- Community - lists.openinfra.dev

[openstack-community] Future of this mailing list
by Jeremy Stanley 22 Mar '21

22 Mar '21

After looking back through the last 6 months worth of list archives, there have been 9 threads: 1 was an announcement about the OpenStack Annual Report and the other 8 were technical support requests which needed to be referred to the openstack-discuss mailing list. Even though the description for this list clearly says it's not for support questions, that seems to be pretty much the only thing anyone besides foundation staff send to it. So with that in mind, is this list still serving any useful purpose? Should we consider retiring it or folding it into another list (maybe openstack-discuss)? -- Jeremy Stanley

3 4

[openstack-community] Authenticating to devstack and listing nova flavors + servers
by Joe Wolfe 21 Mar '21

21 Mar '21

Hi All, I am working on an api and would like to get some more context behinds authenticating into the api - so I am trying to get a list out of available flavors 1 and servers to start off with. I am able to get a token that I can interact with against keystone which shows up as https://mydevstackurl/identity/ <https://mydevstackurl/identity/> however when I try and run a simple curl against my compute as follows: curl -H "X-Auth-Token: $OS_TOKEN" -s https://http://mydevstackurl/compute/api/v2.1/servers <https://http//mydevstackurl/compute/api/v2.1/servers> I got no response back from curl - no 200 ,no 30x no 4xx nothing. Can anyone help to get me started ? The documents seem to be pretty detailed - but the methods provided don’t seem to work either in the tutorial: for example: curl -s -H "X-Auth-Token: $OS_TOKEN" \ $OS_COMPUTE_API/flavors \ | python -m json.tool Only returns: zsh: no matches found: http://mydevstackurl/identity/v3/auth/tokens?nocatalog Expecting value: line 1 column 1 (char 0) Thanks

2 1

[openstack-community] [victoria][keystone][ops]Keystone enforced policy issues
by Luke Camilleri 12 Mar '21

12 Mar '21

Hi there, we have been troubleshooting keystone policies for a couple of days now (Victoria) and would like to reach out to anyone with some experience on the keystone policies. Basically we would like to follow the standard admin, member and reader roles together with the scopes function and have therefore enabled the below two option in keystone.conf enforce_scope = true enforce_new_defaults = true once enabled we started seeing the below error related to token validation in keystone.log: 2021-03-11 19:50:12.009 1047463 WARNING keystone.server.flask.application [req-33cda154-1d54-447e-8563-0676dc5d8471 020bd854741e4ba69c87d4142cad97a5 c584121f9d1a4334a3853c61bb5b9d93 - default default] You are not authorized to perform the requested action: identity:validate_token.: keystone.exception.ForbiddenAction: You are not authorized to perform the requested action: identity:validate_token. The policy was previously setup as: identity:validate_token: rule:service_admin_or_token_subject but has now been implemented with the new scope format to: identity:validate_token: (role:reader and system_scope:all) or rule:service_role or rule:token_subject If we change the policy to the old one, we stop receiving the identity:validate_token exception. This only happens in horizon and running the same commands in the CLI (python-openstack-client) does not output any errors. To work around this behavior we place the old policy for validate_token rule in /usr/share/openstack-dashboard/openstack_dashboard/conf/keystone_policy.yaml and in the file /etc/keystone/keystone.conf A second way how we can solve the validate_token exception is to disable the option which has been enabled above "enforce_new_defaults = true" which will obviously allow the deprecated policy rules to become effective and hence has the same behavior as implementing the old policy as we did We would like to know if anyone have had this behavior and how it has been solved maybe someone can point us in the right direction to identify better what is going on. Last but not least, it seems that from Horizon, the admin user is being assigned a project scoped token instead of a system scoped token, while from the CLI the same admin user can successfully issue a system:all token and run commands across all resources. We would be very happy to receive any form of input related to the above issues we are facing Thanks in advance for any assistance

2 1

[openstack-community] Keystone deprecated policies problem
by meberhardt＠unl.edu.ar 05 Mar '21

