- openstack-discuss - lists.openstack.org

[neutron] Bug Deputy Report May 10 - 16th
by Oleg Bondarev 17 May '21

17 May '21

Hi everyone, Please find Bug Deputy report for the week May 10 - 16th below. Nothing Critical, just a few OVN bugs looking for triage from OVN folks (see the end of the list). Medium: - https://bugs.launchpad.net/neutron/+bug/1928345 - "neutron_tempest_plugin.api.test_trunk*" tests failing Edit o Assigned to Rodolfo Alonso o In progress: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/791255 - https://bugs.launchpad.net/neutron/+bug/1928299 - centos7 train vm live migration stops network on vm for some minutes o Unassigned o Incomplete: same issue as in https://bugs.launchpad.net/neutron/+bug/1815989 - https://bugs.launchpad.net/neutron/+bug/1928450 - ovn_migration.sh script doesn't detect neutron_dhcp agents when... o Fix released - https://bugs.launchpad.net/neutron/+bug/1928465 - Geneve allocation is not update during migration from ml2/ovs to ovn o Assigned to Jakub Libosvar o Fixed by https://review.opendev.org/c/openstack/neutron/+/784352, in progress for Wallaby - https://bugs.launchpad.net/neutron/+bug/1928466 - Allowed address pairs aren't populated to the new host with DVR router o Assigned to Slawek o In progress: https://review.opendev.org/c/openstack/neutron/+/791492 - https://bugs.launchpad.net/neutron/+bug/1927926 - Ha port is not cleared when cleanup l3router ns o Assigned to fanxiujian o Invalid Low: - https://bugs.launchpad.net/neutron/+bug/1928471 - Wrong assertion methods in unit test o Assigned to Takashi Natsume o Fix released - https://review.opendev.org/c/openstack/neutron/+/791497 Wishlist: - https://bugs.launchpad.net/neutron/+bug/1928211 - Remove quota "ConfDriver", deprecated in Liberty o Assigned to Rodolfo Alonso o In progress: https://review.opendev.org/c/openstack/neutron/+/790999 OVN Triage needed: - https://bugs.launchpad.net/neutron/+bug/1928330 - [OVN] Unable to ping router from test IPV6 subnet o Unassigned o New: OVN folks please triage - https://bugs.launchpad.net/neutron/+bug/1927977 - OVN IDLs not initialized for all worker types o Unassigned o New - https://bugs.launchpad.net/neutron/+bug/1928164 - [OVN] Ovn-controller dose not update the flows table when localport tap device is rebuilt o Unassigned o New Thanks, Oleg --- Advanced Software Technology Lab Huawei

1 0

[openstack-helm] Meeting Cancelled
by Gage Hugo 17 May '21

17 May '21

Hey team, Since there are no agenda items [0] for the IRC meeting tomorrow May 18th, the meeting is cancelled. Our next meeting will be May 25th. Thanks [0] https://etherpad.opendev.org/p/openstack-helm-weekly-meeting

1 0

[Nova] Meeting time poll
by Artom Lifshitz 17 May '21

17 May '21

Hey all, As discussed during the IRC meeting today, the Red Hat Nova team would like to know if it's possible to shift the IRC meeting to a different day and/or time. This would facilitate our own internal calls, but I want to be very clear that we'll structure our internal calls around upstream, not the other way around. So please do not perceive any pressure to change, this is just a question :) To help us figure this out, I've created a Doodle poll [1]. I believe the regular attendees of the IRC meeting are spread between Central Europe and NA West Coast, so I've tried to list times that kinda make sense in both of those places, with a couple of hours on each side as a safety margin. Please vote on when you'd like the Nova IRC meeting to take place. Ignore the actual dates (like May 10), the important bits are the days of the week (Monday, Tuesday, etc). This is obviously a recurring meeting, something that Doodle doesn't seem to understand. I've not included Mondays and Wednesdays in the list of possibilities, as they would not work for Red Hat Nova. You can also vote to keep the status quo :) The times are listed in UTC, like the current meeting time, so unfortunately you have to be mindful of the effects of daylight savings time :( Thanks in advance! [1] https://doodle.com/poll/45ptnyn85iuw7pxz

1 2

Restart cinder-volume with Ceph rdb
by ManuParra 17 May '21

17 May '21

Dear OpenStack community, I have encountered a problem a few days ago and that is that when creating new volumes with: "openstack volume create --size 20 testmv" the volume creation status shows an error. If I go to the error log detail it indicates: "Schedule allocate volume: Could not find any available weighted backend". Indeed then I go to the cinder log and it indicates: "volume service is down - host: rbd:volumes@ceph-rbd”. I check with: "openstack volume service list” in which state are the services and I see that indeed this happens: | cinder-volume | rbd:volumes@ceph-rbd | nova | enabled | down | 2021-04-29T09:48:42.000000 | And stopped since 2021-04-29 ! I have checked Ceph (monitors,managers, osds. etc) and there are no problems with the Ceph BackEnd, everything is apparently working. This happened after an uncontrolled outage.So my question is how do I restart only cinder-volumes (I also have cinder-backup, cinder-scheduler but they are ok). Thank you very much in advance. Regards.

7 17

[stein][neutron] l3 agent error
by Ignazio Cassano 17 May '21

17 May '21

Hello Guys, I've just upgraded from openstack queens to rocky and then to stein on centos 7. In my configuration I have router high availability. After the upgrade and rebooting each controller one by one I get the following errors on all my 3 controllers under /var/log/neutron/l3-agent.log http://paste.openstack.org/show/805407/ If I run openstack router show for for one of uuid in the log: http://paste.openstack.org/show/805408/ Namespace for router in present on all 3 controllers. After the controllers reboot,some routers lost their routing tables, but restarting l3-agent they went ok. Is it possible router ha stopped working? Any idea,please ? Ignazio

2 3

[wallaby] patch needed for neutron-linuxbridge-agent: arp_protect.py
by tjoen 17 May '21

17 May '21

neutron-18.0.0 tenacity-7.0.0 Python-3.9.4 neutron-linuxbridge-agent exits with AttributeError: 'FileNotFoundError' object has no attribute 'returncode' neutron/plugins/ml2/drivers/linuxbridge/agent/arp_protect.py: .. @tenacity.retry( wait=tenacity.wait_exponential(multiplier=0.02), retry=tenacity.retry_if_exception(lambda e: e.returncode == 255), reraise=True ) .. Not a python programmer. But I guess it has something to do with Python39

