- openstack-discuss - lists.openstack.org

[tipleo][ussuri][CentOSLinux8] failing on partitioning when building images
by Ruslanas Gžibovskis 21 Dec '20

21 Dec '20

Hi all, My image build fails on partitioning [1] and below error logs you can find yaml file I use to build images. [1] http://paste.openstack.org/show/801211/ -- Ruslanas Gžibovskis +370 6030 7030

1 0

[neutron] Bug Deputy Report (Dec14 - 20)
by Hongbin Lu 20 Dec '20

20 Dec '20

Hi, I was bug deputy this last week. Please find below for the report. Critical: * https://bugs.launchpad.net/neutron/+bug/1908711 [neutron-lib] Bump PyYAML to 5.3.1 High: * https://bugs.launchpad.net/neutron/+bug/1908382 [OVN] Missing OVN ACLs for security groups that utilize remote groups attached to ports with allowed_address_pairs Medium: * https://bugs.launchpad.net/neutron/+bug/1908057 Ensure "keepalived" is correctly disabled (the process does not exist) Best regards, Hongbin

1 0

[cinder] spec freeze exceptions
by Brian Rosmaita 18 Dec '20

18 Dec '20

The Cinder spec freeze is now in effect. There are a few proposed specs that have been reviewed and not yet accepted, but whose final revision looks pretty straightforward, so the following are granted a spec freeze exception for Wallaby: NVMe connector support MD replication spec. - https://review.opendev.org/c/openstack/cinder-specs/+/766730 NVMe monitoring and healing agent for NVMe connector. - https://review.opendev.org/c/openstack/cinder-specs/+/766732 Support storing volume format info - https://review.opendev.org/c/openstack/cinder-specs/+/760999 Specs must be approved before 1700 UTC on Wednesday 23 December. The following specs require more than a little revision and/or their authors have not been responsive to comments, but in the interest of fairness, an exception is granted to these as well: Migration support for a volume with replication status enabled - https://review.opendev.org/c/openstack/cinder-specs/+/766130 Support revert any snapshot to the volume - https://review.opendev.org/c/openstack/cinder-specs/+/736111 Remove quota usage cache - https://review.opendev.org/c/openstack/cinder-specs/+/730701 These must also be approved before 1700 UTC on Wednesday 23 December.

1 0

[neutron] Drivers meeting
by Slawek Kaplonski 18 Dec '20

18 Dec '20

Hi, Due to upcoming holiday season lets cancel next 2 drivers meetings. See You all on the meeting at 8.01.2021. Have a great holidays :) -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[tripleo] next meeting Tuesday Dec 22 @ 1400 UTC in #tripleo
by Marios Andreou 18 Dec '20

18 Dec '20

For anyone that is around next week (and not on well earned break) the last scheduled TripleO irc meeting for 2020 is ** Tuesday 22nd December at 1400 UTC in #tripleo. ** ** https://etherpad.opendev.org/p/tripleo-meeting-items ** Please add anything you want to hilight at https://etherpad.opendev.org/p/tripleo-meeting-items This could be anything including review requests, blocking issues or to socialise ongoing or planned work. Our last meeting was held on Dec 08th - you can find the logs there http://eavesdrop.openstack.org/meetings/tripleo/2020/tripleo.2020-12-08-14.…

1 0

Get openstack public url of an object
by Luca Tagliaferri 18 Dec '20

18 Dec '20

I am using openstack to upload an object to a container like explained here: https://docs.openstack.org/openstacksdk/latest//user/guides/object_store.ht… I would like to know if it is possible to programmatically know the public url of the file that I just uploaded. -- -- *Luca Tagliaferri* / Ing luca.tagliaferri(a)gmail.com / +393382346436 *Ooros* http://www.desidoo.com <http://ww.desidoo.com/> corso rosai 26/6 <https://twitter.com/pinturic> <https://www.facebook.com/pinturic?fref=photo> <https://plus.google.com/u/0/+LucaTagliaferri/posts> <https://es.linkedin.com/pub/luca-tagliaferri/2/322/67a> <https://www.youtube.com/user/pinturicchio4> <https://github.com/pinturic> Get your own signature <http://signature-maker.net/email-signature?utm_source=generatedSig&utm_medi…>

1 0

[all][stable] rocky tempest based jobs are broken now
by Akihiro Motoki 17 Dec '20

17 Dec '20

Hi, All jobs based on devstack-tempest in stable/rocky are now broken. The cause is that stackviz requirements are not compatible with python 3.5 (example [1]) gmann is testing a fix in stackviz [2]. It looks like the change itself works well but we need to handle another failure in the nodejs job. gmann and I will follow-up the fix and keep you updated. Thanks, Akihiro Motoki (amotoki) [1] https://zuul.opendev.org/t/openstack/build/acf6ccdf1b304cb29ab41baa0d80ec55 [2] https://review.opendev.org/c/openstack/stackviz/+/767063

2 2

Re: [cyborg][IRC]Vote for moving cyborg weekly meeting one hour ahead
by yumeng bao 17 Dec '20

17 Dec '20

ok. We've got all +1 from active cores. Also a big +1 from my side. So from next weekly meeting, we will follow the new meeting time[0]: Where: #openstack-cyborg IRC channel When:Every Thursday at UTC 0200 (China @10 am Thu; US West Coast @7 pm Wed) [0]https://wiki.openstack.org/wiki/Meetings/CyborgTeamMeeting#Weekly_IRC_Cyb… Regards， Yumeng > On Dec 17, 2020, at 2:41 PM, Wang, Xin-ran <xin-ran.wang(a)intel.com> wrote: >

1 0

[neutron] Drivers meeting agenda
by Slawek Kaplonski 17 Dec '20

17 Dec '20

Hi, On this week's drivers meeting we have 2 RFEs to discuss: * https://bugs.launchpad.net/neutron/+bug/1907089 - new RFE proposed by Lajos, spec is also proposed at https://review.opendev.org/c/openstack/neutron-specs/+/767337 * https://bugs.launchpad.net/neutron/+bug/1905295 - this was discussed last week, Bence provided new informations related to that one so lets get back to it too. See You tomorrow on the meeting :) -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[nova] PCI hotplugging
by Mauricio Tavares 17 Dec '20

