- openstack-discuss - lists.openstack.org

[Keystone][ldap] Keystone bind request to ldap not able to interpret if the user's password is expired.
by Sharath Ck 05 Jan '26

05 Jan '26

Hi, I have configured Keystone with 389ds as backend. 389ds server is configured with password policy and pwdmustchange is set to true. However on first login attempt from keystone to request token for user in 389ds is resulting in successful bind request. Perhaps, 389ds is providing control ID - control: 2.16.840.1.113730.3.4.4 in the response. But keystone is not able to interpret the control ID and provide a token with full access. Is it not possible for keystone to respond token with minimum scope to only change password? Or any response attribute to specify password is expired and needs to be changed? Kindly help with any configuration that may interpret the password expiry of ldap user and can be used in token response. P.S: configuring user_enabled_attribute to check nsAccountLock will not work as ldap user's password would be expired but not locked. user_enabled_attribute = nsAccountLock user_enabled_mask = 0 user_enabled_invert = true user_enabled_default = true Regards, Sharath

3 2

[ops][cinder][show-and-tell] I wrote an open-source tool to automate OpenStack Cinder snapshot lifecycles
by aravindhstanley＠gmail.com 05 Jan '26

05 Jan '26

Hello folks, We have been using OpenStack for a while and needed a reliable way to keep snapshots on hot storage for compliance and quick recovery. While Cinder provides the mechanism to create snapshots, the actual scheduling and rotation are largely left for the operator to figure out. I know there are robust commercial tools like Trilio (awesome tool, by the way), but I wanted a lightweight, open-source alternative to manage the snapshot lifecycle without the extra overhead. So, I built SnapSentry. It is written in Go, completely free, and MIT licensed, so I thought I should share it with the community. Key Features: Metadata-Driven: No central database or config files; just tag your volumes with metadata and it works. (Helper command takes care of metadata updates) Atomic-ish VM Snapshots: Automatically identifies all volumes attached to a specific VM and snapshots them in parallel to minimize consistency gaps. Smart Concurrency: Uses a hybrid model (Parallel for attached volumes, Sequential for unattached) to prevent API throttling. Resilient: Handles transient OpenStack errors (500s) and cleans up orphaned "zombie" snapshots automatically. Secure: Supports restricted Application Credentials for least-privilege operation. Here is the repo: https://github.com/aravindh-murugesan/openstack-snapsentry-go Cheers, and feedback is welcome! Note: I do use AI assistant for docs, but the logic or the app itself is not vibe-coded. I'm not sure if this is the right place to post this, if it's not, I apologize. Just trying to contribute to the openstack ecosystem :)

2 1

[tacker] Cancelling weekly IRC meeting
by Yasufumi Ogawa 04 Jan '26

04 Jan '26

Hi team, Sorry for the late notice. I'd like to cancel the IRC meeting today as we agreed in the previous meeting. Regards, Yasufumi

1 0

[Opensource Tool] Cinder snapshot lifecycle management
by Aravindh M 03 Jan '26

03 Jan '26

Hello folks, We have been using OpenStack for a while and needed a reliable way to keep snapshots on hot storage for compliance and quick recovery. While Cinder provides the mechanism to create snapshots, the actual scheduling and rotation are largely left for the operator to figure out. I know there are robust commercial tools like Trilio (awesome tool, by the way), but I wanted a lightweight, open-source alternative to manage the snapshot lifecycle without the extra overhead. So, I built *SnapSentry*. It is written in Go, completely free, and MIT licensed, so I thought I should share it with the community. *Key Features:* - *Metadata-Driven:* No central database or config files; just tag your volumes with metadata and it works. (Helper command takes care of metadata updates) - *Atomic-ish VM Snapshots:* Automatically identifies all volumes attached to a specific VM and snapshots them in parallel to minimize consistency gaps. - *Smart Concurrency:* Uses a hybrid model (Parallel for attached volumes, Sequential for unattached) to prevent API throttling. - *Resilient:* Handles transient OpenStack errors (500s) and cleans up orphaned "zombie" snapshots automatically. - *Secure:* Supports restricted Application Credentials for least-privilege operation. Here is the repo: https://github.com/aravindh-murugesan/openstack-snapsentry-go Cheers, and feedback is welcome! Note: I do use AI assistant for docs, but the logic or the app itself is not vibe-coded. I'm not sure if this is the right place to post this, if it's not, I apologize. Just trying to contribute to the openstack ecosystem :)

