Publish shared react components independant of Elektra so they can be use from outside the Elektra context.

Idea: publish as a node module so import is easy

User get error when trying to edit the capacity in cloud_admin view

ActionView::Template::Error in plugins/resource_management
NoMethodError
undefined method `inquiries_url'

plugins/resource_management/app/views/resource_management/cloud_admin/edit_capacity.html.haml at line 23

i read elektra readme ,
its said have these features:
Extended services:
SAP Automation as a Service
SAP Hana as a Service
SAP Kubernetes as a Service

is it work for me after install elektara ? or its private repository ? how i can access to that?

Currently the project's domain-name cloud.sap is hard-coded in the project, for example:

To improve the project's portability the domain name should be made configurable through an environment variable or config file.

Elecktra is not able to authenticate service user. I have update the .env file

I have Keystone v3 enabled in Openstack.

[root@cloud-1 ~(keystone_admin)]# openstack endpoint list |grep identity
| 6544514f28124c80a1e2ef684cfbb41e | us-west-a | keystone | identity | True | internal | http://10.9.80.50:5000/v3 |
| c453c546636e404f8f251bab82e49c2f | us-west-a | keystone | identity | True | public | http://10.9.80.50:5000/v3 |
| e51b95358a9f4d64b45573e50d62455b | us-west-a | keystone | identity | True | admin | http://10.9.80.50:35357/v3 |
[root@cloud-1 ~(keystone_admin)]#

MONSOON_OPENSTACK_AUTH_API_ENDPOINT=http://10.9.80.50:5000/v3/auth/tokens
MONSOON_OPENSTACK_AUTH_API_USERID=admin
MONSOON_OPENSTACK_AUTH_API_PASSWORD=123456789
MONSOON_OPENSTACK_AUTH_API_DOMAIN=default

when I login to Elektra UI I am getting below error

Service User Authentication Error
The request you have made requires authentication. (user_id: admin, domain: default, scope: {:domain=>{:name=>"Default"}})

When I click on Login I am able to login with the admin user however on the home it shows same above Service User Authentication Error .

Keystone.log

2017-02-18 18:29:33.035 4954 INFO keystone.common.wsgi [req-bdcb46e2-e8a3-4309-b9a2-998d51c9843c - - - - -] POST http://10.9.80.50:5000/v3/auth/tokens
2017-02-18 18:29:33.206 4954 WARNING keystone.common.wsgi [req-bdcb46e2-e8a3-4309-b9a2-998d51c9843c - - - - -] Authorization failed. The request you have made requires authentication. from 10.9.60.210

screenshot attached .

Often times we only have a project's elektra URL which contains a friendly id slug that often doesn't match the actual name if people use URL unfriendly characters in their project names.

To make it easier to find the project in question we need a lookup by friendly ID slug which prints the project's real name and ID.

When creating a new router one has to select a private network subnet.
That interface is confusing. It looks more like an information and not like something one must select.
Maybe using something signaling that a user action is necessary, e.g. a checkbox or a dropdown would be better.

Add an option to edit a server's metadata (at least name should be editable). Editing should only be allowed for compute_admins.

When a project is renamed the friendly ID slug isn't updated and the user gets an Unauthorized error message when they try to access the project via the old slug.

Manually deleting the slug from the database fixes the problem.

The liveness check starts to fail after a pod has lived for about a week.

Look into improving the liveness and readiness checks.

Depended on the object, attributes like name, description, .. can't be set to 'blank'.
Non Default Pools can't be created.

Bug report: I accidentally assigned MONSOON3_DOMAIN_USERS instead of admins to my project when i removed them again Elektra first blocked for 1min or so. then I got an error.
I couldn't do anything with the project anymore. every click sent me to the sentry feedback screen. After a while it came back and I got sent to the login screen...

If a project name contains non-encoded HTML entities (e.g. &) friendly IDs don't work and the user gets an "Unauthorized" message.

We regularly get exceptions that happen because an object we don't expect to be nil is nil (likely because the backend call to retrieve the object is too slow). In these cases the user should get a nice message rather than an exception.

Usually this happens in the edit case or if some action is performed on an existing object.

