Skip to content

Commit af4968c

Browse files
mbuechsejklare
andauthored
Cut back gratuitous regulation (#1193)
* Simplify scs-0101-v1 to remove gratuitous regulation * Simplify scs-0100-v3 to remove gratuitous regulation * fix uneven number test to check on advertised RAM instead of actual RAM * Remove unused code for entropy check * Fix dead link (otherwise unrelated) * Undo removal of scs-0101-v1 from SCS-compatible IaaS 'next' * Introduce v1.1 of scs-0101. * Remove unused constant Signed-off-by: Matthias Büchse <matthias.buechse@alasca.cloud> Co-authored-by: Jan Klare <klare@osism.tech>
1 parent 7a2d25d commit af4968c

7 files changed

Lines changed: 18 additions & 117 deletions

File tree

Standards/scs-0100-v3-flavor-naming.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -171,8 +171,6 @@ If memory is oversubscribed, you must expose this with the `o` suffix.
171171

172172
### [OPTIONAL] Disk sizes and types
173173

174-
Disk sizes (in GB) should use sizes 5, 10, 20, 50, 100, 200, 500, 1000.
175-
176174
| Disk type | Meaning |
177175
| --------- | ------------------------------------ |
178176
| n | Network shared storage (ceph/cinder) |

Standards/scs-0101-v1-entropy.md

Lines changed: 7 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ description: |
1515

1616
## Introduction
1717

18+
This is v1.1 of the standard. See section on version history for details.
19+
1820
### Entropy in information technology
1921

2022
Entropy is a concept that is widely used in the scope of information
@@ -39,7 +41,7 @@ bus timings, or keyboard timings, to name a few.
3941

4042
_More recent methods_ of generating entropy include measuring IRQ jitter
4143
(available in Linux since kernel 5.4 or, before that, via a daemon such as
42-
[HavegeD](http://www.issihosts.com/haveged/)) as well as dedicated CPU
44+
[HavegeD](https://github.com/jirka-h/haveged)) as well as dedicated CPU
4345
instructions (available in virtually all major CPUs: RDSEED or RDRAND
4446
on x86_64 and RNDR on arm64).
4547

@@ -94,39 +96,15 @@ will be available in virtual instances.
9496

9597
## Entropy in SCS clouds
9698

97-
### Flavors
98-
99-
It is recommended that all flavors have the following attribute:
100-
101-
```console
102-
hw_rng:allowed=True
103-
```
104-
105-
The following attributes are optional:
106-
107-
```console
108-
hw_rng:rate_bytes - The allowed amount of bytes for the the guest
109-
to read from the host's entropy per period.
110-
hw_rng:rate_period - Sets the duration of a read period in seconds.
111-
```
112-
113-
### Images
114-
11599
It is recommended to use images having a kernel (patch level) version 5.18
116100
or up. This condition is already satisfied by every mandatory image defined
117101
in the [Image Metadata Standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0102-v1-image-metadata.md).
118102

119-
It is recommended that images activate the attribute `hw_rng_model: virtio`.
120-
121-
The daemon `rngd` must be installed (usually from `rng-tools`
122-
or `rng-utils`).
123-
124-
The user may choose to use the `virtio-rng` device via `rngd`.
125-
126-
### Compute nodes
127-
128103
Compute nodes must use CPUs that offer instructions for accessing
129104
entropy (such as RDSEED or RDRAND on x86_64 or RNDR on arm64), and
130105
these instructions may not be filtered by the hypervisor.
131106

132-
Compute nodes may provide a HRNG via `rngd`.
107+
## Version history
108+
109+
As of version 1.1, the method of injecting entropy into a VM using a
110+
virtualized HRNG together with `rngd` is no longer recommended.

Standards/scs-0101-w1-entropy-implementation-testing.md

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,24 +12,16 @@ With reasonably recent hardware—x86 CPU with RDRAND/RDSEED (Intel from 2012,
1212
AMD from 2015) or ARM CPU with FEAT_RNG or FEAT_RNG_TRAP—and recent VM image—Linux
1313
kernel 5.18 or higher—, there is (almost) nothing to be done.
1414

15-
Only the flavor and image attributes required by the standard have to be set:
16-
17-
- flavor extra_spec: `hw_rng:allowed=True` ,
18-
- image property: `hw_rng_model: virtio` .
19-
2015
## Automated tests
2116

2217
The following testcases [are implemented](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/openstack_test.py):
2318

24-
- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`,
25-
- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`,
26-
- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM,
2719
- `scs-0101-entropy-avail` ensures that the special file `/proc/sys/kernel/random/entropy_avail` contains
2820
the value 256 (pinned since kernel 5.18) on a sample VM,
2921
- `scs-0101-fips-test` ensures that the number of FIPS 140-2 failures is below 5 out of 1000 blocks
3022
tested, as determined by `cat /dev/random | rngtest -c 1000` on a sample VM.
3123

32-
Note: The latter two items act as surrogates for the following item, which
24+
These testcases act as surrogates for the following item, which
3325
cannot be detected directly:
3426

3527
- CPU instructions for accessing entropy are available to the VMs.