17 Dec '20

As some of you know, libvirt supports PCI hotplugging[1]. How would that work using nova (or, if there is a better way, I am all ears)? [1]https://www.libvirt.org/pci-hotplug.html

2 1

[cinder] NVMe-oF with TCP transport protocol
by ʂʍɒρƞįł Ҟưȴķɒʁʉɨ 17 Dec '20

17 Dec '20

hello cinder team, I wanted to know if we have support for NVMEoF with TCP transport between servers and the target? Any documentation/reference would be appreciated. Best Regards, Swapnil Kulkarni irc : coolsvap coolsvap at gmail dot com

2 2

[Glance] Cancelling next 2 weekly meetings
by Abhishek Kekane 17 Dec '20

17 Dec '20

Hi All, Due to Christmas and New year, we are cancelling our weekly meetings on 24 and 31 December. The next meeting will be held on 7th January. Ping us on #openstack-glance if you have any queries/doubts. Happy holidays and happy new year in advance. Regards, Abhishek

1 0

[ops][cinder] notice of incorrect default policy value
by Brian Rosmaita 17 Dec '20

17 Dec '20

Hello operators, While reviewing Cinder policies recently, Bug #1908315 [0] was discovered: "Policy group:reset_group_snapshot_status has incorrect checkstring". This policy governs the "Reset a snapshot's status" action [1]. The action is supposed to be admin-only, but the default policy setting is admin-or-owner. This is not a security issue, but it does allow an end user to put a group snapshot that they own into an invalid status, with indeterminate consequences. A fix has been posted for review [2], but if you wish to correct this immediately, you can put the following line into your cinder policy file: "group:reset_group_snapshot_status": "rule:admin_api" More information about the cinder policy file can be found at [3]. [0] https://bugs.launchpad.net/cinder/+bug/1908315 [1] https://docs.openstack.org/api-ref/block-storage/v3/#reset-a-snapshot-s-sta… [2] https://review.opendev.org/c/openstack/cinder/+/767226 [3] https://docs.openstack.org/cinder/latest/configuration/block-storage/sample…

1 1

[cyborg][IRC]Vote for moving cyborg weekly meeting one hour ahead
by yumeng bao 16 Dec '20

16 Dec '20

Hi all, Cyborg weekly meeting is held at #openstack-cyborg IRC channel every Thursday at UTC 0300 (China @11 am Thu; US West Coast @8 pm Wed). For now, most of the attendees are located at China. Attending meeting during 11:00 - 12:00 am for them means giving up partial lunch break time, otherwise they have to give up part of the meeting. This makes it harder to have all the core contributors together in one meeting. As such, we decide to move the meeting time one hour ahead. Please vote for +1/-1, if most cores and attendees agree/disagree, we will make it effective/ineffective. Regards, Yumeng

4 3

[OSSN-0087] Ceph user credential leakage to consumers of OpenStack Manila
by gouthampravi＠gmail.com 16 Dec '20

