- openstack-discuss - lists.openstack.org

Re: LDAP integration with openstack
by Satish Patel 04 Feb '21

04 Feb '21

check out my blog for full deployment of LDAP - https://satishdotpatel.github.io/openstack-ldap-integration/ On Thu, Feb 4, 2021 at 10:35 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: > > Hi sathish, > Once you are free,please reply to my doubts,I believe that I can solve this issue with your solution. > > Thanks & Regards > Midhunlal N B > +918921245637 > > > On Thu, Feb 4, 2021 at 8:14 PM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >> >> Hi Satish, >> I have some doubt in your configuration >> 1.In keystone, "domains" directory and "keystone.myldapdomain.conf "file i need to create right? >> >> 2.In [ldap] section >> url = ldap://192.168.x.xx >> user = cn=admin,dc=blr,dc=ind,dc=company,dc=com >> password = xxxxx >> suffix = dc=company,dc=com >> I need to add or no need?if not how does openstack connect to my ldap?please reply me. >> >> Thanks & Regards >> Midhunlal N B >> +918921245637 >> >> >> On Thu, Feb 4, 2021 at 7:58 PM Satish Patel <satish.txt(a)gmail.com> wrote: >>> >>> This is what i have >>> >>> In /etc/keystone/keystone.conf >>> >>> [identity] >>> driver = sql >>> domain_config_dir = /etc/keystone/domains >>> domain_specific_drivers_enabled = True >>> >>> In /etc/keystone/domains/keystone.myldapdomain.conf >>> >>> [identity] >>> driver = ldap >>> >>> [ldap] >>> group_allow_create = False >>> group_allow_delete = False >>> group_allow_update = False >>> group_id_attribute = cn >>> ... >>> ... >>> ... >>> <<omitted>> >>> >>> >>> On Thu, Feb 4, 2021 at 9:10 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >>> > >>> > Hi satish, >>> > Thank you so much for your response!Here I am pasting my ldap configuration what i done in keystone.conf,please check and let me know what changes i need to make,also please tell me what are all the new entries i need to add in LDAP. >>> > I have been struggling with this issue for the last 2 month,please help me. >>> > >>> > 1.[identity] >>> > driver = ldap >>> > 2.[ldap] >>> > url = ldap://192.168.x.xx >>> > user = cn=admin,dc=blr,dc=ind,dc=company,dc=com >>> > password = xxxxx >>> > suffix = dc=company,dc=com >>> > query_scope = sub >>> > page_size = 2000 >>> > alias_dereferencing = default >>> > #chase_referrals = false >>> > chase_referrals = false >>> > debug_level = 0 >>> > use_pool = true >>> > pool_size = 10 >>> > pool_retry_max = 3 >>> > pool_retry_delay = 0.1 >>> > pool_connection_timeout = -1 >>> > pool_connection_lifetime = 600 >>> > use_auth_pool = false >>> > auth_pool_size = 100 >>> > auth_pool_connection_lifetime = 60 >>> > user_id_attribute = cn >>> > user_name_attribute = sn >>> > user_mail_attribute = mail >>> > user_pass_attribute = userPassword >>> > user_enabled_attribute = userAccountControl >>> > user_enabled_mask = 2 >>> > user_enabled_invert = false >>> > user_enabled_default = 512 >>> > user_default_project_id_attribute = >>> > user_additional_attribute_mapping = >>> > >>> > group_id_attribute = cn >>> > group_name_attribute = ou >>> > group_member_attribute = member >>> > group_desc_attribute = description >>> > group_additional_attribute_mapping = >>> > >>> > >>> > user_tree_dn = ou=people,dc=blr,dc=ind,dc=company,dc=com >>> > user_objectclass = inetOrgPerson >>> > >>> > group_tree_dn = ou=group,dc=blr,dc=ind,dc=company,dc=com >>> > group_objectclass = organizationalUnit >>> > >>> > This is the configuration I have in my keystone.conf file for ldap integration. >>> > >>> > Thanks & Regards >>> > Midhunlal N B >>> > +918921245637 >>> > >>> > >>> > On Thu, Feb 4, 2021 at 7:10 PM Satish Patel <satish.txt(a)gmail.com> wrote: >>> >> >>> >> Default all group/role/project/user information in SQL but when you say use LDAP then it’s trying to find those information in LDAP, do you have all those information in LDAP? ( assuming not that is why you getting that error) >>> >> >>> >> You should tell your openstack use LDAP for only authentication for user information and look for remaining roles/project etc in SQL That is what I’m running in my cloud and everything works. >>> >> >>> >> Full LDAP integration is little complicated that is why I pick partial method. >>> >> >>> >> Sent from my iPhone >>> >> >>> >> > On Feb 4, 2021, at 7:16 AM, Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >>> >> > >>> >> > >>> >> > Hi all, >>> >> > >>> >> > Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally >>> >> > please help me on this issue. >>> >> > >>> >> > If i run admin-openrc file I am getting below error; >>> >> > >>> >> > root@controller:~/client-scripts# openstack image list >>> >> > The request you have made requires authentication. (HTTP 401) >>> >> > (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) >>> >> > >>> >> > Please help me .Where I am making mistakes? >>> >> > >>> >> > Thanks & Regards >>> >> > Midhunlal N B >>> >> > +918921245637

1 0

Authentication error after configuring LDAP integration with openstack
by Midhunlal Nb 04 Feb '21

04 Feb '21

Hi all, Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally please help me on this issue. If i run admin-openrc file I am getting below error; root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) Please help me .Where I am making mistakes? Thanks & Regards Midhunlal N B +918921245637

2 1

[nova][octavia][kolla] failed to create loadbalancer on Centos8 system
by W Ch 04 Feb '21

04 Feb '21

Hi: Recently, we added a CI task[0] for octavia in the kolla project. and we tested octavia based on the ubuntu and centos systems. The ubuntu system worked as expected but Centos did not work. I tried to debug it and result is following: Octavia can not create a load balancer on centos8. because octavia-worker failed to plug a vip port on amphora vm.[1] 2021-01-31 08:20:12.065 22 ERROR octavia.compute.drivers.nova_driver [-] Error attaching network None with ip None and port 26a39187-e95a-4131-91e7-24289e777f36 to amphora (compute_id: a210ec88-b554-487f-a125-30b5c7473060) : novaclient.exceptions.ClientException: Unknown Error (HTTP 504) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs [-] Error plugging amphora (compute_id: a210ec88-b554-487f-a125-30b5c7473060) into port 26a39187-e95a-4131-91e7-24289e777f36.: octavia.common.exceptions.ComputeUnknownException: Unknown exception from the compute driver: Unknown Error (HTTP 504). 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs Traceback (most recent call last): 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/octavia/compute/drivers/nova_driver.py", line 318, in attach_network_or_port 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs port_id=port_id) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/api_versions.py", line 393, in substitution 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs return methods[-1].func(obj, *args, **kwargs) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/v2/servers.py", line 2063, in interface_attach 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs obj_class=NetworkInterface) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/base.py", line 363, in _create 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs resp, body = self.api.client.post(url, body=body) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/keystoneauth1/adapter.py", line 401, in post 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs return self.request(url, 'POST', **kwargs) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs File "/var/lib/kolla/venv/lib/python3.6/site-packages/novaclient/client.py", line 78, in request 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs raise exceptions.from_response(resp, body, url, method) 2021-01-31 08:20:12.066 22 ERROR octavia.network.drivers.neutron.allowed_address_pairs novaclient.exceptions.ClientException: Unknown Error (HTTP 504) Octavia-work called Neutron API to create a port. And called nova-api to attach the vip to amphora. Neutron created port successfully, but nova failed to attach the port to instance.[2] 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [req-ab0e8d9b-664b-430f-8006-cad713b0c826 401ba22da5f8427fbda5fce24600041b 8ce8b97f710f43d7af2b8f9b1e0463c8 - default default] [instance: a210ec88-b554-487f-a125-30b5c7473060] attaching network adapter failed.: libvirt.libvirtError: Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] Traceback (most recent call last): 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/libvirt/driver.py", line 2149, in attach_interface 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] guest.attach_device(cfg, persistent=True, live=live) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/libvirt/guest.py", line 304, in attach_device 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] self._domain.attachDeviceFlags(device_xml, flags=flags) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 190, in doit 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] result = proxy_call(self._autowrap, f, *args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 148, in proxy_call 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] rv = execute(f, *args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 129, in execute 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] six.reraise(c, e, tb) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/usr/lib/python3.6/site-packages/six.py", line 703, in reraise 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] raise value 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/var/lib/kolla/venv/lib/python3.6/site-packages/eventlet/tpool.py", line 83, in tworker 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] rv = meth(*args, **kwargs) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] File "/usr/lib64/python3.6/site-packages/libvirt.py", line 630, in attachDeviceFlags 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] if ret == -1: raise libvirtError ('virDomainAttachDeviceFlags() failed', dom=self) 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] libvirt.libvirtError: Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.945 8 ERROR nova.virt.libvirt.driver [instance: a210ec88-b554-487f-a125-30b5c7473060] Nova-compute called libvirt to attach the device. And libvirt also failed to attach the device[3] 2021-01-31 08:20:23.884+0000: 86663: error : qemuMonitorIORead:491 : Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.884+0000: 86663: debug : qemuMonitorIO:618 : Error on monitor Unable to read from monitor: Connection reset by peer 2021-01-31 08:20:23.884+0000: 86663: info : virObjectRef:402 : OBJECT_REF: obj=0x7f004c00b610 2021-01-31 08:20:23.884+0000: 86663: debug : qemuMonitorIO:649 : Triggering error callback 2021-01-31 08:20:23.884+0000: 86663: debug : qemuProcessHandleMonitorError:346 : Received error on 0x7f004c0095b0 'instance-00000001' 2021-01-31 08:20:23.884+0000: 64768: debug : qemuMonitorSend:958 : Send command resulted in error Unable to read from monitor: Connection reset by peer I also tried to use kolla/ubuntu-source-nova-libvirt instead of kolla/centos-source-nova-libvirt. and it worked as expected. I think the root cause is that libvirt failed to attach a network device. but i don't know how to resolve this problem. could anyone help me? Thanks Wuchunyang [0]: https://review.opendev.org/c/openstack/kolla-ansible/+/754285 [1]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0… [2]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0… [3]: https://zuul.opendev.org/t/openstack/build/e4b8c62c44a64b96bc287ba2ba2315f0…