05 Mar '21

Hi, my installation complains about deprecated policies and throw errors when I try to run specific commands in cli as admin user(list projects or list users, for example). "You are not authorized to perform the requested action: identity:list_users." I tried to fix this by upgrading the keystone policies using oslopolicy-policy-generator and oslopolicy-policy-upgrade. Just found two places where I have those keystone policy files in my sistem: /etc/openstack_dashboard/keystone_policy.json and cd /lib/python3.6/site-packages/openstack_auth/tests/conf/keystone_policy.json I regenerated & upgraded it but Keystone still complains about the old polices. Where are it placed? How I shoud fix it? OS: CentOS 8 Openstack version: Ussuri Manual installation Thanks, Matias /* --------------------------------------------------------------- */ /* Matías A. Eberhardt */ /* */ /* Centro de Telemática */ /* Secretaría General */ /* UNIVERSIDAD NACIONAL DEL LITORAL */ /* Pje. Martínez 2652 - S3002AAB Santa Fe - Argentina */ /* tel +54(342)455-4245 - FAX +54(342)457-1240 */ /* --------------------------------------------------------------- */

2 1

Re: [openstack-community] Ovn chassis error possibly networking config error.
by Dees 02 Mar '21

02 Mar '21

Thanks for your reply much appreciated, deployed OpenStack through JUJU. I managed to get around that issue by restarting services but I have fallen into another issue now, looks like I need to define network time somewhere on the config I am right? When I create a network trying to get out a second interface I am getting errors. Any suggestions, please? labuser@maas:~/openstack-base$ openstack network create Pub_Net1 --external --share --default --provider-network-type vlan --provider-segment 201 --provider-physical-network externalError while executing the command: BadRequestException: 400, Invalid input for operation: physical_network 'external' unknown for VLAN provider network. The first network segment is ok labuser@maas:~/openstack-base$ openstack network create Pub_Net --external --share --default \ --provider-network-type vlan --provider-segment 200 --provider-physical-network physnet1 Config on juju ovn-chassis: annotations: gui-x: '120' gui-y: '1030' charm: cs:ovn-chassis-10 # *** Please update the `bridge-interface-mappings` to values suitable *** # *** for thehardware used in your deployment. See the referenced *** # *** documentation at the top of this file. *** options: ovn-bridge-mappings: physnet1:br-data external:br-ex bridge-interface-mappings: br-data:eno2 br-ex:eno3 Status ubuntu@1:~$ sudo ovs-vsctl showe3b50030-b436-4d26-95af-4abeea1097d5 Manager "ptcp:6640:127.0.0.1" is_connected: true Bridge br-data fail_mode: standalone datapath_type: system Port eno2 Interface eno2 type: system Port br-data Interface br-data type: internal Bridge br-int fail_mode: secure datapath_type: system Port br-int Interface br-int type: internal Port ovn-comput-0 Interface ovn-comput-0 type: geneve options: {csum="true", key=flow, remote_ip="10.141.14.36"} Bridge br-ex fail_mode: standalone datapath_type: system Port eno3 Interface eno3 type: system Port br-ex Interface br-ex type: internal ovs_version: "2.13.1" Kind regards,Deepesh On Monday, 1 March 2021, 10:39:51 GMT, Lucas Alvares Gomes <lucasagomes(a)gmail.com> wrote: Hi, Few questions inline On Mon, Mar 1, 2021 at 12:09 AM Amy Marrich <amy(a)demarco.com> wrote: > > Deepesh, > > Forwarding to the OpenStack Discuss mailing list. > > Thanks, > > Amy (spotz) > > On Sat, Feb 27, 2021 at 12:42 PM Dees <motosingh(a)yahoo.co.uk> wrote: >> >> Hi All, >> >> Deployed openstack all service yesterday and seemed to be running since power cycling the openstack today. >> What did you use to deploy OpenStack ? Based on the command below I don't recognize that output. >> Then deployed and configured VM instance with networking but config onv-chassis is reporting error, as I am new to openstack (having used it number of years back) mind guiding where I should be looking any help will be greatly appreciated. >> >> >> >> nova-compute/0* active idle 1 10.141.14.62 Unit is ready >> ntp/0* active idle 10.141.14.62 123/udp chrony: Ready >> ovn-chassis/0* error idle 10.141.14.62 hook failed: "config-changed" >> I do not recognize this output or that error in particular, but I assume that ovn-chassis is the name of the process of the ovn-controller running on the node ? If so, the configuration of ovn-controller should be present in the local OVSDB instance, can you please paste the output of the following command: $ sudo ovs-vsctl list Open_VSwitch . Also, do you have any logs related to that process ? >> >> Deployed VM instance using the following command line. >> >> >> curl http://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img | \ >> openstack image create --public --container-format bare --disk-format qcow2 \ >> --property architecture=x86_64 --property hw_disk_bus=virtio \ >> --property hw_vif_model=virtio "focal_x86_64" >> >> openstack flavor create --ram 512 --disk 4 m1.micro >> >> openstack network create Pub_Net --external --share --default \ >> --provider-network-type vlan --provider-segment 200 --provider-physical-network physnet1 >> >> openstack subnet create Pub_Subnet --allocation-pool start=10.141.40.40,end=10.141.40.62 \ >> --subnet-range 10.141.40.0/26 --no-dhcp --gateway 10.141.40.1 \ >> --network Pub_Net >> >> openstack network create Network1 --internal >> openstack subnet create Subnet1 \ >> --allocation-pool start=192.168.0.10,end=192.168.0.199 \ >> --subnet-range 192.168.0.0/24 \ >> --gateway 192.168.0.1 --dns-nameserver 10.0.0.3 \ >> --network Network1 >> >> Kind regards, >> Deepesh >> _______________________________________________ >> Community mailing list >> Community(a)lists.openstack.org >> http://lists.openstack.org/cgi-bin/mailman/listinfo/community

