February 2023 - openstack-discuss

[all][tc] Technical Committee next weekly meeting on 2023 Feb 8 at 1600 UTC
by Ghanshyam Mann 07 Feb '23

07 Feb '23

Hello Everyone, The technical Committee's next weekly meeting is scheduled for 2023 Feb 8, at 1600 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Tuesday, Feb 7 at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

Hi, I am watcher ptl chenker. Could you help analyze watcher py38 error？thanks!
by 陈克 07 Feb '23

07 Feb '23

On the surface, the py38 unit test error. But after further analysis, I found that the use cases of failure are all because stevedore cannot be loaded. Here's what I do: 1、Analyzed the version of stevedore 4.1.1 looks like there is no problem. 2、Searched the merged code in watcher history, and found no suspicious points The gerrit link: 871531 Looking forward to your reply. Thanks!

1 1

[keystone] Weekly Meeting Cancelled
by Dave Wilde 07 Feb '23

07 Feb '23

Due to unforeseen circumstances I have to cancel the Keystone meeting this week. Sorry for the late notice, please reach out if you need anything. /Dave

1 0

[kolla][kolla-ansible][skyline] skyline kolla-ansible patches need review
by 朱博祥 07 Feb '23

07 Feb '23

Hi, Now the kolla patch[0] of skyline has been merged. And still two kolla-ansible patches[1][2] of skyline need review. All patches have been ready for review. And the CI has been passed. If you have some questions about them, welcome to review and write your comments. :) Thanks, Boxiang [0] https://review.opendev.org/c/openstack/kolla/+/826948 <https://review.opendev.org/c/openstack/kolla/+/826948> [1] https://review.opendev.org/c/openstack/kolla-ansible/+/828464 <https://review.opendev.org/c/openstack/kolla-ansible/+/828464> [2] https://review.opendev.org/c/openstack/kolla-ansible/+/861687 <https://review.opendev.org/c/openstack/kolla-ansible/+/861687>

1 0

[TripleO] Integrating external Prometheus with openstack TripleO wallaby
by Kushagra Gupta 07 Feb '23

07 Feb '23

Hi team, We have a tripleO environment. Our tripleO environment consists of 2 compute nodes, 3 controller nodes, and 1 undercloud node. TripleO Release: Wallaby We have also deployed an external Prometheus server along with a node exporter on a separate node. On this node, we have also installed Grafana. Prometheus server version: 2.37.5 Node exporter version: 1.5.0 Grafana version: 8.5.20-1 Goal: We need to monitor the instances launched on the compute nodes using Prometheus and visualize the metrics using Grafana. Could anyone help us integrate an external Prometheus server with a tripleO environment? Thanks and Regards Kushagra Gupta DISCLAIMER: This electronic message and all of its contents, contains information which is privileged, confidential or otherwise protected from disclosure. The information contained in this electronic mail transmission is intended for use only by the individual or entity to which it is addressed. If you are not the intended recipient or may have received this electronic mail transmission in error, please notify the sender immediately and delete / destroy all copies of this electronic mail transmission without disclosing, copying, distributing, forwarding, printing or retaining any part of it. Hughes Systique accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus.

1 0

[qa][gate][stable] stable/wallaby gate is broken
by Ghanshyam Mann 07 Feb '23

07 Feb '23

Hello Everyone, You might know stable/wallaby which is in the EM phase is broken because of the Tempest master incompatibility. As this is in EM phase, Tempest master does support it and the fix is to use the old compatible Tempest. I have pushed the fix on devstack to pin Tempest 29.0.0 to test stable/wallaby, do not recheck until that is merged: - https://review.opendev.org/c/openstack/devstack/+/871782 This depends on a few other fixes which are in the gate. Like the Tempest pin, we need to pin tempest plugins also on stable/wallaby. I have pushed a few projects fix for that, please review those if the devstack patch alone does not fix the gate - https://review.opendev.org/q/topic:wallaby-pin-tempest+status:open - https://review.opendev.org/q/topic:bug%252F2003993 -gmann

2 4

[OSSA-2023-002] Cinder, Glance, Nova: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)
by Jeremy Stanley 06 Feb '23

