- openstack-discuss - lists.openstack.org

Limit Access to a Group for a Project- Openstack 13 & 17
by samir oukessou 06 Oct '22

06 Oct '22

Dears, I have a question regarding Openstack, is it possible to limit access for a user to get read only on a specific project that he can only see the instances in that project and eliminate the actions edit,start,stop or delete instance ? i have tried some tests grant *member* role only to the group but all users in the group were able to do everything with the instances thank you in advance, Samir

2 1

[nova][cinder][glance][manila][masakari][tacker][oslo] Configurable soft-delete
by Stephen Finucane 06 Oct '22

06 Oct '22

👋 I'm planning on bringing this up in the nova rooms at the PTG in a few weeks, but I'm also raising it here since this potentially affects other service projects and I can't attend all of those room :) Many projects use the concept of "soft delete" in their database models. A soft deletable model typically has two additional columns, 'deleted' and 'deleted_at'. When deleting such a model, instead of actually deleting the database row (i.e. 'DELETE FROM table WHERE condition'), we set 'deleted' to 'True' and populate the 'deleted_at' column. This is helpful for auditing purposes (e.g. you can inspect all resources ever created, even after they've been "deleted") but bad for database performance (your tables can grow without bound). To work around the performance issues, most projects implement some kind of archive or purge command that will allow operators to periodically clean up these deleted resources. However, at least in nova, we've long since come to the conclusion that soft deleting isn't as useful as initially suspected and the need to run these commands is additional work for no benefit. We've moved toward not using it for all new models. With this said, it's going to be difficult to get away from soft-delete quickly. Not only are there database migrations involved, but operators will need to rework their tooling to adapt to a new, no-soft-delete world. As such, I'd like to propose a half-way measure of making soft-delete configurable. To do this, I'd like to add a new flag in oslo.db, '[database] enable_soft_delete'. When set to 'False' anyone using the 'SoftDeleteMixin' from oslo.db would see these models hard deleted rather than soft deleted when calling 'soft_delete'. This would avoid the need for operators to run the various project-specific purge tooling. The RFC patch for this is available for review [1]. I can also do this on a project-specific basis and have proposed a similar patch for nova [2], however, doing it in oslo.db means every project that uses 'SoftDeleteMixin' in their models will get this for free. Projects that don't (glance, cinder) can switch to using this mixin and also get it for free. As noted above, I intend to discuss this in the nova room at the PTG, but I'd be interested in people's thoughts ahead of time. Do you think this is a good idea? Should we proceed with it? Perhaps there are there better ways to do this? Let me know! Cheers, Stephen [1] https://review.opendev.org/c/openstack/oslo.db/+/860407 [2] https://review.opendev.org/c/openstack/nova/+/860401

7 9

[zed] OpenInfra Live - October 6 at 1400 UTC
by Allison Price 06 Oct '22

06 Oct '22

Hi everyone, This week’s OpenInfra Live episode is brought to you by the OpenStack community who just delivered its 26th on-time release today! Join us to learn about the latest from community leaders about what was delivered in Zed and what we can expect in Antelope, OpenStack's 27th release targeting early 2023. Episode: OpenStack Zed: The End of the Alphabet, The Beginning of a New Era Date and time: October 6 at 1400 UTC You can watch us live on: YouTube: https://www.youtube.com/watch?v=MSbB3L9_MeY <https://www.youtube.com/watch?v=MSbB3L9_MeY> LinkedIn: https://www.linkedin.com/video/event/urn:li:ugcPost:6982723169144950786/ <https://www.linkedin.com/video/event/urn:li:ugcPost:6982723169144950786/> Facebook: https://www.facebook.com/events/390328576642133 <https://www.facebook.com/events/390328576642133> WeChat: recording will be posted on OpenStack WeChat after the live stream Speakers: Kendall Nelson, OpenInfra Foundation Carlos Silva, Manila Jay Faulkner, Ironic Sylvain Bauza, Nova Lajos Katona, Neutron Wu Wenxiang, Skyline Martin Kopec, Interop Working Group Liye Pang, Venus Have an idea for a future episode? Share it now at ideas.openinfra.live <https://openinfrafoundation.formstack.com/forms/openinfralive>. Thanks, Allison

1 1

[SECURITY] Openstack Security Assessments
by jackdaw blues 06 Oct '22

06 Oct '22

Hi all, I am currently leading a team of offensive security engineers and we are trying to create a checklist for each component of Openstack in the context of Security Assessment. At the end of the day what we want to end up with is common exploitable configuration weaknesses for each component. It will be against configuration or installation mistakes that result in unintended privileges or information disclosure, etc. Patch management isn't in scope. Not the exact output, but these links can give a good idea of the contents of the security assessment we are planning (these are for AWS): http://flaws.cloud/ http://flaws2.cloud/ Has anyone had any experience regarding the topic above? If so please feel free to connect. Regardless of the experience, if you want to contribute and at mark zero just like we are, you are still welcome and we can help each other create this assessment checklist. Cheers, Asil

