the process of prototyping a federated Keystone using OpenID Connect, which will place ephemeral users in a group that has roles in existing projects. I was testing how it felt from the user's perspective and am confused how I'm supposed to be able to use the openstacksdk with federation. For one thing, the RC files I can download from the "API Access" section of Horizon don't seem like they work; the domain is hard-coded to "Federated", and it also uses a username/password authentication method. I can see that there is a way to use KSA to use an existing OIDC token, which I think is probably the most "user-friendly" way, but the user still has to obtain this token themselves out-of-band, which is not trivial. Has anybody else set this up for users who liked to use the CLI? Is the solution to educate users about creating application credentials instead? Thank you in advance, -- Jason Anderson Chameleon DevOps Lead Consortium for Advanced Science and Engineering, The University of Chicago Mathematics & Computer Science Division, Argonne National Laboratory

4 8

Permamently delete double / wrong openflow entry from br-tun bridge in OpenvSwitch
by Pawel Konczalski 31 Oct '19

31 Oct '19

Hi, i have a VM with ARP entries in both OpenVswitch bridges br-tun and br-int on the compute node where is it executed: ovs-ofctl dump-flows br-int | egrep "arp.*10.20.0.34" cookie=0x117c25cd8a3f96, duration=47029.368s, table=24, n_packets=20, n_bytes=840, priority=2,arp,in_port="qvod9cdff27-9c",arp_spa=10.20.0.34 actions=resubmit(,25) ovs-ofctl dump-flows br-tun | egrep "arp.*10.20.0.34" cookie=0x1597c76aa2fd74f2, duration=47015.961s, table=21, n_packets=0, n_bytes=0, priority=1,arp,dl_vlan=27,arp_tpa=10.20.0.34 ... 3e:42:af:1d,IN_PORT The unnecassary / faulty entry can by deleted manually from br-tun with: ovs-ofctl --strict del-flows br-tun "priority=1,arp,dl_vlan=27,arp_tpa=10.20.0.34" but after the port is shutdown and up again the entry will by recreated again. When the VM is moved to another compute node, only the br-int entry is created, moving back to the initial host creates both again. Any idea how to remove permamenty this br-tun entry? Thanks Pawel

1 0

[nova] No meeting during summit/PTG week
by Eric Fried 31 Oct '19

31 Oct '19

And that's all I have to say about that. https://wiki.openstack.org/wiki/Meetings/Nova#Agenda_for_next_meeting

1 0

[security] Security SIG Newsletter - Oct 31st 2019
by Gage Hugo 31 Oct '19

31 Oct '19

Hello everyone, Due to a hectic October, this newsletter will have the updates for the month. The SIG meetings for the 07th, 21st, and 28th in November will be cancelled as well due to Summit/PTG & Holidays. Have a Happy Halloween! #Date: 31 Oct 2019 - Security SIG Meeting Info: http://eavesdrop.openstack.org/#Security_SIG_meeting - Weekly on Thursday at 1500 UTC in #openstack-meeting - Agenda: https://etherpad.openstack.org/p/security-agenda - https://security.openstack.org/ - https://wiki.openstack.org/wiki/Security-SIG #Meeting Notes (October) - fungi volunteers to be nova spec liaison for ussuri image encryption spec in nova: http://eavesdrop.openstack.org/meetings/image_encryption/2019/image_encrypt… - The Security SIG won't be meeting on the following dates in November due to the Summit/PTG & Holidays - Nov 07th, Nov 21st, Nov 28th #VMT Reports - A full list of publicly marked security issues can be found here: https://bugs.launchpad.net/ossa/ - OSSA-2019-005 was released this month: https://security.openstack.org/ossa/OSSA-2019-005.html - ceph backend, secret key leak: https://bugs.launchpad.net/cinder/+bug/1849624 - CSV Injection Possible in Compute Usage History: https://bugs.launchpad.net/horizon/+bug/1842749

1 0

[tc][all][goal]: Ussuri community goal candidate 3: 'Consistent and secure default policies'
by Ghanshyam Mann 31 Oct '19

