- OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Dec 20 – 27)
by Stefano Maffulli 28 Dec '13

28 Dec '13

OpenStack “J” naming poll closed <http://lists.openstack.org/pipermail/openstack/2013-December/004035.html> Polls closed, the OpenStack community decided: Juno will be the name of the OpenStack development cycle starting in May 2014, after the Icehouse cycle completes. Third party testing with Turbo-Hipster <http://josh.people.rcbops.com/2013/12/third-party-testing-with-turbo-hipste…> Soon you are going to see a new robot barista leaving comments on Nova code reviews. He is obsessed with espresso, that band you haven’t heard of yet, and easing the life of OpenStack operators. Doing a large OpenStack deployment has always been hard when it came to database migrations. Running a migration requires downtime, and when you have giant datasets that downtime could be hours. To help catch these issues a <http://josh.people.rcbops.com/2013/09/building-a>new zuul worker <http://josh.people.rcbops.com/2013/09/building-a-zuul-worker/> called Turbo-Hipster will run your patchset’s migrations against copies of real databases. This will give you valuable feedback on the success of the patch, and how long it might take to migrate. How to Upgrade an OpenStack Swift Cluster with No Downtime <http://swiftstack.com/blog/2013/12/20/upgrade-openstack-swift-no-downtime/> OpenStack Swift deployers can upgrade from one version of Swift to the next with zero downtime for end users. This has been supported since the initial release of OpenStack Swift back in 2010. OpenStack Project Update Webinars <http://www.openstack.org/blog/2013/12/openstack-project-update-webinars/> To allow for broader participation, we’ve scheduled post-Summit webinars with the Project Team Leads (PTLs) to provide the latest project updates rather than schedule these tracks during the Summit. Next scheduled events: *Tuesday, January 7, 2013* 7 a.m. Pacific/10 a.m. Eastern Project team leads: Mark Washenberger, Image Service (Glance); Julien Danjou, Telemetry (Ceilometer); John Griffith, Block Storage (Cinder) Register: http://openstack.enterthemeeting.com/m/4BC36YZQ *Thursday, January 9, 2013* Noon Pacific/3 p.m. Eastern* Project team leads: Steve Baker, Orchestration (Heat) and David Lyle, Dashboard (Horizon) Register: http://openstack.enterthemeeting.com/m/AXQYKMP7 *Recorded session* Russell Bryant, Compute (Nova) and John Dickinson, Object Storage (Swift) <http://www.youtube.com/watch?v=BZt_r54_vCM&feature=share&list=UUQ74G2gKXdpw…> /The recording of the session by Mark McClain, Networking (Neutron) and Dolph Mathews, Identity (Keystone) will be published as soon as possible./ Tips ‘n Tricks * By Chmouel Boudjnah <http://blog.chmouel.com/>: The life of an OpenStack contributor checking for Jenkins failures <http://blog.chmouel.com/2013/12/24/life-of-openstack-contributor-jenkins-fa…> * By Lars Kellogg-Stedman <http://blog.oddbit.com/>: Visualizing Neutron Networking with GraphViz <http://blog.oddbit.com/2013/12/23/visualizing-network-with-graphviz> * By Sébastien Han <http://sebastien-han.fr/>: OpenStack, Ceph RBD and QoS <http://sebastien-han.fr/blog/2013/12/23/openstack-ceph-rbd-and-qos/> Upcoming Events * 3rd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/events/141728912/> Jan 15, 2014 – Stockholm, Sweden Details <http://www.meetup.com/OpenStack-User-Group-Nordics/events/141728912/> * Austin OpenStack User Group Meetup <http://www.meetup.com/OpenStack-Austin/events/154504332/> Jan 22, 2014 – Austin, Texas Details <http://www.meetup.com/OpenStack-Austin/events/154504332/> * FOSDEM <https://fosdem.org/2014/> Feb 01 – 02, 2014 – Bruxelles, Belgium Details <https://fosdem.org/2014/> * Austin OpenStack User Group Meetup <http://www.meetup.com/OpenStack-Austin/events/154331162/> Feb 19, 2014 – Austin, Texas Details <http://www.meetup.com/OpenStack-Austin/events/154331162/> Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Glance image-create returns HTTPInternalServerError (HTTP 500) <https://ask.openstack.org/en/question/9570/glance-image-create-returns-http…> * How to change VNC frame size in Horizon? <https://ask.openstack.org/en/question/9351/how-to-change-vnc-frame-size-in-…> * How to set default network for project? <https://ask.openstack.org/en/question/9328/how-to-set-default-network-for-p…> * Trouble Installing Multi-Node OpenStack RDO and Gluster Backend on F19 <https://ask.openstack.org/en/question/9365/trouble-installing-multi-node-op…> * No network communication on a 3 node Havana setup <https://ask.openstack.org/en/question/9394/no-network-communication-on-a-3-…> * How to configure VM to have only one network interface <https://ask.openstack.org/en/question/9464/how-to-configure-vm-to-have-only…> * How does nova-baremetal-deploy-helper service get to run? <https://ask.openstack.org/en/question/9506/how-does-nova-baremetal-deploy-h…> * How to configure DHCP agent when I’m using openvswitch and linux bridge in cloud at the same time <https://ask.openstack.org/en/question/9532/how-to-configure-dhcp-agent-when…> * Getting TypeError SQLite DateTime while creating multi-region setup <https://ask.openstack.org/en/question/9536/getting-typeerror-sqlite-datetim…> * Disable networking – Is it possible ? <https://ask.openstack.org/en/question/9538/disable-networking-is-it-possibl…> * How to add a menu in horizon? <https://ask.openstack.org/en/question/9542/how-to-add-a-menu-in-horizon/> Welcome New Reviewers and Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! <http://www.openstack.org/profile/> Pentheus <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jia Dong <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Lee Li <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Yuanchao Sun <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sergey Nikitin <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Michael Krotscheck <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Taurus Cheung <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> JiaHao Li <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Vadim Rovachev <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Haojie Jia <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tim Bell <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bob Callaway <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Stanislav Kudriashev <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Sergey Nikitin <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ken Perkins <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dmitry Kulishenko <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> shihanzhang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Navid Shaikh <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Jaume Devesa <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Igor A. Lukyanenkov <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Cedric Brandily <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Feng Ju <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Yanis Guenane <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Mikhail Durnosvistov <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Hadoop Cluster as a Service (Savanna) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Dec 13 – 20)
by Stefano Maffulli 21 Dec '13

