Re: [Openstack-operators] Problem creating resizable CentOS 6.5 image

2014-10-03 Thread Antonio Messina
I use this snippet in my %post section. I don't find it particularly elegant, but it works just fine: # Set up to grow root in initramfs cat << EOF > 05-grow-root.sh #!/bin/sh /bin/echo /bin/echo Resizing root filesystem /bin/echo "d n p 1 w " | /sbi

Re: [Openstack-operators] Problem creating resizable CentOS 6.5 image

2014-10-03 Thread Antonio Messina
I use this snippet in my %post section. I don't find it particularly elegant, but it works just fine: # Set up to grow root in initramfs cat << EOF > 05-grow-root.sh #!/bin/sh /bin/echo /bin/echo Resizing root filesystem /bin/echo "d n p 1 w " | /sbi

Re: [Openstack-operators] Small openstack

2015-01-08 Thread Antonio Messina
Hi all, I'm also interested in this setup. On Fri, Dec 26, 2014 at 12:31 AM, George Shuklin wrote: > Report on progress so far: > > I was able to fix policies (nova/neutron) to allow tennants to plug to 'own' > external networks, found and report few bugs about error messaging in ML2, > got worki

Re: [Openstack-operators] Small openstack

2015-01-08 Thread Antonio Messina
On Thu, Jan 8, 2015 at 11:53 AM, gustavo panizzo (gfa) wrote: > On 01/08/2015 06:36 PM, Antonio Messina wrote: >> On Fri, Dec 26, 2014 at 12:31 AM, George Shuklin >> wrote: >>> >>> Report on progress so far: >>> >>> I was able to fix policies (

Re: [Openstack-operators] Small openstack

2015-01-08 Thread Antonio Messina
On Thu, Jan 8, 2015 at 12:12 PM, gustavo panizzo (gfa) wrote: > > > On 01/08/2015 07:01 PM, Antonio Messina wrote: >> >> On Thu, Jan 8, 2015 at 11:53 AM, gustavo panizzo (gfa) >> wrote: > > >>> >>> i may be wrong as i haven't tested tha

Re: [Openstack-operators] Migrating keystone from MySQL to LDAP

2015-03-03 Thread Antonio Messina
On Mon, Mar 2, 2015 at 5:31 PM, Fox, Kevin M wrote: > That leaves identity mapping. There is a table of ldap users to > unique id's in the database. I'm not an expert, but I have a Juno testbed that is using LDAP for identity and SQL for assignment, and the 'id' of the user is, in my case, the ui

Re: [Openstack-operators] Migrating keystone from MySQL to LDAP

2015-03-03 Thread Antonio Messina
On Tue, Mar 3, 2015 at 8:44 PM, Fox, Kevin M wrote: > See the id_mapping table. That's the first place I've looked into: mysql> select * from keystone.id_mapping; Empty set (0.00 sec) I think because of http://docs.openstack.org/developer/keystone/developing.html#identity-entity-id-mana

Re: [Openstack-operators] [Neutron][Nova] No Valid Host when booting new VM with Public IP

2015-03-18 Thread Antonio Messina
On Wed, Mar 18, 2015 at 6:29 PM, Adam Lawson wrote: > > What I'm trying to do is force OpenStack to do something it normally > doesn't do for the sake of learning and experimentation. I.e. bind a > public network to a VM so it can be accessed outside the cloud when > floating IP's are normally req

[Openstack-operators] RabbitMQ in cluster mode - high cpu usage

2015-07-16 Thread Antonio Messina
not-so-small installation? (64 compute nodes right now for "testing", 128 soon) Thank you in advance for your help, Antonio Messina Package versions: rabbitmq-server 3.4.3-2~cloud0 python-amqp 1.4.6-0ubuntu1~cloud0 python-amqplib

Re: [Openstack-operators] openstack kilo storage network separation

2015-07-17 Thread Antonio Messina
I think you have to set iscsi_ip_address option in cinder.conf. .a. ___ OpenStack-operators mailing list OpenStack-operators@lists.openstack.org http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-operators

Re: [Openstack-operators] openstack kilo storage network separation

2015-07-17 Thread Antonio Messina
ib/iscsi directory on computing note I saw its iscsi initiator is > still using the target on management network. > Must I modify it either on storage nod or controller node ? > Does controller node pass the configuratin to computing node ? > Many thanks > Il giorno 17/lug/2015 19:48,

Re: [Openstack-operators] Stack with external vlan and intranet vlan

2015-07-25 Thread Antonio Messina
Hi Ignazio, I did something similar, but it's not yet production so I don't know if there are any caveats or better solutions, maybe some neutron expert can tell us more. In principle you can create a neutron network on a specific vlan, assuming the compute nodes will have direct access to that v

Re: [Openstack-operators] Stack with external vlan and intranet vlan

2015-07-25 Thread Antonio Messina
On Sat, Jul 25, 2015 at 12:38 PM, Ignazio Cassano wrote: > You are very kind, thank you. > I have only anothe doubt. > When in a normal scenario you create the external net, you also create an > openvswtch bridge (br-ex) on the network node and add the nic interface > you have configuret for int

[Openstack-operators] Fwd: Managing security incidents: how to find the guilty VM ?