2 2

[magnum] User meeting at 9:00 UTC Tuesday 18 May
by Bharat Kunwar 17 May '21

17 May '21

Hi all, We are planning to meet at 9:00 UTC Tuesday 18 May on #openstack-magnum (freenode). If you have anything pressing you’d like to discuss, please add to the agenda: https://etherpad.opendev.org/p/magnum-weekly-meeting <https://etherpad.opendev.org/p/magnum-weekly-meeting>. Cheers Bharat

1 1

[tripleo] TripleO CI Summary: Unified Sprint 43
by Bhagyashri Shewale 16 May '21

16 May '21

Greetings, The TripleO CI team has just completed **Unified Sprint 43** (Apr 8 thru to Apr 28 wed 2021). The following is a summary of completed work during this sprint cycle: - Successfully deployed promoter server for all c8 and c7 releases using new code (next gen) promoter code <https://hackmd.io/team/rh-openstack-ci?nav=search&q=promoter> - Continue to adopt new changes and improvements in the promoter : - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/32135 - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/32058 - Reduce our upstream resource usage with zuul jobs including optimizations across the zuul layouts in all the tripleo-* repos - https://review.opendev.org/q/topic:tripleo-ci-reduce - Removing Rocky jobs (EOL) - https://review.opendev.org/q/topic:%22tripleo-ci-reduce-rocky%22 - https://review.rdoproject.org/r/q/topic:%22tripleo-ci-reduce-rocky%22 - Content provider jobs across all branches - Wallaby branching -Component / integration rdo pipelines for wallaby - https://hackmd.io/2sxlx1XzTa-Te47_zLv42Q - Repo sanity check as part of the integration lines - https://review.opendev.org/c/openstack/tripleo-quickstart-extras/+/785040 - Correct the tagging in copy-quay tool - the copy and tagging was one single operation, now copy command is copying every hour all the hashes available and tag is running separately now collecting the current-tripleo tag directly from the delorean api. - copy-quay script: https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/32478 - Added all the monitoring work items for wallaby in Grafana: - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/32890 - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/33125 - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/33238 - Python version of cloud infra cleanup script - https://review.rdoproject.org/r/c/rdo-infra/ci-config/+/31410 The planned work for the next sprint and leftover previous sprint work as following: - Deploy the promoter server for upstream promotions on vexxhost - Dependency Pipeline updates: - Update RHEL_U_Next to handle RHEL8.4 + ct3.0 + rhos-release scenario - elastic-recheck containerization - https://hackmd.io/dmxF-brbS-yg7tkFB_kxXQ - Openstack health for tripleo - https://hackmd.io/HQ5hyGAOSuG44Le2x6YzUw - Tripleo-repos spec and implementation - Adds tripleo-get-hash module get tripleo-ci hash info from tag - https://review.opendev.org/c/openstack/tripleo-ci/+/784392 - https://hackmd.io/v2jCX9RwSeuP8EEFDHRa8g?view - https://review.opendev.org/c/openstack/tripleo-specs/+/772442 - Tempest skiplist: Started to work on tempest-skiplist allowed list of tests (no patches yet) - Patrole stable release- Started to work on it - Ensure pip installs do not impact the tripleo deployment - https://review.opendev.org/q/topic:%22tqe_requires_cleanup%22 The Ruck and Rover for this sprint are Amol Kahat(akahat) and Pooja Jadhav(pojadhav). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes to be tracked in hackmd. Thanks, Bhagyashri Shewale

1 0

[all][tc] What's happening in Technical Committee: summary 14th May, 21: Reading: 5 min
by Ghanshyam Mann 16 May '21

16 May '21

Hello Everyone, Here is last week's summary of the Technical Committee activities. 1. What we completed this week: ========================= Project updates: ------------------- ** puppet-glare is retired[1] Other updates: ------------------ ** Merged the 'Y' release naming process schedule[2]. 2. TC Meetings: ============ * TC held this week meeting on Thursday; you can find the full meeting logs in the below link: - http://eavesdrop.openstack.org/meetings/tc/2021/tc.2021-05-13-15.00.log.html * We will have next week's meeting on May 20th, Thursday 15:00 UTC[3]. 3. Activities In progress: ================== TC Tracker for Xena cycle ------------------------------ TC is using the etherpad[4] for Xena cycle working item. We will be checking and updating the status biweekly in the same etherpad. Open Reviews ----------------- * Two open reviews for ongoing activities[5]. Starting the 'Y' release naming process --------------------------------------------- * Y release naming process is started[6]. Nomination is open until June 10th feel free to propose names in below wiki ** https://wiki.openstack.org/wiki/Release_Naming/Y_Proposals Others --------- * Replacing ATC terminology with AC[7]. As UC is merged into TC, this is to include the AUC into ATC so that they can be eligible for TC election voting. We are having a good amount of discussion on Gerrit, feel free to review the patch if you have any points regarding this. 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[8]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15 UTC [9] 3. Office hours: The Technical Committee offers a weekly office hour every Tuesday at 0100 UTC [10] 4. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://review.opendev.org/c/openstack/governance/+/790582 [2] https://review.opendev.org/c/openstack/governance/+/789385 [3] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting [4] https://etherpad.opendev.org/p/tc-xena-tracker [5] https://review.opendev.org/q/project:openstack/governance+status:open [6] http://lists.openstack.org/pipermail/openstack-discuss/2021-May/022383.html [7] https://review.opendev.org/c/openstack/governance/+/790092 [8] http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [9] http://eavesdrop.openstack.org/#Technical_Committee_Meeting [10] http://eavesdrop.openstack.org/#Technical_Committee_Office_hours -gmann

1 0

[Octavia][Victoria] No service listening on port 9443 in the amphora instance
by Luke Camilleri 16 May '21