16 Dec '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Ceph user credential leakage to consumers of OpenStack Manila - ------------------------------------------------------------- ### Summary ### OpenStack Manila users can request access on a share to any arbitrary cephx user, including privileged pre-existing users of a Ceph cluster. They can then retrieve access secret keys for these pre-existing ceph users via Manila APIs. A cephx client user name and access secret key are required to mount a Native CephFS manila share. With a secret key, a manila user can impersonate a pre-existing ceph user and gain capabilities to manipulate resources that the manila user was never intended to have access to. It is possible to even obtain the default ceph "admin" user's key in this manner, and execute any commands as the ceph administrator. ### Affected Services / Software ### - - OpenStack Shared File Systems Service (Manila) versions Mitaka (2.0.0) through Victoria (11.0.0) - - Ceph Luminous (<=v12.2.13), Mimic (<=v13.2.10), Nautilus (<=v14.2.15), Octopus (<=v15.2.7) ### Discussion ### OpenStack Manila can provide users with Native CephFS shared file systems. When a user creates a "share" (short for "shared file system") via Manila, a CephFS "subvolume" is created on the Ceph cluster and exported. After creating their share, a user can specify who can have access to the share with the help of "cephx" client user names. A cephx client corresponds to Ceph Client Users [2]. When access is provided, a client user "access key" is returned via manila. A ceph client user account is required to access any ceph resource. This includes interacting with Ceph cluster infrastructure daemons (ceph-mgr, ceph-mds, ceph-mon, ceph-osd) or consuming Ceph storage via RBD, RGW or CephFS. Deployment and orchestration services like ceph-ansible, nfs-ganesha, kolla, tripleo need ceph client users to work, as do OpenStack services such as cinder, manila, glance and nova for their own interactions with Ceph. For the purpose of illustrating this vulnerability, we'll call them "pre-existing" users of the Ceph cluster. Another example of a pre-existing user includes the "admin" user that is created by default on the ceph cluster. In theory, manila's cephx users are no different from a ceph client user. When a manila user requests access to a share, a corresponding ceph user account is created if one already does not exist. If a ceph user account already exists, the existing capabilities of that user are adjusted to provide them permissions to access the manila share in question. There is no reasonable way for this mechanism to know what pre-existing ceph client users must be protected against unauthorized abuse. Therefore there is a risk that a manila user can claim to be a pre-existing ceph user to steal their access secret key. To resolve this issue, the ceph interface that manila uses was patched to no longer allow manila to claim a pre-existing user account that didn't create. By consequence this means that manila users cannot use cephx usernames that correspond to ceph client users that exist outside of manila. ### Recommended Actions ### #. Upgrade your ceph software to the latest patched releases of ceph to take advantage of the fix to this vulnerability. #. Audit cephx access keys provisioned via manila. You may use "ceph auth ls" and ensure that no clients have been compromised. If they have been, you may need to delete and recreate the client credentials to prevent unauthorized access. #. The audit can also be performed on manila by enumerating all CephFS shares and their access rules as a system administrator. If a reserved ceph client username has been used, you may deny access and recreate the client credential on ceph to refresh the access secret. No code changes were necessary in the OpenStack Shared File System service (manila). With an upgraded ceph, when manila users attempt to provide share access to a cephx username that they cannot use, the access rule's "state" attribute is set to "error" because this operation is no longer permitted. ### Patches ### The Ceph community has provided the following patches: Ceph Octopus: https://github.com/ceph/ceph/commit/1b8a634fdcd94dfb3ba650793fb1b6d09af65e05 Ceph Nautilus: https://github.com/ceph/ceph/commit/7e3e4e73783a98bb07ab399438eb3aab41a6fc8b Ceph Luminous: https://github.com/ceph/ceph/commit/956ceb853a58f6b6847b31fac34f2f0228a70579 The fixes are in the latest releases of Ceph Nautilus (14.2.16) and Ceph Octopus (15.2.8). The patch for Luminous was provided as a courtesy to possible users of OpenStack Manila, however the Ceph community no longer produces releases for Luminous or Mimic as they are end of life. See `here for information about ceph releases. <https://docs.ceph.com/en/latest/releases/general/>`_ ### Contacts / References ### Author: - - Pacha Ravi, Goutham gouthamr(a)redhat.com (Red Hat) Credits: - - Garbutt, John john(a)johngarbutt.com (StackHPC) - - Babel, Jahson jahson.babel(a)cc.in2p3.fr (Centre de Calcul de l'IN2P3) This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0087 Original LaunchPad Bug : https://launchpad.net/bugs/1904015 Mailing List : [Security] tag on openstack-discuss(a)lists.openstack.org OpenStack Security Project : https://launchpad.net/~openstack-ossg CVE: CVE-2020-27781 -----BEGIN PGP SIGNATURE----- wsFcBAEBCAAGBQJf2raCAAoJENJP32eYWZR3mREP/ij+So0KHK7dD3WAdcVK 0JdGzwOjX2Bc4/7g5RPzn4RaxZKicsBOWqESCTTBl94oG4XvTax3fW0E6VlL L6XoV+At1cEvptONDoZ0faCSHfTng1J73rHMo9v+cmxmOuEwXReghArS86tS KIeRWviW9hyNmZfhJxuAC9ICR0HglhT5VHqNtAjL5WzoFGMtC4VeJ7e8rf8r PLjvYGOPzNDj8wAn5UvTnJgkT1tbbIZQai4o+QlDJK5eEuEQnwGTUQ/umx/a z2DeuCnDDxJeOFcWEgkDzTQsE6e7dO4FvoIIsZ3u5pA0Rhw31QfpupUsLAYH WhAjt7cImKRTfza/zVuS7PAko2fMmuNHyHEQQh2Y80S4nkdo/WAfUaBft8eO vdNlvunBQA2E7mlK6oxNF22k/pX49N47vVqGttPFA1kNPFg2qLcc8mJIxpjf V4sJVfMO/DuQaU1zTH/P9KsYm/hlyVzLELEvDR43jmWg4p4btZT8Z2OVD80r 9/dRMcbRQl3yq1C2L7yyKVOc6Pw9HJ90ixXpgv7ZT6TbwAPzFe/euITmA6H0 EGzinRg7JmfFFnf/9FBEZJRL46/idMLVNRo2XioA6+o2kngkwSsD+uJTlMFG XQJINZwrbL1xpuh3VGaOI44yCimsQwNGURH2NmZ7uFBKy6CHYXX42ydnQk51 w9qp =o0Lx -----END PGP SIGNATURE-----

1 0

[Cinder] CHAP security
by Kanevsky, Arkady 16 Dec '20

16 Dec '20

Team, As more storage products start supporting CHAP, cinder drivers adding that also that becomes part of cinder.conf. Should we include CHAP support as an optional feature in https://docs.openstack.org/cinder/latest/reference/support-matrix.html? May as security feature? Thanks, Arkady Kanevsky, Ph.D. SP Chief Technologist & DE Dell EMC office of CTO Dell Inc. One Dell Way, MS PS2-91 Round Rock, TX 78682, USA Phone: 512 7204955

2 1

[tc] weekly meeting agenda
by Mohammed Naser 16 Dec '20

16 Dec '20

Hi everyone, Here’s the agenda for our weekly TC meeting. It will happen tomorrow (Thursday the 17th) at 1500 UTC in #openstack-tc and I will be your chair. If you can’t attend, please put your name in the “Apologies for Absence” section. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting * ACTIVE INITIATIVES - Follow up on past action items - Skipping next 2 meetings - Audit SIG list and chairs (diablo_rojo) - Annual report suggestions (diablo_rojo) - X cycle goal selection start - Audit and clean-up tags (gmann) - X cycle release name vote recording (gmann) - CentOS 8 releases are discontinued / switch to CentOS 8 Stream (gmann/yoctozepto) - Open Reviews We'll clean up the agenda tomorrow should it need changes. Thanks, Mohammed -- Mohammed Naser VEXXHOST, Inc.

1 0

[ironic] Securing physical hosts in hostile environments
by Eric K. Miller 16 Dec '20

16 Dec '20

Hi, We have considered ironic for deploying physical hosts for our public cloud platform, but have not found any way to properly secure the hosts, or rather, how to reset a physical host back to factory defaults between uses - such as BIOS and BMC settings. Since users (bad actors) can access the BMC via SMBus, reset BIOS password(s), change firmware versions, etc., there appears to be no proper way to secure a platform. This is especially true when resetting BIOS/BMC configurations since this typically involves shorting a jumper and power cycling a unit (physically removing power from the power supplies - not just a power down from the BMC). Manufacturers have not made this easy/possible, and we have yet to find a commercial device that can assist with this out-of-band. We have actually thought of building our own, but thought we would ask the community first. Thanks! Eric

4 10

tox -e pep8
by Kanevsky, Arkady 16 Dec '20

16 Dec '20

Do we still using it? If not, what have we replaced it with? Thanks, Arkady Kanevsky, Ph.D. SP Chief Technologist & DE Dell EMC office of CTO Dell Inc. One Dell Way, MS PS2-91 Round Rock, TX 78682, USA Phone: 512 7204955

6 8

[oslo][nova][glance][cinder] move cursive library to oslo?
by Brian Rosmaita 16 Dec '20