4 4

Re: LDAP integration with penstack
by Satish Patel 04 Feb '21

04 Feb '21

This is what i have In /etc/keystone/keystone.conf [identity] driver = sql domain_config_dir = /etc/keystone/domains domain_specific_drivers_enabled = True In /etc/keystone/domains/keystone.myldapdomain.conf [identity] driver = ldap [ldap] group_allow_create = False group_allow_delete = False group_allow_update = False group_id_attribute = cn ... ... ... <<omitted>> On Thu, Feb 4, 2021 at 9:10 AM Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: > > Hi satish, > Thank you so much for your response!Here I am pasting my ldap configuration what i done in keystone.conf,please check and let me know what changes i need to make,also please tell me what are all the new entries i need to add in LDAP. > I have been struggling with this issue for the last 2 month,please help me. > > 1.[identity] > driver = ldap > 2.[ldap] > url = ldap://192.168.x.xx > user = cn=admin,dc=blr,dc=ind,dc=company,dc=com > password = xxxxx > suffix = dc=company,dc=com > query_scope = sub > page_size = 2000 > alias_dereferencing = default > #chase_referrals = false > chase_referrals = false > debug_level = 0 > use_pool = true > pool_size = 10 > pool_retry_max = 3 > pool_retry_delay = 0.1 > pool_connection_timeout = -1 > pool_connection_lifetime = 600 > use_auth_pool = false > auth_pool_size = 100 > auth_pool_connection_lifetime = 60 > user_id_attribute = cn > user_name_attribute = sn > user_mail_attribute = mail > user_pass_attribute = userPassword > user_enabled_attribute = userAccountControl > user_enabled_mask = 2 > user_enabled_invert = false > user_enabled_default = 512 > user_default_project_id_attribute = > user_additional_attribute_mapping = > > group_id_attribute = cn > group_name_attribute = ou > group_member_attribute = member > group_desc_attribute = description > group_additional_attribute_mapping = > > > user_tree_dn = ou=people,dc=blr,dc=ind,dc=company,dc=com > user_objectclass = inetOrgPerson > > group_tree_dn = ou=group,dc=blr,dc=ind,dc=company,dc=com > group_objectclass = organizationalUnit > > This is the configuration I have in my keystone.conf file for ldap integration. > > Thanks & Regards > Midhunlal N B > +918921245637 > > > On Thu, Feb 4, 2021 at 7:10 PM Satish Patel <satish.txt(a)gmail.com> wrote: >> >> Default all group/role/project/user information in SQL but when you say use LDAP then it’s trying to find those information in LDAP, do you have all those information in LDAP? ( assuming not that is why you getting that error) >> >> You should tell your openstack use LDAP for only authentication for user information and look for remaining roles/project etc in SQL That is what I’m running in my cloud and everything works. >> >> Full LDAP integration is little complicated that is why I pick partial method. >> >> Sent from my iPhone >> >> > On Feb 4, 2021, at 7:16 AM, Midhunlal Nb <midhunlaln66(a)gmail.com> wrote: >> > >> > >> > Hi all, >> > >> > Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally >> > please help me on this issue. >> > >> > If i run admin-openrc file I am getting below error; >> > >> > root@controller:~/client-scripts# openstack image list >> > The request you have made requires authentication. (HTTP 401) >> > (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) >> > >> > Please help me .Where I am making mistakes? >> > >> > Thanks & Regards >> > Midhunlal N B >> > +918921245637

1 0

LDAP integration with penstack
by Midhunlal Nb 04 Feb '21

04 Feb '21

Hi all, Before ldap integration openstack working properly but if i set "driver = ldap" in keystone.conf under [identity] section nothing is working for me,I am not able run any openstack command and also not able to create any project or domain or user.If remove "driver = ldap" entry everything working back normally please help me on this issue. If i run admin-openrc file I am getting below error; root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) Please help me .Where I am making mistakes? Thanks & Regards Midhunlal N B +918921245637

2 1

Issue when accessing Openstack
by open infra 04 Feb '21

04 Feb '21

Hi, I am new to both starlingx and openstack. I have deployed StarlingX and now trying to get access OpenStack. I highly appreciate your help on troubleshooting this issue. http://paste.openstack.org/show/802321/ Log: http://paste.openstack.org/show/802322/ Regards, Danishka

1 0

[magnum] [neutron] [ovn] No inter-node pod-to-pod communication due to missing ACLs in OVN
by Krzysztof Klimonda 04 Feb '21

04 Feb '21

Hi, This email is a follow-up to a discussion I've openened on ovs-discuss ML[1] regarding lack of TCP/UDP connectivity between pods deployed on magnum-managed k8s cluster with calico CNI and IPIP tunneling disabled (calico_ipv4pool_ipip label set to a default value of Off). As a short introduction, during magnum testing in ussuri deployment with ml2/ovn neutron driver I've noticed lack of communication between pods deployed on different nodes as part of magnum deployment with calico configured to *not* encapsulate traffic in IPIP tunnel, but route it directly between nodes. In theory, magnum configures adds defined pod network to k8s nodes ports' allowed_address_pairs[2] and then security group is created allowing for ICMP and TCP/UDP traffic between ports belonging to that security group[3]. This doesn't work with ml2/ovn as TCP/UDP traffic between IP addresses in pod network is not matching ACLs defined in OVN. I can't verify this behaviour under ml2/ovs for the next couple of weeks, as I'm taking them off for holidays, but perhaps someone knows if that specific usecase (security group rules with remote groups used with allowed address pairs) is supposed to be working, or should magnum use pod network cidr to allow traffic between nodes instead. [1] https://mail.openvswitch.org/pipermail/ovs-discuss/2020-December/050836.html [2] https://github.com/openstack/magnum/blob/c556b8964fab129f33e766b1c33908b2eb… [3] https://github.com/openstack/magnum/blob/c556b8964fab129f33e766b1c33908b2eb… -- Best Regards, - Chris

5 9

[cyborg]No meeting on Feb 11
by Wang, Xin-ran 04 Feb '21

04 Feb '21

Hi all, With Chinese new year approaching and people being out, we are going to cancel the cyborg IRC meeting on Feb 11. Have a Happy Holiday and Happy Chinese New Year. 😊 Thanks, Xin-Ran

1 0

[all] Eventlet broken again with SSL, this time under Python 3.9
by Thomas Goirand 04 Feb '21

04 Feb '21

Hi, Swift proxy fails with Python 3.9 under Debian Unstable with Python 3.9: http://paste.openstack.org/show/802063/ (that's when doing a simple "openstack container list") I got the same problem with neutron-rpc-server: http://paste.openstack.org/show/802071/ (this happens when neutron-rpc-server tries to tell Nova that my new VM port is up) I didn't really look further, but I guess so many services are affected. This looks like general to OpenStack, and feels like yet-another-problem-with-eventlet, and looks very similar to this one: https://github.com/eventlet/eventlet/issues/677 even though that's here a Python 3.9 issue, not 3.7. I'd very much appreciate if some Eventlet specialist could look into this problem, because that's beyond my skills. Cheers, Thomas Goirand (zigo)

