- openstack-discuss - lists.openstack.org

[OSSA-2024-005] Neutron: Authorization bypassed when setting tags on Neutron networks (CVE-2024-53916)
by Jay Faulkner 03 Dec '24

03 Dec '24

=========================================================================== OSSA-2024-005: Authorization bypassed when setting tags on Neutron networks =========================================================================== :Date: December 03, 2024 :CVE: CVE-2024-53916 Affects ~~~~~~~ - Neutron: >=23.0.0 <23.2.1, >=24.0.0 <24.0.2, >=25.0.0 <25.0.1 Description ~~~~~~~~~~~ Tore Anderson of Redpill Linpro AS discovered that Neutron does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects which do not belong to the tenant, and this action is not being subjected to the proper policy authorization check. Patches ~~~~~~~ -https://review.opendev.org/c/openstack/neutron/+/936849 (2023.2/bobcat) -https://review.opendev.org/c/openstack/neutron/+/936846 (2024.1/caracal) -https://review.opendev.org/c/openstack/neutron/+/936843 (2024.2/dalmatian) -https://review.opendev.org/c/openstack/neutron/+/935883 (2025.1/epoxy) Credits ~~~~~~~ - Tore Anderson from Redpill Linpro AS (C, V, E, -, 2, 0, 2, 4, -, 5, 3, 9, 1, 6) References ~~~~~~~~~~ -https://launchpad.net/bugs/2088986 -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53916 -- Jay Faulkner OpenStack VMT

1 0

[publiccloud-sig] Reminder: next meeting December 4th (tomorrow) - 0800 UTC
by Felix Kronlage-Dammers 03 Dec '24

03 Dec '24

Hi everyone, This Wednesday, tomorrow, (December 4th) the next meeting of the publiccloud-sig is going to happen. We’ll be meeting at 0800 UTC here: https://meetpad.opendev.org/publiccloud-sig <https://meetpad.opendev.org/publiccloud-sig> See also here for all other details: https://wiki.openstack.org/wiki/PublicCloudSIG <https://wiki.openstack.org/wiki/PublicCloudSIG> See you tomorrow! felix -- Felix Kronlage-Dammers Sovereign Cloud Stack — standardized, built and operated by many Ein Projekt der Open Source Business Alliance - Bundesverband für digitale Souveränität e.V. Tel.: +49-30-206539-205 | Matrix: @fkronlage:matrix.org | fkr(a)osb-alliance.com

1 0

[nova] Rescuing a volume-backed instance
by Francesco Di Nucci 03 Dec '24

03 Dec '24

Hello, I am using Openstack 2024.1 and I have issues with an instance with a corrupted FS - I wanted to start it in rescue mode, but I'm getting stuck After reading nova#1926601 <https://bugs.launchpad.net/nova/+bug/1926601> , downloaded System Rescue CD and created an image with properties [otherwise it always failed with "Cannot rescue a volume-backed instance (HTTP 400)"] : openstack image create --file systemrescue-11.02-amd64.iso --disk-format iso --container-format bare --property hw_rescue_bus=virtio --property hw_rescue_device=disk systemrescuecd Then tried to rescue the instance: openstack --os-compute-api-version 2.96 server rescue --image systemrescuecd (my-instance-id) Now it fails with "Instance (my-instance-id) cannot be rescued: Driver Error: Image (my-image-id) is unacceptable: Image not in a supported format" How should I proceed? Thanks in advance -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email: francesco.dinucci(a)na.infn.it

3 3

[ironic] meeting schedule for December and end of the year holidays break
by Riccardo Pittau 03 Dec '24

03 Dec '24

Hello ironicers! Holiday season is upon us and we're close to the end of 2024. The last Ironic community meeting for this year will be held on Monday December 16th, so we have two meetings left before the break. We'll skip December 23rd and 30th and come back in 2025 on Monday January 6th. Thanks everyone for all your contributions during 2024! Ciao! Riccardo

1 0

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2025.1/R-17)
by Goutham Pacha Ravi 02 Dec '24

