August 2021 - openstack-discuss - lists.openstack.org

[release] Y cycle PTL nominations from 17th August
by Herve Beraud 17 Aug '21

17 Aug '21

Hello, in case you missed in, the OpenStack Y cycle election season is soon upon us starting 17th August [1]. I do not intend to run for a third cycle as ptl. I think it is healthy for the project to have new energy and ideas brought by a new ptl. I'd like to encourage anyone who is considering this to read the info from [1] and in particular prepare a nomination [2]. Feel free to reach out to me if you have any questions or concerns. If you *are* thinking about it bear in mind there are many experienced people around that can and will help you. Thanks for your attention, [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-August/024093.h… [2] https://governance.openstack.org/election/#how-to-submit-a-candidacy -- Hervé Beraud Senior Software Engineer at Red Hat irc: hberaud https://github.com/4383/ https://twitter.com/4383hberaud

3 2

[OSSA-2021-004] Neutron: Linuxbridge ARP filter bypass on Netfilter platforms (CVE-2021-38598)
by Jeremy Stanley 17 Aug '21

17 Aug '21

=================================================================== OSSA-2021-004: Linuxbridge ARP filter bypass on Netfilter platforms =================================================================== :Date: August 17, 2021 :CVE: CVE-2021-38598 Affects ~~~~~~~ - Neutron: <16.4.1, >=17.0.0 <17.1.3, ==18.0.0 Description ~~~~~~~~~~~ Jake Yip with ARDC and Justin Mammarella with the University of Melbourne reported a vulnerability in Neutron's linuxbridge driver on newer Netfilter-based platforms (the successor to IPTables). By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the linuxbridge driver with ebtables-nft are affected. Patches ~~~~~~~ - https://review.opendev.org/804058 (Train) - https://review.opendev.org/804057 (Ussuri) - https://review.opendev.org/804056 (Victoria) - https://review.opendev.org/785917 (Wallaby) - https://review.opendev.org/785177 (Xena) Credits ~~~~~~~ - Jake Yip from ARDC (CVE-2021-38598) - Justin Mammarella from University of Melbourne (CVE-2021-38598) References ~~~~~~~~~~ - https://launchpad.net/bugs/1938670 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38598 Notes ~~~~~ - The stable/train branch is under extended maintenance and will receive no new point releases, but a patch for it is provided as a courtesy. -- Jeremy Stanley

1 0

[juju][wallaby] no obvious space for container
by toky0 17 Aug '21

17 Aug '21

Hi, I'm running into error [1] while trying to create lxd containers in the maas+juju deployment guide. This is the output for juju spaces: Name Space ID Subnets alpha 0 default 2 192.168.220.0/24 2001:db8:0:220::/64 public 1 2001:db8::/64 Any pointers are appreciated. Let me know if you need more info. Regards, Sami [1] 3 started 2001:db8:0:220::40 controller0 focal default Deployed 3/lxd/0 down pending focal no obvious space for container "3/lxd/0", host machine has spaces: "default", "public"

1 0

[tripleo] Y cycle PTL nominations from 17th August
by Marios Andreou 17 Aug '21

17 Aug '21

Hello tripleo o/ in case you missed in, the OpenStack Y cycle election season is soon upon us starting 17th August [1] As previously mentioned in tripleo irc meetings I do not intend to run for a third cycle as ptl. I think it is healthy for the project to have new energy and ideas brought by a new ptl and we are very fortunate to have many capable candidates in our community who have not previously occupied that role. I'd like to encourage anyone who is considering this to read the info from [1] and in particular prepare a nomination [2]. Feel free to reach out to me if you have any questions or concerns. If you *are* thinking about it bear in mind there are many experienced people around that can and will help so ... how badly can it go ! ;) regards, marios [1] http://lists.openstack.org/pipermail/openstack-discuss/2021-August/024093.h… [2] https://governance.openstack.org/election/#how-to-submit-a-candidacy