16 May '21

Hi there, i am trying to get Octavia running on a Victoria deployment on CentOS 8. It was a bit rough getting to the point to launch an instance mainly due to the load-balancer management network and the lack of documentation (https://docs.openstack.org/octavia/victoria/install/install.html) to deploy this oN CentOS. I will try to fix this once I have my deployment up and running to help others on the way installing and configuring this :-) At this point a LB can be launched by the tenant and the instance is spawned in the Octavia project and I can ping and SSH into the amphora instance from the Octavia node where the octavia-health-manager service is running using the IP within the same subnet of the amphoras (172.16.0.0/12). Unfortunately I keep on getting these errors in the log file of the worker log (/var/log/octavia/worker.log): 2021-05-05 01:54:49.368 14521 WARNING octavia.amphorae.drivers.haproxy.rest_api_driver [-] Could not connect to instance. Retrying.: requests.exceptions.ConnectionError: HTTPSConnectionPool(host='172.16.4.46', p ort=9443): Max retries exceeded with url: // (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f83e0181550>: Failed to establish a new connection: [Errno 111] Connection ref used',)) 2021-05-05 01:54:54.374 14521 ERROR octavia.amphorae.drivers.haproxy.rest_api_driver [-] Connection retries (currently set to 120) exhausted. The amphora is unavailable. Reason: HTTPSConnectionPool(host='172.16 .4.46', port=9443): Max retries exceeded with url: // (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7f83e0181550>: Failed to establish a new connection: [Errno 111] Conne ction refused',)) 2021-05-05 01:54:54.374 14521 ERROR octavia.controller.worker.v1.tasks.amphora_driver_tasks [-] Amphora compute instance failed to become reachable. This either means the compute driver failed to fully boot the instance inside the timeout interval or the instance is not reachable via the lb-mgmt-net.: octavia.amphorae.driver_exceptions.exceptions.TimeOutException: contacting the amphora timed out obviously the instance is deleted then and the task fails from the tenant's perspective. The main issue here is that there is no service running on port 9443 on the amphora instance. I am assuming that this is in fact the amphora-agent service that is running on the instance which should be listening on this port 9443 but the service does not seem to be up or not installed at all. To create the image I have installed the CentOS package "openstack-octavia-diskimage-create" which provides the utility disk-image-create but from what I can conclude the amphora-agent is not being installed (thought this was done automatically by default :-( ) Can anyone let me know if the amphora-agent is what gets queried on port 9443 ? If the agent is not installed/injected by default when building the amphora image? The command to inject the amphora-agent into the amphora image when using the disk-image-create command? Thanks in advance for any assistance

2 10

[neutron][stein] l3 agent errors
by Ignazio Cassano 15 May '21

15 May '21

Hello Guys, I've just upgraded from openstack queens to rocky and then to stein on centos 7. In my configuration I have router high availability. After the upgrade I get the following errors on all my 3 controllers under /var/log/neutron/l3-agent.log 2021-05-15 19:04:28.599 13219 ERROR neutron.agent.linux.external_process [-] ip_monitor for router with uuid 8c137f17-52e6-47f9-bcaa-0eac94a9acd7 not found. The process should not have died 2021-05-15 19:04:28.600 13219 WARNING neutron.agent.linux.external_process [-] Respawning ip_monitor for uuid 8c137f17-52e6-47f9-bcaa-0eac94a9acd7 2021-05-15 19:04:29.905 13219 ERROR neutron.agent.linux.external_process [-] ip_monitor for router with uuid 303c88e4-1c94-4ebc-b592-91063b371db9 not found. The process should not have died 2021-05-15 19:04:29.905 13219 WARNING neutron.agent.linux.external_process [-] Respawning ip_monitor for uuid 303c88e4-1c94-4ebc-b592-91063b371db9 2021-05-15 19:04:31.267 13219 ERROR neutron.agent.linux.external_process [-] ip_monitor for router with uuid 103f3588-a775-4bca-b7a5-093a05068f64 not found. The process should not have died 2021-05-15 19:04:31.268 13219 WARNING neutron.agent.linux.external_process [-] Respawning ip_monitor for uuid 103f3588-a775-4bca-b7a5-093a05068f64 2021-05-15 19:04:32.684 13219 ERROR neutron.agent.linux.external_process [-] ip_monitor for router with uuid c6136e08-16a3-4d56-9440-59a7fe90d0b0 not found. The process should not have died 2021-05-15 19:04:32.685 13219 WARNING neutron.agent.linux.external_process [-] Respawning ip_monitor for uuid c6136e08-16a3-4d56-9440-59a7fe90d0b0 2021-05-15 19:04:34.140 13219 ERROR neutron.agent.linux.external_process [-] ip_monitor for router with uuid 9abaad3a-2439-4036-8611-5f93a8a3501f not found. The process should not have died 2021-05-15 19:04:34.140 13219 WARNING neutron.agent.linux.external_process [-] Respawning ip_monitor for uuid 9abaad3a-2439-4036-8611-5f93a8a3501f Getting for example the last uuid if I execute "openstack router show openstack router show 9abaad3a-2439-4036-8611-5f93a8a3501f +-------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | +-------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | admin_state_up | UP | | availability_zone_hints | | | availability_zones | nova | | created_at | 2020-12-17T10:11:24Z | | description | | | distributed | False | | external_gateway_info | None | | flavor_id | None | | ha | True | | id | 9abaad3a-2439-4036-8611-5f93a8a3501f | | interfaces_info | [{"subnet_id": "a60b631d-d13c-4d02-a51b-2c86c0b38614", "ip_address": "192.168.201.1", "port_id": "08120fb0-be86-47a0-afd6-932801a2d194"}, {"subnet_id": "0ffcb170-66bb-4e65-9df0-80052deb1299", "ip_address": "169.254.192.11", "port_id": "3aa676aa-91cc-43c4-87ea-3b93340950ad"}, {"subnet_id": "0ffcb170-66bb-4e65-9df0-80052deb1299", "ip_address": "169.254.192.21", "port_id": "d5c0cff2-363d-470a-b77c-155d06e2654b"}, {"subnet_id": "0ffcb170-66bb-4e65-9df0-80052deb1299", "ip_address": "169.254.192.3", "port_id": "dab50b1a-d720-410a-b358-20c53a097bd7"}, {"subnet_id": "ae117b0e-fce9-42ca-88b3-a32ba239d795", "ip_address": "192.168.96.59", "port_id": "e49945aa-3e71-4f38-8c76-1c246cf18ff6"}] | | location | Munch({'project': Munch({'domain_name': None, 'domain_id': None, 'name': None, 'id': u'07573f587ceb4d9da007cec4ebc5dcf8'}), 'cloud': '', 'region_name': '', 'zone': None}) | | name | InternetGateway-a820a62fae-avz714-3-router | | project_id | 07573f587ceb4d9da007cec4ebc5dcf8 | | revision_number | 11 | | routes | destination='0.0.0.0/0', gateway='192.168.96.60' | | | destination='192.168.200.0/24', gateway='192.168.96.60' | | | destination='192.168.202.0/24', gateway='192.168.96.58' | | | destination='192.168.203.0/24', gateway='192.168.96.57' | | status | ACTIVE | | tags | | | updated_at | 2020-12-18T15:22:57Z | +-------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Namespace for router exists in all 3 controllers. Any idea, please ? Ignazio

1 0

[victoria] Windows Server 2008 SP2 - No bootble device
by SSelf＠performair.com 14 May '21

