April 2019 - openstack-discuss - lists.openstack.org

[docs] Documenting CLI references (openstack-auto-commands)
by Sean McGinnis 19 Apr '19

19 Apr '19

Hey everyone, Hoping someone has discussed this and has a recommended course of action. Back when we had the awesome support of the openstack-docs team, there was a command called openstack-auto-commands that would load up client commands and generate help output for all commands. With the resource constraints that hit the team, there were less folks to support tools like this. Docs moved into each team's repos and, for the most part, I think that has worked out well. Some of the automatic syncing stopped happening with this move to in-repo docs. One of them was CLI docs. But it would appear there are at least a few teams that now have not updated these docs since that move happened several releases ago: http://codesearch.openstack.org/?q=This%20file%20is%20tool-generated&i=nope… There are others that appear to have used the last automatically generated version and have been (varying degrees of) successful at just manually updating the doc as things change. When the tool was removed (https://review.openstack.org/#/c/509402/) it was stated that it wasn't needed because cliff has sphinx integration to do the equivalent automatically. That's all well and good... if you are using cliff. But I think many of our legacy clients are not. So looking for recommendations on ways to best keep these docs up to date now. Migrate to cliff? Other in-repo automation tools? (and yeah, I know, "drop the CLI and move to openstackclient) Thanks for any suggestions! Sean

2 2

shelve server taking too long
by Manuel Sopena Ballesteros 19 Apr '19

19 Apr '19

Dear Openstack community, I am trying to shelve a server but the process seems to be stuck in shelving_image_pending_upload state. is it normal for the shelve process to take several hours? thank you NOTICE Please consider the environment before printing this email. This message and any attachments are intended for the addressee named and may contain legally privileged/confidential/copyright information. If you are not the intended recipient, you should not read, use, disclose, copy or distribute this communication. If you have received this message in error please notify us at once by return email and then delete both messages. We accept no liability for the distribution of viruses or similar in electronic communications. This notice should not be removed.

2 1

[searchlight] Searchlight planning for Train
by Trinh Nguyen 18 Apr '19

18 Apr '19

Hi team, We just released Searchlight for Stein last week successfully. Congratulations to all of you who have contributed to the project. We did it!!!! So now the Train cycle started [1]. I would like to plan for the things that we would want to accomplish in this new cycle. Please have a look at the etherpad [2] and put your ideas or comment on existing ones. [1] https://releases.openstack.org/train/schedule.html [2] https://etherpad.openstack.org/p/searchlight-train Yours, -- *Trinh Nguyen* *www.edlab.xyz <https://www.edlab.xyz>*

1 0

[tripleo] Scale up/down Ansible tasks
by Emilien Macchi 18 Apr '19

18 Apr '19

Hi folks, Today I spent a bit of time on: https://blueprints.launchpad.net/tripleo/+spec/scale-down-tasks Which is basically adding the capability of running Ansible tasks before a node is removed during a scale down or after a scale-up. I'm focusing on the scale-down right now, as I know it's something people have been waiting for (e.g. RHSM unsubscribe, Ceph OSD tear down, Nova Compute, etc). I need inputs from folks now, on what kind of tasks would be needed, I will test them and make sure the interface we provide is enough. John, Olie, and Martin in copy have maybe some ideas, please let me know some examples of Ansible tasks that you folks want to run before a node is deleted in Ironic. Prototype: https://review.openstack.org/#/q/topic:bp/scale-down-tasks+(status:open+OR+… Thanks a lot, -- Emilien Macchi

4 7

[ops] offer to host next OpenStack Ops meetup 2019-9-3, 2019-9-4 NYC
by Chris Morgan 18 Apr '19

18 Apr '19

Hello All, My employer Bloomberg LP would like to offer to host the next OpenStack Ops meetup here in NYC in early September this year. Please see https://etherpad.openstack.org/p/ops-meetup-2nd-2019 for some early details on this. All hosting offers are subject to scrutiny by the ops meetups team and the overal community for content, location, timing etc and then approved via a mix of consensus gathering and (if there are multiple offers) voting, see https://wiki.openstack.org/wiki/Ops_Meetups_Team and https://wiki.openstack.org/wiki/Operations/Meetups Thanks, Chris -- Chris Morgan <mihalis68(a)gmail.com>

