- openstack-discuss - lists.openstack.org

[designate] Question about NS record update restriction in multi-region PRIMARY/SECONDARY setup
by Sylvain 16 Dec '25

16 Dec '25

Hi everyone, I hope this email finds you well. I'm reaching out to the community because I'm encountering a limitation with Designate that I don't fully understand, and I'm hoping someone can shed some light on the reasoning behind it or suggest alternative approaches. My Setup I'm running a multi-region Designate deployment with: - 3 independent Designate instances (one per region) - Each instance has its own pool with a single nameserver: - Region 1: ns.region1.net. - Region 2: ns.region2.net. - Region 3: ns.region3.net. This default configuration works perfectly for most of our use cases where zones are region-specific. What I'm Trying to Achieve For certain domains, I need to set up a PRIMARY/SECONDARY configuration across all three regions: - Region 1: PRIMARY zone for example.com - Region 2: SECONDARY zone for example.com - Region 3: SECONDARY zone for example.com For this to work correctly, the PRIMARY zone needs to have NS records pointing to all three nameservers so that: 1. DNS clients can query any of the three nameservers 2. Zone transfers are properly configured between primary and secondaries The Problem When I try to update the NS recordset on the primary zone, I get the error: Updating a root zone NS record is not allowed Steps I'm following: # List recordsets to get the NS recordset ID openstack recordset list example.com. # Attempt to update the NS recordset openstack recordset set example.com. <ns-recordset-id> \ --record ns.region1.net. \ --record ns.region2.net. \ --record ns.region3.net. This happens even when authenticated as an admin user. Why the Default Workaround Doesn't Work I understand that one typical solution is to modify the pool configuration to include all three nameservers. However, this doesn't work in my case because: - I don't want to change the default pool settings since most zones should only use their local regional nameserver - Modifying the pool in Region 1 would affect *all zones* created there, not just the ones I want to replicate My Questions I'm trying to understand the design decisions here, and I'd really appreciate any insights: 1. What's the reasoning behind blocking NS record updates on root zones? I'm not seeing the security or technical concern that this protects against. 2. Is this restriction something that could potentially be made configurable via policy? For example, allowing zone owners to update their own NS records when they have legitimate multi-region or high-availability requirements. 3. Are there any alternative approaches I should be considering for this multi-region PRIMARY/SECONDARY setup that I might be missing? 4. Would the community be open to discussing a potential enhancement that makes this more flexible? I understand if there are concerns, but I'd love to understand them better. Use Case Context This is a fairly standard DNS architecture for high availability and geographic distribution. Many organizations need to run primary and secondary nameservers across different regions or datacenters, and being able to configure the NS records accordingly seems like it should be a supported use case. Thank you very much for taking the time to read this, and I appreciate any guidance or feedback the community can provide! Best regards, Sylvain.

2 1

Upcoming metrics dashboard changes
by Ildiko Vancsa 16 Dec '25

16 Dec '25

Hi OpenStack community, Since the OpenInfra Foundation joined the Linux Foundation, we have been looking into opportunities to take advantage of the frameworks and tool sets that the Linux Foundation has, and some of you and your organizations are already familiar with. While the dashboards are still being built I would like to let you know that, as part of that effort, we will switch to LFX Insights[1] as the metrics dashboard for OpenInfra projects, including OpenStack, starting on __January 15, 2026.__ A couple things to note: - The new OpenStack metrics dashboard[2] is already available, but it is __still under active construction.__ - The set of metrics that is displayed on the new dashboard will not be identical with the metrics on the dashboard provided by Bitergia. - LFX Insights does not display affiliation information for individuals who are listed on the dashboard as contributors, for privacy reasons. However, if you already have an LF account[3], you will be able to check and update your affiliation information. Or, you can create a new LF account[4]. - You can learn more about the dashboard in the LFX Insights documentation[5]. - If your organization is an OpenInfra Foundation / Linux Foundation member already, the LF Organization Dashboard[6] is also available for a more company-centric view. The OpenStack Bitergia metrics dashboard[7] remains available __until January 14, 2026.__ Please let me know if you have any questions. Best Regards, Ildikö [1] https://insights.linuxfoundation.org/ [2] https://insights.linuxfoundation.org/project/OpenStack/ [3] https://openprofile.dev/ [4] https://docs.linuxfoundation.org/lfx/sso/create-an-account [5] https://insights.linuxfoundation.org/docs/introduction/what-is-insights/ [6] https://lfx.linuxfoundation.org/tools/organization-dashboard/ [7] https://openstack.biterg.io/ ——— Ildikó Váncsa Director of Community OpenInfra Foundation