1 1

[openstack-community] Ovn chassis error possibly networking config error.
by Dees 01 Mar '21

01 Mar '21

Hi All, Deployed openstack all service yesterday and seemed to be running since power cycling the openstack today. Then deployed and configured VM instance with networking but config onv-chassis is reporting error, as I am new to openstack (having used it number of years back) mind guiding where I should be looking any help will be greatly appreciated. nova-compute/0* active idle 1 10.141.14.62 Unit is ready ntp/0* active idle 10.141.14.62 123/udp chrony: Ready ovn-chassis/0* error idle 10.141.14.62 hook failed: "config-changed" Deployed VM instance using the following command line. curl http://cloud-images.ubuntu.com/focal/current/focal-server-cloudimg-amd64.img | \ openstack image create --public --container-format bare --disk-format qcow2 \ --property architecture=x86_64 --property hw_disk_bus=virtio \ --property hw_vif_model=virtio "focal_x86_64" openstack flavor create --ram 512 --disk 4 m1.micro openstack network create Pub_Net --external --share --default \ --provider-network-type vlan --provider-segment 200 --provider-physical-network physnet1 openstack subnet create Pub_Subnet --allocation-pool start=10.141.40.40,end=10.141.40.62 \ --subnet-range 10.141.40.0/26 --no-dhcp --gateway 10.141.40.1 \ --network Pub_Net openstack network create Network1 --internalopenstack subnet create Subnet1 \ --allocation-pool start=192.168.0.10,end=192.168.0.199 \ --subnet-range 192.168.0.0/24 \ --gateway 192.168.0.1 --dns-nameserver 10.0.0.3 \ --network Network1 Kind regards,Deepesh

2 2

[openstack-community] 2020 Open Infrastructure Foundation Annual Report Now Available
by Allison Price 28 Jan '21

