- openstack-discuss - lists.openstack.org

[cinder] Block Storage API v2 removal
by Brian Rosmaita 12 Jul '21

12 Jul '21

Cinder community members, especially cinder-core: First, thanks to Rajat, who has reviewed this patch carefully, as evidenced by his 32 comments on patch set 4 and his re-review of patch set 6. We need to get https://review.opendev.org/c/openstack/cinder/+/792299/ reviewed and merged. It's holding up some feature work, as people rightly don't want to touch v2 if it's going to be removed, but aren't sure how serious we are that there will be no v2 in the Xena release, so they're not sure what to submit. The v2 API has been deprecated since Pike [0], and at this point it looks like all consuming projects have switched to using v3. But we need to get this change merged and released now at M-2 so we can discover whether there's anything we missed while it's still relatively early in the cycle. So please look at https://review.opendev.org/c/openstack/cinder/+/792299/ . If you are pressed for time, be creative and make a deal with another reviewer or two so that each of you reivews half (or a third, or whatever). But it's important that this be reviewed now! cheers, brian [0] https://docs.openstack.org/releasenotes/cinder/pike.html#deprecation-notes

1 0

[OSSA-2021-001] Neutron: Anti-spoofing bypass for Open vSwitch networks (CVE-2021-20267)
by Jeremy Stanley 12 Jul '21

12 Jul '21

============================================================= OSSA-2021-001: Anti-spoofing bypass for Open vSwitch networks ============================================================= :Date: July 12, 2021 :CVE: CVE-2021-20267 Affects ~~~~~~~ - Neutron: <16.3.3, >=17.0.0 <17.1.3, =18.0.0 Description ~~~~~~~~~~~ David Sinquin with Gandi.net reported a vulnerability in Neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Patches ~~~~~~~ - https://review.opendev.org/777873 (Queens) - https://review.opendev.org/791470 (Queens) - https://review.opendev.org/777786 (Rocky) - https://review.opendev.org/791469 (Rocky) - https://review.opendev.org/777872 (Stein) - https://review.opendev.org/791500 (Stein) - https://review.opendev.org/777785 (Train) - https://review.opendev.org/791468 (Train) - https://review.opendev.org/777784 (Ussuri) - https://review.opendev.org/791467 (Ussuri) - https://review.opendev.org/777783 (Victoria) - https://review.opendev.org/791465 (Victoria) - https://review.opendev.org/776599 (Wallaby) - https://review.opendev.org/791464 (Wallaby) - https://review.opendev.org/783743 (Xena) Credits ~~~~~~~ - David Sinquin from Gandi.net (CVE-2021-20267) References ~~~~~~~~~~ - https://launchpad.net/bugs/1902917 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20267 Notes ~~~~~ - The stable/train, stable/stein, stable/rocky, and stable/queens branches are under extended maintenance and will receive no new point releases, but patches for them are provided as a courtesy. -- Jeremy Stanley

1 0

placement service issue (placement-status upgrade check failure)
by Deepak Mohanty 12 Jul '21

12 Jul '21

I need your help with installation of placement service on Ubuntu 20.04. I have followed the steps in: https://docs.openstack.org/placement/wallaby/install/install-ubuntu.html I am facing the following issue when I try to verify the installation: $ placement-status upgrade check Error: Traceback (most recent call last): File "/usr/lib/python3/dist-packages/oslo_upgradecheck/upgradecheck.py", line 196, in run return conf.command.action_fn() File "/usr/lib/python3/dist-packages/oslo_upgradecheck/upgradecheck.py", line 104, in check result = func_name(self, **kwargs) File "/usr/lib/python3/dist-packages/oslo_upgradecheck/common_checks.py", line 41, in check_policy_json policy_path = conf.find_file(conf.oslo_policy.policy_file) File "/usr/lib/python3/dist-packages/oslo_config/cfg.py", line 2543, in find_file raise NotInitializedError() oslo_config.cfg.NotInitializedError: call expression on parser has not been invoked I did a bit of debugging and found that the policy file is: policy.json. I could not find any policy.json on my machine. I created an empty policy.json at: /etc/placement/policy.json (user and group = placement). That too did not work. I have followed the steps in the install guide twice, deleting the placement database and other resources and recreating them. I continue to see the same issue. Thank you for your time.

5 6

[ patrole ] Understanding RBAC Permission Exceptions
by darumaseye 12 Jul '21

12 Jul '21

Hello, I am a researcher studying security of the Openstack's Policies. I'm very interested in the Patrole project and I would like to ask you some questions. In the documentation it is stated that Patrole compares two different types of results: - an expected one ( derived from oslo.policy ) - an actual one ( derived from an actual request to the API ). Given that, Patrole's tests can return 3 different values: 1) "Success" if actual result and expected result are both True or both False; 2) "RbacOverPermissionException" if actual result is True but expected result is False; 3) "RbacUnderPermissionException" in the other case. I can't understand in which cases the tests can return a value different from "Success". As far as I know, an API call should always be validated internally by oslo.policy's rules, before being allowed. So, in order for an API call to be accepted, oslo.policy's rules must allow that API call. It seems to me that the "expected" result ( derived from oslo.policy ) is always included in the actual result. Hoping that everything I said is correct, I would like to ask you: What issue is allowing such a strange behavior in Openstack APIs ? Why the expected results can be different from the actual ones? Are there publicly available examples showing "Failure" values? In general, are there any publicly available test cases that i can study to understand this? I Would like to thank you very much in advance; Best Regards, Jacopo

3 3

Cinder error while creating Volumes in Openstack
by Adivya Singh 12 Jul '21

12 Jul '21

Hello Team, i am seeing the below error, while creating volumes in cinder log, Any solution or fix for these error, as of now i am not able to create volumes, neither i am unable to delete, it just sits in hung state DISTRIB_RELEASE="18.1.9" DISTRIB_CODENAME="Rocky" DISTRIB_DESCRIPTION="OpenStack-Ansible" Regards Adivya Singh

2 1

OpenInfra Live - July 15 at 9am CT
by Ashlee Ferguson 12 Jul '21

12 Jul '21

Hi everyone, This week’s OpenInfra Live episode is brought to you by the Open Infrastructure Foundation. One of the reasons workloads moved to virtualization and clouds was to avoid having underutilized resources. But as demand for resources goes up and down, the cloud itself can now have a lot of spare capacity. How do OpenStack-based large scale clouds manage their spare capacity? Join this live discussion between operators of private and public clouds with InMotion Hosting, CERN, NECTAR research cloud, Verizon Media, City Network and Open Telekom Cloud. Episode: How OpenStack Large Clouds Manage their Spare Capacity Date and time: July 15 at 9am CT (1400 UTC) You can watch us live on: YouTube: https://www.youtube.com/watch?v=G7oN2XdI__k <https://www.youtube.com/watch?v=G7oN2XdI__k> LinkedIn: https://www.linkedin.com/feed/update/urn:li:ugcPost:6818945419729604608 <https://www.linkedin.com/feed/update/urn:li:ugcPost:6818945419729604608> Facebook: https://www.facebook.com/104139126308032/posts/4134653546589883/ <https://www.facebook.com/104139126308032/posts/4134653546589883/> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Belmiro Moreira, CERN Brendan Conlan, Verizon Media Chris Bermudez, InMotion Hosting Erik Johansson, CityNetwork Sam Morrison, NECTAR Viktor Molnar, T-Systems Have an idea for a future episode? Share it now at ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>. Thanks, Ashlee