14 May '21

All; I'm having some trouble getting a Windows Server 2008 SP2 image to boot. On instance start I am greeted with the following: Booting from Hard Disk... Boot failed: not a bootable disk No bootable device. I've followed the instructions, referenced below, with a minor exception; the "Red Hat VirtIO SCSI controller" driver was installed after the OS had been installed as the Pre-installation Environment had troubles recognizing them (yay 2008?). Any recommendations would be welcome. Reference: https://superuser.openstack.org/articles/how-to-deploy-windows-on-openstack/ Thank you, Stephen Self IT Manager Perform Air International Inc. sself(a)performair.com www.performair.com

1 0

[horizon][stable] [release] Proposal to make stable/ocata and stable/pike as EOL
by vishal manchanda 14 May '21

14 May '21

Hi all, As discussed in the last horizon weekly meeting[1], [2] on 2021-05-05, I would like to announce that the horizon team decided to make stable/ocata and stable/pike branches as EOL. Consider this mail as an official announcement for that. I would like to know if anyone still would like to keep those branches to be open otherwise, I will purpose an EOL patch for these branches. Thanks & Regards, Vishal Manchanda [1] http://eavesdrop.openstack.org/irclogs/%23openstack-meeting-alt/%23openstac… [2] http://eavesdrop.openstack.org/irclogs/%23openstack-horizon/%23openstack-ho…

1 0

Re: [release-announce] oslo.log 4.5.0
by Thomas Goirand 14 May '21

14 May '21

On 5/14/21 11:01 AM, no-reply(a)openstack.org wrote: > We enthusiastically announce the release of: > > oslo.log 4.5.0: oslo.log library > > The source is available from: > > https://opendev.org/openstack/oslo.log Hi, Something broke the subject line, as it's missing the "(xena)" thingy at the end... Can someone repair it, so my filters can properly work? Cheers, Thomas Goirand (zigo)

3 2

[stein][neutron] gratuitous arp
by Ignazio Cassano 13 May '21

13 May '21

Hello, I have a problem on stein neutron. When a vm migrate from one node to another I cannot ping it for several minutes. If in the vm I put a script that ping the gateway continously, the live migration works fine and I can ping it. Why this happens ? I read something about gratuitous arp. Please, help me ? Any workaround , please ? Best Regards Ignazio

3 33

Train upgrade from centos 7 to centos 8
by Ignazio Cassano 13 May '21

13 May '21

Hello Guys, anyone have tried to upgrade a train based on centos 7 to centos 8 without reinstalling ? Thks Ignazio

1 0

[octavia] victoria - loadbalancer works but its operational status is offline
by apps＠mossakowski.ch 13 May '21

13 May '21

Hello, I have stable/victoria baremetal openstack with octavia installed on centos8 using openvswitch mechanism driver: octavia api on controller, health-manager,housekeeping,worker on 3 compute/network nodes. Official docs include only ubuntu with linuxbridge mechanism but I used https://github.com/prastamaha/openstack-octavia as a reference to get it working on centos8 with ovs. I will push those docs instructions for centos8 soon: https://github.com/openstack/octavia/tree/master/doc/source/install. I created basic http scenario using https://docs.openstack.org/octavia/victoria/user/guides/basic-cookbook.html…. Loadbalancer works but its operational status is offline (openstack_loadbalancer_outputs.txt). On all octavia workers I see the same warning message in health_manager.log: Health Manager experienced an exception processing a heartbeat message from ('172.31.255.233', 1907). Ignoring this packet. Exception: 'NoneType' object has no attribute 'encode' I've searched for related active bug but all I found is this not related in my opinion: https://storyboard.openstack.org/#!/story/2008615 I'm attaching all info I've gathered: - octavia.conf and health_manager debug logs (octavia_config_and_health_manager_logs.txt) - tcpdump from amphora VM (tcpdump_from_amphora_vm.txt) - tcpdump from octavia worker (tcpdump_from_octavia_worker.txt) - debug amphora-agent.log from amphora VM (amphora-agent.log) Can you point me to the right direction what I have missed? Thanks! Piotr Mossakowski https://github.com/moss2k13

4 5

[openstack-helm] Announcing new core reviewers
by Gage Hugo 13 May '21

13 May '21

This week we announced the addition of Sangeet Gupta and Jinyuan Liu to the openstack-helm core reviewer team. Thanks to you both for your hard work!

1 0

[cinder] two priority reviews
by Brian Rosmaita 13 May '21

13 May '21

Hello Cinder team, Please direct your attention to these patches, which address issues that are preventing OpenStack from upgrading to SQLAlchemy 1.4 [0]: - https://review.opendev.org/c/openstack/cinder/+/790796 - https://review.opendev.org/c/openstack/cinder/+/790797 Thanks! [0] https://review.opendev.org/c/openstack/requirements/+/788339/

1 0

[CINDER] - RBD backend reporting
by Steven Relf 13 May '21

13 May '21

Hey list. Currently when using an RBD backend using the default settings, total_capacity_gb is reported as MAX_AVAIL + USED bytes, converted into GiB. This to mean seems a little odd, as I would expect that total_capacity_gb should report the total size in GiB of the backend cluster. This of course can be fixed by adding "report_dynamic_total_capacity = false" into the cinder.conf section for the rbd backend. This works fine for ceph clusters where all pools consume from a single disk type/root. But in clusters where you have multiple root's or device types it does not work correctly. Is this proving to be a pain point for anyone else, or is it just me, and if it is proving a problem for others, im happy to write a patch. Im thinking something that gets the pools crushrule and works out the total_capacity_gb, based off the total available capacity of a pool based on its root/crushrules. Rgds Steve. The future has already arrived. It's just not evenly distributed yet - William Gibson

2 1

[neutron] Drivers meeting 14.05.2021 cancelled
by Slawek Kaplonski 12 May '21

12 May '21

Hi, Due to lack of the agenda let's cancel tomorrow's drivers meeting. In the meantime, please review already accepted specs, especially those with review priority which can be found on: https://review.opendev.org/q/label:Review-priority%253D%252B1+project:opens… -- Slawek Kaplonski Principal Software Engineer Red Hat -------- [1] https://review.opendev.org/q/label:Review-priority%253D%252B1+project:opens…

1 0

[all][tc] Technical Committee next weekly meeting on May 13th at 1500 UTC
by Ghanshyam Mann 12 May '21

12 May '21

Hello Everyone, Technical Committee's next weekly meeting is scheduled for May 13th at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, May 12th, at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[baremetal-sig][ironic] Tue May 11, 2021, 2pm UTC: Why Ironic?
by Arne Wiebalck 12 May '21

12 May '21

Dear all, The Bare Metal SIG will meet next week Tue May 11, 2021, at 2pm UTC on zoom. The meeting will feature a "topic-of-the-day" presentation by Arne Wiebalck (arne_wiebalck) on "Why Ironic? (The Case of Ironic in CERN IT)" As usual, all details on https://etherpad.opendev.org/p/bare-metal-sig Everyone is welcome! Cheers, Arne