1 0

[neutron] bug deputy report for week of 2025-12-15
by Bence Romsics 02 Jan '26

02 Jan '26

Hi Team, Here's the deputy report for the week of 2025-12-15. Sorry for being so slow! High: * https://bugs.launchpad.net/neutron/+bug/2136827 Functional tests using SqlFixture are extremely slow fix in progress: https://review.opendev.org/c/openstack/neutron/+/971472 * https://bugs.launchpad.net/neutron/+bug/2136733 The highest priority chassis gateway port fails to bind after chassis was restarted/crashed wip fix: https://review.opendev.org/c/openstack/neutron/+/971876 Medium: * https://bugs.launchpad.net/neutron/+bug/2136747 [FT] "ResourceWarning: unclosed file" errors in the FT execution unassigned, but Jakub investigated a bit * https://bugs.launchpad.net/neutron/+bug/2136147 test_two_vms_fips test has very specific expectations from availability zones fix in progress: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/970865 * https://bugs.launchpad.net/neutron/+bug/2136864 [ovn-db-sync] sync_hostname_and_physical_networks is expecting to find Chassis among agents fix in progress: https://review.opendev.org/c/openstack/neutron/+/971527 Incomplete: * https://bugs.launchpad.net/neutron/+bug/2136466 [rbac] Unexpected behaviour on floating ip port forwarding list Regards, Bence

1 0

need help in managing production openstack cluster
by Tarun 31 Dec '25

31 Dec '25

Hi, I am migrating from VMware to Openstack 2025.2 Please help me to validate my production cluster to avoid any future issue Thanks Tarun

3 3

Continuous Audit Stuck in PENDING State
by Mohd Atif Ansari 30 Dec '25

30 Dec '25

Hello OpenStack Community, I am facing an issue with Continuous Audits in Watcher. After creating the audit with an interval, the audit remains in the PENDING state and does not generate any action plans. All Watcher services are running, and the audit is created successfully without errors. Could you please help identify what might be missing or misconfigured? Openstack version: 2023.1 I have attached some screenshots for your reference. Thanks, Mohd Atif Ansari Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

3 2

[nova] How to use $aggregates with JsonFilter
by Andy Speagle 30 Dec '25

30 Dec '25

Hey Team, I'm trying to use scheduler hints using the JsonFilter that involve host aggregates. Based on the documentation and my quick perusal of the scheduler's HostState class... it seems like $aggregates are populated there for usage, but I can't seem to find the right magick to make a json query work to schedule an instance on a host that belongs to a specific aggregate based on simply the name of the aggregate... or perhaps metadata contained within. I think my lack of understanding of the structure of the $aggregates list in the scheduler's HostState class is tripping me up. Does anyone have any insight into this?... Thanks. -- Andy Speagle

2 12

[nova][cinder][neutron] Heartbeat improvement: checking if main thread responds to rabbit ping
by Thomas Goirand 30 Dec '25