1 0

[qa] Onboarding contributors in QA
by Ghanshyam Maan 16 Dec '25

16 Dec '25

Hello Everyone, As you might know that we need more contributors in QA projects[1], I have started a etherpad to onboard new or current OpenStack contriburtors with all the deatils which includes: - Onboarding steps/information in OpenStack: this is for the new contributors in OpenStack - QA projects list and their documentation link - Current working item and help needed: this list will be evolving over time based on current working item. Currently I have listed the open bugs and moving tempest tests to SRBAC defaults. - https://etherpad.opendev.org/p/qa-onboarding I have four contributors started working on moving tempest testst to SRBAC defaults. If you or someone form your organization is interested, feel free to ping me or add your name in etherpad. [1] https://governance.openstack.org/tc/reference/upstream-investment-opportuni… -gmaan

1 0

[ops][publiccloud-sig] Public Cloud SIG meeting d.d. 17 December
by Kees Meijs | Nefos 16 Dec '25

16 Dec '25

Hello Stackers, Tomorrow (that's 17 December) the bi-weekly Public Cloud SIG meeting will be held again. The publicly available video meeting will be conducted from 08:05 hrs UTC (09:05 hrs CET) until 08:55 hrs UTC (09:55 hrs CET) here: https://meetpad.opendev.org/publiccloud-sig Additional information to be found on https://wiki.openstack.org/wiki/PublicCloudSIG See you tomorrow! Cheers, Kees __ Kees Meijs BICT Nefos Cloud & IT <https://nefos.com/contact> Nefos IT bv Burgemeester Mollaan 34a 5582 CK Waalre - NL kvk 66494931 +31 (0)88 2088 188 <tel:+31882088188> nefos.com <https://nefos.com/contact> The information contained in this message is intended for the addressee only and may contain classified information. If you are not the addressee, please delete this message and notify the sender; you should not copy or distribute this message or disclose its contents to anyone. Any views or opinions expressed in this message are those of the individual(s) and not necessarily of the organization. No reliance may be placed on this message without written confirmation from an authorised representative of its contents. No guarantee is implied that this message or any attachment is virus free or has not been intercepted and amended. General terms and conditions ("The NLdigital Terms") apply to all our products and services.

1 0

[OpenStack Ansible] [Deployment] Depolyment errors
by holywine＠outlook.com 16 Dec '25