28 Jan '21

Despite being a very different year than most, the Open Infrastructure community, which has over 110,000 community members, made it a productive and successful year. We could not have done this without each and every one of you. One of the biggest milestones that happened in the global community last year was that OpenStack, one of the top three most active open source projects with 15 million cores in production, marked its 10th anniversary in 2020. OpenStack is undoubtedly a success. Millions of CPU cores of computing infrastructure are provided through OpenStack. More than 70 regions of public clouds powered by OpenStack are available for users worldwide. Last year saw our 22nd (on-time) release, with more than 20,000 changes merged in only 5 months. A level of activity that placed OpenStack among the three most active open source development communities in the world. Now, we are seeing users who have been around for years talk about their growing OpenStack production deployments like Workday, LINE, and CERN, as well as new users talk about how they’re running other open source projects in production like Ant Group using Kata Containers, Verizon running StarlingX, and Volvo running Zuul for their autonomous driving software. The Open Infrastructure Foundation would like to extend a huge thanks to the global community for all of the work that went into 2020 and is continuing in 2021 to help people build and operate open infrastructure. Check out the OpenStack community’s achievements in 2020 from the OpenInfra Foundation Annual Report and join us <https://openinfra.dev/join/> to build the next decade of open infrastructure! https://www.openstack.org/annual-reports/2020-openstack-foundation-annual-r… <https://www.openstack.org/annual-reports/2020-openstack-foundation-annual-r…> Let’s cheer on the new year and to the successful growth of the seeds planted over these past years. Cheers, Allison Allison Price Open Infrastructure Foundation allison(a)openstack.org

1 0

[openstack-community] Rally Openstack environment creation
by Kiran Gavali 20 Jan '21

20 Jan '21

Hi Openstack Members, I want use the rally openstack. Please share me the steps to install rally . And what kind of environment we need to create . Is it required to install rally only on openstack server or we can install it on Other independent Machine ? Thanks And Regards Kiran Gavali NEC INDIA | DEGITAL PF | Mob: 8700332988 ________________________________ The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. It shall not attach any liability on the originator or NEC Corporation India Private Limited or its affiliates. Any views or opinions presented in this email are solely those of the author and may not necessarily reflect the opinions of NEC Corporation India Private Limited or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of the author of this e-mail is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.

1 0

[openstack-community] Enabling KVM on Openstack
by open infra 13 Jan '21

13 Jan '21

Hi I have enabled KVM after deploying openstack single node setup. Following entries has been added to /etc/nova/nova.conf and then restart libvirtd.service and openstack-nova-compute.servic. compute_driver = libvirt.LibvirtDriver [libvirt] virt_type=kvm #virt_type=qemu # lsmod | grep kvm kvm_intel 188740 0 kvm 637289 1 kvm_intel irqbypass 13503 1 kvm I still can see Hypervisor Type as QEMU, when I issue openstack hypervisor list command. Is this normal?

2 2

[openstack-community] kolla node_libvirt and broken cgroups
by Denis Kadyshev 11 Nov '20

