Re: [Openstack-operators] [SOLVED] Glance Image Visibility Issue? - Non admin users can see private images from other tenants

2018-10-26 Thread iain MacDonnell
Hi Mike, Interesting - nice detective work! FWIW, I do have that explicitly set in my config, based on the recommendation at: https://docs.openstack.org/glance/latest/install/install-rdo.html#install-and-configure-components Your github PR will no go anywhere - all changes must go through th

Re: [Openstack-operators] Glance Image Visibility Issue? - Non admin users can see private images from other tenants

2018-10-18 Thread iain MacDonnell
/glance/policy.json { "context_is_admin": "role:admin", "default": "role:admin", I'm not terribly familiar with the policies but I feel like that default line is making everyone an admin by default? Mike Moore, M.S.S.E. Systems Engineer, Go

Re: [Openstack-operators] Glance Image Visibility Issue? - Non admin users can see private images from other tenants

2018-10-18 Thread iain MacDonnell
ant. Mike Moore, M.S.S.E. Systems Engineer, Goddard Private Cloud michael.d.mo...@nasa.gov Hydrogen fusion brightens my day. On 10/18/18, 1:07 AM, "iain MacDonnell" wrote: On 10/17/2018 12:29

Re: [Openstack-operators] [all] Naming the T release of OpenStack

2018-10-18 Thread iain MacDonnell
On 10/18/2018 08:31 AM, Anita Kuno wrote: On 2018-10-18 2:35 a.m., Tony Breeds wrote: ... However I'd like to suggest we skip the CIVS poll and select 'Train' as the release name by TC resolution[3].  My think for this is   * It's fun and celebrates a humorous moment in our community   * As

Re: [Openstack-operators] Glance Image Visibility Issue? - Non admin users can see private images from other tenants

2018-10-17 Thread iain MacDonnell
On 10/17/2018 12:29 PM, Moore, Michael Dane (GSFC-720.0)[BUSINESS INTEGRA, INC.] wrote: I’m seeing unexpected behavior in our Queens environment related to Glance image visibility. Specifically users who, based on my understanding of the visibility and ownership fields, should NOT be able to

Re: [Openstack-operators] nova_api resource_providers table issues on ocata

2018-10-16 Thread iain MacDonnell
Is it possible that the hostnames of the nodes changed when you updated them? e.g. maybe they were using fully-qualified names before and changed to short-form, or vice versa ? ~iain On 10/16/2018 07:22 AM, Ignazio Cassano wrote: Hi Sylvain, I mean launching "yum update" on compute nod

Re: [Openstack-operators] RFC: Next minimum libvirt / QEMU versions for 'T' release

2018-09-24 Thread iain MacDonnell
On 09/24/2018 06:22 AM, Kashyap Chamarthy wrote: (b) Oracle Linux: Can you please confirm if you'll be able to release libvirt and QEMU to 4.0.0 and 2.11, respectively? Hi Kashyap, Those are already available at: http://yum.oracle.com/repo/OracleLinux/OL7/developer/kvm/utils/x86_64/ind

Re: [Openstack-operators] ocata nova /etc/nova/policy.json

2018-09-06 Thread iain MacDonnell
On 09/06/2018 06:31 AM, Ignazio Cassano wrote: I installed openstack ocata on centos and I saw /etc/nova/policy.json coontains the following: { } I created an instance in a a project "admin" with user admin that belogns to admin project I created a demo project with a user demo with "user"

Re: [Openstack-operators] getting back onto our IRC channel

2018-08-08 Thread iain MacDonnell
According to: https://superuser.com/questions/1220409/irc-how-to-register-on-freenode-using-hexchat-when-i-get-disconnected-immediat there's a blacklist of source address ranges from which SASL auth/e is required. ~iain On 08/08/2018 12:03 PM, Chris Morgan wrote: I'm sure I'm doin

Re: [Openstack-operators] neutron-server memcached connections

2018-07-30 Thread iain MacDonnell
rg/#/c/583699/ https://review.openstack.org/#/c/583835/ I do wonder how others are managing memcached connections for larger deployments... ~iain On 06/26/2018 12:59 PM, iain MacDonnell wrote: In diagnosing a situation where a Pike deployment was intermittently slower (in general), I discovered th

Re: [Openstack-operators] [kolla-ansible][octavia-role]

2018-07-17 Thread iain MacDonnell
On 07/17/2018 08:13 AM, Flint WALRUS wrote: Hi guys, I'm a trying to install Octavia as a new service on our cloud and facing few issues that I've been able to manage so far, until this nova-api keypair related issue. When creating a loadbalancer with the following command: openstack --os-c

[Openstack-operators] neutron-server memcached connections

2018-06-26 Thread iain MacDonnell
In diagnosing a situation where a Pike deployment was intermittently slower (in general), I discovered that it was (sometimes) exceeding memcached's maximum connection limit, which is set to 4096. Looking closer, ~2750 of the connections are from 8 neutron-server process. neutron-server is c

Re: [Openstack-operators] Octavia on ocata centos 7

2018-05-10 Thread iain MacDonnell
On 05/10/2018 10:45 AM, Ignazio Cassano wrote: I am moving from lbaas v2 based on haproxy driver to octavia on centos 7 ocata. [snip] On the octavia server all services are active, amphora images are installed, but when I try to create a load balancer: nuutron lbaas-loadbalancer-create --na

Re: [Openstack-operators] Help finding old (Mitaka) RDO RPMs

2018-04-12 Thread iain MacDonnell
On 04/12/2018 12:13 PM, Erik McCormick wrote: Does anyone happen to have an archive of the MItaka RDO repo lying around they'd be willing to share with a poor unfortunate soul? My clone of it has gone AWOL and I have moderately desperate need of it. https://buildlogs.centos.org/centos/7/cloud

Re: [Openstack-operators] nova-placement-api tuning

2018-03-30 Thread iain MacDonnell
On 03/29/2018 02:13 AM, Belmiro Moreira wrote: Some lessons so far... - Scale keystone accordingly when enabling placement. Speaking of which; I suppose I have the same question for keystone (currently running under httpd also). I'm currently using threads=1, based on this (IIRC): https:/

Re: [Openstack-operators] nova-placement-api tuning

2018-03-29 Thread iain MacDonnell
On 03/29/2018 04:24 AM, Chris Dent wrote: On Thu, 29 Mar 2018, Belmiro Moreira wrote: [lots of great advice snipped] - Change apache mpm default from prefork to event/worker. - Increase the WSGI number of processes/threads considering where placement is running. If I'm reading http://mo

Re: [Openstack-operators] nova-placement-api tuning

2018-03-29 Thread iain MacDonnell
On 03/29/2018 01:19 AM, Chris Dent wrote: On Wed, 28 Mar 2018, iain MacDonnell wrote: Looking for recommendations on tuning of nova-placement-api. I have a few moderately-sized deployments (~200 nodes, ~4k instances), currently on Ocata, and instance creation is getting very slow as they

[Openstack-operators] nova-placement-api tuning

2018-03-28 Thread iain MacDonnell
Looking for recommendations on tuning of nova-placement-api. I have a few moderately-sized deployments (~200 nodes, ~4k instances), currently on Ocata, and instance creation is getting very slow as they fill up. I discovered that calls to placement seem to be taking a long time, and even thi