- openstack-discuss - lists.openstack.org

[mistral][heat][watcher][aodh] croniter being abandoned
by Thierry Carrez 22 Mar '25

22 Mar '25

Hi everyone, It was brought to my attention that the croniter maintainer has decided to abandon his project, due to not wanting to deal with his perceived exposure to the EU Cyber-Resilience act (CRA). https://pypi.org/project/croniter/#disclaimer The maintainer indicates that you should no longer use it and it may be "unpublished" any time after March 15, 2025. Croniter is being used in at least Mistral, Heat, Watcher, and Aodh as a dependency. While this is clearly an overreaction (the CRA only applies to "economic operators" putting "products with digital elements" on the market "in the course of a commercial activity"), we should probably prepare to migrate away from this dependency, or maintain a fork of it. -- Thierry Carrez (ttx)

5 8

[openstack-ansible] Weird install failure
by Sarah Thompson 21 Mar '25

21 Mar '25

Hi all, I think I'm close to getting things working at this point, but I'm seeing a weird install failure during openstack.osa.setup_openstack: FAILED - RETRYING: [ostk-controller-heat-api-container-7d1e8599 -> ostk-controller-utility-container-db5068d8]: Add service users to roles (1 retries left).Result was: attempts: 5 censored: 'the output has been hidden due to the fact that ''no_log: true'' was specified for this result' changed: false retries: 6 Using module file /etc/ansible/ansible_collections/openstack/cloud/plugins/modules/role_assignment.py Pipelining is enabled. <ostk-controller> ESTABLISH SSH CONNECTION FOR USER: root <ostk-controller> SSH: ansible.cfg set ssh_args: (-C)(-o)(ControlMaster=auto)(-o)(ControlPersist=300) <ostk-controller> SSH: ANSIBLE_HOST_KEY_CHECKING/host_key_checking disabled: (-o)(StrictHostKeyChecking=no) <ostk-controller> SSH: ANSIBLE_REMOTE_PORT/remote_port/ansible_port set: (-o)(Port=22) <ostk-controller> SSH: ansible_password/ansible_ssh_password not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no) <ostk-controller> SSH: ANSIBLE_REMOTE_USER/remote_user/ansible_user/user/-u set: (-o)(User="root") <ostk-controller> SSH: ANSIBLE_TIMEOUT/timeout set: (-o)(ConnectTimeout=5) <ostk-controller> SSH: Set ssh_extra_args: (-o)(UserKnownHostsFile=/dev/null)(-o)(StrictHostKeyChecking=no)(-o)(ServerAliveInterval=64)(-o)(ServerAliveCountMax=1024)(-o)(Compression=no)(-o)(TCPKeepAlive=yes)(-o)(VerifyHostKeyDNS=no)(-o)(ForwardX11=no)(-o)(ForwardAgent=yes)(-T) <ostk-controller> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath="/root/.ansible/cp/d3dfd6cdfc") <ostk-controller> SSH: EXEC ssh -vvvvv -C -o ControlMaster=auto -o ControlPersist=300 -o StrictHostKeyChecking=no -o Port=22 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=5 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ServerAliveInterval=64 -o ServerAliveCountMax=1024 -o Compression=no -o TCPKeepAlive=yes -o VerifyHostKeyDNS=no -o ForwardX11=no -o ForwardAgent=yes -T -o 'ControlPath="/root/.ansible/cp/d3dfd6cdfc"' ostk-controller 'sudo lxc-attach --clear-env --name ostk-controller-utility-container-db5068d8 -- su - root -c '"'"'/bin/sh -c '"'"'"'"'"'"'"'"'/openstack/venvs/utility-30.1.0.dev46/bin/python && sleep 0'"'"'"'"'"'"'"'"''"'"'' <ostk-controller> rc=1, stdout and stderr censored due to no log <ostk-controller> Failed to connect to the host via ssh: <error censored due to no log> failed: [ostk-controller-heat-api-container-7d1e8599 -> ostk-controller-utility-container-db5068d8(192.168.100.117)] (item=None) => attempts: 5 censored: 'the output has been hidden due to the fact that ''no_log: true'' was specified for this result' changed: false fatal: [ostk-controller-heat-api-container-7d1e8599 -> {{ _service_setup_host }}]: FAILED! => censored: 'the output has been hidden due to the fact that ''no_log: true'' was specified for this result' changed: false These logs came from running ansible with -vvvvv as a parameter. Looking at the failed ssh, this root causes pretty straightforwardly: ssh -vvvvv -C -o ControlMaster=auto -o ControlPersist=300 -o StrictHostKeyChecking=no -o Port=22 -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o 'User="root"' -o ConnectTimeout=5 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ServerAliveInterval=64 -o ServerAliveCountMax=1024 -o Compression=no -o TCPKeepAlive=yes -o VerifyHostKeyDNS=no -o ForwardX11=no -o ForwardAgent=yes -T -o 'ControlPath="/root/.ansible/cp/d3dfd6cdfc"' ostk-controller 'sudo lxc-attach --clear-env --name ostk-controller-utility-container-db5068d8 -- su - root -c '"'"'/bin/sh -c '"'"'"'"'"'"'"'"'/openstack/venvs/utility-30.1.0.dev46/bin/python && sleep 0'"'"'"'"'"'"'"'"''"'"'' If I manually ssh to ostk-controller and lxc-attach -n ostk-controller-utility-container-db5068d8, then run the command explicitly: root@ostk-controller-utility-container-db5068d8:~# /openstack/venvs/utility-30.1.0.dev46/bin/python && sleep 0 Python 3.10.12 (main, Feb 4 2025, 14:57:36) [GCC 11.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> KeyboardInterrupt >>> exit() So basically it's invoking an interactive python session, which of course times out, and after 5 retries the installation aborts. Something is obviously missing somewhere, most likely a parameter after the python command which specifies a python script to be run. Any ideas? Thanks all, Sarah

