Tuesday, 2025-12-09

opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-os_nova stable/2025.2: Ensure nova_console_proxy_types respects all computes  https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/97013908:38
opendevreviewMerged openstack/ansible-role-uwsgi master: Update for CONTRIBUTING.rst file  https://review.opendev.org/c/openstack/ansible-role-uwsgi/+/96900208:39
opendevreviewMerged openstack/ansible-role-zookeeper master: Update for CONTRIBUTING.rst file  https://review.opendev.org/c/openstack/ansible-role-zookeeper/+/96254108:40
opendevreviewMerged openstack/ansible-role-httpd master: Update for CONTRIBUTING.rst file  https://review.opendev.org/c/openstack/ansible-role-httpd/+/96896008:46
opendevreviewMerged openstack/ansible-role-pki master: Update for CONTRIBUTING.rst file  https://review.opendev.org/c/openstack/ansible-role-pki/+/96900308:47
opendevreviewMerged openstack/ansible-role-frrouting master: Update for CONTRIBUTING.rst file  https://review.opendev.org/c/openstack/ansible-role-frrouting/+/96900508:52
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: Add AlmaLinux 10 support  https://review.opendev.org/c/openstack/openstack-ansible/+/96896708:56
opendevreviewMerged openstack/openstack-ansible master: docs: utility host replace to environment  https://review.opendev.org/c/openstack/openstack-ansible/+/97003409:03
opendevreviewMerged openstack/ansible-role-systemd_networkd master: Remove unused directory  https://review.opendev.org/c/openstack/ansible-role-systemd_networkd/+/96926910:11
opendevreviewMerged openstack/openstack-ansible-os_ironic stable/2025.2: Remove EL9 compatability  https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/96989210:43
opendevreviewMerged openstack/openstack-ansible-os_ironic master: Remove outdate file local_install.sh  https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/95965210:43
opendevreviewMerged openstack/openstack-ansible-rabbitmq_server stable/2025.2: Make jobs voting again  https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/97012710:49
opendevreviewMerged openstack/openstack-ansible-openstack_hosts master: Remove outdated configure for yum  https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/97016910:50
harunHello everyone, I am experiencing an issue related to certificate renewal in Magnum clusters. I have clusters running on the Magnum Cluster API, and the certificate of the cloud URL has changed. As a result, the clusters are now receiving TLS certificate errors when trying to access the cloud URL.10:51
harunFrom what I observed, the issue is resolved when I manually replace the /etc/kubernetes/cloud_ca.crt file on both the worker and master nodes with the updated certificate. However, is there an easier or more automated way to handle this?10:51
opendevreviewMerged openstack/openstack-ansible-os_ironic master: Remove outdate file manual-test.rc  https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/95964810:51
opendevreviewMerged openstack/openstack-ansible-os_ironic master: Remove deprecated run_tests/vagrantfile  https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/95964910:51
opendevreviewMerged openstack/openstack-ansible-os_ironic master: Fixes for text formulations (OpenStack, Bare metal)  https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/96982510:51
noonedeadpunkhm. I frankly have no idea....10:54
noonedeadpunkharun: have you tried `openstack coe ca rotate` command?10:54
noonedeadpunkI have no idea if that actually works with capi drivers or not...10:55
opendevreviewMerged openstack/ansible-role-systemd_networkd stable/2025.1: Restart systemd-udev on link changes  https://review.opendev.org/c/openstack/ansible-role-systemd_networkd/+/97014811:03
jrosserharun: do you mean that the certificate of your openstack API has changed, or the certificate of the cluster api control plane k8s cluster has changed?11:33
harunjrosser, I mean that the certificate of the OpenStack API has changed. Because of this change, the clusters are now getting TLS errors when they try to access the OpenStack API.11:36
opendevreviewMerged openstack/openstack-ansible stable/2025.2: Set Debian 13 molecule test to voting  https://review.opendev.org/c/openstack/openstack-ansible/+/97012611:41
opendevreviewMerged openstack/openstack-ansible master: [doc] Add warning about verifying latest stable release tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97007211:41
