February 2021 - openstack-discuss

Network policer behavior
by Vladimir Prokofev 19 Feb '21

19 Feb '21

I've encountered some really bizarre things today, and want to discuss it for a sanity check. This is probably more appropriate for a libvirt mailing list, but I want some second opinion first. Openstack Queens libvirtd (libvirt) 4.0.0 qemu-x86_64 version 2.11.1(Debian 1:2.11+dfsg-1ubuntu7.15) 2 instances were launched a while ago with Zabbix Appliance 5.0.7 LTS inside. Both of them were "hacked" shortly after and became a part of a botnet that participated in DDOS attacks via SYN-flood. Sad, but nothing out of the ordinary so far. Now to the bizarre part. Both of the instances had QoS configured via instance metadata that limited them for 100Mb/s in/out[1]. I've checked it on the compute side - it was correctly applied there too[2]. This metadata was tested years ago with usual iperf tcp/udp tests with 1-10 flows - it worked perfectly. Both of the instances landed on the same compute node. And both of them are ignoring network policer and sending about 400Mb/s of SYN-flood traffic each on their respective tap interface, so about 800Mb/s were flowing out of the compute node switch port. So I've shut down 1 instance - 2nd one traffic rose to about 600Mb/s - ok, they probably were contesting some resources. Now I apply a qos-policy to the port of the remaining instance[3] - that does the trick, I can see on the switch port that compute node traffic went down to the expected level, but CPU context switches on the compute node increased almost 3 times, and traffic on the tap interface rise to 1.6Gb/s! What I can't understand is why libvirt network policer does not handle this case? Why does implementing qos-policy actually increase traffic on the tap interface? I can't exactly say if it's the tc that is responsible for context switches increase, or traffic generated by the instance. At first I thought that my Zabbix went crazy, so I double checked. It seems it takes its data for net.if.in key from /proc/net/dev and it appears to be correct. Any ideas appreciated. [1] quota:vif_inbound_average='12500', quota:vif_inbound_burst='3125', quota:vif_inbound_peak='12500', quota:vif_outbound_average='12500', quota:vif_outbound_burst='3125', quota:vif_outbound_peak='12500' [2] compute2:~$ virsh domiftune instance-0000141d tap834d76e9-5f inbound.average: 12500 inbound.peak : 12500 inbound.burst : 3125 inbound.floor : 0 outbound.average: 12500 outbound.peak : 12500 outbound.burst : 3125 [3] openstack port set --qos-policy 100Mbps 834d16e9-5f85-4e82-a834-bdae613cfc23

1 0

[release] Release countdown for week R-7 Feb 22 - Feb 26
by Herve Beraud 19 Feb '21

19 Feb '21

Greetings everyone, Development Focus ----------------- We are entering the last weeks of the Wallaby development cycle. From now until the final release, we'll send a countdown email like this every week. It's probably a good time for teams to take stock of their library and client work that needs to be completed yet. The non-client library freeze is coming up, followed closely by the client lib freeze. Please plan accordingly to avoid any last minute rushes to get key functionality in. General Information ------------------- Next week is the Extra-ATC freeze, in preparation for elections. All contributions to OpenStack are valuable, but some are not expressed as Gerrit code changes. Please list active contributors to your project team who do not have a code contribution this cycle, and therefore won't automatically be considered an Active Technical Contributor and allowed to vote. This is done by adding extra-atcs to https://opendev.org/openstack/governance/src/branch/master/reference/projec… before the Extra-ATC freeze on 25 February, 2021. A quick reminder of the upcoming freeze dates. Those vary depending on deliverable type: * General libraries (except client libraries) need to have their last feature release before Non-client library freeze (4 March, 2021). Their stable branches are cut early. * Client libraries (think python-*client libraries) need to have their last feature release before Client library freeze (11 March, 2021) * Deliverables following a cycle-with-rc model (that would be most services) observe a Feature freeze on that same date, 11 March, 2021. Any feature addition beyond that date should be discussed on the mailing-list and get PTL approval. After feature freeze, cycle-with-rc deliverables need to produce a first release candidate (and a stable branch) before RC1 deadline (22 March, 2021) * Deliverables following cycle-with-intermediary model can release as necessary, but in all cases before Final RC deadline (5 April, 2021) Finally, now is also a good time to start planning what highlights you want for your deliverables in the cycle highlights. The deadline to submit an initial version for those is set to Feature freeze (11 March, 2021). Background on cycle-highlights: http://lists.openstack.org/pipermail/openstack-dev/2017-December/125613.html Project Team Guide, Cycle-Highlights: https://docs.openstack.org/project-team-guide/release-management.html#cycle… knelson [at] openstack.org/diablo_rojo on IRC is available if you need help selecting or writing your highlights. Upcoming Deadlines & Dates -------------------------- Cross-project events: - Extra-ATC freeze: 25 February, 2021 (R-7 week) - Non-client library freeze: 4 March, 2021 (R-6 week) - Client library freeze: 11 March, 2021 (R-5 week) - Wallaby-3 milestone: 11 March, 2021 (R-5 week) Project-specific events: - Oslo Feature Freeze: 25 February, 2021 (R-7 week) - Cinder Driver Features Declaration: 12 March, 2021 (R-5 week) Thanks for your attention -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