1 0

[octavia] Meeting cancelled
by Gregory Thiemonge 12 Jul '21

12 Jul '21

Hi, I'm out of the office on July 14th, I won't be able to attend the weekly meeting. The meeting is cancelled. See you next week. Greg

1 0

[neutron] bug deputy report for week of 2021-07-05
by Bence Romsics 12 Jul '21

12 Jul '21

Hi Neutron Team, These are the new bugs of last week: High: * https://bugs.launchpad.net/neutron/+bug/1934930 [ovn] Multiple servers can try to create neutron_pg_drop at the same time fix proposed: https://review.opendev.org/c/openstack/neutron/+/799900 * https://bugs.launchpad.net/neutron/+bug/1934915 [OVN Octavia Provider] Investigate tempest failures tests disabled to unblock ovn-octavia-provider gate: https://review.opendev.org/c/openstack/ovn-octavia-provider/+/799864 Medium: * https://bugs.launchpad.net/neutron/+bug/1934666 IPv6 not set on VMs when using DVR HA + SLAAC/SLAAC (or DHCPv6 stateless) * https://bugs.launchpad.net/neutron/+bug/1934912 Router update fails for ports with allowed_address_pairs containg IP range in CIDR notation fix proposed: https://review.opendev.org/c/openstack/neutron/+/800059 Low: * https://bugs.launchpad.net/neutron/+bug/1934957 [sriov] Unable to change the VF state for i350 interface unassigned RFE / Wishlist: * https://bugs.launchpad.net/neutron/+bug/1934948 [RFE] refactor of L3 resources update procedure * https://bugs.launchpad.net/neutron/+bug/1935764 RFE: Adding support for direct ports with qos in ovn * https://bugs.launchpad.net/neutron/+bug/1934670 neutron-tempest-plugin should migrate from paramiko Incomplete: * https://bugs.launchpad.net/neutron/+bug/1934135 nova cannot create instances, because it doesn't find the network Regards, Bence

1 0

[keystone][interop][refstack] Adding new capabilities to track in interop
by Martin Kopec 12 Jul '21

12 Jul '21

Hi everyone, we are adding new capabilities and tests for keystone service to interop, see: https://review.opendev.org/c/osf/interop/+/799163 If someone from keystone could review the patch, it would be great. Thanks, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA

1 0

[Image Encryption] No meeting today
by Josephine Seifert 12 Jul '21

12 Jul '21

Hi, there will not be a meeting today, as I am ill. The next meeting will be next Monday the 19th of July. greetings Luzi

1 0

[qa] Virtual PTG October 2021
by Martin Kopec 12 Jul '21

12 Jul '21

Hi everyone, as you have probably heard our next PTG will be held virtually in October. I've created a Doodle [1] to collect the best time slots for our team. Please fill it in by Tuesday July 20th (the deadline for team signup is July 21st). I've also created an etherpad [2] to collect ideas/topics for the PTG sessions. If you have anything to discuss, please don't hesitate to write it there. [1] https://doodle.com/poll/a8gakx4ca6zvtuem?utm_source=poll&utm_medium=link [2] https://etherpad.opendev.org/p/qa-yoga-ptg Regards, -- Martin Kopec Senior Software Quality Engineer Red Hat EMEA

1 0

[kolla][wallaby][neutron][vpnaas]
by Franck VEDEL 12 Jul '21

12 Jul '21

Hello, and first excuse my English please… thanks a lot. I hope you will understand my problem. I have a problem with the following configuration: kolla-ansible, centos, wallaby. I need the vpnaas service. I create internal networks, configure these networks, the routers, and I create a vpnaas between two internal networks (2 cirros instances for example). To the left; net1: 192.168.10.0/24 Right, net2: 192.168.20.0/24 VM On the left: ping VM on the right (ex 192.168.20.30). The ping goes to the internet, it is handled by the default route on the router leaving net1. I do the same with Victoria: it works. I am testing a VPN between net1 and an internal network behind a real network, behind a watchguard. With Victoria, it works. With Wallaby, it doesn't work. Neutron-l3-agent logs says: Command: ['ipsec', 'whack', '--status'] Exit code: 33 Stdout: Stderr: whack: Pluto is not running (no "/run/pluto/pluto.ctl ») Is there a bug in wallaby? What could be the problem, the configuration and the hardware is the same, it works with victoria, not with wallaby. Thanks for your help. Franck

1 1

[all][infra][qa] Retiring Logstash, Elasticsearch, subunit2sql, and Health
by Clark Boylan 09 Jul '21

09 Jul '21

Hello everyone, Xenial has recently reached the end of its life. Our logstash+kibana+elasticsearch and subunit2sql+health data crunching services all run on Xenial. Even without the distro platform EOL concerns these services are growing old and haven't received the care they need to keep running reliably. Additionally these services represent a large portion of our resource consumption: * 6 x 16 vcpu + 60GB RAM + 1TB disk Elasticsearch servers * 20 x 4 vcpu + 4GB RAM logstash-worker servers * 1 x 2 vcpu + 2GB RAM logstash/kibana central server * 2 x 8 vcpu + 8GB RAM subunit-worker servers * 64GB RAM + 500GB disk subunit2sql trove db server * 1 x 4 vcpu + 4GB RAM health server To put things in perspective, they account for more than a quarter of our control plane servers, occupying over a third of our block storage and in excess of half the total memory footprint. The OpenDev/OpenStack Infra team(s) don't seem to have the time available currently to do the major lifting required to bring these services up to date. I would like to propose that we simply turn them off. All of these services operate off of public data that will not be going away (specifically job log content). If others are interested in taking this on they can hook into this data and run their own processing pipelines. I am sure not everyone will be happy with this proposal. I get it. I came up with the idea for the elasticsearch job log processing way back at the San Diego summit. I spent many many many hours since working to get it up and running and to keep it running. But pragmatism means that my efforts and the team's efforts are better spent elsewhere. I am happy to hear feedback on this. Thank you for your time. Clark

10 13

[all][tc] What's happening in Technical Committee: summary 9th July, 21: Reading: 5 min
by Ghanshyam Mann 09 Jul '21

