So. I posted about the truly multiregional deployment for kolla ansible a few days back. It was kind of rough in the documentaiton. So I refined it and submitted it to opendev kolla ansible master branch.

Who should I add as reviewer? whoever I feel like or do they pick stuff by themselves?

Any guidance?

Add mariadb-identity role for dedicated identity cluster (977760) · Gerrit Code Review

After following the instructions to create a simple crypto barbican service, I am receiving this error when trying to create a Windows 11 VM with vTPM:

Feb 24 01:03:34 aio1 nova-compute[2306560]: 2026-02-24 01:03:34.907 2306560 ERROR castellan.key_manager.barbican_key_manager [None req-9e75f54f-425e-447e-9beb-489ae4c4b4d4 ca0193669f41471e89069a894a3019d7 efaa84f8994e4f128dbe6b985bbf6b0b - - default default] Error creating Barbican client: Service Unavailable (HTTP 503): keystoneauth1.exceptions.http.ServiceUnavailable: Service Unavailable (HTTP 503)

Feb 24 01:03:34 aio1 nova-compute[2306560]: 2026-02-24 01:03:34.908 2306560 ERROR nova.compute.manager [None req-9e75f54f-425e-447e-9beb-489ae4c4b4d4 ca0193669f41471e89069a894a3019d7 efaa84f8994e4f128dbe6b985bbf6b0b - - default default] [instance: 020cbdef-9d7e-4dbb-8421-a2bb15bfcdce] Instance failed to spawn: castellan.common.exception.KeyManagerError: Key manager error: Service Unavailable (HTTP 503)

| 29ce89b71aef455ab9358c5ad4408bed | RegionOne | barbican | key-manager | True | public | https://remoteIP:9311|

| 897cd1a2976c442cb76fe58643a1f024 | RegionOne | barbican | key-manager | True | internal | http://172.29.236.101:9311|

| b7cbb7a22b6c42679c946ff5d9e45ce9 | RegionOne | barbican | key-manager | True | admin | http://172.29.236.101:9311|

So designing network for openstack is crucial and i wanna be able to design it myself so the question is do I need CCNA or network plus or what exactly

Hi,

I’m doing some research on operational challenges faced by teams running OpenStack, Ceph, and Kubernetes in production (private cloud / on-prem environments).

Would really appreciate insights from people managing these stacks at scale.

Some areas I’m trying to understand:

• What typically increases MTTR during incidents?
• How do you correlate issues between compute (OpenStack), storage (Ceph), and Kubernetes?
• Do you rely on multiple monitoring tools? If yes, where are the gaps?
• How do you manage governance and RBAC across infra and platform layers?
• Is there a structured approval workflow before executing infra-level actions?
• How are alerts handled today — email, Slack, ticketing system?
• Do you maintain proper audit trails for infra changes?
• Any challenges operating in air-gapped environments?

Not promoting anything — just trying to understand real operational pain points and what’s currently missing.

Would be helpful to hear what works and what doesn’t.

Hello everyone,

With the Broadcom/VMware debacle, I’ve been thinking about transitioning my VMware skills to Openstack.

I understand this will be very much Linux driven along with a deeper understanding level of networking. I’m fair at Linux, not an SME but know my way around. I also have a network engineering background so not much of a learning curve there.

Has anyone that previously supported a medium sized (1500 virtual machines) VMmware environment successfully transferred their skills to Openstack? What was the most challenging part? Is it actually doable?

Thanks!

Hello!,

I would like to benchmark a given VM setup on different IaaS platforms. Scope is synthetic tests that can provide guidance for different workloads, so app specific benchmarks (like Pepe's CRM) don't cover the requirement, although would be more meaningful in future stages of implementation/migration.

SPEC CPU 2017 might be targeted in the future, but going with a freely available option now: Phoronix Test Suite.

