- openstack-discuss - lists.openstack.org

Adding a compute node using Openstack ansible
by Derek O keeffe 15 Jan '25

15 Jan '25

Hi all, I have something weird happening when trying to add a compute node to a working cluster. I added "compute3" to my openstack_user_config.yml compute_hosts stanza and ran the setup_hosts playbook. This created (re-created) the openstack_inventory.json file which I have reviewed thoroughly and I can see compute3 added everywhere compute1 and compute2 had been added from the deploy. When I run the second playbook setup_infrastructure, all the plays skip saying "no hosts matched" but the tasks all touch compute3.... I ran /opt/openstack-ansible/scripts/inventory-manage.py -G and I can see my compute3 listed in the output. The commands I run for the playbooks are as follows: openstack-ansible setup-hosts.yml --limit ,compute3openstack-ansible setup-infrastructure.yml --limit ,compute3openstack-ansible setup-openstack.yml --limit ,compute3 I've been trying to solve this since before Christmas with no luck, could anyone please shed some light on what the issue could be? Output of first playbook: https://paste.openstack.org/show/blArG04q6wgUCJy9JPh3/Output of second playbook: Paste #bSiabwqOk7qdns2iBYDA | LodgeIt! | | | | Paste #bSiabwqOk7qdns2iBYDA | LodgeIt! | | | Any advice or info would be greatly appreciated. Regards,Derek

2 1

[all] 2024 OpenInfra Foundation annual report
by Jeremy Stanley 15 Jan '25

15 Jan '25

The OpenInfra Foundation staff have published 2024's annual report: https://openinfra.org/annual-report/2024 As usual, it includes a section on OpenStack, covering some highlights of our community's achievements throughout the year. There's an accompanying post on the OpenStack Blog too: https://www.openstack.org/blog/openstack-2024-community-progress-highlights/ Please feel free to share these anywhere you think people may be interested in seeing our year in review, or that of our sibling communities and other activities supported by the foundation. -- Jeremy Stanley

1 0

[largescale-sig] Next meeting: January 15, 9utc
by Thierry Carrez 15 Jan '25

15 Jan '25

Hi everyone, The Large Scale SIG will be meeting this Wednesday in #openstack-operators on OFTC IRC, at 9UTC. You can doublecheck how that UTC time translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20250115T09 Feel free to add topics to the agenda: https://etherpad.opendev.org/p/large-scale-sig-meeting Regards, -- Thierry Carrez

1 1

[kolla-ansible][keystone]problem using LDAP and TLS
by Franck VEDEL 15 Jan '25

15 Jan '25

Hello, with all previous versions, to authenticate users from an Active Directory domain, using an LDAP connector worked without any problem on my labs, with or without using TLS. With TLS the file used is the following: /etc/kolla/config/keystone/domains/keystone.DOM1.conf [identity] driver = ldap [ldap] url = ldap://172.16.60.41 user = CN=ldapconnect,OU=openstack,DC=dom1,DC=loc password = XXXXXXXXXX suffix = DC=dom1,DC=loc user_tree_dn = OU=openstack,DC=dom1,DC=loc user_objectclass = person user_filter = (|(memberOf=CN=openstack-users,OU=openstack,DC=dom1,DC=loc)(memberOf=CN=openstack-admins,OU=openstack,DC=dom1,DC=loc)) user_id_attribute = sAMAccountName user_name_attribute = sAMAccountName user_mail_attribute = mail user_pass_attribute = user_enabled_attribute = userAccountControl user_enabled_mask = 2 user_enabled_default = 512 user_attribute_ignore = password,tenant_id,tenants group_objectclass = group group_tree_dn = OU=openstack,DC=dom1,DC=loc group_filter = (|(CN=openstack-users)(CN=openstack-admins)) group_id_attribute = cn group_name_attribute = name query_scope = sub chase_referrals = false use_tls = True tls_certificate = /etc/kolla/certificates/adserv.crt tls_req_cert = never I want to see if it works with Dalmatian (to update my lab, which I can't do with the Bobcat and Caracal versions because bugs block me). Without TLS (use_tls = False) , no problem, it works, my AD users can use Horizon and have access to their project. If I put "use_tls = True" and tls_certificate = /etc/kolla/certificates/adserv.crt .... It doesn't work with Dalmatian, certificate problem. Indeed, the certificate is not copied into the keystone container, so it can't use it. In the keystone logs (/var/kolla/keystone/keystone.log) there is an error message: 2025-01-15 08:36:04.477 1084 ERROR keystone.server.flask.request_processing.middleware.auth_context OSError: tls_cacertfile /etc/kolla/certificates/adserv.crt not found or is not a file However, my adserv.crt file has not changed, is valid, and is in /etc/kolla/certificates directory. What could have changed with the Dalmatian version? I tried to change parameters, but I can't find the solution. How should I proceed to make it work with TLS. I specify again that it works without TLS so the problem is really to use this certificate correctly, so to put it in the right place with the right parameter: tls_certificate or a new one? My lab use ubuntu 2204. Thanks a lot for your help Franck VEDEL