16 Dec '20

Hello Oslo Team, Nova, Glance, and Cinder all make use of the 'cursive' library for image-signature-validation. The library is currently in the 'x' namespace: https://opendev.org/x/cursive The current cursive-core team entirely consists of members of the Johns Hopkins University Applied Physics Laboratory, which ended its involvement with OpenStack in July 2018 [0]. This leaves us in a position where three of the major openstack projects depend on a library to which no one currently around can approve code changes. I'd like to propose that the cursive library be moved back to the 'openstack' namespace and be put under Oslo governance with the consuming teams sharing the maintenance of the library. I don't think this will make much new work for the Oslo team--the library has been very stable and hasn't changed in over 2 years--but it will ensure that should any bugfixes be required, there will be oslo team members who can approve the patches. Thanks for thinking this over, brian [0] http://lists.openstack.org/pipermail/openstack-dev/2018-July/131978.html

6 9

[largescale-sig] Next meeting: December 16, 15utc
by Thierry Carrez 16 Dec '20

16 Dec '20

Hi everyone, We'll have our last 2020 Large Scale SIG meeting this Wednesday in #openstack-meeting-3 on IRC, at 15UTC. You can doublecheck how it translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20201216T15 Our main topic will be to review the various scaling stages[1] and identify low-hanging-fruit tasks to do a first pass at improving those pages. [1] https://wiki.openstack.org/wiki/Large_Scale_SIG Feel free to add other topics to our agenda at: https://etherpad.openstack.org/p/large-scale-sig-meeting Talk to you all later, -- Thierry Carrez

1 1

[kolla] Cancelling next 3 IRC meetings
by Mark Goddard 16 Dec '20

16 Dec '20

Hi, Due to various holidays, we will cancel the next 3 IRC meetings and meet again on 13th January. Regards, Mark

1 0

[ironic] IPA images: CentOS 8, Stream and Debian
by Dmitry Tantsur 16 Dec '20

16 Dec '20

Hi wonderful ironicers! Unless you spend the whole last week under a rock (good for you - I mean it!), you must be already aware that the classical CentOS as we know it is going away in favour of CentOS Stream, and maybe as soon as in the end of 2021! For us it means two things: 1) Bifrost will test with CentOS Stream, which may not 100% match the current stable RHEL. 2) We need to decide what to do with our published DIB images [1], currently based on CentOS 8. I'd like to concentrate on problem #2. We have conducted an experiment of switching to CentOS Stream, and it did not go so well. The image size has increased from ~ 340 MiB to nearly 450 MiB, causing serious issues in CI jobs using it. Because of this we're reverting the switch and considering other options. One is to figure out what causes the size increase and remove packages or manually delete files. We're already doing it quite intensively, so I expect this option to be time-consuming. We'll probably have to repeat this exercise regularly to keep up with the distribution changes. The other option is to switch to another distro. Debian looks promising in this context: 3 years of support and the image size is just 273 MiB. I have a patch [2] up for people who want to try the resulting image on their bare metal machines. What do you think? Are there any concerns with either option? [1] https://tarballs.openstack.org/ironic-python-agent/dib/files/ [2] https://review.opendev.org/c/openstack/ironic-python-agent-builder/+/767158 -- Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill

4 9

[neutron]CI meetings in next 2 weeks canceled
by Slawek Kaplonski 16 Dec '20

16 Dec '20

Hi, As we discussed during our last meeting, we are going to cancel our CI meetings in next 2 weeks. Have a great holidays and see You all on the meeting at 5.01.2021 -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[stable][requirements][neutron] Capping pip in stable branches or not
by Bernard Cafarelli 15 Dec '20

15 Dec '20

Hi, now that master branches have recovered from pip new resolver use, I started looking at stable branches status. tl;dr for those with open pending backports, all branches are broken at the moment so please do not recheck. Thinking about fixing gates for these branches, older EM branches may be fine once the bandit 1.6.3 issue [1] is sorted out, but most need a fix against the new pip resolver. pip has a flag to switch back to old resolver, but this is a temporary one that will only be there for a few weeks [2] >From a quick IRC chat, the general guidance for us was always to leave pip uncapped, and the new resolver issues are actually broken requirements. But looking at master fixes, these indicate large and complicated changes on requirements and lower-contraints. Neutron fix [3] required a few major linter bumps and major version bumps in l-c. I guess it may be doable as victoria backport, but this will be messy for previous branches. ovn-octavia-provider is a scarier example [4], from stable point of view the change by itself does not look good for backport, even just for victoria. Also, in master, some fixes were possible by bumping versions on dependencies, but how to fix them if the max possible versions have broken deps themselves? So, how do we proceed to fix stable gates? Ideas and feedback will be most welcome [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019292… [2] http://pyfound.blogspot.com/2020/11/pip-20-3-new-resolver.html [3] https://review.opendev.org/c/openstack/neutron/+/766000 [4] https://review.opendev.org/c/openstack/ovn-octavia-provider/+/765872/32/low… -- Bernard Cafarelli

16 21

RE: Re: New Openstack Deployment questions - how will we respond to this change?
by Braden, Albert 15 Dec '20