4 4

[neutron] bug deputy report August 9th to 15th
by Miguel Lavalle 17 Aug '21

17 Aug '21

Hi, Here's this week's bugs deputy report: High ==== https://bugs.launchpad.net/neutron/+bug/1939924 [ovn] NeutronNetworks.create_and_delete_subnets failing in concurrent scenario. Needs owner Medium ====== https://bugs.launchpad.net/neutron/+bug/1939403 [ovn] Tag on localnet port is not changed when proivder segment is updated. Assigned to Jakub Libosvar https://bugs.launchpad.net/neutron/+bug/1939429 [periodic] "neutron-ovn-tempest-ovs-master-fedora" failing with Fedora 34. Assigned to Rodolfo Alonso https://bugs.launchpad.net/neutron/+bug/1939432 Concurrent DHCP agent updates can result in a DB lock. Assigned to Rodolfo Alonso. Proposed fix: https://review.opendev.org/c/openstack/neutron/+/804218 https://bugs.launchpad.net/neutron/+bug/1939558 Security group log entry remains in the database after its security group is deleted. Assigned to Slawek Kaplonski. Proposed fix: https://review.opendev.org/c/openstack/neutron/+/804237 https://bugs.launchpad.net/neutron/+bug/1939704 db-sync script may fail when migrating from ovs to ovn. Assigned to Jakub Libosvar. Proposed fix: https://review.opendev.org/c/openstack/neutron/+/804405 https://bugs.launchpad.net/neutron/+bug/1940009 Some options are missing from neutron.conf generated by "tox -e genconfig". Owner assigned Incomplete ======== https://bugs.launchpad.net/neutron/+bug/1939723 neutron-ovn-db-sync generates insufficient flow https://bugs.launchpad.net/neutron/+bug/1939726 neutron-ovn-db-sync error during generate OVN DB RFEs ==== https://bugs.launchpad.net/neutron/+bug/1939602 [RFE] Add a memory profiler. Proposed implementation: https://review.opendev.org/c/openstack/neutron/+/803034 (Rodolfo Alonso) Invalid ===== https://bugs.launchpad.net/neutron/+bug/1939374 [OVN] Support baremetal type vnic https://bugs.launchpad.net/neutron/+bug/1939514 test_dvr_fip_and_router_namespace_rules_with_address_scopes_match iptables failure

1 0

OpenInfra Live - August 19 at 9am CT
by Ashlee Ferguson 16 Aug '21

16 Aug '21

Hi everyone, This week’s OpenInfra Live episode is brought to you by the OpenStack community. For the uninitiated, OpenStack's role in programmable infrastructure can be a little hard to understand unless you know its capabilities and how it works. Furthermore, to some people, OpenStack looks very similar to virtualization or simply like existing public cloud offerings. To fully understand this cloud platform, we will start at the origins of cloud technology and end at how today's OpenStack works. Episode: OpenStack Basics Date and time: August 19 at 9am CT (1400 UTC) You can watch us live on: YouTube: https://www.youtube.com/watch?v=hGRkdYu6I5k <https://www.youtube.com/watch?v=hGRkdYu6I5k> LinkedIn: https://www.linkedin.com/feed/update/urn:li:ugcPost:6831694874451042304/ <https://www.linkedin.com/feed/update/urn:li:ugcPost:6831694874451042304/> Facebook: https://www.facebook.com/104139126308032/posts/4235953959793174/ <https://www.facebook.com/104139126308032/posts/4235953959793174/> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Ben Silverman, CBTS Ildiko Vancsa, Open Infrastructure Foundation Have an idea for a future episode? Share it now at ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>. Thanks, Ashlee

1 0

[manila] We're having an OSC Hack-a-thon - Aug 18-20th 2021
by Goutham Pacha Ravi 16 Aug '21

