- openstack-discuss - lists.openstack.org

Kernel reported iSCSI connection [ID_SESSION]:0 error (1020 - ISCSI_ERR_TCP_CONN_CLOSE: TCP connection closed) state (1), conn 0 login rejected: initiator error - target not found (02/03)
by elgaplok12＠gmail.com 19 Jul '24

19 Jul '24

hi I have a problem with iscsid. so in the iscsiadm -m session there is still iqn-blablabla:.... when I want to delete or log out, there is an error Logout: iscsiadm --mode node --targetname iqn.2010-10.org.openstack:volume-blablabla --portal ip_address --logout Logging out of session [sid: 45, target: iqn.2010-10.org.openstack:volume-blablabla, portal: ip_address,port] iscsiadm: Could not logout of [sid: 45, target: iqn.2010-10.org.openstack:volume-blablabla, portal: ip_address,port]. iscsiadm: initiator reported error (32 - target likely not connected) iscsiadm: Could not logout of all requested sessions Delete: iscsiadm --mode node --targetname iqn.2010-10.org.openstack:volume-blablabla --portal ip_address --op delete iscsiadm: This command will remove the record [iface: default, target: iqn.2010-10.org.openstack:volume-blablabla, portal: ip_address,port], but a session is using it. Logout session then rerun command to remove record. iscsiadm: Could not execute operation on all records: session exists Sessions: tcp: [160] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) tcp: [161] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) tcp: [162] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) tcp: [163] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) tcp: [164] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla(non-flash) tcp: [44] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) tcp: [45] ip_address:3260,1 iqn.2010-10.org.openstack:volume-blablabla (non-flash) NB: blablabla is uuid volume

1 0

Re: Trove question
by Hirotaka Wakabayashi 19 Jul '24

19 Jul '24

Hello Ксения, Thanks for the contact! Trove team provides the following document for admins to upgrade your Trove service. https://docs.openstack.org/trove/latest/admin/upgrade.html Reading the docs above, you can easily try upgrading Trove for test by using `devstack`. https://docs.openstack.org/trove/latest/install/install-devstack.html If you have any questions, you can contact openstack-discuss@. https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… Best Regards,hirotaka On Wednesday, July 17, 2024 at 09:06:57 PM GMT+9, Ксения Петрова <xeniya.petrova(a)ps.kz> wrote: Hello! We're about to launch our DBaaS on trove in our cloud hosting platform. But we're uncertain about what would be the best way on applying a new version of a trove guest image to our customers databases. So what is the best practices for the process of upgrading guest image? Or nobody of cloud providers cares and upgrading is the completely client's concern? Real-world examples with companies who already sell DBaaS would be the best. Thank you in advance! Best regards, Xeniya Petrova PS Cloud Services

1 0

[Glance] Cancelling Weekly Meeting (July 18)
by Pranali Deore 18 Jul '24

18 Jul '24

Hello, I'm not feeling well, won't be able to chair today's meeting, so cancelling the same. See you next week! Thanks, Pranali Deore

1 0

[Diskimage-builder]Attempting to build opensuse failed.
by Junya Noguchi (Fujitsu) 18 Jul '24