5 17

[tc] weekly meeting
by Mohammed Naser 03 Feb '21

03 Feb '21

Hi everyone, Here’s the agenda for our weekly TC meeting. It will happen tomorrow (Thursday the 4th) at 1500 UTC in #openstack-tc and I will be your chair. If you can’t attend, please put your name in the “Apologies for Absence” section. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting # ACTIVE INITIATIVES * Follow up on past action items * Audit SIG list and chairs (diablo_rojo) - https://etherpad.opendev.org/p/2021-SIG-Updates - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019994.… * Gate performance and heavy job configs (dansmith) - http://paste.openstack.org/show/jD6kAP9tHk7PZr2nhv8h/ * Dropping lower-constraints testing from all projects (gmann) - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019672.… * Mistral Maintenance (gmann) - Any early step we can take to get help in Mistral maintenance? - http://lists.openstack.org/pipermail/openstack-discuss/2021-February/020137… * Open Reviews - https://review.opendev.org/q/project:openstack/governance+is:open Thanks, Mohammed -- Mohammed Naser VEXXHOST, Inc.

1 0

Integration tests failing on master branch for ppc64le
by aditi Dukle 03 Feb '21

03 Feb '21

3 2

Backup drivers issue with the container parameter
by Gorka Eguileor 03 Feb '21

03 Feb '21

Hi all, In the next Cinder meeting I'll bring a Backup driver issue up for discussion, and this email hopefully provides the necessary context to have a fruitful discussion. The issue is around the `container` optional parameter in backup creation, and its user and administrator unfriendliness. The interpretation of the `container` parameter is driver dependent, and it's being treated as: - A bucket in Google Cloud Storage and the new S3 driver - A container in Swift - A pool in Ceph - A directory in NFS and Posix Currently the only way to prevent cloud users from selecting a different `container` is by restricting what the storage user configured in Cinder backup can do. For Ceph we can make the storage user unable to access any other existing pools, for Swift, GCS, and S3 we can remove permissions to create buckets/containers from the storage user. This achieves the administrator's objective of not allowing them to change the `container`, but cloud users will have a bad experience, because the API will accept the request but the backup will go into `error` state and they won't see any additional information. And this solution is an all or nothing approach, as we cannot allow just some cloud users select the container while preventing others from doing so. For example we may want some cloud users to be able to do backups on a specific RBD pool that is replicated to a remote location. I think we can solve all these issues if we: - Create a policy for accepting the `container` parameter on the API (defaulting to allow for backward compatibility). - Add a new configuration option `backup_container_regex` to control acceptable values for the `container` (defaults to `.*` for backward compatibility). This option would be used by the backup manager (not the drivers themselves) on backup creation, and would result in a user message if the provided container was not empty and failed the regex check. I think this summarizes the situation and my view on the matter. Feedback is welcome here or in the next Cinder meeting. Cheers, Gorka.

2 1

[oslo] Proposing Daniel Bengtsson for Oslo Core
by Herve Beraud 03 Feb '21

03 Feb '21

Hi, Daniel has been working on Oslo for quite some time now and during that time he was a great help on Oslo. I think he would make a good addition to the general Oslo core team. He helped us by proposing patches to fix issues, maintaining stable branches by backporting changes, and managing our releases by assuming parts of the release liaison role. Existing Oslo team members (and anyone else we co-own libraries with) please respond with +1/-1. If there are no objections we'll add him to the ACL soon. :-) Thanks. -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

5 5

[cinder] wallaby R-9 virtual mid-cycle 10 Feb at 14:00 UTC
by Brian Rosmaita 03 Feb '21

03 Feb '21

The poll results are in (9 responses) and there was only one option where everyone could attend (apologies to the two people who marked that "as need be"): DATE: Wednesday, 10 February 2021 TIME: 1400-1600 UTC (2 hours) LOCATION: https://bluejeans.com/3228528973 The meeting will be recorded. Please add topics to the planning etherpad: https://etherpad.opendev.org/p/cinder-wallaby-mid-cycles Note that there will be no cinder weekly meeting on 10 February. cheers, brian

1 0

[infra][kuryr][launchpad]
by Michał Dulko 03 Feb '21

03 Feb '21

Hi, Seems like the bugs integration with Launchpad for Kuryr is broken since the Gerrit upgrade - the patches with Closes-Bug: <id> are no longer picked up by Launchpad and bug statuses are not updated. Is it a known problem or are there any extra steps we need to as a Kuryr team do to reenable the integration? Thanks, Michał

2 2

[baremetal-sig][ironic] Tue Jan 12, 2021, 2pm UTC: 'Multi-Tenancy in Ironic: Of Owners and Lessees'
by Arne Wiebalck 02 Feb '21

02 Feb '21

Dear all, Happy new year! The Bare Metal SIG will continue its monthly meetings and start again on Tue Jan 12, 2021, at 2pm UTC. This time there will be a 10 minute "topic-of-the-day" presentation by Tzu-Mainn Chen (tzumainn) on 'Multi-Tenancy in Ironic: Of Owners and Lessees' So, if you would like to learn how this relatively recent addition to Ironic works, you can find all the details for this meeting on the SIG's etherpad: https://etherpad.opendev.org/p/bare-metal-sig Everyone is welcome, don't miss out! Cheers, Arne

3 5

[kolla][adjutant] Granular quota settings with Adjutant
by Braden, Albert 02 Feb '21

02 Feb '21

We have been experimenting with Adjutant, and it offers a menu of sizes (default small, medium and large). It's easy to add more sizes, but we would like to allow customers to request granular changes. For example, if a customer needs to add 10 cores and 5 instances to his existing quota. This would require some changes to Horizon, and an Adjutant plugin. Is anyone already doing this, or working in that direction? I apologize for the nonsense below. So far I have not been able to stop it from being attached to my external emails. I'm working on it. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

2 1

Strange behaviour of OSC in keystone MFA context
by Taltavull Jean-Francois 02 Feb '21

02 Feb '21

Hello, I'm experiencing the following strange behavior of openstack CLI with os-auth-methods option (most parameters are defined in clouds.yaml): $ openstack token issue --os-auth-type v3multifactor --os-auth-methods password,totp The plugin p could not be found Note that "p" is the first letter of "password". It looks like the option parser handled "password,totp" as a string instead of as a list of strings. Version of openstack CLI is 5.4.0. Any idea ? Thanks ! Jean-François

5 7

[cinder] wallaby R-9 mid-cycle poll
by Brian Rosmaita 02 Feb '21

02 Feb '21

Hello Cinder team and anyone interested in Cinder, The second wallaby mid-cycle meeting will be held during week R-9 (the week of 8 February 2021). It will be 2 hours long. Please indicate your availability on the following poll: https://doodle.com/poll/9vqri7855cab858d Please respond before 21:00 UTC on Tuesday 2 February 2021. thanks, brian

1 1

[tc] weekly meeting
by Mohammed Naser 02 Feb '21

02 Feb '21

Hi everyone, Here’s an update on what happened in the OpenStack TC this week. You can get more information by checking for changes in the openstack/governance repository. # Patches ## Open Reviews - Remove Karbor project team https://review.opendev.org/c/openstack/governance/+/767056 - Create ansible-role-pki repo https://review.opendev.org/c/openstack/governance/+/773383 - Add assert:supports-api-interoperability tag to neutron https://review.opendev.org/c/openstack/governance/+/773090 - Add rbd-iscsi-client to cinder project https://review.opendev.org/c/openstack/governance/+/772597 - Cool-down cycle goal https://review.opendev.org/c/openstack/governance/+/770616 - Define Xena release testing runtime https://review.opendev.org/c/openstack/governance/+/770860 - monasca-log-api & monasca-ceilometer does not make releases https://review.opendev.org/c/openstack/governance/+/771785 - Define 2021 upstream investment opportunities https://review.opendev.org/c/openstack/governance/+/771707 - [manila] add assert:supports-api-interoperability https://review.opendev.org/c/openstack/governance/+/770859 ## Project Updates - Setting Ke Chen as Watcher's PTL https://review.opendev.org/c/openstack/governance/+/770913 - Move openstack-tempest-skiplist to release-management: none https://review.opendev.org/c/openstack/governance/+/771488 - js-openstack-lib does not make releases https://review.opendev.org/c/openstack/governance/+/771789 ## General Changes - Drop openSUSE from commonly tested distro list https://review.opendev.org/c/openstack/governance/+/770855 - Add Resolution of TC stance on the OpenStackClient https://review.opendev.org/c/openstack/governance/+/759904 ## Abandoned Projects - WIP NO MERGE Move os-*-config to Heat project governance https://review.opendev.org/c/openstack/governance/+/770285 # Other Reminders - Our next [TC] Weekly meeting is scheduled for February 4th at 1500 UTC. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, February 3rd, at 2100 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0

