- openstack-discuss - lists.openstack.org

[TripleO] SELinux support
by Mikhail Fedosin 22 Dec '18

22 Dec '18

Hello! One of the most important tasks for this release cycle is to provide full SELinux support in the installed overcloud. Some work in this direction has already been done and in many respects, due to the recent changes, support is almost ready. However, I would like to ask a few questions about what else can be improved. In short, to provide SELinux support the main challenge for us is to ensure that docker can write to the directories protected by SELinux. To allow writing there we change the directory type to container_file_t or its alias svirt_sandbox_file_t. There are two ways to do this: 1. Explicitly - specify the type when creating a directory. # semanage fcontext -at container_file_t "/my_folder(/.*)?" # restorecon -R /my_folder # docker run -v /my_folder:/tmp/my_folder ... 2. Implicitly - use the suffix :z when mounting the partition when creating a container. # docker run -v /my_folder:/tmp/my_folder:z ... Both methods change selinux type of /my_folder to container_file_t and allow to write to the section inside the container. You can read more about this feature in the article https://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cau… To see how it works, I wrote a small playbook that creates two directories on the host system and modifies their selinux types in two ways: http://paste.openstack.org/show/737234/ Currently there is no consensus in TripleO which of the ways to use. For example, in many cases both methods are used, which adds unnecessary redundancy: https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… In some cases there is only :z https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… In some, only explicit setting of svirt_sandbox_file_t on the directory https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… Some services still do not have SELinux support: https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… Such inconsistency leads to hard to find bugs and makes it difficult to understand the code. An example of such a bug could be this: Here we set selinux type to svirt_sandbox_file_t for /var/log/swift https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… And rewrite it back later: https://github.com/openstack/tripleo-heat-templates/blob/89d13583f7c706d5c7… For this reason, I want to come to an agreement on how we will implement SELinux support. In my understanding, the best solution would be to use the suffix :z only. Its advantage is that docker (and podman) checks the directory's selinux type before launching the container and changes it accordingly. In other words, if the type was accidentally changed during the execution of the container, then when it is restarted ":z" will return the type back. In the case of explicit type setting, we get an error. Therefore, I propose to remove the explicit setting svirt_sandbox_file_t and add the suffix ":z" where it is still missing. What do you think? Best regards, Mikhail Fedosin

2 1

[goals][upgrade-checkers] Week R-16 Update
by Matt Riedemann 21 Dec '18

21 Dec '18

By my count, 34 of 43 projects have at least the initial framework change in place (up from 28 in November). Neutron has merged the change to enable loading upgrade checks via extension point: https://review.openstack.org/#/c/615196/ The designate check has been updated (thanks Ben) and is ready for review: https://review.openstack.org/#/c/604430/ - this one is not a placeholder Otherwise I would like to highlight some initial framework changes that I think are ready to go: * magnum: https://review.openstack.org/#/c/611505/ * cloudkitty: https://review.openstack.org/#/c/613076/ * aodh: https://review.openstack.org/#/c/614401/ * barbican: https://review.openstack.org/#/c/611574/ * ceilometer: https://review.openstack.org/#/c/614400/ -- Thanks, Matt

1 0

[manila] no community meeting 27 December
by Tom Barron 21 Dec '18

21 Dec '18

As agreed at our last meeting, we will skip the regular manila community meeting on 27 December and resume our weekly cadence on 3 January 2019 at 1500 UTC on freenode #openstack-meeting-alt. All are welcome, and as usual please feel free to add to the agenda [1]. -- Tom Barron (irc: tbarron) [1] https://wiki.openstack.org/w/index.php?title=Manila/Meetings&action=edit&se…

1 0

openstack-dev] [neutron] Cancelling next Neutron drivers meeting
by Miguel Lavalle 21 Dec '18

21 Dec '18

Hi Neutrinos, Due to the Holidays season in many parts of the world, we will cancel the Neutron drivers meeting on December 28th. We will resume normally on January 4th. Best regards Miguel

1 0

[dev][keystone] Keystone Team Update - Week of 17 December 2018
by Lance Bragstad 21 Dec '18