18 Jul '24

To whom it may concern An attempt to build an OpenSUSE image using Diskimage-builder failed. It seems that dracut failed during initial image creation because /dev wasn't mounted. Is there a way to solve this problem? [xxxxxxx@xxxxxxxxxxx ~]$ cat /etc/os-release | grep PRETTY_NAME PRETTY_NAME="Rocky Linux 9.3 (Blue Onyx)" [xxxxxxx@xxxxxxxxxxx ~]$ [xxxxxxx@xxxxxxxxxxx ~]$ disk-image-create opensuse baremetal dhcp-all-interfaces -a amd64 grub2 -o opensuse_test 2024-07-05 02:06:02.796 | diskimage-builder version 3.32.0 2024-07-05 02:06:02.797 | Building elements: base opensuse baremetal dhcp-all-interfaces grub2 2024-07-05 02:06:02.948 | Expanded element dependencies to: package-installs base baremetal zypper cache-url install-bin sysprep dib-init-system install-types pkg-map dhcp-all-interfaces grub2 opensuse 2024-07-05 02:06:03.037 | Building in /tmp/dib_build.pTiDO08e 2024-07-05 02:06:03.041 | Searching elements for block-device[-amd64].yaml ... 2024-07-05 02:06:03.047 | ... done 2024-07-05 02:06:19.736 | Running hooks from /tmp/dib_build.pTiDO08e/hooks/extra-data.d 2024-07-05 02:07:17.361 | dracut: Stored kernel commandline: 2024-07-05 02:07:17.362 | dracut: No dracut internal kernel commandline stored in the initramfs 2024-07-05 02:07:17.363 | dracut: *** Creating image file '/boot/initrd-5.3.18-150300.59.106-default' *** 2024-07-05 02:07:24.019 | dracut: *** Creating initramfs image file '/boot/initrd-5.3.18-150300.59.106-default' done *** 2024-07-05 02:07:24.127 | update-bootloader: 2024-07-05 02:07:24 <3> update-bootloader-4241 run_command.294: '/usr/lib/bootloader/grub2-efi/config' failed with exit code 1, output: 2024-07-05 02:07:24.129 | <<<<<<<<<<<<<<<< 2024-07-05 02:07:24.129 | + /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg 2024-07-05 02:07:24.129 | /usr/sbin/grub2-probe: error: cannot find a device for / (is /dev mounted?). 2024-07-05 02:07:24.129 | >>>>>>>>>>>>>>>> 2024-07-05 02:07:24.129 | Updating bootloader failed 2024-07-05 02:07:24.204 | bootloader_entry: 2024-07-05 02:07:24 <3> bootloader_entry-1651 run_command.294: '/usr/lib/bootloader/grub2-efi/config' failed with exit code 1, output: 2024-07-05 02:07:24.218 | <<<<<<<<<<<<<<<< 2024-07-05 02:07:24.218 | + /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg 2024-07-05 02:07:24.218 | /usr/sbin/grub2-probe: error: cannot find a device for / (is /dev mounted?). 2024-07-05 02:07:24.218 | >>>>>>>>>>>>>>>> 2024-07-05 02:07:24.218 | Failed to get root password hash 2024-07-05 02:07:24.218 | Failed to import /etc/uefi/certs/40905999.crt 2024-07-05 02:07:24.220 | warning: %post(kernel-default-5.3.18-150300.59.106.1.x86_64) scriptlet failed, exit status 255 2024-07-05 02:07:24.221 | done] 2024-07-05 02:07:27.003 | Executing %posttrans script 'ca-certificates-mozilla-2.56-150200.24.1.noarch.rpm' [... 2024-07-05 02:07:27.003 | update-bootloader: 2024-07-05 02:07:27 <3> update-bootloader-1757 run_command.294: '/usr/lib/bootloader/grub2-efi/install' failed with exit code 1, output: 2024-07-05 02:07:27.003 | <<<<<<<<<<<<<<<< 2024-07-05 02:07:27.003 | target = x86_64-efi 2024-07-05 02:07:27.003 | + /usr/sbin/shim-install --config-file=/boot/grub2/grub.cfg --no-nvram --removable 2024-07-05 02:07:27.003 | /usr/sbin/grub2-probe: error: cannot find a device for /boot/efi (is /dev mounted?). 2024-07-05 02:07:27.003 | >>>>>>>>>>>>>>>> 2024-07-05 02:07:27.040 | update-bootloader: 2024-07-05 02:07:27 <3> update-bootloader-1757 run_command.294: '/usr/lib/bootloader/grub2-efi/config' failed with exit code 1, output: 2024-07-05 02:07:27.040 | <<<<<<<<<<<<<<<< 2024-07-05 02:07:27.040 | + /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg 2024-07-05 02:07:27.040 | /usr/sbin/grub2-probe: error: cannot find a device for / (is /dev mounted?). 2024-07-05 02:07:27.040 | >>>>>>>>>>>>>>>> 2024-07-05 02:07:27.089 | . 2024-07-05 02:07:27.089 | Creating initrd: /boot/initrd-5.3.18-150300.59.106-default 2024-07-05 02:07:27.304 | dracut: Executing: /usr/bin/dracut --logfile /var/log/YaST2/mkinitrd.log --force /boot/initrd-5.3.18-150300.59.106-default 5.3.18-150300.59.106-default 2024-07-05 02:07:27.370 | dracut: Turning off host-only mode: '/run' is not mounted! 2024-07-05 02:07:54.459 | dracut: Stored kernel commandline: 2024-07-05 02:07:54.460 | dracut: No dracut internal kernel commandline stored in the initramfs 2024-07-05 02:07:54.461 | dracut: *** Creating image file '/boot/initrd-5.3.18-150300.59.138-default' *** 2024-07-05 02:08:01.205 | dracut: *** Creating initramfs image file '/boot/initrd-5.3.18-150300.59.138-default' done *** 2024-07-05 02:08:01.308 | update-bootloader: 2024-07-05 02:08:01 <3> update-bootloader-8343 run_command.294: '/usr/lib/bootloader/grub2-efi/config' failed with exit code 1, output: 2024-07-05 02:08:01.309 | <<<<<<<<<<<<<<<< 2024-07-05 02:08:01.309 | + /usr/sbin/grub2-mkconfig -o /boot/grub2/grub.cfg 2024-07-05 02:08:01.309 | /usr/sbin/grub2-probe: error: cannot find a device for / (is /dev mounted?). 2024-07-05 02:08:01.309 | >>>>>>>>>>>>>>>> 2024-07-05 02:08:01.310 | Updating bootloader failed 2024-07-05 02:08:01.311 | warning: %posttrans(device-mapper-2.03.05_1.02.163-150200.8.49.1.x86_64.rpm) scriptlet failed, exit status 1 2024-07-05 02:08:11.000 | .....done] 2024-07-05 02:08:12.494 | There are running programs which still use files and libraries deleted or updated by recent upgrades. They should be restarted to benefit from the latest updates. Run 'zypper ps -s' to list these programs. 2024-07-05 02:08:12.494 | 2024-07-05 02:08:12.494 | Since the last system boot core libraries or services have been updated. 2024-07-05 02:08:12.494 | Reboot is suggested to ensure that your system benefits from these updates. 2024-07-05 02:08:12.541 | Unmount /tmp/dib_build.pTiDO08e/mnt/var/cache/zypp 2024-07-05 02:08:12.582 | Unmount /tmp/dib_build.pTiDO08e/mnt/tmp/in_target.d 2024-07-05 02:08:12.603 | Unmount /tmp/dib_build.pTiDO08e/mnt/sys 2024-07-05 02:08:12.623 | Unmount /tmp/dib_build.pTiDO08e/mnt/proc 2024-07-05 02:08:12.667 | Unmount /tmp/dib_build.pTiDO08e/mnt/dev/pts 2024-07-05 02:08:12.688 | Unmount /tmp/dib_build.pTiDO08e/mnt/dev 2024-07-05 02:08:12.882 | INFO diskimage_builder.block_device.blockdevice [-] State already cleaned - no way to do anything here [xxxxxxx@xxxxxxxxxxx ~]$