15 Dec '20

The purpose of my Openstack Deployment email was not only to rant about the decision to kill Centos 8. I want to make sure that we don't blindly go down the easy route of pretending that Centos Stream is an acceptable replacement for Centos. If we do this, we would do a disservice to the community and to everyone who depends on it. The reality is that, at the end of 2021, Centos will no longer exist as a viable production operating system, and everyone who was using it will have to adjust. For companies that already have Centos mirror repositories setup and people managing them, the increased load imposed by Stream will be incremental, but I suspect that the vast majority of companies do not have that infrastructure already setup, and we will need to carefully consider whether our needs are better met by going forward with Stream or switching to another OS. If the OpenStack community decides to continue building on Stream, we should make it crystal clear to operators and users that Stream is not a production-ready OS and that our Stream OpenStack implementation is suitable for testing and development use only, unless they devote substantial resources to mirroring and testing Stream to insulate production clusters from the instability that it will introduce. If we do decide to continue building on Stream, how will we respond to the constant stream of bug reports that will result when Stream changes cause OpenStack components to fail? Many component teams are already understaffed. Will we have the bandwidth to constantly chase changes? Should we replace our Centos builds with RHEL, or with Rocky? Does the community have (or can we find) the resources to do the work of maintaining stable Stream mirrors and only building OpenStack on our stable versions of Stream? Or would it be better to drop Centos support and focus our efforts on operating systems that have not implemented unilateral changes that harm the community? -----Original Message----- From: Braden, Albert Sent: Friday, December 11, 2020 9:10 AM To: openstack-discuss(a)lists.openstack.org Subject: RE: [EXTERNAL] Re: New Openstack Deployment questions Centos Stream is fine for those who were using Centos for testing or development. It's not at all suitable for production, because rolling release doesn't provide the stability that production clusters need. Switching to Centos Stream would require significant resources to be expended to setup local mirrors and then perform exhaustive testing before each upgrade. The old Centos did this work for us; Centos was built on RHEL source that had already been tested by paying customers, and bugs fixed with the urgency that paying customers require. Adding an upstream build (Stream) to the existing downstream (Centos 8.x) was fine, but I'm disappointed by the decision to kill Centos 8. I don't want to wax eloquent about how we were betrayed; suffice it to say that even for a free operating system, suddenly changing the EOL from 2029 to 2021 is unprecedented, and places significant burdens on companies that are using Centos in production. I can understand why IBM/RH made this decision, but there's no denying that it puts production Centos users in a difficult position. I hope that Rocky Linux [1], under Gregory Kurtzer (founder of the Centos project) will turn out to be a useful alternative. {1} https://github.com/rocky-linux/rocky -----Original Message----- From: Luigi Toscano <ltoscano(a)redhat.com> Sent: Thursday, December 10, 2020 3:51 PM To: Thomas Wakefield <dwakefi2(a)gmu.edu>; openstack-discuss(a)lists.openstack.org Cc: Satish Patel <satish.txt(a)gmail.com> Subject: [EXTERNAL] Re: New Openstack Deployment questions CAUTION: The e-mail below is from an external source. Please exercise caution before opening attachments, clicking links, or following guidance. On Thursday, 10 December 2020 15:27:40 CET Satish Patel wrote: > I just built a new openstack using openstack-ansible on CentOS 8.2 > last month before news broke out. I have no choice so i am going to > stick with CentOS. > > What is the future of RDO and EPEL repo if centOS going away. ? Continue as before on CentOS Stream. -- Luigi I apologize for the nonsense below. So far I have not been able to stop it from being attached to my external emails. I'm working on it. E-MAIL CONFIDENTIALITY NOTICE: The contents of this e-mail message and any attachments are intended solely for the addressee(s) and may contain confidential and/or legally privileged information. If you are not the intended recipient of this message or if this message has been addressed to you in error, please immediately alert the sender by reply e-mail and then delete this message and any attachments. If you are not the intended recipient, you are notified that any use, dissemination, distribution, copying, or storage of this message or any attachment is strictly prohibited.

3 2

[tripleo][ci] current status
by Wesley Hayutin 15 Dec '20

15 Dec '20

Greetings, *Master*: OVB jobs are working \0/ again [1] Master promoted today, logged a few tempest failures and moved to skiplist *Victoria*: Promoted today OVB jobs all RED waiting [2] *Ussuri*: RED, we need to land 65077 757836 757821 OVB RED *Train*: Most of Upstream is OK [3], update and upgrade jobs need to move to nv imho until fixed [3] non-passing jobs should just be removed [4] *ALL: *We've only merged 17 patches in the last 24 hours, we're usually closer to 30-40+ per day. I'll keep an eye on it, it's only monday. weee [5] [1] https://review.rdoproject.org/zuul/builds?job_name=tripleo-ci-centos-8-ovb-… [2] https://review.opendev.org/c/openstack/tripleo-heat-templates/+/766797 <https://review.opendev.org/c/openstack/tripleo-heat-templates/+/766797> [3] http://dashboard-ci.tripleo.org/d/3-DYSmOGk/jobs-exploration?orgId=1&var-in… [4] https://zuul.openstack.org/builds?job_name=tripleo-ci-centos-7-standalone-u… https://zuul.openstack.org/builds?job_name=tripleo-ci-centos-7-containerize… https://review.opendev.org/c/openstack/tripleo-ci/+/766621 [5] http://paste.openstack.org/show/801030/

1 1

Is Microsoft Windows 2019, 2016 HyperV supported for nova ?
by Nagarjun Rajaraman 15 Dec '20

15 Dec '20

Hi all , Does anyone know if Microsoft Windows 2019, 2016 HyperV supported for openstack nova ? Could only see supported documentation for 2012 & 2012 R2 , what are the steps are need to follow to integrate Hyper V host that runs windows server 2019 . Best Regards , Arjun

2 1

[oslo] No meeting during the next 2 weeks
by hberaud 15 Dec '20

15 Dec '20

Hello Osloers, I'm on PTO during the next 2 weeks so I'll be AFK. I won't be running the next 2 meetings. If someone else from the Oslo team wants to run it, please feel free. Let me wish you happy end of the year parties! Hervé -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

[ovn][neutron] OVN Production Installation Guide
by Malik Obaid 14 Dec '20

14 Dec '20

Hi, I was wondering if there is any comprehensive OVN production installation guide available, or if anyone who has implemented OVN for Openstack Neutron on their Ubuntu based production environment, is willing to provide the guide here, would be a big help. Waiting for you response. Thank you and best regards, Malik Obaid

1 0

[all][SDK][zuul][DIB] CentOS-8
by Artem Goncharov 14 Dec '20

14 Dec '20

Hi everybody, Over around a week we have patches in SDK being blocked by functional test of the nodepool (https://123b844dd0bc940cd071-d2975a8f065f970ca29e743c021b8a36.ssl.cf1.rackc… <https://123b844dd0bc940cd071-d2975a8f065f970ca29e743c021b8a36.ssl.cf1.rackc…>) trying to build CentOS-8 image blocked by https://review.opendev.org/c/openstack/diskimage-builder/+/765963 <https://review.opendev.org/c/openstack/diskimage-builder/+/765963> caused by CentOS rename their packages (the DIB change helps to fix the issue - just verified locally). Normally I would say OK, let’s merge DIB fix and everything is fine, but due to a recent announcement of RedHat (IBM) to discontinue CentOS (non stream) I wonder, whether the DIB change as such is useful at all. At least for the moment I see a perhaps more appropriate fix in nodepool to build some other image (or Fedora or at least to use CentOS stream). DIB should be fixed as well, that’s clear, but maybe differently. Any way we need to come up with solution quickly, since our CI is blocked affecting quite some projects. P.S. Actually that issue is not only affecting our tests, but every Zuul installation trying to build CentOS-8 images. Any opinions? Artem

