- openstack-discuss - lists.openstack.org

[oslo] Core reviewer changes
by Stephen Finucane 19 Feb '20

19 Feb '20

Hi all, Just an update on some recent changes that have been made to oslo-core after discussion among current, active cores. Added: scmcginnis Removed: ChangBo Guo(gcb) Davanum Srinivas (dims) Flavio Percoco Joshua Harlow Mehdi Abaakouk (sileht) Michael Still Victor Stinner lifeless Please let me know if anyone has any concerns about these changes. Cheers, Stephen

5 4

[operators][cinder][nova][glance] possible data loss situation (bug 1852106)
by Brian Rosmaita 19 Feb '20

19 Feb '20

tl;dr: If you are running the OpenStack Train release, add the following to the [DEFAULT]non_inheritable_image_properties configuration option [0] in your nova.conf: cinder_encryption_key_id,cinder_encryption_key_deletion_policy About Your nova.conf ==================== - if you already have a value set for non_inheritable_image_properties, add the above to what you currently have - if non_inheritable_image_properties is *not* set in your current nova.conf, you must set its value to include BOTH the above properties AND the default values (which you can see when you generate a sample nova configuration file [1]) NOTE: At a minimum, the non_inheritable_image_properties list should contain: - the properties used for image-signature-validation (these are not transferrable from image to image): * img_signature_hash_method * img_signature * img_signature_key_type * img_signature_certificate_uuid - the properties used to manage the keys for images of cinder encrypted volumes: * cinder_encryption_key_id * cinder_encryption_key_deletion_policy - review the documentation to determine whether you want to include the other default properties: * cache_in_nova * bittorrent Details ======= This issue is being tracked as Launchpad bug 1852106 [2]. This is probably a low-occurrence situation, because in order for the issue to occur, all of the following must happen: (0) using the OpenStack Train release (or code from master (Ussuri development)) (1) cinder_encryption_key_id and cinder_encryption_key_deletion_policy are NOT included in the non_inheritable_image_properties setting in nova.conf (which they aren't, by default) (2) a user has created a volume of an encrypted volume-type in the Block Storage service (cinder). Call this Volume-1 (3) using the Block Storage service, the user has uploaded the encrypted volume as an image to the Image service (glance). Call this Image-1 (4) using the Compute service (nova), the user has attempted to directly boot a server from the image. (Note: this is an unsupported action, the supported workflow is to use the image to boot-from-volume.) (5) although an unsupported action, if a user does (4), it currently results in a server in status ACTIVE but which is unusable because the operating system can't be found (6) using the Compute service, the user requests the createImage action on the unusable (yet ACTIVE) server, resulting in Image-2 (7) using the Image service, the user deletes Image-2 (which has inherited the cinder_encryption_key_* properties from Image-1) upon which the encryption key is deleted, thereby rendering Image-1 non-decryptable so that it can no longer be used in the normal boot-from-volume workflow NOTE 1: the cinder_encryption_key_deletion_policy image property was introduced in Train. In pre-Train releases, deleting the useless Image-2 in step (7) does NOT result in encryption key deletion. NOTE 2: Volume-1 created in step (2) has a *different* encryption key ID than the one associated with Image-1. Thus, even in the scenario where Image-1 becomes non-decryptable, Volume-1 is not affected. Workaround ========== When cinder_encryption_key_id,cinder_encryption_key_deletion_policy are added to the non_inheritable_image_properties setting in nova.conf, the useless Image-2 created in step (6) above will not have the image properties on it that enable Glance to delete the encryption key still in use by Image-1. This does not, however, protect images for which steps (4)-(6) have been performed before the deployment of this workaround. The safest way to deal with images created before the workaround is deployed is to remove the cinder_encryption_key_deletion_policy image property from any image that has it (or to change its value to 'do_not_delete'). While it is possible to use other image properties to identify images created by Nova as opposed to images created by Cinder, this is not guaranteed to be reliable because image properties may have been modified or removed by the image owner. Proposed Longer-term Fixes ========================== - In the Ussuri release, the unsupported action in step (4) above will result in a 400 rather than an active yet unusable server. Hence it will no longer be possible to create the image of the unusable server that causes the issue. [3] - Additionally, given that the image properties associated with cinder encrypted volumes and image signature validation are specific to a single image and should not be inherited by server snapshots under any circumstances, in Ussuri these "absolutely non-inheritable image properties" will no longer be required to appear in the non_inheritable_image_properties configuration setting in order to prevent them from being propagated to server snapshots. [4] References ========== [0] https://docs.openstack.org/nova/train/configuration/config.html#DEFAULT.non… [1] https://docs.openstack.org/nova/train/configuration/sample-config.html [2] https://bugs.launchpad.net/nova/+bug/1852106 [3] https://review.opendev.org/#/c/707738/ [4] https://review.opendev.org/#/c/708126/

2 1

[operators][cinder] driver removal policy update
by Brian Rosmaita 19 Feb '20

19 Feb '20

The Cinder driver removal policy has been updated [0]. Drivers eligible for removal, at the discretion of the team, may remain in the code repository as long as they continue to pass OpenStack CI testing. When such a driver blocks the CI check or gate, it will be removed immediately. The intent of the policy revision is twofold. First, it gives vendors a longer grace period in which to make the necessary changes to have their drivers reinstated as ‘supported’. Second, keeping these drivers in-tree longer should make life easier for operators who have deployed storage backends with drivers that have been marked as ‘unsupported’. Please see the full statement of the policy [0] for details. [0] https://docs.openstack.org/cinder/latest/drivers-all-about.html#driver-remo…

1 0

[cinder] volume-local-cache spec - last call
by Brian Rosmaita 19 Feb '20

19 Feb '20

The volume-local-cache spec [0], which was granted a Cinder spec-freeze exception, currently has two +2s. It's been reviewed by a lot of people, and as far as I can tell, everyone's concerns have been addressed at this point. However, I'd like to give people one last opportunity to verify this for themselves. Unless a substantive objection is raised, I intend to approve the spec around 12:30 UTC tomorrow (Thursday) so that it can be merged before the Nova meeting at 14:00 UTC. cheers, brian [0] https://review.opendev.org/#/c/684556/

1 0

[kolla] Following Nova with XenAPI deprecation
by Radosław Piliszek 19 Feb '20

19 Feb '20

Hello fellow OpenStackers! There exists some logic in Kolla Ansible that handles XenAPI-specific overrides and bootstrapping with os-xenapi. It is one of those murky, untested features that we prefer to remove as soon as possible. :-) Hence we follow Nova in deprecating this functionality for removal. We will do the removal in Victoria. If you are using XenAPI with recent Kolla-Ansible, please let us know. I will be proposing deprec changes later today. As far as other deployment projects are concerned, DevStack, OpenStack-Helm and Puppet-OpenStack seem to still handle XenAPI specifics. -yoctozepto

1 0

[OSSA-2020-001] Nova can leak consoleauth token into log files (CVE-2015-9543)
by Jeremy Stanley 19 Feb '20

19 Feb '20

============================================================= OSSA-2020-001: Nova can leak consoleauth token into log files ============================================================= :Date: February 19, 2020 :CVE: CVE-2015-9543 Affects ~~~~~~~ - Nova: <18.2.4,>=19.0.0<19.1.0,>=20.0.0<20.1.0 Description ~~~~~~~~~~~ Paul Carlton from HP reported a vulnerability in Nova. An attacker with read access to the serviceâ€™s logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. Patches ~~~~~~~ - https://review.opendev.org/707845 (Queens) - https://review.opendev.org/704255 (Rocky) - https://review.opendev.org/702181 (Stein) - https://review.opendev.org/696685 (Train) - https://review.opendev.org/220622 (Ussuri) Credits ~~~~~~~ - Paul Carlton from HP (CVE-2015-9543) References ~~~~~~~~~~ - https://launchpad.net/bugs/1492140 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-9543 Notes ~~~~~ - The stable/queens branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley, on behalf of OpenStack Vulnerability Management

1 0

[oslo][release] oslo.limit mistakenly released as 1.0.0
by Ben Nemec 19 Feb '20

19 Feb '20

Hi, We seem to have created a bit of a problem with the latest oslo.limit release. In keeping with our general policy of bumping the major version when we release libraries without py2 support, oslo.limit got bumped to 1.0. Unfortunately, being a pre-1.0 library it should have only had the minor version bumped. This puts us in an awkward situation since the library is still under heavy development and we expect the API will change, possibly multiple times, before we're ready to commit to a stable API. We also need the ability to continue doing releases during development so we can test the library with consuming projects. I can think of a few options, although I won't guarantee all of these are even possible: * Unpublish 1.0.0 and do further pre-1.0 development on a feature branch cut from before we released 1.0.0. Once we're ready for "1.0", we merge the feature branch to master and release it as 2.0.0. * Stick a big disclaimer in the 1.0.0 docs that it is still under development and proceed to treat 1.0 the same as we would have treated a pre-1.0 library. Again, when ready for "1.0" we tag it 2.0.0. * Make our breaking changes as needed and just continue bumping the major version every release. This unfortunately makes it hard to communicate via the version when the library is ready for use. :-/ * [some better idea that you suggest :-)] Any input on the best way to handle this is greatly appreciated. Thanks. -Ben