2 1

Wallaby RDO Release Announcement
by Amy Marrich 12 May '21

12 May '21

If you're having trouble with the formatting, this release announcement isavailable online at https://blogs.rdoproject.org/2021/05/rdo-wallaby-released/ --- *RDO Wallaby Released* The RDO community is pleased to announce the general availability of the RDO build for OpenStack Wallaby for RPM-based distributions, CentOS Stream and Red Hat Enterprise Linux. RDO is suitable for building private, public, and hybrid clouds. Wallaby is the 23rd release from the OpenStack project, which is the work of more than 1,000 contributors from around the world. The release is already available on the CentOS mirror network at http://mirror.centos.org/centos/8 <http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-wallaby/> -stream <http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-wallaby/> /cloud/x86_64/openstack- <http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-wallaby/> wallaby <http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-wallaby/>/ <http://mirror.centos.org/centos/8-stream/cloud/x86_64/openstack-wallaby/>. The RDO community project curates, packages, builds, tests and maintains a complete OpenStack component set for RHEL and CentOS Stream and is a member of the CentOS Cloud Infrastructure SIG. The Cloud Infrastructure SIG focuses on delivering a great user experience for CentOS users looking to build and maintain their own on-premise, public or hybrid clouds. All work on RDO and on the downstream release, Red Hat OpenStack Platform, is 100% open source, with all code changes going upstream first. PLEASE NOTE: RDO Wallaby provides packages for CentOS Stream 8 and Python 3 only. Please use the Victoria release for CentOS8. For CentOS7 and python 2.7, please use the Train release. *Interesting things in the Wallaby release include:* - RBAC supported added in multiple projects including Designate, Glance, Horizon, Ironic, and Octavia - Glance added support for distributed image import - Ironic added deployment and cleaning enhancements including UEFI Partition Image handling, NVMe Secure Erase, per-instance deployment driver interface overrides, deploy time “deploy_steps”, and file injection. - Kuryr added nested mode with node VMs running in multiple subnets is now available. To use that functionality a new option [pod_vif_nested]worker_nodes_subnets is introduced accepting multiple Subnet IDs. - Manila added the ability for Operators to now set maximum and minimum share sizes as extra specifications on share types. - Neutron added a new subnet type network:routed is now available. IPs of this subnet type can be advertised with BGP over a provider network. - TripleO moved network and network port creation out of the Heat stack and into the baremetal provisioning workflow. Other highlights of the broader upstream OpenStack project may be read via https://releases.openstack.org/wallaby/highlights.html *Contributors* - During the Wallaby cycle, we saw the following new RDO contributors: - Adriano Petrich - Ananya Banerjee - Artom Lifshitz - Attila Fazekas - Brian Haley - David J Peacock - Jason Joyce - Jeremy Freudberg - Jiri Podivin - Martin Kopec - Waleed Mousa Welcome to all of you and Thank You So Much for participating! But we wouldn’t want to overlook anyone. A super massive Thank You to all 58 contributors who participated in producing this release. This list includes commits to rdo-packages, rdo-infra, and redhat-website repositories: - Adriano Petrich - Alex Schultz - Alfredo Moralejo - Amol Kahat - Amy Marrich - Ananya Banerjee - Artom Lifshitz - Arx Cruz - Attila Fazekas - Bhagyashri Shewale - Brian Haley - Cédric Jeanneret - Chandan Kumar - Daniel Pawlik - David J Peacock - Dmitry Tantsur - Emilien Macchi - Eric Harney - Fabien Boucher - frenzyfriday - Gabriele Cerami - Gael Chamoulaud - Grzegorz Grasza - Harald Jensas - Jason Joyce - Javier Pena - Jeremy Freudberg - Jiri Podivin - Joel Capitao - Kevin Carter - Luigi Toscano - Marc Dequenes - Marios Andreou - Martin Kopec - Mathieu Bultel - Matthias Runge - Mike Turek - Nicolas Hicher - Pete Zaitcev - Pooja Jadhav - Rabi Mishra - Riccardo Pittau - Roman Gorshunov - Ronelle Landy - Sagi Shnaidman - Sandeep Yadav - Slawek Kaplonski - Sorin Sbarnea - Steve Baker - Takashi Kajinami - Tristan Cacqueray - Waleed Mousa - Wes Hayutin - Yatin Karel *The Next Release Cycle* At the end of one release, focus shifts immediately to the next release i.e Xena. *Get Started* There are three ways to get started with RDO. To spin up a proof of concept cloud, quickly, and on limited hardware, try an All-In-One Packstack installation. You can run RDO on a single node to get a feel for how it works. For a production deployment of RDO, use TripleO and you’ll be running a production cloud in short order. Finally, for those that don’t have any hardware or physical resources, there’s the OpenStack Global Passport Program. This is a collaborative effort between OpenStack public cloud providers to let you experience the freedom, performance and interoperability of open source infrastructure. You can quickly and easily gain access to OpenStack infrastructure via trial programs from participating OpenStack public cloud providers around the world. *Get Help* The RDO Project has our users(a)lists.rdoproject.org for RDO-specific users and operators. For more developer-oriented content we recommend joining the dev(a)lists.rdoproject.org mailing list. Remember to post a brief introduction about yourself and your RDO story. The mailing lists archives are all available at https://mail.rdoproject.org. You can also find extensive documentation on RDOproject.org. The #rdo channel on Freenode IRC is also an excellent place to find and give help. We also welcome comments and requests on the CentOS devel mailing list and the CentOS and TripleO IRC channels (#centos, #centos-devel, and #tripleo on irc.freenode.net) however we have a more focused audience within the RDO venues. *Get Involved* To get involved in the OpenStack RPM packaging effort, check out the RDO contribute pages, peruse the CentOS Cloud SIG page, and inhale the RDO packaging documentation. Join us in #rdo and #tripleo on the Freenode IRC network and follow us on Twitter @RDOCommunity. You can also find us on Facebook and YouTube.