2 1

[tc] weekly update
by Mohammed Naser 14 Dec '20

14 Dec '20

Hi everyone, Here's an update for what happened in the OpenStack TC this week. You can get more information by checking for changes in openstack/governance repository. # Patches ## Open Reviews - Deprecate openstack-ansible-galera_client role https://review.opendev.org/c/openstack/governance/+/765784 - Add Resolution of TC stance on the OpenStackClient https://review.opendev.org/c/openstack/governance/+/759904 - Improve check-review-status https://review.opendev.org/c/openstack/governance/+/766249 - Clarify impact on releases for SIGs https://review.opendev.org/c/openstack/governance/+/752699 ## General Changes - Add checks for repo not to be in both project and legacy data https://review.opendev.org/c/openstack/governance/+/766642 - Remove Searchlight project team https://review.opendev.org/c/openstack/governance/+/764530 - Remove Qinling project team https://review.opendev.org/c/openstack/governance/+/764523 ## Project Updates - Revive os_monasca https://review.opendev.org/c/openstack/governance/+/765800 - Add Magpie charm to OpenStack charms https://review.opendev.org/c/openstack/governance/+/762820 ## Other Reminders - Our next [TC] Weekly meeting is scheduled on December 17 at 1500 UTC. If you would like to add topics for discussion, please go to https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting and fill out your suggestions by Wednesday, December 16, at 2100 UTC. Thanks for reading! Mohammed & Kendall -- Mohammed Naser VEXXHOST, Inc.

1 0

Openstack related quieries
by Gokul Kalal 14 Dec '20

14 Dec '20

Hi All, here are the few questionnaires for which I am looking for answers. It would be of great help if anybody provides their suggestions on the below questions. 1. Is RT enabled KVM available for Openstack? It would be helpful if anyone provides a link for the same? 2. Is Openstack using devstack preferable in production or it is meant only for the dev setup? 3. For RT KVM, Is hyper-threading preferred? 4. What are the minimum system requirements for openstack setup? (Currently, I am equipped with Quad-Core i7-8559U with 16 GB RAM, will this work for Openstack setup? My requirements are 3 VMs, out of which 2 VM will be having dedicated 3 CPU cores allocated(hyperthreading enabled) and host ubuntu and another VM will be running on the remaining 2 cores - isolcpu used to isolate cores). -- Thanks & Regards, Gokul G Kalal

2 1

unable to use/assign specific fixed IP - reserved_dhcp_port.
by lejeczek 14 Dec '20

14 Dec '20

Hi guys. I'm try to spin up and instance: $ openstack server create midway --flavor C1.vss.tiny --volume midway --nic net-id=fd8659cf-8723-4254-bf88-837b37a50a24,v4-fixed-ip=10.0.0.4 Fixed IP address 10.0.0.4 is already in use on instance reserved_dhcp_port. (HTTP 400) (Request-ID: req-bf34b06c-d0b7-4798-8eeb-9f5bb87348e2) Having no admin access to the stack - how to troubleshoot and ideally resolve it before I have to admins demanding action :) many thanks, L.

2 1

[cloudkitty] December 18th meeting is canceled
by Rafael Weingärtner 14 Dec '20

14 Dec '20

Hello everybody, As discussed in today's meeting [1], the 18th December meeting is canceled. Therefore, our next meeting will be on January 11th. Meanwhile, let's try to review and test as many patches as possible :) [1] http://eavesdrop.openstack.org/meetings/cloudkitty/2020/cloudkitty.2020-12-… Cheers, -- Rafael Weingärtner

1 0

[CLOUDKITTY] - Prometheus metrics.yml sample?
by Mariusz Karpiarz 14 Dec '20

14 Dec '20

Try this config: https://github.com/mkarpiarz/cloudkitty-playground/tree/prometheus-collecto… Mariusz Karpiarz

1 0

[TripleO] when running cloud deploy again to add more nodes: Database schema file with version 139 doesn't exist
by Ruslanas Gžibovskis 14 Dec '20

14 Dec '20

Hi all. I am getting some failing components on controller host: bb44eef40a91 10.120.129.222:8787/tripleou/centos-binary-cinder-api:current-tripleo /usr/bin/bootstra... 18 minutes ago Exited (1) 18 minutes ago cinder_api_db_sync and in controller:/var/log/containers/stdouts/ 2020-12-14T16:15:20.025430534+00:00 stdout F Error during database migration: "Database schema file with version 139 doesn't exist." how to bypass this? Thanks -- Ruslanas Gžibovskis +370 6030 7030

1 0

[opendev][interop] How to edit Issues link in opendev.org
by Martin Kopec 14 Dec '20

14 Dec '20

Hi everyone, I have noticed that 'Issues' link right under the repo title (osf/refstack-client) [1] redirects to the old location [2] while it should be [3] after the project got moved to the osf/ namespace by [4]. The same problem is with osf/refstack, osf/python-tempestconf and osf/interop projects. I've found this change [5] in opendev/project-config which tracks the renaming process however it seems it didn't do the trick. What is the process to edit the 'Issues' link in opendev.org [1] https://opendev.org/osf/refstack-client [2] https://storyboard.openstack.org/#!/project/openstack/refstack-client [3] https://storyboard.openstack.org/#!/project/osf/refstack-client [4] https://review.opendev.org/c/openstack/project-config/+/734669 [5] https://review.opendev.org/c/opendev/project-config/+/735211 Thank you, -- Martin Kopec Software Quality Engineer Red Hat EMEA

1 0

[neutron] Bug deputy - 7.12 - 14.12.2020
by Slawek Kaplonski 14 Dec '20

14 Dec '20

1 0

port Groups (Bonds) Configuration in Openstack Baremetal Provisioning.
by Lokendra Rathour 13 Dec '20

