- openstack-discuss - lists.openstack.org

[qa][gate][stable] stable/wallaby gate is broken
by Ghanshyam Mann 07 Feb '23

07 Feb '23

Hello Everyone, You might know stable/wallaby which is in the EM phase is broken because of the Tempest master incompatibility. As this is in EM phase, Tempest master does support it and the fix is to use the old compatible Tempest. I have pushed the fix on devstack to pin Tempest 29.0.0 to test stable/wallaby, do not recheck until that is merged: - https://review.opendev.org/c/openstack/devstack/+/871782 This depends on a few other fixes which are in the gate. Like the Tempest pin, we need to pin tempest plugins also on stable/wallaby. I have pushed a few projects fix for that, please review those if the devstack patch alone does not fix the gate - https://review.opendev.org/q/topic:wallaby-pin-tempest+status:open - https://review.opendev.org/q/topic:bug%252F2003993 -gmann

2 4

[OSSA-2023-002] Cinder, Glance, Nova: Arbitrary file access through custom VMDK flat descriptor (CVE-2022-47951)
by Jeremy Stanley 06 Feb '23

06 Feb '23

======================================================================== OSSA-2023-002: Arbitrary file access through custom VMDK flat descriptor ======================================================================== :Date: January 24, 2023 :CVE: CVE-2022-47951 Affects ~~~~~~~ - Cinder, glance, nova: Cinder <19.1.2, >=20.0.0 <20.0.2, ==21.0.0; Glance <23.0.1, >=24.0.0 <24.1.1, ==25.0.0; Nova <24.1.2, >=25.0.0 <25.0.2, ==26.0.0 Description ~~~~~~~~~~~ Guillaume Espanel, Pierre Libeau, Arnaud Morin and Damien Rannou (OVH) reported a vulnerability in VMDK image processing for Cinder, Glance and Nova. By supplying a specially created VMDK flat image which references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server resulting in unauthorized access to potentially sensitive data. All Cinder deployments are affected; only Glance deployments with image conversion enabled are affected; all Nova deployments are affected. Patches ~~~~~~~ - https://review.opendev.org/871631 (Train(cinder)) - https://review.opendev.org/871630 (Train(glance)) - https://review.opendev.org/871629 (Ussuri(cinder)) - https://review.opendev.org/871626 (Ussuri(glance)) - https://review.opendev.org/871628 (Victoria(cinder)) - https://review.opendev.org/871623 (Victoria(glance)) - https://review.opendev.org/871627 (Wallaby(cinder)) - https://review.opendev.org/871621 (Wallaby(glance)) - https://review.opendev.org/871625 (Xena(cinder)) - https://review.opendev.org/871619 (Xena(glance)) - https://review.opendev.org/871622 (Xena(nova)) - https://review.opendev.org/871620 (Yoga(cinder)) - https://review.opendev.org/871617 (Yoga(glance)) - https://review.opendev.org/871624 (Yoga(nova)) - https://review.opendev.org/871618 (Zed(cinder)) - https://review.opendev.org/871614 (Zed(glance)) - https://review.opendev.org/871616 (Zed(nova)) - https://review.opendev.org/871615 (2023.1/antelope(cinder)) - https://review.opendev.org/871613 (2023.1/antelope(glance)) - https://review.opendev.org/871612 (2023.1/antelope(nova)) Credits ~~~~~~~ - Guillaume Espanel from OVH (CVE-2022-47951) - Pierre Libeau from OVH (CVE-2022-47951) - Arnaud Morin from OVH (CVE-2022-47951) - Damien Rannou from OVH (CVE-2022-47951) References ~~~~~~~~~~ - https://launchpad.net/bugs/1996188 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-47951 Notes ~~~~~ - The stable/wallaby, stable/victoria, stable/ussuri, and stable/train branches are under extended maintenance and will receive no new point releases, but patches for them are provided as a courtesy where possible. -- Jeremy Stanley OpenStack Vulnerability Management Team

3 3

[kolla][HAProxy] Insert custom vip in HAProxy
by Satish Patel 06 Feb '23

06 Feb '23

Folks, We have multi-node openstack running and recently i have deployed ceph storage which is in an internal network and i would like to access ceph dashboard on public. I was thinking if there is a way to insert custom vip configuration in the Kolla HAProxy role then I can expose the 8443 port of the ceph-dashboard to the public network. Is it possible in kolla to add custom config in haproxy for extra vip?