09 Jul '21

Hello Everyone, Here is last week's summary of the Technical Committee activities. 1. What we completed this week: ========================= * Y release naming process is completed and announced the name 'Yoga' on ML[1] * Added Ceph Dashboard charm to OpenStack charms [2] * Documentation updates to add DPL model also in 'Appointing leaders' process [3] * Charter change to handle the vacant seat situation during the election or in between of cycle [4]. 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - https://meetings.opendev.org/meetings/tc/2021/tc.2021-07-08-15.00.log.html * We will have next week's meeting on July 15th, Thursday 15:00 UTC[5]. 3. Activities In progress: ================== TC Tracker for Xena cycle ------------------------------ TC is using the etherpad[6] for Xena cycle working item. We will be checking and updating the status biweekly in the same etherpad. Open Reviews ----------------- * Seven open reviews for ongoing activities[7]. ELK services next plan and help status --------------------------------------------- * We discussed this in the TC meeting, below is the summary: ** Help status: as of now, there are no volunteers to help. ** We defined the deadline of service shutdown if there is no help. Agreed Deadline is Yoga cycle end. Clark will update it on ML. ** We also discussed reducing the size of the existing system, and there were multiple ways. Clark will get more data on this and we will continue discussing the same in the next TC meeting on 15th July. Migration from Freenode to OFTC ----------------------------------------- * I started updating the remaining project side wiki/doc page, please review those. ** https://review.opendev.org/q/topic:%2522oftc%2522+status:open * During that I am also updating the retired/deprecated repo README.rst and many of deprecated repo need project-config update to remove the release job run from the master gate. * Retired repo does not need any action from the project team as TC has the ACL right and will take care of patch merge. * All the required work for this migration is tracked in this etherpad[8] Test support for TLS default: ---------------------------------- * Rico has started a separate email thread over testing with tls-proxy enabled[9], we encourage projects to participate in that testing and help to enable the tls-proxy in gate testing. Project updates: ------------------- * Retiring js-openstack-lib [10]. * Create repo for Hashicorp Vault deployment [11] * Deprecate os-panko role [12] Yoga release community-wide goal ----------------------------------------- * Please add the possible candidates in this etherpad [13]. * Current status: One goal "Secure RBAC" is proposed [14]. Other Changes ------------------ * Defining Yoga release testing runtime15] 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[16]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [17] 3. Office hours: The Technical Committee offers a weekly office hour every Tuesday at 0100 UTC [18] 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-July/023512.html [2] https://review.opendev.org/c/openstack/governance/+/797913 [3] https://review.opendev.org/c/openstack/governance/+/797985 [4] https://review.opendev.org/c/openstack/governance/+/797912 [5] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [6] https://etherpad.opendev.org/p/tc-xena-tracker [7] https://review.opendev.org/q/project:openstack/governance+status:open [8] https://etherpad.opendev.org/p/openstack-irc-migration-to-oftc [9] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023000.html [10] https://review.opendev.org/c/openstack/governance/+/798540 [11] https://review.opendev.org/c/openstack/governance/+/799826 [12] https://review.opendev.org/c/openstack/governance/+/799817 [13] https://etherpad.opendev.org/p/y-series-goals [14] https://review.opendev.org/c/openstack/governance/+/799705 [15] https://review.opendev.org/c/openstack/governance/+/799927 [16] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [17] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [18] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

[neutron] Drivers meeting - agenda for 9.07.2021
by Slawek Kaplonski 09 Jul '21

09 Jul '21

Hi, I will be on PTO tomorrow but Miguel will chair the meeting. Agenda for is at [1]. There are 3 RFEs to discuss: * https://bugs.launchpad.net/neutron/+bug/1933517 - [RFE][OVN] Create an intermediate OVS bridge between VM and intergration bridge to improve the live-migration process * https://bugs.launchpad.net/neutron/+bug/1933222 - [RFE] Add distributed datapath for metadata * https://bugs.launchpad.net/neutron/+bug/1932154 - Off-path SmartNIC Port Binding [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers#Agenda -- Slawek Kaplonski Principal Software Engineer Red Hat

2 1

VM fail over mechanism to Remote DR site
by KK CHN 09 Jul '21

09 Jul '21

Members , I am using OpenStack Ussuri for our datacentre for virtualization requirements. we are using KVM hypervisor on Debian . We are in a requirement that our DR site is 200+ KMs apart from our office premises and connectivity over WAN. This DR site also going to deploy with Ussuri version. How we can setup the DR site so effectively so that, when VMs or Physical hosts in our DC clusters crashes or abruptly power to one physical machine got break due to electrical wire pulled out/unplugged , then how automatic failover to the DR site which is 300 miles away from our DC . what will be the solution for this setup so that automatically the VMs crashed in our DC will be served from our DR site with minimum latency or zero downtime (is zero down time possible ? kindly enlight on this or how to achieve near zero down time ) using OpenStack without any data loss ( is this possible no Data Loss ?). How ? Whats the best architecture for this using openstack, what all are the tools components need to be used ? and what type of solutions need to be deployed for the above requirement. VMs are nearly 100 nos and Linux and Windows majority of them with around 100 GB to 200 GB size for each VM. Kindly share your thoughts and expertise in this regard and enlighten me on what techniques / components of OpenStack need to be employed for achieving this. Any hints and tips and reference links highly appreciated. Thanks in advance, Kris

1 0

[tripleo] Retiring tripleo-common-tempest-plugin
by Takashi Kajinami 09 Jul '21

09 Jul '21

Hello, I have raised this in #tripleo channel yesterday but I noticed we have a tempest plugin[1] for tripleo but it has never been used actually. The repo has not been updated for a while and it's documentation still mentions very old items like python2, usage of mistral in undercloud, and so on. Because I'm not aware of any plan to use this repo for our testing, I proposed retiring repo[1]. If anybody has concern with this retirement, please give your feedback on the proposed change. [1] https://review.opendev.org/c/openstack/project-config/+/800154 Thank you, Takashi

2 1

[release] Release countdown for week R-12, Jul 12 - Jul 16
by Herve Beraud 09 Jul '21

09 Jul '21

Development Focus ----------------- The Xena-2 milestone is next week, on July 15, 2021! Xena-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/xena/schedule.html for details. General Information ------------------- Libraries need to be released at least once per milestone period. Next week, the release team will propose releases for any library that has not been otherwise released since milestone 1. PTL's and release liaisons, please watch for these and give a +1 to acknowledge them. If there is some reason to hold off on a release, let us know that as well. A +1 would be appreciated, but if we do not hear anything at all by the end of the week, we will assume things are OK to proceed. Remember that non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. Next week is also the deadline to freeze the contents of the final release. All new 'Xena' deliverables need to have a deliverable file in https://opendev.org/openstack/releases/src/branch/master/deliverables and need to have done a release by milestone-2. Changes proposing those deliverables for inclusion in Xena have been posted, please update them with an actual release request before the milestone-2 deadline if you plan on including that deliverable in Xena, or -1 if you need one more cycle to be ready. Upcoming Deadlines & Dates -------------------------- Xena-2 Milestone: 15 July, 2021 -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

qemu-kvm-rhev >= 2.10.0
by Pete Zhang 09 Jul '21

09 Jul '21

We have qemu-kvm-ev in yum.repos.d but it still complains of missing qemu-kvm-rhev. Any idea where we can find qemu-kvm-rhev (NOT qemu-kvm-ev), thx. Error: Execution of '/bin/yum -d 0 -e 0 -y install openstack-nova-compute' returned 1: Error: Package: 1:openstack-nova-compute-20.6.0-1.el7.noarch (local_openstack-tnrp) Requires: qemu-kvm-rhev >= 2.10.0 sh-4.2# yum list | grep qemu-kvm qemu-kvm-ev.x86_64 10:2.10.0-21.el7_5.1.1 local_openstack-tnrp qemu-kvm.x86_64 10:1.5.3-160.el7_6.1 @ORB-updates qemu-kvm-common.x86_64 10:1.5.3-160.el7_6.1 @ORB-updates qemu-kvm-tools.x86_64 10:1.5.3-160.el7_6.1 ORB-updates -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

2 1

[i40e][vf][sriov] Disabling i40evf driver at the compute level.
by Laurent Dumont 09 Jul '21

09 Jul '21

Hey everyone, We are troubleshooting some weirdness with X710 Intel cards and i40evf. Looking around, it seems that most vendors recommend disabling the i40evf driver from the compute side (and keeping the i40e driver). Is anyone aware of any funkiness if both the i40e driver and the i40evf driver is present on computes running VMs with SRIOV ports. Thanks!