2 2

Inconsistent server rebuild behavior
by Andrew Bogott 18 Jul '24

18 Jul '24

I'm puzzled by nova instance rebuilds. When I run 'openstack server rebuild --image <whatever>' on a new test VM, it does what I expect: - throws away the old server image - boots up a brand new server using the requested image with the old user/vendor data - attaches new server to the old network port and cinder volumes. That's just what I want! Alas, when I try this with the actual old VMs in need of update, usually it does a totally different thing: - reboots the server - changes the nova db record to reflect the requested VM (so that the server /looks/ like it was rebuilt in 'openstack server show') - That's it! It absolutely does not rebuild the actual server disk image. So, for instance, any files that were present in '/' of the old server are still present post-rebuild. lsb_release still shows the OS of the original base image, disagreeing with the the OS version displayed by 'openstack server show'. I've been reading logfiles for days but I don't see nova ever complain (in either case) that it's doing something unexpected and in both cases the servers wind up in state 'Active'. Am I misunderstanding what this is supposed to do? If not, does anyone have thoughts about what might be going wrong? I assume nova is encountering a roadbump during the rebuild and doing a graceful revert, but if so it sure isn't telling me. Bobcat, kvm, VM images are hosted on ceph/rbd.

2 3

[rally] possibility to skip admin=True validation
by Benedikt Trefzer 18 Jul '24

18 Jul '24

Hi list I'd like to run rally against barbican. Since all barbican scenarios are tagged with @validation.add("required_platform", platform="openstack", admin=True) we cannot use them since our rally configuration does not have an admin user. (actually test itself should succeed, but the validation fails). Question: Is it somehow possible to skip (or unset admin=True requirement) for validation in the task configuration or do I have to rewrite the scenario ? Cheers Benedikt

1 0

Caracal deliverables for bug 2065145
by Francesco Di Nucci 17 Jul '24

17 Jul '24

Hello, as the bug 2065145 <https://bugs.launchpad.net/neutron/+bug/2065145> fix has been merged into stable/2024.1 branch, are there plans to release a new version of neutron packages that include the fix? If not, should it be advisable to create a proposal for a bugfix release? Thanks -- Francesco Di Nucci System Administrator Compute & Networking Service, INFN Naples Email:francesco.dinucci@na.infn.it

2 2

General network questions installing OpenStack single node guided
by klaus.becker＠webmen.de 16 Jul '24

16 Jul '24

Dear OpenStackers, I started my 2nd try installing OpenStack single node guided using this link: https://microstack.run/docs/single-node-guided At the point sunbeam cluster bootstrap I have to decide network settings: sudo sunbeam cluster bootstrap Management networks shared by hosts (CIDRs, separated by comma) (192.168.196.0/24): The example given is this: Management networks shared by hosts (CIDRs, separated by comma) (10.20.20.0/24): 172.16.1.0/24 MetalLB address allocation range (supports multiple ranges, comma separated) (10.20.20.10-10.20.20.20): 172.16.1.201-172.16.1.220 Unfortunately there is no information about the LAN the server is running in. What does "Management networks shared by hosts“ mean? I have ONE host (OpenStack) What should be shared? To whom ? I do not understand the clue behind that. The MetalLB addresses are for the VMs, right? So they must be in an address range of my LAN During my first installation (also single node, but not guided) I was not asked for different networks. Finally I was unable to reach Horizon from my LAN. I tried many efforts with routing (nft), but I did not work. Everything seemed live inside my host, but unusable, because I am running Ubuntu Server 24.02 in a Rack using ssh - so: no GUI. I hoped to get another chance with this „guided" installation. What I hoped to get: 1. A dedicated network inside OpenStack where all components are communicating with each other without interfering with my LAN. 2. Access to the Dashboard (Horizon) from my LAN 3. Access to VMs I am using inside OpenStack from my LAN Because I am working over ssh, the host uses an IP number from my LAN (192.168.196.11) There are about 20 IPs free in my LAN The question "Management networks shared by hosts (CIDRs, separated by comma) (192.168.196.0/24):“ shows the whole network (/24) as given. I do not want to run into IP conflicts with other PCs, routers etc. in my LAN. So could someone PLEASE give me a bit more background to this network topic? Thanx a lot! Klaus

2 3

[RALLY 4.1.0] Verifier reconfigure fails when in "no admin" mode
by Jean-François TALTAVULL 16 Jul '24

