Friday, 2021-06-04

*** ueha has joined #openstack00:01
*** aolivo1 has quit IRC00:05
*** benj_ has quit IRC01:37
*** benj_ has joined #openstack01:59
*** yamak16 has joined #openstack01:59
*** jelabarre-rh has quit IRC02:06
*** andrewbogott_ has joined #openstack02:44
*** rlandy|bbl is now known as rlandy03:14
*** rlandy has quit IRC03:14
*** Tahoe has joined #openstack03:25
*** Tahoe has quit IRC04:12
*** gregraka has quit IRC05:55
*** slaweq_ has joined #openstack06:00
*** slaweq has left #openstack06:02
*** slaweq_ has quit IRC06:03
*** slaweq_ has joined #openstack06:03
prometheanfireozzzo: that didn't work either (can't alter rbac policies when they are in use by anything, so only way to go is to recreate everything, not really possible in prod :P06:15
prometheanfirefor our use, removing allocation pools works well enough, though users can still manually create ports, if they do so they may get hands slapped hard06:16
* prometheanfire might write a monitor for that...06:16
*** soniya29 has joined #openstack06:21
*** soniya29 has quit IRC06:22
*** soniya29 has joined #openstack06:25
*** soniya29 has quit IRC06:25
*** soniya29 has joined #openstack06:26
*** Tahoe has joined #openstack06:30
*** lvdombrkr has joined #openstack06:34
TahoeI can't see any chat history.06:41
fricklerprometheanfire: that sounds like a bug to me, let me know if you will create one. slaweq_ ^^06:43
fricklerTahoe: you can find logs for all openstack-related channels at in case you missed something06:43
*** jengbers has joined #openstack06:44
prometheanfirefrickler: the error I get back is explicit about not supporting changing in use rbac policies06:44
prometheanfireRBAC policy on object FOO_UUID cannot be removed because other objects depend on it.06:44
prometheanfire`openstack network rbac set --target-project PROJ_UUID RBAC_UUID`  was the command06:45
prometheanfireif you still think it's a bug I'll report it06:46
slaweq_prometheanfire: frickler: IIRC if there are any objects which are using rbac policy, You can't remove it06:46
fricklerprometheanfire: so that means if I share a network with two projects that use it, I couldn't add a third one. maybe it would be a new feature instead of a bug, but I'm going to need that myself soonish06:46
prometheanfireit's a set operation, not removal, maybe it's not using the right code path?06:46
slaweq_so You should first "unshare" resources06:46
prometheanfireI can't do that either06:46
prometheanfire`os network set --no-share network_uuid` Unable to reconfigure sharing settings for network 'NAME'. Multiple tenants are using it.06:47
prometheanfireI don't see ports06:47
fricklerprometheanfire: which version are you using? I'll do some testing myself, too06:48
prometheanfirehmm, maybe there's another network06:48
prometheanfireor of the client?06:48
fricklerprometheanfire: no, neutron version, not sure if it also might be an issue with the client. need some time to set up a test myself06:49
fricklerso ussuri answers my question06:49
prometheanfireussuri client too :D06:50
*** soniya29 has quit IRC06:50
prometheanfireyou know an easy way to figure out what's using that network, I don't see ports though 'Multiple tenants are using it.'06:50
prometheanfiremaybe it gives the error when any project is using it06:51
*** malikobaid has joined #openstack06:52
fricklerprometheanfire: I'd need to check the code paths for that06:54
fricklerprometheanfire: do you have a full traceback? that might help06:54
*** soniya29 has joined #openstack06:55
prometheanfireit looks like neutron is throwing it06:55
prometheanfireright now I've traced it back to either ensure_no_tenant_ports_on_network or _validate_projects_have_access_to_network06:56
prometheanfirein neutron06:56
prometheanfirewhich is called by _validate_shared_update, which mentions going from true to false, which I'm doing06:56
prometheanfireok, so the network was originally created via openstack-ansible as a provider network, then used by another project07:00
prometheanfireso the network is owned by project A, and used by project B, because of this the network cannot set unshared because then it will conflict with project b (since now it's only allowed to be used by project a)07:00
prometheanfirecan't update the network owner to be project b or set unshared :|07:01
prometheanfirefrickler: what process / service runs the neutron db code?  neutron/db/
prometheanfireso I can check for traceback07:02
prometheanfireeh, server container did show anything07:04
*** rpittau|afk is now known as rpittau07:05
*** malikobaid___ has joined #openstack07:06
*** gwaewion has quit IRC07:07
*** genekuo has joined #openstack07:11
*** aa has joined #openstack07:16
*** aa has quit IRC07:16
prometheanfirehmm target project has to be singular or everyone, and has to include the source project when shared07:24
prometheanfireor seems to07:24
*** andrewbonney has joined #openstack07:32
prometheanfirefrickler: would you agree that I seem to have drawn myself into a corner?07:33
*** slaweq has joined #openstack07:35
prometheanfirechanging shared or the rbac for shared seems to call 'update_network' which calls '_validate_shared_update', which fails when network created by project a tries to grant access to only project b07:35
prometheanfirein that scenario you'd think both project a and project b would have access07:36
prometheanfireI think maybe should be '> 2', not '> 1'07:37
