- openstack-discuss - lists.openstack.org

[ptg][nova][placement] Etherpad & collector started
by Eric Fried 11 Feb '19

11 Feb '19

I needed to brain-dump some topics to be discussed at the PTG in a couple of months. I asked if there was already an etherpad and the two people who happened to hear my question weren't aware of one, so I started one [1]. I also started the collector wiki page [2], templated on the Stein one [3]. Enjoy. -efried [1] https://etherpad.openstack.org/p/nova-ptg-train [2] https://wiki.openstack.org/wiki/PTG/Train/Etherpads [3] https://wiki.openstack.org/wiki/PTG/Stein/Etherpads

1 0

[dev][keystone] Keystone Team Update - Week of 4 February 2019
by Colleen Murphy 11 Feb '19

11 Feb '19

# Keystone Team Update - Week of 4 February 2019 ## News ### Performance of Loading Fernet/JWT Key Repositories Lance noticed that it seems that token signing/encryption keys are loaded from disk on every request and is therefore not very performant, and started investigating ways we could improve this[1][2]. [1] http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-k… [2] http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-k… ## Recently Merged Changes Search query: https://bit.ly/2pquOwT We merged 10 changes this week. ## Changes that need Attention Search query: https://bit.ly/2RLApdA There are 73 changes that are passing CI, not in merge conflict, have no negative reviews and aren't proposed by bots. ## Bugs This week we opened 2 new bugs and closed 3. Bugs opened (2) Bug #1814589 (keystone:High) opened by Guang Yee https://bugs.launchpad.net/keystone/+bug/1814589 Bug #1814570 (keystone:Medium) opened by Guang Yee https://bugs.launchpad.net/keystone/+bug/1814570 Bugs fixed (3) Bug #1804483 (keystone:Medium) fixed by Lance Bragstad https://bugs.launchpad.net/keystone/+bug/1804483 Bug #1805406 (keystone:Medium) fixed by Lance Bragstad https://bugs.launchpad.net/keystone/+bug/1805406 Bug #1801095 (keystone:Wishlist) fixed by Artem Vasilyev https://bugs.launchpad.net/keystone/+bug/1801095 ## Milestone Outlook https://releases.openstack.org/stein/schedule.html Feature freeze is in four weeks. Be mindful of the gate and try to submit and review things early. ## Shout-outs Congratulations and thank you to our Outreachy intern Islam for completing the first step in refactoring our unit tests to lean on our shiny new Flask framework! Great work! ## Help with this newsletter Help contribute to this newsletter by editing the etherpad: https://etherpad.openstack.org/p/keystone-team-newsletter

2 1

[nova] Floppy drive support — does anyone rely on it?
by Kashyap Chamarthy 11 Feb '19

11 Feb '19

Question for operators: Do anyone rely on floppy disk support in Nova? Background ---------- The "VENOM" vulnerability (CVE-2015-3456)[1] was caused due to a Floppy Disk Controller (FDC) being initialized for all x86 guests, regardless of their configuration — so even if a guest does not explicitly have a virtual floppy disk configured and attached, this issue was exploitable. As a result of that, upstream QEMU has suppressed the FDC for modern machine types (e.g. 'q35') by default — commit ea96bc629cb; from QEMU v2.4.0 onwards. From the commit message: "It is Very annoying to carry forward an outdatEd coNtroller with a mOdern Machine type." QEMU users can still get floppy devices, but they have to ask for them explicitly on the command-line. * * * Given that, and the use of floppy drives is generally not recommended in 2019, any objection to go ahead and remove support for floppy drives? Currently Nova allows the use of the floppy drive via these two disk image metadata properties: - hw_floppy_bus=fd - hw_rescue_device=floppy Filed this blueprint[2] to track this. * * * [1] https://access.redhat.com/articles/1444903 [2] https://blueprints.launchpad.net/nova/+spec/remove-support-for-floppy-disks -- /kashyap

2 2

[keystone] adfs SingleSignOn with CLI/API?
by Fabian Zimmermann 11 Feb '19

11 Feb '19

Hi, Im currently trying to implement some way to do a SSO against our ActiveDirectory. I already tried SAMLv2 and OpenID Connect. Im able to sign in via Horizon, but im unable to find a working way on cli. Already tried v3adfspassword and v3oidcpassword, but im unable to get them working. Any hints / links / docs where to find more information? Anyone using this kind of setup and willing to share KnowHow? Thanks a lot, Fabian Zimmermann

2 1

Re: [TripleO][Kolla] Reduce base layer of containers for security and size of images (maintenance) sakes: UPDATE
by Bogdan Dobrelya 11 Feb '19

