September 2022 - openstack-discuss

[dev][security-sig] Revisiting tarfile, or "What's old is new again"
by Jeremy Stanley 22 Sep '22

22 Sep '22

The tarfile module from Python's standard library is in the news this week, with people publicly exploiting the very long-standing CVE-2007-4559[0] (yes, you read that correctly, *2007*). Some old-timers in the community might remember this from such popular hits as OSSA-2011-001: Path traversal issues registering malicious images using EC2 API[1], our very first OpenStack Security Advisory! This revived interest in unsafe use of tarfile methods will undoubtedly have lots of people scanning OpenStack's Git repos looking for potentially exploitable calls. Indeed, some of our own community members are already auditing the collective codebase to make sure new vulnerabilities haven't sneaked in over the 11 years since this first came up for us, but more help is always welcome. I encourage anyone using tarfile in their projects to double-check you're doing so safely[2]. If you rely bandit to check your source code, be advised that the most recent 1.7.4 release doesn't catch this but you can install its main branch[3] instead which does include a check for it, at least until they tag a new release (which I have a feeling they'll do quite soon given the recent furor around this topic). On a related note, I want to take this opportunity to remind everyone that OpenStack has a Security Special Interest Group (SIG), which meets monthly[4] on IRC, and members will also be in attendance at the upcoming virtual PTG[5] in case anyone is interested in discussing this or similar subject matter. Our PTG slot is currently booked for 15:00 UTC Wednesday (2022-10-19), though we can adjust or book an additional hour at another time if this conflicts with any tracks people also need to join, just let me know. [0] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4559 [1] https://security.openstack.org/ossa/OSSA-2011-001.html [2] https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall [3] https://github.com/pycqa/bandit [4] https://meetings.opendev.org/#OpenStack_Security_SIG_meeting [5] https://ptg.opendev.org/ptg.html -- Jeremy Stanley

2 1

[ironic][ptg] Last call for topics
by Jay Faulkner 22 Sep '22

22 Sep '22

This morning, a group of Ironic cores met and mapped out a rough schedule for our PTG sessions. Please review the etherpad here: https://etherpad.opendev.org/p/ironic-antelope-ptg for more details on the outcome of that. We did want to give one last chance for anyone who has not yet had a chance to add their topic to do so before the plans are finalized. Please add any additional topics to the etherpad, and preferably, also respond to this email or let us know in #openstack-ironic on IRC. Thanks, Jay Faulkner G-Research Open Source Software lab OpenStack Ironic PTL OpenStack Technical Committee member

1 0

How do I disable replication in swift
by Paladox 22 Sep '22

22 Sep '22

Hello, I would like Swift to only have 1 file not any copies of it, how do I disable replication as you must set the value to 1 when you create the rings? (We don’t have the disk space to have replication / copies of the files)

2 2

[neutron] Drivers meeting - Friday 22.09.2022 - cancelled
by Lajos Katona 22 Sep '22

22 Sep '22

Hi Neutron Drivers! Due to the lack of agenda, let's cancel tomorrow's drivers meeting. See You on the meeting next week. Lajos Katona (lajoskatona)

1 0

Cinder-volume active active setup
by Eugen Block 22 Sep '22

22 Sep '22

Hi, I didn't mean to hijack the other thread so I'll start a new one. There are some pages I found incl. Gorkas article [1], but I don't really understand yet how to configure it. We don't use any of the automated deployments (we created our own) like TripleO etc., is there any guide showing how to setup cinder-volume active/active? I see in my lab environment that python3-tooz is already installed on the control node, but how do I use it? Besides the "cluster" config option in the cinder.conf (is that defined when setting up the DLM?) what else is required? I also found this thread [2] pointing to the source code, but that doesn't really help me at this point. Any pointers to a how-to or deployment guide would be highly appreciated! Thanks, Eugen [1] https://gorka.eguileor.com/a-cinder-road-to-activeactive-ha/ [2] https://www.mail-archive.com/openstack@lists.openstack.org/msg18385.html

2 5

Floating IP attached to octavia not working | tripleo wallaby | centos | OVN DVR
by Swogat Pradhan 22 Sep '22