9 22

[vmware][hyperv][kolla] Is there any interest? (or should we deprecate and remove?)
by Radosław Piliszek 19 Feb '20

19 Feb '20

Hello Fellow Stackers, In Kolla and Kolla-Ansible we have some support for VMware (both hypervisor and networking controller stuff) and Hyper-V. The issue is the relevant code is in pretty bad shape and we had no recent reports about these being used nor working at all for that matter and we are looking into dropping support for these. Please respond if you are interested in these. Long term we would require access to some CI running these to really keep things in shape. -yoctozepto

1 1

Re: [openstack-dev][kuryr] Not working in ARM64 (as Node)
by mdulko＠redhat.com 19 Feb '20

19 Feb '20

Hi, So from this run you need the kuryr-controller logs. Apparently the pod never got annotated with an information about the VIF. Thanks, Michał On Fri, 2020-02-07 at 05:14 +0000, VeeraReddy wrote: > Hi mdulko, > Thanks for your support. > > As you mention i removed readinessProbe and > livenessProbe from Kuryr pod definitions. Still i am facing issue , unable to create pod. > > > > > Attached kubelet and kuryr-cni logs. > > > > Regards, > Veera. > > > On Thursday, 6 February, 2020, 05:19:12 pm IST, <mdulko(a)redhat.com> wrote: > > > Hm, nothing too troubling there too, besides Kubernetes not answering > on /healthz endpoint. Are those full logs, including the moment you > tried spawning a container there? It seems like you only pasted the > fragments with tracebacks regarding failures to read /healthz endpoint > of kube-apiserver. That is another problem you should investigate - > that causes Kuryr pods to restart. > > At first I'd disable the healthchecks (remove readinessProbe and > livenessProbe from Kuryr pod definitions) and try to get fresh set of > logs. > > On Thu, 2020-02-06 at 10:46 +0000, VeeraReddy wrote: > > Hi mdulko, > > Please find kuryr-cni logs > > http://paste.openstack.org/show/789209/ > > > > > > Regards, > > Veera. > > > > > > On Thursday, 6 February, 2020, 04:08:35 pm IST, <mdulko(a)redhat.com> wrote: > > > > > > Hi, > > > > The logs you provided doesn't seem to indicate any issues. Please > > provide logs of kuryr-daemon (kuryr-cni pod). > > > > Thanks, > > Michał > > > > On Thu, 2020-02-06 at 07:09 +0000, VeeraReddy wrote: > > > Hi, > > > I am trying to run kubelet in arm64 platform > > > 1. Generated kuryr-cni successfullly. using kur-cni Dockerfile > > > 2. Generated kuryr-cni-arm64 container. > > > 3. my kube-kuryr-arm64.yml (http://paste.openstack.org/show/789208/) > > > > > > My master node in x86 installed successfully using devstack > > > > > > While running kubelet in arm platform , not able to create kubelet interface (kubelet logs: http://paste.openstack.org/show/789206/) > > > > > > COntroller logs: http://paste.openstack.org/show/789209/ > > > > > > Please help me to fix the issue > > > > > > Veera. > > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > Veera. > > > > > >

2 6

Virtio memory balloon driver
by Albert Braden 18 Feb '20

18 Feb '20

When we build a Centos 7 VM with 1.4T RAM it fails with "[ 17.797177] BUG: unable to handle kernel paging request at ffff988b19478000" I asked in #centos and they asked me to show a list of devices from a working VM (if I use 720G RAM it works). This is the list: [root@alberttest1 ~]# lspci 00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02) 00:01.0 ISA bridge: Intel Corporation 82371SB PIIX3 ISA [Natoma/Triton II] 00:01.1 IDE interface: Intel Corporation 82371SB PIIX3 IDE [Natoma/Triton II] 00:01.2 USB controller: Intel Corporation 82371SB PIIX3 USB [Natoma/Triton II] (rev 01) 00:01.3 Bridge: Intel Corporation 82371AB/EB/MB PIIX4 ACPI (rev 03) 00:02.0 VGA compatible controller: Cirrus Logic GD 5446 00:03.0 Ethernet controller: Red Hat, Inc. Virtio network device 00:04.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:05.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:06.0 SCSI storage controller: Red Hat, Inc. Virtio block device 00:07.0 Unclassified device [00ff]: Red Hat, Inc. Virtio memory balloon [root@alberttest1 ~]# lsusb Bus 001 Device 002: ID 0627:0001 Adomax Technology Co., Ltd Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub They suspect that the "Virtio memory balloon" driver is causing the problem, and that we should disable it. I googled around and found this: http://www.linux-kvm.org/page/Projects/auto-ballooning It looks like memory ballooning is deprecated. How can I get rid of the driver? Also they complained about my host bridge device; they say that we should have a newer one: 00:00.0 Host bridge: Intel Corporation 440FX - 82441FX PMC [Natoma] (rev 02) Where can I specify the host bridge? <bugs_> ok ozzzo one of the devices is called "virtio memory balloon" [13:18:12] <bugs_> do you see that? [13:18:21] <ozzzo> yes [13:18:47] <bugs_> i suggest you google that and read about what it does - i think it would [13:19:02] <bugs_> be worth trying to disable that device on your larger vm to see what happens [13:19:18] <ozzzo> ok I will try that, thank you [13:19:30] * Altiare (~Altiare@unaffiliated/altiare) has quit IRC (Quit: Leaving) [13:21:45] * Sheogorath[m] (sheogora1(a)gateway/shell/matrix.org/x-uiiwpoddodtgrwwz) joins #centos [13:22:06] <@TrevorH> I also notice that the VM seems to be using the very old 440FX and there's a newer model of hardware available that might be worth checking [13:22:21] <@TrevorH> 440FX chipset is the old old pentium Pro chipset! [13:22:32] <@TrevorH> I had one of those in about 1996

4 11

ops meetups team meeting 2020-2-18
by Chris Morgan 18 Feb '20

18 Feb '20

The OpenStack Ops Meetups team meeting was held today on IRC, minutes linked below. Key links vancouver opendev+ptg : https://www.openstack.org/events/opendev-ptg-2020/ South Korea Ops Meetup proposal : https://etherpad.openstack.org/p/ops-meetup-2nd-korea-2020 OpenInfra summit 2020 announced for Berlin, Oct 19-23 : https://superuser.openstack.org/articles/inside-open-infrastructure-the-lat… The meetups team will be proposing content for Vancouver and will shortly solicit feedback on preferred dates for the Ops Meetups even in South Korea. Please follow https://twitter.com/osopsmeetup for more announcements. Minutes: <•openstack> Meeting ended Tue Feb 18 15:37:42 2020 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) 10:37 AM Minutes: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… 10:37 AM Minutes (text): http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… 10:37 AM Log: http://eavesdrop.openstack.org/meetings/ops_meetup_team/2020/ops_meetup_tea… Chris Morgan - on behalf of the OpenStack Ops Meetups team ( https://wiki.openstack.org/wiki/Ops_Meetups_Team) -- Chris Morgan <mihalis68(a)gmail.com>

1 0

Re: [Release-job-failures] Release of openstack/puppet-keystone for ref refs/tags/16.1.0 failed
by Thierry Carrez 18 Feb '20

18 Feb '20

We had a series of failures uploading Puppet artifacts to the forge: Forge API failed to upload tarball with code: 500 errors: An error was encountered while processing your request, please try again later. This affected: openstack/puppet-ceilometer (16.1.0) https://zuul.opendev.org/t/openstack/build/5b0b890d777545c098ea88b70eb89b52 openstack/puppet-panko (16.1.0) https://zuul.opendev.org/t/openstack/build/073cbb3b72ac4241aa1802ccbaf4ada5 openstack/puppet-murano (16.1.0) https://zuul.opendev.org/t/openstack/build/b07a78bd59c84176bb7d9d2f1e0f635c openstack/puppet-keystone (16.1.0) https://zuul.opendev.org/t/openstack/build/be7510a717d3413ab008ab3d34db3672 As a result the tarballs were not uploaded to tarballs.openstack.org either. I think we should reenqueue the tag reference to retrigger the release-openstack-puppet job for those ? -- Thierry Carrez (ttx)

2 1

[neutron] Can br-ex and br-tun use the same interface?
by Zhengyu Pan 18 Feb '20

18 Feb '20

hi, I have only two physical interfaces. In my deploying, network node and compute node are the same. Can Bridge br-tun and br-ex use the same interface when using vxlan network type ? management network use the other interface?