opendevreviewMerged openstack/openstack-ansible master: [doc] Domain routing order warning  https://review.opendev.org/c/openstack/openstack-ansible/+/97003311:41
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: Move deploy-guide under docs for translation  https://review.opendev.org/c/openstack/openstack-ansible/+/94949711:46
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: Move deploy-guide under docs for translation  https://review.opendev.org/c/openstack/openstack-ansible/+/94949711:46
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: Move deploy-guide under docs for translation  https://review.opendev.org/c/openstack/openstack-ansible/+/94949711:46
harunI updated the caCert field in the cluster object using kubectl edit, and new nodes are now created with the updated CA. However, do I need to delete all existing worker nodes and recreate them for the change to take effect?11:52
haruncloudCaCert*11:52
jrosserharun: it is a bit like you need to do a rolling upgrade of the workload clusters, but don't want to change version12:02
harunYes, exactly. I want to trigger something similar to a rolling upgrade so that all nodes pick up the new CA, but without changing the Kubernetes version. My goal is just to refresh the nodes so they regenerate with the updated certificate, without performing a full version upgrade.12:05
jrosseri think that you can just delete the instances one by one (not for non-ha k8s control plane though) and they will get reprovisioned once capi notices that there are not enough12:08
jrosserthat can be pretty tedious though if you have a lot of clusters12:08
jrossermnaser: do you know if there is a trick to rolling replace the workload clusters without doing an actual upgrade?12:09
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023912:20
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023912:28
mnasiadkanoonedeadpunk: do you know if anything is happening with the openvswitch collection?13:00
noonedeadpunkI was kinda wondering about it, but failed to follow up due to internal mess...13:00
noonedeadpunkI was not given permissions to it13:01
noonedeadpunkor well... let me double check...13:02
noonedeadpunknah...13:03
noonedeadpunkpinged gundalow...13:03
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023914:21
noonedeadpunkif any core is available - would be nice to land these backports: https://review.opendev.org/q/parentproject:openstack/openstack-ansible+branch:%5Estable/2025.2+status:open+14:50
noonedeadpunkand I'll update/rebase RC2 on top of these14:50
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023914:50
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023914:51
jrosserargh /o\ didnt look closely enough at the depends-on :(14:55
noonedeadpunk#startmeeting openstack_ansible_meeting15:02
opendevmeetMeeting started Tue Dec  9 15:02:45 2025 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.15:02
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:02
opendevmeetThe meeting name has been set to 'openstack_ansible_meeting'15:02
noonedeadpunk#topic rollcall15:02
noonedeadpunko/15:04
jrossero/ hello15:04
NeilHanlono/15:05
noonedeadpunk#topic office hours15:09
noonedeadpunklast week we got finally branched 2025.215:09
noonedeadpunkand now we're a week in delay with flamingo release15:09
noonedeadpunkHuge cohntributing factor to the delay was rotation of rabbitmq repos, which we missed15:10
noonedeadpunkand learned about once it has happened :(15:10
jrosserwere we late to move to an updated version?15:10
noonedeadpunkI think they've announced about removal of ppa1 in advance15:13
noonedeadpunkbut I missed that completely15:13
noonedeadpunkanyway, we have what we have, and hopefully backports will land today15:13
noonedeadpunkthen we will be able to produce rc2 tomorrow...15:14
noonedeadpunkI have also proposed a patch to start tracking master again: https://review.opendev.org/c/openstack/openstack-ansible/+/97012815:14
noonedeadpunkand there is one for EOM-ing 2024.1: https://review.opendev.org/c/openstack/openstack-ansible/+/96617415:15
noonedeadpunkonce we're done with release, I'd love to check in PKI patches again, and merge them early in the cycle15:15
jrosserwe also need to look at what we are happy with for the magnum patches15:16