22 Sep '22

Hi, I've deployed Octavia + OVN + DVR and floating IPs assigned to Octavia VIPs are not reachable. Other floating IPs tied to nova instances are working fine. The octavia vip is reachable and working fine from inside on the private network, however the Floating IP is not reachable at all. I found a similar issue in bugzilla but the bug is closed now and i do not have any solution. https://bugzilla.redhat.com/show_bug.cgi?id=1608951 Please help me get a solution for this issue. With regards, Swogat pradhan

3 3

[ansible-os-modules] Antelope PTG in October | Ansible OpenStack Collection
by Jakob Meng 22 Sep '22

22 Sep '22

Hi everyone, we have scheduled our Antelope's vPTG session for the Ansible OpenStack Collection [1] at the same time and place as in April: at 13:00 - 15:00 UTC on Thursday October 20, 2022 in Essex room. Topics will be our migration progress to openstacksdk's first major release, new features, notable changes and open todos. Do not hesitate to add any questions and topics you want to address in our PTG session to etherpad [2]. Looking forward to meet you ☺️ [1] https://opendev.org/openstack/ansible-collections-openstack [2] https://etherpad.opendev.org/p/oct2022-ptg-os-ansible-modules Thanks, Ananya, Arx, Rafael, Sagi and Jakob

1 0

[openstack][quuens][cinder] consistency groups bug ?
by Ignazio Cassano 22 Sep '22

22 Sep '22

Hi everyone, in my openstack installation, for performance reasons, I use a cinder type to address different storage virtual machines on the same device. Balancing takes place via the scheduler. Below is an example of my configuration in cinder.conf: https://paste.openstack.org/show/b0hCTsdniLhinoQiVT7A/ As you can see nfsgold1 to nfsgold8 are all part of the volume type nfsgold. Unfortunately if I create a consistency group with volume type nfsgold, it can only contain volumes on the same backend, even though they are of the same type. For example, if in my consistency group there is a volume on nfsgold1 and I add a volume present on nfsgold8 I get the following: https://paste.openstack.org/show/b4XnUeGDF5wYlCBLTcuc/ Any help, please ? Ignazio

2 3

cloud Stack Testing
by KK CHN 22 Sep '22

22 Sep '22

List, We have deployed Openstack wallaby using kolla-ansible openstack installation . The setup is up and running with default configurations all-in-one node ... Reference: https://docs.openstack.org/project-deploy-guide/kolla-ansible/wallaby/quick… 1. We need to test this cloud stack for Compute, Network, and storage able to scale across multiple local and remote zones. What other components/configurations needed to be configured /built for this purpose? What are the testing parameters to check the above setup scale across multiple local and remote zones? or what methods/procedures need to be performed for this testing ? 2. for Successful deployment of enterprise applications having enough scaling and availability requirements in each IaaS, SaaS & PaaS category may further help in evaluating this setup across these categories. Is there any such kind of benchmarking tools or sample application/s to test the capacity to kindly share the name/details of such application/s to deploy as PoC? Any help/hints much appreciated. Thanks in advance, Krish

2 1

[all][tc] Technical Committee next weekly meeting on 2022 Sept 22 at 1500 UTC
by Ghanshyam Mann 22 Sep '22

22 Sep '22

Hello Everyone, Below is the agenda for tomorrow's TC meeting schedule at 1500 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting * Roll call * Follow up on past action items * Gate health check ** Bare 'recheck' state *** https://etherpad.opendev.org/p/recheck-weekly-summary * Zed cycle tracker checks ** https://etherpad.opendev.org/p/tc-zed-tracker * 2023.1 cycle PTG Planning ** TC + Leaders interaction sessions *** https://etherpad.opendev.org/p/tc-leaders-interaction-2023-1 ** TC PTG etherpad *** https://etherpad.opendev.org/p/tc-2023-1-ptg ** Schedule 'operator hours' *** https://lists.openstack.org/pipermail/openstack-discuss/2022-September/0303… * 2023.1 cycle Technical Election & Leaderless projects ** https://governance.openstack.org/election/ ** https://etherpad.opendev.org/p/2023.1-leaderless ** https://lists.openstack.org/pipermail/openstack-discuss/2022-September/0304… * Meeting time check ** We have new TC members. Let's check if the current meeting time is ok for everyone. * Open Reviews ** https://review.opendev.org/q/projects:openstack/governance+is:open -gmann

1 0