3 5

[nova][cinder] What should the behaviour of extend_volume be with attached encrypted volumes?
by Lee Yarwood 18 Feb '20

18 Feb '20

Hello all, The following bug was raised recently regarding a failure to extend attached encrypted volumes: Failing to extend an attached encrypted volume https://bugs.launchpad.net/nova/+bug/1861071 I've worked up a series below that resolves this for LUKSv1 volumes by taking the LUKSv1 header into account before calling Libvirt to resize the block device within the instance: https://review.opendev.org/#/q/topic:bug/1861071 This results in the instance visable block device being resized to a size just smaller than that requested through Cinder's API. My question to the list is if that behaviour is acceptable given the same call to extend an attached unencrypted volume *will* grow the instance visable block device to the requested size? Many thanks in advance, -- Lee Yarwood A5D1 9385 88CB 7E5F BE64 6618 BCA6 6E33 F672 2D76

1 1

[kolla][zun] Zun image source
by Hongbin Lu 18 Feb '20

18 Feb '20

Hi Kolla team, I was looking into the CentOS Zun image downloaded from DockerHub. It looks the source code is from stable/train branch: $ docker run kolla/centos-source-zun-compute:master cat zun/zun.egg-info/pbr.json {"git_version": "25e56636", "is_release": false} The git_version points to the stable/train branch, but I think it should point to the master branch. FWIW, I also checked the Ubuntu image and the git version in there looks correct: $ docker run kolla/ubuntu-source-zun-compute:master cat zun/zun.egg-info/pbr.json {"git_version": "6fbf52ae", "is_release": false} Any suggestion? Best regards, Hongbin

2 1

[tripleo] deep-dive containers & tooling
by Emilien Macchi 17 Feb '20

17 Feb '20

Hi folks, On Friday I'll do a deep-dive on where we are with container tools. It's basically an update on the removal of Paunch, what will change etc. I'll be on Bluejeans at 2pm UTC, anyone is welcome to join and ask questions or give feedback. https://bluejeans.com/6007759543 Link of the slides: https://docs.google.com/presentation/d/111sEwyIKxx2NCqTIQizdPNVaRbv0HAT5YeM… -- Emilien Macchi

2 4

Re: [Ask OpenStack] 7 updates about "galera", "rabbiitmq", "auth_token", "keysone", "swift-proxy" and more
by Gaurav Goyal 17 Feb '20

17 Feb '20

Dear Openstack Experts, We are using a big openstack setup in our organization and different operation teams adds new computes nodes to it. We as system admin of this Openstack environment wants to audit the configuration parameters on all the nodes. Can you please help to suggest a better way (Tools) to audit this environment? Awaiting your kind reply. Regards Gaurav Goyal On Wed, Feb 12, 2020 at 10:26 PM <communitymngr(a)openstack.org> wrote: > Dear Gaurav Goyal, > > Ask OpenStack has these updates, please have a look: > > - Kubernetes cluster created with Magnum doesn't work > <https://ask.openstack.org/en/question/126164/kubernetes-cluster-created-wit…> (new > question) > - how do i list the top objects consuming more space in the swift > container > <https://ask.openstack.org/en/question/126161/how-do-i-list-the-top-objects-…> (new > question) > - action requests is empty > <https://ask.openstack.org/en/question/126160/action-requests-is-empty/?sort…> (new > question) > - How to Migrate OpenStack Instance from one Tenant to another > <https://ask.openstack.org/en/question/126159/how-to-migrate-openstack-insta…> (new > question) > - Architecture of keystone, swift and memcached together > <https://ask.openstack.org/en/question/126158/architecture-of-keystone-swift…> (3 > rev) > - why is octavia not using keystone public endpoint to validate tokens? > <https://ask.openstack.org/en/question/126156/why-is-octavia-not-using-keyst…> (new > question) > - Error while launching instance on openstack > <https://ask.openstack.org/en/question/126150/error-while-launching-instance…> (2 > rev, 1 ans, 3 ans rev) > > To change frequency and content of these alerts, please visit your user > profile > <https://ask.openstack.org/en/users/18141/gaurav-goyal/subscriptions/>. > To unsubscribe, visit this page > <https://ask.openstack.org/en/users/unsubscribe/?key=89e52fdededaf7e8066737b…> > If you believe that this message was sent in an error, please email about > it the forum administrator at communitymngr(a)openstack.org. > ------------------------------ > > Sincerely, > Ask OpenStack Administrator > > To unsubscribe: there's a big "Stop Email" button in the link to your user > profile above. >

1 0

[neutron] bug deputy report (Feb 10-17)
by Akihiro Motoki 17 Feb '20

17 Feb '20

Hi, Here is a neutron bug deputy report last week. While 15 new bugs were reported, several bugs needs further investigation and are not triaged yet. I will look into them but it would be great if they need attentions. --- Undecided - https://bugs.launchpad.net/neutron/+bug/1862611 Neutron try to register invalid host to nova aggregate for ironic routed network Undecided It was covered by the last week report, but it needs more eyes familiar with routed network. - https://bugs.launchpad.net/neutron/+bug/1862851 update_floatingip_statuses: StaleDataError: UPDATE statement on table 'standardattributes' expected to update 1 row(s); 0 were matched. Undecided Needs to be checked by folks familiar with DVR. It looks like a race condition. - https://bugs.launchpad.net/neutron/+bug/1862932 [neutron-bgp-dragent] passive agents send wrong number of routes Undecided Needs attention by folks familiar with dynamic-routing stuff. - https://bugs.launchpad.net/neutron/+bug/1863068 Dublicated Neutron Meter Rules in different projects kills metering Undecided - https://bugs.launchpad.net/neutron/+bug/1863091 IPVS setup fails with openvswitch firewall driver, works with iptables_hybrid Undecided - https://bugs.launchpad.net/neutron/+bug/1863110 2/3 snat namespace transitions to master Undecided - https://bugs.launchpad.net/neutron/+bug/1863201 stein regression listing security group rules Undecided - https://bugs.launchpad.net/neutron/+bug/1863213 Spawning of DHCP processes fail: invalid netcat options Undecided ralonsoh assigned himself. Any update on this? Incomplete - https://bugs.launchpad.net/neutron/+bug/1863206 Port is reported with 'port_security_enabled=True' without port-security extension Incomplete I think the bug author misunderstood the default of port-security extension behavior. Double check would be appreciated. Confirmed - https://bugs.launchpad.net/neutron/+bug/1863577 [ovn] tempest.scenario.test_network_v6.TestGettingAddress tests failing 100% times Confirmed, High In Progress - https://bugs.launchpad.net/neutron/+bug/1862618 [OVN] functional test test_virtual_port_delete_parents is unstable In Progress, Medium - https://bugs.launchpad.net/neutron/+bug/1862703 Neutron remote security group does not work In Progress, High - https://bugs.launchpad.net/neutron/+bug/1862648 [OVN] Reduce the number of tables watched by MetadataProxyHandler High, Fix Released - https://bugs.launchpad.net/neutron/+bug/1862893 [OVN]Updating a QoS policy for a port will cause a KeyEerror In Progress, Low Fix Released - https://bugs.launchpad.net/neutron/+bug/1862927 "ncat" rootwrap filter is missing Fix Released The root cause turned out that we need to specify rootwrap filter config by abspath.

1 0

[charms] OpenStack Charms 20.02 release is now available
by Peter Matulis 17 Feb '20