1 0

Facing issue while creating image in Open stack using Barbican
by Shalini Srivastava 15 Jan '25

15 Jan '25

Hi Sir, I have created openstack image with the help of Barbican key-manager but it is not coming in active mode from past two days. It is still showing in queue mode only. Since i have searched a lot reagarding the same issue but could not find any solution to fix the same. Hope to hear from you soon. Thanks & Regards Shalini Srivastava Project Associate /प्रोजेक्ट एसोसिएट Centre for Development of Advanced Computing(C-DAC) / प्रगत संगणन विकास केन्द्र(सी-डैक) Tidel Park”, 8th Floor, “D” Block, (North &South) / “टाइडल पार्क”,8वीं मंजिल, “डी” ब्लॉक, (उत्तर और दक्षिण) No.4, Rajiv Gandhi Salai / नं.4, राजीव गांधी सलाई Taramani / तारामणि Chennai / चेन्नई – 600113 Ph.No.:044-22542226/27 Fax No.: 044-22542294 ------------------------------------------------------------------------------------------------------------ [ C-DAC is on Social-Media too. Kindly follow us at: Facebook: https://www.facebook.com/CDACINDIA & Twitter: @cdacindia ] This e-mail is for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email is strictly prohibited and appropriate legal action will be taken. ------------------------------------------------------------------------------------------------------------

1 0

Guidance Required for OVN-BGP-Agent Configuration with EVPN Mode
by AkashMadan Talebailkar 15 Jan '25

15 Jan '25

Dear Community, I hope this email finds you well. I came across this insightful discussion on the OpenStack forum regarding the OVN-BGP-Agent Discussio<https://lists.openstack.org/pipermail/openstack-discuss/2022-August/030080.…>n. We are doing research on openstack capability and would greatly appreciate your guidance. We are utilizing the OVN mechanism driver along with the OVN-BGP-Agent<https://github.com/openstack/ovn-bgp-agent/tree/master> in EVPN mode. Our objective is to establish BGP-EVPN between our leaf switch and the OpenStack controller. The OVN-BGP-Agent should advertise the IP and MAC addresses of VMs to its BGP peers. Please find attached the following details for your reference: bgp-agent.conf Agent configuration OVN_DB configuration Result We installed the OVN-BGP-Agent and FRR on the controller. Below are the steps we followed: Network Setup: Created a tenant network (NET) with a subnet of 121.168.0.0/24. Created a provider network (EXNET) with a subnet of 192.27.5.0/24. Router Configuration: Set up a router (newrouter) with an external network (EXNET) and unchecked SNAT. Added the NET interface to the router. OVN Database Configuration: Configured the OVN Northbound DB (detailed in the attachment). VM Creation: Deployed a VM in NET with the VM's IP 121.168.0.202 PFA for the agent configuration and FRR configuration done once agent VM has been created. Despite following the steps above, the VM IP is not visible in FRR, PFA for the result. Consequently, we are unable to advertise its route via BGP-EVPN. We kindly request your guidance to identify any potential misconfigurations or missing steps. Thank you for your time and support. Best regards, Akash Talebailkar Palc Networks akashmadan.t(a)palcnetworks.com +91 9035376555

1 0

[dev] Invitation to participate in a survey on flaky tests spanning multiple OpenStack projects
by xiao＠ait.kyushu-u.ac.jp 15 Jan '25