LDAP integration with openstack
by Midhunlal Nb 01 Feb '21

01 Feb '21

Hi, I tried to integrate ldap with my openstack. I followed an openstack document and completed the ldap integration,after that I am getting a lot of errors,I am not able to run any openstack commands. -->I followed below document https://docs.openstack.org/keystone/rocky/admin/identity-integrate-with-lda… --->I am getting below errors root@controller:~/client-scripts# openstack image list The request you have made requires authentication. (HTTP 401) (Request-ID: req-bdcde4be-5b62-4454-9084-19324603d0ce) --->so I checked keystone log POST http://controller:5000/v3/auth/tokens 2021-01-29 11:16:36.881 28558 WARNING keystone.auth.plugins.core [req-cf013eff-6e1e-43c4-a6ae-9f91f4fe48f9 - - - - -] Could not find user: neutron.: UserNotFound: Could not find user: neutron. 2021-01-29 11:16:36.881 28558 WARNING keystone.common.wsgi [req-cf013eff-6e1e-43c4-a6ae-9f91f4fe48f9 - - - - -] Authorization failed. The request you have made requires authentication. from192.168.xxx.xx: Unauthorized: The request you have made requires authentication. 2021-01-29 11:17:22.009 28556 INFO keystone.common.wsgi [req-a2a480a7-2ee1-4e11-8a48-dcf93ffb96db - - - - -] POSthttp://controller:5000/v3/auth/tokens 2021-01-29 11:17:22.039 28556 WARNING keystone.auth.plugins.core [req-a2a480a7-2ee1-4e11-8a48-dcf93ffb96db - - - - -] Could not find user: placement.: UserNotFound: Could not find user: placement. Anyone please help me on this issue. Thanks & Regards Midhunlal N B +918921245637

2 1

[magnum][heat] Rolling system upgrades
by Krzysztof Klimonda 01 Feb '21

01 Feb '21

Hi, While testing magnum, a problem of upgrades came up - while work has been done to make kubernetes upgrades without interruption, operating system upgrades seem to be handled only partially. According to the documentation, two ways of upgrading system are available: - via specifying ostree_commit or ostree_remote labels in the cluster template used for upgrade - via specifying a new image in the cluster template used for upgrade The first one is specific to Fedora Atomic (and, while probably untested, seems to be mostly working with Fedora CoreOS) but it has some drawbacks. Firstly, due to base image staying the same we require this image for the life of the cluster, even if OS has already been upgraded. Secondly, using this method only upgrades existing instances and new instances (spawned via scaling cluster up) will not be upgraded. Thirdly, even if that is fixed I'm worried that at some point upgrading from old base image to some future ostree snapshot will fail (there is also cost associated with diff growing with each release). The second method, of specifying a new image in the cluster template used for upgrade, comes with an ugly warning about nodes not being drained properly before server rebuild (and it actually doesn't seem to be working anyway as the new image parameter is not being passed to the heat template on upgrade). This does however seem like a more valid approach in general. I'm not that familar with Heat, and the documentation of various OS::Heat::Software* resources seems inconclusive, but is there no way of executing some code before instance is rebuilt? If not, how are other projects and users handling this in general? -- Krzysztof Klimonda kklimonda(a)syntaxhighlighted.com

2 3

[neutron] bug deputy report for week of 2021-01-25
by Rodolfo Alonso Hernandez 01 Feb '21

01 Feb '21

Hello Neutrinos: This is the bug report from 2021-01-25 to 2021-01-31. Critical: - https://bugs.launchpad.net/neutron/+bug/1913718: “Enforcer perform deprecation logic unnecessarily”. Assigned to Slawek. High: - https://bugs.launchpad.net/neutron/+bug/1913401: “Timeout during creation of interface in functional tests”. Unassigned - https://bugs.launchpad.net/neutron/+bug/1913572: “[CI] Error in "tox-docs" job due to an error in library amqp”. Assigned to Rodolfo. - https://bugs.launchpad.net/neutron/+bug/1914037: “scenario tests tempest.scenario.test_network_v6.TestGettingAddress fails”. Unassigned. Medium: - https://bugs.launchpad.net/neutron/+bug/1913297: “Network creation fails when enable_security_group = False with error "Unknown quota resources ['security_group_rule’]”. Assigned to Slawek - https://bugs.launchpad.net/neutron/+bug/1913269: “DHCP entries for floating IP ports are not needed really”. Assigned to Slawek. - https://bugs.launchpad.net/neutron/+bug/1913723: “[DHCP] Race condition during port processing events in DHCP agent”. Assigned to Rodolfo. Low: - https://bugs.launchpad.net/neutron/+bug/1913280: “Keepalived unit tests don't mocks properly _is_keepalived_use_no_track_supported() function”. Assigned to Slawek - https://bugs.launchpad.net/neutron/+bug/1913180: “QoS policy with minimum bandwidth rules can be assigned to a VXLAN network if the network doesn't have any ports”. Unassigned. - https://bugs.launchpad.net/neutron/+bug/1913664: “[CI] neutron multinode jobs does not run neutron_tempest_plugin scenario cases”. Assigned to Mamatisa. Incomplete: - https://bugs.launchpad.net/neutron/+bug/1913038: “Port remains in status DOWN when fields "Device ID" and "Device owner" are filled from dashboard”. Undecided/unconfirmed: - https://bugs.launchpad.net/neutron/+bug/1913621: “Permant ARP entries not added to DVR qrouter when connected to two Networks”. - https://bugs.launchpad.net/neutron/+bug/1913646: “DVR router ARP traffic broken for networks containing multiple subnets”. Probably a duplicate of LP#1913621. Regards.

1 0

Mistral Maintenance
by Renat Akhmerov 01 Feb '21

01 Feb '21

Hi, Just for those who don’t know me, I’m Renat Akhmerov who originally started the project called Mistral (Workflow Service) and I’ve been the PTL of the project most of the time. The project was started in 2013 when I was at Mirantis, then in 2016 I moved to Nokia and continued to work on the project. My activities at Nokia were related with Mistral on 90%. On 25th of January I joined the company called Tailify where I won’t be contributing to Mistral officially anymore. On that note, I want to say that for now I’ll try to provide minimally required maintenance (reviews, releases, CI fixes) and consulting but I don’t think I’ll continue to be the major contributor of the project. And, most likely, I’ll stop working on the project completely at some point. Don’t know when though, it depends on my new load, my capacity and desire. I still care about the project and want it to live further. So, if anybody wants to step up as the PTL or just take over the development, it would be great and I could provide all the required help and guidance. In this case, I won’t be announcing my candidacy in the upcoming election. Thanks Renat Akhmerov @Tailify

3 5

How to get volume quota usage
by Braden, Albert 01 Feb '21

01 Feb '21

I'm auditing quota usage for all of our projects, and checking them all in Horizon would be a lot of work so I wrote a little script to pull them all and build a spreadsheet. I can get network and compute usage with "openstack quota list -detail" but when I try to get volume usage it demurs: (openstack) [root@chrnc-area51-build-01 openstack]# openstack quota list --detail --volume --project test Volume service doesn't provide detailed quota information I can see the volume quota usage in Horizon. How can I get it on the CLI? I apologize for the nonsense below. So far I have not been able to stop it from being attached to my external emails. I'm working on it. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

2 2

[cinder] kioxia ready for driver and connector reviews
by Zohar Mamedov 01 Feb '21