17 Feb '20

The 20.02 release of the OpenStack Charms is now available. This release brings several new features to the existing OpenStack Charms deployments for Queens, Rocky, Stein, Train, and many other stable combinations of Ubuntu + OpenStack. Please see the Release Notes for full details: https://docs.openstack.org/charm-guide/latest/2002.html == Highlights == * New charm: manila-ganesha There is a new charm to support Ganesha for use with Manila and CephFS: manila-ganesha. This charm, as well as the requisite manila and ceph-fs charms, have been promoted to supported status. * Swift global cluster With OpenStack Newton or later, support for a global cluster with Swift is available as a tech preview. * OVN With OpenStack Train or later, support for integration with Open Virtual Network (OVN) is available as a tech preview. * MySQL8 With Ubuntu 19.10 or later, support for MySQL 8 is available as a tech preview. * New charms: watcher and watcher-dashboard There are two new charms to support Watcher, the resource optimization service for multi-tenant OpenStack-based clouds: watcher and watcher-dashboard. This is the first release of these charms and they are available as a tech preview. * Policy overrides The policy overrides feature provides operators with a mechanism to override policy defaults on a per-service basis. The last release (19.10) introduced the feature for a number of charms. This release adds support for openstack-dashboard and octavia charms. * Disabling snapshots as a boot source for the OpenStack dashboard Snapshots can be disabled as valid boot sources for launching instances in the dashboard. This is done via the new 'disable-instance-snapshot' configuration option in the openstack-dashboard charm. == OpenStack Charms team == The OpenStack Charms team can be contacted on the #openstack-charms IRC channel on Freenode. == Thank you == Lots of thanks to the below 49 charm contributors who squashed 53 bugs, enabled support for a new release of OpenStack, improved documentation, and added exciting new functionality! Liam Young Corey Bryant Peter Matulis Sahid Orentino Ferdjaoui Frode Nordahl Alex Kavanagh David Ames Chris MacNaughton Stamatis Katsaounis inspurericzhang Tiago Pasqualini Andrew McLeod ShangXiao Ryan Beisner James Page Felipe Reyes kangyufei Edward Hope-Morley Adam Dyess Xuan Yandong Arif Ali Chris Johnston wangfaxin Aurelien Lourot Alexandros Soumplis Jose Guedez Qitao Tytus Kurek Seyeong Kim Dongdong Tao Haw Loeung Jorge Niedbalski Qiu Fossen Yanos Angelopoulos Syed Mohammad Adnan Karim JiaSiRui Xiyue Wang Adam Dyess Jose Delarosa Alexander Balderson Andreas Jaeger Dmitrii Shcherbakov Jacek Nykis Thobias Trevisan Hemanth Nakkina Shuo Liu Drew Freiberger zhangboye Aggelos Kolaitis -- OpenStack Charms Team

1 0

[blazar] Spec for flexible reservation policy enforcement
by Jason Anderson 17 Feb '20

17 Feb '20

Hi all, Last week I introduced a final version of the flexible reservation usage spec[1]. This builds on the original spec proposed by Pierre Riteau some months ago. The purpose of the functionality is to allow operators to define various limits or more sophisticated policies around advanced reservations, in order to prevent e.g., a single user from reserving all resources for an indefinite amount of time. Instead of a quota-based approach, the decisions are delegated to an external service; a future improvement could be providing a default implementation (perhaps using quotas and some default time limits) that can be deployed alongside Blazar. I would appreciate reviews from the core team and feedback from others as to the design. This work is planned for Ussuri pending spec approval. Thanks, /Jason [1]: https://review.opendev.org/#/c/707042/ -- Jason Anderson Chameleon DevOps Lead Consortium for Advanced Science and Engineering, The University of Chicago Mathematics & Computer Science Division, Argonne National Laboratory

1 0

[goals][Drop Python 2.7 Support] Week R-13 Update (we are at deadline)
by Ghanshyam Mann 17 Feb '20

17 Feb '20

Hello Everyone, Below is the progress on "Drop Python 2.7 Support" at end of R-13 week. Schedule: https://governance.openstack.org/tc/goals/selected/ussuri/drop-py27.html#sc… Highlights: ======== * Deadline was M-2 (R-13 week). * Things are breaking and being fixed daily. * Do not worry about the gate failure, it is better to break it now and fix so that we can smoothly release Ussuri. * Tempest has dropped the py2 and stop running the py2 jobs and so does devstack. * tempest-full job has been moved to py2 (it started running on py3 when devstack default to py3). This job is not supposed to run on master gate (except d-g which should keep running on py2 jobs). tempest-full-py3 is the py3 version of it. But few master jobs derived from tempest-full needs to either start using tempest-full-py3 or explicitly enable py3. I will be working on those next week. * Bugs & Status: No open bugs as of now. Below is the status of last week's bugs. ** QA dropped py3.5 support also from many tooling like stackviz etc which are branchless and should keep working on stable py3.5 env. We have reverted the dropping py3.5 and working now. ** Nova stable branches are still falling for the u-c reason on nova-live-migration. Fixes are up[2] *** Fixed and gate is green. * * Tempest tox 'all-plugin' usage issue[3] *** Fixed and gate is green. ** neutron-vpass in-tree plugin issue *** Fixed and gate is green. NOTE: I know few py2.7 drop patches are failing on few projects, I will continue debugging those. Help from the failing project will be greatly appreciated to meet the deadline. Project wise status and need reviews: ============================ Phase-1 status: The OpenStack services have not merged the py2 drop patches: NOTE: This was supposed to be completed by milestone-1 (Dec 13th, 19). * Adjutant ** https://review.opendev.org/#/c/706723/ * Masakari ** https://review.opendev.org/#/c/694551/ * Qinling ** https://review.opendev.org/#/c/694687/ Phase-2 status: By today, we should be completing the phase-2 work which is nothing but drop py2 from everything except requirement repo. But we have few repos to merge the patches on priority. * Open review: https://review.opendev.org/#/q/topic:drop-py27-support+status:open How you can help: ============== - Review the patches. Push the patches if I missed any repo. [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-February/012463… [2] https://review.opendev.org/#/q/I8190f93e0a754fa59ed848a3a230d1ef63a06abc [3] https://bugs.launchpad.net/tempest/+bug/1862240 [4] https://review.opendev.org/#/q/topic:bug/1862240+(status:open+OR+status:mer… -gmann

2 2

[cinder][nova] volume-local-cache meeting results
by Brian Rosmaita 16 Feb '20

16 Feb '20

Thanks to everyone who attended this morning, we had a productive meeting. If you missed it and want to know what happened: etherpad: https://etherpad.openstack.org/p/volume-local-cache recording: https://youtu.be/P9bouCCoqVo Liang Fang will be updating the specs to reflect what was discussed: cinder spec: https://review.opendev.org/#/c/684556/ nova spec: https://review.opendev.org/#/c/689070/ cheers, brian

2 1

Automatically remove /var/log directory from the openstack instance
by Md. Ziaul Haque 15 Feb '20

15 Feb '20

Hello, During few days we have faced that from the instance /var/log directory log have been removed automatically after the unexpected reboot. We have faced this issue with centos and ubuntu images. Openstack version is rocky and qemu-kvm version 2.12.0 . If anybody has faced the same issue, kindly help us for solving this issue Thanks & Regards Ziaul

1 0

[queens][config_drive] not working for ubuntu bionic
by Ignazio Cassano 15 Feb '20

15 Feb '20

Hello, I configured config drive and centos instances works fine with it. Ubuntu bionic tries to get metadata from network and cloud-init does not set hostname and does not insert keys for ssh. Any help, please Ignazio

4 10

[queens]neutron][metadata] configuration
by Ignazio Cassano 15 Feb '20

15 Feb '20

Hello everyone, in my installation of Queees I am using many provider networks. I don't use openstack router but only dhcp. I would like my instances to reach the metadata agent without the 169.154.169.254 route, so I would like the provider networks to directly reach the metadata agent on the internal api vip. How can I get this configuration? Thank you Ignazio

3 7

UC Nominations now open
by Amy Marrich 14 Feb '20

14 Feb '20

The nomination period for the February User Committee elections is now open. Any individual member of the Foundation who is an Active User Contributor (AUC) can propose their candidacy (except the two sitting UC members elected in the previous election). Self-nomination is common; no third party nomination is required. Nominations can be made by sending an email to the user-committee(a)lists.openstack.org mailing-list[0], with the subject: “UC candidacy” by February 16, 23:59 UTC aa voting will begin on February 17. The email can include a description of the candidate platform. The candidacy is then confirmed by one of the election officials, after verification of the electorate status of the candidate. Criteria for AUC status can be found at https://superuser.openstack.org/articles/auc-community/. If you are still not sure of your status and would like to verify in advance please email myself(amy(a)demarco.com) and Rain Leander(rleander(a)redhat.com) as we are serving as the Election Officials. Thanks, Amy Marrich (spotz) 0 - Please make sure you are subscribed to this list before sending in your nomination.

1 1

[tripleo] RDO image server migration
by Wesley Hayutin 14 Feb '20

14 Feb '20

FYI... Possible interruption on 3rd party ovb jobs. ---------- Forwarded message --------- From: Daniel Pawlik <dpawlik(a)redhat.com> Date: Fri, Feb 14, 2020 at 8:47 AM Subject: [rdo-dev] [rdo-users] [infra] RDO image server migration To: <dev(a)lists.rdoproject.org> Hello, We are going to migrate images.rdoproject.org to our new cloud provider, starting on February 17th at 10 AM UTC. Migration should be transparent to the end user (scripts and job definition are using new image server). However, you have to keep in mind the unforeseen events that may occur. Write access to the old server will be disabled and until DNS propagation is not done, you could have read-only access. If you have any doubts or concerns, please do not hesitate to contact: - Daniel Pawlik <dpawlik(a)redhat.com> - Javier Pena <jpena(a)redhat.com> Regards, Daniel _______________________________________________ dev mailing list dev(a)lists.rdoproject.org http://lists.rdoproject.org/mailman/listinfo/dev To unsubscribe: dev-unsubscribe(a)lists.rdoproject.org

1 0

[tripleo] RDO image server migration
by Daniel Pawlik 14 Feb '20

14 Feb '20

Hello, We are going to migrate images.rdoproject.org to our new cloud provider, starting on February 17th at 10 AM UTC. Migration should be transparent to the end user (scripts and job definition are using new image server). However, you have to keep in mind the unforeseen events that may occur. Write access to the old server will be disabled and until DNS propagation is not done, you could have read-only access. If you have any doubts or concerns, please do not hesitate to contact: - Daniel Pawlik <dpawlik(a)redhat.com> - Javier Pena <jpena(a)redhat.com> Regards, Daniel

1 0

[security] Vancouver PTG Planning - Security SIG
by Gage Hugo 14 Feb '20

14 Feb '20

Hello, It's about that time again, to start planning for the next PTG. To help gauge interest and track any topics that anyone is interested in, I've created an etherpad: https://etherpad.openstack.org/p/yvr-ptg-security-sig Please add your name if you plan to attend and any topic ideas that you are interested in. Thanks!

