- openstack-discuss - lists.openstack.org

[cinder][tempest] service_token_roles=admin unexpected behaviour
by Sven Springer 16 Aug '24

16 Aug '24

Hi, I have a question in regards to the service_token_roles setting in combination with an old vulnerability: I have a failing tempest test case, which is there to specifically test this vulnerability: https://lists.openstack.org/pipermail/openstack-announce/2023-May/002070.ht… I checked the cinder in our setup, and it contains the fix Test-reference: https://review.opendev.org/c/openstack/tempest/+/882876 Now I wonder if the test fails because in our setup, we set "service_token_roles = admin" for cinder, and the detach calls therefore being accepted (when the tempest tests expect them to be denied). Can someone confirm or deny this hypothesis? Best regards, Sven.

1 0

[release] Release countdown for week R-6, Aug 19-23
by Elõd Illés 16 Aug '24

16 Aug '24

Development Focus ----------------- Work on libraries should be wrapping up, in preparation for the various72 library-related deadlines coming up. Now is a good time to make decisions on deferring feature work to the next development cycle in order to be able to focus on finishing already-started feature work. General Information ------------------- We are now getting close to the end of the cycle, and will be gradually freezing feature work on the various deliverables that make up the OpenStack release. This coming week is the deadline for general libraries (except client libraries): their last feature release needs to happen before "Non-client library freeze" on August 22nd, 2024. Only bugfixes releases will be allowed beyond this point. When requesting those library releases, you can also include the stable/2024.2 branching request with the review (as an example, see the "branches" section here: https://opendev.org/openstack/releases/src/branch/master/deliverables/pike/… In the next weeks we will have deadlines for: * Client libraries (think python-*client libraries), which need to have their last feature release before "Client library freeze" (August 29th, 2024) * Deliverables following a cycle-with-rc model (that would be most services), which observe a Feature freeze on that same date, August 29th, 2024. Any feature addition beyond that date should be discussed on the mailing-list and get PTL approval. As we are getting to the point of creating stable/2024.2 branches, this would be a good point for teams to review membership in their $project-stable-maint groups. Once the stable/2024.2 branches are cut for a repo, the ability to approve any necessary backports into those branches for 2024.2 Dalmatian will be limited to the members of that stable team. If there are any questions about stable policy or stable team membership, please reach out in the #openstack-stable channel. Upcoming Deadlines & Dates -------------------------- Non-client library freeze: August 22nd, 2024 (R-6 week) Client library freeze: August 29th, 2024 (R-5 week) Dalmatian-3 milestone: August 29th, 2024 (R-5 week) Cycle Highlights Due: September 5th, 2024 (R-4 week) 2024.2 Dalmatian final release: October 2nd, 2024 Előd Illés irc: elodilles @ #openstack-release

1 0

[neutron] Drivers meeting canceled tomorrow, Friday, August 16th
by Brian Haley 16 Aug '24

16 Aug '24

Hello Neutrinos: I'm going to cancel tomorrow's drivers meeting as there is no agenda and two members cannot attend. There is one item for next week's meeting so far: * [RFE] Allow binding Security Groups to Network https://bugs.launchpad.net/neutron/+bug/2075955 Feel free to add any comments to the bug so the submitter can try and answer them before then. Thanks! -Brian

1 0

Connectivity Issues with Beluga Cloud
by Zil Pavdighada 16 Aug '24

16 Aug '24

Hello, I hope this email finds you well. I am currently working on a cloud project using the Beluga cloud platform. I have set up an Apache server on a VM and am hosting a website through MobaXTerm. While SSH is working fine, I am unable to connect to the VM using either the floating (public) or private IP address. I have already troubleshooted my network and MobaXTerm without success. I am wondering if the issue might be related to the cloud project itself. Any assistance you can provide would be greatly appreciated. Thank you. Zil Pavdighada