01 Feb '21

Hi Cinder team, The Kioxia Kumoscale NVMeOF driver is ready for reviews. Gate tests are passing and "KIOXIA CI" is leaving comments on review threads. Here is an example of last response it posted: https://review.opendev.org/c/openstack/cinder/+/765304/2#message-6ca11d3b3c… All changes that the CI responded to can be found here: http://104.254.65.37/ (each will also have a gerrit_event.json which will have a ['change']['url'] with a link to the review page) Part of this contribution is a major expansion to the nvmeof connector in os-brick. This was initially discussed in the PTG meetings, and mentioned in some follow up IRC meetings. The main change is adding (optional) support for mdraid replication of nvmeof volumes. Target connection sharing is also implemented (removing the need for a separate nvmeof target per volume.) Additionally, a concurrency / race condition issue in the existing nvmeof connector (nvmeof.py line 120) is resolved as part of these changes. Though this change is a big rework, it is in line with the spec, which had an in depth review and was approved: https://review.opendev.org/c/openstack/cinder-specs/+/766730 We are dedicated to addressing possible regressions, however, following a review of existing CIs using or testing the nvmeof connector, none were found to be using it. All suspected CIs seem to pass or be using a different connector. This is to the best of our knowledge, we suspect that Kioxia may be the first CI to be testing with NVMeOF protocol and driver. If we missed anything, please let us know with a review comment. Kioxia Kumoscale driver review: https://review.opendev.org/c/openstack/cinder/+/768574 NVMeOF connector review: https://review.opendev.org/c/openstack/os-brick/+/768575 Thank you! Zohar

1 0

[ironic] Reducing EM stable branch testing
by Julia Kreger 01 Feb '21

01 Feb '21

Greetings everyone, Last week, during our Wallaby mid-cycle[0] meeting, we discussed removing testing on older (extended, and approaching extended) maintenance branches. In part because of the number of integration jobs which we have and the overhead being so high to keep them operational at this point in time across every repository we use. The consensus we reached was to begin peeling back fragile and resource intensive jobs on these older branches. Mainly "multinode" and grenade type jobs where we risk running the test virtual machine out of memory. We may opt to remove additional older integration jobs and minimize the scenarios as seems relevant, but we will approach that when that time comes. Please let us know if you have any questions or concerns. Thanks, Julia [0]: https://etherpad.opendev.org/p/ironic-wallaby-midcycle

1 0

Failed to Install Ceilometer using devstack pike
by Nitish Goel 01 Feb '21

01 Feb '21

Hi , Please help.! I try to install heat ,ceilometer and aodh openstack using the devstack pike version. But getting the below error: *no matching distribution found for oslo.log>=4.3.0* pip version 9.x python version 2.7 Next Attempt: Upgraded the pip to 20.x but still gets the same error. Next Attempt: *Updated the python 3.6(pip with the old version) but then gets the below error:* Traceback (most recent call last): File "/opt/stack/devstack/tools/outfilter.py", line 85, in <module> sys.exit(main()) File "/opt/stack/devstack/tools/outfilter.py", line 53, in main outfile = open(opts.outfile, 'a', 0) ValueError: can't have unbuffered text I/O Next Attempt: Initially heat was installed successfully, but after the above errors from ceilometer and aodh, I commented them and executed stack.sh but now heat installation also fails with below error: *(pip with 9.x and python 2.7)* CRITICAL keystone [None req-ddd57555-0e66-4e94-8349-044e79573d01 None None] Unhandled error: TypeError: __init__() got an unexpected keyword argument 'encoding' 2021-02-01 11:43:37.083 | ERROR keystone Traceback (most recent call last): 2021-02-01 11:43:37.083 | ERROR keystone File "/usr/local/bin/keystone-manage", line 10, in <module> 2021-02-01 11:43:37.083 | ERROR keystone sys.exit(main()) 2021-02-01 11:43:37.083 | ERROR keystone File "/opt/stack/keystone/keystone/cmd/manage.py", line 45, in main 2021-02-01 11:43:37.083 | ERROR keystone cli.main(argv=sys.argv, config_files=config_files) 2021-02-01 11:43:37.083 | ERROR keystone File "/opt/stack/keystone/keystone/cmd/cli.py", line 1331, in main 2021-02-01 11:43:37.083 | ERROR keystone CONF.command.cmd_class.main() 2021-02-01 11:43:37.083 | ERROR keystone File "/opt/stack/keystone/keystone/cmd/cli.py", line 380, in main 2021-02-01 11:43:37.083 | ERROR keystone klass.do_bootstrap() 2021-02-01 11:43:37.083 | ERROR keystone File "/opt/stack/keystone/keystone/cmd/cli.py", line 190, in do_bootstrap 2021-02-01 11:43:37.083 | ERROR keystone domain=default_domain) 2021-02-01 11:43:37.083 | ERROR keystone File "/opt/stack/keystone/keystone/common/manager.py", line 110, in wrapped 2021-02-01 11:43:37.084 | ERROR keystone __ret_val = __f(*args, **kwargs) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/resource/core.py", line 723, in create_domain 2021-02-01 11:43:37.084 | ERROR keystone domain_id, project_from_domain, initiator) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/common/manager.py", line 110, in wrapped 2021-02-01 11:43:37.084 | ERROR keystone __ret_val = __f(*args, **kwargs) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/resource/core.py", line 221, in create_project 2021-02-01 11:43:37.084 | ERROR keystone ret['domain_id']) 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/cache/region.py", line 1239, in set_ 2021-02-01 11:43:37.084 | ERROR keystone self.set(key, value) 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/cache/region.py", line 983, in set 2021-02-01 11:43:37.084 | ERROR keystone key = self.key_mangler(key) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/common/cache/core.py", line 87, in key_mangler 2021-02-01 11:43:37.084 | ERROR keystone key = '%s:%s' % (key, invalidation_manager.region_id) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/common/cache/core.py", line 45, in region_id 2021-02-01 11:43:37.084 | ERROR keystone self._region_key, self._generate_new_id, expiration_time=-1) 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/cache/region.py", line 833, in get_or_create 2021-02-01 11:43:37.084 | ERROR keystone async_creator) as value: 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/lock.py", line 154, in __enter__ 2021-02-01 11:43:37.084 | ERROR keystone return self._enter() 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/lock.py", line 87, in _enter 2021-02-01 11:43:37.084 | ERROR keystone value = value_fn() 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/dogpile/cache/region.py", line 788, in get_value 2021-02-01 11:43:37.084 | ERROR keystone value = self.backend.get(key) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/common/cache/_context_cache.py", line 72, in get 2021-02-01 11:43:37.084 | ERROR keystone value = self._get_local_cache(key) 2021-02-01 11:43:37.084 | ERROR keystone File "/opt/stack/keystone/keystone/common/cache/_context_cache.py", line 57, in _get_local_cache 2021-02-01 11:43:37.084 | ERROR keystone value = msgpackutils.loads(value) 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/oslo_serialization/msgpackutils.py", line 487, in loads 2021-02-01 11:43:37.084 | ERROR keystone return msgpack.unpackb(s, ext_hook=ext_hook, encoding='utf-8') 2021-02-01 11:43:37.084 | ERROR keystone File "/usr/local/lib/python2.7/dist-packages/msgpack/fallback.py", line 126, in unpackb 2021-02-01 11:43:37.084 | ERROR keystone unpacker = Unpacker(None, max_buffer_size=len(packed), **kwargs) 2021-02-01 11:43:37.084 | ERROR keystone TypeError: __init__() got an unexpected keyword argument 'encoding' 2021-02-01 11:43:37.084 | ERROR keystone Thanks, Nitish Goel

1 0

[Diversity] Diversity &Inclusion WG Meeting reminder Amy Marrich <amy@demarco.com> Mon, Jan 11, 7:49 AM to foundation, openstack-discuss, kata-dev, starlingx-discuss, airship-discuss, zuul-discuss The Diversity & Inclusion WG invites members of all OSF projects to our meeting today, at 17:00 UTC in the #openstack-diversity channel. The agenda can be found at https://etherpad.openstack.org/p/diversity-wg-agenda. Please feel free to add any other topics you wish to discuss at the meeting. Thanks, Amy (spotz)
by Amy Marrich 31 Jan '21

31 Jan '21

The Diversity & Inclusion WG invites members of all OSF projects to our meeting tomorrow, at 17:00 UTC in the #openstack-diversity channel. The agenda can be found at https://etherpad.openstack.org/p/diversity-wg-agenda. Please feel free to add any other topics you wish to discuss at the meeting. Thanks, Amy (spotz)

1 0

[DHCP][Provider Network] Instances get IP from external DHCP server
by dangerzone ar 31 Jan '21

31 Jan '21

Hi, appreciate some advice on how instances in openstack get ip from external DHCP server. For example instance is attached to port eth1 (physical port) and this port is connected to home/office lan port and requests dhcp ip. How this can be achieved. ***User don't know the dhcp ip range/gw/dns that will be provided by the dhcp sever to that instance...instance just attach to eth1 and request ip.*** Similar like our pc/notebook request dhcp ip via wifi or lan port. How to establish this in openstack. Please advise and help me. Thank you