jrosseras those are now working functionally15:16
jrosserjust we might want to adjust the structure somewhat, or have a plan for what to do with it generally in the next release15:16
noonedeadpunk++15:18
noonedeadpunkyes, totally15:18
noonedeadpunkI was just looking today at some of them, and was wondering if we wanna keep the collection named as a specific driver for instance15:19
noonedeadpunkie: https://review.opendev.org/c/openstack/openstack-ansible/+/966666/11/ansible-collection-requirements.yml15:21
noonedeadpunkso question is - what we wanna do with this collection?15:21
noonedeadpunkrename it in place?15:21
noonedeadpunkor make a new repo for it?15:22
noonedeadpunkor move to plugins?15:23
NeilHanloni vote for whatever is less work15:23
noonedeadpunkless work is to ignore `vexxhost` in it's naming :D15:23
jrosserultimately it is a confusion of two things15:24
jrosserthere is the control plane k8s deployment15:24
noonedeadpunkideally - I think, this content would better fit the collection where we deploy k8s from15:24
jrosserand then laying over the top of that whichever capi driver and its accessories that are needed15:25
jrosser(or indeed both of them)15:25
noonedeadpunkso iirc, the only difference between them are namespaces and different set of helm charts...15:25
noonedeadpunkso 2 roles - proxy and sonobuoy are kinda indeed on the top15:26
noonedeadpunkI'm just not sure it's worth to have different colletions on top based of the driver?15:27
jrossermaybe it just needs a capi collection15:28
noonedeadpunkie CAPI_XXX - collection XXX, CAPI_YYY - collection YYY15:28
jrosserwhich can have all the bits for both15:28
noonedeadpunkyeah....15:28
noonedeadpunkI need to get some time to finally get working magnum sandbox deployment...15:30
jrosserandrew has had this all running in AIO fairly straightforwardly15:31
jrosserwe are just a bit stuck now to take it beyond our staging environment until the code is in a mergable form15:31
jrossertoo much tech debt if we deploy it first tbh15:31
noonedeadpunkok, so we can land things as is, with commitment to refactor until the next release?15:32
jrosserwell i don't know really - like you say it is best to merge it once and right perhaps15:33
noonedeadpunkalso - this mcapi_vexxhost.rust role should be just a path in os_magnum, imo15:34
noonedeadpunkit really doesn;t do much except doing apt install...15:34
jrosserpath?15:34
noonedeadpunkwell, include_tasks: magnum_vexxhost_driver.yml when: magnum_capi_driver == 'vexxhost'15:35
noonedeadpunkor smth like that15:35
noonedeadpunkinside of the os_magnum role?15:40
jrosserright - well atm there is no integration of capi stuff in there at all, which i suppose is the thing we need to think about a bit15:41
noonedeadpunkyes, true15:46
noonedeadpunkI'm not sure, but be guessing that heat driver may vanish anytime now15:46
jrossercurrently there is many layers of stuff exactly to keep it separate15:46
noonedeadpunkso it's also not that we had much choice, unless leaving jsut a noop one...15:46
noonedeadpunkwe can keep it separate just to have it said, if we want to15:47
noonedeadpunkbut probably it might be easier to merge, given we get compatability for both of them15:47
noonedeadpunkand add some check to ensure operator has defined a driver (when heat is removed)15:48
jrosserthis sounds like it is a bigger discussion15:48
jrossermaybe we can make an etherpad in a future meeting and try to tie down where all the different parts should live15:48
andrewbonney^ sounds good to me - I was concerned about having time for a full refactor right now with other priorities, but before next release sounds manageable15:52
noonedeadpunk++15:55
noonedeadpunkworks for me as well.15:55
noonedeadpunkshould we use this link?15:55
noonedeadpunk#link https://etherpad.opendev.org/p/osa-magnum-capi-refactoring15:55
noonedeadpunk#endmeeting16:01
opendevmeetMeeting ended Tue Dec  9 16:01:29 2025 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)16:01
opendevmeetMinutes:        https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-12-09-15.02.html16:01
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-12-09-15.02.txt16:01
opendevmeetLog:            https://meetings.opendev.org/meetings/openstack_ansible_meeting/2025/openstack_ansible_meeting.2025-12-09-15.02.log.html16:01