[all][TC] March k8s Steering Committee Meeting?
by Kendall Nelson 18 Feb '21

18 Feb '21

Hello! I wanted to make everyone aware that I was able to coordinate time with the k8s Steering Committee to have some cross community discussions at their next public monthly meeting. I wanted to kick-off collection of topics early and I figured we could keep using the etherpad[1] we used for our last discussions with them. Please add ideas! Also, if you are interested in attending, please do! It's a public community meeting and all are welcome. -Kendall (diablo_rojo) [1] https://etherpad.opendev.org/p/kubernetes-cross-community-topics

1 0

[ops] How to enable Live Migrate option in instance dropdown in Horizon?
by Linebarger, John 18 Feb '21

18 Feb '21

Precisely how do I enable a Live Migrate option in the instance dropdown menu in Horizon? I've been following the instructions at this link, but a Live Migrate option (or any migrate option at all) never appears in Horizon despite restarting nova-compute and the openstack dashboard service. We are using a libvirt VM-based implementation of Canonical Charmed OpenStack (Stein). Somewhere there's a trick or a detail that we are missing. https://docs.openstack.org/nova/victoria/admin/configuring-migrations.html#… Thanks! Enjoy! John M. Linebarger, PhD, MBA Principal Member of Technical Staff Sandia National Laboratories (Work) 505-845-8282 (Cell) 505-681-4879 [cid:image006.jpg@01D705FE.47F9E330]<http://www.sandia.gov/>[AWS Certified Solutions Architect - Professional]<https://www.youracclaim.com/badges/24fe4e43-2f72-4ecc-a11a-783d21dada0f>[AWS Certified Solutions Architect - Associate]<https://www.youracclaim.com/badges/707a5f6f-d919-4daa-bbc4-81b5a779a6cd>[AWS Certified Developer - Associate]<https://www.youracclaim.com/badges/b52ac093-5415-4493-85c3-b77e055211f5>[cid:image003.png@01D705FD.A88014F0]<https://www.youracclaim.com/badges/d6e5a453-0e61-4dbe-9716-6af51f364710/pub…>[cid:image007.png@01D705FE.47F9E330]<https://www.youracclaim.com/badges/035d4967-f77d-476e-915b-1061bb789ec3/pub…>