02 Dec '24

Hello Stackers, This week marks the 2024.2 ("Dalmatian") release trailing deadline [1]. All projects following the cycle-trailing release model [2][3] must release their 2024.2 ("Dalmatian") deliverables by December 5, 2024. No new governance changes were merged in the past week; goal champions and volunteers continued their efforts on the cross-community goals that have been committed to [4]. As Ghanshyam Mann (gmann) highlighted in this mailing list [5], nine project teams need to address CI jobs within their repositories due to the switch of base DevStack (and some tox) jobs to Ubuntu 24.04 LTS. Teams can work around the problem temporarily by pinning the nodeset used to run their failing jobs to Ubuntu 22.04 LTS while they triage and resolve these issues. The Ironic and Neutron teams recently dropped functional testing with the PostgreSQL database. As highlighted at the PTG [6], there is very little motivation within OpenStack's contributor community to support PostgreSQL as a database alternative to MySQL and its derivatives with Oslo.db. The TC has clarified this in a past resolution as well [7]. We are currently identifying places within the documentation where PostgreSQL references need to be removed and aim to address these promptly. If you rely on PostgreSQL, please voice your concerns and consider dedicating time and resources to reviving testing with this database. === Weekly Meeting === TC members met last Tuesday (2024-11-26) on OFTC's #openstack-tc channel [8]. A significant portion of the discussion focused on the state of CI. Members of the Testing and Collaboration Tools SIG highlighted that much of the gate flakiness is due to jobs encountering the new rate limits on DockerHub [9]. Alternatives that may be more suitable for CI usage within open-source communities were discussed. As a result, we encourage project teams to explore these alternatives, as many open-source communities have already done. The OpenStack TC's next weekly meeting is today (2024-12-03). It will be held simultaneously via video (Zoom) and IRC (OFTC's #openstack-tc channel) at 18:00 UTC. The agenda for this meeting, along with participation links, can be found on the wiki [10]. I hope to see you there! === Governance Proposals === ==== Open for Review ==== - Retire Murano/Senlin/Sahara OpenStack-Ansible roles: https://review.opendev.org/c/openstack/governance/+/935677 - Add ansible-role-httpd repo to OSA-owned projects: https://review.opendev.org/c/openstack/governance/+/935694 - Rework the initial goal proposal as suggested by the community: https://review.opendev.org/c/openstack/governance/+/931254 - Resolve to adhere to non-biased language: https://review.opendev.org/c/openstack/governance/+/934907 - Propose to select the eventlet-removal community goal: https://review.opendev.org/c/openstack/governance/+/934936 Thank you for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] 2025.1 "Epoxy" Release Schedule: https://releases.openstack.org/epoxy/schedule.html [2] Cycle-trailing release model: https://releases.openstack.org/reference/release_models.html#cycle-trailing [3] Cycle-trailing projects: https://codesearch.opendev.org/?q=type%3A%20trailing&i=nope&literal=nope&fi… [4] Proposed and selected community goals: https://governance.openstack.org/tc/goals/#community-goals [5] Migrate to noble communication: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [6] OpenStack TC PTG Notes (around line 159): https://etherpad.opendev.org/p/r.0f25532f564fb786a89cfe1de39b004b [7] State of community support for databases: https://governance.openstack.org/tc/resolutions/20170613-postgresql-status.… [8] TC Meeting IRC Log 2024-11-26: https://meetings.opendev.org/meetings/tc/2024/tc.2024-11-26-18.01.log.html [9] DockerHub rate limit changes: https://www.docker.com/blog/november-2024-updated-plans-announcement/ [10] TC Meeting Agenda, 2024-12-03: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee

1 0

[neutron] bug deputy report for week of 2024-11-25
by Bence Romsics 02 Dec '24

02 Dec '24

Hi All, These are the new bugs reported last week. Except the last one, each has an assignee or even a proposed fix. ovn-octavia-provider cores, please have a look at the last one! It seems valid to me, but I'm not familiar with the code base. The reporter/assignee seems to be a new contributor, may be happy to get some help from you. Medium: * https://bugs.launchpad.net/neutron/+bug/2089940 [WSGI] Make ``TunnelTypeDriverBase.sync_allocations`` compatible with WSGI Fix proposed: https://review.opendev.org/c/openstack/neutron/+/936813 * https://bugs.launchpad.net/neutron/+bug/2089661 Resource cache should be delete after port remove from br-int Fix in progress: https://review.opendev.org/c/openstack/neutron/+/936235 * https://bugs.launchpad.net/neutron/+bug/2089663 Router port device owner changed should send PORT resource UPDATE event Fix in progress: https://review.opendev.org/c/openstack/neutron/+/936237 * https://bugs.launchpad.net/neutron/+bug/2089727 neutron-tempest-plugin-openvswitch router migration cases are not run Assigned to Yulong. RFE: * https://bugs.launchpad.net/neutron/+bug/2089726 Sequential Execution of run Methods in OVN Agent Suggestion to parallelize the ovsdbapp event loop, see discussion in wip patch: https://review.opendev.org/c/openstack/ovsdbapp/+/936327 Stable: * https://bugs.launchpad.net/neutron/+bug/2089522 [stable] 2024.1 and 2023.2, broken grenade and skip jobs due to a partial migration to um/2023.1 Fixes in progress, some merged already: https://review.opendev.org/q/topic:"bug/2089522" ovn-octavia-provider: * https://bugs.launchpad.net/neutron/+bug/2090782 Some requests take a lot of time to process in OVN Octavia Provider on huge loadbalancers Assigned to Aslan. Cheers, Bence