Tests/iaas/openstack_test.py

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@
1818
from scs_0100_flavor_naming.flavor_names_check import \
1919
compute_scs_flavors, compute_scs_0100_syntax_check, compute_scs_0100_semantics_check
2020
from scs_0101_entropy.entropy_check import \
21-
compute_scs_0101_image_property, compute_scs_0101_flavor_property, compute_canonical_image, \
22-
compute_collected_vm_output, compute_scs_0101_entropy_avail, compute_scs_0101_rngd, \
21+
compute_canonical_image, compute_collected_vm_output, compute_scs_0101_entropy_avail, \
2322
compute_scs_0101_fips_test
2423
from scs_0102_image_metadata.image_metadata import \
2524
compute_scs_0102_prop_architecture, compute_scs_0102_prop_hash_algo, compute_scs_0102_prop_min_disk, \
@@ -73,10 +72,7 @@ def make_container(cloud):
7372
# scs_0101_entropy
7473
c.add_function('canonical_image', lambda c: compute_canonical_image(c.images))
7574
c.add_function('collected_vm_output', lambda c: compute_collected_vm_output(c.conn, c.flavors, c.canonical_image))
76-
c.add_function('scs_0101_image_property', lambda c: compute_scs_0101_image_property(c.images))
77-
c.add_function('scs_0101_flavor_property', lambda c: compute_scs_0101_flavor_property(c.flavors))
7875
c.add_function('scs_0101_entropy_avail', lambda c: compute_scs_0101_entropy_avail(c.collected_vm_output, c.canonical_image.name))
79-
c.add_function('scs_0101_rngd', lambda c: compute_scs_0101_rngd(c.collected_vm_output, c.canonical_image.name))
8076
c.add_function('scs_0101_fips_test', lambda c: compute_scs_0101_fips_test(c.collected_vm_output, c.canonical_image.name))
8177
# scs_0102_image_metadata
8278
c.add_function('scs_0102_prop_architecture', lambda c: compute_scs_0102_prop_architecture(c.images))

Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@
1515
parsers=(flavor_names.parser_v3, ),
1616
tolerated_parsers=(flavor_names.parser_v2, flavor_names.parser_v1),
1717
)
18-
ACC_DISK = (0, 5, 10, 20, 50, 100, 200, 500, 1000, 2000, 5000, 10000, 20000, 50000, 100000)
1918

2019

2120
def compute_scs_flavors(flavors: typing.List[openstack.compute.v2.flavor.Flavor], parser=STRATEGY) -> list:
@@ -65,20 +64,18 @@ def compute_scs_0100_semantics_check(scs_flavors: list) -> bool:
6564
elif flv.vcpus > cpuram.cpus:
6665
logger.info(f"Flavor {flv.name} CPU underpromise: {flv.vcpus} > {cpuram.cpus}")
6766
# RAM
67+
advram = cpuram.ram # advertised RAM
6868
flvram = int((flv.ram + 51) / 102.4) / 10
6969
# Warn for strange sizes (want integer numbers, half allowed for < 10GiB)
70-
if flvram >= 10 and flvram != int(flvram) or flvram * 2 != int(flvram * 2):
71-
logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {flvram:.1f} GiB")
72-
if flvram < cpuram.ram:
73-
logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {cpuram.ram:.1f}")
70+
if advram >= 10 and advram != int(advram) or advram * 2 != int(advram * 2):
71+
logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {advram:.1f} GiB")
72+
if flvram < advram:
73+
logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {advram:.1f}")
7474
problems.add(flv.name)
75-
elif flvram > cpuram.ram:
76-
logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {cpuram.ram:.1f}")
75+
elif flvram > advram:
76+
logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {advram:.1f}")
7777
# Disk could have been omitted
7878
disksize = flavorname.disk.disksize if flavorname.disk else 0
79-
# We have a recommendation for disk size steps
80-
if disksize not in ACC_DISK:
81-
logger.info(f"Flavor {flv.name} non-standard disk size {disksize}, should have (5, 10, 20, 50, 100, 200, ...)")
8279
if flv.disk < disksize:
8380
logger.error(f"Flavor {flv.name} disk overpromise {flv.disk} < {disksize}")
8481
problems.add(flv.name)