Found cases:

• instance edit
• volume edit
• image sorting for instance new form
• security group show

I access localhost:3000/Default
After sign in use demo, redirect to Default/home, the page error show:

URI::InvalidURIError in Identity::DomainsController#show

`bad URI(is not URI?): [{"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:35357/v3", "region"=>"RegionOne", "interface"=>"admin", "id"=>"9d15f97a033e4b3999cef263e695f826"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"internal", "id"=>"af6fcbed74344f08bd6f7bdbc5db4514"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"public", "id"=>"b71fb2ab726344768e880b7f7b884199"}]

the error point is Service.new(api_client.send(name) in lib/core/api/client_wrapper.rb
the name variable is identity.

my terminal show me:

FriendlyIdEntry Load (0.8ms)  SELECT  "friendly_id_entries".* FROM "friendly_id_entries" WHERE (class_name='Domain' and (lower(key)='default' or lower(slug)='default') and endpoint='http://10.211.55.27:5000/v3/auth/tokens' ) ORDER BY "friendly_id_entries"."id" ASC LIMIT $1  [["LIMIT", 1]]
17:19:42 rails.1 |   CACHE FriendlyIdEntry Load (0.0ms)  SELECT  "friendly_id_entries".* FROM "friendly_id_entries" WHERE (class_name='Domain' and (lower(key)='default' or lower(slug)='default') and endpoint='http://10.211.55.27:5000/v3/auth/tokens' ) ORDER BY "friendly_id_entries"."id" ASC LIMIT $1  [["LIMIT", 1]]
17:19:42 rails.1 | Completed 500 Internal Server Error in 96ms (ActiveRecord: 3.2ms)
17:19:42 rails.1 | 
17:19:42 rails.1 | 
17:19:42 rails.1 | bad URI(is not URI?): [{"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:35357/v3", "region"=>"RegionOne", "interface"=>"admin", "id"=>"9d15f97a033e4b3999cef263e695f826"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"internal", "id"=>"af6fcbed74344f08bd6f7bdbc5db4514"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"public", "id"=>"b71fb2ab726344768e880b7f7b884199"}] excluded from capture: DSN not set
17:19:42 rails.1 |   
17:19:42 rails.1 | URI::InvalidURIError (bad URI(is not URI?): [{"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:35357/v3", "region"=>"RegionOne", "interface"=>"admin", "id"=>"9d15f97a033e4b3999cef263e695f826"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"internal", "id"=>"af6fcbed74344f08bd6f7bdbc5db4514"}, {"region_id"=>"RegionOne", "url"=>"http://10.211.xx.xx:5000/v3", "region"=>"RegionOne", "interface"=>"public", "id"=>"b71fb2ab726344768e880b7f7b884199"}]):
17:19:42 rails.1 |   
17:19:42 rails.1 | lib/core/api/client_wrapper.rb:151:in `block (3 levels) in initialize'

my .env file content is:

POSTGRES_SERVICE_HOST=localhost
POSTGRES_SERVICE_PORT=5432

# Rails development port
PORT=3000

MONSOON_DB_USER=dashboard
MONSOON_DB_PASSWORD=dashboard

# Devstack standard admin user/pw settings used for elektra service user
MONSOON_OPENSTACK_AUTH_API_ENDPOINT=http://10.211.xx.xx:5000/v3/auth/tokens
MONSOON_OPENSTACK_AUTH_API_USERID=admin
MONSOON_OPENSTACK_AUTH_API_PASSWORD=secret
MONSOON_OPENSTACK_AUTH_API_DOMAIN=Default
# openstack service endpoint interface, default internal (for local development you most likely need to set this to public)
DEFAULT_SERVICE_INTERFACE=public

other options is default by env.sample

the url access no error for http://10.211.xx.xx:35357/v3 and http://10.211.xx.xx:5000/v3
openstack edtion is mitaka

Can you tell me how i should fix the probliem, thanks.

According to the network API it is possible to allocate floating ips with a specific address (https://developer.openstack.org/api-ref/network/v2/#create-floating-ip). This is not yet supported by the dashboard, but is desired by customers.

If I edit a flavor via dashboard in ccadmin/cloud_admin for example I activate it, I get an error and afterwards the flavor is deleted.

Regards,

Olaf

Implement an autogeneratable changelog that is easier readable and more condensed than the commit history for others to track what we have been working on.

Idea: A changelog that can be generated from the information in git/github

When adding a new public key of the type ed25519 the interface does not accept it.

With rails5 upgrade it is not necessary to have the healthcheck middleware anymore. Rewrite those checks and add them to the prometheus exporter to be used in new grafana dashboards

Liveness and Readiness check can be written from same controller having in the readiness action a Modell call to check if the database is still up and running.

Tasks:

• Remove middleware healthcheck
• Write both healthchecks from the same controller. Add a model call just for the readiness check.
• Add healthcheck calls to the prometheus exporter

Since Elektra has been switched to the new Elektron API client all dependencies to the previously used Fog and Misty clients should be removed.