1 0

[DevStack] Fail to install devstack (stable/2024.2)
by Seongsoo Cho 01 Dec '24

01 Dec '24

Hi OpenStack Community Since a few weeks ago, I've been getting an error on neutron module import when installing devstack. I still can't get rid of the error, how can I fix it? [ Error Message ] ERROR neutron return self.channel.remote_call(name, args, kwargs, ERROR neutron File "/opt/stack/data/venv/lib/python3.10/site-packages/oslo_privsep/daemon.py", line 215, in remote_call ERROR neutron raise exc_type(*result[2]) ERROR neutron ModuleNotFoundError: No module named 'neutron.privileged.agent' ERROR neutron +lib/neutron_plugins/ovs_base:_neutron_ovs_base_setup_bridge:1 exit_trap +./stack.sh:exit_trap:540 local r=1 ++./stack.sh:exit_trap:541 jobs -p You can find the full error message from this link full error : https://pastebin.com/KEn33H1a [ Environment ] OS : Ubuntu 24.04 devstack branch : stable/2024.2 full error : https://pastebin.com/KEn33H1a world dump : https://pastebin.com/vp4Azqjg Best Regards Seongsoo -- Seongsoo Cho OpenStack Korea User Group / Community Leader IRC #seongsoocho

2 2

join to contribute
by alibasafa18＠gmail.com 01 Dec '24

01 Dec '24

Hi everyone, I’m interested in contributing to Neutron. Could you please guide me on how to start understanding its codebase and logic? I have experience working with OpenStack, and I’m familiar with OVS and OVN, as well as their concepts.

2 1

[kayobe] [bifrost] Enabling and Deploying compute node
by alidot-subs Mail 30 Nov '24

30 Nov '24

Hi Everyone, Its be good experience to deploy Kayobe in all in one mode and see cirros image getting deployed and acesssible. Moving forward for multi-node deployment of baremetal machines. i tried to enable bifrost bit i doesn't seems to et enable by setting configurations in bifrost.yaml. What it takes to enable and use Bifrost using kayobe ? It may sound basic question. Thank you Ali

2 3

[cinder] What is the "official" name for Cinder in the service catalog?
by Stephen Finucane 29 Nov '24

29 Nov '24

o/ I've proposed a series of patches to "clean up" the service catalog that DevStack creates in a deployment. Currently, DevStack creates two endpoints for Cinder: one called 'cinderv3' of type 'volumev3' and another called 'cinder' of type 'block-storage'. For example: { "services": [ { "name": "cinderv3", "description": "Cinder Volume Service V3", "id": "65460706a9864e71926f13042f526aeb", "type": "volumev3", "enabled": true, "links": { "self": "http://10.0.108.50/identity/v3/services/65460706a9864e71926f13042f526aeb" } }, { "name": "cinder", "description": "Cinder Volume Service", "id": "cd406a0e296d47dca1e481e992851bb2", "type": "block-storage", "enabled": true, "links": { "self": "http://10.0.108.50/identity/v3/services/cd406a0e296d47dca1e481e992851bb2" } }, // ... ], "links": { "next": null, "self": "http://10.0.108.50/identity/v3/services", "previous": null } } They both ultimately point to the same API, the Cinder v3 API, meaning one of these endpoints is redundant. My assumption was 'block-storage' was the correct one, since that's the official service type [1], and that 'cinder' was the appropriate name since it mirrors what we use for other services (nova, neutron, keystone, glance, ...). However, tkajinam raised the point [2] that the Install Guide currently recommends use of the 'volumev3' type and that projects like Nova and Glance have an '[cinder] catalog_info' that defaults to 'volumev3'. If so, is 'block-storage' really the official service type, or is it 'volumev3'. If it is, should we be changing the Install Guide and the various config option defaults? Cheers, Stephen [1] https://specs.openstack.org/openstack/service-types-authority/