2 1

[cinder][nova] force detach volume
by Arnaud Morin 21 Mar '25

21 Mar '25

Hey team, Is there any way to force detach a volume when the nova compute service is down? Like when the hypervisor is off, we want to detach the volume and attach it to another instance. Maybe I'm missing the way to do it, but detach action on nova side seems a synchronous task that I can't force without admin creds. Thanks for any help, Regards, Arnaud

4 6

[release] Release countdown for week R-1, Mar 24 - 28
by Elõd Illés 21 Mar '25

21 Mar '25

(re-sent this mail with the right week number in subject, sry :S) Development Focus ----------------- We are on the final mile of the 2025.1 Epoxy development cycle! Remember that the 2025.1 Epoxy final release will include the latest release candidate (for cycle-with-rc deliverables) or the latest intermediary release (for cycle-with-intermediary deliverables) available. March 28th, 2025 is the deadline for final 2025.1 Epoxy release candidates as well as any last cycle-with-intermediary deliverables. We will then enter a quiet period until we tag the final release on April 2nd, 2025. Teams should be prioritizing fixing release-critical bugs, before that deadline. Otherwise it's time to start planning the 2025.2 Flamingo development cycle, including discussing Forum and PTG sessions content, in preparation of Project Teams Gathering (virtual), April 7th-11th, 2025. Actions ------- Watch for any translation patches coming through on the stable/2025.1 branch and merge them quickly. If you discover a release-critical issue, please make sure to fix it on the master branch first, then backport the bugfix to the stable/2025.1 branch before triggering a new release. Please drop by #openstack-release with any questions or concerns about the upcoming release ! Upcoming Deadlines & Dates -------------------------- Final 2025.1 Epoxy release: April 2nd, 2025 Project Teams Gathering (virtual): April 7th-11th, 2025 Előd Illés irc: elodilles @ #openstack-release