7 6

[nova][ptg] Stein retrospective
by Eric Fried 18 Apr '19

18 Apr '19

All- I have seeded an etherpad for Nova Stein nostalgia [1]. Please populate it. Following tradition, I'm putting this first on the schedule. Unless this etherpad gets just huge, I'm going to time box the discussion to 30 minutes. Make it count. Thanks, efried [1] https://etherpad.openstack.org/p/nova-ptg-train-retrospective

1 0

Re: [openstack-dev] [nova][xenapi][ptg] can we deprecate the xenapi-specific 'nova-console' service?
by Eric Fried 18 Apr '19

18 Apr '19

Scrubbing the Nova PTG agenda (hence addition of [ptg] subject tag), and this is on it: ================ Can we remove the nova-console service? (mriedem) The nova-console service is xenapi-specific and was deprecated in stein: https://review.openstack.org/#/c/610075/ There are, however, REST APIs for it: https://developer.openstack.org/api-ref/compute/#server-consoles-servers-os… So if we drop the nova-console service, the APIs would no longer work. It seems our options are: Delete the nova-console service and obsolete the REST APIs (410 response on all microversions like what we're doingwith nova-cells and nova-network APIs) Deprecate the REST APIs on a new microversion but continue to support older microversions - this means the nova-console service would live forever. Are people still using the nova-console service? Are there alternatives/replacements for xen users? BobBall seemed to suggest there was http://lists.openstack.org/pipermail/openstack-dev/2018-October/135422.html but it's not clear to me. ================ I'm looking for any excuse to remove things from the agenda, and this seems like a good candidate, because we don't really stand to gain anything by bringing it up at the PTG. Does anyone a) object to removing the nova-console service; or b) think we need to discuss it at the PTG? Thanks, efried .

2 1

[neutron] Cancelling drivers meeting
by Miguel Lavalle 18 Apr '19

18 Apr '19

Dear Neutrinos, We don't have RFEs lined up for discussion for tomorrow's meeting. So we are cancelling it this week Best regards Miguel

1 0

[nova] Privsep is not giving us any security
by Matthew Booth 18 Apr '19

18 Apr '19

Privsep is intended to provide some security in depth. The idea is based on the principal of least privilege. We assume that an attacker has exploited some bug in Nova and is able to execute arbitrary code. If privsep is doing its job, the attacker should at least not be able to perform any privileged operations which Nova does not normally perform. For developers, from the spec[1]: "The intention is to allow slightly more code into the privileged portion - enough that we now have sufficient “context” to make better security decisions. For example move from “run chown” to “take ownership of VM output file”." Unfortunately, I suspect out of expediency in the initial forklift from rootwrap, we've lost this critical principal of moving security-critical logic into privsep itself. Consequently, a brief and non-exhaustive audit reveals we have privsep functions to do the following: fs.py: * mount anything of any type, including remote storage, anywhere. * unmount anything * shred any file or block device, without restriction path.py: * read any file or block device, without restriction * overwrite any existing file or block device utils.py: * send any signal to any process Just the existence of these methods in nova's privsep module essentially gives the unprivileged nova process unfettered root access, which entirely defeats the purpose of privsep. As it stands today, privsep gives us literally nothing. I suspect that it's worse than rootwrap, in fact. If privsep protection is something we want, we need to do 2 things: 1. Immediately stop adding or using generic privsep functions. 2. Audit privsep properly for problematic methods, and remove them. For example, in libvirt.driver.get_console_output() we do nova.privsep.path.writefile(console_log, 'a+', data). Instead, we should have, eg, nova.privsep.libvirt.ensure_console_log_for_instance(instance). This would determine the instance path from its own secure config (see [1] again), and touch that file. We should probably also compile a list of privsep anti-patterns if there isn't one already to make life simpler for reviewers. For example, I suggest that no privsep function should take as an argument a path, or any other reference to a system resource; it should determine these itself. I view this as essentially a continuation of the privsep forklift. As with all such large mechanical changes I expect this to be disruptive and unloved by reviewers. Is it something we'd be prepared to prioritise? Matt [1] https://specs.openstack.org/openstack/oslo-specs/specs/liberty/privsep.html -- Matthew Booth Red Hat OpenStack Engineer, Compute DFG Phone: +442070094448 (UK)

