August 2021 - openstack-discuss - lists.openstack.org

Subject: [all][elections][ptl] PTL Voting Kickoff - Cyborg
by Belmiro Moreira 31 Aug '21

31 Aug '21

Polls for PTL elections are now open and will remain open for you to cast your vote until Sep 07, 2021 23:45 UTC. We are having PTL elections for Cyborg. Please rank all candidates in your order of preference. You are eligible to vote in a PTL election if you are a Foundationindividual member[0] and had a commit in one of that team'sdeliverable repositories[1] over the Sep 25, 2020 00:00 UTC - Aug 24, 2021 00:00 UTC timeframe (Wallaby to Xena) or if you are in that team's list of extra-atcs[2]. If you are eligible to vote in an election, you should find youremail with a link to the Condorcet page to cast your vote in theinbox of your Gerrit preferred email[3]. What to do if you don't see the email and have a commit in atleast one of the projects having an election:* check the trash or spam folders of your gerrit Preferred Email address, in case it went into trash or spam* wait a bit and check again, in case your email server is a bit slow* find the sha of at least one commit from the project's deliverable repos[0] and email the election officials[4]. If we can confirm that you are entitled to vote, we will add youto the voters list for the appropriate election. Our democratic process is important to the health of OpenStack,please exercise your right to vote! Candidate statements/platforms can be found linked to Candidatenames on this page:https://governance.openstack.org/election/ Happy voting,Belmiro,On behalf of all the Election Officials [0] https://www.openstack.org/community/members/ [1] The list of the repositories eligible for electoral status: https://opendev.org/openstack/governance/src/tag/0.10.0/reference/projects.… [2] Look for the extra-atcs element in [1] [3] Sign into review.openstack.org: Go to Settings > Contact Information. Look at the email listed as your preferred email. That is where the ballot has been sent. [4] https://governance.openstack.org/election/#election-officials

1 1

[OSSA-2021-005] Neutron: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts (CVE-2021-40085)
by Jeremy Stanley 31 Aug '21

31 Aug '21

==================================================================== OSSA-2021-005: Arbitrary dnsmasq reconfiguration via extra_dhcp_opts ==================================================================== :Date: August 31, 2021 :CVE: CVE-2021-40085 Affects ~~~~~~~ - Neutron: <16.4.1, >=17.0.0 <17.2.1, >=18.0.0 <18.1.1 Description ~~~~~~~~~~~ Pavel Toporkov reported a vulnerability in Neutron. By supplying a specially crafted extra_dhcp_opts value, an authenticated user may add arbitrary configuration to the dnsmasq process in order to crash the service, change parameters for other tenants sharing the same interface, or otherwise alter that daemon's behavior. This vulnerability may also be used to trigger a configuration parsing buffer overflow in versions of dnsmasq prior to 2.81, which could lead to remote code execution. All Neutron deployments are affected. Patches ~~~~~~~ - https://review.opendev.org/806750 (Ussuri) - https://review.opendev.org/806749 (Victoria) - https://review.opendev.org/806748 (Wallaby) - https://review.opendev.org/806746 (Xena) Credits ~~~~~~~ - Pavel Toporkov (CVE-2021-40085) References ~~~~~~~~~~ - https://launchpad.net/bugs/1939733 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40085 -- Jeremy Stanley

1 0

[nova][placement] Asia friendly meeting slot on 2nd of Sept
by Balazs Gibizer 31 Aug '21

31 Aug '21

Hi, This is a reminder that the next Asia friendly Nova meeting timeslot is coming up this week on Thursday 8:00 UTC[1]. We will hold that meeting on IRC[2] in the #openstack-nova channel on the OFTC server. See you there. Cheers, gibi [1] http://www.timeanddate.com/worldclock/fixedtime.html?iso=2021-09-02T08:00:00 [2] https://docs.openstack.org/contributors/common/irc.html

1 0

A question about nova live-migration across AZ
by Yingji Sun 31 Aug '21

31 Aug '21

Buddies, I can migration nova instance across available zones with the command below. Suppose instance is in AZ1 and host is in AZ2. nova --os-compute-api-version 2.67 live-migration --force [--block-migrate] <server> [<host>] After migration, the instance’s available zone is changed to AZ2. However, the available zone information in request_specs was not changed. So next time when trying to migrate the instance without specifying a target, the migration target will be selected through nova scheduler, by the availability zone value (AZ1) saved in request_specs. This caused some error. Is this an expected behavior ? Yingji.

