- openstack-discuss - lists.openstack.org

gerrit no longer lading from iphone
by Sorin Sbarnea 05 Aug '21

05 Aug '21

I am wondering if something was changed on our gerrit deployment recently as it seems to no longer load on ios safari. I know,… not the most common use case… still adding the usual recheck can prove useful after checking zuul comment. /zbr -- -- /zbr

5 7

[neutron] Drivers team meeting - agenda for Friday 05.08.2021
by Slawek Kaplonski 05 Aug '21

05 Aug '21

Hi, Agenda for our tomorrow's drivers meeting is at [1]. We have one RFE to discuss: https://bugs.launchpad.net/neutron/+bug/1936408 - [RFE] Neutron quota change should check available existing resources [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[all][tc] Technical Committee next weekly meeting on Aug 5th at 1500 UTC
by Ghanshyam Mann 04 Aug '21

04 Aug '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for Aug 5th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, Aug 4th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[Ironic] Users Needed! OpenInfra Live Opportunity
by Erin Disney 04 Aug '21

04 Aug '21

Hey All- We have an OpenInfra Live episode coming up next Thursday, August 12th at 14:00 UTC focused on Ironic. We will be kicking off the episode with a project overview and look at the development roadmap, then would like to feature companies running it in production to discuss their use cases, and wrap up the episode discussing FAQs regarding Ironic as a group. We currently have one user signed up but would love to add one or two more to the line up. If this is something you or your team would be interested in participating in, please reach out to me directly (erin(a)openstack.org) If the day/time doesn’t work but you are still willing to discuss your deployment, a pre-recorded video is an option as well. Thanks in advance! For more on OpenInfra Live, check out https://openinfra.dev/live. Erin Disney Event Marketing Open Infrastructure Foundation

1 0

[largescale-sig] Next meeting: Aug 4, 15utc
by Thierry Carrez 04 Aug '21

04 Aug '21

Hi everyone, Our next Large Scale SIG meeting will be this Wednesday in #openstack-operators on OFTC IRC, at 15UTC. You can doublecheck how that time translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20210804T15 A number of topics have already been added to the agenda, including discussing the contents of our next OpenInfra.Live show. Feel free to add other topics to our agenda at: https://etherpad.openstack.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

1 1

[cinder] Bug deputy report for week of 2021-04-08
by Sofia Enriquez 04 Aug '21

04 Aug '21

Hello, This is a bug report from 2021-28-07 to 2021-04-08. We won't have the Cinder Bug Meeting today but we're welcome to attend the cinder mid cycle. Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Low - https://bugs.launchpad.net/cinder/+bug/1938869 "max_over_subscription_ratio set auto mode rbd backend will have a negative value". Unassigned. Incomplete - https://bugs.launchpad.net/cinder/+bug/1938488 "When restarting the c-bak service snapshot status is always backing-up". Unassigned Cheers, Sofi -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

Migrating VM's
by Derek O keeffe 04 Aug '21

04 Aug '21

Hi all, I have a question. If we have an old openstack deployment (Queens) that have VM's (with & without volumes attached) and we want to migrate those to a new deploy (Victoria) can this be achieved by the owners of the VM's through horizon in some way? We can take snapshots of the vm's that don't have volumes attached, copy them to the new controller and re instantiate them but we haven't found a solution for the volumes yet. This give us more work though as it all needs to be done over cli so the user is taken out of the loop and it falls on us 3 admins to move over 300 VM's. Any advice or info would be greatly appreciated. Thanks in advance. Derek

3 7

[nova][neutron][deployment-projects] Re secbug #1734320
by Radosław Piliszek 03 Aug '21

03 Aug '21

Hello Folks! I am writing this because a recent patch proposed to DevStack [1] mentioned "when using ml2/ovs vif isolation should always be used to prevent cross tenant traffic during a live migration" which is related to secbug #1734320 "Eavesdropping private traffic" [2]. However, I've found that none of the publicly-available deployment projects seem to be using ``isolate_vif``. [3] [4] Should this be corrected? PS: I used the deployment-projects tag as a collective tag to avoid mentioning all the projects (as it is too long to write :-) ). I hope that relevant people see this if need be or someone passes the information to them. For now, I am curious whether this should actually be enforced by default with ML2/OVS. [1] https://review.opendev.org/c/openstack/devstack/+/796826 [2] https://bugs.launchpad.net/neutron/+bug/1734320 [3] https://codesearch.opendev.org/?q=%5Cbisolate_vif%5Cb&i=nope&files=&exclude… [4] https://github.com/search?p=1&q=isolate_vif&type=Code -yoctozepto

3 2

Re: [centos][kolla-ansible][wallaby][vpnaas] I need Help
by Björn Puttmann 03 Aug '21

