| opendevreview | Merged openstack/kayobe stable/2023.1: Fix an issue when user forgot combine custom passwords https://review.opendev.org/c/openstack/kayobe/+/900461 | 01:22 |
|---|---|---|
| opendevreview | Michal Nasiadka proposed openstack/kolla-ansible master: ironic: Use baremetal_node_info https://review.opendev.org/c/openstack/kolla-ansible/+/901100 | 05:42 |
| opendevreview | Michal Nasiadka proposed openstack/kolla-ansible master: ironic: Use baremetal_node_info https://review.opendev.org/c/openstack/kolla-ansible/+/901100 | 05:44 |
| opendevreview | efineshi proposed openstack/kolla-ansible master: Fix upload image bigger than 1GB failed https://review.opendev.org/c/openstack/kolla-ansible/+/900660 | 07:00 |
| opendevreview | efineshi proposed openstack/kolla-ansible master: Fix upload image bigger than 1GB failed https://review.opendev.org/c/openstack/kolla-ansible/+/900660 | 07:01 |
| opendevreview | efineshi proposed openstack/kolla-ansible master: Fix upload image bigger than 1GB failed https://review.opendev.org/c/openstack/kolla-ansible/+/900660 | 07:08 |
| opendevreview | Petr Slavchenkov proposed openstack/kolla-ansible master: Fix proxysql get mariadb_backup_database_password https://review.opendev.org/c/openstack/kolla-ansible/+/900979 | 08:35 |
| opendevreview | Michal Nasiadka proposed openstack/kolla-ansible master: ironic: Use baremetal_node_info https://review.opendev.org/c/openstack/kolla-ansible/+/901100 | 08:53 |
| opendevreview | Michal Nasiadka proposed openstack/kolla-ansible master: ironic: Use baremetal_node_info https://review.opendev.org/c/openstack/kolla-ansible/+/901100 | 09:02 |
| SvenKieske | o/ | 09:12 |
| SvenKieske | mnasiadka: asking again if we should do a last effort to update rmq in yoga release? there is this one open: https://review.opendev.org/c/openstack/kolla/+/880799 | 09:13 |
| opendevreview | efineshi proposed openstack/kolla-ansible master: Fix upload image bigger than 1GB failed https://review.opendev.org/c/openstack/kolla-ansible/+/900660 | 09:13 |
| frickler | I don't think we can do this now, since we can no longer test upgrades from xena. IMO best we could do is a warning telling deployers to do the upgrade locally | 09:17 |
| mnasiadka | yoga is going to be unmaintained soon | 09:19 |
| mnasiadka | so I don't think the effort makes any sense | 09:20 |
| mnasiadka | but we could do it for antelope (Zed for my company is just a jump through release) | 09:20 |
| opendevreview | efineshi proposed openstack/kolla-ansible master: Fix upload image bigger than 1GB failed https://review.opendev.org/c/openstack/kolla-ansible/+/900660 | 09:24 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/yoga: Fix OpenStack exporter scrape with internal TLS & FQDN https://review.opendev.org/c/openstack/kolla-ansible/+/901068 | 09:38 |
| opendevreview | Michal Nasiadka proposed openstack/kolla-ansible master: ironic: Use baremetal_node_info https://review.opendev.org/c/openstack/kolla-ansible/+/901100 | 09:49 |
| opendevreview | Merged openstack/kolla-ansible master: [doc] Fix the incorrect URL of 'Quick Start for development' https://review.opendev.org/c/openstack/kolla-ansible/+/898186 | 09:51 |
| opendevreview | Sven Kieske proposed openstack/kolla-ansible master: harden the glance-api cors settings https://review.opendev.org/c/openstack/kolla-ansible/+/901123 | 09:52 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/2023.1: Add command to force reset the state of RabbitMQ https://review.opendev.org/c/openstack/kolla-ansible/+/901069 | 09:52 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/zed: Add command to force reset the state of RabbitMQ https://review.opendev.org/c/openstack/kolla-ansible/+/901070 | 09:53 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/yoga: Add command to force reset the state of RabbitMQ https://review.opendev.org/c/openstack/kolla-ansible/+/901071 | 09:53 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/yoga: Add command to force reset the state of RabbitMQ https://review.opendev.org/c/openstack/kolla-ansible/+/901071 | 09:53 |