2 2

[election][ptl][openstack-helm] PTL Non-candidacy
by Gage Hugo 06 Feb '23

06 Feb '23

Hey folks, With the next election approaching, I want to announce that I will not be running for PTL this upcoming cycle. I've served as PTL for the last 3 years (6 cycles!?) now and I believe it's time for a change that can only be introduced by new leadership. I believe the OpenStack-Helm project is currently in good standing, but it will be healthy for the project to have someone with a fresh perspective step in. The current project team has been excellent and I believe whoever steps up will have plenty of support from the OpenStack-Helm community. I still plan on being around when I can so I can provide help whenever it's needed. Thanks everyone, it's been great! Gage

3 2

[qa][dev] Support for `sudo pip install` going away soon (PEP 668)
by Jeremy Stanley 06 Feb '23

06 Feb '23

Debian 12 (bookworm) and non-LTS Ubuntu 23.04 (lunar) are going to disallow `sudo pip install` so anything you install with pip for use by their packaged Python interpreter will need to go into venvs. Here's the upcoming readme about it: https://salsa.debian.org/cpython-team/python3/-/blob/master/debian/README.v… This has obvious implications for DevStack and Grenade, which currently install OpenStack services into the system environment for the distribution-packaged interpreter. Both bookworm and lunar will be released in a few months and people are going to end up using them for development systems, but at a minimum we're going to be forced to address this before we make Debian 12 or Ubuntu 24.04 LTS a targeted test platform for a release. There was an attempt to implement a solution 5 years ago when the writing was clearly on the wall that this would eventually happen. It may need some updates, but probably could serve as a good starting point: https://review.opendev.org/558930 -- Jeremy Stanley

1 0

[osprofiler] CI broken, looks like something related to ChangeLog not generated
by Sahid Orentino Ferdjaoui 06 Feb '23

06 Feb '23

Hello, There is a change here that is fixing functional test issues on CI. But we still have an issue with ChangeLog. https://review.opendev.org/c/openstack/osprofiler/+/840711 Looks like pbr should generate it, then we include it on history.rst. But for some reason it seems that the file is not generated or got deleted at some point. Locally that is working right. Any idea what may be the problem here? https://zuul.opendev.org/t/openstack/build/a6df711e249c4666a1a26ca6b25d6f42 Thanks, s.

1 0

Stopped OpenStack Trove Guest Agent Service for Development.
by Uday Dikshit 05 Feb '23

05 Feb '23

Hello Team We are trying to use Openstack Trove in kolla-ansible Openstack Wallaby release. We created an image using tarball as well as trovestack, we created a datastore for mysql and added version using these images. But every time we create a database instance the instance in service projects runs successfully and shows active status. But when the database instance gets stuck in build state and after the timeout it logs error in trove taskmanager of polling time out. We created a customized image with the trovestack image and configured ssh in it. Then we used this customized image to check if the guestagent was running in the instance. Here are the logs mysql-instance-1:~# journalctl -u guest-agent.service | less Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to load environment files: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to run 'start-pre' task: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed with result 'resources'. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Failed to start OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Scheduled restart job, restart counter is at 1. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Stopped OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to load environment files: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to run 'start-pre' task: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed with result 'resources'. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Failed to start OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Scheduled restart job, restart counter is at 2. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Stopped OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to load environment files: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to run 'start-pre' task: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed with result 'resources'. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Failed to start OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Scheduled restart job, restart counter is at 3. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Stopped OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to load environment files: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed to run 'start-pre' task: No such file or directory Feb 04 18:10:57 mysql-instance-1 systemd[1]: guest-agent.service: Failed with result 'resources'. Feb 04 18:10:57 mysql-instance-1 systemd[1]: Failed to start OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:58 mysql-instance-1 systemd[1]: guest-agent.service: Scheduled restart job, restart counter is at 4. Feb 04 18:10:58 mysql-instance-1 systemd[1]: Stopped OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:58 mysql-instance-1 systemd[1]: guest-agent.service: Failed to load environment files: No such file or directory Feb 04 18:10:58 mysql-instance-1 systemd[1]: guest-agent.service: Failed to run 'start-pre' task: No such file or directory Feb 04 18:10:58 mysql-instance-1 systemd[1]: guest-agent.service: Failed with result 'resources'. Feb 04 18:10:58 mysql-instance-1 systemd[1]: Failed to start OpenStack Trove Guest Agent Service for Development. Feb 04 18:10:58 mysql-instance-1 systemd[1]: guest-agent.service: Scheduled restart job, restart counter is at 5. Feb 04 18:10:58 mysql-instance-1 systemd[1]: Stopped OpenStack Trove Guest Agent Service for Development. It will be really helpful if anybody did had any idea on running trove in kolla ansible wallaby release Thanks in advance Uday Dikshit