1 0

[Openstack][train][neutron] centos 7 after live migration instances stop to respond to ping
by Ignazio Cassano 12 May '21

12 May '21

Hello everyone, After migrating from stein to train, I am facing again with live migration issues because live migrated vm stop to respond to ping. On Stein I solved following a workaround for enabling legacy port binding. On centos 7 train I have not found any workaround for solving this issue yet. I think it is very important issue because train is the last release for centos 7 and it could be a bridge for moving from centos 7 to centos 8. I tried to talk on irc but seems some patches are not backported to train. So the question is: which is the strategy for moving from stein to a newer release ? On which version of openstack the multiport binding works fine in live migration case ? How can upgrade from stein to an openstack release where I can forget the above issue? Many thanks and Regards. Ignazio

1 0

[all][neutron][nova][ironic][cinder][keystone][glance][swift] OVN is now default in DevStack
by Lucas Alvares Gomes 12 May '21

12 May '21

Hi, As of today, OVN is the default network backend driver in DevStack [0]. This effort has been discussed in previous PTGs as well as emails to this mail list for a few cycles and now we are happy to announce that it's complete! We are aware that OpenStack is big and it has many projects included in it so, we tried to make this transition as smooth as possible for each other but, in case this change breaks your project CI in any way know that there's an easy fix for that which is explicitly enabling the ML2/OVS driver back until we can better investigate the problem. Here are some examples of patches doing it: [1][2][3]. Also, I would like to reinforce that this DOES NOT mean that the ML2/OVS driver will be deprecated, both drivers are and will be actively maintained by the Neutron community. Big thanks to everyone that participated in this effort! [0] https://review.opendev.org/c/openstack/devstack/+/735097/ [1] https://review.opendev.org/c/openstack/ironic/+/739945 [2] https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/790928 [3] https://review.opendev.org/c/openstack/metalsmith/+/749346 Cheers, Lucas

1 0

SNS like in Swift
by Antonio Gomez 12 May '21

12 May '21

Hi all, I'm trying to achieve an event based action based on uploading an Object to Swift, similar to SNS on AWS - where a file is uploaded and then some action happens. I've looked into https://github.com/openstack-archive/qinling due to https://www.youtube.com/watch?v=K2SiMZllN_A&t=30s&ab_channel=LingxianKong which shows how a function is triggered when a file is uploaded to Swift. However I see the project has been archived and not maintained and was wondering if there is something that maybe I can use? Thanks in advance, -- *Antonio Gomez *

1 0

[ironic] Announcing retirement of sushy-cli
by Riccardo Pittau 12 May '21

12 May '21

Hello ironicers! After a brief exchange in the ML and a discussion during the latest ironic meeting on monday, the community has agreed to retire the sushy-cli project. We'll start the procedure in the next days aiming to conclude the retirement during the xena cycle. Thank you, Cheers, Riccardo

1 0

[cinder] Bug deputy report for week of 2021-05-12
by Sofia Enriquez 12 May '21

12 May '21

Hello, This is a bug report from 2021-05-05 to 2021-05-12. You're welcome to join the next Cinder Bug Meeting later today. Weekly on Wednesday at 1500 UTC on #openstack-cinder Agenda: https://etherpad.opendev.org/p/cinder-bug-squad-meeting ------------------------------------------------------------------------------------------------------------ Critical: - https://bugs.launchpad.net/cinder/+bug/1928083 : "conditional_update broken in sqlalchemy 1.4". Assigned to Gorka Eguileor. High: Medium: - https://bugs.launchpad.net/cinder/+bug/1927784 : "NetApp ONTAP Failing Create FlexVol Pool Replica". Unassigned. - https://bugs.launchpad.net/cinder/+bug/1927783 : "NetApp ONTAP Failing Create FlexVol Replica". Unassigned. - https://bugs.launchpad.net/os-brick/+bug/1928065: "Fails to create vm with nvme native multipath". Unassigned. Low:- Incomplete:- Cheers, Sofi -- L. Sofía Enriquez she/her Software Engineer Red Hat PnT <https://www.redhat.com> IRC: @enriquetaso @RedHat <https://twitter.com/redhat> Red Hat <https://www.linkedin.com/company/red-hat> Red Hat <https://www.facebook.com/RedHatInc> <https://www.redhat.com>

1 0

[blazar] Proposing Jason Anderson as new core reviewer
by Pierre Riteau 12 May '21

12 May '21

Hello, Jason has been involved with the Blazar project for several years now. He has submitted useful new features and fixed bugs, and even wrote a couple of specs. I am proposing to add him as a core reviewer. If there is no objection, I will grant him +2 rights. Thank you Jason for your contributions! Best wishes, Pierre Riteau (priteau)

1 1

[all] Pycharm Project of the Decade - OpenStack
by ʂʍɒρƞįł Ҟưȴķɒʁʉɨ 11 May '21

11 May '21

Hello All, OpenStack recently voted the PyCharm project of the decade. Here's a latest blog article published on Jetbrains [1] [1] https://www.jetbrains.com/company/customers/experience/openstack/ Best Regards, Swapnil Kulkarni coolsvap at gmail dot com

1 0

[puppet] Lint job fails in some modules because of the latest lint packages
by Takashi Kajinami 11 May '21

11 May '21

Hello, I'd like to inform you that we are experiencing lint job failures in some modules since we removed pin of lint packages recently[1]. I started submitting fixes for these failures[2], so please be careful before you recheck the job. [1] https://review.opendev.org/c/openstack/puppet-openstack_spec_helper/+/761925 [2] https://review.opendev.org/q/topic:%22puppet-lint-latest%22+(status:open%20… Thank you, Takashi

1 1

[neutron] Specs to review
by Slawek Kaplonski 11 May '21

11 May '21

Hi, As we spoke on today's team meeting. I set review-priority = +1 for some of the specs which I think would be good to review. List is available at https:// tinyurl.com/22ct4dwx[1] Please take a look at those specs if You will have some time. Thx in advance. -- Slawek Kaplonski Principal Software Engineer Red Hat -------- [1] https://tinyurl.com/22ct4dwx

1 0

[all] Nomination open for OpenStack "Y" Release Naming until 10th June, 21
by Ghanshyam Mann 11 May '21

11 May '21

Hello Everyone, We are now starting the process for the OpenStack 'Y' release name. Below are the details on dates and criteria: Dates[1]: ======= - Nomination Open: 2021-05-13 to 2021-06-10 - TC Poll on proposed names: 2021-06-10 to 2021-06-17 Criteria: ====== - Refer to the below governance page for the naming criteria: https://governance.openstack.org/tc/reference/release-naming.html#release-n… - Any community members can propose the name to the below wiki page: https://wiki.openstack.org/wiki/Release_Naming/Y_Proposals We encourage all community members to participate in this process. [1]https://governance.openstack.org/tc/reference/release-naming.html#polls -gmann

1 0

[ops][victoria][cinder] Import volume?
by DHilsbos＠performair.com 11 May '21

11 May '21

All; I'm looking to transfer several VMs from XenServer to an OpenStack Victoria cloud. Finding explanations for importing Glance images is easy, but I haven't been able to find a tutorial on importing Cinder volumes. Since they are currently independent servers / volumes it seems somewhat wasteful and messy to import each VMs disk as an image just to spawn a volume from it. We're using Ceph as the storage provider for Glance and Cinder. Thank you, Dominic L. Hilsbos, MBA Director - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

