Older blog entries for mikal (starting at number 926)

Merged in Havana: configurable iptables drop actions in nova

LaunchPad bug 1013893 asked nicely if the drop action for iptables rules created by nova-network could be configured. The idea here is that you might want to do something other than a plain old drop -- for example logging before dropping. This has now been implemented in Havana.

To configure the drop action, set the iptables_drop_action to the name of an already existing iptables target. Creating this target is not managed by nova, and you'll need to do it on every compute node. When iptables creates or deletes rules on compute nodes it will now use this new target. There's a bit of an upgrade problem here in that this will stop nova from deleting rules which use the old hard coded drop target. However, if an instance is torn down then all of its tables are torn down as well and rules will be deleted correctly, so this is only a problem if a security group is changed while the instance is running.

It occurs to me that we can do better here, so I've sent off this review to handle the case where a rule is being removed and used the default drop action.

For safety, I would recommend only using this flag on new compute nodes that have no instances running in order to make this simple.

Tags for this post: openstack havana nova iptables
Related posts: Further adventures with base images in OpenStack; Havana Nova PTL elections; Upgrade problems with the new Fixed IP quota; Openstack compute node cleanup

Comment

Syndicated 2013-03-30 21:13:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Upgrade problems with the new Fixed IP quota

In the last few weeks a new quota has been added to Nova covering Fixed IPs. This was done in response to LaunchPad bug 1125468, which was disclosed as CVE 2013-1838.

To be honest I think there are some things the vulnerability management team learned the hard way with this disclosure. For example, we didn't realize that we needed to update python-novaclient to allow users to set the quota, or that adding a quota would require changes in Horizon. Both of these errors have been corrected.

More importanly, the default value of the new quota was set to 10. I made this decision based on the default value of the instances quota coupled with a desire to protect deployments from denial of service. However, this decision combined with a failure to explicitly call out the new quota in the release notes for the Folsom stable release have resulted in some deployers experiencing upgrade problems. This was drawn to our attention by LaunchPad bug 1161190.

We have therefore moved to set the default quota for fixed IPs to unlimited. If you want to protect yourself from a potential DoS, then you should seriously consider changing this default value in your deployment. This can be done with the quota_fixed_ips flag. The code reviews implementing this change are either merged, or under review depending on the release. At the time of writing this Havana and Grizzly have a fix merged, with Folsom and Essex still under review.

I think this experience also reinforces the importance of testing all upgrades in a lab environment before doing them in production.

Sorry for any inconvenience caused.

Tags for this post: openstack nova quota fixed_ip vmt cve denial_of_service
Related posts: Further adventures with base images in OpenStack; Havana Nova PTL elections; Openstack compute node cleanup

Comment

Syndicated 2013-03-30 16:11:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Havana Nova PTL elections

This is just a quick reminder that there are only a couple more days to vote in the Nova PTL elections for the Havana cycle. If you're eligible to vote, you should have a voting URL in your email.

The candidates:

• Russell Bryant -- announcement
• Michael Still -- announcement

The incumbent PTL, Vishvananda Ishaya, has chosen not to run.

Rackspace is hiring OpenStack developers, let me know if you want to know more.

Tags for this post: openstack nova ptl election havana
Related posts: Further adventures with base images in OpenStack; Openstack compute node cleanup

Comment

Syndicated 2013-03-13 08:34:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Roanoke, Virginia

This is by far the smallest US town I've been to, so I found it quite exciting. I think I need to come back in summer when there are some leaves as well.

                                       

See more thumbnails

Tags for this post: events pictures 20130310 photo

Comment

Syndicated 2013-03-12 07:13:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Redshirts

ISBN: 9780765334797 LibraryThing

I was super excited to get my hands on the latest John Scalzi book because I've really liked his previous stuff. Unfortunately while this book is fun I feel that the underlying concept is pretty weak... Its more of a toy boy than something which makes you think, which is a disappointment to me. Don't get me wrong, the overall execution is good, but the book feels lazily plotted, much like a badly done Harry Harrison does. So, if that sort of thing annoys you, give this one a miss. Tags for this post: book john_scalzi exploration comedy space Related posts: Dirk Gentley's Holistic Detective Agency; So Long, and Thanks For All the Fish ; The Restaurant at the End of the Universe ; Military satellites fly north-south, commercial satellites fly east-west?; The Man in the Rubber Mask; Bill The Galactic Hero ; Colony; Bill the Galactic Hero on the Planet of Bottled Brains; Ohhh, space junk; Russian scavengers life off abandoned space junk; The Light Fantastic; Starbound; The Hitchhikers Guide to the Galaxy ; Better Than Life; Bill the Galactic Hero Series; Marsbound; And Another Thing; Bingo!; Have I mentioned that I'm a big Smithsonian fan?; Life, the Universe and Everything ; Red Dwarf

Comment

Syndicated 2013-02-14 01:08:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

I give you Fidel, the slightly questionable LCA2013 organizer

I love this outfit. He looks so disastrously dodgy. Luckily for me, Jeff did a great job of handling our accommodation requirements for the week of the conference.

             

Tags for this post: conference lca2013 pictures 20130125 photo

Comment

Syndicated 2013-02-11 22:45:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Pictures from Catie and Pete's engagement party

This is how I spent Sunday afternoon. I can think of worse ways to spend time.

                                       

See more thumbnails

Tags for this post: events pictures 20130210 photo

Comment

Syndicated 2013-02-11 22:32:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Yet more lca2013 setup

Some bag stuffing, move AV setup, and network kit starts appearing.

                                       

See more thumbnails

Tags for this post: conference lca2013 pictures 20130124-lca2013 photo

Comment

Syndicated 2013-01-24 13:29:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

linux.conf.au 2013 setup

   

Tags for this post: conference lca2013 pictures 20130123 photo

Comment

Syndicated 2013-01-22 21:01:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)

Pool

It was hot the other day, so we went for a swim. Notice how hard I am working on the conference in these shots.

               

Tags for this post: blog pictures 20130111 photo

Comment

Syndicated 2013-01-18 15:52:00 from stillhq.com : Mikal, a geek from Canberra living in Silicon Valley (no blather posts)