03 Aug '21

Hi! We had similar problems while testing VPNaaS with Victoria in HA mode. The main takeaway was the following: - the path to the pidfile of the libreswan process in the driver is wrong. This causes the process.active check to always fail. diff --git a/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py b/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py index 90731f7a4..48b178d05 100644 --- a/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py +++ b/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py @@ -30,6 +30,9 @@ class LibreSwanProcess(ipsec.OpenSwanProcess): self._rootwrap_cfg = self._get_rootwrap_config() super(LibreSwanProcess, self).__init__(conf, process_id, vpnservice, namespace) + self.pid_path = os.path.join( + self.config_dir, 'var', 'run', 'pluto', 'pluto') + self.pid_file = '%s.pid' % self.pid_path def _ipsec_execute(self, cmd, check_exit_code=True, extra_ok_codes=None): """Execute ipsec command on namespace. - when deploying VPNaaS in HA mode, takeover fails as the standby node is missing the necessary configuration files for Libreswan. diff --git a/neutron_vpnaas/services/vpn/device_drivers/ipsec.py b/neutron_vpnaas/services/vpn/device_drivers/ipsec.py index 424c0eea0..7b1c96b3d 100644 --- a/neutron_vpnaas/services/vpn/device_drivers/ipsec.py +++ b/neutron_vpnaas/services/vpn/device_drivers/ipsec.py @@ -1077,12 +1077,19 @@ class IPsecDriver(device_drivers.DeviceDriver, metaclass=abc.ABCMeta): def report_status(self, context): status_changed_vpn_services = [] for process_id, process in list(self.processes.items()): - # NOTE(mnaser): It's not necessary to check status for processes - # of a backup L3 agent router = self.routers.get(process_id) - if router and router.router['ha'] and router.ha_state == 'backup': - LOG.debug("%s router in backup state, skipping", process_id) - continue + if router and router.router['ha']: + # NOTE(mnaser): It's not necessary to check status for processes + # of a backup L3 agent + if router.ha_state == 'backup': + LOG.debug("%s router in backup state, skipping", process_id) + continue + # When a ha takeover took place, router will initially not be active. Enable it now. + if router.ha_state == 'primary' and not process.active: + LOG.debug("%s is primary but not active. Activating.", process_id) + process.ensure_configs() + process.enable() + continue if not self.should_be_reported(context, process): continue previous_status = self.get_process_status_cache(process) With these patches applied, VPNaaS worked as expected, at least in Victoria. It seems, as Bodo already pointed out, that CentOS 8 is coming with Libreswan 4.4 which apparently dropped the "—use-netkey" parameter and now expects "--use-xfrm" So you could try to patch the corresponding driver files: diff --git a/neutron_vpnaas/services/vpn/device_drivers/ipsec.py b/neutron_vpnaas/services/vpn/device_drivers/ipsec.py index 424c0eea0..051719d40 100644 --- a/neutron_vpnaas/services/vpn/device_drivers/ipsec.py +++ b/neutron_vpnaas/services/vpn/device_drivers/ipsec.py @@ -647,7 +647,7 @@ class OpenSwanProcess(BaseSwanProcess): 'pluto', '--ctlbase', self.pid_path, '--ipsecdir', self.etc_dir, - '--use-netkey', + '--use-xfrm', '--uniqueids', '--nat_traversal', '--secretsfile', self.secrets_file] diff --git a/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py b/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py index 90731f7a4..b68e05f81 100644 --- a/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py +++ b/neutron_vpnaas/services/vpn/device_drivers/libreswan_ipsec.py @@ -106,7 +106,7 @@ class LibreSwanProcess(ipsec.OpenSwanProcess): def start_pluto(self): cmd = ['pluto', - '--use-netkey', + '--use-xfrm', '--uniqueids'] if self.conf.ipsec.enable_detailed_logging: You could apply the patches to the device driver files on a local machine and copy the patched files into the corresponding containers via: docker cp /path/to/patched/{{ driver_file }} neutron_l3_agent:/usr/lib/python3.6/site-packages/neutron_vpnaas/services/vpn/device_drivers/{{ driver_file }} After that, restart the container. At least, that worked for us. Some commands, that proved quite useful for debugging the VPN stuff (please ignore if you already know this, just found this info very useful myself ;-) Get host for VPN tunnel: export PROJECT_ID=THE_PROJECT_ID ROUTER_ID=$(openstack --os-cloud THE_PROJECT_NAME vpn service list --long -f json | jq -r ".[] | select(.Project == \"${PROJECT_ID}\").Router") echo ${ROUTER_ID} openstack --os-cloud THE_PROJECT_NAME port list --router ${ROUTER_ID} --device-owner network:ha_router_replicated_interface -c binding_host_id -f value | sort -u Enable detailed logging in /etc/kolla/neutron-l3-agent/l3_agent.ini (restart container after changing this): [ipsec] enable_detailed_logging = True Logfile can now be found in neutron_l3_agent under /var/lib/neutron/ipsec/ROUTER_ID/log/ Get ipsec status (execute in neutron_l3_agent container): export ROUTER_ID=THE_ROUTER_ID ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --rootwrap_config=/etc/neutron/rootwrap.conf --cmd="ipsec,whack,--status" ipsec.conf for router can be found under /var/lib/neutron/ipsec/ROUTER_ID/etc/ipsec.conf If you want to change the configuration directly (e.g. for testing cipher), the connection configuration needs to be reloaded: export ROUTER_ID=THE_ROUTER_ID ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --rootwrap_config=/etc/neutron/rootwrap.conf --cmd="ipsec,auto,--replace,CONNECTION_ID" CONNECTION_ID can be found in ipsec.conf, e.g. conn 2b965b6b-2e03-4a89-acff-74cb56335f22 To initiate the tunnel after configuration change: export ROUTER_ID=THE_ROUTER_ID ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --rootwrap_config=/etc/neutron/rootwrap.conf --cmd="ipsec,whack,--initiate,--name,CONNECTION_ID" To reread secrets: export ROUTER_ID=THE_ROUTER_ID ip netns exec qrouter-${ROUTER_ID} neutron-vpn-netns-wrapper --mount_paths="/etc:/var/lib/neutron/ipsec/${ROUTER_ID}/etc,/var/run:/var/lib/neutron/ipsec/${ROUTER_ID}/var/run" --rootwrap_config=/etc/neutron/rootwrap.conf --cmd="ipsec,auto,--rereadsecrets" Hope this is of some use. All the best and take care, Björn Puttmann -- NEOZO Cloud GmbH

2 1

[nova][placement]Weekly meeting canceled on 10th of Aug
by Balazs Gibizer 03 Aug '21

03 Aug '21

Hi, As it seems many of us will be on PTO next week I cancel the weekly meeting. Cheers, gibi

1 0

stackalytics.com/api/1.0/activity
by Csatari, Gergely (Nokia - FI/Espoo) 03 Aug '21

03 Aug '21

Hi, We plan to use the API of stackalytics.com and we realized that the data it provides ([1<https://www.stackalytics.com/api/1.0/activity?page_size=100>]) is never more recent than March 2021. Does anyone know what is the reason for this? Thanks, Gergely 1: https://www.stackalytics.com/api/1.0/activity?page_size=100

5 5

Automagically find LP bugs that should be marked as "Fix Released"
by Cyril Roelandt 03 Aug '21

03 Aug '21

Hello, I recently realized that some of my Launchpad bugs had a status different from "Fix Released" even though a fix had been released, and still appeared in my query of "open bugs". I wrote a simple script[1] to find bugs in a similar state: $ cd ~/openstack/glance_store/ # We assume the repository is up-to-date # Let's find the glance_store bugs fixed between 2.4.0 and 2.5.0 $ fix-released.sh 2.4.0 2.5.0 glance-store https://bugs.launchpad.net/glance-store/+bug/1915163 (Opinion) https://bugs.launchpad.net/glance-store/+bug/1915602 (New) In both these bug reports the following comment can be found: "This issue was fixed in the openstack/glance_store 2.5.0 release.", but the bug statuses have not been changed to "Fix Released". Comments are welcome, and I hope this helps. Cyril [1] https://gist.github.com/CyrilRoelandteNovance/1af6a5a23112ce444bda0ca2010d3…

1 0

[nova][glance] nova-lvm job constantly fails on glance image upload
by Sylvain Bauza 03 Aug '21

03 Aug '21

Hi, I recently spotted a constant failure on the nova-lvm job [1] which seems to occur since July-19 at least, and which prevents us to merge all changes touching the nova-libvirt code section [2] Evidences show a glance image upload HTTP 502 failure when we want to snapshot [3] which corresponds to the Glance API getting issues with staged image data not found [4] Until we figure out how to solve this, recheck against nova changes touching nova/virt/libvirt/ module are useless. Any help would be appreciated on debugging the Glance failure, tho. Thanks, -Sylvain [1] https://zuul.openstack.org/builds?job_name=nova-lvm&branch=master [2] https://zuul.openstack.org/job/nova-lvm [3] https://zuul.openstack.org/build/a04b0d2e184a4d3e9c39bd6110b454ea/log/contr… [4] https://zuul.openstack.org/build/a04b0d2e184a4d3e9c39bd6110b454ea/log/contr…