16 Jul '24

Hi All, I'm using a Rally (4.1.0) deployment with existing users and no admin credentials. So the command "rally env show" outputs "admin": null in the json and it's ok. But the problem is that the command "rally verify configure-verifier -reconfigure" fails with: "rally_openstack.common.credential.OpenStackCredential() argument after ** must be a mapping, not NoneType" I've been struggling with this error for a number of hours with no results :-( Any idea ? I looked for a known bug in launchpad but found nothing. Thanks, Jean-Francois

2 4

Re: [neutron] ovs: multiple rows in Manager patch
by Brian Haley 16 Jul '24

16 Jul '24

Just sending response to the list in case anyone else has the same issue. On 6/17/24 1:09 PM, stream_unpicked390(a)simplelogin.com wrote: > Hi, > > On 6/13/24 21:38, Brian Haley - haleyb.dev(a)gmail.com wrote: >> Hi, >> >> On 6/13/24 4:53 AM, stream_unpicked390(a)simplelogin.com wrote: >>> Hi Brian, >>> On 6/12/24 23:04, Brian Haley - haleyb.dev(a)gmail.com wrote: >>>> Hi, >>>> >>>> On 6/12/24 12:43 PM, stream_unpicked390(a)simplelogin.com wrote: >>>>> Hi everyone! >>>>> >>>>> this is my first time on a mailing list, so please excuse any >>>>> "obvious" mistakes and feel free to correct me :) >>>>> >>>>> I'm currently setting up a minimal OpenStack system manually on one >>>>> server. The setup is nearly complete but I'm running into issues >>>>> with neutron. After fully completing the neutron setup as mentioned >>>>> in the docs, the neutron-ovs-service refuses to start, showing the >>>>> error message >>>> >>>> Sorry, but I have to ask which "docs" are you using? >>> >>> thanks for your quick answer! I followed the OpenStack install guide >>> under https://docs.openstack.org/2024.1/install/. For neutron >>> specifically, I used the document linked under >>> https://docs.openstack.org/neutron/2024.1/install/install-ubuntu.html. >>> >>> As I mentioned, I'm currently setting up everything on just one >>> server, the documentations scenario describes two servers. This is >>> the only intentional diversion I made from the docs. I've been trying >>> to setup a self-service network. >>> >>>> I don't see ptcp used in any of the examples here for ovsdb_connection: >>>> >>>> https://docs.openstack.org/neutron/latest/install/ >>> >>> I couldn't find any example of the ovsdb_connection and I don't >>> remember modifying any value like that either. The problem existed >>> "right out of the box". Can you point me to the part of the linked >>> documentation where the ovsdb_connection config is discussed? >> >> Instead of trying to go through the details of anything that might be >> wrong, if you are just trying to get a single-node Openstack running >> have you tried using devstack [0]? It would be much simpler if this is >> just for testing purposes. > This is a production setup so devstack was out of the question. Because > of our very tight constraints, we first have to set up a single node, > before being able to add additional servers. Definitely not ideal.. Your > hint about ovsdb_connection helped me out! While I couldn't find any > setting with the name ovsdb_connection already set to an, apparently > wrong, string, I set ovsdb_connection to the value mentioned by you. > This probably overwrote something I couldn't find, because after > restarting neutron, my issues were gone! Thanks again for looking into > my issue and guiding me on the right path! Glad it worked out, thanks for responding. -Brian >> [0] https://github.com/openstack-dev/devstack.git >> >>>>> multiple rows in Manager patch "ptcp:6640:127.0.0.0" >>>> >>>> Two things look wrong here, both the IP address and port. Typically >>>> this string would be "ptcp:127.0.0.1:6640" or "ptcp:0.0.0.0:6640" in >>>> ml2_conf.ini. >>> >>> Thanks! I will try to take a look at the aforementioned config as >>> soon as possible and report back! >>> >>>> >>>> -Brian >>>> >>>>> I dumped the ovs database which only shows one row in the Manager >>>>> table. After many days of debugging and googleing I'm out of ideas >>>>> how this could be solved.. >>>>> I already posted this issue on serverfault >>>>> (https://serverfault.com/questions/1160418/openstack-ovs-multiple-rows-in-ma…) only after that post finding this mailing list! >>>>> >>>>> Best regards >>>>> Talooola >>>>> >>>> >>

2 1

[swift] Weird log corruption or something more serious?
by Sam Morrison 16 Jul '24