Consider a situation where the sapcc-billing backend service is available. A user logs on and wants to request a new project. This action happens in the domain scope, where Keystone does not deliver a service catalog. Therefore, services.cost_control.available? is false and the project request form (and thus, the project request) will not contain the form fields for specifying a cost object.

This leads to funny crashes when the domain admin tries to approve the request, because the dialog gets confused over cost control being enabled on the one side, but the request not containing any cost object data on the other side.

There are two questions in here:

1. How can we rewrite services.cost_control.available? such that it gives the correct result when the project request wizard is rendered?
2. When the request is approved, the dashboard seems to understand that cost control is enabled (as evidenced by it trying, and failing, to access the cost object metadata in the request). But that workflow also happens in domain scope, where services.cost_control.available? should give the same, wrong result. How does that work? (Maybe it just doesn't check the service availability at all?)

Since this breaks the project request workflow for customers, it would be nice if someone could look into this soon.

Add the ability to extend or shrink a manila share

What is not apparent from the project page is wether Elektra is geared towards public or private clouds.

My initial thought was that Elektra was a drop-in replacement for Horizon, Horizon being geared towards public clouds with support for tenants and domains. Now having spent a little time setting-up Elektra with OpenStack Ansible it seems to me Elektra is geared towards private clouds. The default domain, API credentials requirements during setup, etc.

Reset status on a volume requires "admin" role, even if the user has cinder_admin. This is an indication that the policy doesn't have a rule for this action and falls back to the default policy.

Implement a service for admins that allows an input of floating IP or DNS record. The service should then find which project the input belongs to and display the following information about the project:

• Project domain
• Project name
• Project ID
• List of users with the role admin

Additionally retrieve some information about the object the floating IP or DNS record is attached to:

• Type of object (server, load balancer, ...)
• Name
• Backend information (e.g. building block or vcenter info, ...)

The service shall be available (via link) from the domain start page and only visible/useable by users with the new security_ops role (already available in staging).

There is already a branch (reverse-lookup) where I did some initial work before deciding that this was too cumbersome to do in rails and that it needed to be a react app. The code is in the lookup plugin under reverse_lookup (controller and views)

For the user lists my idea was to get users with the role and then separately get groups with the role and make the groups expandable (so the users in the group are only loaded if the group is expanded).

Currently when we create a server it gets a fixed IP assigned via DHCP. Some customers would like to choose a specific fixed IP for a new server.

In order for this to work we'll need to offer the ability to create ports with a specific fixed IP. Then at a later stage when creating a new server we offer the ability to use DHCP (default) or choose from the previously created ports.

i was looking elektra travis,
what meaning "# Not yet implemented" ?
what things Not yet implemented?

thanks

I’m trying to figure out how to implement Elektra with OpenStack Ansible instead of DevStack. I keep getting an Unsupported Domain notification in the view.

Sidenote: Keystone v3 is active and I have an admin user with a Default domain and a RegionOne region in OpenStack.

Could you try and help me out getting this to work? Thanks in advance.

Screenshot:

When I'm out of Quota in Manila Shared File System Storage I expect a proper error to be shown.
But the create share dialog simply hangs without any indication.

implement actions for sharedfilesystem_admin

The router UI needs some love. Some actions aren't possible from Elektra (e.g. removing internal interfaces) and are not named the way they are named in OpenStack.

Investigate what we should support and redesign the UI accordingly. Might be worth to separate the actions to add/remove the internal interfaces on the subnets from adding/removing the gateway interface on the FIP/External network.

usecase with multiple fixed IPs at the same port on a server and thus the same mac address is not displayed + handled correctly. UI shows only one IP out of many

please fix the testcase I added for this in b162a08, my quick poor commented fix, that would handle at least the 'show' will most likely not be enough for add/remove FIP

Some customers are using CLI to first create a port with an IP and then boot an instance with that port id.
This makes sure a server of type X always gets the same private IP.

That should be implemented on the UI.

The security group that is chosen on instance creation isn't assigned. Instead the server gets the default security group.

TEST CASE:

1. Logon to cc3test / admin project in qa-de-1
2. Create a cirros vm with security group datapath_ingress_all
3. Check security group on server details screen

EXPECTED BEHAVIOUR:

OBSERVED BEHAVIOUR:

Same issue is observed in eu-nl-1. Cannot access server!

When renaming a project via OpenStack CLI our FriendlyID entry isn't update which causes the project to be inaccessible to the user.