11 Nov '20

I have an openstack ocata release deployed via kolla. Libvirtd running inside docker container nova_ libvirt and volumes /sys/fs/cgroup, /run privileged mode enabled. Some guest vms cannot provide cpu-stats Symptoms are: > $ docker exec -ti nova_libvirt virsh cpu-stats instance-000004cb > error: Failed to retrieve CPU statistics for domain 'instance-000004cb' > error: Requested operation is not valid: cgroup CPUACCT controller is not > mounted To check cgroups looking for all related pid > $ ps fax | grep instance-000004cb > 8275 ? Sl 4073:40 /usr/libexec/qemu-kvm -name guest=instance-000004cb > $ ps fax | grep 8275 > 8346 ? S 76:04 \_ [vhost-8275] > 8367 ? S 0:00 \_ [kvm-pit/8275] > 8275 ? Sl 4073:42 /usr/libexec/qemu-kvm See cgroup for qemu-kvm > $ cat /proc/8275/cgroup > 11:blkio:/user.slice > 10:devices:/user.slice > > 9:hugetlb:/docker/e5bef89178c1c3ae34fd2b4a9b86b299a6145c0b9f608a06e83f6f4ca4d897bd > 8:cpuacct,cpu:/user.slice > > 7:perf_event:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > > 6:net_prio,net_cls:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > 5:freezer:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > 4:memory:/user.slice > 3:pids:/user.slice > > 2:cpuset:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope/emulator > 1:name=systemd:/user.slice/user-0.slice/session-c1068.scope for vhost-8275 > $ cat /proc/8346/cgroup > 11:blkio:/user.slice > 10:devices:/user.slice > > 9:hugetlb:/docker/e5bef89178c1c3ae34fd2b4a9b86b299a6145c0b9f608a06e83f6f4ca4d897bd > 8:cpuacct,cpu:/user.slice > > 7:perf_event:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > > 6:net_prio,net_cls:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > 5:freezer:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope > 4:memory:/user.slice > 3:pids:/user.slice > > 2:cpuset:/machine.slice/machine-qemu\x2d25\x2dinstance\x2d000004cb.scope/emulator > 1:name=systemd:/user.slice/user-0.slice/session-c1068.scope for kvm-pit > $ cat /proc/8275/cgroup > 11:blkio:/user.slice > 10:devices:/user.slice > 9:hugetlb:/ > 8:cpuacct,cpu:/user.slice > 7:perf_event:/ > 6:net_prio,net_cls:/ > 5:freezer:/ > 4:memory:/user.slice > 3:pids:/user.slice > 2:cpuset:/ > 1:name=systemd:/user.slice/user-0.slice/session-c4807.scope I tried to fix the groups with a this script > get_broken_vms() { > docker exec nova_libvirt bash -c 'for vm in $(virsh list --name); do > virsh cpu-stats $vm > /dev/null 2>&1 || echo $vm; done' > } > > attach_vm_to_cgroup() { > # Attach processes and their threads pid to correct cgroup > local vm_pid=$1; shift > local vm_cgname=$1; shift > > echo Fix cgroup for pid $vm_pid in cgroup $vm_cgname > > for tpid in $(find /proc/$vm_pid/task/ -maxdepth 1 -mindepth 1 -type d > -printf '%f\n'); do > echo $tpid | tee > /sys/fs/cgroup/{blkio,devices,perf_event,net_prio,net_cls,freezer,memory,pids,systemd}/machine.slice/$vm_cgname/tasks > 1>/dev/null & > echo $tpid | tee > /sys/fs/cgroup/{cpu,\cpuacct,cpuset}/machine.slice/$vm_cgname/emulator/tasks > 1>/dev/null & > done > } > > for vm in $(get_broken_vms); do > vm_pid=$(pgrep -f $vm) > vm_vhost_pids=$(pgrep -x vhost-$vm_pid) > vm_cgname=$(find /sys/fs/cgroup/systemd/machine.slice -maxdepth 1 > -mindepth 1 -type d -name "machine-qemu\\\x2d*\\\x2d${vm/-/\\\\x2d}.scope" > -printf '%f\n') > > echo Working on vm: $vm pid: $vm_pid vhost_pid: $vm_vhost_pids > cgroup_name: $vm_cgname > [ -z "$vm_pid" -a -z "$vm_cgname" ] || attach_vm_to_cgroup $vm_pid > $vm_cgname > > # Fix vhost-NNNN kernel threads > for vpid in $vm_vhost_pids; do > [ -z "$vm_cgname" ] || attach_vm_to_cgroup $vpid $vm_cgname > done > done After fixing all vms successfully provided cpu-stats and other metrics, but after some hours cgroups broke again. Problems and symptoms: - cgoup broken not at all VMs - to find out what leads to this effect failed - if restart a problem VM then as expected cgroups has been fixed but after some hours cgroup broken again - if cgroups has been fixed by hand cpu-stats is works, but after some hours cgroup broken again Now i check: - logrotate - nothing - cron - nothing Add audit logs for cgrups > auditctl -w '/sys/fs/cgroup/cpu,cpuacct/machine.slice' -p rwxa And found only libvirtd processes write cgroups. Any suggestions?

2 2