6 18

[docs][arch] Architecture Guide, ch. Control Plane Design
by just.me.on.reddit＠protonmail.com 29 Nov '24

29 Nov '24

I am sorry for proprietary tag - I hope it helps to narrow down the scope of this mail. Tags in order generic to more specific. Hello, If I only understand the term "cloud controller" properly these are those OpenStack services which collectively control whole cloud, inclusively those services exposed to cloud user. Cloud control can run on single hosting node, or can be distributed to a group of nodes. Please correct me if I am wrong. My role is on cloud operative side (a learner to become OS user). Architecture Guide, chapter as in this mail subject states following "It’s also possible to use virtual machines for all or some of the services that the cloud controller manages, such as the message queuing. In this guide, we assume that all services are running directly on the cloud controller." It is hard to continue the lecture of this Guide due to unclear description at following points. 1. reg. "all services are running directly on the cloud controller" Can't actually understand this statement. The "on" suggests cloud controller be hosting services in mind. Furthermore, cloud controller includes only those services acting under the goal of cloud control. Service whose major purpose is to provide functionality to cloud user won't, I suppose, be part of cloud controller. Hence, this statement might be more generic as it should be. 2. reg. "use virtual machines for all or some of the services that the cloud controller manages, such as the message queuing" Will cloud controller really mange message queuing instead of include comprise it? Which use of virtual machine exactly is meant here * placing services to virtual machine during O.S. deployment to hosting IT * the IT hosting OpenStack-based cloud? Should the former bullet apply, wasn't is said in some other Guide, abstraction level rather high, that use of virtual machines as cloud host is recommended only for test and evaluation purposes?

1 0

[openstack-ansible] : GPU computes on openstack-ansible
by Rambo Rambo 29 Nov '24

29 Nov '24

Hi Team Openstack-Ansible Openstack Victoria Release Ubuntu 20.04 I need to add computes having GPU on them. So I need recommendations on the procedure to add them and also what all configurations through openstack-ansible are required for nova_api, nova_scheduler on control node nova_api containers and compute node nova_compute configurations? Also does anyone has experience using and installing openstack service : cyborg for GPU management. Regards Rambo

3 5

[heat][horizon][octavia][oslo][qa][skyline][takcer][telemetry][zaqar] Need attention for tomorrow (Nov 29th) CI migration to Ubutnu Noble
by Ghanshyam Mann 28 Nov '24

28 Nov '24

Hello Team, As you know, we have been trying very hard to test and fix the project CI for the Ubuntu Noble migration[1] and there are 9 projects that are still failing on Noble. Check the etherpad having testing change for me information on failures: - https://etherpad.opendev.org/p/migrate-to-noble The migration is planned for tomorrow (Nov 29th); request you to check/fix the failure before that; otherwise, it will break your project gate. [1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… -gmann

1 0

[docs][kayobe] Architecture, terms used
by just.me.on.reddit＠protonmail.com 28 Nov '24

28 Nov '24

Dear Kayoube documentation, If possible please be bit more specific at few points - document Architecture, section Networks refers to bare metal overcloud hosts, however the chapter "Hosts in the System" presents only bare metal compute hosts, nor any other text passage clarifies the term "overcloud". This way it is hard to get full understanding of term "Overcloud out-of-band network". Furthermore, if you talk about an out-of-band stuff it gets hard to see what is out-of-band without term in-band be precisely clear.