16 Jul '24

Hi, We are debugging a weird issue with our swift cluster (currently running 2.29.2) We got a report from a user that they were getting upload failures and then sent us this from their logs: 2024-06-25 23:30:06,829 | swiftclient.service | ERROR | Object PUT failed: https://swift-host/v1/PROJECT_ID_A/prod_result/195e5e8e-334a-11ef-ba70-0a58… 401 Unauthorized [first 60 chars of response] b'<html><h1>Unauthorized</h1><p>This server could not verify t' (txn: txab25fcfcf3354bbbaf105-00667b52fe) Searching our logs for that transaction ID I found: 203.101.227.241 127.0.0.1 25/Jun/2024/23/30/06 PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/blobs/default/content/vol-27/chap-25/6bc30bae-4f5e-40a8-bc63-096679af1a58.bytes HTTP/1.0 401 - rclone/v1.59.0%2Cpython-swiftclient-4.2.0 gAAAAABme1L7tlfE... - 131 - txab25fcfcf3354bbbaf105-00667b52fe - 0.0440 - - 1719358206.765954018 1719358206.809994936 0 Note this is a completely different project ID from our side, timestamp is correct too. We also have this: ERROR WSGI: code 400, message Bad request syntax ('\x89PNG') (txn: txab25fcfcf3354bbbaf105-00667b52fe) (client_ip: XX.XX.XX.XX) Upon further analysis we see this quite a lot, mostly from attempted hackers but lots from real users and lots seem to be related to rclone. Eg. Jun 27 08:24:46 swift-host proxy-server[70043]: ERROR WSGI: code 400, message Bad request syntax ('PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/elasticsearch/nexus/nodes/0/indices/42b6a6a76dae683a647546ac02a6883108ac7df5/0/index/segments_4PUT /v1/AUTH_PROJECT_ID_B/nexus-migration/nexus-data/elasticsearch/nexus/nodes/0/indices/4db62ff1327dfe236d85b1dd1a6a9e8139e7e4cf/0/index/_67t.cfs HTTP/1.1') (txn: txd57a3d00bb1942c6a390e-00667c952a) (client_ip: XX.XX.XX.XX) Anyone know what is going on here? Thanks, Sam

1 1

[tc][all] OpenStack Technical Committee Weekly Summary and Meeting Agenda (2024.2/R-11)
by Goutham Pacha Ravi 16 Jul '24

16 Jul '24

Hello Stackers, The 2024.2 release train is chugging along, and its final stop is 11 weeks away [1]. In the past week, the OpenStack Technical Committee updated its charter to enforce its affiliation diversity requirements during TC elections [2]. If an election results in over 50% of the TC being affiliated with the same organization, we've adopted a rule to vacate the least favored candidate elected from that organization and accommodate a non-elected candidate with a different affiliation, if one exists. We're also ideating on how to handle situations where there are no candidates from other organizations [3]. Your views are greatly appreciated. Nominations for the TC (and PTL) elections for 2025.2 open on 2024-08-14. You'll begin to receive election-specific emails soon. In other news, Jeremy Stanley (fungi) shared the OpenInfra Foundation's Diversity and Inclusion Working Group updates on this list recently [4]. I encourage you to participate in the survey that the group has put together [5]. It's open year-round, and the feedback gathered will be incorporated continuously. === Weekly Meeting === Last week's Technical Committee meeting was well attended, and the meeting was logged to eavesdrop [6]. We discussed project activity and gate issues in Monasca, Freezer, Skyline, Tacker, Masakari, Zaqar, and Adjutant. We're very glad to see the project teams' responsiveness to the concerns raised. Monasca and Freezer teams have expressed their desire to remain "inactive" through this release cycle. A proposal has been made to move Skyline from the list of "Emerging" projects. The TC will review these proposals in the coming week. The retirement of the "kuryr-kubernetes" repository was held off temporarily to address dependencies within Tacker. The next Technical Committee meeting is tomorrow, 2024-07-16! The meeting will be hosted on OFTC's #openstack-tc channel, and the agenda has been posted to the Meetings Wiki Page [7]. Please consider joining us! === Governance Proposals === ==== Merged ==== Adding a rule to manage the affiliation diversity requirement in the TC | https://review.opendev.org/c/openstack/governance/+/922512 ==== Open for review/discussion ==== Follow up on the affiliation diversity handling | https://review.opendev.org/c/openstack/governance/+/923876 Move Skyline out from the "Emerging Projects" list | https://review.opendev.org/c/openstack/governance/+/924109 Transition Watcher project to DPL | https://review.opendev.org/c/openstack/governance/+/923583 Inactive state extensions: Monasca | https://review.opendev.org/c/openstack/governance/+/923919 Update to include docs and miscellaneous repos for AC status | https://review.opendev.org/c/openstack/governance/+/915021 Update criteria for the inactive projects to become active again | https://review.opendev.org/c/openstack/governance/+/921500 Inactive state extensions: Freezer | https://review.opendev.org/c/openstack/governance/+/923441 Retire kuryr-kubernetes and kuryr-tempest-plugin | https://review.opendev.org/c/openstack/governance/+/922507 Remove Eventlet From OpenStack | https://review.opendev.org/c/openstack/governance/+/902585 The OpenStack Technical Committee serves you! We're always willing to chat with you and would love feedback: === How to contact the TC === You can reach out to the TC in multiple ways: 1. Email: you can send the email with the tag [tc] on this email list. 2. Ping us using the 'tc-members' keyword on the #openstack-tc IRC channel 3. Join us at our weekly meeting: The Technical Committee meets every week on Tuesdays at 1800 UTC [7] === Upcoming Events === 2024-08-14: Nominations open for 2025.1 OpenStack PTL+TC elections 2024-08-24: OpenInfra Days, Vietnam: https://2024.vietopeninfra.org/ 2024-08-29: Dalmatian-3 milestone Thank you very much for reading! On behalf of the OpenStack TC, Goutham Pacha Ravi (gouthamr) OpenStack TC Chair [1] Release Schedule: https://releases.openstack.org/dalmatian/schedule.html [2] TC Diversity Requirement: https://governance.openstack.org/tc/reference/charter.html#tc-diversity-req… [3] Following up on affiliation diversity: https://review.opendev.org/c/openstack/governance/+/923876 [4] OpenInfra D&I initiatives and survey: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… [5] D&I survey: https://openinfrafoundation.formstack.com/forms/openinfra_diversity_inclusi… [6] TC Meeting IRC Logs, 2024-07-09: https://meetings.opendev.org/meetings/tc/2024/tc.2024-07-09-18.00.log.html [7] TC Meeting, 2024-07-16: https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting

1 0

Restricting User Deletion to Project Owners
by Thamanna Farhath 16 Jul '24

16 Jul '24

Hi OpenStack Community, I am working on a policy configuration to ensure that only owners of a project can delete users within their own project. Below is my current setup and the policy rules I have defined. Current Setup OpenStack deployment using Kolla Ansible 2023.1. Created an owner role with permissions to create, delete, and manage users and projects. But it allows you to delete users from other projects as well. So, I need to achieve the below scenario. Policy Rules yaml "admin_required": "role:admin" "admin_or_owner": "rule:admin_required or (role:owner and project_id:%(target.user.project_id)s)" "identity:delete_user": "rule:admin_or_owner" Scenario User demo with owner role of project X creates users newuser1 and newuser2 assigned to project X. User tester with owner role of project Y creates users myuser1 and myuser2 assigned to project Y. With the above configuration, I aim to ensure that: User demo can only delete newuser1 and newuser2 within project X. User tester can only delete myuser1 and myuser2 within project Y. Thank you for your support. Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 3

[keystone] Keystone Single Sign-On for REST API Access
by leon.amtmann＠ibm.com 16 Jul '24

16 Jul '24

Hello OpenStack Community, and greetings especially to the Keystone experts among you. I'm currently co-administering an OpenStack 17.1.3 cluster with a few compute nodes and three controllers. For a better user experience, we've enabled Single Sign-On using OIDC for Horizon, which is working fabulously. To do that, the [mod_auth_openidc module](https://github.com/OpenIDC/mod_auth_openidc) is configured for httpd on the controller nodes. However, we're now facing a novel scenario for us. Basically, we want to interact with the OpenStack REST APIs - but not using a usual token request to `/v3/auth/tokens`, but using Single Sign-On. We've looked at the authentication request that Horizon makes to Keystone after successful authentication with the SSO provider. As far as we can tell: 1. After successful authentication with the SSO identity provider, Keystone redirects back to the redirect URI with a grant_id, id_token and state in the URL fragments (after # in the URL). 2. The redirect URI is `/v3/auth/OS-FEDERATION/websso/openid`, which contains HTML that will read the fragments and POST them as form data to somewhere. 3. Those fragments get POSTed to `/v3/auth/OS-FEDERATION/websso/openid`. 4. The response from Keystone is an HTML document containing an auth token, rigged to get POSTed to Horizon at `/dashboard/auth/websso/` (presumably to start a fresh session). So far, so good. The [Keystone federation documentation](https://docs.openstack.org/keystone/latest/admin/federation/… does show the [Horizon flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct… in action. I can replicate it in part using cURL, by doing the same requests to the same endpoints that my browser does. However, I do not understand or see a request to `/v3/auth/OS-FEDERATION/websso/mapped` where Keystone actually issues a token. Instead, after the `id_token`, `grant_id`, etc. are POSTed to `/v3/auth/OS-FEDERATION/websso/openid`, Keystone responds with an HTML document containing the token (see step 4. in my earlier list). I've only seen this working for Horizon in an actual browser, though. Am I misunderstanding the documentation? Right above that in the documentation, there is a section about an unrelated [OpenID Connect Authentication Flow](https://docs.openstack.org/keystone/latest/admin/federation/introduct…. It contains a graphic in which the first request made is a GET request to `/secure`. A direct GET request yields a `404`, so I assume this is a placeholder for any protected resource. However, if I request any protected resource without a valid token, I do not receive a 302 as the graphic would seem to suggest. Is this a behavior that would need to be configured, first? In short: How does one end up with an unscoped token when trying to SSO against Keystone from something that is not Horizon? I'm just wondering if I am on the correct path in trying to modify the `10-keystone.wsgi` in `/etc/httpd/conf.d/` to use [multiple providers](https://github.com/OpenIDC/mod_auth_openidc/wiki/Multiple-Provid…. If, after starting the SSO process, I end up with a `grant_id` and an `id_token`, where do I post this to to get a Keystone token in return? After going through the documentation, I am still at a loss. I would appreciate any help. Thank you for your time.