2 3

[wallaby][neutron] OVN ovs-system: deferred action limit reached, drop recirc action
by Ammad Syed 03 Aug '21

03 Aug '21

Hi, I am using openstack with OVN 20.12 and OVS 2.15.0 on ubuntu 20.04. I am using geneve tenant network and vlan provider network. I am continuously getting below messages in my dmesg logs continuously on compute node 1 only the other two compute nodes have no such messages. [275612.826698] openvswitch: ovs-system: deferred action limit reached, drop recirc action [275683.750343] openvswitch: ovs-system: deferred action limit reached, drop recirc action [276102.200772] openvswitch: ovs-system: deferred action limit reached, drop recirc action [276161.575494] openvswitch: ovs-system: deferred action limit reached, drop recirc action [276210.262524] openvswitch: ovs-system: deferred action limit reached, drop recirc action I have tried by reinstalling (OS everything) compute node 1 but still having same errors. Need your advice. Ammad

1 0

[swift] EC data left in old location after rebalance
by Reid Guyett 02 Aug '21

02 Aug '21

Hello, We started using EC policies in a new cluster a few months ago and added more capacity. During the rebalance (started June 30), it seems that all the data was copied to the new locations but it didn't clean up the old locations. This was identified through our handoff monitoring. OS: Ubuntu 18.04 Swift: 2.17.1 Example: List of devices for partition ~$ swift-get-nodes /etc/swift/object-4.ring.gz -p 14242 ... removed ... Server:Port Device x.x.x.31:6031 d31 Server:Port Device x.x.x.66:6030 d30 Server:Port Device x.x.x.25:6029 d29 Server:Port Device x.x.x.33:6027 d27 Server:Port Device x.x.x.36:6020 d20 Server:Port Device x.x.x.29:6018 d18 Server:Port Device x.x.x.21:6033 d33 Server:Port Device x.x.x.27:6025 d25 Server:Port Device x.x.x.35:6022 d22 Server:Port Device x.x.x.39:6031 d31 Server:Port Device x.x.x.28:6032 d32 Server:Port Device x.x.x.23:6021 d21 Server:Port Device x.x.x.26:6022 d22 Server:Port Device x.x.x.34:6023 d23 Server:Port Device x.x.x.37:6019 d19 Server:Port Device x.x.x.30:6017 d17 Server:Port Device x.x.x.22:6027 d27 Server:Port Device x.x.x.24:6031 d31 Server:Port Device x.x.x.32:6032 d32 Partitions look to have the correct data on them: ~$ ssh root(a)x.x.x.31 "ls -lah ${DEVICE:-/srv/node*}/d31/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.66 "ls -lah ${DEVICE:-/srv/node*}/d30/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.25 "ls -lah ${DEVICE:-/srv/node*}/d29/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.33 "ls -lah ${DEVICE:-/srv/node*}/d27/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.36 "ls -lah ${DEVICE:-/srv/node*}/d20/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.29 "ls -lah ${DEVICE:-/srv/node*}/d18/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.21 "ls -lah ${DEVICE:-/srv/node*}/d33/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.27 "ls -lah ${DEVICE:-/srv/node*}/d25/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.35 "ls -lah ${DEVICE:-/srv/node*}/d22/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.39 "ls -lah ${DEVICE:-/srv/node*}/d31/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.28 "ls -lah ${DEVICE:-/srv/node*}/d32/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.23 "ls -lah ${DEVICE:-/srv/node*}/d21/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.26 "ls -lah ${DEVICE:-/srv/node*}/d22/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.34 "ls -lah ${DEVICE:-/srv/node*}/d23/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.37 "ls -lah ${DEVICE:-/srv/node*}/d19/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.30 "ls -lah ${DEVICE:-/srv/node*}/d17/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.22 "ls -lah ${DEVICE:-/srv/node*}/d27/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.24 "ls -lah ${DEVICE:-/srv/node*}/d31/objects-4/14242 | wc -l" 664 ~$ ssh root(a)x.x.x.32 "ls -lah ${DEVICE:-/srv/node*}/d32/objects-4/14242 | wc -l" 664 >From one of the nodes that does not belong to the list above. This partition should not exist on this node after the rebalance. x.x.x.20:~# ls /srv/node/d28/objects-4/14242 | wc -l 627 The reconstructor is throwing a lot of these unexpected response errors in the logs. Manually running it from the node that should not have the partition, I can reproduce the error. x.x.y.0/24 is the replication network. x.x.x.20:~# swift-object-reconstructor /etc/swift/object-server.conf -d d28 -p 14242 -o -v object-reconstructor: x.x.y.42:6200/d30/14242 Unexpected response: ":ERROR: 500 'ERROR: With :UPDATES: 36 failures to 0 successes'" There looked to have been some partition locations cleaned up around July 11. Our expectation is that the old partition locations should be cleaned gradually since June 30 but we're not seeing that. I Was hoping for some ideas on what may be the problem (if any) and how we can make sure that the old partitions are cleaned up. Thanks, Reid

2 4

[ironic] Xena Mid-cycle
by Iury Gregory 02 Aug '21

02 Aug '21

Hello Ironicers! In our upstream meeting we decided we should do a virtual mid-cycle! If you are interested please fill out the doodle[1] and add topics in the etherpad[2]. Keep in mind we have contributors in many time zones, if you think we should add more time windows, please let me know. Maybe we can have multiple sessions each day so we can accommodate APAC TZ. I will close the doodle before our upstream meeting next week. [1] https://doodle.com/poll/mhh959u4s4rturxi [2] https://etherpad.opendev.org/p/ironic-xena-midcycle -- *Att[]'sIury Gregory Melo Ferreira * *MSc in Computer Science at UFCG* *Part of the ironic-core and puppet-manager-core team in OpenStack* *Software Engineer at Red Hat Czech* *Social*: https://www.linkedin.com/in/iurygregory *E-mail: iurygregory(a)gmail.com <iurygregory(a)gmail.com>*

1 1

[nova][gate] nova-tox-functional-* jobs failing on master branch
by melanie witt 02 Aug '21

02 Aug '21

Hey all, The nova-tox-functional-* jobs on the openstack/nova master branch are currently failing 100% of the time: https://zuul.openstack.org/builds?job_name=nova-tox-functional-py38&branch=… This is due to another issue with time overrides (a lack thereof) in the test_archive_task_logs functional tests. The same bug has happened in the past and the fix is now known to have been unsuccessful: https://bugs.launchpad.net/nova/+bug/1934519 Another fix has been proposed here: https://review.opendev.org/c/openstack/nova/+/803106 Please hold your rechecks until the fix merges and apologies for the trouble. -melwitt