30 Dec '25

tl;dr: I want to implement main thread ping in the heartbeat tread via rabbitmq to make sure the main thread is alive when reporting a service status, I'd like to have opinions. Hi, I already wrote about this on #openstack-cinder, but nobody replied to me. Anyways, I think it's a topic that is cross-project, so I want to open it in this list. After a rabbitmq outage due to a disk full in our infra, we restarted our rabbitmq cluster. Everything seemed to come back normally, but we later discovered that the main threads of cinder-volume and cinder-backup were dead, while the heartbeat thread was not, and was reporting the services as up. It took us some time to realize it, as this cluster isn't public cloud, and we could live with the errors. Though we don't want to leave things the way they are, as we want reliable monitoring to avoid painful support tickets from customers. Within Cinder, there's already all the infrastructure in place to enhance the hearbeat thread, and make it do more checks. However, currently, the Manager class isn't even instantiated and used when creating the service. Here's my proposal, currently only for Cinder, but hopefully, I'll also implement it in Nova and Neutron. When creating the cinder-volume using cinder/service.py, it's going to also create a manager, and attach it to the service. The ManagerVolume class will implement the is_working() method of the class Manager. In it, it's going to ping the main thread with rabbitmq, sending a ping message, to which the main thread must respond with a pong. If the pong isn't received within a timeout, is_working() will reply False. I started implementing it here: https://review.opendev.org/c/openstack/cinder/+/970796 Note that it's currently still a WIP, and there's more to work on, like some unit tests that are currently failing. I'm not posting the link to the patch to get a merge yet, and it's unfinished, but the current patch is probably enough to get the idea of what I want to implement. So, for each service, the heartbeat will do a ping, which will of course make more messages in Rabbit. Though I believe this is still a reasonable thing to do. With 200 Cinder service, and a heartbeat every 30 seconds per service, that's going to be an additional less than 15 messages per seconds. Considering a reasonable RabbitMQ service can eat 100k message per seconds, it should be ok. Now, this is for Cinder. Once it's done there, I intend to investigate Neutron next, but I'm not sure if it has all the facilities that Cinder offers. Maybe it'd be worth unifying this in oslo.messaging? I'm open to suggestions, but I'm unsure (yet) of what it would look like within one of the oslo libs (I'd have to look on how / where to do it: suggestions are welcome, as it would speed-up my work on it). Please let know your opinion on this, if this is a good idea or not, and if the Cinder team (and potentially Neutron and Nova) will be willing to accept such a patch. Cheers, Thomas Goirand (zigo)

3 4

[Nova] unified limit and pci alias combination support
by Masahito Muroi 30 Dec '25

30 Dec '25

Hi Nova folks, We're trying to use unified limit with alias PCI device information with following configuration. With this configuration, unified limit calculates the resources:CUSTOM_NVIDIA_T4 correctly, but nova-scheduler makes allocation_candidate request with duplicated CUSTOM_NVIDIA_T4 resources. From my quick check of the code, the unified limit and pci device alias usecase is not supported by the master branch now. I'm thinking to fix the issue and comming up with two idea to solve the issue. I want to hear the nova team's opinion which is better to fit the nova's code. Or please give me any comment if there is another better way. - idea1: nova-scheduler drops duplicated resources request if needed. Adding a configuration to drop duplicated situation and etc. - idea2: introduces a new flavor extra spec prefix, e.g. "placement:<RC>", to indicate the resource class comes from placement. # nova.conf [pci] device_spec = {"vendor_id":"8086", "product_id":"8d2d", "resource_class":"CUSTOM_NVIDIA_T4"} alias = {"name":"t4_pcie_16gb", "vendor_id":"8086", "product_id":"8d2d", "resource_class":"CUSTOM_NVIDIA_T4", "device_type":"type-PCI"} report_in_placement = true pci_in_placement = true [quota] driver = nova.quota.UnifiedLimitsDriver unified_limits_resource_strategy = require unified_limits_resource_list = class:CUSTOM_NVIDIA_T4, class:VCPU, class:MEMORY_MB, class:DISK_GB # openstack flavor show GPU_FLAVOR | Fields. | Value | +-------------+-----------------------------------------| | properties | pci_passthrough:alias='t4_pcie_16gb:1', | | | resources:CUSTOM_NVIDIA_T4='1' | # allocation candidate request query /allocation_candidates limit=1000 resources=CUSTOM_NVIDIA_T4:1 DISK_GB:10 MEMORY_MB:1024 VCPU:1 resourcesbb775ad3-f50c-4d3b-bb28-8993e4a664ca-0=CUSTOM_NVIDIA_T4:1 best regards, Masahito

2 1