1 0

[neutron] Bug Deputy Report January 30 - February 6
by Nurmatov Mamatisa 05 Feb '23

05 Feb '23

Hi, Below is the week summary of bug deputy report for last week. Undecided bugs needs further triage. Details: Critical -------- - https://bugs.launchpad.net/neutron/+bug/2004184 - [neutron-lib] SQLAlchemy 2.0: ASSOCIATION_PROXY import error - Fix released: https://review.opendev.org/c/openstack/neutron-lib/+/872198 - Assigned to Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/2004258 - [sqlalchemy-20] ORM "relation" deprecated since v1.4 - Fix released: https://review.opendev.org/c/openstack/neutron/+/872271 - Assigned to Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/2004538 - [neutron-lib] Gate pep8 errors - Fix released: https://review.opendev.org/c/openstack/neutron-lib/+/872513 - Assigned to Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/2004656 - "rpc_workers" config variable needs to be registered in stadium projects - In progress: https://bugs.launchpad.net/neutron/+bug/2004656 - Assigned to Rodolfo Alonso High ---- - https://bugs.launchpad.net/neutron/+bug/2004265 - [sqlalchemy-20] Add SQLAlchemy CI jobs using master branch - Fix released: https://review.opendev.org/c/openstack/neutron/+/872273 - Assigned to Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/2004263 - [sqlalchemy-20] Remove ORM "from_self" - Fix released: https://review.opendev.org/c/openstack/neutron/+/744512 - Assigned to Rodolfo Alonso - https://bugs.launchpad.net/neutron/+bug/2004260 - [neutron-lib][sqlalchemy-20] ``Session.transaction`` is no longer a public member - Fix released: https://review.opendev.org/c/openstack/neutron-lib/+/872272 - Assigned to Rodolfo Alonso Medium ------ - https://bugs.launchpad.net/neutron/+bug/2004186 - [ovsdbapp] "LbAddIpPortMappingCommand" C letter is a non-ascii character - In progress: https://review.opendev.org/c/openstack/ovsdbapp/+/872200 - Assigned to Rodolfo Alonso Undecided --------- - https://bugs.launchpad.net/neutron/+bug/2004238 - OVN metadata use the same IP as LB health monitor - Incomplete - https://bugs.launchpad.net/neutron/+bug/1988574 - vpnaas not working on centos8-stream on xena - Originally it was kola-ansible bug. Now updated to neutron - https://bugs.launchpad.net/neutron/+bug/2004581 - Neutron API query error, implicit cast does not exist in postgresql - Incomplete - https://bugs.launchpad.net/neutron/+bug/2005111 - Batch creating VM failed because of timeout error Best regards, Isa Advanced Software Technology Lab / Cloud Technologies Research

1 0

[neutron] Bumping of requirements on RDO before bumping them on Neutron
by Elvira Garcia Ruiz 04 Feb '23

04 Feb '23

Hi Neutrinos! RDO folks proposed that, in order to be able to correctly build CI gates for testing, it would be nice if we tried to update the neutron-distgit requirement file when we want to update the minimal version of a dependency before merging it on our repository. This would allow them to realize whether they need or not to update any Fedora package. In order to do that, we just need to send a small commit to their repository [0]. You can use your GitHub account for the login. Here you can find an example for pyroute2 in RDO [1] and the respective pyroute2 bump in Neutron [2]. Regards! Elvira García (elvira) [0] https://review.rdoproject.org/r/openstack/neutron-distgit [1] https://review.rdoproject.org/r/c/openstack/neutron-distgit/+/46809 [2] https://review.opendev.org/c/openstack/neutron/+/870963

7 9

[all][tc] What's happening in Technical Committee: summary 2023 Feb 3: Reading: 5 min
by Ghanshyam Mann 03 Feb '23