1 0

[release] Release countdown for week R-4, Mar 24 - 28
by Elõd Illés 21 Mar '25

21 Mar '25

Development Focus ----------------- We are on the final mile of the 2025.1 Epoxy development cycle! Remember that the 2025.1 Epoxy final release will include the latest release candidate (for cycle-with-rc deliverables) or the latest intermediary release (for cycle-with-intermediary deliverables) available. March 28th, 2025 is the deadline for final 2025.1 Epoxy release candidates as well as any last cycle-with-intermediary deliverables. We will then enter a quiet period until we tag the final release on April 2nd, 2025. Teams should be prioritizing fixing release-critical bugs, before that deadline. Otherwise it's time to start planning the 2025.2 Flamingo development cycle, including discussing Forum and PTG sessions content, in preparation of Project Teams Gathering (virtual), April 7th-11th, 2025. Actions ------- Watch for any translation patches coming through on the stable/2025.1 branch and merge them quickly. If you discover a release-critical issue, please make sure to fix it on the master branch first, then backport the bugfix to the stable/2025.1 branch before triggering a new release. Please drop by #openstack-release with any questions or concerns about the upcoming release ! Upcoming Deadlines & Dates -------------------------- Final 2025.1 Epoxy release: April 2nd, 2025 Project Teams Gathering (virtual): April 7th-11th, 2025 Előd Illés irc: elodilles @ #openstack-release

1 0

[neutron] Drivers meeting canceled Friday, March 21st
by Brian Haley 20 Mar '25

20 Mar '25

Hello Neutrinos: I'm going to cancel tomorrow's drivers meeting as I have a conflict and cannot attend. Let's just add any new RFE items to the agenda for the upcoming PTG [0] - I'll try and group them all together in our Thursday meeting slots if possible. Just a reminder there are still open specs that need review, list is at [1], would be good to get them merged. Have a nice weekend! -Brian [0] https://etherpad.opendev.org/p/apr2025-ptg-neutron [1] https://review.opendev.org/q/status:open+project:openstack/neutron-specs

1 0

[ironic] [operators] Inspector service deprecated; scope assumed by Ironic
by Jay Faulkner 19 Mar '25

19 Mar '25

OpenStack developers and deployers, In 2014, Dmitry Tantsur created a project to allow deployers of Ironic to inspect nodes and discover and enroll new nodes -- ironic-inspector. This project has become a staple, deployed alongside other Ironic services in most common deployments. Over the last couple of years, we've worked on -- and now completed -- a migration all existing ironic-inspector functionality into the primary Ironic service. As a result of that, the service/project at openstack/ironic-inspector and it's client at openstack/python-ironic-inspector-client have both been in maintenance mode since 2024. Users of Ironic should not expect future releases of ironic-inspector past this SLURP release of OpenStack 2025.1. If you have any issues migrating to the in-tree inspection functionality in Ironic, please reach out to the Ironic team on the mailing list, in IRC, or wherever else you may find us. Thanks, Jay Faulkner Ironic Security Liason

1 0

[neutron][l3 agent] pymysql.err.IntegrityError (Duplicate entry) while updating router information
by Viacheslav Klenov 19 Mar '25