opendevreviewMerged openstack/openstack-ansible stable/2025.2: Don't use nova_console_type for mapping  https://review.opendev.org/c/openstack/openstack-ansible/+/97012516:28
opendevreviewMerged openstack/ansible-role-systemd_networkd stable/2025.2: Restart systemd-udev on link changes  https://review.opendev.org/c/openstack/ansible-role-systemd_networkd/+/97014716:29
drarveseHello, I'm setting up a OSA 2025.1 multi-node OVN setup on 3 compute nodes in a collapsed compute/gateway setup and I'm having issues with VMs passing network traffic.16:49
drarveseHere's the network interface config of one of the hosts: https://paste.openstack.org/show/bubNMksizOd658nBovzB/ and the relevant provider_network definitions: https://paste.openstack.org/show/bCmTytvjLxgCyID1mRVF/16:49
drarveseThe switch ports that the eno12409np1 interfaces are connected to are tagged VLAN 134 and I can ping the br-vxlan IPs on the other hosts from that interface. VLAN 134 is also the VLAN that our instances will be on.16:49
drarveseOVN seems to be working correctly as far as I can tell. I've created a VLAN provider network and can launch an instance, and see the port in the OVN DB. However, I'm unable to ping anything from the VMs I launch. I can't ping the gateway or other VMs. The only thing I can ping is the "network:distributed" port.16:49
drarveseOne of our network engineers thought that we might be double tagging. I'm basically following the production environment example and putting the tunnel network on a VLAN subinterface.16:50
drarveseI'm at a loss as to what the issue is. Does anyone have ideas?16:50
drarveseI just noticed that line 14 in the first paste has "id: 10" for the VLAN ID. That's a typo, it is 134.16:52
noonedeadpunkhey17:02
noonedeadpunkdrarvese: give me a sec to read back :)17:03
noonedeadpunkthere is totally smth I don't like in the paste....17:08
noonedeadpunkso on the compute node, can you check the output of `ovs-vsctl list-ports br-vlan` ? Is eno12409np1 part of the bridge?17:10
noonedeadpunkand then also what you have in /etc/neutron/plugins/ml2/ml2_conf.ini as network_vlan_ranges ?17:11
noonedeadpunk(and also type_drivers)17:11
drarveseYeah, eno12409np1 is on the bridge17:11
drarvesenetwork_vlan_ranges = provider:1:409417:11
drarvesetype_drivers = vlan,vxlan,local,geneve,flat17:12
noonedeadpunkhm. you should not be having vxlan in there....17:12
noonedeadpunkhow you defined network* in openstack_user_config?17:12
noonedeadpunktrying to ensure that groups are defined correctly for ovn, and do not have ovs/lxb bits17:13
drarveseneutron_plugin_type: ml2.ovn17:13
drarveseneutron_plugin_base: - ovn-router17:13
drarveseneutron_ml2_drivers_type: "vlan,vxlan,local,geneve,flat"17:13
noonedeadpunkaha, ok, so you defined that explicitly?17:14
drarveseYeah, wasn't sure if it was needed17:14
noonedeadpunkprobably explicit is better then implicit?:)17:14
noonedeadpunkBut I'd suggest just having neutron_ml2_drivers_type: "vlan,geneve" for your setup17:15
noonedeadpunkand drop type: "flat" from provider_networks17:15
noonedeadpunkI don't think it's configured to be usable right now anyway17:15
noonedeadpunkbut also I'm not really sure about vlan134 17:16
noonedeadpunkas it seems to attempt to re-use the vlan id on the interface which is managed by ovs17:17
noonedeadpunkare you able to ping actually nodes via network on br-vxlan?17:18
drarveseI'm able to ping the br-vxlan IPs on the other compute nodes (172.21.4.2, .3)17:19
noonedeadpunkoh, ok, right, as it's vlan interface. right17:20
drarveseShould that bridge be on a separate VLAN so 134 can be used by OVS?17:20
noonedeadpunknah, not really, but yo udefined range: "1:4094" which might intersect. but as long as you don't create vlan 134 in neutron it should be fine...17:21
drarveseI am creating it in neutron, so maybe that's the problem?17:22
noonedeadpunkem17:23
noonedeadpunkok, so let me elaborate probably on my expectations from the config I see :)17:24
noonedeadpunkcontainer_bridge: "br-mgmt" - this is the management network, all services are communication with each other. It's defined so that it was passed to all lxc containers and that host_vars were set accordingly17:25
noonedeadpunkcontainer_bridge: "br-vxlan" / type: "geneve" - this network is designed to provide a geneve networks - basically internal networks inside of the openstack, which will be built on top of an interface - vlan134 in your case. It should not be a bridge per say, as encapsulated traffic will be flowing over it17:27