2 1

[nova][placement] add your PTG topics before Oct-06 please !
by Sylvain Bauza 06 Oct '22

06 Oct '22

Hi folks, as I said in the nova meeting, I'd like to create an agenda for our PTG topics. Given the PTG is in 3 weeks, please provide your topics you'd like to discuss at the PTG in [1] so I could look at them and try to provide an agenda for them. Eventually, I'd love to have most of the topics by Oct 6th as I said in the title so the agenda would be on the Friday Oct 7th. Also, if you can't be in the Nova PTG sessions for all the PTG schedule (between Tues and Fri for Nova), just add in the topic when you would like to be around. Thanks, -Sylvain [1] https://etherpad.opendev.org/p/nova-antelope-ptg

1 1

Re: Query about networking-onos for newer OpenStack releases
by Rodolfo Alonso Hernandez 06 Oct '22

06 Oct '22

Hello Aditya: If you don't have any specific requirement, I would choose one of the Neutron in-tree ML2 plugins: ML2/OVS or ML2/OVN (and ML2/SR-IOV, that can run with the other two). About which one you can choose, I won't point you to any of them. I would prefer you to review the different architectures: * OVS: https://docs.openstack.org/liberty/networking-guide/scenario-classic-ovs.ht… (this is an old but still valid document to see the different ML2/OVS deployments) * OVN: https://www.openstack.org/videos/summits/austin-2016/practical-ovn-architec… Regards. On Wed, Oct 5, 2022 at 10:37 PM Aditya Sathish <saditya(a)vt.edu> wrote: > Hi Lajos and Rodolfo, > > First of all thank you for your previous replies. After discussing it with > my team over here, we have decided to look at other alternatives beyond > ONOS for implementing an SDN controller with OpenStack. > > Lajos, as you mentioned about OVN, we can perform SDN control on the VM > instances using this. One extension we would like to do is to use OVN to > control an openflow hardware switch. The idea is to allow different users > over a network to access the VM instances. Any idea if I can get this done > through OVN? > > I also tried to check out OpenDayLight but even this has not been updated > in some time. > > Any replies would be greatly appreciated! > > Regards, > Aditya > > On Thu, Sep 22, 2022 at 12:22 PM Lajos Katona <katonalala(a)gmail.com> > wrote: > >> Seems gmail lost some chars from Rodolfo's address, resending. >> >> Lajos Katona <katonalala(a)gmail.com> ezt írta (időpont: 2022. szept. 22., >> Cs, 17:55): >> >>> Hi, >>> Thanks for considering this question. I do not add this topic now to the >>> agenda, of course it can be discussed any time :-) >>> In openstack OVN as an SDN controller is tested, and more and more >>> companies are using it, so for long term I would check it. >>> OVN is now in-tree in Neutron code base, meaning that you don't need any >>> extra code, you can just use Neutron. >>> OVN uses OVS as soft switch and the OVN code is written in C, and >>> originally started by the same team who develops OVS. >>> >>> If you need any advice, or would like to discuss any topics with the >>> team just ping us on #openstack-neutron channel. >>> >>> Best wishes >>> Lajos Katona (lajoskatona) >>> >>> >>> Aditya Sathish <saditya(a)vt.edu> ezt írta (időpont: 2022. szept. 22., >>> Cs, 17:00): >>> >>>> Hi Lajos, >>>> >>>> Thank you for the email. Unfortunately, I'm not sure if I can dedicate >>>> time to maintain this release-on-release. However, I forked the >>>> networking-onos repository and currently verified it with DevStack Zed >>>> along with tempest. (https://github.com/adityasathis/networking-onos) >>>> Considering the changes so far involved only replacing some code to account >>>> for changes in the ML2 callback interface, I think the support should not >>>> be too time consuming if we assume that the ML2 plugin interface remains >>>> the same. >>>> >>>> If we cannot find a way to support networking-onos for long-term >>>> support, do you know a better way to understand the industry implementation >>>> of using SDN controllers with OpenStack? >>>> >>>> Regards, >>>> Aditya. >>>> >>>> On Thu, Sep 22, 2022 at 10:46 AM Lajos Katona <katonalala(a)gmail.com> >>>> wrote: >>>> >>>>> Hi, >>>>> Do you think that you can maintain networking-onos, if you think yes, >>>>> we can discuss this topic on next drivers meeting (as Rodolfo wrote >>>>> previously). >>>>> Just ping me on IRC (#openstack-neutron lajoskatona) and I add this >>>>> topic for you to the agenda: >>>>> https://wiki.openstack.org/wiki/Meetings/NeutronDrivers >>>>> >>>>> Best Wishes >>>>> Lajos Katona (lajoskatona) >>>>> >>>>> Aditya Sathish <saditya(a)vt.edu> ezt írta (időpont: 2022. szept. 20., >>>>> K, 17:48): >>>>> >>>>>> Hello! >>>>>> >>>>>> I am trying to integrate an SDN controller with our lab's OpenStack >>>>>> network. Currently, we have already deployed a version of ONOS to serve our >>>>>> needs and I have been following the SONA project which uses the >>>>>> networking-onos ML2 plugin with OpenStack. However, it seems that the >>>>>> networking-onos project has been retired since the Train release. >>>>>> >>>>>> Is there any way I can get ONOS to work with OpenStack Yoga? If not, >>>>>> what is the go-to way to integrate an SDN controller with OpenFlow support >>>>>> with Neutron?? >>>>>> >>>>>> Any help will be much appreciated. >>>>>> >>>>>> Regards, >>>>>> Aditya. >>>>>> >>>>>