31 Oct '19

Hello Everyone, This is 3rd proposal candidate for the Ussuri cycle community-wide goal. The other two are [1]. Colleen proposed this idea for the Ussuri cycle community goal. Projects implemented/plan to implement this: *Keystone already implemented this with all necessary support in oslo.policy with nice documentation. * We discussed this in nova train PTG to implement it in nova [2]. Nova spec was merged in Train but could not implement. I have re-proposed the spec for the Ussuri cycle [3]. This is nice idea as a goal from the user perspective. Colleen has less bandwidth to drive this goal alone. We are looking for a champion or co-champions (1-2 people will be much better) this goal along with Colleen. Also, let us know what do you think of this as a community goal? Any query or Improvement Feedback? You can refer the detailed on etherpad or I am copying the same here too to get feedback/queries in each item. Existing policy defaults suffer from three major faults: #1: the admin-ness problem: use of policy rules like 'is_admin' or hard-coded is-admin checks results in the admin-anywhere-admin-everywhere problem and drastically inhibits true multitenancy since by default customers cannot have admin rights on their own projects or domains #2: insecure custom roles: many policy rules simply use "" as the rule, which means there is no rule: anyone can perform that action. This means creation of a custom role (say, "nova-autoscaler" requires editing every policy file across every service to block users with such a rule from performing actions unrelated to their role #3: related to #2, no support for read-only roles: keystone now has a "reader" role that comes out of the box when keystone is bootstrapped, but it currently has very little value because of the use of empty rules in service policies: users with the "reader" role can still perform write actions on services if the policy rule for such an action is empty. The keystone project has migrated all of its default policies to 1) use oslo.policy's scope_types attribute, which allows the policy engine to understand "system scope" and distinguish between an admin role assignment on a project versus an admin role assignment on the entire system, 2) ensure all rules use one of the default roles (admin, member, and reader) which both ensures support for a read-only role and prevents custom roles from accidental over-permissiveness. Although the problems being solved are slightly different, the keystone team found it was easiest to migrate everything at once. The rest of the OpenStack services can use this migration as a template for securing their own policies. [1] http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010287.… http://lists.openstack.org/pipermail/openstack-discuss/2019-October/010290.… [2] https://etherpad.openstack.org/p/ptg-train-xproj-nova-keystone [3] https://review.opendev.org/#/q/topic:bp/policy-defaults-refresh+(status:ope… -gmann

3 4

[SIGs][meta-sig] Encourage SIG Chairs to join `Meet the project leaders` opportunities in Shanghai
by Rico Lin 31 Oct '19

31 Oct '19

Dear SIG chairs There will be two `Meet the project leaders` event in Shanghai summit. And SIG chairs are definitely part of it. I'm here to encourage you to sign up [1] and join that event so people might get more chances to meet with you. They're scheduled on Monday marketplace mixer (5:30pm-7:00pm) and Wednesday lunch (12:20pm-1:40pm). [1] https://etherpad.openstack.org/p/meet-the-project-leaders -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 0

[openstack-dev][kuryr] Error in creating LB
by VeeraReddy 31 Oct '19

31 Oct '19

Hi, I am trying to install openstack & Kubernetes usingdevstack https://docs.openstack.org/kuryr-kubernetes/latest/installation/devstack/ba… ErrorLog : http://paste.openstack.org/show/785670/ Local.conf : http://paste.openstack.org/show/785671/ Regards, Veera.

1 0

[scientific-sig] OpenStack maintenance planning
by Sebastian Luna Valero 31 Oct '19

31 Oct '19

Hi All, At our Institute we have secured funding to buy a small infrastructure. We have surveyed the computational requirements of researchers and we came to the conclusion that we need to deploy OpenStack on-prem. No one at our Institute has worked with OpenStack before so there is no local expertise. I have been looking around at the available options. Given the complexity of OpenStack and the tight time-frame that we have to get the infrastructure up and running, we would like to go with one of the OpenStack distributions offered by vendors to minimize the time it takes to go into production. Over the initial period, we would need to learn from the vendor how to operate and troubleshoot OpenStack properly, but in the long run we would like to be autonomous. On the other hand, funding in academia is complex and there is no guarantee that we'll be successful in all future funding calls. So in the scenario where we start off with an OpenStack distribution offered by a vendor, and 3 years down the line we run out of budget, can we continue operating/upgrading our OpenStack deployment without issues? Best regards, Sebastian