2 2

[neutron] Bug deputy report July 26 - Aug 2
by Jakub Libosvar 02 Aug '21

02 Aug '21

Hi, I was bug deputy for the last week, here is the report. There are couple of unassigned bugs, I would highlight the first on the list related to stable/ussuri functional tests failures that needs an assignee. Kuba Critical * [stable/ussuri] Functional jobs timeout, many tests with fixtures._fixtures.timeout.TimeoutException https://bugs.launchpad.net/neutron/+bug/1938262 Needs assignee * [fullstack] OOM mysql service https://bugs.launchpad.net/neutron/+bug/1938455 Patch up for review: https://review.opendev.org/c/openstack/neutron/+/802907 Assigned to Rodolfo High * L3 agent fails to process a DVR router external network change https://bugs.launchpad.net/neutron/+bug/1938191 Needs assignee * [ovn]Router scheduler failing for config "default_availability_zones" https://bugs.launchpad.net/neutron/+bug/1938261 Patch up for review: https://review.opendev.org/c/openstack/neutron/+/802665 * FT "test_restart_rpc_on_sighup_multiple_workers" failing recurrently https://bugs.launchpad.net/neutron/+bug/1938428 Patch up for review: https://review.opendev.org/c/openstack/neutron/+/802860 Assigned to Rodolfo * vpnaas problem:ipsec pluto not running centos 8 victoria wallaby https://bugs.launchpad.net/neutron/+bug/1938571 Needs assignee * ofctl timeouts lead to dvr-ha-multinode-full failures https://bugs.launchpad.net/neutron/+bug/1938685 Needs assignee Medium * Cannot delete vlan type network via network generic switch (ngs) https://bugs.launchpad.net/neutron/+bug/1938023 Needs assignee * Cannot adjust number of resources in one agent step during device handling https://bugs.launchpad.net/neutron/+bug/1938202 Assigned to Mitya Eremeev * [ovn]agents alive status error after restarting neutron server https://bugs.launchpad.net/neutron/+bug/1938478 Needs assignee * Typo in OVN SUPPORTED_DHCP_OPTS_MAPPING dictionary https://bugs.launchpad.net/neutron/+bug/1938569 Patch up for review: https://review.opendev.org/c/openstack/neutron/+/803037 Assigned to Eduardo Low * Misalignment with extra-dhcp-options between neutronclient & openstackclient https://bugs.launchpad.net/neutron/+bug/1938575 Needs assignee Wishlist * [networking-bgpvpn] Port events now use payload Patch up for review: https://review.opendev.org/c/openstack/networking-bgpvpn/+/802916 Assigned to Rodolfo * Missing Diffie-Hellman-Groups vpnaas: https://bugs.launchpad.net/neutron/+bug/1938284 Patch up for review: https://review.opendev.org/c/openstack/neutron-vpnaas/+/802714

1 0

[TripleO] centos7 gate blocker (stable/train) please hold rechecks
by Marios Andreou 02 Aug '21

02 Aug '21

Hello tripleo o/ new gate blocker for centos7 hitting stable/train tripleo repos https://zuul.opendev.org/t/openstack/builds?job_name=tripleo-ci-centos-7-co… bug is at https://bugs.launchpad.net/tripleo/+bug/1938079 - hitting stable/train (we only run c7 jobs there). investigation/resolution ongoing please hold rechecks for centos7 jobs. thank you

2 3

Diversity and Inclusion Meeting Reminder - OFTC
by Amy Marrich 01 Aug '21

01 Aug '21

The Diversity & Inclusion WG invites members of all OIF projects to attend our next meeting Monday Auguat 2nd, at 17:00 UTC in the #openinfra-diversity channel on OFTC. The agenda can be found at https://etherpad.openstack.org/p/ diversity-wg-agenda. Please feel free to add any topics you wish to discuss at the meeting. Thanks, Amy (apotz)

1 0

VPNaaS for Openstack
by Vinh Nguyen Duc 01 Aug '21

01 Aug '21

1 0

[cinder-backup][ceph] replicate volume between sites
by Tony Liu 31 Jul '21

31 Jul '21

Hi, I have two sites with OpenStack Victoria deployed by Kolla and Ceph Octopus deployed by cephadm. As what I know, either Swift (implemented by RADOSGW) or RBD is supported to be the backend of cinder-backup. My intention is to use one of those option to replicate Cinder volume from one site to another, based on RADOSGW multi-site support or RBD mirroring. I wonder if anyone has done this and could share some opinions, like pros, cons, which way is better for which case? One specific thing I am not clear is that, how to import RBD volume into Cinder when it gets to another site. There used to be a way, but it's replicated. Any comments is appreciated. Thanks! Tony

1 1

[neutron] dnsmasq refusing to provide ipv6 address over dhcpv6 after a server rebuild
by Thomas Goirand 31 Jul '21

31 Jul '21

Hi, I've filled this bug in Debian concerning our official image: https://bugs.debian.org/991613 tl;dr: When doing "openstack server rebuild", dnsmasq refuses to provide an ipv6 when the instance does a dhcpv6 request, because after a rebuild, the instance generates a different DUID. So I wonder if there's a way to fix this by configuring dnsmasq in some ways, maybe by telling it to not use the DUID at all. So far, I haven't found a way yet. Does anyone have a good answer to this problem? Ideally, I'd like to find a way to fix on both side (ie: OpenStack *AND* the official Debian image), so I can make sure to never encounter the issue ever again. Cheers, Thomas Goirand (zigo)

1 0

Routed provider networks
by Gk Gk 31 Jul '21

31 Jul '21

Hi, I learnt that routed provider networks from the below links: https://docs.openstack.org/neutron/latest/admin/config-routed-networks.html https://www.youtube.com/watch?v=HwQFmzXdqZM This concept, according to them solves two issues: 1. Large broadcast L2 domains with failure domains 2. If there are multiple L2 provider networks, users are confused, unable to choose a particular network. My question is, how does routed provider networks solve the second problem mentioned above ? If one user wants to use external network for internet, how can he choose from this one single routed provider network ? Or, if another user wants another provider network, how can he choose that particular network ? Also the same can also be achieved by creating nova aggregates or availability zones and mapping computes with particular provider network connections and ask users to use that particular nova AZ, without creating routed provider networks at all ? Can someone clarify this for me ? Thanks Kumar

2 2

[all][tc] What's happening in Technical Committee: summary 30th July, 21: Reading: 5 min
by Ghanshyam Mann 30 Jul '21