2015-07-27 Thread Antonio Messina
On Thu, Jul 23, 2015 at 3:54 PM, Alvise Dorigo wrote: > If the VM doesn't have a floating IP, the Y IP address that is exposed on > the internet (and therefore the one that will be commuticated to the > security people) is the one of the OpenStack router. > > Given the private IP of the machine we

Re: [Openstack-operators] Managing security incidents: how to find the guilty VM ?

2015-07-31 Thread Antonio Messina
per should know what to do: run ulogd if "ip netns add" is called, kill it if "ip netns delete" is called c) [UGLY]: run a cron every tot seconds to ensure every qrouter- namespace has an instance of ulogd running on it. Other suggestions? .a. On Mon, Jul 27, 2015 at 11:50 A

Re: [Openstack-operators] Managing security incidents: how to find the guilty VM ?

2015-07-31 Thread Antonio Messina
= "netns" -a "$2" == "delete" ] then # Namespace deleted, *first* kill ulogd, then remove the namespace ns=$3 if [ -n "$ns" -a -f /run/ulogd.$ns.pid ] then kill $(cat /run/ulogd.$ns.pid) fi exec ip $@ else exec ip $@ fi

Re: [Openstack-operators] Managing security incidents: how to find the guilty VM ?

2015-08-01 Thread Antonio Messina
On Sat, Aug 1, 2015 at 5:27 AM, gustavo panizzo wrote: > On Fri, Jul 31, 2015 at 05:48:19 +0200, Antonio Messina wrote: >> a) in case neutron supports "triggers" (but I don't think so), e.g. >> shell commands that are executed whenever a namespace is created

Re: [Openstack-operators] Managing security incidents: how to find the guilty VM ?

2015-08-06 Thread Antonio Messina
On Thu, Aug 6, 2015 at 5:25 PM, Andy Hill wrote: > Archival and consumption of notifications emitted from Nova / Neutron is one > approach. AFAIK, this only works with floating IPs. When using SNAT, you really have to check the kernel connection tracking table, otherwise you will not be able to k

Re: [Openstack-operators] Problems with OpenStack and LDAP

2015-08-17 Thread Antonio Messina
On Mon, Aug 17, 2015 at 4:02 PM, Marc Pape wrote: > the internal SQL . It would be great if the service users of OpenStack > are also stored in SQL, but they are also currently in the LDAP > deposited. This is an use case for keystone domains (https://wiki.openstack.org/wiki/Domains) but when we

Re: [Openstack-operators] Stack with external vlan and intranet vlan

2015-08-29 Thread Antonio Messina
e configured > "tenant_network_types = gre" but > we presume we must use "gre, vlan" ? > > Regards > > 2015-07-25 12:48 GMT+02:00 Antonio Messina : > >> On Sat, Jul 25, 2015 at 12:38 PM, Ignazio Cassano >> wrote: >> > You are very kind, th

Re: [Openstack-operators] nova snapshots should dump all RAM to hypervisor disk ?

2016-04-23 Thread Antonio Messina
We are in an even worst situation: we have flavors with 256GB of ram but only 100GB on the local hard disk, which means that we cannot snapshot VMs with this flavor. If there is any way to avoid saving the content of the ram to disk (or maybe there is a way to snapshot the ram to, e.g., ceph), we

Re: [Openstack-operators] nova snapshots should dump all RAM to hypervisor disk ?

2016-04-24 Thread Antonio Messina
I actually have a card in my trello board to implement live snapshots, pointing to this link http://www.sebastien-han.fr/blog/2015/02/09/openstack-perform-consistent-snapshots-with-qemu-guest-agent/ However, I haven't tested it yet. If you test it let me know how it goes. .a. On Sun, Apr 24, 201

Re: [Openstack-operators] Migration to LDAP / default domain questions

2016-07-29 Thread Antonio Messina
Hi Ben, We recently migrated from single-domain to multi-domain. However, in our case the situation was a bit different. The cloud was already in production with default domain pointing to LDAP, and we didn't really want to update every resource, so we kept the default domain to ldap and we added

Re: [Openstack-operators] nova resize on shared storage

2016-08-08 Thread Antonio Messina
2016-08-08 10:52 GMT+02:00 Timofei Durakov : > Hi, > > so for this moment we have 2 options: > - somehow check every time that nodes are on shared storage(now it's done > over ssh) > - define that shared storage explicitly() > The possible workaround for the first option is to use RPC for checking

Re: [Openstack-operators] Change Dashboard Splash Logo and Top-left logo

2016-08-15 Thread Antonio Messina
I kind of remember then when updating CSS on the dashboard you also have to re-generate the compressed css. On ubuntu, doing a dpkg-reconfigure openstack-dashboard should be enough. .a. 2016-08-15 10:10 GMT+02:00 Saverio Proto : > On ubuntu we just replace these two files: > > /usr/share/openstac

Re: [Openstack-operators] Delegating quota management for all projects to a user without the admin role?

2017-01-27 Thread Antonio Messina
We had the same problem and found the same problem. Also Neutron doesn't allow you to create a policy.json to give someone the privileges to change quotas, which is pretty bad since when updating the number of instances you usually have to also upgrade the number of ports. (Mitaka) .a. 2017-01-27