Using a DevStack installation at commit e08f45f77f73392b2524992d8ca6c4e628400bcc in * branch stable/mitaka

Dashboard is not enabled for this domain.

Error ID: 0d29e012-3744-4012-9ecf-4bbf3b2a062e
Show error details 

Could not authenticate service user. Please check permissions on default for service user admin

I've verified that I can login with the admin credentials via:

curl -i \
  -H "Content-Type: application/json" \
  -d '
{ "auth": {
    "identity": {
      "methods": ["password"],
      "password": {
        "user": {
          "name": "admin",
          "domain": { "id": "default" },
          "password": "*********"
        }
      }
    }
  }
}' \
  http://localhost:5000/v3/auth/tokens ; echo

I get the error "Please select at a network" (please fix the grammar too) when creating a server, if I have selected a network + subnet, but no fixed IP

It works if I don't select a subnet, but that is not very intuitive.

When I configure the .env file, foreman start run the project, visit localhost: 3000/Default, enter the login page, enter the horizon existing account, prompt
[Monsoon Openstack Auth] login_form_user -> failed. (http://10.211.xx.xx/identity/auth/tokens): The resource could not be found.
The "user" and "demo" account login is not up. horizon login success.

my .env config file is
# Devstack standard admin user/pw settings used for elektra service user MONSOON_OPENSTACK_AUTH_API_ENDPOINT=http://10.211.xx.xx/identity/v3/auth/tokens MONSOON_OPENSTACK_AUTH_API_USERID=admin MONSOON_OPENSTACK_AUTH_API_PASSWORD=secret MONSOON_OPENSTACK_AUTH_API_DOMAIN=Default DEFAULT_SERVICE_INTERFACE=public
openstack is build by devstack on ubuntu16.04.
I have used “http://10.211.xx.xx/identity/v3/auth/tokens” to test the keystone api, succeeded. the url from xxx.xxx.xxx.xxx/indentify.
The "admin" user is admin role.

thanks.

Currently the internal network that a router is attached to is only shown in the router's details view. It would be helpful if it would already be shown on the router list screen.

Unify ports and fixed IP UI. Add possibility to delete ports.

Fixed IP reservations are ports with a fixed IP that haven't been attached to anything yet. In order to make this clearer to the user we'll unify the ports and fixed IP reservation UIs.

The Ocata release of Glance changed the meaning of the visibility attribute as specified here: https://wiki.openstack.org/wiki/Glance-v2-community-image-visibility-design
This can be identified by the minor version of the API being 2.5 or later.

It breaks a bit our UI on images, as it expects all "shared" images to be offered images which can be accepted, and that "private" images can be shared.

By default, the image resulting of a snapshot of an instance will have the "shared" visibility, meaning it can be shared to others.

In order to roll out the Queens release (currently deployed in staging), it would be good adopt the UI to the new visibility semantics.

If you try to delete a router, there is an error that subnet or port should be given

implement on share network show to also load the related share server and show the details, in our netapp case: vserver_name

According to some customers SSO for them is not working, neither on windows nor on mac. After they choose a certificate they still have to enter their user/pw.
Further testing on QA showed this happens for users that have no domain-role-assignment.
Apparently elektra tries to issue a domain-scoped (SSO) authentication, that fails for 'normal' users because of lacking role-assignments.
The SSO auth should be 'unscoped' (or at least only scoped to projects/domains where a user has role-assignments for) to fix it.

Add a 'reset state' option to servers.

Reset state is an action on a compute server, possible target states are 'active' and 'error' (see http://developer.openstack.org/api-ref/compute/?expanded=reset-server-state-os-resetstate-action-detail#reset-server-state-os-resetstate-action)

role needed: compute_admin (requires nova policy change)

This needs some documentation for end-users as to when it makes sense to use. Example:

user turned off instance on console (without nova knowing) and triggered a reboot leaving instance in error
solution: reset state to active, nova stop, nova start

Server groups are affinity groups for servers which determine where (availability zone) a server will be spawned in relation to other servers in the same group.

1. Show for a server which server groups it belongs to and which rule is applied (affinity / anti-affinity)

2. Add a new server groups UI that allows CRUD for server groups

Api Bad floatingip request: Port 8a90e270-1a5b-431d-b251-f221a6e5d57c has multiple fixed IPv4 addresses. Must provide a specific IPv4 address when assigning a floating IP. and Api .

Add option to lock/unlock an instance. Locking an instance prevents any action on it.

Only allowed for compute_admins (this requires a change to the nova policy)