30 Jul '21

Hello Everyone, Here is last week's summary of the Technical Committee activities. 1. What we completed this week: ========================= * Retired tripleo-common-tempest-plugin[1] 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - https://meetings.opendev.org/meetings/tc/2021/tc.2021-07-29-15.00.log.html * We will have next week's meeting on Aug 5th, Thursday 15:00 UTC[2]. 3. Activities In progress: ================== TC Tracker for Xena cycle ------------------------------ TC is using the etherpad[3] for Xena cycle working item. We will be checking and updating the status biweekly in the same etherpad. Open Reviews ----------------- * Three open reviews for ongoing activities[4]. Migration from Freenode to OFTC ----------------------------------------- * Only few repo patches are left to merge. requesting core team of those repos to merge them. ** https://review.opendev.org/q/topic:%2522oftc%2522+status:open * openstack blog site is updated for freenode->oftc, Thanks Jimmy for taking care of it. * All the required work for this migration is tracked in this etherpad[5] Test support for TLS default: ---------------------------------- * Rico has started a separate email thread over testing with tls-proxy enabled[6], we encourage projects to participate in that testing and help to enable the tls-proxy in gate testing. Project updates: ------------------- * Retiring js-openstack-lib [7] * Adding tap-as-a-service back to neutron stadium[8] Yoga release community-wide goal ----------------------------------------- * Please add the possible candidates in this etherpad [9]. * Current status: One goal "Secure RBAC" is proposed. Other Changes ------------------ * Defining Yoga release testing runtime[10] PTG planning ---------------- * TC booked three slots: ** 1. Monday 15-17 UTC for TC + Community Leaders ** 2. Thursday 13-17 UTC ** 3. Friday 13-17UTC * We are collecting the PTG topics in etherpad[11], feel free to add any topic you want to discuss. 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[12]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [13] 3. Office hours: The Technical Committee offers a weekly office hour every Tuesday at 0100 UTC [14] 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://review.opendev.org/c/openstack/governance/+/800432 [2] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [3] https://etherpad.opendev.org/p/tc-xena-tracker [4] https://review.opendev.org/q/project:openstack/governance+status:open [5] https://etherpad.opendev.org/p/openstack-irc-migration-to-oftc [6] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023000.html [7] https://review.opendev.org/c/openstack/governance/+/798540 [8] https://review.opendev.org/c/openstack/governance/+/802833 [9] https://etherpad.opendev.org/p/y-series-goals [10] https://review.opendev.org/c/openstack/governance/+/799927 [11] https://etherpad.opendev.org/p/tc-yoga-ptg [12] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [13] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [14] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

Redhat RHEV Virtualisation and logical data volumes
by KK CHN 30 Jul '21

30 Jul '21

Is it practically or theoretically possible to export image/Disk as single image /Disk from RHEV/Virtualization Manager where VMs have logical volumes attached to it ? Any other data/information do I need to provide for the above question let know. Problem scenario is this: We have hosted VMs on RHEV virtualization environment. Each VM has associated Logical Volumes attached to the VM. We are planning to migrate our VMs to OpenStack (Ussuri, qemu KVM and Glance) Right now Our System Integrator who maintains these VMs on their RHEV virtualization environment exporting each VM as Three separate images. One for OS image, other for boot and third one for data volume disk image ( they use logical volumes for data storage, might be added disks when data storage was insufficient at any point of time. ) But I want to get each VM with data volumes as a single disk image . IS THIS THEORETICALLY or PRACTICALLY POSSIBLE using RHEV Virtualization tools ? if so how ? ( OR any other methods do this ?) OR am I asking a STUPID QUESTION ? If so WHY ? Kindly enlighten me !!! I am at the end of the rope with this issue. Thanks in advance, Kris

1 0

[sahara][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Sahara Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've seen that Sahara's stable branches started to fail as well so collected the recent failures with examples. Please take a look at them and try to fix them. The errors seem to be related to cinder's v2 removal ("No module named 'cinderclient.v2'"): sahara: stein - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/77f0f18b297240fa92eb5b22c8200598 sahara: train - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/23c860b5af74449bbed561d5853963ea sahara: ussuri - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/6e8ec09a4cc54eadaeaa9fe88eb249d9 sahara: victoria - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/db254fea259e482ab3ff3b404feeed28 sahara: wallaby - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/1e50a52edefe4f8191f0f0d529db7a63 [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

2 2

[cinder][qa][devstack][ci] need help running centos-8/opensuse-15 on stable/victoria
by Brian Rosmaita 30 Jul '21

30 Jul '21

Does anyone have any zuul jobs running in stable/victoria that use either of these nodesets: - devstack-single-node-centos-8 - devstack-single-node-opensuse-15 I can't get devstack to complete building on either (missing package, though different for each distro). I figure that someone in openstack must have this working, given that Python 3.6 and Centos-8 and OpenSUSE-15 are listed in the Tested Runtimes for Victoria [0]. Here's the failing patch if anyone would be kind enough to point out what I'm mis-configuring: https://review.opendev.org/c/openstack/python-cinderclient/+/800635/ thanks! brian [0] https://governance.openstack.org/tc/reference/runtimes/victoria.html

6 7

[nova][wallaby] Nova policy rule project_member_api not effective
by Taltavull Jean-Francois 30 Jul '21

30 Jul '21

Hi All, Despite the fact that oslopolicy-policy-generator --namespace nova shows the rules "project_member_api": "role:member and project_id:%(project_id)s" and "os_compute_api:servers:create": "rule:project_member_api", it is still possible to create a server even if you only have the role "member" on the project. Is this behavior normal or not ? Must we consider that we are in a phase of transition about nova default policies ? Thanks, Jean-Francois