21 Dec '18

# Keystone Team Update - Week of 17 December 2018 ## News This week was really quiet due to the holiday. Note that there won't be keystone meetings or office hours for the next two weeks since they fall on Christmas Day and New Years. If you have questions, please don't hesitate to use asynchronous communication like the mailing lists, especially since folks are likely on vacation and not lingering in IRC. ### Granular Instance Locks There is a thread about solving the problem on granular instance locks [0], which is kind of policy related. We're currently airing out all possible solutions. [0] http://lists.openstack.org/pipermail/openstack-discuss/2018-December/001223… ## Open Specs Reminder that we're about a month away from specification freeze, so specification reviews are important. I'd like to specifically call attention to the renewable app creds specification [1] since that is one the few left on our radar for this release. Stein specs: https://bit.ly/2Pi6dGj Ongoing specs: https://bit.ly/2OyDLTh [0] https://review.openstack.org/#/c/604201/ ## Recently Merged Changes Search query: https://bit.ly/2pquOwT We merged 4 changes this week. ## Changes that need Attention Search query: https://bit.ly/2RLApdA There are 117 changes that are passing CI, not in merge conflict, have no negative reviews and aren't proposed by bots. It'll be good to start ramping up review focus since we'll start running up against deadlines shortly after the new year. Please have a look if you have time. ## Bugs This week we opened 5 new bugs and closed 1. Bugs opened (5) Bug #1808859 (keystone:High) opened by Lance Bragstad https://bugs.launchpad.net/keystone/+bug/1808859 Bug #1809116 (keystone:Undecided) opened by Kristi Nikolla https://bugs.launchpad.net/keystone/+bug/1809116 Bug #1809237 (keystone:Undecided) opened by varocho https://bugs.launchpad.net/keystone/+bug/1809237 Bug #1808550 (keystoneauth:Undecided) opened by Ievgeniia Zadorozhna https://bugs.launchpad.net/keystoneauth/+bug/1808550 Bug #1809101 (keystonemiddleware:Undecided) opened by leehom https://bugs.launchpad.net/keystonemiddleware/+bug/1809101 Bugs closed (1) Bug #1809237 (keystone:Undecided) https://bugs.launchpad.net/keystone/+bug/1809237 ## Milestone Outlook https://releases.openstack.org/stein/schedule.html ## Help with this newsletter Help contribute to this newsletter by editing the etherpad: https://etherpad.openstack.org/p/keystone-team-newsletter Dashboard generated using gerrit-dash-creator and https://gist.github.com/lbragstad/9b0477289177743d1ebfc276d1697b67

1 0

[senlin] No meetings next two weeks
by Duc Truong 21 Dec '18

21 Dec '18

Everyone, Due to the holidays there will be no meetings on December 28th and January 3rd. We will resume the regular meetings on Friday January 11th at 530 UTC. Duc

1 0

[keystone] No meetings December 25th or January 1st
by Lance Bragstad 21 Dec '18

21 Dec '18

Hey all, We talked about this in last week's meeting, but I'm sending a reminder to the list. We won't be having a team meeting or holding office hours next week or the week after since they fall on Christmas Day and New Year's. We'll resume meetings and office hours on January 8th. Happy holidays, Lance

1 0

[openstack-dev] [neutron] Cancelling next two team meetings
by Miguel Lavalle 21 Dec '18

21 Dec '18

Hi Neutrinos, Due to the Holidays season in many parts of the world, we will cancel the weekly Neutron meeting on December 24th and January 1st. We will resume normally on January 7th Best regards Miguel

1 0

[openstack-dev] [neutron] [neutron-interconnection] neutron-interconnection core reviewers
by Miguel Lavalle 21 Dec '18

21 Dec '18

Hi Neutrinos, During the Dublin PTG we discussed and approved a neutron-interconnection proposal. Over the past few months the spec was merged ( https://specs.openstack.org/openstack/neutron-specs/specs/rocky/neutron-int…) and the corresponding repo was also approved and created: https://review.openstack.org/#/c/599428/ and https://review.openstack.org/#/c/599429/. Earlier today the core team of reviewers was created. This team includes the current Neutron core plus Thomas Morin and Yannick Thomas. So let's start pushing and reviewing code Best regards Miguel

2 1

Re: [glance][dev] Regarding "Eliminate Redundant Downloads of Uncached Images" project
by Vedartham Bharath 21 Dec '18

21 Dec '18

Hey Jim, Thank you for the reply! I was looking at this untargeted specs page for the project. http://specs.openstack.org/openstack/glance-specs/specs/untargeted/glance/d… It is stated in this page that this project is currently unassigned. I will start working on this spec. I will begin by studying Glance and start making smaller contributions to it for now. I need all the help I can get! I am very passionate about OpenStack and it's services! I will keep in touch with you and the developers through this mailing list and the IRC channel. Thank you Bharath On Fri, Dec 21, 2018, 7:20 PM Jim Rollenhagen <jim(a)jimrollenhagen.com wrote: > On Fri, Dec 21, 2018 at 2:50 AM Vedartham Bharath < > vedarthambharath(a)gmail.com> wrote: > >> Hi all, >> >> I am very interested in working on one of the untargeted approved >> specifications in Glance. It is titled "Eliminate Redundant Downloads >> of Uncached Images". >> I have noticed that it is currently unassigned. >> >> My experience with OpenStack: >> I have setup Devstack. >> I have worked extensively on Swift as part of a research project. >> I have set up Swift All in One multiple times. >> I have also set up a multi-server installation of Swift. >> I have studied the codebase of Swift and added my own features for my >> project. >> >> I don't have a lot of experience with Glance. >> I have experience with dealing with large codebases and I am willing to >> dedicate myself to study Glance and work on this project. >> I would love to know if it is up for grabs! >> > > Hi Bharath, > > The untargeted specs page for glance says "The following specs have been > reviewed and approved but have not been targeted for a release because the > proposer is no longer available to work on the implementation". I do see > the blueprint for the spec[0] is assigned, but I know Jesse no longer works > on OpenStack. I'd say go ahead and assign the blueprint to yourself and > start hacking! :) > > [0] https://blueprints.launchpad.net/glance/+spec/duplicate-downloads > > // jim >

2 1