3 5

[train][nova][neutron] gratiutous arp on centos 7
by Ignazio Cassano 11 May '21

11 May '21

Hello All, We've just updated openstack centos7 fron stein to train. Unfortunately live migrations works but vm lost a lot of pings after migration. We also applied the following patches but the do not solve: https://review.opendev.org/c/openstack/neutron/+/640258/ https://review.opendev.org/c/openstack/neutron/+/753314/ https://review.opendev.org/c/openstack/neutron/+/766277/ https://review.opendev.org/c/openstack/nova/+/742180/12 https://review.opendev.org/c/openstack/nova/+/747454/4 After that we also tried to apply https://review.opendev.org/c/openstack/nova/+/602432 but the issue remains the same. Please, anyone can help us ? Ignazio

1 0

[zun][horizon] How to display containers among VMs on network topology ?
by Maxime d'Estienne 11 May '21

11 May '21

Hello, I installed Zun on my stack and it works very well, I have a few containers up and running. I also added the zun-ui plugin for Horizon wich allows me to see the list of containers and to create them. But I often use the network topology view, wich I found very clean sometimes. I wondered if there is a solution to display the containers as are Vm's ? Thank you ! Maxime

2 2

[sdk]: identity service if get_application_credential method could use user name
by dmeng 11 May '21

11 May '21

Hello, Hope this email finds you well. Shall I please ask a question about the openstacksdk identity service, the application credential? We would like to get the expiration date of an application credential using the Identity v3 method get_application_credential or find_appplication_credential. We found that they require both the user id and the application credential id in order to get it. The code I'm using is as the following, and this works for us. conn = connection.Connection( session=sess, region_name='Victoria, identity_api_version='3') keystone = conn.identity find = keystone.get_application_credential(user='my_user_id', application_credential = 'app_cred_id') expire_date = find['expires_at'] We are wondering if we could use the user name to get it instead of the user id? If I do get_application_credential(user='catherine', application_credential = 'app_cred_id'), then it will show me an error that "You are not authorized to perform the requested action: identity:get_application_credential". Is there any method that no need user info, can just use the application credential id to get the expiration date? We also didn't find any documentation about the application credential in openstacksdk identity service docs. Thanks and have a great day! Catherine

2 5

Re: [cinder] Multiattach volume mount/attach limit
by Adam Tomas 10 May '21

10 May '21

Hi, thank you for the answer. Regards Adam > > Hi, > > This is currently not possible, and I believe there is no ongoing effort > to add this feature either. > > Cheers, > Gorka. > > >

1 0

[placement] clouds.yaml does not use placement API version variable
by jayaditya gupta 10 May '21

10 May '21

Even after specifying the variable in clouds.yaml placement still uses version 1.0 Story : https://storyboard.openstack.org/#!/story/2008553 Hello can someone help me on this one. I'm not sure where exactly is the issue in placement or in osc-placement . I would really appreciate the insight on this one. Thanks

1 0

[dev][tc]nova-scheduler: cpu-topology: sub-numa(numa nodes within one CPU socket) aware scheduler
by Song Bao Hua (Barry Song) 10 May '21

10 May '21

Dears, Historically, both AMD EPYC and Intel Xeon had NUMA nodes within one CPU socket. For Intel haswell/broadwell, they could have two rings to connect multiple CPUs: +----------------------------+ +-------------------------+ +---+ +-----+ +----+ +---+ +---+ +-----+ +----+ +---+ | | | | +---+ +-----+ +----+ ring +---+ +---+ ring +-----+ +----+ +---+ | | | | +---+ +-----+ +----+ +---+ +---+ +-----+ +----+ +---+ | | | | | | | | +----------------------------+ +-------------------------+ Due to the latency to access the memory located in different rings, cluster-on-die(COD) NUMA nodes did exist in haswell/ broadwell. For AMD EPYC, they used to have 4 DIEs in one CPU socket: +-------------------------------------------------+ | AMD EPYC | | +-------------+ +-------------+ | | | | | | | | | die | | die | | | | |-------- | | | | |\ /| | | | +-------------+ -\ /- +-------------+ | | | /-\ | | | +-------|------+/- -+-------|------+ | | | - | | | | | die | | die | | | | |------| | | | | | | | | | +--------------+ +--------------+ | | | +-------------------------------------------------+ These 4 different DIEs could be configured as 4 different NUMA. However, with the development of hardware, Intel and AMD no longer need to be aware of NUMA nodes within single one CPU. Intel has moved to mesh since skylake(server): +-------|-----------------------+ | | | | | | | | | | |-------|-------|-------|-------| | | | | | | | | | | |-------|-------|-------|-------| | | | | | | | | | | |-------|-------|-------|-------| | | | | | | | | | | +-------------------------------+ AMD moved memory and I/O to a separate DIE, thus made the whole CPU become UMA in EPYC II: +---------+ +---------+ +---------+ +---------+ | cpu die | |cpu die | |cpu die | |cpu die | | | | | | | | | +---------+ +---------+ +---------+ +---------+ +------------------------------------------------------+ | | | memory and I/O DIE | | | +------------------------------------------------------+ +---------+ +---------+ +---------+ +---------+ |cpu die | |cpu die | |cpu die | |cpu die | | | | | | | | | +---------+ +---------+ +---------+ +---------+ Skylake, while still having SNC(sub-numa-cluster) within a DIE for a huge mesh network, doesn't really suffer from this kind of internal sub-numa since the latency difference is really minor to enable SNC or not. According to "64-ia-32-architectures-optimization-manual"[1], for a typical 2P system, disabling and enabling SNC will bring minor latency difference for memory access within one CPU: SNC off: Using buffer size of 2000.000MB Measuring idle latencies (in ns)... Numa node Numa node 0 1 0 81.9 153.1 1 153.7 82.0 SNC on: Using buffer size of 2000.000MB Measuring idle latencies (in ns)... Numa node Numa node 0 1 2 3 0 81.6 89.4 140.4 153.6 1 86.5 78.5 144.3 162.8 2 142.3 153.0 81.6 89.3 3 144.5 162.8 85.5 77.4 As above, if we disable sub-numa in one CPU, the CPU has memory latency as 81.9, but if sub-numa is enabled, the advantage is really minor, SNC can access its own memory with the latency of 81.6 with 0.3 gap only. So SNC doesn't really matter on Xeon. However, the development of kunpeng920's topology is different from Intel and AMD. Similar with AMD EPYC, kunpeng920 has two DIEs in one CPU. Unlike EPYC which has only 8cores in each DIE, each DIE of kunpeng920 has 24 or 32 cores. For a typical 2P system, we can set it to 2NUMA or 4NUMA. +------------------------------+ +------------------------------+ | CPU | | CPU | | +----------+ +----------+ | | +----------+ +----------+ | | | | | | | | | | | | | | | DIE | | DIE | | | | DIE | | DIE | | | | | | | | | | | | | | | | | | | | | | | | | | | +----------+ +----------+ | | +----------+ +----------+ | | | | | +------------------------------+ +------------------------------+ * 2NUMA - DIE interleave In this case, two DIEs become one NUMA. The advantage is that we are getting more CPUs in one NUMA, so this decreases the fragment of CPUs and help deploy more virtual machines on the same host when we apply the rule of pinning VM within one NUMA, compared with disabling DIE interleave. But, this has some obvious disadvantage. Since we need to run DIE interleave, the average memory access latency could increase much. Enabling DIE interleave: Numa node Numa node 0 1 0 95.68 199.21 1 199.21 95.68 Disabling DIE interleave Numa node Numa node 0 1 2 3 0 85.79 104.33 189.95 209.00 1 104.33 85.79 209.00 229.60 2 189.95 209.00 85.79 104.33 3 209.00 229.60 104.33 85.79 As above, one DIE can access its local memory with latency of 85.79, but when die-interleave is enabled, the latency becomes 95.68. The gap 95.68-85.79 isn't minor. * 4NUMA - each DIE becomes one NUMA In this way, NUMA-aware software can access its local memory with much lower latency. Thus, we can gain some performance improvement in openstack if one VM is deployed in one DIE and only access its local memory. Testing has shown 4%+ performance improvement. However, under the rule that VM does not cross NUMA, less VMs could be deployed on the same host. In order to achieve both goals of performance improvement and anti-fragmentation, we are looking for some way of sub-numa awareness in openstack scheduler. That means, 1. we will disable DIE interleave, thus, for 2P system, we are going to have 4 NUMA; 2. we use the rule VM shouldn't cross CPU, thinking one CPU as a big NUMA and each DIE as a smaller sub-numa. 3. For guests, we can define different priorities, for high priority VMs whose performance is a great concern, openstack will try to deploy them in same sub-numa which is a DIE for kunpeng920; for low priority VMs who can endure across-die latency, they could be placed on different sub-numa, but still within same CPU. So basically, we'd like to make openstack aware of the topology of sub-numa within one cpu and support a rule which prevents cross-CPU but allows cross-DIE. At the same time, this scheduler should try its best to deploy important VMs in same sub-numa and allow relatively unimportant VMs to cross two sub-numa. This might be done by customized openstack flavor according to [2], but we are really looking for some flexible and automatic way. If openstack scheduler can recognize this kind of CPU topology and make smart decision accordingly, it would be nice. Please let me know how you think about it. And alternative ways also welcome. [1] https://software.intel.com/content/www/us/en/develop/download/intel-64-and-… [2] https://docs.openstack.org/nova/pike/admin/cpu-topologies.html Thanks Barry