3 2

Trove Instance fails in build stage
by Abhinav Tyagi 18 Feb '21

18 Feb '21

Hi, Please help us in using trove. We are using https://tarballs.opendev.org/openstack/trove/images/trove-ussuri-mysql-ubun… image. We have a multi master openstack setup. These are the logs: Feb 18 19:03:30 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:03:30.535 1274599 INFO trove.taskmanager.models [-] Waiting for instance 5fe896f6-dc7b-424a-87c2-64f207f422a2 up and running with timeout 900s Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall [-] Dynamic backoff interval looping call 'trove.common.utils.build_polling_task.<locals>.poll_and_check' failed: oslo_service.loopingcall.LoopingCallTimeOut: Looping call timed out after 893.31 seconds Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall Traceback (most recent call last): Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall File "/usr/lib/python3.6/site-packages/oslo_service/loopingcall.py", line 154, in _run_loop Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall idle = idle_for_func(result, self._elapsed(watch)) Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall File "/usr/lib/python3.6/site-packages/oslo_service/loopingcall.py", line 351, in _idle_for Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall % self._error_time) Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall oslo_service.loopingcall.LoopingCallTimeOut: Looping call timed out after 893.31 seconds Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.940 1274599 ERROR oslo.service.loopingcall Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.941 1274599 ERROR trove.taskmanager.models [-] Failed to create instance 5fe896f6-dc7b-424a-87c2-64f207f422a2, error: Polling request timed out..: trove.common.exception.PollTimeOut: Polling request timed out. Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.960 1274599 ERROR trove.taskmanager.models [-] Service status: ERROR, service error description: guestagent error: trove.common.exception.PollTimeOut: Polling request timed out. Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.970 1274599 DEBUG trove.db.models [-] Saving DBInstance: {'_sa_instance_state': <sqlalchemy.orm.state.InstanceState object at 0x7fb5447bd668>, 'tenant_id': '19aa2578cb444b828549b394eed8ebfb', 'hostname': None, 'shard_id': None, 'server_status': None, 'compute_instance_id': 'b928d7e4-6706-48d2-9fb9-c75e19b9765c', 'type': None, 'deleted': 0, 'id': '5fe896f6-dc7b-424a-87c2-64f207f422a2', 'task_id': 91, 'region_id': 'Bangalore', 'deleted_at': None, 'task_description': 'Build error: guestagent timeout.', 'encrypted_key': '***', 'datastore_version_id': 'b4bbc01c-e785-4944-8a76-6c154c19ddff', 'task_start_time': None, 'created': datetime.datetime(2021, 2, 18, 13, 33, 24), 'configuration_id': None, 'volume_id': '68accc42-34ae-4ac3-93fc-1efb9fed2af9', 'slave_of_id': None, 'updated': datetime.datetime(2021, 2, 18, 13, 48, 33, 969535), 'flavor_id': 'bbf4bad4-e258-45b4-8860-e5a51c86ed6e', 'name': 'trove_instance_15', 'cluster_id': None, 'volume_size': 10, 'errors': {}} save /usr/lib/python3.6/site-packages/trove/db/models.py:65 Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.981 1274599 ERROR trove.taskmanager.models [-] Trove instance status: ERROR, Trove instance status description: Build error: guestagent timeout.: trove.common.exception.PollTimeOut: Polling request timed out. Feb 18 19:18:33 bngoscompn01.comviva.com trove-taskmanager[1274599]: 2021-02-18 19:18:33.994 1274599 DEBUG trove.db.models [-] Saving DBInstanceFault: {'_sa_instance_state': <sqlalchemy.orm.state.InstanceState object at 0x7fb5448688d0>, 'id': 'f0983744-4cfe-4863-b9ae-6fb33cc8a0d2', 'created': datetime.datetime(2021, 2, 18, 13, 48, 33, 994216), 'deleted': False, 'instance_id': '5fe896f6-dc7b-424a-87c2-64f207f422a2', 'message': 'Polling request timed out.', 'details': 'Traceback (most recent call last):\n File "/usr/lib/python3.6/site-packages/trove/common/utils.py", line 207, in wait_for_task\n return polling_task.wait()\n File "/usr/local/lib/python3.6/site-packages/eventlet/event.py", line 125, in wait\n result = hub.switch()\n File "/usr/local/lib/python3.6/site-packages/eventlet/hubs/hub.py", line 309, in switch\n return self.greenlet.switch()\n File "/usr/lib/python3.6/site-packages/oslo_service/loopingcall.py", line 154, in _run_loop\n idle = idle_for_func(result, self._elapsed(watch))\n File "/usr/lib/python3.6/site-packages/oslo_service/loopingcall.py", line 351, in _idle_for\n % self._error_time)\noslo_service.loopingcall.LoopingCallTimeOut:\n Looping call timed out after 893.31 seconds\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File "/usr/lib/python3.6/site-packages/trove/taskmanager/models.py", line 431, in wait_for_instance\n time_out=timeout)\n File "/usr/lib/python3.6/site-packages/trove/common/utils.py", line 222, in poll_until\n return wait_for_task(task)\n File "/usr/lib/python3.6/site-packages/trove/common/utils.py", line 209, in wait_for_task\n raise exception.PollTimeOut\ntrove.common.exception.PollTimeOut: Polling request timed out.\n', 'errors': {}, 'updated': datetime.datetime(2021, 2, 18, 13, 48, 33, 994288)} save /usr/lib/python3.6/site-packages/trove/db/models.py:65