noonedeadpunkso it needs to have an IP address and be reachable17:27
noonedeadpunkcontainer_bridge: "br-vlan" / type: "vlan" - these for actuall tagged VLANs, which are created and managed inside of the Neutron. This is usually used for external networks/connectivity17:28
noonedeadpunkwhile it's usually not that convenient to use vlans for intenrnal networks for projects, due to limit of 4096 vlans, and requirement to pass vlan tags on network equipment.17:29
noonedeadpunkBut you totally can not have vlan to be configured both on OS level and Neutron level17:30
noonedeadpunkUsually, tenants are not even allowed to create a new networks with type vlan in neutron17:31
drarveseThis is a relatively small cloud we're creating for our own use, all VMs are going to be on vlan13417:32
noonedeadpunkand it's an admin-only possibility, while tenants can create geneve networks and as many as they want17:32
noonedeadpunkaha, okay17:32
noonedeadpunkwell. If *all* VMs are going to be on the same vlan - maybe you should define it as a flat network?17:32
noonedeadpunkand then you can skip both vlan and geneve ones...17:33
noonedeadpunkyou probably should be fine with just this: https://paste.openstack.org/show/b16yWJx64ChFVJZmFtIW/17:34
noonedeadpunkoops17:34
noonedeadpunksorry. now17:34
drarveseWell, all VMs right now. That might change in the future. We've used VLAN provider networks everywhere else17:34
noonedeadpunkhttps://paste.openstack.org/show/b6QxUg2THZsrOSKL0pUj/17:35
noonedeadpunkand then you don't need to have br-vxlan bridge17:35
noonedeadpunk(in netplan)17:36
noonedeadpunknor IP address on it17:36
noonedeadpunkif you wanna have vlan networks only - you can also do that17:36
noonedeadpunkbut still what you configure on OS level in netplan should not intersect with range property for Neutron17:37
noonedeadpunkYou can also add more flat networks to neutron, where each flat network can be a vlan configured in netplan17:38
noonedeadpunkpretty much the difference between flat network and vlan network, is that in vcase of flat you configure interface in OS, and in vlan you oflfoad this to SDN17:38
noonedeadpunkso to add flat network except of os configuration, you will also need to run a playbook17:39
noonedeadpunkand for vlan is just an API call17:39
drarveseYeah, we want to do vlan, so it sounds like the issue is the OS/neutron intersection 17:40
noonedeadpunkyeah17:46
noonedeadpunkI'm pretty sure you can't do like that17:47
noonedeadpunkas also these networks are designed for quite different purposes17:47
noonedeadpunkso current setup assumes that you will be serving geneve netowkrs over vlan134as well17:47
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible-rabbitmq_server master: Do not run remove_classic_queue_mirroring for distro-isntalled RabbitMQ  https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/97029217:55
opendevreviewMerged openstack/openstack-ansible-os_nova stable/2025.2: Ensure nova_console_proxy_types respects all computes  https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/97013918:34
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023918:37
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023921:38
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023921:38
opendevreviewIvan Anfimov proposed openstack/openstack-ansible master: [doc] Add correction about latest tag  https://review.opendev.org/c/openstack/openstack-ansible/+/97023921:40
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add git fetch step to minor upgrade instructions  https://review.opendev.org/c/openstack/openstack-ansible/+/97031321:52
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible master: [doc] Add git fetch step to minor upgrade instructions  https://review.opendev.org/c/openstack/openstack-ansible/+/97031321:56
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible-haproxy_server master: Add certbot package variable for RHEL based systems.  https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/96719523:29
opendevreviewDmitriy Chubinidze proposed openstack/openstack-ansible-haproxy_server master: Add certbot package variable for RHEL based systems.  https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/96719523:30

Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!