Re: [openstack-dev] [Heat] DB schema changes for Convergence [was: Short term scaling strategies for large Heat stacks]

2014-05-31 Thread Mike Spreitzer
Clint Byrum cl...@fewbar.com wrote on 05/29/2014 09:09:18 PM: update-failure-recovery === This is a blueprint I believe Zane is working on to land in Juno. ... It's not just the observed state that you need in the database to resume. You also need the

Re: [openstack-dev] [Neutron][Advanced Services] Requesting reviewers

2014-05-31 Thread Ivar Lazzaro
Hi Sumit, Review commitment sound like a good idea. Is this aiming core reviewers only? What number of cores / non cores are you ideally trying to reach? Thanks, Ivar. On Fri, May 30, 2014 at 7:21 PM, Sumit Naiksatam sumitnaiksa...@gmail.com wrote: During the Neutron Advanced Services'

Re: [openstack-dev] [Neutron][L3] BGP Dynamic Routing Proposal

2014-05-31 Thread Ian Wells
I've tested exabgp against a v6 peer, and it's an independent feature, so I added that as a row separately from whether v6 advertisements work. Might be worth making the page general and adding in the vpn feature set too. On 30 May 2014 16:50, Nachi Ueno na...@ntti3.com wrote: Hi folks

Re: [openstack-dev] [Neutron] One performance issue about VXLAN pool initiation

2014-05-31 Thread Xurong Yang
Hi, i have reported a bug[1] [1]https://bugs.launchpad.net/neutron/+bug/1324875 but no better idea about this issue now, maybe need more discussion. any thoughts? :) Xurong Yang 2014-05-31 6:33 GMT+08:00 Eugene Nikanorov enikano...@mirantis.com: I was thinking it would be a separate

Re: [openstack-dev] [Neutron][Advanced Services] Requesting reviewers

2014-05-31 Thread Sumit Naiksatam
Hi Ivar, This is not just aimed at Neutron core reviewers. We are trying to get a set of reviewers who will commit to doing the reviews on a weekly basis. In fact, we would like to have a large number of non-core reviewers be a part of this review team. Patches which are filtered through this team

Re: [openstack-dev] [Neutron][Advanced Services] Requesting reviewers

2014-05-31 Thread trinath.soman...@freescale.com
+1 Summit. This really helps a lot for code and spec reviews. -- Trinath Somanchi - B39208 trinath.soman...@freescale.com | extn: 4048 -Original Message- From: Sumit Naiksatam [mailto:sumitnaiksa...@gmail.com] Sent: Saturday, May 31, 2014 5:31 PM To: OpenStack Development Mailing List

Re: [openstack-dev] [nova] bug status and our 1st Bug Day for Juno

2014-05-31 Thread Matt Riedemann
On 5/28/2014 11:29 PM, Tracy Jones wrote: Hi Folks – I spoke with Michael at the summit about bug management for Juno. Other than tagging the untagged bugs each week, I will also be driving a top ten list of bugs at the nova meeting. The meeting is every Wednesday for 1/2 hour at 1630 UTC.

Re: [openstack-dev] [All] Disabling Pushes of new Gerrit Draft Patchsets

2014-05-31 Thread Eugene Nikanorov
Hi, I might be posting a question to a wrong thread, but what would be the option to push a patch that I would like to share only with certain group of people. In other words, is there still an option to push non-public patches? I wouldn't like such patches to affect gerrit stream or trigger CIs,

[openstack-dev] [all] gerrit-dash-creator - much easier process for creating client side dashboards

2014-05-31 Thread Sean Dague
We're still working on a way to make it possible to review in server side gerrit dashboards more easily to gerrit. In the mean time I've put together a tool that makes it easy to convert gerrit dashboard definitions into URLs that you can share around. The project is called Gerrit Dash Creator -

[openstack-dev] [OSSG][OSSN] Multiple Cinder drivers set insecure file permissions

2014-05-31 Thread Nathan Kinder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Multiple Cinder drivers set insecure file permissions - --- ### Summary ### Several Cinder volume drivers set insecure file permissions for various files and directories. These permissions render the files accessible for read and write to any user

[openstack-dev] [OSSG][OSSN] Glance allows non-admin users to create public images

2014-05-31 Thread Nathan Kinder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Glance allows non-admin users to create public images - --- ### Summary ### The default policy settings in Glance allow any user to upload an image that is publicly available to all users. This can allow a malicious user to upload a vulnerable image

Re: [openstack-dev] Selecting more carefully our dependencies

2014-05-31 Thread Thomas Goirand
On 05/30/2014 03:22 PM, Chmouel Boudjnah wrote: On Thu, May 29, 2014 at 11:25 AM, Thomas Goirand z...@debian.org mailto:z...@debian.org wrote: So I'm wondering: are we being careful enough when selecting dependencies? In this case, I think we haven't, and I would recommend

[openstack-dev] Need help to patch IceHouse to enable emulated sound board.