19 Mar '25

Hello, We ran into a strange issue with neutron l3_agent after failed live-migration, which failed due to pyroute2/iproute2 version incompatibility issue During live-migration l3 agent starts to update router information but then logs a lot of errors 2025-03-13 12:28:18.041 43002 ERROR neutron.agent.l3.agent [-] Failed to fetch router information for '4b89508c-beaf-43cf-92a6-9e080c03554d': oslo_messaging.rpc.client.RemoteError: Remote error: PendingRollbackError This Session's transaction has been rolled back due to a previous exception during flush. To begin a new transaction with this Session, first issue Session.rollback(). Original exception was: (pymysql.err.IntegrityError) (1062, "Duplicate entry '506ac36d-4e5c-47a1-96ca-36f739018dfe-hv-017' for key 'PRIMARY'") [SQL: INSERT INTO ml2_distributed_port_bindings (port_id, host, router_id, vif_type, vif_details, vnic_type, profile, status) VALUES (%(port_id)s, %(host)s, %(router_id)s, %(vif_type)s, %(vif_details)s, %(vnic_type)s, %(profile)s, %(status)s)] [parameters: {'port_id': '506ac36d-4e5c-47a1-96ca-36f739018dfe', 'host': 'hv-017', 'router_id': '4b89508c-beaf-43cf-92a6-9e080c03554d', 'vif_type': 'unbound', 'vif_details': '', 'vnic_type': 'normal', 'profile': '', 'status': 'DOWN'}] (log attached) Before the migration there is no records in neutron ml2_distributed_port_bindings table with a hostname from the error after the errors the migrated VM is seemingly functional The error reproduces every time on live-migration even after pyroute2/iproute2 incompatibility was fixed Any insight into why is this happening or a way to fix it would be greatly appreciated -- Viacheslav ----------------- Viacheslav Klenov vklenov(a)sardinasystems.com | www.sardinasystems.com | @sardinasystems | https://www.linkedin.com/company/sardina-systems "We build technology so that others can build more technology.”

2 2

Guidance on Deploying Octavia with VXLAN in Nested OpenStack Setup
by Thamanna Farhath 19 Mar '25

19 Mar '25

Dear OpenStack Community, I am currently using OpenStack 2023.1 and looking to deploy Octavia using VXLAN networking. My setup consists one parent openstack environment, and within this, I have an nested OpenStack deployment in which I want to configure Octavia with VXLAN. I would appreciate any guidance on the following: Network Configuration: Best practices for setting up VXLAN tunnels in a nested OpenStack environment. Octavia Deployment: Steps or references for installing Octavia with VXLAN networking. Integration with Neutron: Any specific settings required to ensure proper communication between the parent network and the nested OpenStack deployment. Reference Documentation: Any official or community-driven guides that can help with this setup. If anyone has experience with a similar deployment or has documentation to refer to, I would be grateful for your insights. Thank you in advance for your help! Associate Engineer-R&D Thamanna Farhath N Cn: (+91) 9344093591 , thamanna.f(a)zybisys.com Zybisys Consulting LLP | Srinivasa Tower' No.29, 39th E Cross, 4th T Block, Jayanagar , Bangalore India – 560041 http://zybisys.com/ Disclaimer : The content of this email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to which they are addressed. If you have received this email in error, please notify the sender and remove the messages from your system. If you are not the named addressee, it is strictly forbidden for you to share, circulate, distribute or copy any part of this e-mail to any third party without the written consent of the sender. E-mail transmission cannot be guaranteed to be secured or error free as information could be intercepted, corrupted, lost, destroyed, arrive late, incomplete, or may contain viruses. Therefore, we do not accept liability for any errors or omissions in the contents of this message, which arise as a result of e-mail transmission. The recipient should check this e-mail and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email."

1 0

Spice, NoVNC and TLS
by Jani Heikkinen 19 Mar '25

19 Mar '25

Dear Openstack community, I would be happy to hear if anybody has configured Spice or noVNC console with TLS. Is this possible with using spicehtml5proxy? As far I know, it is easy to set up the TLS until the server running spiche5html(or noVNC). And according to Websockets documentation, it will only establish itself over existing http connection. How the proxy actually forms this connection? Is it possible to pass TLS certificates to it? My requirement would also be, that self-signed certificates are no-go. Best, and thanks, Jani -- Berner Fachhochschule / Bern University of Applied Sciences IT-Services / Team Linux & Infrastructure Services Jani Heikkinen IT Linux Engineer ___________________________________________________________ Dammweg 3, CH-3013 Bern Telefon direkt +41 31 848 68 14 Telefon Servicedesk +41 31 848 48 48 jani.heikkinen(a)bfh.ch

4 5