February 2021 - openstack-discuss

Some questions regarding OpenStack Trove Victoria release
by Bekir Fajkovic 18 Feb '21

18 Feb '21

Hello! My name is Bekir Fajkovic and i work at City Network cloud service provider mostly as a DBA but i am also involved in many other kind of activities inside the Company. We at City Network are currently in a process of deployment of OpenStack Trove project (latest official release) and are thus preparing a dedicated region inside our OpenStack hosting environment to host it as a beta version internally, to begin with, where we are going to involve some of our customers to evaluate the service after, hopefully, successful installation and configuration. To be totally honest, while there is a whole lot of a certain kind of documentation provided covering many aspects, some other aspects inside the project do not seem to be documented in depth or at all (which of course is totally understandable), so i am forced to ask some questions this way and i hope You find them not to be too annoying to anyone. The questions: ------------------------ Having the fact that Trove Victoria release provides Docker containers as a new way of database instance provisioning, i am wondering how far the project is developed in terms of covering the different types of databases. What i can see by mainly parsing the code provided on Github, those seem to be officially released: - MySQL - MariaDB - PostgreSQL and the rest of the planned database types are in "experimental" phase. And also, regarding certain types of databases (for example MySQL, version 5.7 and 8.0) only certain versions of the datastores seems to be supported, but not all. On the other hand, nothing regarding datastore versions supported for MariaDB and PostgreSQL seems to be mentioned somewhere. Could someone please confirm that as well as give some more details about it? I successfully managed to create certain versions of datastores in my devstack environment, belonging to those 3 database types mentioned above (and based on trovestack-generated dev guest image that is by default delivered with devstack installation), but not without some undesirable events. For example, i am able to register PostgreSQL datastore version 12 and instantiate a database instance of that version but not version 13 and above, where i get some hostname-related errors etc. Also, a question regarding the building of the production-ready guest image. As mentioned, Trovestack script is provided as a possible way of producing the images (by omitting dev option the Trove Guest Agent binaries are deployed into the instantiated VM). How does an image produced this way looks like? From where the base image is fetched, is it a "cloud based image" with cloud-init in it, are the automatic security and software patching features disabled in produced image, so that we do not get unexpected service interruptions when the OS suddenly decides to start updating itself etc.. Regarding the Trove Guest Agent service - i read in some Trove books previously that there are dedicated agents for each and every database type, is it the same situation in Victoria release, or is there an "universal" Guest Agent covering all the database types nowadays? Where is the code that adapts the Agent commands towards the database instances placed inside the project? The backups - as i can see there seem to be some kind of dedicated docker-backup images involved in each database type. Could someone explain the internals of backup mechanisms inside Trove Victoria release in more details? So, that would be all for the moment and although You probably consider my questions being as stupid as possible, i still dared to ask them :) I hope You will be able to provide the answers to at least some of them! Thanks in advance! Best Regards Bekir Fajkovic Senior DBA Mobile: +46 70 019 48 47 www.citynetwork.eu | www.citycloud.com INNOVATION THROUGH OPEN IT INFRASTRUCTURE ISO 9001, 14001, 27001, 27015 & 27018 CERTIFIED

3 10

[all][requirements] Pygments 2.8.0 break console blocks
by Dmitriy Rabotyagov 18 Feb '21

18 Feb '21

Hi! After recent upper-constraints bump [1] which upgraded Pygments to version 2.8.0 we got our docs tests broken because of the console blocks [2]. So CI started failing with "Could not lex literal_block as "console". Highlighting skipped." While I can kind of understand some of the issues, with a misleading quotes (while they're fine in bash) some are totally weird. For example it starts complaining on this [3]. I'm not sure if it's intended behaviour of Pygments with 2.8.0 and pretty ok to fix the docs, but I'm not sure I understand the issue here... It feels more like Pygments issue atm. And changelog [4] is pretty excessive... [1] https://opendev.org/openstack/requirements/commit/673ce445d54f8bdf792550e2d… [2] https://zuul.opendev.org/t/openstack/build/6eea1a7099824c90a533b57c1281d478… [3] https://opendev.org/openstack/openstack-ansible/src/branch/master/doc/sourc… [4] https://pygments.org/docs/changelog/#version-2-8-0 -- Kind regards, Dmitriy

1 1

[CentOS7][train][tripleo]undercloud self-signed certificate expired
by Ruslanas Gžibovskis 18 Feb '21

18 Feb '21

Hi all. I got undercloud certificate expired and cannot find the best procedure to update the certificate. Do you have any link to Read The Following Material/Manual? I cannot find anything useful. As "openstack undercloud install|upgrade --force-stack-update" fails at step below: "logical_resource_id": "undercloud", "resource_status_reason": "Resource CREATE failed: StackValidationFailed: resources.UndercloudServiceChain.resources.ServiceChain: Property error: ServiceChain.resources[18].properties: Property RootStackName not assigned", "resource_status": "CREATE_FAILED", "physical_resource_id": "50784129-526c-4f14-83d3-7a0c51a7cbd9", "id": "d3b641cb-8ec0-422b-a012-8b14c9724270"}]} -- Ruslanas Gžibovskis +370 6030 7030

2 5

[victoria][cinder] Local Volume Type
by Ammad Syed 18 Feb '21

18 Feb '21

Hi, Is there a way in cinder to create a volume type that creates persistent root and persistent volumes on compute host instance path or local on compute host local storage ? Ammad Ali -- Regards, Syed Ammad Ali

1 0

[neutron] Drivers meeting agenda - Friday 19.02.2021
by Slawek Kaplonski 18 Feb '21

18 Feb '21

Hi, Agenda for tomorrow's drivers meeting is at [1]. We have only one RFE to discuss there: https://bugs.launchpad.net/neutron/+bug/1915151 It is continuation of discussion from last week. I updated it with requested info. Please take a look and tell me if You need anything more there. Also if anyone wants to discuss anything else on tomorrow's meeting, please add Your topics to the "On Demand" section on the agenda page [1]. See You on the meeting tomorrow. [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[victoria][cinder] Default Storage type
by Malik Obaid 18 Feb '21

18 Feb '21

Hi, I am creating nova instance with cinder backed iscsi storage. I have created multiple storage types. But my launched instance from image use storage type __DEFAULT__ for flavor's root volume. I have changed default_volume_type to mystoragetype in cinder.conf but instances root volume still goes in __DEFAULT__ storage type. However new volume creation in mystoragetype is successful. Need help, how can I set instance root volume storage type during its deployment ? Regards, Malik Obaid

3 4

[swift][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: Swift tempurl middleware reveals signatures in the logfiles (CVE-2017-8761) https://launchpad.net/bugs/1685798 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[nova][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Host data corruption through nova inject_key feature https://launchpad.net/bugs/1552042 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[neutron][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Metadata iptables rules never inserted upon exception on router creation https://launchpad.net/bugs/1735724 Neutron RBAC not working for multiple extensions https://launchpad.net/bugs/1784259 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 non-IP ethertypes are permitted with iptables_hybrid firewall driver https://launchpad.net/bugs/1838473 RA Leak on tenant network https://launchpad.net/bugs/1844712 Anti-spoofing bypass https://launchpad.net/bugs/1884341 Anti-spoofing bypass using Open vSwitch https://launchpad.net/bugs/1902917 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[keystone][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: PCI-DSS account lock out DoS and account UUID lookup oracle https://launchpad.net/bugs/1688137 keystonemiddleware connections to memcached from neutron-server grow beyond configured values https://launchpad.net/bugs/1883659 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0