1 3

[watcher][tc] watcher-drivers launchpad membership
by Sean Mooney 28 Nov '24

28 Nov '24

Hi folks o/ Following up form the PTG discussion https://etherpad.opendev.org/p/r.79644f8f3cd04686c4f45c10aa35d8ac#L65 and the recently merged governance patch https://github.com/openstack/governance/commit/1e547ae39f9913dc9cfd9c755b24… I wanted to raise the topic of the watcher-drivers team https://launchpad.net/~watcher-drivers membership and ownership. during the TC sessions we discussed that that the <project>-coresec teams should be owned by the https://launchpad.net/~openstack-admins team https://etherpad.opendev.org/p/r.0f25532f564fb786a89cfe1de39b004b#L123 watcher does not currently have a sperate watcher-coresec team in launchpadd only a a watcher-drivers team i also think that the watcher driver team should be owned by the https://launchpad.net/~openstack-adminsteam. https://launchpad.net/~watcher-drivers is currently owned by https://launchpad.net/~david-tardivel and the only other member with admin rights is https://launchpad.net/~li-canwei2 Can i ask that one of the existing admin either grant my membership request and delegate admin rights to me or add the https://launchpad.net/~openstack-admins team as admins and make them the owner of the team? licanwei, david-tardivel, would either of ye be willing and able to make those changes in launchpad? i also think it would be prudent to add other active member (the current liaisons) as admins/moderators of the watcher-driver team but i can do that once i have access or https://launchpad.net/~openstack-adminscan. having all launchpad teams owned by https://launchpad.net/~openstack-adminsteam mitigates the risk of loosing access by the current admins becoming inactive, but it would be nice to not need to escalation to them for simple tasks like moderation of the group. that is why i want to add the other liaisons to the admins of the team. I am asking for this access for 2 reasons: Fist to add https://launchpad.net/~openstack-adminsas admins of the team and the launchpad project, Second so that i can create new launchpad series for current releases to do blueprint and bug tracking. at present because we do not have launchpad series fro 2025.1 we cannot properly track bugs/blueprints for the current cycle. In the future if there are no objections form the existing contributors i would also like to create a separate open bug team with less project wide permission so that anyone can contribute to bug triage without needing access to the drivers team. this is in lien with how other project like nova work for example https://launchpad.net/~nova-bugs i also think we should be creating a separate watcher-coresec team to allow dan as the security liaison and the vulnerability management team to properly manage security reports. once we have access to the watcher-drivers team we should be able to update the launchpad project to make that possible. Regards sean.