06 Feb '23

======================================================================== OSSA-2023-002: Arbitrary file access through custom VMDK flat descriptor ======================================================================== :Date: January 24, 2023 :CVE: CVE-2022-47951 Affects ~~~~~~~ - Cinder, glance, nova: Cinder <19.1.2, >=20.0.0 <20.0.2, ==21.0.0; Glance <23.0.1, >=24.0.0 <24.1.1, ==25.0.0; Nova <24.1.2, >=25.0.0 <25.0.2, ==26.0.0 Description ~~~~~~~~~~~ Guillaume Espanel, Pierre Libeau, Arnaud Morin and Damien Rannou (OVH) reported a vulnerability in VMDK image processing for Cinder, Glance and Nova. By supplying a specially created VMDK flat image which references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server resulting in unauthorized access to potentially sensitive data. All Cinder deployments are affected; only Glance deployments with image conversion enabled are affected; all Nova deployments are affected. Patches ~~~~~~~ - https://review.opendev.org/871631 (Train(cinder)) - https://review.opendev.org/871630 (Train(glance)) - https://review.opendev.org/871629 (Ussuri(cinder)) - https://review.opendev.org/871626 (Ussuri(glance)) - https://review.opendev.org/871628 (Victoria(cinder)) - https://review.opendev.org/871623 (Victoria(glance)) - https://review.opendev.org/871627 (Wallaby(cinder)) - https://review.opendev.org/871621 (Wallaby(glance)) - https://review.opendev.org/871625 (Xena(cinder)) - https://review.opendev.org/871619 (Xena(glance)) - https://review.opendev.org/871622 (Xena(nova)) - https://review.opendev.org/871620 (Yoga(cinder)) - https://review.opendev.org/871617 (Yoga(glance)) - https://review.opendev.org/871624 (Yoga(nova)) - https://review.opendev.org/871618 (Zed(cinder)) - https://review.opendev.org/871614 (Zed(glance)) - https://review.opendev.org/871616 (Zed(nova)) - https://review.opendev.org/871615 (2023.1/antelope(cinder)) - https://review.opendev.org/871613 (2023.1/antelope(glance)) - https://review.opendev.org/871612 (2023.1/antelope(nova)) Credits ~~~~~~~ - Guillaume Espanel from OVH (CVE-2022-47951) - Pierre Libeau from OVH (CVE-2022-47951) - Arnaud Morin from OVH (CVE-2022-47951) - Damien Rannou from OVH (CVE-2022-47951) References ~~~~~~~~~~ - https://launchpad.net/bugs/1996188 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47951 Notes ~~~~~ - The stable/wallaby, stable/victoria, stable/ussuri, and stable/train branches are under extended maintenance and will receive no new point releases, but patches for them are provided as a courtesy where possible. -- Jeremy Stanley OpenStack Vulnerability Management Team

3 3

[kolla][HAProxy] Insert custom vip in HAProxy
by Satish Patel 06 Feb '23

06 Feb '23

Folks, We have multi-node openstack running and recently i have deployed ceph storage which is in an internal network and i would like to access ceph dashboard on public. I was thinking if there is a way to insert custom vip configuration in the Kolla HAProxy role then I can expose the 8443 port of the ceph-dashboard to the public network. Is it possible in kolla to add custom config in haproxy for extra vip?

2 2

[election][ptl][openstack-helm] PTL Non-candidacy
by Gage Hugo 06 Feb '23

06 Feb '23

Hey folks, With the next election approaching, I want to announce that I will not be running for PTL this upcoming cycle. I've served as PTL for the last 3 years (6 cycles!?) now and I believe it's time for a change that can only be introduced by new leadership. I believe the OpenStack-Helm project is currently in good standing, but it will be healthy for the project to have someone with a fresh perspective step in. The current project team has been excellent and I believe whoever steps up will have plenty of support from the OpenStack-Helm community. I still plan on being around when I can so I can provide help whenever it's needed. Thanks everyone, it's been great! Gage

3 2

[qa][dev] Support for `sudo pip install` going away soon (PEP 668)
by Jeremy Stanley 06 Feb '23

06 Feb '23

Debian 12 (bookworm) and non-LTS Ubuntu 23.04 (lunar) are going to disallow `sudo pip install` so anything you install with pip for use by their packaged Python interpreter will need to go into venvs. Here's the upcoming readme about it: https://salsa.debian.org/cpython-team/python3/-/blob/master/debian/README.v… This has obvious implications for DevStack and Grenade, which currently install OpenStack services into the system environment for the distribution-packaged interpreter. Both bookworm and lunar will be released in a few months and people are going to end up using them for development systems, but at a minimum we're going to be forced to address this before we make Debian 12 or Ubuntu 24.04 LTS a targeted test platform for a release. There was an attempt to implement a solution 5 years ago when the writing was clearly on the wall that this would eventually happen. It may need some updates, but probably could serve as a good starting point: https://review.opendev.org/558930 -- Jeremy Stanley

1 0