1 0

Re: [ironic] IPA image does not want to boot with UEFI
by Julia Kreger 10 May '21

10 May '21

Adding the list back and trimming the message. Replies in-band. Well, that is good that the server is not signed, nor other esp images are not working. On Thu, Apr 1, 2021 at 11:20 AM Vuk Gojnic <vuk.gojnic(a)gmail.com> wrote: > > Hey Julia, > > Thanks for asking. I have tried with several ESP image options with same effect (one taken from Ubuntu Live ISO that boots on that node, another downloaded and third made with grub tools). None of them was signed. Interesting. At least it is consistent! Have you tried to pull down the iso image and take it apart to verify it is UEFI bootable against a VM or another physical machine? I'm wondering if you need both uefi parameters set. You definitely don't have properties['capabilities']['boot_mode'] set which is used or... maybe a better word to use is drawn in for asserting defaults, but you do have the deploy_boot_mode setting set. I guess a quick manual sanity check of the actual resulting iso image is going to be critical. Debug logging may also be useful, and I'm only thinking that because there is no logging from the generation of the image. > > The server is not in UEFI secure boot mode. Interesting, sure sounds like it is based on your original message. :( > Btw. I will be on holidays for next week so I might not be able to follow up on this discussion before Apr 12th. No worries, just ping us on irc.freenode.net in #openstack-ironic if a reply on the mailing list doesn't grab our attention. > > Bests, > Vuk > > On Thu, Apr 1, 2021 at 4:20 PM Julia Kreger <juliaashleykreger(a)gmail.com> wrote: >> >> Greetings, >> >> Two questions: >> 1) Are the ESP image contents signed, or are they built using one of >> the grub commands? >> 2) Is the machine set to enforce secure boot at this time? >> >> [trim]

2 3

[cinder] Multiattach volume mount/attach limit
by Adam Tomas 10 May '21

10 May '21

Hi, Is there any way to limit the number of possible mounts of multiattach volume? Best regards Adam Tomas

2 1

[tripleo][ci] all c8 master / wallaby blocked
by Wesley Hayutin 10 May '21

10 May '21

https://bugs.launchpad.net/tripleo/+bug/1927952 https://zuul.openstack.org/builds?job_name=tripleo-ci-centos-8-content-prov… Issues atm w/ quay.io, we are making sure our failover is working properly atm. RDO was missing the latest ceph containers. Thanks

1 1

[swift][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: Swift tempurl middleware reveals signatures in the logfiles (CVE-2017-8761) https://launchpad.net/bugs/1685798 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[nova][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[neutron][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Anti-spoofing bypass using Open vSwitch (CVE-2021-20267) https://launchpad.net/bugs/1902917 Neutron RBAC not working for multiple extensions https://launchpad.net/bugs/1784259 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 non-IP ethertypes are permitted with iptables_hybrid firewall driver https://launchpad.net/bugs/1838473 RA Leak on tenant network https://launchpad.net/bugs/1844712 Anti-spoofing bypass https://launchpad.net/bugs/1884341 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[keystone][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: PCI-DSS account lock out DoS and account UUID lookup oracle https://launchpad.net/bugs/1688137 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[horizon][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: using glance v2 api does not remove temporary files https://launchpad.net/bugs/1674846 DOS : API_RESULT_LIMIT does not work for swift objects https://launchpad.net/bugs/1724598 XSS in adding JavaScript into the ‘Subnet Name’ field https://launchpad.net/bugs/1892848 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[glance][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 10 May '21

10 May '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: default paste_deploy.flavor is none, but config file text implies it is 'keystone' (was: non-admin users can see all tenants' images even when image is private) https://launchpad.net/bugs/1799588 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0