4 3

[tacker] Cancelling IRC meeting
by Yasufumi Ogawa 15 Jul '24

15 Jul '24

Hi team, I'd like to skip IRC meeting this week since I'll be out of office. Thanks, Yasufumi

1 0

[barbican] Weekly meeting canceled Jul 15th
by Grzegorz Grasza 15 Jul '24

15 Jul '24

Hi all, I'll be traveling during our usual meeting hour, so I'm cancelling it this week. / Greg

1 0

[neutron] Bug Deputy Report July 8 - July 14
by Yatin Karel 15 Jul '24

15 Jul '24

Hi Neutrinos, Below is the bug deputy report for last week:- High ------ - https://bugs.launchpad.net/neutron/+bug/2072754 - Restarting octavia breaks IPv4 Load Balancers with health checks Assigned to Pavlo Shchelokovskyy - https://bugs.launchpad.net/neutron/+bug/2072567 - neutron-ovn-tempest-postgres-full job fails as oslo_db.exception.DBError: (psycopg2.errors.GroupingError) column "standardattributes_1.id" must appear in the GROUP BY clause or be used in an aggregate function Assigned to Rodolfo Alonso Medium ---------- - https://bugs.launchpad.net/neutron/+bug/2072978 - Show some error in logs when failing to load nb connection certificate Assigned to Chris Buggy Wishlist ---------- - https://bugs.launchpad.net/neutron/+bug/2072505 - [RFE] "External network not reachable from subnet" could take static routes into account Unassigned -- Thanks and Regards Yatin Karel

1 0

Making stestr scheduler smarter with a lot of threads
by Thomas Goirand 15 Jul '24

15 Jul '24

Hi, Currently, it looks like stestr calculate which thread should run which test at the beginning, by calculating some partition, and then launch all tests at once. With a lot of threads, the result is, at the end, only a few cores are in use, with all the others being idle. Would there be a way to have a pool of available threads instead, and have stestr to give threads something to eat when they are available, instead of the current way? How much work would that be? Cheers, Thomas Goirand (zigo)

4 3

Tenacity 8.4.2 breaking at least 4 OpenStack projects
by Thomas Goirand 14 Jul '24

14 Jul '24

Hi, It looks like Tenacity 8.4.2 broke a number of projects: - heat - ironic - octavia - python-octavia-lib I filed this for Octavia: https://bugs.launchpad.net/octavia/+bug/2073044 though I should probably do the same for the other projects. Unfortunately, someone uploaded Tenacity 8.4.2 to Debian unstable, so the packages are currently broken. :/ I'll see if the upload can be temporarily reverted, but the more long term solution is to fix the above projects and up the global requirements. Cheers, Thomas Goirand (zigo)

2 2

Subject: Assistance Needed: Restricting Owner Role to Manage Users and Projects Within Their Own Project
by Thamanna Farhath 13 Jul '24

13 Jul '24

Hi OpenStack Community, I am currently using openstack kolla ansible 2023.1, now facing an issue with the role-based access control in my OpenStack deployment.Could you please assist me in achieving my requirements for proper role configuration and access management? I have created a custom role named "owner" with permissions to create, delete, and manage users and projects, and also to assign users to projects. However, I want to restrict the "owner" role to manage only the users and projects within their own project, and not across other projects. Here is the policy file configuration(/etc/kolla/keystone/policy.yaml) I am using: yaml # Custom rule to allow users with the 'owner' role to manage users and projects identity:create_project: "role:owner or role:admin" admin_or_owner: "rule:admin_required or project_id:%(target.project.id)s" identity:delete_project: "rule:admin_or_owner" identity:delete_user: "rule:admin_or_owner" identity:create_user: "role:owner or role:admin" identity:get_user: "role:owner or role:admin or role:member or role:user" identity:list_users: "role:owner or role:admin" identity:update_user: "role:owner or role:admin" identity:create_grant: "role:owner or role:admin" identity:list_grants: "role:owner or role:admin" I have the following questions: Is the above policy configuration correct for achieving the desired restrictions? Are there any other possibilities or best practices to ensure that the "owner" role can only delete users and projects within their own project? How can I improve or adjust the policy rules to meet these requirements effectively? Thank you in advance for your assistance. ---- On Fri, 12 Jul 2024 10:49:22 +0530 Artem Goncharov <artem.goncharov(a)gmail.com> wrote --- Hi, 1) in Keystone we are currently working on implementing domain manager persona that allows certain person on a "customer" side to do project and user operations. This includes explicit listing of users in a domain 2) this is conceptually wrong to talk about users in a project, since users are owned by domains and can get access to multiple projects within the domain (and with some tricks to other domains). So you are partially right that role assignments is the way of figuring out access of users to projects. One more challenge though is that such access can be granted using user groups. In this case you actually should also resolve groups access to the desired project. Hope this helps, Artem ---- typed from mobile, auto-correct typos assumed ---- On Thu, Jul 11, 2024, 20:34 Thamanna Farhath <mailto:thamanna.f@zybisys.com> wrote: Hello openstack community, I am currently working on an OpenStack kolla ansible 2023.1. I have created a custom role " owner " Objective: Users with the owner role can only list users within their project. Avoid additional API calls for filtering users by project. Current Challenge: Using direct API calls, the list users API currently returns all users without any project-specific filtering. While additional API calls to the role_assignments endpoint can achieve the desired filtering, this approach is not efficient and doesn't restrict access at the API level. I am considering defining custom Keystone policies to achieve this restriction. However, I am unsure how to properly configure these policies to enforce project-specific access control effectively. Thanks in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email." Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

1 0

[keystone] Weekly Meeting Canceled 17-Jul-2024
by Dave Wilde 13 Jul '24

13 Jul '24

Hello, I'm canceling the Keystone weekly meeting for 17-Jul-2024 as I'll be on PTO. Please reach out to the mailing list or #openstack-keystone on IRC for assistance. Thanks, /Dave