03 Feb '23

Hello Everyone, Here is this week's summary of the Technical Committee activities. 1. TC Meetings: ============ * We had this week's meeting on Feb 1. Most of the meeting discussions are summarized in this email. This was a monthly video call and the recording is available @ https://www.youtube.com/watch?v=SU4CKkz2Fkc and summary logs are available @ https://meetings.opendev.org/meetings/tc/2023/tc.2023-02-01-16.00.log.html * The next TC weekly meeting will be on Feb 8 Wed at 16:00 UTC, Feel free to add the topic to the agenda[1] by Feb 7. 2. What we completed this week: ========================= * None for this week 3. Activities In progress: ================== TC Tracker for the 2023.1 cycle ------------------------------------- * Current cycle working items and their progress are present in the 2023.1 tracker etherpad[2]. Open Reviews ----------------- * Four open reviews for ongoing activities[3]. PTG/Forum planning ------------------------- The TC started the etherpad[4] to collect the topics for next vPTG in March, feel free to add the topics there. Defining 2023.2 cycle testing runtime --------------------------------------------- It's time to define the testing runtime for the next cycle (2023.2). I have pushed the patch[5], feel free to review and add feedback. For quick ref: below are the changes from the 2023.1 cycle testing runtime: * Remove the additional ubuntu version 20.04 from testing which was added in the 2023.1 testing runtime because we bumped the testing version from 20.04 to 22.04 in the 2023.1 cycle. From 2023.1 to 2023.2, there is no major version change in testing so we do not need to do any additional version testing. * Add Rocky Linux 9 in Best Effort testing * With that bumping the python minversion to py3.9 which is Debian 11 default. Defining 2023 upstream investment opportunities ------------------------------------------------------------ Every calendar year, TC defines the upstream investment opportunities where we need help and the organization can help. I have pushed the patch[6] to define it for the 2023 calendar year which is nothing but continuing last year's opportunities. Feel free to let TC know if any of the areas/projects you think need help and should be added to this list. Cleanup of PyPI maintainer list for OpenStack Projects ---------------------------------------------------------------- The audit process is going on and a few projects have been completed [7]. There is a discussion also going on in ML[8]. In this weekly call, TC discussed it further and there is some improvement in the cleanup process. To do this cleanup smoothly, instead of removing them directly, it is better to notify them first. As PyPi does not tell about the email addresses of additional maintainers, the PTL/team is the best person to know their email addresses (if they are old contributors). JayF will be documenting[9] the 'how to remove PyPI maintainers/owner access' and what additional steps to be done by PTL. Basically In step#1, along with the audit, PTL needs to reach out to their additional maintainers and ask them to i) remove themself as PyPi maintainers ii) transfer the ownership to 'openstackci' if they are 'owner' in PyPi. The process to find the less active projects early in the cycle: ------------------------------------------------------------------------ No update this week. JayF started the etherpad to collect the data and define the criteria to help in this process[10]. Project updates ------------------- * Add Cinder Huawei charm[11] * Add the woodpecker charm to Openstack charms[12] 4. How to contact the TC: ==================== If you would like to discuss or give feedback to TC, you can reach out to us in multiple ways: 1. Email: you can send the email with tag [tc] on openstack-discuss ML[13]. 2. Weekly meeting: The Technical Committee conduct a weekly meeting every Thursday 15:00 UTC [14] 3. Ping us using 'tc-members' nickname on #openstack-tc IRC channel. [1] https://wiki.openstack.org/wiki/Meetings/TechnicalCommittee#Agenda_Suggesti… [2] https://etherpad.opendev.org/p/tc-2023.1-tracker [3] https://review.opendev.org/q/projects:openstack/governance+status:open [4] https://etherpad.opendev.org/p/tc-2023-2-ptg [5] https://review.opendev.org/c/openstack/governance/+/872232 [6] https://review.opendev.org/c/openstack/governance/+/872233 [7] https://etherpad.opendev.org/p/openstack-pypi-maintainers-cleanup [8] https://lists.openstack.org/pipermail/openstack-discuss/2023-January/031848… [9] https://meetings.opendev.org/meetings/tc/2023/tc.2023-02-01-16.00.log.html#… [10] https://etherpad.opendev.org/p/project-health-check [11] https://review.opendev.org/c/openstack/governance/+/867588 [12] https://review.opendev.org/c/openstack/governance/+/869752 [13] hhttp://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-discuss [14] http://eavesdrop.openstack.org/#Technical_Committee_Meeting -gmann

1 0