1 0

[openstack-dev][kuryr] Error in creating LB
by Veera.reddy B 30 Oct '19

30 Oct '19

Hi, I am trying to install openstack & Kubernetes using devstack https://docs.openstack.org/kuryr-kubernetes/latest/installation/devstack/ba… Error Log : http://paste.openstack.org/show/785670/ Local.conf : http://paste.openstack.org/show/785671/ Thanks, Veera.

1 0

[neutron] Drivers meetings cancelled
by Slawek Kaplonski 30 Oct '19

30 Oct '19

Hi, Due to public holiday on November 1st and PTG on November 8th, lets cancel drivers meetings at those days. Next drivers meeting will take place at November 15th. -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[neutron] CI meeting cencelled November 5th
by Slawek Kaplonski 30 Oct '19

30 Oct '19

Hi, Due to summit next week, lets cancel our CI meeting on November 5th. We will resume this meeting after the PTG on November 12th. -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[neutron] Neutron team meeting cancelled
by Slawek Kaplonski 30 Oct '19

30 Oct '19

Hi, Due to the PTG/Summit next week, and public holiday in Poland on 11th Nov, lets cancel neutron team meetings in next 2 weeks. We will get back to this meeting as usuall on Tuesday, 19th Nov. See You in Shanghai :) -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[ptg][nova][neutron][ironic][cinder][keystone][cyborg] Cross-project sessions
by Eric Fried 30 Oct '19

30 Oct '19

All- Time to coordinate cross-project sessions at the PTG. slaweq approached me about a nova/neutron session so I penciled it in on the nova etherpad [1]. If anyone has conflicts/objections with that time, please speak up and we'll try to coordinate. Other teams (including nova): If cross-project meetings are necessary, please suggest times in the etherpad and/or on this thread and/or by grabbing me (efried) on IRC. (Note that stephenfin (I think) will be running the room, but he's on vacation until the event.) Thanks, efried [1] https://etherpad.openstack.org/p/nova-shanghai-ptg

2 1

[octavia] Octavia weekly IRC meeting cancelled November 6th.
by Michael Johnson 30 Oct '19

30 Oct '19

As many of the cores are travelling to Shanghai and our meeting time would be at midnight, we are cancelling the November 6th Octavia IRC meeting. Safe travels everyone, Michael

1 0

Where do we support running tripleoclient
by Dougal Matthews 30 Oct '19

30 Oct '19

Hi all, Pretty much as the subject says. Do we specify where we support running tripleoclient? In theory it should run anywhere with the correct environment variables. However, as far as I understand most users run it on the undercloud itself. Is this something we have a position on? To give a little more context, this is relevant when replacing Mistral with Ansible. Can we assume that we are running ansible only against localhost or do we need to create an inventory for the undercloud? Cheers, Dougal

2 1

[neutron][ptg] Agenda for PTG
by Slawek Kaplonski 30 Oct '19

30 Oct '19

Hi neutrinos, I prepared agenda for our PTG sessions in Shanghai. It's available at [1]. Please check that and let me know if You need to add/change anything. [1] https://etherpad.openstack.org/p/Shanghai-Neutron-Planning -- Slawek Kaplonski Senior software engineer Red Hat

1 0

[ops][nova] Different quotas for different SLAs ?
by Massimo Sgaravatto 30 Oct '19

30 Oct '19

Dear all I would like to set different overcommitments factors for the compute nodes. In particular I would like to use some compute nodes without overcommitments, and some compute nodes with a cpu_allocation_ratio equals to 2.0. To decide if an instance should go to a compute node with or without overcommitment is easy; e.g. it could be done with host aggregates + setting metadata to the relevant flavors/images. But is it in some way possible to decide that a certain project has a quota of x VCPUs without overcommitment, and y VCPUs with overcommitments ? Or the only option is using 2 different projects for the 2 different SLAs (which is something that I would like to avoid) ? Thanks, Massimo