1 0

[release] Release countdown for week R-12, February 17-21
by Sean McGinnis 14 Feb '20

14 Feb '20

Development Focus ----------------- We are now past the Ussuri-2 milestone, and entering the last development phase of the cycle. Teams should be focused on implementing planned work for the cycle. Now is a good time to review those plans and reprioritize anything if needed based on the what progress has been made and what looks realistic to complete in the next few weeks. General Information ------------------- Looking ahead to the end of the release cycle, please be aware of the feature freeze dates. Those vary depending on deliverable type: * General libraries (except client libraries) need to have their last feature release before Non-client library freeze (April 2). Their stable branches are cut early. * Client libraries (think python-*client libraries) need to have their last feature release before Client library freeze (April 9) * Deliverables following a cycle-with-rc model (that would be most services) observe a Feature freeze on that same date, April 9. Any feature addition beyond that date should be discussed on the mailing-list and get PTL approval. After feature freeze, cycle-with-rc deliverables need to produce a first release candidate (and a stable branch) before RC1 deadline (April 23) * Deliverables following cycle-with-intermediary model can release as necessary, but in all cases before Final RC deadline (May 7) Upcoming Deadlines & Dates -------------------------- Non-client library freeze: April 2 (R-6 week) Client library freeze: April 9 (R-5 week) Ussuri-3 milestone: April 9 (R-5 week) OpenDev+PTG Vancouver: June 8-11

1 0

[tripleo] TripleO CI Summary: Sprint 42
by Rafael Folco 14 Feb '20

14 Feb '20

Greetings, The TripleO CI team has just completed Sprint 42 / Unified Sprint 21 (Jan 23 thru Feb 12). The following is a summary of completed work during this sprint cycle: - Started refactoring Promoter code into a modular implementation w/ testing oriented design and accommodating the changes for the new promotion pipeline. - Completed building CentOS8 containers with required repositories. This is still an unofficial build as some of the repositories (like Ceph) are not from RDO/TripleO. - Refined the component pipeline design [3] w/ the new aggregated hash containing all promoted components. Continued to implement the downstream version of the component pipeline. - Translated get-hash into a separated role in ci-config repo, de-attaching from promote-hash role in config. Added support for the new component and integration jobs. - Made improvements to the collect-logs plugin as part of the shared goals for the combined CI team. - Built CI workflow to follow successful manual standalone deployment using an IPA server. The TLS CI job is not running yet and still needs to be activated. Ruck/Rover Notes: - There were at least four upstream gate outages during this sprint. All have been resolved at this time. Notes are here [4]. The planned work for the next sprint [1] extends the work started in the previous sprint and focuses on the following: - Build the CentOS8 pipeline starting with the base jobs to build containers and promote hashes. - Replicate the component jobs to all available components and build the new promotion pipeline in CentOS8. - Continue the promoter code refactoring and converting the legacy code in a modular implementation that can be tested more efficiently. - Continue the collect-logs effort to make it a shared tool used by multiple teams. - Collaborate with the RDO team in migrating 3rd party CI to vexxhost. The Ruck and Rover for this sprint are Wesley Hayutin (weshay) and Marios Andreou (marios). Please direct questions or queries to them regarding CI status or issues in #tripleo, ideally to whomever has the ‘|ruck’ suffix on their nick. Ruck/rover notes to be tracked in etherpad [2]. Thanks, rfolco [1] https://tree.taiga.io/project/tripleo-ci-board/taskboard/unified-sprint-22 [2] https://etherpad.openstack.org/p/ruckroversprint22 [3] https://hackmd.io/5uYRmLaOTI2raTbHWsaiSQ [4] https://etherpad.openstack.org/p/ruckroversprint21

1 0

[Outreachy] Call for mentors, projects by Feb 25
by Samuel de Medeiros Queiroz 14 Feb '20

14 Feb '20

Hi all, TL;DR OpenStack is participating of Outreachy! Mentors, please submit project proposals by Feb 25. More info: https://www.outreachy.org/communities/cfp/openstack/ Outreachy's goal is to support people from groups underrepresented in the technology industry. The upcoming round runs from May to August 2020. Now that we are confirmed as a participating community, we welcome experienced community contributors to help out as mentors, who need to submit project proposals. Therefore, if you have an interesting project that meets the criteria, please submit it as soon as possible. You can find more information about the program, project criteria, mentor requirements, and submit your project at the Call for mentors page <https://www.outreachy.org/communities/cfp/openstack/> [1]. I have participated twice of Outreachy as a mentor and I can tell you it was a great opportunity to get someone onboard the community and, of course, to learn from them. Besides getting work done (which is great), we happen to make our community more diverse, while helping with its continuity. Please let me know if you have any questions. Thanks, Samuel [1] https://www.outreachy.org/communities/cfp/openstack/

1 0

[keystone] Keystone Team Update - Week of 10 February 2020
by Vishakha Agarwal 13 Feb '20

13 Feb '20

# Keystone Team Update - Week of 10 February 2020 ## News ### YVR PTG Keystone People can write down the topics in etherpad [1] to have a brief discussion with the team. [1] https://etherpad.openstack.org/p/yvr-ptg-keystone ### User Support and Bug Duty Every week the duty is being rotated between the members. The person-in-charge for bug duty for current and upcoming week can be seen on the etherpad [2] [2] https://etherpad.openstack.org/p/keystone-l1-duty ## Open Specs Ussuri specs: https://bit.ly/2XDdpkU Ongoing specs: https://bit.ly/2OyDLTh ## Recently Merged Changes Search query: https://bit.ly/2pquOwT We merged 10 changes this week. ## Changes that need Attention Search query: https://bit.ly/2tymTje There are 21 changes that are passing CI, not in merge conflict, have no negative reviews and aren't proposed by bots. ### Priority Reviews * Ussuri Roadmap Stories - Groups in keystone SAML assertion https://tree.taiga.io/project/keystone-ussuri-roadmap/us/33 https://review.opendev.org/#/c/588211/ Add openstack_groups to assertion - Add support for modifying resource options to CLI tool https://tree.taiga.io/project/keystone-ussuri-roadmap/us/53 https://review.opendev.org/#/c/697444/ Adding options to user cli ## Bugs This week we opened 3 new bugs and closed 2. Bugs opened (3) Bug #1862802 (keystone:Wishlist): Avoid the default domain usage when the Domain is not specified in the project creation - Opened by Raildo Mascena de Sousa Filho https://bugs.launchpad.net/keystone/+bug/1862802 Bug #1862606 (keystone:Undecided): LDAP support broken if UTF8 characters in DN (python2) - Opened by Rafal Ramocki https://bugs.launchpad.net/keystone/+bug/1862606 Bug #1863098 (keystone:Undecided): Install and configure in keystone - Opened by Assassins! https://bugs.launchpad.net/keystone/+bug/1863098 Bugs closed (2) Bug #1808305 (python-keystoneclient:Won't Fix) https://bugs.launchpad.net/python-keystoneclient/+bug/1808305 Bug #1823258 (keystone:Undecided): RFE: Immutable Resources - Fixed by Colleen Murphy https://bugs.launchpad.net/keystone/+bug/1823258 ## Milestone Outlook https://releases.openstack.org/ussuri/schedule.html This week marks the milestone 2 spec freeze. Feature proposal freeze is in week of March 9. This means code implementing approved specs needs to be in a reviewable, non-WIP state. ## Help with this newsletter Help contribute to this newsletter by editing the etherpad: https://etherpad.openstack.org/p/keystone-team-newsletter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: RHOSP-like installation
by Amy Marrich 13 Feb '20