4 3

[baremetal-sig][ironic] Tue Sep 7, 2021, 2pm UTC: Ironic User & Operator Feedback
by Arne Wiebalck 30 Aug '21

30 Aug '21

Dear all, The Bare Metal SIG is back from the summer break and will zoom-meet next week, Tue Sep 7, 2021, at 2pm UTC. To start the new season, this first session will focus on: User/operator/admin feedback for Ironic So come along, meet other Ironicers and discuss your Ironic pain points, issues, experiences and ideas with the community and in particular the upstream developers! Everyone, in particular not-yet Ironicers, are welcome to join! All details can be found on: https://etherpad.opendev.org/p/bare-metal-sig Hope to see you there! Arne (for the Bare Metal SIG)

1 0

[Kolla] update
by Ignazio Cassano 30 Aug '21

30 Aug '21

Hello, I would like to ask if the procedure I am using for update my kolla wallaby is correct. Every week new images are released so I execute the following steps: 1. Pull new images on my local registry 2 pull new images from my local registry to controllers and compute nodes 3 kolla-ansible deploy Are the above steps the correct way or I missed something? Must I clean something before deploying ? Thanks Ignazio

3 10

No meeting tomorrow
by Gage Hugo 30 Aug '21

30 Aug '21

Hey team, Since there are no agenda items [0] for the IRC meeting tomorrow, the meeting is cancelled. Our next meeting will be Sept 7th. Thanks [0] https://etherpad.opendev.org/p/openstack-helm-weekly-meeting

1 0

[ci][nova] Server {uuid} failed to delete
by Balazs Gibizer 30 Aug '21

30 Aug '21

Hi, The gate is in a bad shape due to frequent failure of server delete tests due to placement conflicts. The bug that is tracked in [1] became more frequent after a recent placement feature (consumer_types) got landed. The nova team is aware of the situation and possible fixes are being discussed [2]. Cheers, gibi [1] http://status.openstack.org/elastic-recheck/#1836754 [2] https://review.opendev.org/q/topic:bug/1836754

3 4

Hypervisors inaccessable with VM on provider network
by Matthew Ens 30 Aug '21

30 Aug '21

Hello, I am running openstack-victoria on centos8 without OVS and I have followed the installation directions according to the docs with the option to have self-service networks as our project does not need all our vm's accessible from the outside. We do still however occasionally use the provider network for users who need external access to the VM and in cases where using a floating ip is not sufficient. We noticed when there is a VM connected to the provider network we lose access to the hypervisor (cannot ssh or anything, ping still gives a response though) and the hypervisor itself loses internet access (cannot ping or curl some test website). We narrowed it down to two issues. One, we were using firewalld to keep track of our own firewall rules while openstack uses iptables to enforce its security group rules. These two did not work well together due to the second issue where openstack assigns incoming connections to a conntrack zone, it seemed like firewalld could not handle this correctly and would drop connections that should have been allowed under its rules. After transferring our firewall rules to iptables and masking firewalld, the hypervisor was accessible over ssh but could not access the internet due to our rule allowing ESTABLISHED and RELATED connections not being applied properly when a packet was assigned to a conntrack zone. The work around we found for this was to add a rule where packets destined for the hypervisor were not assigned to a conntrack zone (add a rule to the raw iptables table in the PREROUTING chain to just be accepted if the destination ip address was the address of the hypervisor). This worked until a new vm was created as openstack rebuilds the iptables when a change is made and puts it's own rules above those created by someone other than openstack. To fix this we changed the code in neutron (iptables_manager.py, the modify_rules function) to put this rule only above those made by openstack in the raw iptables table, PREROUTING chain. This fixed our issue, we are now able to access the hypervisor when VMs are running on a provider network and VMs and the hypervisor are accessible and able to access the internet. Security groups are also properly enforced on the VMs as are our firewall rules assigned elsewhere in iptables. I'm not sure if this is exactly a bug since in most cases openstack should be assigning its own firewall rules first in case there are DROP rules put in by someone else or I could also have missed some configuration step in which case I would love to know how I can improve. We thought others may be having a similar issue. If you'd like more details or have suggestions I'm happy to receive feedback. Cheers, Matt

1 0

[PTLs][release] Xena Cycle Highlights
by helena＠openstack.org 30 Aug '21

30 Aug '21

Hello Everyone! The deadline for cycle highlights is just a few days away, on September 3 [1]. Please be sure to get those in. I look forward to seeing what all you all have accomplished this release! How To Reminder: ------------------------- Simply add them to the deliverables/$RELEASE/$PROJECT.yaml in the openstack/releases repo like this: cycle-highlights: - Introduced new service to use unused host to mine bitcoin. The formatting options for this tag are the same as what you are probably used to with Reno release notes. Also, you can check on the formatting of the output by either running locally: tox -e docs And then checking the resulting doc/build/html/$RELEASE/highlights.html file or the output of the build-openstack-sphinx-docs job under html/$RELEASE/highlights.html. Feel free to add Kendall Nelson (diablo_rojo) as a reviewer on your patches. Thanks :) -Helena Spease (hspease) [1] [ https://releases.openstack.org/xena/schedule.html ]( https://releases.openstack.org/xena/schedule.html )

1 0