1 0

Assistance Needed: Restricting User List API Access Based on Project Context
by Artem Goncharov 12 Jul '24

12 Jul '24

Hi, 1) in Keystone we are currently working on implementing domain manager persona that allows certain person on a "customer" side to do project and user operations. This includes explicit listing of users in a domain 2) this is conceptually wrong to talk about users in a project, since users are owned by domains and can get access to multiple projects within the domain (and with some tricks to other domains). So you are partially right that role assignments is the way of figuring out access of users to projects. One more challenge though is that such access can be granted using user groups. In this case you actually should also resolve groups access to the desired project. Hope this helps, Artem ---- typed from mobile, auto-correct typos assumed ---- On Thu, Jul 11, 2024, 20:34 Thamanna Farhath <thamanna.f(a)zybisys.com> wrote: > Hello openstack community, > I am currently working on an OpenStack kolla ansible 2023.1. I > have created a custom role " owner " > > *Objective:* > > 1. Users with the owner role can only list users within their project. > 2. Avoid additional API calls for filtering users by project. > > *Current Challenge:* > Using direct API calls, the list users API currently returns all > users without any project-specific filtering. While additional API calls to > the role_assignments endpoint can achieve the desired filtering, this > approach is not efficient and doesn't restrict access at the API level. > > I am considering defining custom Keystone policies to achieve this > restriction. However, I am unsure how to properly configure these policies > to enforce project-specific access control effectively. > > Thanks in advance > > > ------------------------------ > *Disclaimer :** The content of this email and any files transmitted with > it are confidential and intended solely for the use of the individual or > entity to which they are addressed. If you have received this email in > error, please notify the sender and remove the messages from your system. > If you are not the named addressee, it is strictly forbidden for you to > share, circulate, distribute or copy any part of this e-mail to any third > party without the written consent of the sender.* > > > > *E-mail transmission cannot be guaranteed to be secured or error free as > information could be intercepted, corrupted, lost, destroyed, arrive late, > incomplete, or may contain viruses. Therefore, we do not accept liability > for any errors or omissions in the contents of this message, which arise as > a result of e-mail transmission. The recipient should check this e-mail and > any attachments for the presence of viruses. The company accepts no > liability for any damage caused by any virus transmitted by this email."* > >

1 0

[ironic] SNMP hardware type
by Julia Kreger 12 Jul '24

12 Jul '24

Greetings folks, For those that are unaware of it, Ironic has an snmp[0] hardware type which allows for the remote control of power ports on an PDU, which makes Ironic powerful for a variety of non-traditional computing hardware to be leveraged with Ironic. If you are aware of this hardware type and happen to use it, you may want to engage with the Upstream community. Historically we've used a tool called virtualpdu[1] to facilitate testing, and we're facing some challenges with newer pysnmp[2] versions. These challenges have us wondering if there is value for us to fix virtualpdu and continue upstream testing. Realistically, if nobody steps forward to help maintain virtualpdu and the snmp hardware type, upstream testing may become limited or be discontinued for the snmp hardware type entirely, which is likely to impact users of this hardware type. If you're interested in helping maintain the hardware type and its testing, please reach out to the Ironic team via the weekly team meeting[3]. Thanks, -Julia [0]: https://docs.openstack.org/ironic/latest/admin/drivers/snmp.html [1]: https://opendev.org/openstack/virtualpdu [2]: https://pypi.org/project/pysnmp-lextudio/#history [3]: https://wiki.openstack.org/wiki/Meetings/Ironic

1 0

Assistance Needed: Restricting User List API Access Based on Project Context
by Thamanna Farhath 12 Jul '24

12 Jul '24

Hello openstack community, I am currently working on an OpenStack kolla ansible 2023.1. I have created a custom role " owner " Objective: Users with the owner role can only list users within their project. Avoid additional API calls for filtering users by project. Current Challenge: Using direct API calls, the list users API currently returns all users without any project-specific filtering. While additional API calls to the role_assignments endpoint can achieve the desired filtering, this approach is not efficient and doesn't restrict access at the API level. I am considering defining custom Keystone policies to achieve this restriction. However, I am unsure how to properly configure these policies to enforce project-specific access control effectively. Thanks in advance Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

2 1

[nova] "failure domain" scheduler
by Mohammed Naser 12 Jul '24

12 Jul '24

Hi everyone I had a discussion a few days ago in the #openstack-nova about the possibility of introducing the concept of different failure domains, which would be a component inside of an availability zone. The concept is similar to Azure’s availability set feature: https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-o… I’ve built a very similar nova scheduler filter which leverages server groups + another scheduler hint called `different_failure_domain` then it will actually build them inside different failure domains. The failure domains are built similar to AZs in terms of being modeled are using aggregates, so it would use a `failure_domain` aggregate metadata. I’ve managed to build and validate this functionality with my team here: https://github.com/vexxhost/nova-scheduler-filters Now, based on that, I’m wondering if: 1. Is this the best approach to take based on this? 2. Is this something we can upstream into Nova easily as an extra filter? I think this is helpful for a lot of the “VMware” world people. 😊 Thanks, Mohammed

2 1