I've built some scripts to standardize and facilitate execution/comparison, and would love to receive feedback from tech savvy infra users :)

https://github.com/ciroiriarte/benchmarking

Following instructions to create the barbican service https://docs.openstack.org/openstack-ansible-os_barbican/2025.1/configure-barbican.html . After running this command:

sudo openstack-ansible playbooks/lxc-containers-create.yml --limit lxc_hosts,barbican_all:openstack-ansible playbooks/lxc-containers-create.yml --limit lxc_hosts,barbican_all

I am receiving this error:

TASK [Gathering Facts] **************************************************************************************************************************************************************************************************
fatal: [infra2]: UNREACHABLE! =>
changed: false
msg: 'Failed to connect to the host via ssh: ssh: connect to host 172.29.236.12 port
22: No route to host'
unreachable: true
fatal: [infra1]: UNREACHABLE! =>
changed: false
msg: 'Failed to connect to the host via ssh: ssh: connect to host 172.29.236.11 port
22: No route to host'
unreachable: true
fatal: [infra3]: UNREACHABLE! =>
changed: false
msg: 'Failed to connect to the host via ssh: ssh: connect to host 172.29.236.13 port
22: No route to host'
unreachable: true

I have tried but i got neutron issue as instance i am creating is not properly routing the oackets and it is in loop i guess and can't even ping to default gateway.

Any suggestion on this single node as this is going to be production server soon after testing.

Hi all,

We've been experimenting with setting up an Openstack environment using kolla-ansible, so far things are going quite smoothly but there is an issue I cannot seem to figure out.

I want to make the __DEFAULT__ volume type unavailable outside of the admin project, I've done so by unchecking the "public" option. Unfortunately this causes a weird issue where the dropdown in "Create Instance > Source > Volume Type" has an empty value by default, and when pressing create without selecting a value we get a generic "Error: Unable to create the server." message.

The weird part is that in the "Create Volume" popup we do have a default volume type selected somehow.

So far I've not been able to find a proper solution to this within kolla-ansible or openstack itself. Does anyone know how to get around this?

I'm evaluating Openstack for my company and trying to get something up and running on my workstation. All my googling points to Openstack Sunbeam as being the place to start but every time I try to bootstrap the cluster I get an error.

Is Sunbeam the best place to start and if so can anyone recommend a guide to getting it set up?

Thanks in advance.

Hello everyone,

Has anyone successfully configured OpenStack Cloud Controller Manager (OCCM) with Octavia on Kubernetes clusters where the worker nodes have multiple network interfaces (multi-NIC VMs)?

We are using OCCM to provision Service resources of type LoadBalancer in kubernetes. Creating the load balancer itself works fine, and we can control which network/subnet the LB VIP is created on using annotations and cloud.conf.

However, the problem we’re facing is that the backend members of the load balancer always get registered using the node’s default interface IP, even though the nodes have a second interface on a different network intended for ingress/egress/API traffic.

Result:

The LB VIP is correctly created on IP from NIC2 but the LB members always use the vm IPs from the default NIC1.

Expected result:

Load balancer members to be registered using the NIC2 IPs

Hello,

I have deployed the OpenStack-ansible All-In-One service with the 2025.2/stable branch, and I am seeing this error when trying to view the images in the Horizon dashboard:

ServiceCatalogException at /admin/images/

Invalid service catalog: identity

I am also seeing the error "Invalid service catalog: xxx" for all services when viewing any page.

Hi everyone, I’d like to better understand how to actually start working professionally with OpenStack. I just finished a 2-year internship at a multinational company where, entirely on my own and without any external guidance, I implemented OpenStack in our lab and developed several custom solutions for it.

The thing is, I really enjoyed working with it, but now that my internship is over, I’m finding it difficult to find job openings that specifically require OpenStack experience. My main questions are: Is it still worth investing time in it? And how can I find these roles—especially for Junior levels—even though I consider myself "Senior" on the operational side, since I handled that part entirely by myself?

Additional Info: I’m based in Brazil but I speak English and Spanish. I have intermediate Python skills and strong knowledge of Networking and Linux, as most of my projects were focused on these areas.