3 4

[watcher][tc][tempest] watcher gerrit group membership
by Sean Mooney 28 Nov '24

28 Nov '24

Hi everyone o/ As many will be aware, over the last month or two, I and some others have been looking to help maintain and extend the Watcher project. At the ptg, I proposed several topics to cover the administrivia of reviving the project. To bring it to a healthy state where features, bugs and general maintenance could be performed on an ongoing basis and avoid its retirement at the end of the 2025.1 cycle. One of the follow-up items to enable that was the extension of the watcher Gerrit groups to allow others to supplement the largely inactive core groups. https://etherpad.opendev.org/p/r.79644f8f3cd04686c4f45c10aa35d8ac#L47 <https://etherpad.opendev.org/p/r.79644f8f3cd04686c4f45c10aa35d8ac#L47> To that end, I would like to ask the existing watcher core team and TC (or other community members :) ) to provide input on the following proposal. 0.) I want to state upfront that I do not want to take away review rights or diminish the experience and efforts of any of the past or present members of the watcher team. I am sending this proposal to enable the watcher project to function effectively and I am welcome to feedback or objections. 1.) To facilitate the changes in the rest of the proposal I would like to formally ask to be added to all of the existing watcher Gerrit groups * watcher-core https://review.opendev.org/admin/groups/77cd139bd57514e98e5e694a82f7e261b47… <https://review.opendev.org/admin/groups/77cd139bd57514e98e5e694a82f7e261b47…> * watcher-release https://review.opendev.org/admin/groups/b265e6b6457de71c7ecfc2a3c70f0c52cde… <https://review.opendev.org/admin/groups/b265e6b6457de71c7ecfc2a3c70f0c52cde…> * watcher-dashboard-core https://review.opendev.org/admin/groups/77cd139bd57514e98e5e694a82f7e261b47… <https://review.opendev.org/admin/groups/77cd139bd57514e98e5e694a82f7e261b47…> * watcher-dashboard-release https://review.opendev.org/admin/groups/904be58ec9fa0e811166ce6144d6314cc7b… <https://review.opendev.org/admin/groups/904be58ec9fa0e811166ce6144d6314cc7b…> * watcher-specs-core https://review.opendev.org/admin/groups/747af616eb8748aee5b17d9493f9ebbc49e… <https://review.opendev.org/admin/groups/747af616eb8748aee5b17d9493f9ebbc49e…> * watcher-tempest-core https://review.opendev.org/admin/groups/09a91d8e24af9ce44b80062c4851a1d2fa3… <https://review.opendev.org/admin/groups/09a91d8e24af9ce44b80062c4851a1d2fa3…> 2.) watcher-release and watcher-dashboard-release Historically, there has been a benefit to having separate core teams for the master and the stable branches. As the velocity of projects has decreased and projects have become more mature the delineation between the maintainers of the master branch and the stable branches has lessened. I believe there is still merit in having the flexibility to add people directly to the release team independently from the core team so I am not proposing replacing the *-release teams with *-core. To that end, I would like to make the following changes to the membership of watcher-release and watcher-dashboard-release - add stable-maint to both release groups - add watcher-core to watcher-release, as we have done in other projects the ask to the watcher-core team is, if you do not have time to review stable branches, or do not feel comfortable with applying stable policy, then there is no expectation to review on the stable branches. - add watcher-dashboard-core to watcher-dashboard-release - me (sean-k-mooney as release-liaison) to facilitate backports and release activities and Gerrit membership admin. 3.) watcher-core and watcher-dashboard-core As it currently stands the core groups are relatively inactive https://tinyurl.com/bdz9k47n full url: https://openstack.biterg.io/app/dashboards?security_tenant=openstack#/view/…:'Gerrit%20Approvals%20panel%20by%20Bitergia',filters:!(('$state':(store:appState),meta:(alias:Bots,disabled:!f,index:gerrit,key:author_bot,negate:!t,params:(query:!t),type:phrase),query:(match:(author_bot:(query:!t,type:phrase)))),('$state':(store:appState),meta:(alias:!n,disabled:!f,index:gerrit,key:project,negate:!f,params:(query:watcher),type:phrase),query:(match_phrase:(project:watcher)))),fullScreenMode:!f,options:(darkTheme:!f,hidePanelTitles:!f,useMargins:!t),query:(language:lucene,query:''),timeRestore:!f,title:'Gerrit%20Approvals',viewMode:view <https://openstack.biterg.io/app/dashboards?security_tenant=openstack#/view/…:'Gerrit%20Approvals%20panel%20by%20Bitergia',filters:!(('$state':(store:appState),meta:(alias:Bots,disabled:!f,index:gerrit,key:author_bot,negate:!t,params:(query:!t),type:phrase),query:(match:(author_bot:(query:!t,type:phrase)))),('$state':(store:appState),meta:(alias:!n,disabled:!f,index:gerrit,key:project,negate:!f,params:(query:watcher),type:phrase),query:(match_phrase:(project:watcher)))),fullScreenMode:!f,options:(darkTheme:!f,hidePanelTitles:!f,useMargins:!t),query:(language:lucene,query:''),timeRestore:!f,title:'Gerrit%20Approvals',viewMode:view>) Dan Smith and Slawek Kaplonski were added to help with the retirement/gate issues on behalf of the TC While Dan has offered to help bootstrap the core team we need to be cognizant that both Dan and Slawek have other commitments. Chenker has previously expressed that they intend to review when time allows but they have limited time to do so. To that end, I would like to propose that I be added to both core teams, To have a health core team we will eventually need to have at least 3 active reviewers. Watcher will still be 1-2 reviews short of that, but I hope that can be addressed over the coming months. As others become active over the 2025.1 cycles I would like to revisit the membership and extend the core team after milestone 2 or more realistically after milestone 3 if others demonstrate interest and capacity to review. 4.) watcher-tempest-core This is a newly created group added by https://review.opendev.org/c/openstack/project-config/+/934357 <https://review.opendev.org/c/openstack/project-config/+/934357> This group intends to allow the review team for the tempest plugin to diverge from the main watcher core group. To enable effective review and maintenance of the tempest plugin I would like to propose the following membership changes. - tempest-core should be added as a fallback, to guide best practices, and review if they have time. - gmann has volunteered to help with this too so I propose they be added as a direct member - I would like to be added to have a second active reviewer available. Note, while I can provide some review input I have less knowledge of tempest in general as such I will rely on Gmann's guidance in this area. 5.) watcher-specs Several years ago Nova expanded the nova-specs core group to include nova-core there were a number of motivating factors but one of them was the large overlap between the two groups. another factor was the role of a spec core (focusing on the design constraints, upgrade impact, API impact ectra) is different from the implementation considerations(testing, code quality, performance) often the line between the two is subtle and blurred. To that end, I would like to propose the following changes. - first, I would like to be directly added to the specs core group - second, I would like to add the watcher-core group to watcher-specs. If this proposal is accepted I would like to try and move forward with this in the next week or so to unblock the pending review backlog. Regards sean PS many of the open reviews are cleanup i have submitted so this does not directly address review bandwidth for my personal patches but i think it still has value in general.