5 6

[PTG][interviews] We Want To Talk With YOU!
by Rain Leander 30 Oct '19

30 Oct '19

I am attending OIS and PTG and will conduct interviews on Friday 08 November in room Liberty. If you're keen and able, I'd love to talk with you. [0] These interviews have several purposes. Please consider all of the following when thinking about what you might want to say in your interview: * Tell the users/customers/press what you've been working on in Rocky * Give them some idea of what's (what might be?) coming in Stein * Put a human face on the OpenStack project and encourage new participants to join us * You're welcome to promote your company's involvement in OpenStack but we ask that you avoid any kind of product pitches or job recruitment In the interview I'll ask some leading questions and it'll go easier if you've given some thought to them ahead of time: * Who are you? (Your name, your employer, and the project(s) on which you are active.) * What did you accomplish in Rocky? (Focus on the 2-3 things that will be most interesting to cloud operators) * What do you expect to be the focus in Stein? (At the time of your interview, it's likely that the meetings will not yet have decided anything firm. That's ok.) * Anything further about the project(s) you work on or the OpenStack community in general. Finally, note that there are only 33 interview slots available, so please consider coordinating with your project to designate the people that you want to represent the project, so that we don't end up with 12 interview about Neutron, or whatever. It's fine to have multiple people in one interview - Maximum 3, probably. Interview slots are 30 minutes, in which time we hope to capture somewhere between 10 and 20 minutes of content. It's fine to run shorter, but 15 minutes is probably an ideal length. [0] https://docs.google.com/spreadsheets/d/1XwRC_nHm2hZs37Hlrb5fUl4zGtOGgekj1oH… -- K Rain Leander OpenStack Community Liaison Open Source Program Office https://www.rdoproject.org/ http://community.redhat.com

3 2

[heat] Heat PTG Schedule. Please join us!
by Rico Lin 30 Oct '19

30 Oct '19

Dear all, As Summit and PTG is right next week. would like to update our schedule with you. Our PTG session will be hosted on 11/7 full-day from 9:00 am to 4:30 pm in room Grizzly. You can suggest PTG sessions in our etherpad: https://etherpad.openstack.org/p/PVG-heat We also have project update session <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24364…> on Monday, November 4, 2:35pm-2:50pm at Shanghai Expo Center - 5th Floor - 515 And Some sessions with heat tags on for your consideration: - Quick, Solid, and Automatic - OpenStack Bare-metal Orchestration <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24215…> - Monday, November 4, 1:20pm-2:00pm, on Shanghai Expo Center - 6th Floor - 619 - Forum: Project Resource Cleanup - followup <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24407…> - Monday, November 4, 11:40am-12:20pm in Shanghai Expo Center - 4th Floor - 431 - Leveraging OpenStack IaaS to run a Cloud CI/CD pipeline <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24091…> - Monday, November 4, 2:05pm-2:15pm in Shanghai Expo Center - 5th Floor - Marketplace Theater - The Little Bag O'Tricks: 10 things you might not know you can do with OpenStack <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24202…> - Tuesday, November 5, 11:40am-12:20pm in Shanghai Expo Center - 6th Floor - 617 - Enabling a Secure Industry 4.0transition for ShangHai Electric with OpenStack based Edge Clouds <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24187…> - Wednesday, November 6, 3:20pm-4:00pm in Shanghai Expo Center - 6th Floor - 617 Here's my Wechat ID if you would like to find me there: RicoLinCloudGeek See you all in Shanghai! -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 0

[meta-sig] SIG PTG schedule. feel free to join!
by Rico Lin 30 Oct '19

30 Oct '19

Hi all PTG is right next week, so if you're interested in SIG governance or you like to walk by and say hello, please join us! Both TC and UC will have people there as well! Our session will be hosted on 11/6 for a quarter-day from 3:20 pm to 5:00 pm in room 431. You can suggest PTG sessions in our etherpad: https://etherpad.openstack.org/p/PVG-meta-sig Here's my Wechat ID, if you like to find me there: RicoLinCloudGeek See you all in Shanghai! -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

1 1