Tests/iaas/scs_0101_entropy/entropy_check.py

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,6 @@
1717
SECURITY_GROUP_NAME = "_scs-0101-group"
1818
KEYPAIR_NAME = "_scs-0101-keypair"
1919

20-
IMAGE_ATTRIBUTES = {
21-
# https://docs.openstack.org/glance/2023.1/admin/useful-image-properties.html#image-property-keys-and-values
22-
# type: str
23-
"hw_rng_model": "virtio",
24-
}
25-
FLAVOR_ATTRIBUTES = {
26-
# https://docs.openstack.org/nova/2023.1/configuration/extra-specs.html#hw-rng
27-
# type: bool
28-
"hw_rng:allowed": "True", # testing showed that it is indeed a string?
29-
}
30-
FLAVOR_OPTIONAL = ("hw_rng:rate_bytes", "hw_rng:rate_period")
31-
3220

3321
TIMEOUT = 5 * 60 # timeout in seconds after which we no longer wait for the VM to complete the run
3422
MARKER = '_scs-test-'
@@ -70,38 +58,6 @@
7058
}
7159

7260

73-
def compute_scs_0101_image_property(images, attributes=IMAGE_ATTRIBUTES):
74-
"""This test ensures that each image has the relevant properties."""
75-
candidates = [
76-
(image.name, [f"{key}={value}" for key, value in attributes.items() if image.get(key) != value])
77-
for image in images
78-
]
79-
# drop those candidates that are fine
80-
offenders = [candidate for candidate in candidates if candidate[1]]
81-
for name, wrong in offenders:
82-
logger.error(f"Image '{name}' missing attributes: {', '.join(wrong)}")
83-
return not offenders
84-
85-
86-
def compute_scs_0101_flavor_property(flavors, attributes=FLAVOR_ATTRIBUTES, optional=FLAVOR_OPTIONAL):
87-
"""This test ensures that each flavor has the relevant extra_spec."""
88-
offenses = 0
89-
for flavor in flavors:
90-
extra_specs = flavor['extra_specs']
91-
wrong = [f"{key}={value}" for key, value in attributes.items() if extra_specs.get(key) != value]
92-
miss_opt = [key for key in optional if extra_specs.get(key) is None]
93-
if wrong:
94-
offenses += 1
95-
message = f"Flavor '{flavor.name}' missing attributes: {', '.join(wrong)}"
96-
# only report missing optional attributes if main ones are missing as well
97-
# reasoning here is that these optional attributes are merely a hint for implementers
98-
# and if the main ones are present, we assume that implementers have done their job already
99-
if miss_opt:
100-
message += f"; additionally, missing optional attributes: {', '.join(miss_opt)}"
101-
logger.error(message)
102-
return not offenses
103-
104-
10561
def compute_scs_0101_entropy_avail(collected_vm_output, image_name):
10662
"""This test ensures that the `entropy_avail` value is correct for a test VM."""
10763
lines = collected_vm_output['entropy-avail']
@@ -115,15 +71,6 @@ def compute_scs_0101_entropy_avail(collected_vm_output, image_name):
11571
return True
11672

11773

118-
def compute_scs_0101_rngd(collected_vm_output, image_name):
119-
"""This test ensures that the `rngd` service is running on a test VM."""
120-
lines = collected_vm_output['rngd']
121-
if "could not be found" in '\n'.join(lines):
122-
logger.error(f"VM '{image_name}' doesn't provide service rngd")
123-
return False
124-
return True
125-
126-
12774
def compute_scs_0101_fips_test(collected_vm_output, image_name):
12875
"""This test ensures that the 'fips test' via `rngtest` is passed on a test VM."""
12976
lines = collected_vm_output['fips-test']

Tests/scs-compatible-iaas.yaml

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -304,20 +304,13 @@ modules:
304304
- scs-0100-syntax-check
305305
- scs-0100-semantics-check
306306
- id: scs-0101-v1
307-
name: Entropy v1
307+
# leap from v1 to v1.1 in place because it's a very minor relaxation; all essential testcases are kept
308+
name: Entropy v1.1
308309
url: https://docs.scs.community/standards/scs-0101-v1-entropy
309310
targets:
310311
main:
311-
- scs-0101-rngd
312312
- scs-0101-entropy-avail
313313
- scs-0101-fips-test
314-
- id: scs-0101-v1-rec
315-
name: Entropy v1
316-
url: https://docs.scs.community/standards/scs-0101-v1-entropy
317-
targets:
318-
recommended:
319-
- scs-0101-flavor-property
320-
- scs-0101-image-property
321314
- id: scs-0102-v1
322315
name: Image metadata v1
323316
url: https://docs.scs.community/standards/scs-0102-v1-image-metadata

0 commit comments

Comments
 (0)