2 3

[trove][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Trove Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list (with possible root causes): * bandit should be constrained: trove: pike - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/c8da125f4a7f4dafaa5f3b337a0d14c2 trove: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/9973f556913e439a912455712ecbd54a trove: queens - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/6ed08e9f7d25414e8ee04db14a753649 trove: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/0a3b1f6668a740c69f888c7272e24d58 trove: rocky - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/208c02dfcbc9487bbaca1eccc53e8a67 trove: rocky - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/f13cc87c4f104727ab4f4696ad7ed160 trove: stein - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/9aff516680074e11b52ea07fac389fa0 trove: train - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/db3b97cec2604318a7bd129fa8cd3bc2 * version conflict revealed with the new pip resolver: trove: stein - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/30f8f8a99fea4a93bab55b694c9e79e9 trove: train - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/00b400d2485a45fc997ebd35d48a506d trove: train - openstack-tox-py36 -- https://zuul.opendev.org/t/openstack/build/5e6a8f14ea93456ba70f5e1e3ee689a9 trove: train - openstack-tox-py37 -- https://zuul.opendev.org/t/openstack/build/e3c9201c92874e3fa25357171741cad2 [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[neutron][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Neutron Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list (with possible root causes): * horizon's pike + queens were deprecated: networking-bgpvpn: pike - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/553d4923eeca421c9ac56d193781b487 networking-bgpvpn: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/0fe12998347c4fa19ce3e04450bd914d networking-bgpvpn: queens - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/d804b266bfdc408dbd1dd517b5901914 networking-bgpvpn: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/9151ba1cb74e4f569d863b7a90a8b702 * some dependency issues + unit tests are broken: neutron-vpnaas: queens - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/64d92abffe7d48b1bcc3d3f42f8a1a24 neutron-vpnaas: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/743f561a2bb34875b86917cfe8861a53 neutron-vpnaas: rocky - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/e700494509934ba995f8c4b0e69f4627 neutron-vpnaas: stein - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/4339034bc4014a0292310fd013d46caa neutron-vpnaas: victoria - openstack-tox-docs -- https://zuul.opendev.org/t/openstack/build/83d8251153b64de488bae3972968256f neutron-vpnaas: victoria - openstack-tox-py36 -- https://zuul.opendev.org/t/openstack/build/02e214a1483a4778986697ba6c85cbf9 neutron-vpnaas: victoria - openstack-tox-py38 -- https://zuul.opendev.org/t/openstack/build/a746a0bc5a1c4caeb6b813a7dd83878c [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[murano][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Murano Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list (with possible root causes): * bandit should be constrained: murano: pike - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/6ee6c9548d6b47e79361151964992ddf murano: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/fbfe0f67b90f4b3189a13e02a5b7f274 murano: queens - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/c254a7f764f547e4a5bf8467cbcbe24b murano: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/b9646137d45c49ab8f10c2031135d21e murano: rocky - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/63f53b3df8a940f6b86c450617882cfc murano: stein - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/be63abe6be9a4d1f90c8d74fd9c4a407 * broken unittest: murano: victoria - openstack-tox-py36 -- https://zuul.opendev.org/t/openstack/build/b403e1a7431a484e90b23738a56669c7 murano: victoria - openstack-tox-py38 -- https://zuul.opendev.org/t/openstack/build/7f886d7e21864f4d941ad0a03d61ec4d murano: wallaby - openstack-tox-py36 -- https://zuul.opendev.org/t/openstack/build/dc61998732ff4d13a6e8c9d1f82ccd8d murano: wallaby - openstack-tox-py38 -- https://zuul.opendev.org/t/openstack/build/cc2fa00e650d4cd1973fd76dc1649624 * and also master is broken. [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[designate][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Designate Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list (with possible root cause): * bandit should be constrained: designate: pike - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/810cf80432dc4b90a7367b5f2107147e designate: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/11d042ab2e82478db75d877f3c62cd62 designate: queens - build-openstack-sphinx-docs -- https://zuul.opendev.org/t/openstack/build/4cd73558ffb3402e8f25f602d85aec94 designate: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/6c0b8dd6cee24b7eab9153bfc0e1dd61 designate: rocky - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/8d4d56e05ec94870823d3e057ee8ea4a [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[powervmstackers][multi-arch-sig][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi PowerVMStackers and Multi-Arch SIG members, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list: * ocata is mostly End of Life -- (also there is a patch to EOL ocata of the *-powervm: https://review.opendev.org/c/openstack/releases/+/801123 ) ceilometer-powervm: ocata - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/151e90c3c3eb48779759f469d76f02d7 nova-powervm: ocata - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/535ffa6750c74ab7a886f6fb3838ff4f * unit tests are broken: nova-powervm: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/27bd093f615341e7a5563e3b9ea86f31 * dependency version conflict: nova-powervm: train - openstack-tox-py36 -- https://zuul.opendev.org/t/openstack/build/f9afc55de6dc452cbc88d98c837ab58f nova-powervm: train - openstack-tox-py37 -- https://zuul.opendev.org/t/openstack/build/0ea69ad9be8c4a269613573fa5014fe4 [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[telemetry][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

Hi Telemetry Team, In the last couple of months the periodic-stable job errors (and thus the mails on openstack-stable-maint mailing list [1], where mails are sent from every failing jobs) increased significantly. I've talked with the infra team as the mail traffic is quite visible for them as well. I've collected the recent failures with examples that are failing constantly. Please take a look at them and try to fix them wherever it is possible. Since the old branches seem quite abandoned in some cases, they might need maintainers to step up to keep those gates healthy, or in case there are no maintainers, then it might worth to think of transitioning those broken old branches to End of Life. :/ And the list (with possible root causes): * tenacity should be constrained for py27: ceilometer: pike - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/4bcb7e71d507465ea799cd289e6cc920 ceilometer: queens - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/583d52b6096745ddbb18da23cf79fa75 ceilometer: rocky - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/03279061fddd4d14819c04feda3a1806 * kombu version should be constrained for py27: ceilometer: stein - openstack-tox-py27 -- https://zuul.opendev.org/t/openstack/build/219139b1814b4fd591ee7dc199f2e3da [1] http://lists.openstack.org/pipermail/openstack-stable-maint/2021-July/threa… Thanks, Előd

1 0

[oslo][stable] periodic-stable errors
by Előd Illés 30 Jul '21

30 Jul '21

1 0

[centos][kolla-ansible][wallaby][vpnaas] I need Help
by Franck VEDEL 30 Jul '21

30 Jul '21

Hello. I try one last time to get some help, answers to my questions because I have been trying for 2 weeks to get the vpnaas service to work under Wallaby, without success. Still, I have no problem under Victoria with vpnaas. However, on my last installation which must work in September (to be used by students), without my understanding why, the horizon container of my centos (rocky) / kolla-ansible / victoria installation does not want to launch and I do not have no logs. So, can't use Victoria. I am trying Wallaby, everything works except vpnaas. My questions: how to get the logs of this hoorizon container which does not start (restart every 20 seconds)? how to know if it is a bug in wallaby with vpnaas? Really thank you if anyone can help me move forward. Franck

5 22

RE: [ops][nova][victoria] Unable to Migrate: Host filter ignoring hosts
by DHilsbos＠performair.com 29 Jul '21