13 Feb '20

Adding the discuss list back in On Thu, Feb 13, 2020 at 5:16 PM Amy Marrich <amy(a)demarco.com> wrote: > Volodymyr, > > I'm sure someone from the TripleO team will pipe in, but TripleO is closer > to RHOSP then RDO. When I was playing with it in the past I found Keith > Tenzer's blogs helpful. There might be more recent ones then this but > here's a link to one: > > > https://keithtenzer.com/2015/10/14/howto-openstack-deployment-using-tripleo… > > Thanks, > > Amy Marrich (spotz) > > On Thu, Feb 13, 2020 at 5:05 PM Volodymyr Litovka <doka.ua(a)gmx.com> wrote: > >> Dear colleagues, >> >> while having a good experience with Openstack on Ubuntu, we're facing a >> plenty of questions re RHOSP installation. >> >> The primary requirement for our team re RHOSP is to get a knowledge on >> RHOSP - how to install it and maintain. As far as I understand, RDO is >> the closest way to reach this target but which kind of installation it's >> better to use? - >> * plain RDO installation as described in generic Openstack guide at >> https://docs.openstack.org/install-guide/index.html (specifics in >> RHEL/CentOS sections) >> * or TripleO installation as described in http://tripleo.org/install/ >> * or, may be, it is possible to use RHOSP in kind of trial mode to get >> enough knowledge on this platform? >> >> Our lab consists of four servers (64G RAM, 16 cores@2GHz) which we're >> going to use in "ultraconverged" mode - as both controller and agent >> (compute/network/storage) nodes (controllers, though, can be in >> virsh-controlled VMs). In case of TripleO scenario, 4th server can be >> used for undercloud role. This installation is intended not for >> production use, but rather for learning purposes, so no special >> requirements for productivity. The only special requirement - to be >> functionally as much as close to canonical RHOSP platform. >> >> I will highly appreciate your suggestions on this issue. >> >> Thank you. >> >> -- >> Volodymyr Litovka >> "Vision without Execution is Hallucination." -- Thomas Edison >> >> >>

2 1

[all][PTL][tc] U Community Goal: Project PTL & Contrib Docs Update #2
by Kendall Nelson 13 Feb '20

13 Feb '20

Hello! First off I want to say thank you to the 4 projects that have already gotten started/completed the goal! Good work Glance, Neutron, Searchlight, and Watcher :) For the rest of the projects, thankfully we have more time to work on this goal than for the dropping py2 goal given that its documentation we aren't restricted to it being completed by feature freeze. That said, the sooner the better :) One thing I did want to draw attention to was the discussion around adding an include for CONTRIBUTING.rst to doc/source/contributor/contributing.rst[4] and the patch I have to add it to the template[5]. I also pushed a patch to clarify doc/source/contributor/contributing.rst vs CONTRIBUTING.rst -Kendall (diablo_rojo) [1] Goal: https://governance.openstack.org/tc/goals/selected/ussuri/project-ptl-and-c… [2] Docs Template: https://opendev.org/openstack/cookiecutter/src/branch/master/%7b%7bcookiecu… [3] Tracking: https://storyboard.openstack.org/#!/story/2007236 [4] TC Discussion: http://eavesdrop.openstack.org/irclogs/%23openstack-tc/%23openstack-tc.2020… [5] Patch to add include: https://review.opendev.org/#/c/707735/ [6] contributing.rst vs CONTRIBUTING.rst clarification patch: https://review.opendev.org/#/c/707736/

1 0

[tripleo] CI is RED py27 related
by Wesley Hayutin 13 Feb '20

13 Feb '20

Greetings, Most of the jobs went RED a few minutes ago. Again it's related to python27. Nothing is going to pass CI until this is fixed. See: https://etherpad.openstack.org/p/ruckroversprint21 We'll update the list when we have the required patches in. Thanks

2 5

[release] Release countdown for week R-13, February 10-14
by Sean McGinnis 13 Feb '20

13 Feb '20

Development Focus ----------------- The Ussuri-2 milestone is next week, on February 13! Ussuri-related specs should now be finalized so that teams can move to implementation ASAP. Some teams observe specific deadlines on the second milestone (mostly spec freezes): please refer to https://releases.openstack.org/ussuri/schedule.html for details. General Information ------------------- Libraries need to be released at least once per milestone period. Next week, the release team will propose releases for any library that has not been otherwise released since milestone 1. PTL's and release liaisons, please watch for these and give a +1 to acknowledge them. If there is some reason to hold off on a release, let us know that as well. A +1 would be appreciated, but if we do not hear anything at all by the end of the week, we will assume things are OK to proceed. Remember that non-library deliverables that follow the cycle-with-intermediary release model should have an intermediary release before milestone-2. Those who haven't will be proposed to switch to the cycle-with-rc model, which is more suited to deliverables that are released only once per cycle. Next week is also the deadline to freeze the contents of the final release. All new 'Ussuri' deliverables need to have a deliverable file (https://opendev.org/openstack/releases/src/branch/master/deliverables/ussuri ) and need to have done a release by milestone-2. The following new deliverables have not had a release yet, and will not be included in Ussuri unless a release is requested for them in the coming week: - adjutant, adjutant-ui, python-adjutantclient (Adjutant) - barbican-ui (Barbican) - js-openstack-lib (OpenStackSDK) - ovn-octavia-provider (Neutron) - sushy-cli (Ironic) - tripleo-operator-ansible (TripleO) Changes proposing those deliverables for inclusion in Ussuri have been posted, please update them with an actual release request before the milestone-2 deadline if you plan on including that deliverable in Ussuri, or -1 if you need one more cycle to be ready. Upcoming Deadlines & Dates -------------------------- Ussuri-2 Milestone: February 13 (R-13 week)

1 1

[nova] API updates week 20-7
by Ghanshyam Mann 13 Feb '20

13 Feb '20

Hello Everyone, Please find the Nova API updates of this week. Please add if I missed any BPs/API related work. API Related BP : ============ COMPLETED: 1. Add image-precache-support spec: - https://blueprints.launchpad.net/nova/+spec/image-precache-support Code Ready for Review: ------------------------------ 1. Nova API policy improvement - Topic: https://review.opendev.org/#/q/topic:bp/policy-defaults-refresh+(status:ope… - Weekly Progress: API till D is covered and ready for review. Fixed 5 bugs in policy while working on new defaults. - Review guide over ML - http://lists.openstack.org/pipermail/openstack-discuss/2019-August/008504.h… 2. Non-Admin user can filter their instance by availability zone: - Topic: https://review.opendev.org/#/q/topic:bp/non-admin-filter-instance-by-az+(st… - Weekly Progress: Code under review. efried needs to remove his -2 now as spec is merge 3. Boot from volume instance rescue - Topic: https://review.opendev.org/#/q/topic:bp/virt-bfv-instance-rescue+(status:op… - Weekly Progress: Code is in progress. Lee Yarwood has removed the WIP from patches so ready for review. 4. Add action event fault details -Topic: https://review.opendev.org/#/q/topic:bp/action-event-fault-details+(status:… - Weekly Progress: Spec is merged and code is ready for review. Specs are merged and code in-progress: ------------------------------ ------------------ - None Spec Ready for Review or Action from Author: --------------------------------------------------------- 1. Support specifying vnic_type to boot a server -Spec: https://review.opendev.org/#/c/672400/ - Weekly Progress: Stephen summarized the comment about not in scope of nova. I will remove it from this list from next report. 2. Allow specify user to reset password -Spec: https://review.opendev.org/#/c/682302/5 - Weekly Progress: One +2 on this but other are disagree on this idea. More discussion on review. 3. Support re-configure deleted_on_termination in server -Spec: https://review.openstack.org/#/c/580336/ - Weekly Progress: This is old spec and there is no consensus on this till now. Others: 1. None Bugs: ==== I started fixing policy bugs while working on policy-defaults-refresh BP. 5 bugs have been identified till now and fix up for review. - https://bugs.launchpad.net/nova/+bugs?field.tag=policy-defaults-refresh NOTE- There might be some bug which is not tagged as 'api' or 'api-ref', those are not in the above list. Tag such bugs so that we can keep our eyes. -gmann

1 0

[neutron][metering] Dublicated Neutron Meter Rules in different projects kills metering
by merlin.blom＠bertelsmann.de 13 Feb '20