3 3

[Cinder] Active/Active Support
by Swapnil Kulkarni 09 Jul '21

09 Jul '21

Hello Cinder Team, Can someone provide a reference documentation for active/active support for a Cinder Driver w.r.t. configuration and any driver changes expected? Best Regards, Swapnil

2 1

[Octavia dashboard] Impossible to fill the subnet field when creating a load balancer
by Taltavull Jean-Francois 09 Jul '21

09 Jul '21

Hi All, On my OSA Victoria deployment (on Ubuntu 20.04), the "Create Load Balancer" form does not allow me to fill the mandatory "subnet" field and therefore I can't create a load balancer with Horizon. On the other hand, Octavia works fine and I can create load balancers with the CLI, Terraform, etc. Has one of you already faced such a situation ? Best regards, Jean-François

3 6

[nova] Applying custom policies at VM creation time
by gustavo panizzo 09 Jul '21

09 Jul '21

Hello I'd like to reject VM creation or mutate the request depending on custom (business) logic for example - reject duplicate names within the same neutron network(s) - change the VM name to append a number or increase it (VM-1 requested, VM-1 already exists so it gets created as VM-2) - reject some values for particular keys on metadata (role=db rejected for project foo) How can I accomplish this? I really don't want to patch nova thanks PS: I found https://github.com/roaet/wafflehaus but it looks it hasn't been touched in years -- IRC: gfa GPG: 0x27263FA42553615F904A7EBE2A40A2ECB8DAD8D5 OLD GPG: 0x44BB1BA79F6C6333

2 2

VM failover mechanism to DR site at remote
by KK CHN 09 Jul '21

09 Jul '21

Hi list members , I am using OpenStack Ussuri for our datacentre for virtualization requirements. we are using KVM hypervisor on Debian . We are in a requirement that our DR site is 200+ KMs apart from our office premises and connectivity over WAN. This DR site also going to deploy with Ussuri version. How we can setup the DR site so effectively so that, when VMs or Physical hosts in our DC clusters crashes or abruptly power to one physical machine got break due to electrical wire pulled out/unplugged , then how automatic failover to the DR site which is 300 miles away from our DC . what will be the solution for this setup so that automatically the VMs crashed in our DC will be served from our DR site with minimum latency or zero downtime (is zero down time possible ? kindly enlight on this or how to achieve near zero down time ) using OpenStack without any data loss ( is this possible no Data Loss ?). How ? Whats the best architecture for this using openstack, what all are the tools components need to be used ? and what type of solutions need to be deployed for the above requirement. VMs are nearly 100 nos and Linux and Windows majority of them with around 100 GB to 200 GB size for each VM. Kindly share your thoughts and expertise in this regard and enlighten me on what techniques / components of OpenStack need to employed for achieving this. Any hints and tips and reference links hightly appreicated. Thanks in advance, Kris

1 0

cannot import name greenpool
by Pete Zhang 08 Jul '21

08 Jul '21

We are seeing this error in /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync] from eventlet import greenpool ImportError: cannot import name greenpool *glance/greenlet version* sh-4.2# yum list installed | grep -i "eventlet\|glance" openstack-glance.noarch 1:19.0.4-1.el7 @local_openstack-tnrp python2-eventlet.noarch 0.25.1-1.el7 @local_openstack-tnrp python2-glance.noarch 1:19.0.4-1.el7 @local_openstack-tnrp python2-glance-store.noarch 1.0.1-1.el7 @local_openstack-tnrp python2-glanceclient.noarch 1:2.17.1-1.el7 @local_openstack-tnrp *Log* Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: Traceback (most recent call last): Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/bin/glance-manage", line 6, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.cmd.manage import main Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/cmd/manage.py", line 54, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.db.sqlalchemy import alembic_migrations Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/db/sqlalchemy/alembic_migrations/__init__.py", line 28, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.db.sqlalchemy import api as db_api Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/db/sqlalchemy/api.py", line 46, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from glance.common import utils Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/glance/common/utils.py", line 29, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet.green import socket Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/eventlet/__init__.py", line 10, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet import convenience Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: File "/usr/lib/python2.7/site-packages/eventlet/convenience.py", line 4, in <module> Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: from eventlet import greenpool Notice: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]/returns: ImportError: cannot import name greenpool Error: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]: Failed to call refresh: 'glance-manage db_sync' returned 1 instead of one of [0] Error: /Stage[main]/Glance::Db::Sync/Exec[glance-manage db_sync]: 'glance-manage db_sync' returned 1 instead of one of [0] -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

1 0

[cinder] I have a question about openstack cinder zonemanager driver
by aaaa bbbb 08 Jul '21

08 Jul '21

I am using Brocade FC switch in my OpenStack environment. I have a question about OpenStack cinder zonemanger driver. I find that [fc-zone-manager] can only configure one zone driver. If I want to use two FC switches from different vendors at the same time. One is Brocade FC switch, the other one is Cisco FC switch. Is there a method or solution configure two FC switch zone driver in one cinder.conf ? I want them both to support Zone Manager.

2 1

[kolla] Clean shutdown for guest VMs when host shutdown
by J-P Methot 08 Jul '21

08 Jul '21

Hi, I'm about ready to go into production with kolla, but one small issue remains. On regular Openstack deployments, I would use the libvirt-guests service to ensure that VMs on hosts always shutdown cleanly when the host shuts down. This is to prevent database issues which may happen on guests during forced, unclean shutdowns. At first glance, Kolla doesn't seem to install this service or anything similar that would ensure clean shutdown of guests when the host shuts down. I have found in the github source, in the tools folder, a systemd script that is supposed to do that, but it tries to execute /usr/libexec/libvirt-guests.sh shutdown in the libvirt container, which doesn't exist there. Does Kolla already ensure clean shutdown automatically, or is there a script I'm missing that could make this work?

4 6

[kolla] [kolla-ansible] Multiple external ceph clusters
by Alexandros Soumplis 08 Jul '21

08 Jul '21

Hi all, I am trying to connect Cinder and Manila with a second CEPH cluster and cannot find an "elegant" way to copy a second pair of ceph.conf/ceph_keyring to the running images. I can do it manually or by changing the playbook code, but I was wondering if there is a clean solution that will allow me to do this without touching the base code of kolla-ansible. Thank you in advance for any suggestions! Best, Alexandros

1 0

bird rpm for Openstack Release Train
by Pete Zhang 08 Jul '21

08 Jul '21

Does anyone know which version of bird rpm used by Openstack Release Train and where I can download it? thx. -- <https://smart.salesforce.com/sig/peiyong.zhang//us_mb/default/link.html>

1 0

[TripleO] Abandoning all open stable/stein and stable/queens patches for EOL
by Marios Andreou 08 Jul '21

08 Jul '21

Hello folks As brought to my attention this morning, we still have some open reviews against stein [1] and queens [2]. Since we have agreed to EOL those branches we should not be merging any new code there (if this is news to you (!) see [3] - EOL patches at [4][5]). I am going to go through and abandon all the patches in [1][2]. If this causes problems for you then please reach out to me ASAP so we can work something out if possible (may be harder for stein, e.g. we'd have to address some broken jobs first). For example, we can try and merge your patch and then resend the EOL patches at [4][5]. Once the patches at [4][5] merge (which is looking pretty close, they have at least one +2 from the release team) then all bets are off we can't merge anything else there. regards, marios [1] https://review.opendev.org/q/(project:%255Eopenstack/.*tripleo.*)AND(status… [2] https://review.opendev.org/q/(project:%255Eopenstack/.*tripleo.*)AND(status… [3] http://lists.openstack.org/pipermail/openstack-discuss/2021-June/023409.html [4] https://review.opendev.org/c/openstack/releases/+/798924 [5] https://review.opendev.org/c/openstack/releases/+/798925

2 3

Increase image upload limit
by open infra 08 Jul '21

08 Jul '21

Hi In a Kubernetes based OpenStack deployment, how to set the value for image_size_cap? Regards Danishka