13 Dec '20

Hello, I am trying to install a baremetal on existing openstack setup. During the time of installation, is it possible to have bonds already setup when the baremetal nodes comes up. I was trying to work on the : Port groups configuration in the Bare Metal service *Documents referred :* 1. https://docs.openstack.org/ironic/pike/admin/portgroups.html#:~:text=A%20po… . 2. https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/14… *Setup used:* Baremetal on StarlingX Setup : https://docs.starlingx.io/deploy_install_guides/r4_release/bare_metal/ironi… ¶ <https://docs.openstack.org/ironic/queens/admin/portgroups.html#port-groups-…> -- ~ Lokendra

2 5

[tc][goals] community feedback on 'stabilization' goal
by Mohammed Naser 11 Dec '20

11 Dec '20

Hi there, Over the last TC meeting, we exchanged opinions about the new goal selection. It was discussed that due to the extraordinary situation this year, we could have a loose goal instead. Therefore, we would like to propose having a stabilization cycle this release. Some ideas discussed for this “stabilization” cycle (would be all of those): 1. Use this time to rest and relax, no need to do something. 2. Use this time to finish up this really cool thing you've been trying to find time to, and share with us to recognize. 3. Check out these existing goals/popup teams that might interest you if you want to invest time in something different/new. As a reminder that we don't have to do a community goal for every release, we are leaving this open and would like to know what the community thinks. Feel free to send over your thoughts, Regards, -- Mohammed Naser VEXXHOST, Inc.

4 3

[tc] weekly meeting summary
by Mohammed Naser 11 Dec '20

11 Dec '20

Hi everyone, Here's a summary of what happened in our TC weekly meeting last Thursday, Dec 10. # ATTENDEES (LINES SAID) - mnaser (115) - apevec (60) - gmann (57) - yoctozepto (26) - mugsie (26) - fungi (20) - jungleboyj (14) - noonedeadpunk (9) - diablo_rojo__ (6) - marios|rover (6) - ricolin (6) - zbr (4) - weshay|ruck (2) - jrosser (2) - akahat (1) - gouthamr (1) # MEETING SUMMARY 1. Rollcall 2. Follow up on past action items DONE: mnaser change all reference of meeting time to go towards eavesdrop for single source of truth DONE: mnaser remove openstacksdk discussions for future meetings DONE: mnaser remove project retirement from agenda 3. X cycle goal selection start It was discussed that due to the extraordinary situation this year, perhaps we could have a stabilization goal instead. As a reminder that we don't have to do a community goal for every release, we are leaving this open and will ask folks to update the proposed goal page with something they worked on. Some ideas discussed for this "stabilization" cycle: 1) Use this time to rest and relax, no need to do something. 2) Use this time to finish up this really cool thing you've been trying to find time to, and share with us to recognize. 3) Check out these existing goals/popup teams that might interest you if you want to invest time in something different/new We will keep this as an open discussion item to track the progress and will keep collecting new ideas for goals. 4. Audit and clean-up tags (gmann) For API interoperability tag, patch is merged; gmann will start the ML to encourage projects to start applying for that tag. We will keep this action to discuss the progress of getting projects in, and we will have each tag one by. 5. X cycle release name vote recording (gmann) Because the votes were not recorded, we are asking TC members to list what they voted for on the mailing list http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019337… 6. CentOS 8 releases are discontinued / switch to CentOS 8 Stream (gmann/yoctozepto) Community members from RH were present to help talk through the changes that are occurring with the introduction of CentOS Stream 8. mnaser work to find time for community deployment projects + centos/rdo team to meet to help teams get more information about the upcoming change # ACTION ITEMS 1. mnaser send email to ML to find volunteers to help drive goal selection 2. gmann complete retirement of searchlight & qinling 3. diablo_rojo complete retirement of karbor 4. mnaser work to find time for community deployment projects + centos/rdo team To read the full logs of the meeting, please refer to http://eavesdrop.openstack.org/meetings/tc/2020/tc.2020-12-10-15.01.log.html -- Mohammed Naser VEXXHOST, Inc.

1 0

[nova][gate] nova-multi-cell job failing test_*_with_qos_min_bw_allocation
by melanie witt 11 Dec '20

11 Dec '20

Howdy all, FYI we have gate failures of the recently added test_*_with_qos_min_bw_allocation tests [1] in the nova-multi-cell job on the master, stable/victoria, and stable/ussuri branches. The failures occur during cross cell migrations. I have opened a bug for the failure on the master branch: * https://bugs.launchpad.net/nova/+bug/1907522 The issue here is that we fail to create port bindings in neutron during a cross cell migration in the superconductor: nova.exception.PortBindingFailed: Binding failed for port <port uuid> and that corresponds to a failure in the neutron server log where it fails the port binding with: neutron_lib.exceptions.placement.UnknownResourceProvider: No such resource provider known by Neutron I don't yet know what is going on here ^. For the bug on stable/victoria and stable/ussuri I have opened this bug: * https://bugs.launchpad.net/nova/+bug/1907511 and have a WIP stable-only patch proposed that needs tests: https://review.opendev.org/c/openstack/nova/+/766364 I just wanted to see ASAP if the nova-multi-cell job will pass on it. The issue here ^ is that during a cross cell migration, we aren't targeting the cell database for the target host when we attempt to lookup the service record of the target host. For the stable branch failures I think the failure rate is 100% and it looks like it might also be 100% for the master branch failures. Cheers, -melanie [1] https://review.opendev.org/c/openstack/tempest/+/694539

2 3

[Openstack][FOSDEM][CFP] Virtualization & IaaS Devroom
by Piotr Kliczewski 11 Dec '20

11 Dec '20

Friendly reminder that submission deadline for Virtualization & IaaS dev room at Fosdem is on 20th of December.

