February 2022 - service-discuss

OpenSSH 8.8, RSA keys, and Gerrit
by Clark Boylan 13 Oct '22

13 Oct '22

Hello, About a year ago Fedora 33 released and gave us a preview of OpenSSH's sha1 + RSA key deprecation fallout. Fedora 33 users noticed they could no longer use SSH RSA keys to connect to our Gerrit at review.opendev.org. This happens because Fedora 33's OpenSSH packaging has deprecated sha1 hashes for RSA, and despite both the client and server supporting rsa-sha2-* variants they couldn't negotiate their use between them. OpenSSH 8.8 released recently and did similar in the upstream software which means users with up to date OpenSSH installations are noticing similar problems (Arch Linux for example). There are a couple of workarounds that you can use. Probably the best option is to use an ed25519 or ecdsa key with our Gerrit. Modern clients and our Gerrit SSHD negotiate these keys without issue. Less optimal is to manually re-enable the use of the ssh-rsa hash, but we recommend against this as your software providers have decided this is no longer secure enough. On our end we've brought this up with the MINA SSHD devs [0] with the hope that the SSH implementation that Gerrit uses can be updated to negotiate the sha2 hashes properly. Also, the rsa-sha2 RFC indicates [1] clients may fallback to a sha2 variant instead of the sha1 variant which would workaround MINA's lack of support for negotiation in the protocol. If you are an OpenSSH>=8.8 or Fedora>=33 user you might consider filing bugs against your ssh clients to change the default fallback to a sha2 variant on your platforms. [0] https://issues.apache.org/jira/browse/SSHD-1141 [1] https://datatracker.ietf.org/doc/html/rfc8332#section-3.3 Hopefully I've put enough keywords in this email that the various search engines will index it, and the next time someone runs into these problems they'll find this explanation. Clark

1 1

[all] Dynamic Zuul results table in Gerrit 3
by Radosław Piliszek 04 Aug '22

04 Aug '22

Hello Fellow OpenStack and OpenDev Folks! TL;DR click on [3] and enjoy. I am starting this thread to not hijack the discussion happening on [1]. First of all, I would like to thank gibi (Balazs Gibizer) for hacking a way to get the place to render the table in the first place (pun intended). I have been a long-time-now user of [2]. I have improved and customised it for myself but never really got to share back the changes I made. The new Gerrit obviously broke the whole script so it was of no use to share at that particular state. However, inspired by gibi's work, I decided to finally sit down and fix it to work with Gerrit 3 and here it comes: [3]. Works well on Chrome with Tampermonkey. Not tested others. I hope you will enjoy this little helper (I do). I know the script looks super fugly but it generally boils down to a mix of styles of 3 people and Gerrit having funky UI rendering. Finally, I'd also like to thank hrw (Marcin Juszkiewicz) for linking me to the original Michel's script in 2019. [1] http://lists.openstack.org/pipermail/openstack-discuss/2020-November/019051… [2] https://opendev.org/x/coats/src/commit/444c95738677593dcfed0cfd9667d4c4f0d5… [3] https://gist.github.com/yoctozepto/7ea1271c299d143388b7c1b1802ee75e Kind regards, -yoctozepto

7 11

Team Meeting Agenda for February 22, 2022
by Clark Boylan 21 Feb '22

21 Feb '22

== Agenda for next meeting == * Announcements ** Service Coordinator election is over. Clarkb was the only nomination. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220215) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220215) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning for old reviews? (frickler 20220222) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** https://etherpad.opendev.org/p/opendev-repo-retirements List of repos to retire. Please review for any that are inappropriate to remove. *** https://review.opendev.org/q/topic:retirement+status:open Changes to retire all unused the repos. *** Once the above changes land we'll abandon related changes and then remove the repos from zuul entirely. ** Gitea 1.16.1 (clarkb 20220222) *** https://review.opendev.org/c/opendev/system-config/+/828184 Change to upgrade to 1.16.1 when we are ready *** https://104.130.74.7:3081/opendev/system-config Test site via held node here *** There are changes to how docker container processes are started. In particular change log calls out this may affect ssh. We update our testing to push content via ssh to simulate gerrit replication to cover this. ** Gerrit gitea weblinks (clarkb 20220222) *** Gerrit now links to gitea ** Rocky Linux 8 Images (clarkb 20220222) *** Need EPEL support in DIB for this https://review.opendev.org/c/openstack/diskimage-builder/+/830278 * Open discussion