11 Feb '19

Good news: so the %systemd_ordering macro works well for containers images to build it w/o systemd & deps pulled in, and the changes got accepted for RDO and some of the base packages for f29! Bad news: [0] is a show stopper for removing systemd off the base RHEL/Fedora containers in Kolla. To mitigate that issue for the remaining dnf and puppet, and as well for the less important* to have it fixed iscsi-initiator-utils and kuryr-kubernetes-distgit, we need to consider using microdnf instead of dnf for installing RPM packages in Kolla. Or alternatively somehow to achieve a trick with _tmpfiles to be split off the main spec files into sub-packages [1]: if the tmpfiles and such were split out into a subpackage that'd be required if and only if the kernel was installed or being installed, that might work. * it is only less important as those do not belong to the Kolla base/openstack-base images and impacts only its individual containers images. [0] https://bugs.launchpad.net/tripleo/+bug/1804822/comments/17 [1] https://github.com/rpm-software-management/dnf/pull/1315#issuecomment-46232… > Here is an update. > The %{systemd_ordering} macro is proposed for lightening containers > images and removing the systemd dependency for containers. Please see & > try patches in the topic [0] for RDO, and [1][2][3][4][5] for generic > Fedora 29 rpms. I'd very appreciate if anyone building Kolla containers > for f29/(rhel8 yet?) could try these out as well. > > PS (somewhat internal facing but who cares): I wonder if we could see > those changes catched up automagically for rhel8 repos as well? > >> I'm tracking systemd changes here [0],[1],[2], btw (if accepted, >> it should be working as of fedora28(or 29) I hope) >> >> [0] https://review.rdoproject.org/r/#/q/topic:base-container-reduction >> [1] https://bugzilla.redhat.com/show_bug.cgi?id=1654659 >> [2] https://bugzilla.redhat.com/show_bug.cgi?id=1654672 > > [0] https://review.rdoproject.org/r/#/q/topic:base-container-reduction > [1] https://bugzilla.redhat.com/show_bug.cgi?id=1654659 > [2] https://bugzilla.redhat.com/show_bug.cgi?id=1654672 > [3] https://bugzilla.redhat.com/show_bug.cgi?id=1668688 > [4] https://bugzilla.redhat.com/show_bug.cgi?id=1668687 > [5] https://bugzilla.redhat.com/show_bug.cgi?id=1668678 -- Best regards, Bogdan Dobrelya, Irc #bogdando

1 0

[cinder][nova][os-brick] os-brick initiator rename
by Kulazhenkov, Yury 11 Feb '19

11 Feb '19

Hi all, Some time ago Dell EMC software-defined storage ScaleIO was renamed to VxFlex OS. I am currently working on renaming ScaleIO to VxFlex OS in Openstack code to prevent confusion with storage documentation from vendor. This changes require patches at least for cinder, nova and os-brick repos. I already submitted patches for cinder(634397) and nova(634866), but for now code in these patches relies on os-brick initiator with name SCALEIO. Now I'm looking for right way to rename os-brick initiator. Renaming initiator in os-brick library and then make required changes in nova and cinder is quiet easy, but os-brick is library and those changes can break someone else code. Is some sort of policy for updates with breaking changes exist for os-brick? One possible solution is to rename initiator to new name and create alias with deprecation warning for old initiator name(should this alias be preserved more than one release?). What do you think about it? Thanks, Yury

3 2

Horizon extremely slow with 400 instances
by Satish Patel 11 Feb '19

11 Feb '19

folks, we have mid size openstack cloud running 400 instances, and day by day its getting slower, i can understand it render every single machine during loading instance page but it seems it's design issue, why not it load page from MySQL instead of running bunch of API calls behind then page? is this just me or someone else also having this issue? i am surprised why there is no good and robust Web GUI for very popular openstack? I am curious how people running openstack in large environment using Horizon. I have tired all kind of setting and tuning like memcache etc.. ~S

3 2

[infra][upstream-institute] Bot to vote on changes in the sandbox
by Tony Breeds 10 Feb '19

10 Feb '19

Hi All, During the Berlin forum the idea of running some kinda of bot on the sandbox [1] repo cam up as another way to onboard/encourage contributors. The general idea is that the bot would: 1. Leave a -1 review on 'qualifying'[2] changes along with a request for some small change 2. Upon seeing a new patchset to the change vote +2 (and possibly +W?) on the change Showing new contributors approximately what code review looks like[2], and also reduce the human requirements. The OpenStack Upstream Institute would make use of the bot and we'd also use it as an interactive tutorial from the contributors portal. I think this can be done as a 'normal' CI job with the following considerations: * Because we want this service to be reasonably robust we don't want to code or the job definitions to live in repo so I guess they'd need to live in project-config[4]. The bot itself doesn't need to be stateful as gerrit comments / meta-data would act as the store/state sync. * We'd need a gerrit account we can use to lodge these votes, as using 'proposal-bot' or tonyb would be a bad idea. My initial plan would be to develop the bot locally and then migrate it into the opendev infra once we've proven its utility. So thoughts on the design or considerations or should I just code something up and see what it looks like? Yours Tony. [1] http://git.openstack.org/cgit/openstack-dev/sandbox [2] The details of what counts as qualifying can be fleshed out later but there needs to be something so that contributors using the sandbox that don't want to be bothered by the bot wont be. [3] So it would a) be faster than typical and b) not all new changes are greeted with a -1 ;P [4] Another repo would be better as project-config is trusted we can't use Depends-On to test changes to the bot itself, but we need to consider the bots access to secrets

6 11

D&I WG Meeting Reminder
by Amy Marrich 10 Feb '19

10 Feb '19

The Diversity & Inclusion WG will hold it's next meeting Monday(2/11) at 17:00 UTC in the #openstack-diversity channel. The agenda can be found at https://etherpad.openstack.org/p/diversity-wg-agenda. Please feel free to add any other topics you wish to discuss at the meeting. Including the discuss list to invite potential new members! Thanks, Amy (spotz)

1 0

[goals][upgrade-checkers] Week R-9 Update
by Matt Riedemann 10 Feb '19

10 Feb '19

The only change since last week [1] is the swift patch was abandoned. The next closest patches to merge should be cloudkitty, ceilometer and aodh so if someone from those teams is reading this please check the open reviews [2]. [1] http://lists.openstack.org/pipermail/openstack-discuss/2019-February/002328… [2] https://review.openstack.org/#/q/topic:upgrade-checkers+status:open -- Thanks, Matt

1 0