1 0

[keystone] which CADF events are considered audit logs?
by Bence Romsics 08 Jul '21

08 Jul '21

Hi All, My colleagues working downstream asked me about audit logging, however I did not know enough about it to answer their questions. So let me please phrase their question here: For all other OpenStack components but Keystone they see audit logs in CADF format with event types 'audit.http.request' and 'audit.http.response'. Always separate logs for requests and responses. However from Keystone they also encountered CADF events with event_types like 'identity.user.created', 'identity.user.deleted' or 'identity.authenticate'. Please see an example at the end of my mail. And I guess all examples from https://docs.openstack.org/keystone/latest/admin/event_notifications.html also apply here. They were a bit surprised that these events do not one-by-one correspond to request-responses. So I believe their question is: Do you consider these Keystone events audit logs? Or do you consider them just event logs in CADF format? Or does the answer to this question depend on the object of auditing? Thanks in advance, Bence Romsics keystone/keystone-main.log:188003:<14>2021-06-15T12:51:27.323753+02:00 cic-1.domain.tld keystone-main[14531]: INFO oslo.messaging.notification.identity.user.created [req-8c3fed70-db9c-4f37-a9c5-517491d55246 034a3ac87804494a8d89d32987ff6696 e2fa6412da584f7ebb439d108e1a1185 - default default] {"event_type": "identity.user.created", "timestamp": "2021-06-15 10:51:27.321921", "payload": {"typeURI": http://schemas.dmtf.org/cloud/audit/1.0/event<http://schemas.dmtf.org/cloud/audit/1.0/event>, "initiator": {"typeURI": "service/security/account/user", "host": {"agent": "python-keystoneclient", "address": "192.168.2.124"}, "project_id": "e2fa6412da584f7ebb439d108e1a1185", "user_id": "034a3ac87804494a8d89d32987ff6696", "id": "034a3ac87804494a8d89d32987ff6696"}, "target": {"typeURI": "data/security/account/user", "id": "3dac4a1acaaa4d5598d03b9970d13ce5"}, "observer": {"typeURI": "service/security", "id": "6c15158d525643ea9e40e26b88489b82"}, "eventType": "activity", "eventTime": "2021-06-15T10:51:27.211457+0000", "action": "created.user", "outcome": "success", "id": "c0723c47-f806-54c6-b8b1-14d4e5fdd456", "resource_info": "3dac4a1acaaa4d5598d03b9970d13ce5"}, "priority": "INFO", "publisher_id": "identity.cic-1.domain.tld", "message_id": "2a2adc06-710d-4b11-abdf-2b588a2b8440"}

1 0

[all][tc] OpenStack next release name is final- "OpenStack Yoga"
by Ghanshyam Mann 08 Jul '21

08 Jul '21

Hello Everyone, We have the final name selected for the OpenStack next release name. Its "OpenStack Yoga". As per the release name criteria[1], selection of release name is gone through three steps: Step1: Name nomination from community members[2]. Step2: TC voted on the nominated names[3]. Step3: Trademark checks by Foundation on winners from TC votes. In trademark check, “Yoga” is finalized as the best bet for this release. Thanks community members to participating in name nomination, TC to vote and Foundation for performing the trademark checks. "Yoga" is now good signal to extend our exercise and be more fit in Yoga cycle :) [1] https://governance.openstack.org/tc/reference/release-naming.html#release-n… [2] https://wiki.openstack.org/wiki/Release_Naming/Y_Proposals [3] https://civs1.civs.us/cgi-bin/results.pl?id=E_f065453ffd2537cb -gmann

4 6

[kolla] Date for the release of 10.2.1 ussuri (stable)
by KIM 1 Guy 08 Jul '21

08 Jul '21

Dear all, We are using the ansible kolla with the release 10.2.0. We are planning to upgrade it. So I would like to know when the stable 10.2.1 is released. On 10.2.1 "ussuri" : kolla-ansible (launchpad.net)<https://launchpad.net/kolla-ansible/+milestone/10.2.1>, the release date is not mentioned. Thank you in advance for your answer. Kind regards, Guy KIM This message and any attachments (the "message") is intended solely for the intended addressees and is confidential. If you receive this message in error,or are not the intended recipient(s), please delete it and any copies from your systems and immediately notify the sender. Any unauthorized view, use that does not comply with its purpose, dissemination or disclosure, either whole or partial, is prohibited. Since the internet cannot guarantee the integrity of this message which may not be reliable, BNP PARIBAS (and its subsidiaries) shall not be liable for the message if modified, changed or falsified. Do not print this message unless it is necessary, consider the environment. ---------------------------------------------------------------------------------------------------------------------------------- Ce message et toutes les pieces jointes (ci-apres le "message") sont etablis a l'intention exclusive de ses destinataires et sont confidentiels. Si vous recevez ce message par erreur ou s'il ne vous est pas destine, merci de le detruire ainsi que toute copie de votre systeme et d'en avertir immediatement l'expediteur. Toute lecture non autorisee, toute utilisation de ce message qui n'est pas conforme a sa destination, toute diffusion ou toute publication, totale ou partielle, est interdite. L'Internet ne permettant pas d'assurer l'integrite de ce message electronique susceptible d'alteration, BNP Paribas (et ses filiales) decline(nt) toute responsabilite au titre de ce message dans l'hypothese ou il aurait ete modifie, deforme ou falsifie. N'imprimez ce message que si necessaire, pensez a l'environnement.

2 1

[kolla] PTL away next week, meeting cancelled
by Mark Goddard 08 Jul '21

08 Jul '21

Hi, I'm away from 12th - 16th July. As several other cores are also away, we agreed to cancel the meeting on 14th July. Thanks, Mark

1 0

[Neutron] PTL on holiday
by Slawek Kaplonski 08 Jul '21

08 Jul '21

Hi, I will be on PTO from 9.07 and I will be back on Monday 19.07.2021. For anything related to Neutron, please reach out to our drivers team [1] or core team [2]. For any release related things, please reach out to Akihiro who is our release liaison. Due to my holidays I'm also canceling our next week's meetings. There will be no team meeting and ci meeting on Tuesday 13.07 and no drivers meeting on 16.07. Have a great week and see You back on Monday 19.07 :) [1] https://review.opendev.org/admin/groups/ 5b063c96511f090638652067cf0939da1cb6efa7,members [2] https://review.opendev.org/admin/groups/ 9b227d5d1b27471dacbe9a9161904ec115a74138,members -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[all][tc] Technical Committee next weekly meeting on July 8th at 1500 UTC
by Ghanshyam Mann 08 Jul '21

08 Jul '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for July 8th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, June 7th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[kolla][wallaby][manila] ambiguous network
by Ignazio Cassano 07 Jul '21

07 Jul '21

Hello All, I configured manually manila on stein with generic driver and driver handle share server true without issues. When I create a share on a share network it creates a service instance and bla bla bla. Now I am using kolla wallaby and share.log gives "ambiguous network error" with generic manila driver and dhss true. It works fine with netapp driver but dhss true with generic is not working anyone. Any suggestion, please? Ignazio