| opendevreview | Mark Goddard proposed openstack/kolla-ansible stable/yoga: Add command to force reset the state of RabbitMQ https://review.opendev.org/c/openstack/kolla-ansible/+/901071 | 09:54 |
| opendevreview | Will Szumski proposed openstack/kolla-ansible master: Adds the neutron_service_limit option https://review.opendev.org/c/openstack/kolla-ansible/+/877776 | 09:56 |
| jangutter | mnasiadka: I think that ubuntu podman build could possibly have been an outlier: https://zuul.opendev.org/t/openstack/builds?job_name=kolla-build-ubuntu-podman&project=openstack/kolla I don't see a pattern of badness... | 11:41 |
| Vii | Hi. I have a question if this is normal because I don't think it is. The vnc service runs on libvirt nodes and issues an access port for each VM console, e.g. 5901, 5902, 5903. and you can access the vnc console from the vnc client without logging in. The service configuration should not include "Disable the 'No Authentication' security type." | 11:50 |
| Vii | This looks like a serious security bug | 11:51 |
| Vii | I think I know the answer :/ https://review.opendev.org/c/openstack/openstack-manuals/+/433321/2/doc/admin-guide/source/compute-configuring-migrations.rst | 12:18 |
| jovial | Don't you normally have the vnc proxy in front of the those vnc sockets? Which at least has some kind of token based authentication. | 12:20 |
| Vii | I have vnc-proxy, but I was wondering if it is normal that I can connect to a libvirt machine without auth | 12:26 |
| jovial | I think that is normal in a k-a deploy, but like you say, it doesn't seem ideal from security perspective | 12:30 |
| opendevreview | Verification of a change to openstack/kayobe master failed: Remove Monasca and co remnants https://review.opendev.org/c/openstack/kayobe/+/901059 | 13:14 |
| opendevreview | Verification of a change to openstack/kayobe master failed: Drop not used grafana-conf from reqs https://review.opendev.org/c/openstack/kayobe/+/901060 | 13:14 |
| SvenKieske | regarding vnc: isn't this normally only reachable via the horizon/skyline gui, which is authenticated? are you telling me we are exposing unauthed vnc traffic on public/external networks? I don't think we do? | 13:33 |
| SvenKieske | @Vii: see above | 13:34 |
| Vii | @SvenKieske there is no access from the public/external network. I was simply surprised that you can open a VNC connection without auth from inside the network. I was wondering if this was normal. But it looks like it is | 13:37 |
| SvenKieske | Vii: it seems that the default auth_schemes is "none": https://docs.openstack.org/nova/latest/configuration/config.html#vnc.auth_schemes | 13:43 |
| SvenKieske | not 100% sure this is the correct config option to look at, in a past life I did design novnc authentication also based on novnc-proxy in a different but similar product.. | 13:43 |
| SvenKieske | Vii: at least this _was_ by design..looking into what happened to this spec: https://specs.openstack.org/openstack/nova-specs/specs/wallaby/approved/nova-support-webvnc-with-password-authentication.html | 13:52 |
| SvenKieske | "The spec wasn't approved for Xena and has outstanding issues. Abandoning until this is reproposed and reworked in a future release" https://review.opendev.org/c/openstack/nova/+/622336/37#message-2a790d3cea7b38415b5efc670223b27d0efd569f | 13:54 |
| SvenKieske | Vii: I just asked over at #openstack-nova | 14:05 |
| Vii | SvenKieske: thans, for me looks like a security bug | 14:07 |
| opendevreview | Sven Kieske proposed openstack/kolla-ansible master: harden the glance-api cors settings https://review.opendev.org/c/openstack/kolla-ansible/+/901123 | 14:15 |
| SvenKieske | Vii: well you need a token inside your URL, basic password auth doesn't buy you much, you really need to carefully describe an attacker scenario where an adversary crosses a trust boundary, just glancing at the problem I don't see that just yet. | 14:20 |
| SvenKieske | you may though want to encrypt the network channel between the novnc proxy and the end user, that is possible (and even needed if you want to do password auth). | 14:22 |