29 Jul '21

All; Thank you for reading my previous email, despite its poor Subject. I have attached a subset of the Nova Scheduler log, with debugging enabled. I have added line numbers to the beginning, in order to facilitate referencing. At line 18 it appears to select the requested server for the migration, but then at line 38, it rejects it. Am I missing something here? Is it unable to assign the resources through placement? Dominic L. Hilsbos, MBA Vice President – Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com -----Original Message----- From: melanie witt [mailto:melwittt@gmail.com] Sent: Wednesday, July 28, 2021 1:24 PM To: Dominic Hilsbos; openstack-discuss(a)lists.openstack.org Subject: Re: [ops][nova] On Wed, 28 Jul 2021, 20:10 +0000, <DHilsbos(a)performair.com> wrote: > All; > > I'm having a problem, though I'm not certain of the full scope. > > The most obvious issue is that I can't live migrate instances. The server I want to send the instance to gets filtered out, though I don't see any logs that tell me why it's being filtered out. > > It might be related that all of my new instances seems to land on a single host. > > An pointers on where to look for logs for Host Filters? You'll want to set [DEFAULT]debug = True in the nova.conf for your nova-scheduler service and restart or HUP the service. And then the logging per scheduler filter (each one will show the starting and ending number of hosts) will be included at DEBUG log level in the nova-scheduler log. -melwitt

3 5

[OSSA-2021-002] Nova: Open Redirect in noVNC proxy (CVE-2021-3654)
by Jeremy Stanley 29 Jul '21

29 Jul '21

=========================================== OSSA-2021-002: Open Redirect in noVNC proxy =========================================== :Date: July 29, 2021 :CVE: CVE-2021-3654 Affects ~~~~~~~ - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.2 Description ~~~~~~~~~~~ Swe Aung, Shahaan Ayyub, and Salman Khan with the Monash University Cyber Security team reported a vulnerability affecting Nova's noVNC proxying implementation which exposed access to a well-known redirect behavior in the Python standard library's http.server.SimpleHTTPRequestHandler and thus noVNC's WebSockifyRequestHandler which uses it. By convincing a user to follow a specially-crafted novncproxy URL, the user could be redirected to an unrelated site under control of the attacker in an attempt to convince them to divulge credentials or other sensitive data. All Nova deployments with novncproxy enabled are affected. Patches ~~~~~~~ - https://review.opendev.org/791807 (Train) - https://review.opendev.org/791806 (Ussuri) - https://review.opendev.org/791805 (Victoria) - https://review.opendev.org/791577 (Wallaby) - https://review.opendev.org/791297 (Xena) Credits ~~~~~~~ - Swe Aung from Monash University Cyber Security team (CVE-2021-3654) - Shahaan Ayyub from Monash University Cyber Security team (CVE-2021-3654) - Salman Khan from Monash University Cyber Security team (CVE-2021-3654) References ~~~~~~~~~~ - https://launchpad.net/bugs/1927677 - https://bugs.python.org/issue32084 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3654 Notes ~~~~~ - The stable/train branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley

1 0

[cinder] No Cinder Bug Meeting on 4 August
by Sofia Enriquez 29 Jul '21

29 Jul '21

I'll send the email report as usual. Please join the Cinder Xena R-9 virtual that day 1400-1600 UTC. Cheers, Sofia -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[openstack-nova] Attached volume is not available in the VM
by Aleksander Wojtal 29 Jul '21

29 Jul '21

Hello, During our testing we perform reboot of compute during volume attached task. Result is as follows. Volume is marked as attached to VM (also in DB) ceeinfra@lcm1:~> openstack volume list +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ | ID | Name | Status | Size | Attached to | +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ | c52d406c-5587-445d-9da1-436ffbbe3541 | vol_neXt-488 | available | 10 | | | f3e45efc-35eb-4f95-8e71-f50b5cb69028 | RebootOfComputeHostWhilePerformingVolumeOperations-Volume-0618_19_45_12_669 | in-use | 20 | Attached to neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 on /dev/vdb | | 1bd81392-e2c9-4725-93c8-baa484924f21 | vol_neXt-488 | available | 10 | | | 919db17c-0729-409c-bf59-74539edcea47 | vol_neXt-488 | available | 10 | | +--------------------------------------+-----------------------------------------------------------------------------+-----------+------+--------------------------------------------------------------------------------------------------------------+ >From VM perspective too. ceeinfra@lcm1:~> openstack server show neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 +-------------------------------------+-------------------------------------------------------------------------------------+ | Field | Value | +-------------------------------------+-------------------------------------------------------------------------------------+ | OS-DCF:diskConfig | MANUAL | | OS-EXT-AZ:availability_zone | nova | | OS-EXT-SRV-ATTR:host | compute-0-11.k2.ericsson.se | | OS-EXT-SRV-ATTR:hypervisor_hostname | compute-0-11.k2.ericsson.se | | OS-EXT-SRV-ATTR:instance_name | instance-00001edc | | OS-EXT-STS:power_state | Running | | OS-EXT-STS:task_state | None | | OS-EXT-STS:vm_state | active | | OS-SRV-USG:launched_at | 2021-06-18T14:14:58.000000 | | OS-SRV-USG:terminated_at | None | | accessIPv4 | | | accessIPv6 | | | addresses | NovaController-Network-0618_19_44_16_852=10.0.0.5 | | config_drive | True | | created | 2021-06-18T14:14:19Z | | flavor | m1.small (2) | | hostId | 5078bfd4fabd8b2e7c9f4554b3ac08d536ceebb5f393db4d38c8ff60 | | id | 95ed49ed-b3f8-46ae-80a0-544b939c50b7 | | image | JCAT_Common_CirrOS_i386 (b71f3fbd-59f1-4c29-a296-5065fe0406f7) | | key_name | None | | name | neXt-377_VM1--RebootOfComputeHostWhilePerformingVolumeOperations--0618_19_44_16_775 | | progress | 0 | | project_id | b63725c8ebaf43ebabbed497f41eb71c | | properties | ha-policy='managed-on-host' | | scheduler_hints | {} | | security_groups | name='default' | | status | ACTIVE | | updated | 2021-06-18T14:22:07Z | | user_id | f490f07b813748698e56ca7641d46a72 | | volumes_attached | id='f3e45efc-35eb-4f95-8e71-f50b5cb69028' | +-------------------------------------+-------------------------------------------------------------------------------------+ >From Libvirt perspective, volume is not attached to VM compute-0-11:/var/log # virsh dumpxml instance-00001edc <domain type='kvm' id='1'> <name>instance-00001edc</name> <uuid>95ed49ed-b3f8-46ae-80a0-544b939c50b7</uuid> (...) <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' cache='directsync'/> <source file='/var/lib/nova/instances/95ed49ed-b3f8-46ae-80a0-544b939c50b7/disk' index='2'/> <backingStore type='file' index='3'> <format type='raw'/> <source file='/var/lib/nova/instances/_base/af82cd8216adb002916bb9e422a3fbb637022ec6'/> <backingStore/> </backingStore> <target dev='vda' bus='virtio'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw' cache='directsync'/> <source file='/var/lib/nova/instances/95ed49ed-b3f8-46ae-80a0-544b939c50b7/disk.config' index='1'/> <backingStore/> <target dev='hdd' bus='ide'/> <readonly/> <alias name='ide0-1-1'/> <address type='drive' controller='0' bus='1' target='0' unit='1'/> </disk> <controller type='usb' index='0' model='piix3-uhci'> (...) </domain> System does not provide any indication of the problem. There should be some kind of indication to user that volume attachment was not completed. Pozdrawiam / Best regards, Aleksander Wojtal, Junior Software Engineer TietoEVRY BU Telco Cloud Infra & Applications email aleksander.wojtal(a)tietoevry.com al. Piastów 30, 71-064 Szczecin, tietoevry.com [cid:image001.png@01D77EE0.7C2AE900] Please note: The information contained in this message may be legally privileged, confidential and protected from disclosure. If you received this in error, please notify the sender immediately and delete the message from your computer. Thank you.