1 0

[cinder] Bug deputy report for week of 2021-07-07
by Sofia Enriquez 07 Jul '21

07 Jul '21

Hello, This is a bug report from 2021-30-06 to 2021-07-07. You're welcome to join the Cinder Bug Meeting today. Weekly on Wednesday at 1500 UTC on #openstack-cinder Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ----------------------------------------------------------------------------------------- Medium: - https://bugs.launchpad.net/cinder/+bug/1934480 "Cinder can not use system scope due to endpoint". Unassigned. Low: - https://bugs.launchpad.net/cinder/+bug/1934823 "[RBD] --pool is deprecated". Unassigned -->* low-hanging-fruit *good for Open Source day at Grace Hopper Celebration. - https://bugs.launchpad.net/cinder/+bug/1934459 "Enabling OSprofiler in a Openstack cluster with Element OS , runs into an infinite loop recursion". Unassigned Wishlist - https://bugs.launchpad.net/cinder/+bug/1934435 "Element/Cinder driver fails with multiple Timeout exceptions during Element OS upgrade". Unassigned. - https://bugs.launchpad.net/cinder/+bug/1934168 "cinder matrix - clarification of snapshot attachment feature". Unassigned Cheers, Sofia -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[wallaby][octavia] worker Read timeout
by Ignazio Cassano 07 Jul '21

07 Jul '21

Hello All, I installed octavia kolla wallaby and when I create a lod balancer it remains in pending create. The controller worker log reports: Could not connect to instance. Retrying.: requests.exceptions.ReadTimeout: HTTPSConnectionPool(host='10.102.191.23', port=9443): Read timed out. (read timeout=10.0) I am sure the controller can contect the amphora agent on port 8443 (I tried with telnet 10.102.191.23 9443). On the amphora vm I read the following in /var/log/amphora-agent.log: ciphers: None raw_paste_global_conf: [] strip_header_spaces: False [2021-07-07 06:03:03 +0000] [610] [INFO] Starting gunicorn 20.0.4 [2021-07-07 06:03:03 +0000] [610] [DEBUG] Arbiter booted [2021-07-07 06:03:03 +0000] [610] [INFO] Listening at: http://[::]:9443 (610) [2021-07-07 06:03:03 +0000] [610] [INFO] Using worker: sync [2021-07-07 06:03:03 +0000] [637] [INFO] Booting worker with pid: 637 [2021-07-07 06:03:03 +0000] [610] [DEBUG] 1 workers [2021-07-07 06:03:16 +0000] [637] [DEBUG] Closing connection. [2021-07-07 06:03:31 +0000] [637] [DEBUG] Closing connection. [2021-07-07 06:03:47 +0000] [637] [DEBUG] Closing connection. Please, what is wrong ? Ignazio

1 1

[tripleo] TripleO CI Summary: Unified Sprint 45-46
by Bhagyashri Shewale 07 Jul '21

07 Jul '21

Greetings, The TripleO CI team has just completed **Unified Sprint 45-46** (Jun 10 thru to Jun 30 wed 2021). The following is a summary of completed work during this sprint cycle: - Continue to track upstream / rdo work on CentOS-Stream-9 - Utilize the dependency pipelines to track and test the latest patches - At this time upstream is holding for https://review.rdoproject.org/r/c/testproject/+/33878/ - Successfully deployed production promoter server on vexxhost using new code (next gen) promoter code <https://hackmd.io/team/rh-openstack-ci?nav=search&q=promoter> - Continue to adopt new changes and improvements in the promoter : - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/32135 - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/33815 - Instead of pip install use rpm of tripleo-ansible for deployment - https://review.opendev.org/q/topic:%22remove_uneeded_tq_requirements <https://review.opendev.org/q/topic:%22remove_uneeded_tq_requirements%22+(st…> - https://review.opendev.org/c/openstack/tripleo-quickstart/+/789787 - TripleO Repos: - Refactoring tripleo-repos to use cliff as command line framework https://review.opendev.org/c/openstack/tripleo-repos/+/794801 - Python/ansible module to set yum module information More details, use cases and design here: https://hackmd.io/mU1te45ASEWbnLqpSexB_Q?both https://review.opendev.org/q/topic:%22tripleo-yum-config <https://review.opendev.org/q/topic:%22tripleo-yum-config%22+(status:open%20…> - Tempest: - Tempest skiplist design for upstream and downstream https://hackmd.io/9tB-rw0EQ4uHZAaBjDsT4g - Augment and refine update/upgrade jobs in upstream periodic, integration, component pipelines - https://review.opendev.org/c/openstack/tripleo-ci/+/794571 - https://review.opendev.org/c/openstack/tripleo-ci/+/796771 - https://review.opendev.org/c/openstack/tripleo-ci/+/797865 - https://review.opendev.org/q/topic:wallaby-upgrade-jobs - Ruck-rover tooling: https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/34060 The planned work for the next sprint and leftover previous sprint work as following: - Continue to track upstream / rdo work on CentOS-Stream-9 - Utilize the dependency pipelines to track and test the latest patches - At this time upstream is holding for https://review.rdoproject.org/r/c/testproject/+/33878/ - Continue to adopt new changes and improvements in the promoter code - elastic-recheck containerization - https://hackmd.io/dmxF-brbS-yg7tkFB_kxXQ - Openstack health for tripleo - https://hackmd.io/HQ5hyGAOSuG44Le2x6YzUw - Tripleo-repos spec and implementation - Python/ansible module to set yum module information More details, use cases and design here: https://hackmd.io/mU1te45ASEWbnLqpSexB_Q?both https://review.opendev.org/q/topic:%22tripleo-yum-config <https://review.opendev.org/q/topic:%22tripleo-yum-config%22+(status:open%20…> - https://hackmd.io/v2jCX9RwSeuP8EEFDHRa8g?view - Patrole stable release: - We require the logging resource client in tempest to test the patrole logging policy actions in patrole https://hackmd.io/rBqcts18Rc-qCOqe1DM1gg - Centos-8-stream rpm version lock: https://hackmd.io/iYAL3ueUTzWCHE5qFA6jVQ - Pip version lock: https://hackmd.io/5-IjvGr4RUqxNkJ3Yr6c3Q The Ruck and Rover for this sprint are Bhagyashri Shewale(bhagyashris) and Chandan Kumar (chandankumar). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes to be tracked in hackmd. Thanks, Bhagyashri Shewale

1 0

examples or docs about Slurm cloud bursting on OpenStack ?
by Pablo Escobar Lopez 07 Jul '21

07 Jul '21

Hi, I am exploring the option to use the Slurm elastic computing support ( https://slurm.schedmd.com/elastic_computing.html ) together with the Slurm configless support ( https://slurm.schedmd.com/configless_slurm.html ) to deploy dynamic Slurm clusters on OpenStack which can automatically grow and shrink. In a quick search I couldn't find any example or documentation which is specific to Slurm + Openstack. Does anyone has any experience on this specific topic? Can you point me to any documentation or examples? Thanks in advance for any help or advice. Regards, Pablo.