2 1

Some questions regarding OpenStack Trove Victoria release
by Bekir Fajkovic 18 Feb '21

18 Feb '21

Hello! My name is Bekir Fajkovic and i work at City Network cloud service provider mostly as a DBA but i am also involved in many other kind of activities inside the Company. We at City Network are currently in a process of deployment of OpenStack Trove project (latest official release) and are thus preparing a dedicated region inside our OpenStack hosting environment to host it as a beta version internally, to begin with, where we are going to involve some of our customers to evaluate the service after, hopefully, successful installation and configuration. To be totally honest, while there is a whole lot of a certain kind of documentation provided covering many aspects, some other aspects inside the project do not seem to be documented in depth or at all (which of course is totally understandable), so i am forced to ask some questions this way and i hope You find them not to be too annoying to anyone. The questions: ------------------------ Having the fact that Trove Victoria release provides Docker containers as a new way of database instance provisioning, i am wondering how far the project is developed in terms of covering the different types of databases. What i can see by mainly parsing the code provided on Github, those seem to be officially released: - MySQL - MariaDB - PostgreSQL and the rest of the planned database types are in "experimental" phase. And also, regarding certain types of databases (for example MySQL, version 5.7 and 8.0) only certain versions of the datastores seems to be supported, but not all. On the other hand, nothing regarding datastore versions supported for MariaDB and PostgreSQL seems to be mentioned somewhere. Could someone please confirm that as well as give some more details about it? I successfully managed to create certain versions of datastores in my devstack environment, belonging to those 3 database types mentioned above (and based on trovestack-generated dev guest image that is by default delivered with devstack installation), but not without some undesirable events. For example, i am able to register PostgreSQL datastore version 12 and instantiate a database instance of that version but not version 13 and above, where i get some hostname-related errors etc. Also, a question regarding the building of the production-ready guest image. As mentioned, Trovestack script is provided as a possible way of producing the images (by omitting dev option the Trove Guest Agent binaries are deployed into the instantiated VM). How does an image produced this way looks like? From where the base image is fetched, is it a "cloud based image" with cloud-init in it, are the automatic security and software patching features disabled in produced image, so that we do not get unexpected service interruptions when the OS suddenly decides to start updating itself etc.. Regarding the Trove Guest Agent service - i read in some Trove books previously that there are dedicated agents for each and every database type, is it the same situation in Victoria release, or is there an "universal" Guest Agent covering all the database types nowadays? Where is the code that adapts the Agent commands towards the database instances placed inside the project? The backups - as i can see there seem to be some kind of dedicated docker-backup images involved in each database type. Could someone explain the internals of backup mechanisms inside Trove Victoria release in more details? So, that would be all for the moment and although You probably consider my questions being as stupid as possible, i still dared to ask them :) I hope You will be able to provide the answers to at least some of them! Thanks in advance! Best Regards Bekir Fajkovic Senior DBA Mobile: +46 70 019 48 47 www.citynetwork.eu | www.citycloud.com INNOVATION THROUGH OPEN IT INFRASTRUCTURE ISO 9001, 14001, 27001, 27015 & 27018 CERTIFIED

3 10

[all][requirements] Pygments 2.8.0 break console blocks
by Dmitriy Rabotyagov 18 Feb '21