15 Jan '25

Hello there, My name is Tao Xiao, Assistant Professor at Kyushu University (Japan), and togather with a team from Canada and China. Our research specifically investigates cross-project flakiness by analyzing information available on the Gerrit Code Review platform. Through our study, we have observed a significant number of flaky tests spanning multiple OpenStack projects and categorized several potential causes behind this phenomenon. Our next step is to validate our empirical findings and gather real developers' perceptions to improve the OpenStack ecosystem through a developer survey. If you have at most 10 minutes, we have designed a simple survey to capture your perceptions. The survey link is here: https://forms.gle/dUMWRL8MNALQE6kG8 This questionnaire is totally anonymized, and the survey was approved by the Kyushu University, Japan ethics board (2024-26). Again, thank you so much for your time, and please feel free to contact us for more information. Tao Xiao on Behalf of Our Team Assistant Professor Faculty of Information Science and Electrical Engineering Kyushu University, Japan xiao(a)ait.kyushu-u.ac.jp <mailto:xiao@ait.kyushu-u.ac.jp> Team Members and their homepages: Tao Xiao – https://tao-xiao.github.io/ Dong Wang – https://dong-w.github.io/ Shane McIntosh – https://shanemcintosh.org/ Hideaki Hata – https://hideakihata.github.io/ Yasutaka Kamei – https://posl.ait.kyushu-u.ac.jp/~kamei/

1 0

[openstack][octavia] How clients can debug their LB
by Nguyễn Hữu Khôi 15 Jan '25

15 Jan '25

Hello. I would like to know how clients can debug their LB such as access log or monitor LB performance? Thank you. Regards Nguyen Huu Khoi

5 7

[ironic] Ironic-Lib being deprecated
by Jay Faulkner 14 Jan '25

14 Jan '25

Hi all, As many of you know, at the recent PTG the Ironic community made a decision to move any functionality out of ironic-lib into ironic / ironic-python-agent. This library has been documented, since it's inception, as for use by Ironic projects only, so there should be little to no impact to deployers other than having one less python package to deploy in their IPA ramdisks and Ironic services. We will keep the repository's stable (and unmaintained) branches open for as long as their Ironic/IPA counterparts are also supported in order to fulfill our support obligation. Remaining patches to complete this deprecation are here: https://review.opendev.org/q/topic:%22ironic-lib-deprecation%22 -- please reach out if there are any questions or concerns. I thought it wise to inform the mailing list of this change. We'll ensure it's highlighted in Ironic cycle highlights for epoxy as well. Thanks, Jay Faulkner

1 0

[neutron][upgrades] Linuxbridge driver removal and migration
by Brian Haley 14 Jan '25

14 Jan '25

Hi Stackers, In 2022, during the Zed cycle, the Neutron team took a step at marking some items as experimental. One of those was the Linuxbridge driver. The reason was due to it being unmaintained for a number of cycles, and no one was able to take on its ownership. The implication of this decision was that it was consider deprecated, even if not given an official warning message. In doing this, all gate jobs were moved into the experimental queue, feature-parity with other drivers was deemed unnecessary, and bug fixing was considered best-effort. Since then, both major distros have stopped supporting new deployments using Linuxbridge, and have been mainly focused on OVN. So what does this mean? We (the neutron cores) have come to the conclusion that it is time to take the next step and remove the code from the tree [1]. After 5 cycles of being considered experimental without any investment it just makes sense. We plan on doing this in the current Epoxy cycle. We realize that there are still deployments using Linuxbridge, and hopefully they have been looking at migration strategies since we originally marked the code experimental. This email is another push to the user community to start looking at this, especially if you are planning any new deployments. There has been at least one migration guide written at [2] (thanks Jim!), and at this point I would encourage those still using Linuxbridge to look at it and start asking any questions they have so we have the chance to make it better and can make that process easier. Thanks for reading, -Brian, Neutron PTL [0] https://review.opendev.org/c/openstack/neutron/+/845181 [1] https://review.opendev.org/c/openstack/neutron/+/927216 [2] https://www.jimmdenton.com/migrating-lxb-to-ovn/

4 3