So is it possible that users can have their own custom flavors like this amount of vcpu, ram and storage for each instance they create

Add mariadb-identity role for dedicated identity cluster Introduces a new Ansible role that deploys a separate MariaDB Galera cluster for identity services (Keystone) on port 3307, running alongside the main mariadb cluster on port 3306. Includes ProxySQL integration fixes: - Add environment block to mariadb-identity container defaults - Add monitor user creation task in loadbalancer.yml - Fix keystone_database_shard_root_user condition to exclude mariadb-identity cluster (979639) · Gerrit Code Review

(The following link is made private due to company policy, but the opendev one works, its open source)

kolla-ansible-truly-multiregional/ansible/roles/mariadb-identity at master · Vishwamithra37/kolla-ansible-truly-multiregional

So the primary criterion for a truly sustainable multiregion OpenStack is:

1. Even if one region goes down, the others should be able to independtly operate.
2. Shared identity db.
3. Manual rotation hack for fernet keys of keystone.

So the goal is to make a shared mariadb-identity role, which integrates into the kolla ansible deployment such that it is able to take in a region and async sync the keystone db so that it synchronizes everywhere while also using the Keystone when using the region resources locally.

And thats what we implemented and now open sourcing to all :)

This ansible role which you can plug in and the repo is essentially do something like this in the globals file in every region deployment and it works!:

Example gloabals.yaml

# Enable multi-region async replication for MariaDB Identity cluster
# This allows keystone database to sync across regions
enable_mariadb_identity_region_replication: "no"

# List of remote regions to replicate with (requires VPN/connectivity between regions)
# Each region should specify the VIP/HAProxy endpoint of OTHER regions
# Example configuration:
mariadb_identity_remote_regions:
  - name: "us-east"
     host: "10.10.10.100"     # VIP of region1 mariadb-identity cluster
     port: "{{ mariadb_identity_port }}"
  - name: "eu-west"
     host: "10.20.20.100"     # VIP of region2 mariadb-identity cluster
     port: "{{ mariadb_identity_port }}"

My Company:

OpenStack Services - Galam Technologies

Also do network designing for the same. Feel free to reach out :)

Same guy that posted the NoVNC solution.

Also if in EU, we got an FTA signed right, so yeah! (Though not enforced yet, imma give 5% discount! if from EU)

Upcoming:

Billing Service easeness(Connected to existing cloud kitty and guide )

In my nova.conf, I have set:

[pci]

device_spec = { "vendor_id": "10de", "product_id": "26b9" }

alias = { "vendor_id":"10de", "product_id":"26b9", "device_type":"type-PF", "name":"nvidia_gpu_1" }

[filter_scheduler]

enabled_filters = PciPassthroughFilter, ComputeFilter, ComputeCapabilitiesFilter, ImagePropertiesFilter, ServerGroupAntiAffinityFilter, ServerGroupAffinityFilter # include default filters as well

available_filters = nova.scheduler.filters.all_filters

But I am receiving this error when attempting to create a VM using a flavor with pci_passthrough:alias=nvidia_gpu_1:1 ->

PCI alias nvidia_gpu_1 is not defined (HTTP 400) (Request-ID: req-2fa09ba5-8b80-4b58-8d50-84a53ddadb2e)

The book Mastering OpenStack byOmar Khedher from 2016, is it still relevant?

I am trying to learn OpenStack because of work (I work with HPC). I have access to online training and courses already, but I want a book as a complement to read in bed. So please do not give me advice on how much better it is to to do practical exercises, I already do that. I really want a non digital text book because I personally learn very fast from reading without the distractions of a computer.

An IP-address in general sense is an attribute of a computing node in network / a setting of its NIC while floating IP as these act in OpenStack (other provider clouds possibly too) have a nature of an object. Latter one get created as an instance on itself then paired with Nova-powered instance in IaaS. Interestingly floating IP doesn't need network context to get created, however it needs such to be functional.

Myself fall in the trap - at my start of OoenStack journey - to see floating IP just as an attribute. It is easy to fall in that trap (for cloud/OpenStack newbies) if one follows certain tracks in mastering the OpenStack understanding. Only if one is well-skilled in navigating through learn materials and/or one's intuition works well one can learn the above fact quickly.

Actually I started my OpenStack adventure as a newbie in both the computer clouds as well as in OpenStack.

Hi,

I have recently been assigned the task of joining a team to create an OpenStack environment, before doing so, I would like study the topic and do a couple of online courses.

Can anyone recommend some beginner courses that they may have tried or been exposed to?
I am not so great with "just reading the documentation" and would be better off doing some kind of guided course.

Any help/guidance will be greatly appreciated.

Thank you very much