18 Feb '21

Hi! After recent upper-constraints bump [1] which upgraded Pygments to version 2.8.0 we got our docs tests broken because of the console blocks [2]. So CI started failing with "Could not lex literal_block as "console". Highlighting skipped." While I can kind of understand some of the issues, with a misleading quotes (while they're fine in bash) some are totally weird. For example it starts complaining on this [3]. I'm not sure if it's intended behaviour of Pygments with 2.8.0 and pretty ok to fix the docs, but I'm not sure I understand the issue here... It feels more like Pygments issue atm. And changelog [4] is pretty excessive... [1] https://opendev.org/openstack/requirements/commit/673ce445d54f8bdf792550e2d… [2] https://zuul.opendev.org/t/openstack/build/6eea1a7099824c90a533b57c1281d478… [3] https://opendev.org/openstack/openstack-ansible/src/branch/master/doc/sourc… [4] https://pygments.org/docs/changelog/#version-2-8-0 -- Kind regards, Dmitriy

1 1

[CentOS7][train][tripleo]undercloud self-signed certificate expired
by Ruslanas Gžibovskis 18 Feb '21

18 Feb '21

Hi all. I got undercloud certificate expired and cannot find the best procedure to update the certificate. Do you have any link to Read The Following Material/Manual? I cannot find anything useful. As "openstack undercloud install|upgrade --force-stack-update" fails at step below: "logical_resource_id": "undercloud", "resource_status_reason": "Resource CREATE failed: StackValidationFailed: resources.UndercloudServiceChain.resources.ServiceChain: Property error: ServiceChain.resources[18].properties: Property RootStackName not assigned", "resource_status": "CREATE_FAILED", "physical_resource_id": "50784129-526c-4f14-83d3-7a0c51a7cbd9", "id": "d3b641cb-8ec0-422b-a012-8b14c9724270"}]} -- Ruslanas Gžibovskis +370 6030 7030

2 5

[victoria][cinder] Local Volume Type
by Ammad Syed 18 Feb '21

18 Feb '21

Hi, Is there a way in cinder to create a volume type that creates persistent root and persistent volumes on compute host instance path or local on compute host local storage ? Ammad Ali -- Regards, Syed Ammad Ali

1 0

[neutron] Drivers meeting agenda - Friday 19.02.2021
by Slawek Kaplonski 18 Feb '21

18 Feb '21

Hi, Agenda for tomorrow's drivers meeting is at [1]. We have only one RFE to discuss there: https://bugs.launchpad.net/neutron/+bug/1915151 It is continuation of discussion from last week. I updated it with requested info. Please take a look and tell me if You need anything more there. Also if anyone wants to discuss anything else on tomorrow's meeting, please add Your topics to the "On Demand" section on the agenda page [1]. See You on the meeting tomorrow. [1] https://wiki.openstack.org/wiki/Meetings/NeutronDrivers -- Slawek Kaplonski Principal Software Engineer Red Hat

1 0

[victoria][cinder] Default Storage type
by Malik Obaid 18 Feb '21

18 Feb '21

Hi, I am creating nova instance with cinder backed iscsi storage. I have created multiple storage types. But my launched instance from image use storage type __DEFAULT__ for flavor's root volume. I have changed default_volume_type to mystoragetype in cinder.conf but instances root volume still goes in __DEFAULT__ storage type. However new volume creation in mystoragetype is successful. Need help, how can I set instance root volume storage type during its deployment ? Regards, Malik Obaid