16 Aug '21

Hi Zorillas and other interested stackers, tl;dr: - We're swarming to add missing OSC commands to python-manilaclient between 18th-20th Aug 2021, join us. - Kick-off Aug 18th at 1400 UTC, Mid-point check Aug 19th, 1500 UTC, Close-out Aug 20th, 1500 UTC on https://meetpad.opendev.org/manila-xena-hackathon Now for the longer version: As discussed at our IRC meeting today [1], I'm excited to share the nitty gritties of the upcoming OSC hack-a-thon. We'd be delighted to welcome existing and new contributors to come join us in the quest to achieve CLI parity in the OpenStackClient plugin within python-manilaclient. The work is being tracked here: https://tree.taiga.io/project/gouthampacha-openstack-manila-osc-integration… The commands we're targeting are also featured in a specification: https://specs.openstack.org/openstack/manila-specs/specs/release_independen… The fine print for the hack-a-thon: - Maari Tamm has been the force behind this effort so far, and she's put up a very helpful "Getting Started" wiki [2] that we intend to expand through the hack-a-thon and finally add to the project's Contributor Docs. There are also several examples of recent additions [3][4][5] that could serve as inspiration. - You're free to create, claim and edit Taiga cards for the implementation you're chasing, we highly recommend picking only one card, and not claiming something someone else already has. Please reach out to gouthamr/maaritamm if you have to be added to the taiga board. - Also, Add yourself as a "watcher" to two other Taiga cards that someone else is implementing, this will mean that you will be a code reviewer on these implementations! - You can work in teams - min size: 1, max size: 3 - You can submit code between Aug 18th 1200 UTC and Aug 21st 1200 UTC to count towards this hack-a-thon - A day before the hack-a-thon, a few of us will gather to prep taiga.io cards, communicate with owners if there are conflicts, pre-reqs, etc. - During the hack-a-thon, we'll use #openstack-manila on OFTC to chat, and hop onto a meetpad room: https://meetpad.opendev.org/manila-xena-hackathon when required. - We'll have a half-hour kick-off session on Aug 18th at 1400 UTC - We'll use the manila community meeting hour as a mid-point status check (Aug 19th, 1500 UTC) - We'll have a half-hour close out meeting to discuss reviews, AIs and futures (grab your beers) (Aug 20th, 1500 UTC) I'm quite excited to participate in this, and I hope you are too. Please feel free to reach out here or on OFTC's #openstack-manila if you have any questions! Thanks, Goutham [1] https://meetings.opendev.org/meetings/manila/2021/manila.2021-08-12-15.00.l… [2] https://docs.google.com/document/d/1Kc02fO_ei-6NxPm_b6mnFbf-6MVdjMk71mFqX1a… [3] https://review.opendev.org/c/openstack/python-manilaclient/+/772393 [4] https://review.opendev.org/c/openstack/python-manilaclient/+/762754 [5] https://review.opendev.org/c/openstack/python-manilaclient/+/701229

2 1

[victoria][ops][horizon][neutron] Network not available to use by Members in Horizon
by DHilsbos＠performair.com 16 Aug '21

16 Aug '21

All; We just discovered, this morning, that Members of one of our projects can't see the project's network, in order to use it in Instance creation. If an Administrator creates a Port, the Member user can then use it to create an Instance. Most of our activity to this point has been by Administrators, this is the first time we've opened a project up to users with the Member level. Is this expected behavior? Thank you, Dominic L. Hilsbos, MBA Vice President - Information Technology Perform Air International Inc. DHilsbos(a)PerformAir.com www.PerformAir.com

2 2

[ops][security-sig] KVM AMD vulnerabilities (CVE-2021-3653, CVE-2021-3656)
by Jeremy Stanley 16 Aug '21

16 Aug '21

I usually don't do this, but as it is likely to be a widespread concern across many OpenStack deployments I thought it would be a good idea to bring the situation to everyone's attention and help spread the word. Today, two new vulnerabilities were announced in the Linux KVM implementation for AMD processors (CVE-2021-3653 and CVE-2021-3656): https://www.openwall.com/lists/oss-security/2021/08/16/1 The impact described there indicates that these could be leveraged by guest virtual machines to gain access to their underlying hypervisor host servers. If you run a KVM-based deployment on AMD processors, please be on the lookout for updates from your Linux distribution and apply them at the earliest opportunity. Also consider temporarily enacting the mitigations listed in the advisory (e.g. disabling nested virtualization in the kvm_amd module). -- Jeremy Stanley

1 0

答复: [venus] Project Progress
by Brin Zhang(张百林) 16 Aug '21

16 Aug '21

Thanks for working for this job. As we discussed support for log retrieval of Cyborg in Hackthon in China at <http://www.baidu.com/link?url=Rn4my7xbuu7WVmRPPPyFPS0xLUb79O18GxMO5ANBxlO0o wZZMhOInqarCLBY3_IM4kOytWff8QIfUZ2RC9Q_5agl4w2-w1kZ2hbjdXYIy9C> April 2021, which improves our efficiency in locating and solving problems. And there are many companies have expressed interest in the Venus project, and we have already begun to cooperate. Thanks. brinzhang Inspur Electronic Information Industry Co.,Ltd. 发件人: Liye Pang(逄立业) 发送时间: 2021年8月14日 15:38 收件人: openstack-discuss(a)lists.openstack.org 抄送: Brin Zhang(张百林) <zhangbailin(a)inspur.com> 主题: [venus] Project Progress Hi Team: Thanks to everyone for months of hard work, we have made great progress of venus, mainly as follows: 1. Add the retrieval of vitrage, cyborg and other modules to venus. 2.Developed the deployment based on kolla-ansible of venus,the location is: https://review.opendev.org/c/openstack/kolla-ansible/+/793897 https://review.opendev.org/c/openstack/kolla/+/793795 3.The configuration, Search,analysis of Venus are integrated into horizon in the form of plugin as the attached picture. Hope everyone will make persistent efforts to make venus easier and more practical. Regards, pangliye

4 5