1 0

How the add public ip address to access dashboard
by Salman Sheikh 07 Jul '21

07 Jul '21

Hi all, Suppose in LAN the dashboard is accessible on 192.168.0.3/dashboard, if we want to access it on the internet public ip for ex:124.124.222.34. How can we do this, so it can be accessible through both ips192.168.0.3 and 124.124.22.34. And how we can remove /dashboard from the url. so it can be accessible on 192.168.0.3 instead of 192.168.0.3/dashboard. Kind regards

1 0

PXE in Oracle VM Virtual Box
by Adivya Singh 06 Jul '21

06 Jul '21

Hi Team, is there any individual link for setup a PXE in Oracle VM Virtual Box I have setup the Network boot as first priority but once the VM comes up, it is giving me below error "No Such boot or media error, i can understand the error, but not able to get the correct steps to rectify this error Regards Adivya Singh

1 0

[all][policy] Disable & making policy rule's default change warning configurable
by Ghanshyam Mann 06 Jul '21

06 Jul '21

Hello Everyone, While implementing the new secure RBAC (scope and new defaults), you might have noticed the lot of warnings in the log and sometime failing jobs also due to size of logs. Then you had to disable those via "suppress_default_change_warnings" variable on policy enforcer. The oslo policy log the warnings if the default value of policy rule (if not overridden) is changed, so there are warnings for every policy rule on every API request, everytime policy is initialized which end up a lot of warnings (thousands) in log. It might be happening in production also. Many projects have disabled it via hardcoded "suppress_default_change_warnings". But there is no way for the operator to disable/enable these warnings (enable in case they would like to check the new policy RBAC). To handle it on oslo policy side and generically for all the projects I am planning to: 1. Disable it by default in oslo policy side itself. 2. Make it configurable so that operator can enable it on need basis. NOTE: This proposal is about warnings for default value change, not for the policy name change. I have submitted this proposal in gerrit too - https://review.opendev.org/c/openstack/oslo.policy/+/799539 Please let me know your opinon on this? -gmann

2 2

[Ironic] Vendor-neutral Disk names
by Mahnoor Asghar 06 Jul '21

06 Jul '21

Dear all, There is [a proposal][1] in the metal3-io/baremetal-operator repository to extend the hardware RAID configuration to support ‘physical_disks’ and ‘controller’ fields in the 'target_raid_config' section. The user should be able to specify the disks for RAID configuration, in a vendor-agnostic way. (This requirement comes from the Airship project.) The names of the disks should be indicative of the physical location of the disks within the server. An algorithm to construct disk names is therefore needed, for this purpose. One possible algorithm was found in the [inventory module][2] of the [Redfish Tacklebox scripts][3]. To construct a disk name, it uses Redfish properties, specifically the ‘Drive’ resource> ‘Physical Location’ object> ‘Part Location’ property> ‘Service Label’ property. ([Link][4] to code) ([Link][5] to Redfish ‘Drive’ resource) If this property is empty, the resource type (String uptil the first dot encountered in the @odata.type field), and the ‘Id’ properties of the Drive resource are used to construct the disk name. ([Link][6] to code) For example, if the 'Drive'.'Physical Location'.'Part Location'.'Service Label' field is ‘Disk.Bay1.Slot0’, this is what the disk name will be. If this field is empty, and the resource name is ‘Drive’ and the resource ‘Id’ is ‘Disk.Bay1.Slot0’, the disk name will be: ‘Drive: Disk.Bay1.Slot0’. We would like to understand the values different vendors give in: - ‘Drive’ resource> ‘Physical Location’ object> ‘Part Location’ property> ‘Service Label’ property - The resource type for a Drive (@odata.type field) - The ‘Id’ property of the Drive resource Also, it would be helpful to understand the existing logic used by vendors to construct the disk names, including the (Redfish or other) properties used. This is so that a consensus can be reached for an algorithm to construct disk names. Any suggestions are welcome, thank you so much! [1]: https://github.com/metal3-io/metal3-docs/pull/148 [2]: https://github.com/DMTF/Redfish-Tacklebox/blob/master/redfish_utilities/inv… [3]: https://github.com/DMTF/Redfish-Tacklebox [4]: https://github.com/DMTF/Redfish-Tacklebox/blob/e429f70a79cfe288756618498ce4… [5]: https://redfish.dmtf.org/schemas/v1/Drive.v1_12_1.json [6]: https://github.com/DMTF/Redfish-Tacklebox/blob/e429f70a79cfe288756618498ce4… Best regards, Mahnoor Asghar Software Design Engineer xFlow Research Inc. mahnoor.asghar(a)xflowresearch.com www.xflowresearch.com

4 6

[TripleO] next irc meeting Tuesday 06 July @ 1400 UTC in OFTC #tripleo
by Marios Andreou 06 Jul '21

06 Jul '21

Reminder the next TripleO irc meeting is today Tuesday 06 July 1400 UTC in OFTC irc channel #tripleo. agenda: https://wiki.openstack.org/wiki/Meetings/TripleO one-off items: https://etherpad.opendev.org/p/tripleo-meeting-items (feel free to add any tripleo status/ongoing work etc to the etherpad). Our last meeting was on Jun 22 - you can find logs @ http://eavesdrop.openstack.org/meetings/tripleo/2021/tripleo.2021-06-22-14.… Hope you can make it on Tuesday, regards, marios

1 0

[wallaby][nova] CPU topology and NUMA Nodes
by Ammad Syed 06 Jul '21

06 Jul '21

Hi, I am using openstack wallaby on ubuntu 20.04 and kvm. I am working to make optimized flavor properties that should provide optimal performance. I was reviewing the document below. https://docs.openstack.org/nova/wallaby/admin/cpu-topologies.html I have two socket AMD compute node. The workload running on nodes are mixed workload. My question is should I use default nova CPU topology and NUMA node that nova deploys instance by default OR should I use hw:cpu_sockets='2' and hw:numa_nodes='2'. Which one from above provide best instance performance ? or any other tuning should I do ? The note in the URL (CPU topology sesion) suggests that I should stay with default options that nova provides. Currently it also works with libvirt/QEMU driver but we don’t recommend it in production use cases. This is because vCPUs are actually running in one thread on host in qemu TCG (Tiny Code Generator), which is the backend for libvirt/QEMU driver. Work to enable full multi-threading support for TCG (a.k.a. MTTCG) is on going in QEMU community. Please see this MTTCG project <http://wiki.qemu.org/Features/tcg-multithread> page for detail. Ammad

5 9

[wallaby][neutron][ovn] Low network performance between instances on different compute nodes using OVN Geneve tunnels
by Malik Obaid 06 Jul '21