3 4

[swift][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: Swift tempurl middleware reveals signatures in the logfiles (CVE-2017-8761) https://launchpad.net/bugs/1685798 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[nova][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Host data corruption through nova inject_key feature https://launchpad.net/bugs/1552042 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[neutron][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: Metadata iptables rules never inserted upon exception on router creation https://launchpad.net/bugs/1735724 Neutron RBAC not working for multiple extensions https://launchpad.net/bugs/1784259 tenant isolation is bypassed if port admin-state-up=false https://launchpad.net/bugs/1798904 non-IP ethertypes are permitted with iptables_hybrid firewall driver https://launchpad.net/bugs/1838473 RA Leak on tenant network https://launchpad.net/bugs/1844712 Anti-spoofing bypass https://launchpad.net/bugs/1884341 Anti-spoofing bypass using Open vSwitch https://launchpad.net/bugs/1902917 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[keystone][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: PCI-DSS account lock out DoS and account UUID lookup oracle https://launchpad.net/bugs/1688137 keystonemiddleware connections to memcached from neutron-server grow beyond configured values https://launchpad.net/bugs/1883659 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[horizon][security-sig] Please revisit your open vulnerability reports
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following reports: using glance v2 api does not remove temporary files https://launchpad.net/bugs/1674846 DOS : API_RESULT_LIMIT does not work for swift objects https://launchpad.net/bugs/1724598 XSS in adding JavaScript into the ‘Subnet Name’ field https://launchpad.net/bugs/1892848 Can these be exploited by a nefarious actor, and if so, how? Are they likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[glance][security-sig] Please revisit your open vulnerability report
by Jeremy Stanley 18 Feb '21

18 Feb '21

Please help the OpenStack Vulnerability Management Team by taking a look at the following report: default paste_deploy.flavor is none, but config file text implies it is 'keystone' (was: non-admin users can see all tenants' images even when image is private) https://launchpad.net/bugs/1799588 Can it be exploited by a nefarious actor, and if so, how? Is it likely to be fixable in all our supported stable branches, respecting stable backport policy? What deployment configurations and options might determine whether a particular installation is susceptible? This is the sort of feedback we depend on to make determinations regarding whether and how to keep the public notified, so they can make informed decisions. Thanks for doing your part to keep our users safe! -- Jeremy Stanley

1 0

[cyborg] Participating in Anuket hardware acceleration discussions
by Ildiko Vancsa 18 Feb '21

18 Feb '21

Hi Cyborg Team, I’m reaching out to you about a recent discussion[1] in Anuket (project created by the merger of CNTT and OPNFV) about hardware acceleration. In the Reference Model discussions the interested people are planning to create a sub-group to identify the hardware acceleration needs of a telecom cloud infrastructure and identify and define interfaces to manage and integrate hardware accelerator devices. Currently the discussions are taking place as part of the Reference Model discussions[1] until a sub-group is formed. It would be great to have people from the Cyborg team to participate to update the Anuket contributors about the project’s current features and roadmap as well as gain more requirements that can be used in the project onwards. Would someone from the Cyborg team be available to participate? Please let me know if you have questions. Thanks, Ildikó [1] https://wiki.lfnetworking.org/display/LN/2021-02-02+-+RM%3A+Hardware+Accele… [2] https://wiki.anuket.io/display/HOME/RM

2 3

[largescale-sig] Next meeting: February 10, 15utc
by Thierry Carrez 18 Feb '21

18 Feb '21

Hi everyone, Our next Large Scale SIG meeting will be this Wednesday in #openstack-meeting-3 on IRC, at 15UTC. You can doublecheck how it translates locally at: https://www.timeanddate.com/worldclock/fixedtime.html?iso=20210210T15 Feel free to add other topics to our agenda at: https://etherpad.openstack.org/p/large-scale-sig-meeting Talk to you all later, -- Thierry Carrez

1 2

[victoria][cinder] Volume Delete In server live migrate
by Ammad Syed 18 Feb '21

18 Feb '21

Hi, I am using Nexentastor5.3 community edition with cinder victoria. When I try to do live migrate machine from one host to other host, the volume does deleted from nexentastor. I see below logs in cinder logs. 2021-02-17 12:14:10.881 79940 INFO cinder.volume.manager [req-26344304-7180-4622-9915-b5f2f76ccd3e 2af528fdf3244e15b4f3f8fcfc0889c5 890eb2b7d1b8488aa88de7c34d08817a - - -] attachment_update completed successfully. 2021-02-17 12:14:20.867 79940 INFO cinder.volume.manager [req-37ff44a8-5bf9-4c4d-b114-68e6c0504859 2af528fdf3244e15b4f3f8fcfc0889c5 890eb2b7d1b8488aa88de7c34d08817a - - -] Terminate volume connection completed successfully. 2021-02-17 12:14:20.917 79940 WARNING py.warnings [req-37ff44a8-5bf9-4c4d-b114-68e6c0504859 2af528fdf3244e15b4f3f8fcfc0889c5 890eb2b7d1b8488aa88de7c34d08817a - - -] /usr/lib/python3/dist-packages/sqlalchemy/orm/evaluator.py:95: SAWarning: Evaluating non-mapped column expression 'updated_at' onto ORM instances; this is a deprecated use case. Please make use of the actual mapped columns in ORM-evaluated UPDATE / DELETE expressions. util.warn( Please advise. -- Regards, Syed Ammad Ali