6 14

[OpenStack-sigs][publiccloud-wg][Action Required] help most needed for SIGs and WGs
by Rico Lin 18 Apr '19

18 Apr '19

Dear all SIG and WG members I would like to ask for three favors from each group. Thank you for your kindly help. tl;dr: 1. As an action from [3], we will have a forum `Help most needed for SIGs and WGs` [4]. And would like to ask each group kindly provide me the following help most needed information, including - What's your team's name - Who's leading or active in this team - What's this team recently plan or doing - How people can join this team? - What's your most needed help interns of actions or technical features? - Which team (or who) you think that have a part in above help request (high potentially is fine)? - Anything else you wish to share to attendees? 2. update help most needed section in [1]. So anyone can understand what help your group needs. Also, TCs and UCs will have a better view of how group effort been working in the community and how community priority should be if regarding SIGs and WGs. 3. Also, consider your needs as a community goal? Add it in [2] now. -------------------------------------------longer version--------------------------------------------------- ( don't worry, not like I can do a super long readable article, but under the power of line-counting this is longer and still readable for sure!) 1. Back in the last summit, we have a forum [3] to talk about how can we help to expose SIGs and WGs. As an action, We will host a forum in coming Denver summit, to talk about `Help most needed for SIGs and WGs` [4]. This forum will present the most needed help from SIGs and WGs. By plan to also invite everyone (will try to invite people from each team and group) in the community to join this forum. We might get attention from people and potentially helpers:). Therefore, I do wish to have participants from every group. Please kindly provide me the following help most needed information, including - What's your team's name - Who's leading or active in this team - What's this team recently plan or doing - How people can join this team? - What's your most needed help interns of actions or technical features? - Which team (or who) you think that have a part in above help request (high potentially is fine)? - Anything else you wish to share to attendees? I will try to reach out to each team too, but if you already have answers to the above questions, that will be super! Since we might get around 16 groups, will try to get to the ` most needed help` part for everyone. But hopefully, we can still give some time if any attendee is really interested in helping. We gonna get more focus on what's the needs and how we can help to make progress of it, so it won't be like another BoF or Project update for you. Also, it's a forum so I won't give my hope to have a video recorder, which makes the second part more essential. 2. Update help most needed section in [1]. So anyone can understand what help you need. Also, TCs and UCs will have a better view of how group effort been working in the community and how community priority should be. Possibly and hopefully organizations/users/people might find matching their inner plan and sending people to help. Now if your group are willing to help with the forum, this action should be easy. And as I mention we're going to have a forum [4], It will be benefit to have such a document ready for anyone who's not coming to summit. 3. Is this needed suitable as a community goal [2]? Since we're also discussing community goal in #openstack-tc and ML, I think this might be a good chance to raise your needs into suggestion as our goal [2] if you find it fit with community goal definition. As one of the Meta SIG chairs, I will try hard to make all SIG's life easier. So let me know if above action doesn't fit with your group or if you find it hard with making progress with your SIG mission. [1] https://github.com/openstack/governance/blob/master/reference/help-most-nee… [2] https://etherpad.openstack.org/p/community-goals [3] https://etherpad.openstack.org/p/expose-sigs-and-wgs [4] https://www.openstack.org/summit/denver-2019/summit-schedule/events/23612/h… -- May The Force of OpenStack Be With You, *Rico Lin*irc: ricolin

3 2