21 Dec '13

1 0

[OSSA 2013-037] Nova compute DoS through ephemeral disk backing files (CVE-2013-6437)
by Thierry Carrez 18 Dec '13

18 Dec '13

OpenStack Security Advisory: 2013-037 CVE: CVE-2013-6437 Date: December 18, 2013 Title: Nova compute DoS through ephemeral disk backing files Reporter: Phil Day (HP) Products: Nova Affects: All supported versions Description: Phil Day from HP reported a vulnerability in the libvirt driver handling of ephemeral disk backing files on Nova compute nodes. By repeatedly creating snapshots, changing the os_type to a new random value, and spawning new instances from the snapshot (and quickly deleting those instances), an authenticated user could generate lots of different ephemeral disk backing files and fill up compute node disks, potentially resulting in a Denial of Service against a Nova setup. Only Nova setups running the libvirt driver are affected. Icehouse (development branch) fix: https://review.openstack.org/62910 Havana fix: https://review.openstack.org/62912 Grizzly fix: https://review.openstack.org/62913 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6437 https://bugs.launchpad.net/nova/+bug/1253980 Regards, -- Thierry Carrez OpenStack Vulnerability Management Team

1 0

OpenStack 2013.2.1 released
by Alan Pevec 17 Dec '13

17 Dec '13

Hello everyone, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.2.1 stable Havana release. We have been busy reviewing and accepting backported bugfixes to the stable/havana branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 136 bugs have been fixed across all projects. These updates to Havana are intended to be relatively risk free with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/nova/havana/2013.2.1 https://launchpad.net/keystone/havana/2013.2.1 https://launchpad.net/glance/havana/2013.2.1 https://launchpad.net/neutron/havana/2013.2.1 https://launchpad.net/cinder/havana/2013.2.1 https://launchpad.net/horizon/havana/2013.2.1 https://launchpad.net/heat/havana/2013.2.1 https://launchpad.net/ceilometer/havana/2013.2.1 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.1 The freeze on the stable/havana branches will be lifted today as we begin working toward the 2013.2.2 release, to be released on Feb 06 and managed by Adam Gandelman. Thanks, Alan

1 0

OpenStack Community Weekly Newsletter (Dec 6 – 13)
by Stefano Maffulli 16 Dec '13