3 5

[oslo] Feature Freeze is approaching
by Herve Beraud 18 Feb '21

18 Feb '21

Hi Oslo contributors, Oslo observes a feature freeze that is earlier than other projects. This is to allow time for features in Oslo to be adopted in the services before their feature freeze. And it's coming up soon. Feb. 25th (R-7 week) is the Oslo feature freeze date for this cycle [1][2]. That leaves about one weeks for features to be merged in Oslo libraries. After that, any features to be merged will require a feature freeze exception, which can be requested on the list. If you have any questions about this feel free to contact me here or on IRC (hberaud in #openstack-oslo). Thanks for your attention [1] https://releases.openstack.org/wallaby/schedule.html [2] https://releases.openstack.org/wallaby/schedule.html#w-oslo-feature-freeze -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud -----BEGIN PGP SIGNATURE----- wsFcBAABCAAQBQJb4AwCCRAHwXRBNkGNegAALSkQAHrotwCiL3VMwDR0vcja10Q+ Kf31yCutl5bAlS7tOKpPQ9XN4oC0ZSThyNNFVrg8ail0SczHXsC4rOrsPblgGRN+ RQLoCm2eO1AkB0ubCYLaq0XqSaO+Uk81QxAPkyPCEGT6SRxXr2lhADK0T86kBnMP F8RvGolu3EFjlqCVgeOZaR51PqwUlEhZXZuuNKrWZXg/oRiY4811GmnvzmUhgK5G 5+f8mUg74hfjDbR2VhjTeaLKp0PhskjOIKY3vqHXofLuaqFDD+WrAy/NgDGvN22g glGfj472T3xyHnUzM8ILgAGSghfzZF5Skj2qEeci9cB6K3Hm3osj+PbvfsXE/7Kw m/xtm+FjnaywZEv54uCmVIzQsRIm1qJscu20Qw6Q0UiPpDFqD7O6tWSRKdX11UTZ hwVQTMh9AKQDBEh2W9nnFi9kzSSNu4OQ1dRMcYHWfd9BEkccezxHwUM4Xyov5Fe0 qnbfzTB1tYkjU78loMWFaLa00ftSxP/DtQ//iYVyfVNfcCwfDszXLOqlkvGmY1/Y F1ON0ONekDZkGJsDoS6QdiUSn8RZ2mHArGEWMV00EV5DCIbCXRvywXV43ckx8Z+3 B8qUJhBqJ8RS2F+vTs3DTaXqcktgJ4UkhYC2c1gImcPRyGrK9VY0sCT+1iA+wp/O v6rDpkeNksZ9fFSyoY2o =ECSj -----END PGP SIGNATURE-----

1 0

Recall: [cyborg] Participating in Anuket hardware acceleration discussions
by Wang, Xin-ran 18 Feb '21

18 Feb '21

Wang, Xin-ran would like to recall the message, "[cyborg] Participating in Anuket hardware acceleration discussions".