06 Jul '21

Hi, I am using Openstack Wallaby release with OVN on Ubuntu 20.04. My environment consists of 2 compute nodes and 1 controller node. ovs_version: "2.15.0" Ubuntu Kernel Version: 5.4.0-77-generic I am observing Network performance between instances on different compute nodes is slow. The network uses geneve tunnels.The environment is using 10Gbps network interface cards. However, iperf between instances on different compute nodes attains only speeds between a few hundred Mbit/s and a few Gb/s. Both instances are in the same tenant network. Note: iperf results between both compute nodes (hypervisors) across the geneve tunnel endpoints is perfect 10 Gbps. Below are the results of iperf commands. *iperf server:* 2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 8950 qdisc fq_codel state UP group default qlen 1000 link/ether fa:16:3e:4b:1d:29 brd ff:ff:ff:ff:ff:ff inet 192.168.100.111/24 brd 192.168.100.255 scope global dynamic ens3 valid_lft 42694sec preferred_lft 42694sec inet6 fe80::f816:3eff:fe4b:1d29/64 scope link valid_lft forever preferred_lft forever root@vm-01:~# iperf3 -s Server listening on 5201 Accepted connection from 192.168.100.69, port 45542 [ 5] local 192.168.100.111 port 5201 connected to 192.168.100.69 port 45544 [ 8] local 192.168.100.111 port 5201 connected to 192.168.100.69 port 45546 [ ID][Role] Interval Transfer Bitrate Retr Cwnd [ 5][RX-S] 0.00-1.00 sec 692 MBytes 5.81 Gbits/sec [ 8][TX-S] 0.00-1.00 sec 730 MBytes 6.12 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 1.00-2.00 sec 598 MBytes 5.01 Gbits/sec [ 8][TX-S] 1.00-2.00 sec 879 MBytes 7.37 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 2.00-3.00 sec 793 MBytes 6.65 Gbits/sec [ 8][TX-S] 2.00-3.00 sec 756 MBytes 6.34 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 3.00-4.00 sec 653 MBytes 5.48 Gbits/sec [ 8][TX-S] 3.00-4.00 sec 871 MBytes 7.31 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 4.00-5.00 sec 597 MBytes 5.01 Gbits/sec [ 8][TX-S] 4.00-5.00 sec 858 MBytes 7.20 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 5.00-6.00 sec 734 MBytes 6.16 Gbits/sec [ 8][TX-S] 5.00-6.00 sec 818 MBytes 6.86 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 6.00-7.00 sec 724 MBytes 6.06 Gbits/sec [ 8][TX-S] 6.00-7.00 sec 789 MBytes 6.60 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 7.00-8.00 sec 735 MBytes 6.18 Gbits/sec [ 8][TX-S] 7.00-8.00 sec 835 MBytes 7.02 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 8.00-9.00 sec 789 MBytes 6.62 Gbits/sec [ 8][TX-S] 8.00-9.00 sec 845 MBytes 7.09 Gbits/sec 0 3.14 MBytes [ 5][RX-S] 9.00-10.00 sec 599 MBytes 5.02 Gbits/sec [ 8][TX-S] 9.00-10.00 sec 806 MBytes 6.76 Gbits/sec 0 3.14 MBytes [ ID][Role] Interval Transfer Bitrate Retr [ 5][RX-S] 0.00-10.00 sec 6.75 GBytes 5.80 Gbits/sec receiver [ 8][TX-S] 0.00-10.00 sec 7.99 GBytes 6.87 Gbits/sec 0 sender Server listening on 5201 *Client side:* root@vm-03:~# iperf3 -c 192.168.100.111 --bidir Connecting to host 192.168.100.111, port 5201 [ 5] local 192.168.100.69 port 45544 connected to 192.168.100.111 port 5201 [ 7] local 192.168.100.69 port 45546 connected to 192.168.100.111 port 5201 [ ID][Role] Interval Transfer Bitrate Retr Cwnd [ 5][TX-C] 0.00-1.00 sec 700 MBytes 5.87 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 0.00-1.00 sec 722 MBytes 6.06 Gbits/sec [ 5][TX-C] 1.00-2.00 sec 594 MBytes 4.98 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 1.00-2.00 sec 883 MBytes 7.41 Gbits/sec [ 5][TX-C] 2.00-3.00 sec 796 MBytes 6.67 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 2.00-3.00 sec 752 MBytes 6.31 Gbits/sec [ 5][TX-C] 3.00-4.00 sec 654 MBytes 5.49 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 3.00-4.00 sec 876 MBytes 7.35 Gbits/sec [ 5][TX-C] 4.00-5.00 sec 598 MBytes 5.01 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 4.00-5.00 sec 853 MBytes 7.16 Gbits/sec [ 5][TX-C] 5.00-6.00 sec 734 MBytes 6.15 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 5.00-6.00 sec 818 MBytes 6.86 Gbits/sec [ 5][TX-C] 6.00-7.00 sec 726 MBytes 6.09 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 6.00-7.00 sec 793 MBytes 6.65 Gbits/sec [ 5][TX-C] 7.00-8.00 sec 734 MBytes 6.15 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 7.00-8.00 sec 831 MBytes 6.97 Gbits/sec [ 5][TX-C] 8.00-9.00 sec 788 MBytes 6.61 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 8.00-9.00 sec 845 MBytes 7.09 Gbits/sec [ 5][TX-C] 9.00-10.00 sec 600 MBytes 5.03 Gbits/sec 0 3.13 MBytes [ 7][RX-C] 9.00-10.00 sec 805 MBytes 6.76 Gbits/sec [ ID][Role] Interval Transfer Bitrate Retr [ 5][TX-C] 0.00-10.00 sec 6.76 GBytes 5.81 Gbits/sec 0 sender [ 5][TX-C] 0.00-10.00 sec 6.75 GBytes 5.80 Gbits/sec receiver [ 7][RX-C] 0.00-10.00 sec 7.99 GBytes 6.87 Gbits/sec 0 sender [ 7][RX-C] 0.00-10.00 sec 7.99 GBytes 6.86 Gbits/sec receiver iperf Done. --------------------------------------------------------------------------------------------------------- *ovs-vsctl show on compute node1:* root@kvm01-a1-khi01:~# ovs-vsctl show 88e6b984-44dc-4f74-8a9a-891742dbbdbd Bridge br-eth1 Port ens224 Interface ens224 Port patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int Interface patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int type: patch options: {peer=patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9} Port br-eth1 Interface br-eth1 type: internal Bridge br-int fail_mode: secure datapath_type: system Port tapde98b2d4-a0 Interface tapde98b2d4-a0 Port ovn-f51ef9-0 Interface ovn-f51ef9-0 type: vxlan options: {csum="true", key=flow, remote_ip="172.16.30.3"} bfd_status: {diagnostic="No Diagnostic", flap_count="1", forwarding="true", remote_diagnostic="No Diagnostic", remote_state=up, state=up} Port tap348fc6dc-3a Interface tap348fc6dc-3a Port br-int Interface br-int type: internal Port tap6d4d8e02-c0 Interface tap6d4d8e02-c0 error: "could not open network device tap6d4d8e02-c0 (No such device)" Port patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9 Interface patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9 type: patch options: {peer=patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int} Port tap247fe5b2-ff Interface tap247fe5b2-ff ------------------------------------------------------------------------------------------------------ *ovs-vsctl show on compute node2:* root@kvm03-a1-khi01:~# ovs-vsctl show 24ce6475-89bb-4df5-a5ff-4ce58f2c2f68 Bridge br-eth1 Port patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int Interface patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int type: patch options: {peer=patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9} Port br-eth1 Interface br-eth1 type: internal Port ens224 Interface ens224 Bridge br-int fail_mode: secure datapath_type: system Port patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9 Interface patch-br-int-to-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9 type: patch options: {peer=patch-provnet-440be99a-c347-4458-b7c1-6c0e6155eee9-to-br-int} Port tap2b0bbf7b-59 Interface tap2b0bbf7b-59 Port ovn-650be8-0 Interface ovn-650be8-0 type: vxlan options: {csum="true", key=flow, remote_ip="172.16.30.1"} bfd_status: {diagnostic="No Diagnostic", flap_count="1", forwarding="true", remote_diagnostic="No Diagnostic", remote_state=up, state=up} Port tap867d2174-83 Interface tap867d2174-83 Port tapde98b2d4-a0 Interface tapde98b2d4-a0 Port br-int Interface br-int type: internal -------------------------------------------------------------------------------------------------------- I would really appreciate any input in this regard. Thank you. Regards, Malik Obaid

2 3

[openstack-ansible][osa] Wallaby has been released with 23.0.0
by Dmitriy Rabotyagov 05 Jul '21

05 Jul '21

Hi everyone! We're happy to announce, that OpenStack-Ansible project has finally released stable/wallaby version with tag 23.0.0. This release includes more then 700 changes from over 50 contributors. And I'd love to thank everyone who made this release happen! The major changes since Victoria are: - Added experimental support of Debian Bullseye (11) and CentOS 8 Stream - Significantly improved workflow and status of Cloudkitty, Trove and Zun roles - Added PKI role, that generates local CA, so self-signed certificates will be trusted inside deployment - nspawn containers support has been removed For the full log of the changes, please reffer to the project Release Notes [1] [1] https://docs.openstack.org/releasenotes/openstack-ansible/wallaby.html -- Kind Regards, Dmitriy Rabotyagov

1 0