13 Feb '20

I want to use Neutron Meter with gnocchi to report the egress bandwidth used for public traffic. So I created neutron meter labels and neutron meter rules to include all ipv4 traffic: +-------------------+------------------------------------------------------- ---------------------------------------------+ | Field | Value | +-------------------+------------------------------------------------------- ---------------------------------------------+ | direction | egress | | id | f2c9b9a8-0af3-40a5-a718-6e841bad111d | | is_excluded | False | | location | cloud='', project.domain_id='default', project.domain_name=, | | | project.id='80120067cd7949908e44dce45aeb7712', project.name='billing', region_name='xxx', | | | zone= | | metering_label_id | d0068fc8-4a3e-4108-aa11-e3c171d4d1e1 | | name | None | | project_id | None | | remote_ip_prefix | 0.0.0.0/0 | +-------------------+------------------------------------------------------- ---------------------------------------------+ And excluded all private nets: +-------------------+------------------------------------------------------- ---------------------------------------------+ | Field | Value | +-------------------+------------------------------------------------------- ---------------------------------------------+ | direction | egress | | id | 838c9631-665b-42b6-b1e9-539983a38573 | | is_excluded | True | | location | cloud='', project.domain_id='default', project.domain_name=, | | | project.id='80120067cd7949908e44dce45aeb7712', project.name='billing', region_name='xxx', | | | zone= | | metering_label_id | 435652e6-e985-4351-a31a-954bace9eea0 | | name | None | | project_id | None | | remote_ip_prefix | 10.0.0.0/8 | +-------------------+------------------------------------------------------- ---------------------------------------------+ It works fine for just one project but if I apply it to all projects it fails and no measures are recorded in gnocchi. The neutron-metering-agent.log shows the following warning: Feb 13 09:14:18 xxx_host neutron-metering-agent: 2020-02-13 09:14:09.648 4732 WARNING neutron.agent.linux.iptables_manager [req-4c38f1f5-2db4-4d4a-9c1f-9585b1b50427 65c6d4bdcbc7469a910f6361b7f70f27 80120067cd7949908e44dce45aeb7712 - - -] Duplicate iptables rule detected. This may indicate a bug in the iptables rule generation code. Line: -A neutron-meter-r-28155d45-d16 -s 10.0.0.0/8 -o qg-c61bafef-ea -j RETURN I would expect that it is possible to have similar rules for different projects. What do you think? Is it part of the rule creation code? In the iptables_manager code the function is criticized: <https://github.com/openstack/neutron/blob/86e4f141159072421a19080455caba1b0 efef776/neutron/agent/linux/iptables_manager.py> https://github.com/openstack/neutron/blob/86e4f141159072421a19080455caba1b0e fef776/neutron/agent/linux/iptables_manager.py # TODO(kevinbenton): remove this function and the next one. They are # just oversized brooms to sweep bugs under the rug!!! We generate the # rules and we shouldn't be generating duplicates. def _weed_out_duplicates(line): if line in seen_lines: thing = 'chain' if line.startswith(':') else 'rule' LOG.warning("Duplicate iptables %(thing)s detected. This " "may indicate a bug in the iptables " "%(thing)s generation code. Line: %(line)s", {'thing': thing, 'line': line}) return False seen_lines.add(line) # Leave it alone return True <https://bugs.launchpad.net/neutron/+bug/1863068> https://bugs.launchpad.net/neutron/+bug/1863068 Merlin Blom

1 0

[Watcher]IRC meeting at 8:00 UTC today
by licanwei 13 Feb '20

13 Feb '20

2 2

[openstack-dev][kuryr] Kubelet error in ARM64
by VeeraReddy 13 Feb '20

13 Feb '20

Hi I am getting following error in kubelet in arm64 platform Feb 13 07:16:32 node-2088 kubelet[16776]: E0213 07:16:32.493458 16776 machine.go:288] failed to get cache information for node 0: open /sys/devices/system/cpu/cpu0/cache/index0/size: no such file or directoryFeb 13 07:16:32 node-2088 kubelet[16776]: I0213 07:16:32.493600 16776 gce.go:44] Error while reading product_name: open /sys/class/dmi/id/product_name: no such file or directory Help me in fixing above issue. Regards, Veera.

2 1

[operators][cinder] RSD and Swordfish drivers being abandoned
by Brian Rosmaita 12 Feb '20

12 Feb '20

Greetings operators, The current maintainers of the Intel Rack Scale Design (RSD) driver announced at this week's Cinder meeting that the driver will be marked as UNSUPPORTED in Ussuri and that the driver will no longer be maintained. The Swordfish driver, which was under active development, but not yet merged to Cinder, is also being abandoned as well as the os-brick modifications to support NVMeoF. Finally, the third-party CI system for the RSD driver is being dismantled. We want you to be aware of these changes, but more optimistically, we are hoping that there would be some interest in the community in picking these up. If you are or know of such a person, please contact us right away so that we can get a technology transfer going before the current development group has been dispersed to other projects. For more information, please contact: Ivens Zambrano (ivens.zambrano(a)intel.com / IRC:IvensZambrano) David Shaughnessy (david.shaughnessy(a)intel.com / IRC: davidsha) thanks, brian

1 0

[qa][ptg] QA PTG, Vancouver Planning
by Ghanshyam Mann 12 Feb '20

12 Feb '20

Hello Everyone, I have started the Vancouver PTG planning for QA[1]. The very first step is to reserve the space based on number of attendees. For that, please write your name in the etherpad. I know it might not be confirmed yet or the travel process has not started, still, you can write your probability of attending. It is not necessary to be 100% in QA but if you are planning to spend some time in QA PTG, still write your name with comment. [1] https://etherpad.openstack.org/p/qa-victoria-ptg -gmann

1 0

[cinder][ptg] Victoria (Vancouver 2020) PTG headcount
by Brian Rosmaita 12 Feb '20

12 Feb '20

I need to get a rough headcount to submit to the PTG planning committee. Please take a minute to put your name on this etherpad if you think/hope/plan to attend (no commitment--we just want to increase the likelihood that we'll have enough seats for the Cinder team): https://etherpad.openstack.org/p/cinder-victoria-ptg-planning While you're on that etherpad, if you have a topic idea already, feel free to add it. I need the headcount info by 19:00 UTC on 28 February. (But do it now before you forget.) thanks, brian

1 0

[largescale-sig] Meeting summary and next actions
by Thierry Carrez 12 Feb '20

12 Feb '20

Hi everyone, The Large Scale SIG held a meeting today. We had a small attendance, and blame holidays for that. But you can catch up with the summary and logs of the meeting at: http://eavesdrop.openstack.org/meetings/large_scale_sig/2020/large_scale_si… We started with a presentation by oneswig of the integration of HAProxy telemetry via Monasca on a Kolla-Ansible-based deployment, and how that can help us derive latency information based on the API server called, the HTTP method and the HTTP code result across all HAProxy-fronted servers in a deployment. Slides are available at: http://www.stackhpc.com/resources/HAproxy-telemetry.pdf Regarding progress on our "Documenting large scale operations" goal, some doc links were proposed and all seem relevant to our collection. On the "Scaling within one cluster, and instrumentation of the bottlenecks" goal, the draft of the oslo.metrics spec got a first round of comments. masahito will refresh it based on those initial comments, but it would be good for SIG members to also weigh in at that early stage. In other news, we discussed the SIG's involvement in the "Large-scale Usage of Open Source Infrastructure Software" track at the OpenDev event in Vancouver in June. We plan to have SIG members directly involved and have discussions around our two goals for 2020. TODOs between now and next meeting: - masahito to update spec based on initial feedback - everyone to review and comment on https://review.opendev.org/#/c/704733/ The next meeting will happen on February 26, at 9:00 UTC on #openstack-meeting. Cheers, -- Thierry Carrez (ttx)

1 0

[scientific-sig] No Scientific SIG meeting today
by Stig Telfer 12 Feb '20

12 Feb '20

Hi All - Unfortunately there will not be a Scientific SIG IRC meeting today, owing to other commitments and availability. Apologies, Stig

1 0

How to Migrate OpenStack Instance from one Tenant to another
by Pradeep Antil 12 Feb '20

12 Feb '20

Hi Folks, I am using Mitaka OpenStack and VLAN as network type driver for tenant VMs. Initially i have provisioned all the VMs (Including Customer VMs) inside the admin. I want to segregate my internal VMs and Customer VMs, for this to accomplish i have created different tenant names and now i want customer VMs from admin tenant to Customer tenant, On Google , i have a found a script which migrates the VMs but that script doesn't update network and security group details, Can anyone help me and suggest what steps needs to executed to update network , security group and attached Volumes ..? Below is the exact script: #!/bin/bash for i do if [ "$i" != "$1" ]; then echo "moving instance id " $i " to project id" $1; mysql -uroot -s -N <<query use nova; update instances set project_id="$1" where uuid="$i"; query else #get project id of the instance before update old_proj_id=$(mysql -uroot -s -N <<query use nova; select project_id from instances where uuid="$2"; query ) #get user id of the instance before update user_id=$(mysql -uroot -s -N <<query use nova; select user_id from instances where uuid="$2"; query ) fi done echo "quota_resync " $old_proj_id; ./quota_resync.sh $old_proj_id $user_id; echo "quota_resync " $1; ./quota_resync.sh $1 $user_id; root@xxxx:/mnt# cat quota_resync.sh #!/bin/bash count=$(mysql -uroot -s -N <<query use nova; select count(*) from instances where project_id="$1" and vm_state="active"; query ) memory=$(mysql -uroot -s -N <<query use nova; select sum(memory_mb) from instances where project_id="$1" and vm_state="active"; query ) vcpu=$(mysql -uroot -s -N <<query use nova; select sum(vcpus) from instances where project_id="$1" and vm_state="active"; query ) echo "count" $count; echo "vcpus" $vcpu; echo "Ram" $memory; update=$(mysql -uroot -s -N <<query use nova; update quota_usages set in_use=$count where project_id="$1" and user_id="$2" and resource="instances"; update quota_usages set in_use=$memory where project_id="$1" and user_id="$2" and resource="ram"; update quota_usages set in_use=$vcpu where project_id="$1" and user_id="$2" and resource="cores"; query ) root@xxxx:/mnt# Script Execution Method : # /vm_move.sh "destination_tenant_id" "VM_id" -- Best Regards Pradeep Kumar