2014-05-31 Thread Martinx - ジェームズ
Guys, Sorry to ask this here but, how can I enable an emulated sound board for KVM Instances on IceHouse with Ubuntu 14.04? I already have configured the SPICE Consoles for my Cloud for Desktops and, the only missing piece of configuration in now the sound device for Instances (specially Windows

Re: [openstack-dev] [All] Disabling Pushes of new Gerrit Draft Patchsets

2014-05-31 Thread Clark Boylan
There isn't an option to push non public patches (and there really wasn't before either, drafts are not properly private and this false expectation is one of the reasons we have disabled them). Currently the recommended alternative is work in progress. The code cannot merge with a work in progress

Re: [openstack-dev] [All] Disabling Pushes of new Gerrit Draft Patchsets

2014-05-31 Thread Morgan Fainberg
I’ve had this question asked numerous times (by previous coworkers, people interested in contributing to OpenStack, etc). The general feeling has always been that the individual is concerned about 3 things when considering drafts in gerrit. 1. Patch is very much WIP and doesn’t need to be

Re: [openstack-dev] [horizon][infra] Plan for the splitting of Horizon into two repositories

2014-05-31 Thread Jeremy Stanley
On 2014-05-29 20:55:01 + (+), Lyle, David wrote: [...] There are several more xstatic packages that horizon will pull in that are maintained outside openstack. The packages added are only those that did not have existing xstatic packages. These packages will be updated very sparingly,

Re: [openstack-dev] [All] Disabling Pushes of new Gerrit Draft Patchsets

2014-05-31 Thread Sean Dague
On 05/31/2014 04:30 PM, Morgan Fainberg wrote: I’ve had this question asked numerous times (by previous coworkers, people interested in contributing to OpenStack, etc). The general feeling has always been that the individual is concerned about 3 things when considering drafts in gerrit. 1.

Re: [openstack-dev] [Neutron][L3] BGP Dynamic Routing Proposal

2014-05-31 Thread YAMAMOTO Takashi
Hi folks ExaBGP won't suit for BGPVPN implementation because it isn't support vpnv4. Ryu is supporting it, however they have no internal api to binding neutron network route target. can you explain a little more? do you have api suggestions? YAMAMOTO Takashi so I think contrail is a

Re: [openstack-dev] [All] Disabling Pushes of new Gerrit Draft Patchsets

2014-05-31 Thread Morgan Fainberg
2. Since a patch is very much WIP, there is concern about consuming CI  resources with needless testing.  3. The code is “example”, “toy”, or “exploratory” (not planning to  submit to the project, but not private/proprietary)    The general advice I give to people is to post the patches

Re: [OpenStack-Infra] Service Account for Freescale

2014-05-31 Thread trinath.soman...@freescale.com
Hi- Kindly update the email address for Freescale CI account to new address fslo...@freescale.com. Thanking you -- Trinath Somanchi - B39208 trinath.soman...@freescale.com | extn: 4048 -Original Message- From: Jeremy Stanley [mailto:fu...@yuggoth.org] Sent: Saturday, February 15,

Re: [OpenStack-Infra] Service Account for Freescale

2014-05-31 Thread Clark Boylan
Email address for freescale-ci has been updated to the requested address. Clark On Sat, May 31, 2014 at 8:01 PM, trinath.soman...@freescale.com trinath.soman...@freescale.com wrote: Hi- Kindly update the email address for Freescale CI account to new address fslo...@freescale.com. Thanking

[Openstack] Integration with OpenStack

2014-05-31 Thread Avi Tal
Hi all, I am designing a Dynamic Resource Allocation for my company lab resources. The focal point of this solution should be OpenStack. *Background:* The testing and dev environments are built out of multiple nodes. Servers, clients. Some could be virtual but must support also bare-metal. The

Re: [Openstack] Integration with OpenStack

2014-05-31 Thread Alex Glikson
Hi Avi, This is a very interesting use-case. We have been experimenting internally with similar ideas (dynamic management of virtualized and bare-metal resources). In a nutshell, you can use Heat templates to provision the different environments. For bare-metal, you can configure Nova to

[Openstack] Nova-network Bug??