1 0

Service Coordinator Election Nominations
by Clark Boylan 16 Feb '22

16 Feb '22

Hello everyone, I've noticed that while I brought up the planned nomination period of January 25, 2022 to February 8, 2022 for our Service Coordinator election in our meeting agendas, and the meetings themselves; I never sent a proper announcement to the mailing list about this. We discussed this in today's meeting and there were no objections to extending the nomination period to 23:59 UTC February 15, 2022. This way everything is formally announced and anyone interested has time to sign up. Consider this the official call for nominations. You've got a week to put your name in the hat if you'd like to give the Service Coordinator hat a go. If we have more than one nomination at that point we'll figure out an election process that should run for a week. If we end up with one nomination that individual will win by default. Looking at the 2022 calendar for the next election: we should plan to have nominations from August 2 - 16, 2022. Then have an election the week after if necessary. Clark

2 2

Infra Team Meeting Agenda for February 15, 2022
by Clark Boylan 14 Feb '22

14 Feb '22

We will meet Tuesday, February 15, 2022 at 19:00 UTC in #opendev-meeting with this agenda: * Announcements ** Service Coordinator nomination time has begun. You have until February 15, 2022 UTC end of day. That is today. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220215) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220215) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning our Nodepool images (clarkb 20220215) *** http://lists.opendev.org/pipermail/service-announce/2021-December/000029.ht… cleanup announcement *** https://review.opendev.org/c/opendev/system-config/+/829115 Removes fedora 34 mirror content ** Spring cleaning for old reviews? (frickler 20220215) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** https://etherpad.opendev.org/p/opendev-repo-retirements List of repos to retire. Please review for any that are inappropriate to remove. *** https://review.opendev.org/c/opendev/system-config/+/829119 Removes unused repos from integration testing. *** https://review.opendev.org/c/openstack/project-config/+/829121 Sets noop jobs on unused repos so that they can be retired. ** Gitea 1.16.1 (clarkb 20220215) *** https://review.opendev.org/c/opendev/system-config/+/828184 Change to upgrade to 1.16.1 when we are ready *** https://104.130.74.7:3081/opendev/system-config Test site via held node here *** There are changes to how docker container processes are started. In particular change log calls out this may affect ssh. We update our testing to push content via ssh to simulate gerrit replication to cover this. ** Gerrit gitea weblinks (clarkb 20220215) *** Fixes in progress upstream **** https://gerrit-review.googlesource.com/c/gerrit/+/329279 **** https://gerrit-review.googlesource.com/c/plugins/gitiles/+/330361 *** Not sure why the bazel test runs fail complaining about java runtimes. This happens for me too on the gerrit repo but only happens to gitiles upstream (not gerrit). * Open discussion

1 0

Team Meeting Agenda for February 8, 2022
by Clark Boylan 07 Feb '22

07 Feb '22

We will meet with this agenda on February 8, 2022 at 19:00 UTC in #opendev-meeting: == Agenda for next meeting == * Announcements ** OpenInfra Summit CFP needs your input: https://openinfra.dev/summit/ Tomorrow (the 9th) is the last day to get your entries in. ** Service Coordinator nomination time is ending. You have until February 8, 2022. That is today. * Actions from last meeting * Specs Review * Topics ** Improving OpenDev's CD throughput (clarkb 20220208) *** Bootstrapping bridge via Zuul is now a complicated subject. Can use zuul secrets to make it happen. Are we comfortable with this? *** https://review.opendev.org/c/opendev/infra-specs/+/821645 -- spec outlining some of the issues with secrets *** https://review.opendev.org/c/opendev/system-config/+/821155 -- sample of secret writing; more info in changelog ** Container maintenance (clarkb 20220208) *** https://etherpad.opendev.org/p/opendev-container-maintenance *** Running container with dedicated users. Next up all the ircbots. *** Upgrading Zookeeper *** Upgrading MariaDB *** Eventually convert MariaDB container's from uid 999 to something that makes more sense on the system. ** Spring cleaning our Nodepool images (clarkb 20220208) *** http://lists.opendev.org/pipermail/service-announce/2021-December/000029.ht… cleanup announcement *** CentOS 8 is now gone. Any progress on Fedora 34 removal? ** Spring cleaning for old reviews? (frickler 20220208) *** system-config has >300 open reviews, most of them in merge-conflict and >1y old *** https://etherpad.opendev.org/p/opendev-repo-retirements List of repos to retire. Please review for any that are inappropriate to remove. ** Gerrit mergeabilityComputationBehavior (frickler 20220127) *** https://gerrit-documentation.storage.googleapis.com/Documentation/3.5.0/con… *** Frickler volunteered to write a change for this. * Open discussion

1 0