| SvenKieske | the designspec was seemingly rejected on the basis that password based auth wasn't deemed secure enough/enough of a security benefit, but I don't have the details at hand. | 14:23 |
| Vii | I'm more concerned about the situation that the local "admin" in the local network can open any libvirt vnc connections and connect to a specific libvirt node | 14:23 |
| SvenKieske | well, you can configure nova, to always only connect to the novnc proxy and you need to get a bearer token to be able to do so, but you get one by default by e.g. issuing "openstack console.." | 14:24 |
| SvenKieske | the thing is, the admin can always reconfigure nova/qemu to accept local unauthed vnc connections | 14:25 |
| Vii | if you have any libvirt node available with running VMs, connect with vnc client to ip.node.address:5900 /5901 / 5902 | 14:25 |
| SvenKieske | I personally don't believe in all the "remote attestation" hype, if you can't trust your cloud admin, you have big problems. that doesn't mean we should strive to make stuff even secure against admins | 14:26 |
| Vii | Sure, I understand and I understand what's going on. Thanks | 14:27 |
| SvenKieske | ah I guess we need to enable "vencrypt" as an auth_scheme, as mentioned above | 14:27 |
| SvenKieske | Vii: maybe open a bug against kolla-ansible? | 14:27 |
| Vii | I'd have to create an account :) If I remember, I'll do it tomorrow | 14:28 |
| SvenKieske | I _think_ we should adjust the default vnc.auth_schemes to have "vencrypt" at least that seems to lock this down to the proxy | 14:28 |
| SvenKieske | okay, then I guess I'll just file a bug myself, to not forget this stuff | 14:28 |
| SvenKieske | Vii: opened a bug: https://bugs.launchpad.net/kolla-ansible/+bug/2043709 feel free to subscribe there or update with your concrete findings :) | 14:35 |
| SvenKieske | from my experience it always helps if a user can clearly state what is wrong and how they expect the system to behave..we devs are somewhat disconnected from this stuff :D | 14:36 |
| opendevreview | Can Özyurt proposed openstack/kolla-ansible master: Remove auth.conf from config.json for fake nova-compute https://review.opendev.org/c/openstack/kolla-ansible/+/901168 | 14:54 |
| *** Continuity__ is now known as Continuity | 17:25 | |
| frickler | mnasiadka: looking at examples for the deprecation, I found renos saying we'd drop sahara and vitrage this cycle, do we still want to do that? | 17:33 |
| opendevreview | Dr. Jens Harbott proposed openstack/kolla-ansible master: Deprecate Masakari https://review.opendev.org/c/openstack/kolla-ansible/+/901193 | 17:45 |
| frickler | hmm, do we mark deprecations only in k-a and not in kolla? also doc/source/support_matrix.rst still mentions bullseye and not bookworm? | 17:50 |
| opendevreview | Merged openstack/kayobe master: Remove Monasca and co remnants https://review.opendev.org/c/openstack/kayobe/+/901059 | 18:13 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/2023.1: Fix issue with octavia security group rules creation https://review.opendev.org/c/openstack/kolla-ansible/+/901075 | 21:09 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/yoga: Add ability to configure rabbitmq https://review.opendev.org/c/openstack/kolla-ansible/+/901209 | 21:21 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/yoga: Add ability to configure rabbitmq https://review.opendev.org/c/openstack/kolla-ansible/+/901209 | 21:22 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/yoga: Add ability to configure rabbitmq https://review.opendev.org/c/openstack/kolla-ansible/+/901209 | 21:24 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/yoga: Configure coordination in default for masakari-api https://review.opendev.org/c/openstack/kolla-ansible/+/901076 | 21:26 |
| opendevreview | Maksim Malchuk proposed openstack/kolla-ansible stable/2023.1: Add support for multiple ceph files https://review.opendev.org/c/openstack/kolla-ansible/+/901077 | 21:28 |
| opendevreview | Magnus Lööf proposed openstack/kolla-ansible master: Enable TLS backend for designate https://review.opendev.org/c/openstack/kolla-ansible/+/866524 | 21:29 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!