3 5

Advise Request
by Karera Tony 30 Jan '21

30 Jan '21

Dear Team, I deployed the Openstack Ussuri version and everything was working fine with the small cirros Image since its a test environment for now. I started facing an issue when I uploaded a bigger image (Ubuntu 16.04 Xenialand Ubuntu 18.04 Biomic), When I tried to create an instance using any of those images, I got the error below. Traceback (most recent call last): File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/compute/manager.py", line 1942, in _prep_block_device wait_func=self._await_block_device_map_created) File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/block_device.py", line 874, in attach_block_devices _log_and_attach(device) File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/block_device.py", line 871, in _log_and_attach bdm.attach(*attach_args, **attach_kwargs) File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/block_device.py", line 771, in attach wait_func=wait_func, image_id=self.image_id) File "/var/lib/kolla/venv/lib/python3.6/site-packages/nova/virt/block_device.py", line 381, in _create_volume availability_zone=av_zone, Can any one advise on how to proceed ? Regards Tony Karera

1 0

[neutron] Secure RBAC api performance regression
by Slawek Kaplonski 29 Jan '21

29 Jan '21

Hi, In Neutron we are merging more and more patches related to the secure rbac policies [1]. Recently we noticed that our neutron-rally-task job is failing very often [2]. I did some tests and here is what were my results: * on latest neutron, with about 12 patches related to secure rbac merged - list of 4k ports took about 1m 40s: $ time neutron port-list | wc -l neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead. 4044 real 1m41,644s user 0m0,926s sys 0m0,087s * same test with all those patches reverted - and it took 8 seconds: $ sudo systemctl restart devstack@q-svc; sleep 5; time neutron port-list | wc -l neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead. 4044 real 0m8,131s user 0m0,907s sys 0m0,120s After a bit of digging I found out that most of the slowdown came from calls of the method self._handle_deprecated_rule(default) in [3]. When I commented that one line I had results same like without secure-rbac patches: $ sudo systemctl restart devstack@q-svc; sleep 5; time neutron port-list | wc -l neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead. 4044 real 0m7,875s user 0m0,931s sys 0m0,087s @Lance, can You maybe take a look at it and help me understand if we are doing something wrong with those new rules in Neutron? Or maybe there is a bug in oslo_policy? [1] https://review.opendev.org/q/topic:secure-rbac+project:openstack/neutron [2] https://bugs.launchpad.net/neutron/+bug/1913718 [3] https://github.com/openstack/oslo.policy/blob/e103baa002e54303b08630c436dfc… -- Slawek Kaplonski Principal Software Engineer Red Hat

2 1

[tc][all] Encouraging projects to apply for tag 'assert:supports-api-interoperability'
by Ghanshyam Mann 29 Jan '21

29 Jan '21

Hello Everyone, TC defined a tag for API interoperability (cover both stable and compatible APIs) called 'assert:supports-api-interoperability' which assert on API won’t break any users when they upgrade a cloud or start using their code on a new OpenStack cloud. Basically, Projects will not change (or remove) an API in a way that will break existing users of an API. We have updated the tag documentation to clarify its definition and requirements. If your projects follow the API interoperability guidelines[1] and some API versioning mechanism that does not need to be microversion then you should start thinking to apply for this tag. The complete requirement can be found here[2]. Currently, only nova has this tag but I am sure many projects are eligible for this, and TC encourage them to apply for this. [1] https://specs.openstack.org/openstack/api-wg/guidelines/api_interoperabilit… [2] https://governance.openstack.org/tc/reference/tags/assert_supports-api-inte… -gmann

2 3

[Release-job-failures] os-collect-config 11.0.2 and tripleo-ipsec 9.3.1
by Thierry Carrez 29 Jan '21

29 Jan '21

We had two release jobs failures around TripleO and stable/ussuri: > - openstack-upload-github-mirror https://zuul.opendev.org/t/openstack/build/cb4de2810bd147e2bf1cd98d6a1160fa : SUCCESS in 46s > - release-openstack-python https://zuul.opendev.org/t/openstack/build/fb61c0814f114a2ea0c7298378e10e5f : FAILURE in 3m 07s > - announce-release https://zuul.opendev.org/t/openstack/build/None : SKIPPED > - propose-update-constraints https://zuul.opendev.org/t/openstack/build/None : SKIPPED and > - openstack-upload-github-mirror https://zuul.opendev.org/t/openstack/build/fad34ae84b9d4a8c982ca4f75c01f0c9 : SUCCESS in 58s > - release-openstack-python https://zuul.opendev.org/t/openstack/build/0edc8da3c58842ed85b826f56153cde3 : FAILURE in 3m 25s > - announce-release https://zuul.opendev.org/t/openstack/build/None : SKIPPED > - propose-update-constraints https://zuul.opendev.org/t/openstack/build/None : SKIPPED In both cases those jobs are coming from post-processing of release tags being pushed as a result of merging https://review.opendev.org/c/openstack/releases/+/772047 The error is that os-collect-config 11.0.0 and tripleo-ipsec 9.3.0 both did not have a stable/ussuri branch cut around ussuri release time at https://review.opendev.org/c/openstack/releases/+/728537 (probably escaped our watch as they are cycle-trailing). os-collect-config 11.0.1 was released on master about 3 months ago, which worked because 12.0.0 (victoria) was not cut yet. But now that victoria is cut, 11.0.2 (and tripleo-ipsec 9.3.1) triggered an error. ----11.0.0------11.0.1-------12.0.0/11.0.2/13.0.0-------master \ -----stable/victoria ----9.3.0------10.0.0/11.0.0/9.3.1-----master \ ----- stable/victoria Given that os-collect-config 12.0.0/11.0.2/13.0.0 are the same commit and tripleo-ipsec 10.0.0/11.0.0/9.3.1 are the same commit, this might be solved by just cutting stable/ussuri on that same commit and reenqueuing the tag references in Zuul to trigger the jobs. I proposed https://review.opendev.org/c/openstack/releases/+/772995 to that effect. -- Thierry Carrez (ttx)

2 1

[rdo][ussuri][tripleo] use rsyslog by default for all OSP components and send them to undercloud
by Ruslanas Gžibovskis 29 Jan '21

29 Jan '21

Hi all, I would like to configure, during deployment, all OSP services save logs over rsyslog, not directly writing to files. I know OSP services support such. In most cases, services/modules write into files directly. Is there any TripleO option to set it all to logging over system logger? Also is there possibility, to send logs to centralised server, into undercloud, if to be precise? From there I want to send it to elastic, using rsyslog or send it to other log parser/analyser/storage. Have anyone met such articles/howtos/docs I could refer to tweak my config? -- Ruslanas Gžibovskis +370 6030 7030

2 2

Ussuri Trove trovestack problem
by Diaz, Santiago Miguel 28 Jan '21

28 Jan '21

Hi. Im new in Openstack. When I try to create Trove guest image with the next command ./trovestack build-image mariadb ubuntu xenial true ubuntu exit 1 obtain. Reading the logs I found: 2021-01-28 13:30:13.217 | [error] The following package is needed by the script, but not installed: 2021-01-28 13:30:13.218 | apt-transport-https 2021-01-28 13:30:13.218 | Please install and rerun the script. I resolved it changing then next file: /trove/integration/scripts/files/elements/ubuntu-guest/pre-install.d/04-baseline-tools - apt-get --allow-unauthenticated install -y language-pack-en python-software-properties software-properties-common + apt-get --allow-unauthenticated install -y language-pack-en python-software-properties software-properties-common apt-transport-https I hope it helps AVISO LEGAL: El presente correo electrónico y la información contenida en el mismo, es información privada y confidencial, está dirigida únicamente a su destinatario y no puede ser revelada a terceros, ni utilizada inapropiadamente en interés del destinatario. Excepto que se haya establecido expresamente de otra forma, éste correo electrónico y la mencionada información privada y confidencial no constituye una oferta, ni una promesa, ni una propuesta y no será interpretado como aceptación, ni como una tratativa pre-contractual, acuerdo parcial, contrato preliminar y/o pre-contrato, ni como un compromiso vinculante y/o declaración de voluntad oficial de TELECOM ARGENTINA S.A. Si Usted no es el destinatario original de éste mensaje y por ese medio pudo acceder a dicha información, por favor, elimine el mensaje. La distribución o copia de este mensaje esta estrictamente prohibida. La transmisión de e-mails no garantiza que el correo electrónico sea seguro o libre de error. Por consiguiente, no manifestamos que esta información sea completa o precisa. Toda información está sujeta a alterarse sin previo aviso. This email and the information contained herein are proprietary and confidential, and intended for the recipient only and cannot be disclosed to third parties or used inappropriately in the interest of the recipient. Except it has been expressly stated otherwise, the email and said private and confidential information are not an offer or promise, or a proposal and will not be construed as acceptance or as a pre-contractual negotiation, partial agreement, preliminary contract and / or pre-contract or binding commitment and/or an official statement of intent of TELECOM ARGENTINA S.A. If you are not the intended recipient of this message and thereby gained access to such information, please remove the message. Distribution or copying of this message is strictly prohibited. Transmission of e-mails does not guarantee that e-mail is safe or free from error. Therefore, we do not represent that this information is complete or accurate. All information is subject to change without notice.