16 Dec '25

Hello, Trying to deploy OpenStack on 5 hosts (3 infra, 2 compute). During executing command "openstack-ansible openstack.osa.setup_infrastructure" following errors occurred. Can anybody please provide a clue on what went wrong? Thanks in advance! 2025-12-16 16:21:15,379 p=382940 u=root n=ansible INFO| container_name: "infra1-repo-container-0b24c04d" 2025-12-16 16:21:15,379 p=382940 u=root n=ansible INFO| physical_host: "infra1" 2025-12-16 16:21:15,379 p=382940 u=root n=ansible INFO| Container confirmed 2025-12-16 16:21:15,533 p=382940 u=root n=ansible INFO| Using module file /etc/ansible/ansible_collections/gluster/gluster/plugins/modules/gluster_peer.py 2025-12-16 16:21:15,533 p=382940 u=root n=ansible INFO| Pipelining is enabled. 2025-12-16 16:21:15,533 p=382940 u=root n=ansible INFO| <infra1> ESTABLISH SSH CONNECTION FOR USER: root 2025-12-16 16:21:15,534 p=382940 u=root n=ansible INFO| <infra1> SSH: EXEC ssh -vvv -C -o ControlMaster=auto -o ControlPersist=300 -o StrictHostKeyChecking=no -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=5 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ServerAliveInterval=64 -o ServerAliveCountMax=1024 -o Compression=no -o TCPKeepAlive=yes -o VerifyHostKeyDNS=no -o ForwardX11=no -o ForwardAgent=yes -T -o 'ControlPath="/root/.ansible/cp/0fbb4d5943"' infra1 'sudo lxc-attach --clear-env --name infra1-repo-container-0b24c04d -- su - root -c '"'"'/bin/sh -c '"'"'"'"'"'"'"'"'/usr/bin/python3.12 && sleep 0'"'"'"'"'"'"'"'"''"'"'' 2025-12-16 16:21:19,534 p=382940 u=root n=ansible INFO| <infra1> (1, b'\n{"changed": false, "rc": 1, "failed": true, "msg": "peer probe: failed: Probe returned with Transport endpoint is not connected\\n", "invocation": {"module_args": {"nodes": ["infra1-repo-container-0b24c04d", "infra2-repo-container-8419857e", "infra3-repo-container-8432350f"], "state": "present", "force": null}}}\n', b"OpenSSH_9.6p1 Ubuntu-3ubuntu13.14, OpenSSL 3.0.13 30 Jan 2024\r\ndebug1: Reading configuration data /etc/ssh/ssh_config\r\ndebug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files\r\ndebug1: /etc/ssh/ssh_config line 21: Applying options for *\r\ndebug1: auto-mux: Trying existing master at '/root/.ansible/cp/0fbb4d5943'\r\ndebug2: fd 3 setting O_NONBLOCK\r\ndebug2: mux_client_hello_exchange: master version 4\r\ndebug3: mux_client_forwards: request forwardings: 0 local, 0 remote\r\ndebug3: mux_client_request_session: entering\r\ndebug3: mux_client_request_alive: entering\r\ndebug3: mux_client_request_alive: done pid = 386307\r\ndebug3: mux_client_request_session: session request sent\r\ndebug1: mux_client_request_session: master session id: 2\r\n/tmp/ansible_gluster.gluster.gluster_peer_payload_cd62ayz2/ansible_gluster.gluster.gluster_peer_payload.zip/ansible_collections/gluster/gluster/plugins/modules/gluster_peer.py:173: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead.\ndebug3: mux_client_read_packet_timeout: read header failed: Broken pipe\r\ndebug2: Received exit status from master 1\r\n") 2025-12-16 16:21:19,534 p=382940 u=root n=ansible INFO| <infra1> Failed to connect to the host via ssh: OpenSSH_9.6p1 Ubuntu-3ubuntu13.14, OpenSSL 3.0.13 30 Jan 2024 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files debug1: /etc/ssh/ssh_config line 21: Applying options for * debug1: auto-mux: Trying existing master at '/root/.ansible/cp/0fbb4d5943' debug2: fd 3 setting O_NONBLOCK debug2: mux_client_hello_exchange: master version 4 debug3: mux_client_forwards: request forwardings: 0 local, 0 remote debug3: mux_client_request_session: entering debug3: mux_client_request_alive: entering debug3: mux_client_request_alive: done pid = 386307 debug3: mux_client_request_session: session request sent debug1: mux_client_request_session: master session id: 2 /tmp/ansible_gluster.gluster.gluster_peer_payload_cd62ayz2/ansible_gluster.gluster.gluster_peer_payload.zip/ansible_collections/gluster/gluster/plugins/modules/gluster_peer.py:173: DeprecationWarning: distutils Version classes are deprecated. Use packaging.version instead. debug3: mux_client_read_packet_timeout: read header failed: Broken pipe debug2: Received exit status from master 1 2025-12-16 16:21:19,539 p=382940 u=root n=ansible INFO| fatal: [infra1-repo-container-0b24c04d]: FAILED! => changed: false invocation: module_args: force: null nodes: - infra1-repo-container-0b24c04d - infra2-repo-container-8419857e - infra3-repo-container-8432350f state: present msg: |- peer probe: failed: Probe returned with Transport endpoint is not connected rc: 1 BR, Frank

1 0

[blazar] Extending the payload of a notification, to send the entire lease data
by NITIN GUPTA 16 Dec '25

16 Dec '25

Hello Blazar Team, May I have the following change reviewed, for extending the payload of a notification, to send the entire lease data: *https://review.opendev.org/c/openstack/blazar/+/965448 <https://review.opendev.org/c/openstack/blazar/+/965448>* Looking for your feedback as soon as possible. Best regards. -- NITIN GUPTA