1 0

[TC][all] X Release name polling
by Sean McGinnis 11 Dec '20

11 Dec '20

Hey everyone, We recently collected naming suggestions for the X release name. A lot of great suggestions by the community! Much more than I had expected for this letter. As a reminder, starting with the W release we had changed the process for selecting the name [1]. We collected suggestions from the community, then the members of the TC voted in a poll [2] to select which name(s) out of the suggestions to go with. The vetting of the top choices from that process is happening now, and we should have a official result soon. This is a bit of a mea culpa from me about an issue with how this was conducted though. The naming process specifically states: "the poll should be run in a manner that allows members of the community to see what each TC member voted for." When I set up the CIVS poll, I failed to check the box that would allow seeing the detailed results of the poll. So while we do have the winning names, we are not able to see which TC members voted and how. I apologize for missing this step (and I've noted that we really should add some detailed process for future coordinators to follow!). I believe the intent with that part of the process was to allow the community to see how your elected TC members voted as one factor to consider when reelecting anyone. Also transparency to show that no one is pushing through their own choices, circumventing any process. The two options I see at this point would be to either redo the entire naming poll, or just try to capture what TC members voted for somewhere so we have a record of that. It's been long enough now since taking the poll that I don't expect TC members to remember exactly how they ranked things. But we've also started the vetting process through the Foundation (lawyers engaged, etc) so I'd really rather not start over if we can avoid it. If TC members could respond here with what they remember voting for, I hope that is enough to satisfy the spirit of the defined process. If there are any members of the community that have a strong objection to this, please say so. I leave it up to the TC then to decide how to proceed. Again, apologies for missing this step. Otherwise, I think the process has worked well, and I hope we can declare an official X name shortly. Thanks! Sean [1] https://governance.openstack.org/tc/reference/release-naming.html#release-n… [2] https://civs.cs.cornell.edu/cgi-bin/results.pl?id=E_7e6e96070af39fe7

8 9

[nova] weekly meeting is canceled during the holidays
by Balázs Gibizer 11 Dec '20

11 Dec '20

Hi, As we agreed on the weekly meeting the nova meeting schedule will look like the following during the next weeks: Dec 17 2020 16:00 UTC, #openstack-meeting-3 Dec 24 2020 16:00 UTC, Cancelled Dec 31 2020 16:00 UTC, Cancelled Jan 7 2021 16:00 UTC, #openstack-meeting-3 Cheers, gibi

1 0

About fuel
by sunkai 11 Dec '20

11 Dec '20

Hello, I have a question to ask you。How do I modify the disk configuration of fuel for the node? I need to add some configuration items。How can I fulfill this requirement？Looking forward to your reply，Thankyou very much!!!

1 0

[all][policy] Canceling policy-popup's 24th Dec meeting
by Ghanshyam Mann 10 Dec '20

10 Dec '20

Hello Everyone, Due to new year vacations, we decided to cancel the policy popup 24th Dec meeting and will resume meeting from 7th Jan onwards. -gmann

1 0

[all][tc][policy] Progress report of consistent and secure default policies pop-up team
by Ghanshyam Mann 10 Dec '20

10 Dec '20

Hello Everyone, Please find this month's progress on 'Consistent and Secure Default Policies Popup Team'. Meeting notes: ============ * We discussed progress on policy format migration from JSON->YAML and updates required in oslo.upgradecheck is merged now. * As you saw in another email thread by Lance[1], he has started the work on many projects. We will be adding the test coverage also in those, I will be able to help lance on some of them in next month. * We will define the common personas in oslo.policy for reusing it on the service side[2] * Below are the 'Action items, by person': ** gmann to check with abhishekk on glance point in meeting agenda ** gmann to push common persona on oslo policy and release 3.6.1 and lbragstad to review that ** lbragstad/gmann to push common persona on Oslo policy and release 3.6.1 and lbragstad to review that ** lbragstad to finish placement as first ** raildo to update https://review.opendev.org/#/c/743318/ Progress so far: ============ * Popup team meet twice in a month and discuss and work on progress and pre-work to do. - https://wiki.openstack.org/wiki/Consistent_and_Secure_Default_Policies_Popu… * Pre-work to provide a smooth migration path to the new policy <here we will add any pre-work we need to do before more project start moving towards new policy> ** Migrate Default Policy Format from JSON to YAML - This is now a community-wide goal, refer my separate ML thread for progress - https://review.opendev.org/q/topic:%22policy-json-to-yaml%22+(status:open%2… ** Improving documentation about target resources (oslo.policy) - https://bugs.launchpad.net/oslo.policy/+bug/1886857 - raildo pushed the patch which is under review: https://review.opendev.org/#/c/743318/ * Team Progress: (list of a team interested or have volunteer to work) ** Keystone (COMPLETED; use as a reference) ** Nova (COMPLETED; use as a reference) ** Cyborg (COMPLETED) ** Work started in other projects *** https://review.opendev.org/q/topic:%22secure-rbac%22+(status:open%20OR%20st… [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019313… [2] https://review.opendev.org/c/openstack/oslo.policy/+/766536 -gmann

1 0

Multiple VM ports on provider networks / dhcp fails
by Eric K. Miller 10 Dec '20

10 Dec '20

Hi, We ran into an issue recently that I haven't been able to figure out (this environment is on Stein which uses DVR). It involves an environment with many provider networks that connect to a legacy environment as well as many tenant networks. We create a server on a tenant network and add ports to this afterwards with each port attached to its respective provider network. The provider networks have "None" for the "gateway" property, so we don't have multiple default routes added to the routing table. We have a single subnet which has DHCP enabled and a proper allocation pool on its subnet. Note that this is a CentOS 8 server we are testing with, which has "no" ifcfg files for the additional ports, and so we rely on CentOS using DHCP by default. After adding the first port, the DHCP client does its job and requests an IP, which succeeds - so the DHCP server in the respective network namespace is responding fine. However, after adding the second port, it appears the DHCP client is sending requests out the network (we can see this traffic when tcpdump'ing the respective tap interface on the host), but the DHCP server is not replying. After looking at OpenVSwitch flows, it appears that DHCP broadcast traffic is being dropped for the second network. This does NOT happen with tenant networks. I can add multiple ports, each connected to its respective tenant network, and an IP is assigned to each interface that appears in CentOS immediately after the port has been added. Is there something special that is blocking the creation of the DHCP flow for subsequent provider network ports? NOTE that non-DHCP traffic flows fine if we create an ifcfg file with a static IP set to the address that DHCP should have set the interface to - it just appears that DHCP traffic is not flowing to the DHCP namespace for second and subsequent ports/networks. Thanks! Eric

1 0