3 3

Re: [kolla][oslo] RabbitMQ issue Adding/Removing a Controller Node in an OpenStack Cluster
by Ishan Shanware (ishanwar) 28 Nov '24

28 Nov '24

For everyone’s reference From: Ishan Shanware (ishanwar) <ishanwar(a)cisco.com> Date: Wednesday, 27 November 2024 at 10:01 PM To: Sven Kieske <kieske(a)osism.tech> Subject: Re: [kolla][oslo] RabbitMQ issue Adding/Removing a Controller Node in an OpenStack Cluster Hi Sven, Thanks for getting back to me. We have configured kolla to use 3 controllers in each cluster. Each controller has one rabbitmq container created by kolla. The process we follow move a controller out of rotation is as follows: 1. We first failover all the l3 and dhcp agents running on the controller to the 2 other controllers. 2. We then turn of the server and then delete any neutron agents on it. Currently the rabbitmq cluster only consists of only 2 containers. The problem specifically occurs during the reinstall of the rabbitmq container in the kolla deploy stage. Specifically, after it executes the checking rabbitmq containers role. It triggers a restart for the contains on all the blades. After this stage completed we observe that the masakari-engine disables all the nova-computes. Let me know if you need any other information for discussion Thanks Ishan From: Sven Kieske <kieske(a)osism.tech> Date: Tuesday, 26 November 2024 at 11:36 PM To: Ishan Shanware (ishanwar) <ishanwar(a)cisco.com>, openstack-discuss(a)lists.openstack.org <openstack-discuss(a)lists.openstack.org> Subject: Re: [kolla][oslo] RabbitMQ issue Adding/Removing a Controller Node in an OpenStack Cluster Hi Ishan, my first question would be, how many controller nodes and specifically, rabbitmq nodes you are running inside your Openstack cluster? You should be following the general guidelines for running any raft consensus based distributed system and only run an odd number of systems, e.g. 3 or 5 control nodes. Can you confirm that this is the case in your setup? If you e.g. run a two node setup such errors are indeed expected. See also our production architecture guide: https://docs.openstack.org/kolla-ansible/latest/admin/production-architectu… > Control - Cloud controller nodes which host control services like APIs and databases. This group should have odd number of nodes for quorum. If you are running an odd number of control nodes and you're still facing this issue, I would be curious to know the rabbitmq cluster state before you add or remove a node, because this should theoretically just work. But maybe there is another issue with your cluster. HTH -- Sven Kieske Senior Cloud Engineer Mail: kieske(a)osism.tech Web: https://osism.tech OSISM GmbH / Talweg 8 / 75417 Mühlacker / Deutschland Geschäftsführer: Christian Berendt Unternehmenssitz: Mühlacker Amtsgericht: Stuttgart, HRB 756139

1 1

[watcher] Canceling Dec 5th weekly meeting
by Douglas Viroel 28 Nov '24

28 Nov '24

Hi all o/ Since most of our audience will be out next week, we agreed[1] on canceling watcher's weekly meeting[2], on Dec 5th. We will meet again in two weeks, on Dec 12th. [1] https://meetings.opendev.org/meetings/watcher/2024/watcher.2024-11-28-12.00… [2] https://meetings.opendev.org/#Watcher_Team_Meeting BR, -- Douglas Viroel - dviroel

1 0

[kolla-ansible] nova-cell can't not find nova.keyring file when deploy
by daniel890723＠gmail.com 27 Nov '24

27 Nov '24

hello Daniel here Previously i was testing openstack-helm but it doesn't work so i switch to kolla-ansible with all-in-one mode i was following the official guide and put the keyring file i generate to the config folder: (venv) root:~# nano /etc/kolla/config/nova/ ceph.client.nova.keyring ceph.conf localhost/ nova-compute.conf But when i try to deploy it show the error below TASK [nova-cell : Check nova keyring file] ***************************************************************************************************************** fatal: [localhost]: FAILED! => {"msg": "No file was found when using first_found."} Just in case i also put the keyring file in /config/localhost/nova Still shows the same error But when i put the cinder keyring file in nova folder like this: (venv) root@:~# nano /etc/kolla/config/nova/ ceph.client.cinder.keyring ceph.client.nova.keyring ceph.conf localhost/ nova-compute.conf It can find the cinder keyring file but this time the nova-compute container show error below: unable to find a keyring on /etc/ceph/ceph.client.nova.keyring,/etc/ceph/ceph.keyring,/etc/ceph/keyring,/etc/ceph/keyring.bin: (2) No such file or directory Did i do anything wrong or something makes it not able to detect the nova.keyring file P.S. Cinder and Glance works fine and Ceph can be used normally