prometheanfireif (len(tenant_ids) > 1 or len(tenant_ids) == 1 and original.tenant_id not in tenant_ids)07:38
*** slaweq_ has quit IRC07:41
prometheanfireohh, I did it07:46
prometheanfirefrickler: workaround was setting a new rbac for each of the projects that have access to network/subents/ports (so bootstrap project and user project, or a and b)07:47
prometheanfirethen you can set --no-share07:47
*** slaweq_ has joined #openstack08:05
*** slaweq_ has quit IRC08:11
*** CeeMac has joined #openstack08:15
fricklerprometheanfire: oh, it seems I misunderstood your initial issue. when you said "remove shared policy" I read "remove projects from the rbac list", not "remove the --shared property from the network"08:18
prometheanfireI find reading comprehension is something I struggle with too :P08:21
fricklerbut then, things might actually be working as designed, I'd think08:27
prometheanfirenah, can still have logic errors and other types08:31
*** fuhrmannb has joined #openstack08:34
*** fuhrmannb has quit IRC08:36
*** fuhrmannb|2 has joined #openstack08:38
*** soniya29 has quit IRC08:57
*** jpward has quit IRC09:11
*** TMM has quit IRC09:17
*** TMM has joined #openstack09:17
*** jangutter has joined #openstack09:48
*** jangutter_ has quit IRC09:54
*** Tahoe has quit IRC09:55
*** isabek has joined #openstack09:56
*** isabek has left #openstack09:57
*** jangutter has quit IRC10:01
*** jangutter has joined #openstack10:02
*** jengbers has quit IRC10:05
*** jangutter has quit IRC10:14
*** jangutter has joined #openstack10:15
*** yamak16 has quit IRC10:21
*** jangutter has quit IRC10:23
*** jangutter has joined #openstack10:24
*** soniya29 has joined #openstack10:28
*** jengbers has joined #openstack10:31
*** jengbers has quit IRC10:34
*** genekuo has quit IRC10:38
*** genekuo has joined #openstack10:39
*** jengbers has joined #openstack10:42
*** malikobaid has quit IRC10:49
*** ueha has quit IRC11:01
*** soniya29 has quit IRC11:22
*** osmanlicilegi has quit IRC11:38
*** genekuo has quit IRC11:38
*** genekuo has joined #openstack11:38
*** rlandy has joined #openstack11:49
*** aolivo1 has joined #openstack12:00
*** osmanlicilegi has joined #openstack12:00
*** genekuo has quit IRC12:04
*** aolivo1 has quit IRC12:08
*** osmanlicilegi has quit IRC12:11
*** jelabarre-rh has joined #openstack12:15
*** osmanlicilegi has joined #openstack12:35
*** malikobaid___ has quit IRC12:44
*** osmanlicilegi has quit IRC12:46
*** soniya29 has joined #openstack12:52
*** rlandy is now known as rlandy|training12:54
*** osmanlicilegi has joined #openstack12:55
*** gregraka has joined #openstack13:05
*** lowercase has joined #openstack13:28
*** rpittau is now known as rpittau|afk13:37
*** jengbers has quit IRC13:41
*** jengbers has joined #openstack13:41
*** rlandy|training is now known as rlandy13:43
*** jengbers has quit IRC13:43
*** soniya29 has quit IRC14:14
*** aolivo1 has joined #openstack14:19
*** heilerich has joined #openstack14:39
*** gmann is now known as gmann_afk14:40
heilerichHi everyone! I am trying to connect a machines on a tenant network to services on a shared (internal) network using neutron-ovn, but I am having difficulties :(14:50
heilerichI created a port on the shared network. Then, I added that port to the default router on the tenant network. Lastly, I created a static route on the tenant router to the shared network subnet with the shared network router as the gateway. Sadly it's not working. Meaning I can't seem to connect from a machine on the tenant network to a service on the shared network.14:50
heilerichDoes anyone have any pointers on how to debug this issue? Or should I go about this using an entirely different approach?14:50
*** gregraka has quit IRC14:59
*** gmann_afk is now known as gmann15:13
*** engine has joined #openstack15:20
*** khyr0n has quit IRC15:32
*** gregraka has joined #openstack16:02
*** rlandy is now known as rlandy|brb16:10
*** jelabarre-rh has quit IRC16:28
*** engine_ has joined #openstack16:35
*** engine has quit IRC16:36
*** rlandy|brb is now known as rlandy16:42
*** fuhrmannb|2 has quit IRC17:22
*** TMM has quit IRC17:27
*** TMM has joined #openstack17:28
*** engine_ has left #openstack17:43
*** engine has joined #openstack17:46
*** andrewbonney has quit IRC17:46
*** lvdombrkr has quit IRC18:04
*** engine_83 has joined #openstack18:13
*** engine has quit IRC18:20
*** lowercase has quit IRC18:51
*** tinwood has quit IRC18:55
*** tinwood has joined #openstack18:58
*** khyr0n has joined #openstack18:59
*** engine__38 has joined #openstack19:24
*** engine__38 has quit IRC19:29
*** engine_83 has quit IRC19:30
*** lvdombrkr has joined #openstack19:37
*** gfidente|afk has quit IRC20:42
*** servagem has quit IRC21:14
*** gmann is now known as gmann_afk21:51
*** jangutter_ has joined #openstack21:59
*** jangutter_ has quit IRC21:59
*** jangutter_ has joined #openstack22:00
*** jangutte_ has joined #openstack22:01
*** jangutte_ has quit IRC22:01
*** jangutter_ has quit IRC22:01
*** jangutter_ has joined #openstack22:02
*** jangutter_ has quit IRC22:02
*** jangutter_ has joined #openstack22:04
*** jangutter has quit IRC22:06
*** John_W has joined #openstack22:29
*** rlandy has quit IRC23:01
*** leifmadsen has quit IRC23:06
*** gregraka has quit IRC23:08
*** leifmadsen has joined #openstack23:15
*** aolivo1 has quit IRC23:18

Generated by 2.17.2 by Marius Gedminas - find it at!