1 0

Re: [ospurge] looking for project owners / considering adoption
by Artem Goncharov 11 Feb '20

11 Feb '20

Hi, I am thinking to submit (not found possibility so far) a forum-like session for that again in Vancouver, where I would present current status of implementation and we can plan further steps. Unfortunately I have still no confirmation from my employer, that I will be allowed to go. Any ideas/objections? Regards, Artem > On 3. Nov 2019, at 02:34, Tobias Rydberg <tobias.rydberg(a)citynetwork.eu> wrote: > > Hi, > > Sounds really good Artem! Will you be at the session at the Summit? If not, I will bring the information from you to the session... > > Cheers, > Tobias > > Tobias Rydberg > Senior Developer > Twitter & IRC: tobberydberg > > www.citynetwork.eu <http://www.citynetwork.eu/> | www.citycloud.com <http://www.citycloud.com/> > > INNOVATION THROUGH OPEN IT INFRASTRUCTURE > ISO 9001, 14001, 27001, 27015 & 27018 CERTIFIED > On 2019-11-02 16:26, Artem Goncharov wrote: >> Hi Tobby, >> >> As I mentioned, if Monty does not start work, I will start it in few weeks latest (mid November). I need this now in my project, therefore I will be definitely able to spend time on implementation in both SDK and OSC. >> >> P.S. mailing this to you, since I will not be on the Summit. >> >> Regards, >> Artem >> >>> On 2. Nov 2019, at 09:19, Tobias Rydberg <tobias.rydberg(a)citynetwork.eu <mailto:tobias.rydberg@citynetwork.eu>> wrote: >>> >>> Hi, >>> >>> A Forum session is planned for this topic, Monday 11:40. Suites perfect to continue the discussions there as well. >>> >>> https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24407… <https://www.openstack.org/summit/shanghai-2019/summit-schedule/events/24407…> >>> BR, >>> Tobias >>> >>> Tobias Rydberg >>> Senior Developer >>> Twitter & IRC: tobberydberg >>> >>> www.citynetwork.eu <http://www.citynetwork.eu/> | www.citycloud.com <http://www.citycloud.com/> >>> >>> INNOVATION THROUGH OPEN IT INFRASTRUCTURE >>> ISO 9001, 14001, 27001, 27015 & 27018 CERTIFIED >>> On 2019-10-30 15:43, Artem Goncharov wrote: >>>> Hi Adam, >>>> >>>> Since I need this now as well I will start working on implementation how it was agreed (in SDK and in OSC) during last summit by mid of November. There is no need for discussing this further, it just need to be implemented. Sad that we got no progress in half a year. >>>> >>>> Regards, >>>> Artem (gtema). >>>> >>>>> On 30. Oct 2019, at 14:26, Adam Harwell <flux.adam(a)gmail.com <mailto:flux.adam@gmail.com>> wrote: >>>>> >>>>> That's too bad that you won't be at the summit, but I think there may still be some discussion planned about this topic. >>>>> >>>>> Yeah, I understand completely about priorities and such internally. Same for me... It just happens that this IS priority work for us right now. :) >>>>> >>>>> >>>>> On Tue, Oct 29, 2019, 07:48 Adrian Turjak <adriant(a)catalyst.net.nz <mailto:adriant@catalyst.net.nz>> wrote: >>>>> My apologies I missed this email. >>>>> >>>>> Sadly I won't be at the summit this time around. There may be some public cloud focused discussions, and some of those often have this topic come up. Also if Monty from the SDK team is around, I'd suggest finding him and having a chat. >>>>> >>>>> I'll help if I can but we are swamped with internal work and I can't dedicate much time to do upstream work that isn't urgent. :( >>>>> >>>>> On 17/10/19 8:48 am, Adam Harwell wrote: >>>>>> That's interesting -- we have already started working to add features and improve ospurge, and it seems like a plenty useful tool for our needs, but I think I agree that it would be nice to have that functionality built into the sdk. I might be able to help with both, since one is immediately useful and we (like everyone) have deadlines to meet, and the other makes sense to me as a possible future direction that could be more widely supported. >>>>>> >>>>>> Will you or someone else be hosting and discussion about this at the Shanghai summit? I'll be there and would be happy to join and discuss. >>>>>> >>>>>> --Adam >>>>>> >>>>>> On Tue, Oct 15, 2019, 22:04 Adrian Turjak <adriant(a)catalyst.net.nz <mailto:adriant@catalyst.net.nz>> wrote: >>>>>> I tried to get a community goal to do project deletion per project, but >>>>>> we ended up deciding that a community goal wasn't ideal unless we did >>>>>> build a bulk delete API in each service: >>>>>> https://review.opendev.org/#/c/639010/ <https://review.opendev.org/#/c/639010/> >>>>>> https://etherpad.openstack.org/p/community-goal-project-deletion <https://etherpad.openstack.org/p/community-goal-project-deletion> >>>>>> https://etherpad.openstack.org/p/DEN-Deletion-of-resources <https://etherpad.openstack.org/p/DEN-Deletion-of-resources> >>>>>> https://etherpad.openstack.org/p/DEN-Train-PublicCloudWG-brainstorming <https://etherpad.openstack.org/p/DEN-Train-PublicCloudWG-brainstorming> >>>>>> >>>>>> What we decided on, but didn't get a chance to work on, was building >>>>>> into the OpenstackSDK OS-purge like functionality, as well as reporting >>>>>> functionality (of all project resources to be deleted). That way we >>>>>> could have per project per resource deletion logic, and all of that >>>>>> defined in the SDK. >>>>>> >>>>>> I was up for doing some of the work, but ended up swamped with internal >>>>>> work and just didn't drive or push for the deletion work upstream. >>>>>> >>>>>> If you want to do something useful, don't pursue OS-Purge, help us add >>>>>> that official functionality to the SDK, and then we can push for bulk >>>>>> deletion APIs in each project to make resource deletion more pleasant. >>>>>> >>>>>> I'd be happy to help with the work, and Monty on the SDK team will most >>>>>> likely be happy to as well. :) >>>>>> >>>>>> Cheers, >>>>>> Adrian >>>>>> >>>>>> On 1/10/19 11:48 am, Adam Harwell wrote: >>>>>> > I haven't seen much activity on this project in a while, and it's been >>>>>> > moved to opendev/x since the opendev migration... Who is the current >>>>>> > owner of this project? Is there anyone who actually is maintaining it, >>>>>> > or would mind if others wanted to adopt the project to move it forward? >>>>>> > >>>>>> > Thanks, >>>>>> > --Adam Harwell >>>> >>

2 1

Galera and haproxy fail; keystone error 'Lost connection to MySQL server during query'
by Albert Braden 11 Feb '20

11 Feb '20

If I run galera without haproxy and point everything to 1 server, it seems to work fine, but we want to load-balance it with haproxy. After setting up haproxy we had lots of errors in nova, neutron and keystone, but I got rid of those by setting haproxy timeout values to 10 minutes. The remaining errors are in keystone. In /var/log/keystone/keystone-wsgi-public.log I see "Loaded 2 Fernet keys" every 5 minutes and this is frequently accompanied by a mysql error 'Lost connection to MySQL server during query' I tried changing various config items in haproxy, galera and keystone, but nothing seems to help. How can I fix these errors? Errors: https://f.perl.bot/p/pbq26k https://f.perl.bot/p/1tnh78 https://f.perl.bot/p/fuxmwo Haproxy config: https://f.perl.bot/p/gu2lil Mysql timeout values: https://f.perl.bot/p/i6l7tn Keystone config (minus commented lines): https://f.perl.bot/p/o6fdht

2 3

[ptl][keystone] cmurphy afk week of February 17
by Colleen Murphy 11 Feb '20

11 Feb '20

I will be on vacation the week of February 17 and will not be computering. Kristi Nikolla (knikolla) has graciously agreed to act as stand-in PTL for keystone during that time and will chair next week's meeting. If necessary I will be reachable by email or IRC but with some delay (hours or days). Colleen

1 0