1 0

[all][tc] Technical Committee next weekly meeting on 2022 Oct 6 at 1500 UTC
by Ghanshyam Mann 06 Oct '22

06 Oct '22

Hello Everyone, The technical Committee's next weekly meeting is scheduled for 2022 Oct 6, at 1500 UTC. If you would like to add topics for discussion, please add them to the below wiki page by Wednesday, Oct 5 at 2100 UTC. https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Next_Meeting -gmann

1 1

[Keystone][Swift] Using policy.json to prohibit specific API operations by policy?
by Andrew Boring 06 Oct '22

06 Oct '22

Hi all, I'm looking to support a situation where one class of Keystone users in a given domain can create Swift containers (either within a single, dedicated project or within their own projects) but *cannot* change ACLs on those containers, while a second class of users *can* alter ACLs on their own containers. For example, User A is in the first class (defined by role) and can perform all CRUD operations, EXCEPT update pre-defined ACLmetadata on those containers. User B is in the second class and CAN update ACLs on their respecitive containers, like any other standard user. Something like this AWS policy condition ("Granting permissions to multiple accounts with added conditions") is directionally what I'm trying to achieve: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-polici… Keystone docs imply that I can create policy.json files for all services: "You can define actions for OpenStack service roles in the /etc/PROJECT/policy.yaml files. For example, define actions for Compute service roles in the /etc/nova/policy.yaml file." -https://docs.openstack.org/keystone/yoga/admin/cli-manage-projects-users-and-roles.html But I can't find any indication that Swift actually supports this. So, does Swift support the Oslo policy.json stuff, and if so, is it documented anywhere? Is it simply a "install oslo policy and add it to the pipeline in proxy-server.conf"? If not, is there another/preferred way to achieve the desired restrictions on Swift API operations by policy for a given Keystone domain? Thanks. -- Andrew Boring andrew(a)andrewboring.com

2 1

[tacker] Critical bug report and backport the fix
by Yuta Kazato 06 Oct '22

06 Oct '22

Yasufumi, Ueha, Tacker and Release management team Hi, thanks for your agreements and supports it this issue. We could backport fix patches to stable/zed. I'm glad to release Openstack Zed:) https://releases.openstack.org/zed/ See you next Antelope vPTG! Yuta > Hi Yuta and Yasufumi, > > +1 > > And we have a patch for another critical bug related with pm interface. > The bug report [1] and the fix patch [2] have been already posted. > This patch also requires a backport to stable/zed. > > [1]https://bugs.launchpad.net/tacker/+bug/1990828 > [2]https://review.opendev.org/c/openstack/tacker/+/859377 > > Best Regards, > Ueha > > -----Original Message----- > From: Yasufumi Ogawa <yasufum.o at gmail.com> > Sent: Tuesday, September 27, 2022 10:42 AM > To: openstack-discuss at lists.openstack.org > Subject: Re: [tacker] Critical bug report and backport the fix > > Hi Yuta, > > On 2022/09/26 16:57, Yuta Kazato wrote: > > Hi tacker team, > > > > As you know, new bug report #1990793 [1] related to K8s resource name > > and v2 API is submitted by Masaki. > > The bug will appear if K8s resource name contains `-`. > > > > I think this is a critical issue because users often set resource > > names that contain `-`. > Agree. > > > Fortunately, the fix patch [2] has already been submitted. > > > > I suggest that we should backport the fix patch to the stable/zed > > branch before Zed release. > > What do you think? > We should fix the issue in stable/zed, or this k8s support doesn't work for many usecases. > > Yasufumi > > > > [1] https://bugs.launchpad.net/tacker/+bug/1990793 > > [2] https://review.opendev.org/c/openstack/tacker/+/859206 > > > > Yuta > > -- Yuta Kazato (風戸雄太) NTT Network Innovation Center. tel: +81-422-59-6754 mail:yuta.kazato.nw@hco.ntt.co.jp

1 0

OpenStack Zed is officially released!
by Előd Illés 06 Oct '22

06 Oct '22

Hello OpenStack community, The official OpenStack Zed release announcement has been sent out: http://lists.openstack.org/pipermail/openstack-announce/2022-October/002061… Thanks to all who were a part of the Zed development cycle! This marks the official opening of the openstack/releases repository for 2023.1 Antelope releases, and freezes are now lifted. stable/zed is now a fully normal stable branch, and the normal stable policy applies from now on. Thanks, Előd Illés and the Release Management team

5 4