2 5

[manila] Cancelling Nov 28th upstream weekly meeting
by Carlos Silva 27 Nov '24

27 Nov '24

Hello Zorillas, At least half of our audience tomorrow will not be online tomorrow, as it is thanksgiving in the US, so let's cancel the meeting. We'll resume the weekly meetings on Dec 5th. Regards, carloss

1 0

[ops][kolla-ansible][openstack-ansible] Deploying OpenStack using Ansible to LXC while project is used to grab for Kolla-Ansible
by just.me.on.reddit＠protonmail.com 27 Nov '24

27 Nov '24

Hi, I am learning OS because my imminent mission uses a cloud-based solution (cloud-app) which runs in OpenStack cloud. How do you estimate the probability for a cloud-app to feature built-in Docker dependency (runtime) in situation where the project of mentioned app appears to be used to apply Kolla Ansible in order to deploy OpenStack cloud? It means the cloud-app to depend at runtime on Docker-specific artefacts. 3rd-party cloud-app going to be in use will play a major role in my project. It is in responsibility of cloud-app operator to do provisioning of OpenStack cloud before mentioned app can be deployed to cloud. Recommendations found in cloud-app's documentation read to use Kolla Ansible in order to conduct mentioned provision. Myself learned that Kolla uses Docker. Docker use is that component which triggers me to ask this question. My own preference would be rather to deploy OpenStack services to LXC-containers. One can find in OpenStack web the project Ansible-based deployment to LXC containers. I wonder following if cloud-app developers could had placed in it any built-in Docker (eco-system) runtime dependency and they achieved it by the use of Ansible Kolla for OpenStack deployment. Considering my very flat knowledge of Docker (only familiarized with its purpose and very few exercises made in far past) there exists just hypothetical risk for cloud project in my focus to feature built-in docker eco-system dependency. Should such dependency be a fact (not just a risk) my aim to use OpenStack services in LXC-containers has good chance to fail. It is hard to contact 3rd-party cloud project developer regarding my questions. Question 2 Any common conclusions had been drawn so far if one of the two approaches be of remarkably higher suitableness to host OpenStack-based cloud services? * placing OpenStack-based cloud services to Docker-based containers * placing services of OpenStack-based cloud to Linux containers (LXC/LXD/...)

1 0

[os-vif][nova][neutron] Proposing Rodolfo as an os-vif core
by Sean Mooney 27 Nov '24

27 Nov '24

hi folks o/ I intended to send this last week but didn't find time till now. I'm sure many are familiar with Rodolfo form the work that he has done in neutron over the years. I have worked with them for a long time and over the years they have also contributed too and reviewed changes too os-vif. I think having a neutron core on the os-vif team would certainly help bubble up pain points form them and address such issue faster in os-vif going forward. Rodolfo is familiar with the code and with the upstream review process so i think they would be a good fit. If there are no objection to this ill bring this up again in next weeks nova team meeting and add rodoflo to the core list. reagrds sean.

2 2

[Octavia] Cancelling today's meeting
by Gregory Thiemonge 27 Nov '24

27 Nov '24

Hi Folks, Due to personal reasons, I have to cancel this week's meeting, sorry for the short notice, See you next week, Greg

1 0

Openstack ansible variables
by engineer2024 27 Nov '24

27 Nov '24

I want to print the values of all the ansible variables at the playbook and task level. If we execute os_glance.yml , I want to see the variable values of all the tasks/playbooks involved in this glance playbook. Is it also possible doing it from any one file ? Thanks elinux

1 0

[largescale-sig] Next meeting: November 27, 9utc
by Thierry Carrez 27 Nov '24

27 Nov '24

Hi everyone, The Large Scale SIG will be meeting this Wednesday in #openstack-operators on OFTC IRC, at 9UTC. You can doublecheck how that UTC time translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20241127T09 Feel free to add topics to the agenda: https://etherpad.opendev.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

1 1