16 Dec '13

1 2

[Swift] Release of Swift 1.11.0
by John Dickinson 13 Dec '13

13 Dec '13

I'm happy to announce that we've released Swift 1.11.0. You can find the high-level Launchpad details (including a link to the tarball) at https://launchpad.net/swift/icehouse/1.11.0. As always, you can upgrade to this release without any downtime to your users. Swift 1.11.0 is the work of 26 contributors, including the following 5 new contributors to Swift: Rick Hawkins Steven Lang Gonéri Le Bouder Zhenguo Niu Aaron Rosen This release includes some significant new features. I encourage you to read the change log (https://github.com/openstack/swift/blob/master/CHANGELOG), and I'll highlight some of the more significant changes below. * Discoverable capabilities: The Swift proxy server will now respond to /info requests with information about the particular cluster being queried. This will allow easy programmatic discovery of limits and features implemented in a particular Swift system. The first two obvious use cases are for cross-cluster clients (e.g. common client between Rackspace, HP, and a private deployment) and for deeper functional testing of all parts of the Swift API. * Early quorum response: On writes, the Swift proxy server will not return success unless a quorum of the storage nodes indicate they have successfully written data to disk. Previously, the proxy waited for all storage nodes to respond, even if it had already heard from a quorum of servers. With this change, the proxy node will be able to respond to client requests as soon as a quorum of the storage nodes indicate a common response. This can help lower response times to clients and improve performance of the cluster. * Retry reads: If a storage server fails during an object read request, the proxy will now continue the response stream to the client by making a request to a different replica of the data. For example, if a client requests a 3GB object and the particular object server serving the response fails during the request after 1.25GB, the proxy will make a range request to a different replica, asking for the data starting at 1.25GB into the file. In this way, Swift provides even higher availability to your data in the face of hardware failures. * DiskFile API: The DiskFile abstraction for talking to data on disk has been refactored to allow alternate implementations to be developed. There is an example in-memory implementation included in the codebase. External implementations include one for Gluster and one for Seagate Kinetic drives. The DiskFile API is still a work in progress and is not yet finalized. * Object replication ssync (an rsync alternative): A Swift storage node can now be configured to use Swift primitives for replication transport instead of rsync. Although still being tested at scale, this mechanism will allow for future development improving replication times and lowering both MTTD and MTTR of errors. I'd like to publicly thank the Swift contributors and core developers for their work on Swift. Their diverse experience and viewpoints make Swift the mature project it is, capable of running the world's largest storage clouds. --John

1 0

[OSSA 2013-036] Insufficient sanitization of Instance Name in Horizon (CVE-2013-6858)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-036 CVE: CVE-2013-6858 Date: December 11, 2013 Title: Insufficient sanitization of Instance Name in Horizon Reporter: Cisco PSIRT Products: Horizon Affects: All supported releases Description: Cisco PSIRT reported a vulnerability in the OpenStack Horizon dashboard. By embedding HTML tags in an Instance Name, a tenant may execute a script within an administrator's browser resulting in a cross-site scripting (XSS) attack. Only setups using the Horizon dashboard are affected. Icehouse (development branch) fix: https://review.openstack.org/55175 Havana fix: https://review.openstack.org/58465 Grizzly fix: https://review.openstack.org/58820 Notes: This fix is included in the icehouse-1 development milestone and will appear in a future 2013.2.1 stable point release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6858 https://launchpad.net/bugs/1247675 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-035] Heat ReST API doesn't respect tenant scoping (CVE-2013-6428)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-035 CVE: CVE-2013-6428 Date: December 11, 2013 Title: Heat ReST API doesn't respect tenant scoping Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in the Heat ReST API. By changing the request path, an authenticated client may override their tenant scope resulting in privilege escalation. Only setups exposing the Heat orchestration ReST interface are affected. Icehouse (development branch) fix: https://review.openstack.org/61455 Havana fix: https://review.openstack.org/61456 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6428 https://launchpad.net/bugs/1256983 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-034 CVE: CVE-2013-6426 Date: December 11, 2013 Title: Heat CFN policy rules not all enforced Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in Heat's default API policy enforcement. By calling the CreateStack or UpdateStack methods, an in-instance user may be able to create or update a stack in violation of the default policy. Only setups using Heat's cloudformation-compatible API are affected. Icehouse (development branch) fix: https://review.openstack.org/61452 Havana fix: https://review.openstack.org/61454 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6426 https://launchpad.net/bugs/1256049 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)
by Jeremy Stanley 11 Dec '13

11 Dec '13

OpenStack Security Advisory: 2013-034 CVE: CVE-2013-6426 Date: December 11, 2013 Title: Heat CFN policy rules not all enforced Reporter: Steven Hardy (Red Hat) Products: Heat Affects: All supported releases Description: Steven Hardy from Red Hat reported a vulnerability in Heat's default API policy enforcement. By calling the CreateStack or UpdateStack methods, an in-instance user may be able to create or update a stack in violation of the default policy. Only setups using Heat's cloudformation-compatible API are affected. Icehouse (development branch) fix: https://review.openstack.org/61452 Havana fix: https://review.openstack.org/61454 Notes: This fix will be included in the icehouse-2 development milestone and in a future 2013.2.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6426 https://launchpad.net/bugs/1256049 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0