2 1

[kolla][mariadb] failed to start a cluster
by Tony Liu 28 Jan '21

28 Jan '21

Hi, When running kolla-ansible to deploy 3 controller nodes (Ussuri), mariadb on node-1 started fine, but when start mariadb on node-2 and node-3 to join node-1, node-1 became nodor/desync and node-2 and node-3 complained "Member 2.0 (os-control-2) requested state transfer from '*any*', but it is impossible to select State Transfer donor: Resource temporarily unavailable". Ansible failed at "RUNNING HANDLER [mariadb : Wait for MariaDB service port liveness]" when timeout. What could be wrong here? Thanks! Tony

1 0

[tripleo] next irc meeting Tuesday Feb 02 @ 1400 UTC in #tripleo
by Marios Andreou 28 Jan '21

28 Jan '21

Reminder that the next TripleO irc meeting is: ** Tuesday 02 February at 1400 UTC in #tripleo ** ** https://wiki.openstack.org/wiki/Meetings/TripleO ** ** https://etherpad.opendev.org/p/tripleo-meeting-items ** Please add anything you want to hilight at https://etherpad.opendev.org/p/tripleo-meeting-items This can include recently completed things, ongoing review requests, blocking issues, or anything else tripleo you'd like to share. Our last meeting was on Jan 19 - you can find the logs there http://eavesdrop.openstack.org/meetings/tripleo/2021/tripleo.2021-01-19-14.… Hope you can make it on Tuesday, thanks, marios

1 0

2020 Open Infrastructure Foundation Annual Report
by Kendall Nelson 28 Jan '21

28 Jan '21

Hello Everyone :) Despite being a very different year than most, the Open Infrastructure community, which has over 110,000 community members, made it a productive and successful year. One of the biggest milestones that happened in the global community last year was that OpenStack, one of the top three most active open source projects with 15 million cores in production, marked its 10th anniversary in 2020. The Open Infrastructure Foundation would like to extend a huge thanks to the global community for all of the work that went into 2020 and is continuing in 2021 to help people build and operate open infrastructure. Check out the OpenStack community’s achievements in 2020 from the OpenInfra Foundation Annual Report[1] and join us <https://openinfra.dev/join/> to build the next decade of open infrastructure! -Kendall Nelson (diablo_rojo) [1] https://www.openstack.org/annual-reports/2020-openstack-foundation-annual-r…

1 0

Integration tests failing on ppc64le master branch
by aditi Dukle 28 Jan '21

28 Jan '21

2 1

[all] Proposed Xena cycle schedule
by Herve Beraud 28 Jan '21

28 Jan '21

Hey everyone, The Wallaby cycle is going by fast, and it's already time to start planning some of the early things for the Xena release. One of the first steps for that is actually deciding on the release schedule. Typically we have done this based on when the next Summit event was planned to take place. Due to several reasons, we don't have a date yet for the second 2021 event. The current thinking is it will likely take place in October (nothing is set, just an educated guess, so please don't use that for any other planning). So for the sake of figuring out the release schedule, we are proposing two schedules, one targeting a release date in mid of september, one targeting a release date in early October. Hopefully this will then align well with event plans. I have two proposed release schedule up for review here: - https://review.opendev.org/c/openstack/releases/+/772367 (23w) - https://review.opendev.org/c/openstack/releases/+/772357 (25w) Please feel free to comment on the patch if you see any major issues that we may have not considered. Thanks! -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 1

[neutron] Drivers meeting agenda - 29.01.2021
by Slawek Kaplonski 28 Jan '21

28 Jan '21

Hi, Agenda for tomorrow's drivers meeting is available at [1]. We have 2 things to discuss: * 1 RFE - [RFE] [QoS] add qos rule type packet per second (pps) [2] * 1 On demand topic - Do we want to apply for tag 'assert:supports-api-interoperability' - see [3] for details. See You tomorrow on the meeting. [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers#Agenda [2] https://bugs.launchpad.net/neutron/+bug/1912460 [3] http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019505… -- Slawek Kaplonski Principal Software Engineer Red Hat

2 2

Re: [Release-job-failures] Release of openstack/monasca-tempest-plugin for ref refs/tags/2.2.0 failed
by Herve Beraud 28 Jan '21

28 Jan '21

Hello monasca team, FYI a release failure happened on monasca-tempest-plugin within the job publish-monasca-tempest-plugin-docker-image. This build was triggered by https://review.opendev.org/c/openstack/releases/+/768551 (the Wallaby part). A new incompatibility in requirements was found by pip's new resolver: > pykafka 2.8.0 has requirement kazoo==2.5.0, but you'll have kazoo 2.8.0 which is incompatible. (c.f https://zuul.opendev.org/t/openstack/build/aba1acc623e74cf08e82ffc4d73134aa… ) I didn't find a trace of these requirements on your repo so I think they are pulled/resolved from/for underlying libraries. After that the job fails to push the "latest" docker tag because the tag is not found, I think it's a side effect of the previous error. (c.f https://zuul.opendev.org/t/openstack/build/aba1acc623e74cf08e82ffc4d73134aa… ) Let us know if we can help you, The Release Team. Le lun. 18 janv. 2021 à 23:31, <zuul(a)openstack.org> a écrit : > Build failed. > > - openstack-upload-github-mirror > https://zuul.opendev.org/t/openstack/build/8dd9a4fce3bc4ae2a32134b7d7fec5b5 > : SUCCESS in 52s > - release-openstack-python > https://zuul.opendev.org/t/openstack/build/ff7c8136563444df9c565f07f618c559 > : SUCCESS in 3m 44s > - announce-release > https://zuul.opendev.org/t/openstack/build/78731c6e0948490d82e1e2d14eb67857 > : SUCCESS in 3m 42s > - propose-update-constraints > https://zuul.opendev.org/t/openstack/build/3eab7a3209a84a33b8d7b69e41e185cb > : SUCCESS in 2m 49s > - publish-monasca-tempest-plugin-docker-image > https://zuul.opendev.org/t/openstack/build/aba1acc623e74cf08e82ffc4d73134aa > : POST_FAILURE in 8m 19s > > _______________________________________________ > Release-job-failures mailing list > Release-job-failures(a)lists.openstack.org > http://lists.openstack.org/cgi-bin/mailman/listinfo/release-job-failures > -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

4 5

[osc-placement] placement_api_version in clouds.yaml not recognized
by jayaditya gupta 28 Jan '21

28 Jan '21

Hello it seems during plugin creation placement_api_version is not recognized by the osc-placement plugin. I have looked at other plugins too but can't seem to understand where the clouds.yaml file is loaded or referenced to get the desired value. Story : https://storyboard.openstack.org/#!/story/2008553 Would be helpful if i can get some pointers Thanks

1 0

[tc] weekly meeting
by Mohammed Naser 27 Jan '21

27 Jan '21

Hi everyone, Here’s the agenda for our weekly TC meeting. It will happen tomorrow (Thursday the 28th) at 1500 UTC in #openstack-tc and I will be your chair. If you can’t attend, please put your name in the “Apologies for Absence” section. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting # ACTIVE INITIATIVES * Follow up on past action items * Audit SIG list and chairs (diablo_rojo) - https://etherpad.opendev.org/p/2021-SIG-Updates - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019994.… * Gate performance and heavy job configs (dansmith) - http://paste.openstack.org/show/jD6kAP9tHk7PZr2nhv8h/ * Dropping lower-constraints testing from all projects (gmann) - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019672.… * Open Reviews - https://review.opendev.org/q/project:openstack/governance+is:open Thank you, Mohammed -- Mohammed Naser VEXXHOST, Inc.