1 0

[tripleo][compute][overcloud]Add additional compute nodes on existing overcloud
by dangerzone ar 18 Feb '21

18 Feb '21

Hi all...I'm planning to add another 3 compute servers to existing overcloud (consists of existing 2 compute nodes, 3 controllers and 3 storage). I'm running on openstack ussuri using tripleo and centos7. Below is the command and parameters used during initial deployment ``` openstack overcloud deploy --templates \ -r ~/templates/roles_data.yaml \ -n ~/templates/network_data.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/network-environment.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/network-isolation.yaml \ -e /usr/share/openstack-tripleo-heat-templates/environments/docker-ha.yaml -e ~/templates/network.yaml \ -e ~/templates/scheduler_hints_env.yaml \ -e ~/templates/node-info.yaml ``` So now this is my plan to add additional compute nodes *1. Create new json file containing details of new compute nodes i.e. newnodes.json* *openstack overcloud node import newnodes.json* *2. Run introspection* *openstack overcloud node introspect --all-manageable* *3. Tag each new node for its desired role* *openstack baremetal node set --property capabilities='profile:compute,boot_option:local' [NODE UUID]* *4. Run openstack overcloud deploy* *openstack overcloud deploy --compute-scale 3* *Step No 4, should I run overcloud deploy with all the environment template/parameters same as during initial deployment as per example above?* *Really appreciate your advice of these steps especially no 4.* Please advise further if my plan and steps above are good to go. Thank you for your help and kind advice. May God bless you. Thank you. dz 1.

2 5

Fwd: [all] [board] [diversity][events][ptg][forum][summit] New OpenInfra IRC Channels!
by Kendall Nelson 17 Feb '21

17 Feb '21

Hello Everyone! As you might have seen, there was a ML post[1] earlier this year/end of last year discussing openinfra -ing some of our openstack channels to make them more inclusive. The process is almost done! We now have the follow channels in place: - #openinfra (to replace #openstack-foundation) - #openinfra-board (to replace #openstack-board) - #openinfra-events (to replace #openstack-ptg, #openstack-forum, #openstack-summit, and #openinfra-summit ) - #openinfra-diversity (ro replace #openstack-diversity) Our last step is to kick people from the old channels which we plan to do at the end of the month. All the archives for the old channels remain on eavesdrop here[2]. We have setup redirects so that when people try to join the old channels, they will now be directed to the new ones. See you in open infra land! Thanks! -Kendall (diablo_rojo) & fungi [1] http://lists.openstack.org/pipermail/foundation/2020-December/002920.html [2] http://eavesdrop.openstack.org/irclogs/

1 0

[tc] weekly meeting
by Mohammed Naser 17 Feb '21

17 Feb '21

Hi everyone, Here’s the agenda for our weekly TC meeting. It will happen tomorrow (Thursday the 18th) at 1500 UTC in #openstack-tc and I will be your chair. If you can’t attend, please put your name in the “Apologies for Absence” section. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting # ACTIVE INITIATIVES * Follow up on past action items * Audit SIG list and chairs (diablo_rojo) - https://etherpad.opendev.org/p/2021-SIG-Updates - http://lists.openstack.org/pipermail/openstack-discuss/2021-January/019994.… * Gate performance and heavy job configs (dansmith) - http://paste.openstack.org/show/jD6kAP9tHk7PZr2nhv8h/ * Mistral Maintenance (gmann) - Any early step we can take to get help in Mistral maintenance? - http://lists.openstack.org/pipermail/openstack-discuss/2021-February/020137… * Student Programs (diablo_rojo) - Google Summer of Code: https://summerofcode.withgoogle.com/get-started/ - Feb 19th - Outreachy: https://www.outreachy.org/communities/cfp/ - March 7th * k8s Steering Committee Meeting - March 1st from 17:30- 18:30 UTC - Can reuse the etherpad from our last interactions? https://etherpad.opendev.org/p/kubernetes-cross-community-topics or make a new one to brainstorm topics * Recommended path forward for OSarchiver (ttx) - OVH released https://github.com/ovh/osarchiver as open source, and they are interested in pushing it under OpenStack governance to increase discoverability - One option is to make it its own smallish project on the "Operations tooling" side of the map - Another option is to place it under the "Operation Docs and Tooling" SIG in the OSops repository, but that seems mostly abandoned - What's the TC's recommendation for them to follow? * Open Reviews https://review.opendev.org/q/project:openstack/governance+is:open Thanks, Mohammed -- Mohammed Naser VEXXHOST, Inc.

1 0