3 6

[TripleO] next irc meeting Tuesday 03 August @ 1400 UTC in OFTC #tripleo
by Marios Andreou 29 Jul '21

29 Jul '21

Reminder the next TripleO irc meeting is this coming Tuesday agenda: https://wiki.openstack.org/wiki/Meetings/TripleO one-off items: https://etherpad.opendev.org/p/tripleo-meeting-items (feel free to add any tripleo status/ongoing work etc to the etherpad). Our last meeting was on Jul 20 - you can find logs @ https://meetings.opendev.org/meetings/tripleo/2021/tripleo.2021-07-20-14.00… Hope you can make it on Tuesday, regards, marios

1 0

[sdk] keystone group members list
by Valéry Tschopp 29 Jul '21

29 Jul '21

Hi all, With the openstacksdk, how can list the members of a Keystone group? The Keystone API exists https://docs.openstack.org/api-ref/identity/v3/?expanded=list-users-in-grou… but I didn't find the corresponding SDK functions... Thanks in advance Cheers, Valery -- SWITCH Valéry Tschopp, Software Engineer Werdstrasse 2, P.O. Box, 8021 Zurich, Switzerland Email: valery.tschopp(a)switch.ch Phone: +41 44 268 1544 https://www.switch.ch/

1 0

[kolla][keystone][openstack-ansible][deploy][sdk] enforcing scope in Kolla-Ansible deployment
by James Kirsch 29 Jul '21

29 Jul '21

I'm working on adding the option to enable enforce_scope in keystone during Kolla-Ansible deployment. I've revived this transaction to complete this work: https://review.opendev.org/c/openstack/kolla-ansible/+/692179 As part of that effort, I would like to also enable enforce_new_defaults in keystone. Deployment currently fails because the nova keystone user roles created during Kolla-Ansible deployment requires system scope. I can currently get around this using python-openstack: openstack role add --system all --user d7512be612454eff8a7f5bf5476b1531 admin Kolla-ansible relies on the OpenStack Ansible modules to create users and roles for deployment. Looking around the repositories, it does not appear that the openstack ansible module nor the openstacksdk supports granting system scope to a user role. Please let me know if this is not the case or if it is in current development. Otherwise, I could use guidance on what the next steps I could take or who I should talk to so I can move this forward. Thanks, James my awesome background music: http://www.generalfuzz.net about me: http://www.headphonejames.com

3 2

[kolla] Operator pain points
by Mark Goddard 29 Jul '21

29 Jul '21

Hi, The TC is looking at community goals for the Yoga release cycle, and has proposed resolving some operator pain points [1]. These pain points are naturally project-specific, and the first step is collecting some. They are looking for 1-2 points per project, but this is an interesting feedback exercise for us, so don't hold back. Please add any significant operator pain points you have for Kolla (or other projects) to the Etherpad [2]. Thanks, Mark [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-July/023659.html [2] https://etherpad.opendev.org/p/pain-point-elimination

2 1

[Openstack][kolla][wallaby] swift installation
by Ignazio Cassano 28 Jul '21

28 Jul '21

Hello all, I want install swift but I do not have disks on controllers and on compute nodes. Is it possible to inventory a group of servers other than controllers or computes to install swift? In other words, I would like to insert in multinode inventory a new group of servers with disks for reinstalling swift. Thanks. Ignazio

2 2

[all][tc] Technical Committee next weekly meeting on July 29th at 1500 UTC
by Ghanshyam Mann 28 Jul '21

28 Jul '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for July 29th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, June 28th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[tc][cinder] early removal of 'enable_v3_api' option
by Brian Rosmaita 28 Jul '21

28 Jul '21

Hello TC members, Cinder has asserted the 'assert:follows-standard-deprecation' tag. This cycle, the long-deprecated Block Storage API v2 has been removed [0], at which time the 'enable_v2_api' option was also removed (which was appropriate since the option had been deprecated since Mitaka [1]). It turns out, however, that the corresponding 'enable_v3_api' option had never been deprecated. It has been deprecated in the current development branch by [0], but the team would like to know whether it is permissible to simply remove it in Xena without deprecating it for the following reasons: - The option was introduced by [1] in Mitaka. It has always had the default value: True. - In the Xena release, if the option is False, you can deploy the Block Storage API, but the only reachable resource from the endpoint is '/versions', which returns an empty list of available versions. This doesn't seem to be something that anyone would do on purpose. - If someone wants to deploy only the Block Storage API v2, this cannot be done in Xena by setting 'enable_v3_api' to False. So for that purpose, this option is already effectively a no-op in Xena. In short, we could leave the 'enable_v3_api' option as deprecated in the Xena release, but we can't imagine any circumstances under which someone would intentionally use it in its non-default value, so it seems pointless to keep it around ... except to satisfy the 'assert:follows-standard-deprecation' tag. To be clear, the Cinder team has no intention of violating or removing the 'assert:follows-standard-deprecation' tag. The point of this email is to ask the TC whether it would be permissible to simply remove the 'enable_v3_api' option in Xena (as opposed to deprecating the option in Xena and then waiting until Yoga development to remove it). Thanks for thinking about this! [0] https://review.opendev.org/c/openstack/cinder/+/792299 [1] https://review.opendev.org/c/openstack/cinder/+/224910

2 1

[ops][nova]
by DHilsbos＠performair.com 28 Jul '21

28 Jul '21

All; I'm having a problem, though I'm not certain of the full scope. The most obvious issue is that I can't live migrate instances. The server I want to send the instance to gets filtered out, though I don't see any logs that tell me why it's being filtered out. It might be related that all of my new instances seems to land on a single host. An pointers on where to look for logs for Host Filters? Thank you, Dominic L. Hilsbos, MBA Vice President - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

3 2

[nova] Early migrate error - pain point?
by DHilsbos＠performair.com 28 Jul '21

28 Jul '21

All; Yesterday I ran into an issue where a live migration errored before starting the migration itself (libvirt version incompatibility). This left the instance in an error state, even though it continued to run normally on the original host. Has anyone else run into this? Could this be a candidate for the current pain point hunt? Thank you, Dominic L. Hilsbos, MBA Vice President - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

2 4