2014-05-31 Thread Georgios Dimitrakakis
Hi! For some days now I am trying to figure out what is the problem and IceHouse instances don't get internet access (you can have a look here: https://www.mail-archive.com/openstack@lists.openstack.org/msg07138.html ) Today I 've discovered that I have to put a NAT-firewall rule in the

[Openstack] Is there any in-guest agent need to be installed on OpenStack Instances?

2014-05-31 Thread hossein zabolzadeh
Hi, As the topic implied, in order to have better control over the instances, is there any agent software, that need to be installed on the openstack virtual machines? If so, what is the project name?! ___ Mailing list:

Re: [Openstack] Is there any in-guest agent need to be installed on OpenStack Instances?

2014-05-31 Thread Thomas Goirand
On Sat May 31 2014 07:21:15 PM HKT, hossein zabolzadeh zabolza...@gmail.com wrote: Hi, As the topic implied, in order to have better control over the instances, is there any agent software, that need to be installed on the openstack virtual machines? If so, what is the project name?! Hi,

Re: [Openstack] Is there any in-guest agent need to be installed on OpenStack Instances?

2014-05-31 Thread hossein zabolzadeh
Thanks a lot. On Sat, May 31, 2014 at 5:06 PM, Thomas Goirand tho...@goirand.fr wrote: On Sat May 31 2014 07:21:15 PM HKT, hossein zabolzadeh zabolza...@gmail.com wrote: Hi, As the topic implied, in order to have better control over the instances, is there any agent software, that

[Openstack] Network node's security

2014-05-31 Thread walterxj
hi all:     The network node(s) is the only node(s) that expose to the internet,so it's security setting is more important,So I think it needs to be protect by iptables or firewall etc.     On the other hand,network nodes control all the vm instances' network traffic,I have no ideas how

Re: [Openstack] Integration with OpenStack

2014-05-31 Thread Avi Tal
Hi Alex, First of all, Thanks for the excellent answer. Indeed I'll be participating the event in Israel. It will be cool to meet face-to-face and discuss these scenarios. Thanks On Sat, May 31, 2014 at 12:40 PM, Alex Glikson glik...@il.ibm.com wrote: Hi Avi, This is a very interesting

Re: [Openstack] Network node's security

2014-05-31 Thread Clint Byrum
Be permissive on br-ex to allow VM traffic to flow out to the internet. Otherwise be protective of the host address that the machine listens to. Excerpts from walterxj's message of 2014-05-31 13:46:24 +0100: hi all: The network node(s) is the only node(s) that expose to the

[Openstack] [OSSG][OSSN] Multiple Cinder drivers set insecure file permissions

2014-05-31 Thread Nathan Kinder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Multiple Cinder drivers set insecure file permissions - --- ### Summary ### Several Cinder volume drivers set insecure file permissions for various files and directories. These permissions render the files accessible for read and write to any user

[Openstack] [OSSG][OSSN] Glance allows non-admin users to create public images

2014-05-31 Thread Nathan Kinder
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Glance allows non-admin users to create public images - --- ### Summary ### The default policy settings in Glance allow any user to upload an image that is publicly available to all users. This can allow a malicious user to upload a vulnerable image

Re: [Openstack] Integration with OpenStack

2014-05-31 Thread Matt Jarvis
Foreman supports both bare metal and Openstack provisioning, so you could use the Foreman API to achieve all of this. Off the top of my head, for bare metal you'd use the foreman discovery plugin so that non-configured hosts are available as discovered hosts, get a list of hosts available in

Re: [Openstack] Nova-network Bug??

2014-05-31 Thread Georgios Dimitrakakis
It seems that the chains - Chain nova-network-OUTPUT - Chain nova-network-POSTROUTING - Chain nova-network-PREROUTING - Chain nova-network-float-snat are not populated correctly every time I start an instance. Any ideas why this is happening? Best, G. On Sat, 31 May 2014 14:09:13 +0300,

Re: [Openstack] Integration with OpenStack

2014-05-31 Thread Avi Tal
I wouldn't like to use foreman for the entire solution because I believe OpenStack is the future and I prefer treating OpenStack as the focal point and foreman as bare metal workaround until TripleO or Ironic will be out for production. Foreman will also be used for the post install requirements.

Re: [Openstack] Network node's security

2014-05-31 Thread xu Walter
Thank you for your advice,Clint,I'll try. 2014-05-31 21:47 GMT+08:00 Clint Byrum cl...@fewbar.com: Be permissive on br-ex to allow VM traffic to flow out to the internet. Otherwise be protective of the host address that the machine listens to. Excerpts from walterxj's message of