2 9

[neutron] Bug deputy report for week of December 8th
by Brian Haley 15 Dec '25

15 Dec '25

Hi, I was the Neutron bug deputy last week. Below is a short summary about the reported bugs. -Brian Critical bugs ------------- * None High bugs --------- * https://bugs.launchpad.net/neutron/+bug/2134504 - Wrong neutron:host_id in LSP external_ids after live migration - https://review.opendev.org/c/openstack/neutron/+/970564 Medium ------ * https://bugs.launchpad.net/neutron/+bug/2134387 - The is_default flag cannot be modified for external networks - https://review.opendev.org/c/openstack/neutron/+/970204 * https://bugs.launchpad.net/neutron/+bug/2134703 - [OVN] `update_lrouter_ports_ext_ids_name_prefix` should provide the Neutron DB port in `_gen_router_port_ext_ids` call - https://review.opendev.org/c/openstack/neutron/+/970644 Low --- * None Invalid ------- * https://bugs.launchpad.net/neutron/+bug/2134388 - auto allocate topology fails when there is only a single external network - Could no longer reproduce Wishlist -------- * https://bugs.launchpad.net/neutron/+bug/2134606 - [RFE] Add an API that returns a list of available IPs in a network - Asked for more information based on the change already proposed for network-ip-availabilities additions https://review.opendev.org/c/openstack/neutron/+/965083 - Not sure this is useful, will ask at meeting * https://bugs.launchpad.net/neutron/+bug/2135228 - [RFE] Add support for local sink in tap mirror - Asked Miro to add to future Driver's agenda

1 0

[ops][largescale-sig][scientific-sig][publiccloud-sig] Ops Radio Hour on December 19, 2025
by Ildiko Vancsa 15 Dec '25

15 Dec '25

Hi OpenStack community, I'm reaching out to you with a friendly reminder that the next OpenStack Ops Radio Hour[1] is scheduled to happen on __December 19th, 2025 at 1300UTC,__ which is this Friday! The call series is a casual setting for operators, engineers, and contributors to come together, share knowledge, and collaborate on the complexities of managing and deploying OpenStack environments. Topics for this call: - As this is the last call of the year, we can utilize it to have a retrospective on the call series and talk about plans for 2026. - We also had a great discussion at the PTG session about how to refactor Ops-related activities, which we can keep exploring for further increased collaboration between related groups: * See Thierry's email for initial details: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… * Meeting notes from October 31st: https://etherpad.opendev.org/p/openstack_ops_radiohour If you have further topics you would like to dive into during the call, please add them to this etherpad: https://etherpad.opendev.org/p/openstack_ops_radiohour A few reminders: - The group on the call agreed to try out Matrix as a chat platform for more synchronous communication outside calls + You can access the Matrix room here: https://matrix.to/#/#openstack-ops:opendev.org<https://matrix.to/#/%23openstack-ops:opendev.org> <https://matrix.to/#/%23openstack-ops:opendev.org%3Chttps://matrix.to/%23/%2…> + Further details are here: https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack… - If you would like to read and catch up on notes from previous calls, you can find them in this etherpad: https://etherpad.opendev.org/p/openstack_ops_radiohour See you on the call on December 19th! Bets Regards, Ildikó [1] https://wiki.openstack.org/wiki/Operations/Meetups

1 0

[stable][unmaintained] Move old Unmaintained branches to EOL
by Elõd Illés 15 Dec '25

15 Dec '25

Dear OpenStack Community, A bit more than two years ago the Unmaintained state was formalized [1] to signal towards the community that branches beyond the official maintained phase are not officially supported by the project teams themselves, rather by volunteers with interests to keep these branches open for co-operation and bug fix backports. This requires CI maintenance time to time, as CI jobs, infrastructure, packaging and build tools might also change under these legacy unmaintained branches. My employer, Ericsson, chose to support this process for further co- operation on these legacy branches and we stepped up as maintainer for unmaintained branches back till unmaintained/victoria as a starter, as long as it is feasible. Unfortunately, in the past months the point is reached where multiple gate jobs got broken, CI infrastructure elements (old ubuntu versions, old python versions) went to End of Life, too, and keeping meaningful testing [2] functional, is harder and harder on the oldest unmaintained/* branches [3]. Given these circumstances, I'm officially initiating to move old unmaintained branches to End of Life, starting with Victoria, and up till Yoga. I'll prepare the transition patches next week. Thanks to all, who helped with these old branches for this long. Sincerely, Előd Illés irc: elodilles @ #openstack-release / #openstack-stable / #openstack-unmaintained [1] https://governance.openstack.org/tc/resolutions/20230724-unmaintained-branc… [2] there were arguments about making it possible to merge patches without tempest or even without any tests, but that is something that we should avoid in my opinion as we cannot be sure that we don't introduce regressions if there were no proper testing and no one would want to consume untested code. [3] ubuntu-bionic node type is removed, py36 based jobs disappeared, tempest jobs started to fail with some test cases and with that, grenade jobs as well, etc.

2 3

[kolla] Cancelling weekly meetings on 24th and 31st of December 2025
by Michał Nasiadka 15 Dec '25

15 Dec '25

Hello Cancelling weekly meetings on 24th and 31st of December for obvious reasons The first meeting in 2026 will be on 7th of January Cheers, Michal

1 0