4 4

[kolla] LICENSE answer from
by Michal Arbet 15 Aug '24

15 Aug '24

Hello Koalas, I would like to share with you a statement where I discussed the possibility of adding orchestration for Konsul and similar projects (like Vault, for example, for Barbican) into the Kolla and Kolla-Ansible code – and whether this contradicts the conditions of the OpenDev community... TLDR - there is no problem to add this piece of code as it still remain optional and it's not break any license Last message in list: "After consulting foundation legal counsel, this type of integration should not be a problem from a licensing perspective as long as no BSL licensed code is added into OpenStack code and as long as use of the HashiCorp product remains optional." https://lists.openstack.org/archives/list/legal-discuss@lists.openstack.org… Thank you very much Michal Arbet Openstack Engineer Ultimum Technologies a.s. Na Poříčí 1047/26, 11000 Praha 1 Czech Republic +420 604 228 897 michal.arbet(a)ultimum.io *https://ultimum.io <https://ultimum.io/>* LinkedIn <https://www.linkedin.com/company/ultimum-technologies> | Twitter <https://twitter.com/ultimumtech> | Facebook <https://www.facebook.com/ultimumtechnologies/timeline>

2 1

[Cinder][Glance][Image Encryption] Discussion about the handling of images with old "cinder_encryption_*"-parameters
by Josephine Seifert 15 Aug '24

15 Aug '24

Hi everyone, because we will rename some parameters in encrypted images, we should discuss the transition from the old Glance image metadata naming (|cinder_encryption_*|) to the new one (|os_encrypt_*|). Glance and Cinder are affected: * |*_key_deletion_policy| is used to delete Barbican secrets; if Glance and Cinder use different namings here, secret is not properly deleted * if Cinder still uses |cinder_encryption_*|, secret consumers are not registered as the image is not detected as encrypted by Glance * Old image with old parameters may not be detected anymore by Cinder, as soon as the new code is rolled out It may be advisable to introduce a deprecation period and make Glance and Cinder still accept the old metadata names when parsing image metadata. The image encrpytion pop-up team is meeting next Monday 13 UTC in IRC (in openstack-meeting). We can discuss it then, please join the meeting. greetings Luzi

1 0

[charms] Proposing Jadon Naas and Myles Penner for OpenStack Charms core
by James Page 14 Aug '24

14 Aug '24

Hi everyone I'd like to propose Jadon Naas and Myles Penner for the OpenStack Charms core development team. Jadon has been contributing for over 12 months, providing reviews and direct contributions in a number of areas including figuring out a niggly configuration issue in the OIDC support in Keystone. Myles has been contributing for about 6 months - I'd highlight his work on owning the implementation of audit middleware support in the charms in support of his proposal to the core team. Thank you both for your contributions to the project! Regards James

2 2

networking-onos plugin
by Ganesan, Sathya 14 Aug '24

14 Aug '24

Good Day, Is there an alternative integration available for ONOS and Openstack since networking-onos is archived? Sathya Ganesan Geico Tech | Data Center Core Network Engineering - SDN | sganesan(a)geico.com<mailto:sganesan@geico.com> | 240.478.2121 | M-F 9a-5:30p EST Sensitivity: Company-Internal ==================== This email/fax message is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution of this email/fax is prohibited. If you are not the intended recipient, please destroy all paper and electronic copies of the original message.

2 2

[Nova][Keystone] Instance boot fail if user has many roles
by Masahito Muroi 14 Aug '24

14 Aug '24

Hi Nova and Keystone folks, I'd like to get your feedback for the bug[1] and the commit[2]. We use Keystone as company internal role management system and hit the issue frequently. The commit is to change instance_system_metadata table schema, but it could be too big change only for the long role list. Another idea I can imagine is to introduce "store_boot_roles" boolean configuration to store the boot_roles or not. IIUC, the boot_roles is used only by a specific vendor data in the metadata api. If there is another good value to store from Keystone side, I'm happy to use the value instead of role name, too. 1. https://bugs.launchpad.net/nova/+bug/2075100 2. https://review.opendev.org/c/openstack/nova/+/925163 thank you, Masahito

2 3

[kolla] IRC meeting cancelled today
by Bartosz Bezak 14 Aug '24

14 Aug '24

Hello, Unfortunately, due to the unavailability of core team members, we need to cancel today’s Kolla IRC meeting. Apologies for the late notice. Best regards, Bartosz Bezak

1 0