1 0

[cinder] s3 backup driver status
by Brian Rosmaita 27 Jan '21

27 Jan '21

(I think there are time zone issues preventing the team working on the driver from attending the cinder weekly meeting, so I'm sending this update to the mailing list.) We discussed the proposed s3 backup driver [0] at today's cinder meeting. The code is looking good and the developers have been responsive to comments and doing quick revisions. The patch has one +2 and looks very close to being approved. One thing that's missing at this point is a comment on the review from one of the developers that they've deployed it with cinder and it works, and under what conditions it's been tested (that is, actually with S3, or only with the swift proxy). So please add such a comment to the review. This will allow us to merge the backup driver while you continue to work on getting the CI running [1]. We haven't required CI on backup drivers previously, so the cinder team has taken the position that lack of CI is not a reason to hold up the backup driver from merging. I want to stress, however, that we are excited that you are working on getting CI for the driver. The CI is looking close to completion as well (the holdup at the moment seems to be a problem with the swift proxy and recent versions of the boto library). The devstack support for this effort [2] is also looking good. [0] https://review.opendev.org/c/openstack/cinder/+/746561 [1] https://review.opendev.org/c/openstack/cinder-tempest-plugin/+/772085 [2] https://review.opendev.org/c/openstack/devstack/+/770171

1 0

[infra][release] delete old EOL'd stable branches
by Előd Illés 27 Jan '21

27 Jan '21

Hi Infra Team! In October there was a discussion at Release Team meeting [1] about what can we do with the old, already EOL'd but not yet deleted branches (this is possible since with the Extended Maintenance process the general/"mass" EOL'ing was stopped and tagging a project branch EOL does not delete the branch anymore). Related to this, I would like to ask two things: 1. I've used the list_eol_stale_branches.sh [2] script to get the list of such not-yet-deleted branches for Ocata [3]. They are all tagged with 'ocata-eol', but stable/ocata branch still exists for them. Could you please delete these? [3] 2. On the Release Team meeting [1] we were hinted that with the newer version of gerrit (that was installed at the end of November) some automation is possible through gerrit API in the future. Can I get some help about where should I start with the automation? Which repository should I look, where can the deletion being triggered ("similarly like branch creation")? Thanks in advance, Előd [1] http://eavesdrop.openstack.org/meetings/releaseteam/2020/releaseteam.2020-1… [2] https://opendev.org/openstack/releases/src/commit/eb381492da3f7c826c35b9f14… [3] http://paste.openstack.org/show/801992/

4 9

[largescale-sig] Next meeting: January 27, 15utc
by Thierry Carrez 27 Jan '21

27 Jan '21

Hi everyone, Our next Large Scale SIG meeting will be this Wednesday in #openstack-meeting-3 on IRC, at 15UTC. You can doublecheck how it translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20210127T15 Our main topic will be to review progress and blockers on improving the documentation of various stages of our Scaling journey[1]. [1] https://wiki.openstack.org/wiki/Large_Scale_SIG Feel free to add other topics to our agenda at: https://etherpad.openstack.org/p/large-scale-sig-meeting Talk to you all later, -- Thierry Carrez

1 1

Secure RBAC work
by Lance Bragstad 27 Jan '21

27 Jan '21

Hey everyone, I wanted to take an opportunity to clarify some work we have been doing upstream, specifically modifying the default policies across projects. These changes are the next phase of an initiative that’s been underway since Queens to fix some long-standing security concerns in OpenStack [0]. For context, we have been gradually improving policy enforcement for years. We started by improving policy formats, registering default policies into code [1], providing better documentation for policy writers, implementing necessary identity concepts in keystone [2], developing support for those concepts in libraries [3][4][5][6][7][8], and consuming all of those changes to provide secure default policies in a way operators can consume and roll out to their users [9][10]. All of this work is in line with some high-level documentation we started writing about three years ago [11][12][13]. There are a handful of services that have implemented the goals that define secure RBAC by default, but a community-wide goal is still out-of-reach. To help with that, the community formed a pop-up team with a focused objective and disbanding criteria [14]. The work we currently have in progress [15] is an attempt to start applying what we have learned from existing implementations to other projects. The hope is that we can complete the work for even more projects in Wallaby. Most deployers looking for this functionality won't be able to use it effectively until all services in their deployment support it. I hope this helps clarify or explain the patches being proposed. As always, I'm happy to elaborate on specific concerns if folks have them. Thanks, Lance [0] https://bugs.launchpad.net/keystone/+bug/968696/ [1] https://governance.openstack.org/tc/goals/selected/queens/policy-in-code.ht… [2] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/… [3] https://review.opendev.org/c/openstack/keystoneauth/+/529665 [4] https://review.opendev.org/c/openstack/python-keystoneclient/+/524415 [5] https://review.opendev.org/c/openstack/oslo.context/+/530509 [6] https://review.opendev.org/c/openstack/keystonemiddleware/+/564072 [7] https://review.opendev.org/c/openstack/oslo.policy/+/578995 [8] https://review.opendev.org/q/topic:%22system-scope%22+(status:open%20OR%20s… [9] https://review.opendev.org/q/status:merged+topic:bp/policy-defaults-refresh… [10] https://review.opendev.org/q/topic:%22implement-default-roles%22+(status:op… [11] https://specs.openstack.org/openstack/keystone-specs/specs/keystone/ongoing… [12] https://docs.openstack.org/keystone/latest/admin/service-api-protection.html [13] https://docs.openstack.org/keystone/latest/contributor/services.html#author… [14] https://governance.openstack.org/tc/reference/popup-teams.html#secure-defau… [15] https://review.opendev.org/q/topic:%2522secure-rbac%2522+status:open

6 10

RE: [EXTERNAL] Re: [kolla][keystone] Another keycloak issue
by Braden, Albert 27 Jan '21

27 Jan '21

Another problem I'm encountering with keycloak is that the keycloak users can't login on the command line. I created user test2 via Keycloak and test3 via CLI. They have identical roles on the admin domain: (openstack) [root@chrnc-area51-build-01 ~]# os role assignment list --user test2 +----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+--------+-----------+ | 406a5f1cd92d45b5b3d54979235e896c | f4287b6082b8f36048d052eaa3d35facb94e5eff598d59d2aee68252ddb13339 | | 15c32af517334e28a9427809a9fc4805 | | | False | +----------------------------------+------------------------------------------------------------------+-------+----------------------------------+--------+--------+-----------+ (openstack) [root@chrnc-area51-build-01 ~]# os role assignment list --user test3 +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ | 406a5f1cd92d45b5b3d54979235e896c | 06a5f28d061f4d42b3bf64df378338fd | | 15c32af517334e28a9427809a9fc4805 | | | False | +----------------------------------+----------------------------------+-------+----------------------------------+--------+--------+-----------+ I made identical env-setting "rc" files with only the username changed. Test3 logs in successfully but test2 fails: (openstack) [root@chrnc-area51-build-01 ~]# . ./test2-openrc.sh (openstack) [root@chrnc-area51-build-01 ~]# openstack server list The request you have made requires authentication. (HTTP 401) (Request-ID: req-ad7ee855-df98-434a-9afc-89f64a7addd1) (openstack) [root@chrnc-area51-build-01 ~]# . ./test3-openrc.sh (openstack) [root@chrnc-area51-build-01 ~]# openstack server list (openstack) [root@chrnc-area51-build-01 ~]# The only obvious difference is the longer UID for the Keycloak users. Do Keycloak-created users require something different in the env? Do I need to change something in Keycloak, to make the Keycloak users work the same as CLI-created users? Where can I look in the database to find the differences between these two users? RC files: (openstack) [root@chrnc-area51-build-01 ~]# cat test2-openrc.sh # Clear any old environment that may conflict. for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=test2 export OS_TENANT_NAME=test2 export OS_USERNAME=test2 export OS_PASSWORD=<password> export OS_AUTH_URL=http://192.168.0.10:35357/v3 export OS_INTERFACE=internal export OS_ENDPOINT_TYPE=internalURL export OS_IDENTITY_API_VERSION=3 export OS_REGION_NAME=chrnc-area51-01 export OS_AUTH_PLUGIN=password export OS_CACERT=/etc/kolla/certificates/openstack.area51.dev.chtrse.com.pem (openstack) [root@chrnc-area51-build-01 ~]# cat test3-openrc.sh # Clear any old environment that may conflict. for key in $( set | awk '{FS="="} /^OS_/ {print $1}' ); do unset $key ; done export OS_PROJECT_DOMAIN_NAME=Default export OS_USER_DOMAIN_NAME=Default export OS_PROJECT_NAME=test export OS_TENANT_NAME=test export OS_USERNAME=test3 export OS_PASSWORD=<password> export OS_AUTH_URL=http://192.168.0.10:35357/v3 export OS_INTERFACE=internal export OS_ENDPOINT_TYPE=internalURL export OS_IDENTITY_API_VERSION=3 export OS_REGION_NAME=chrnc-area51-01 export OS_AUTH_PLUGIN=password export OS_CACERT=/etc/kolla/certificates/openstack.area51.dev.chtrse.com.pem E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

4 3