From ecb5a164a48a10a232bee3dbdeaece1c4e30dd65 Mon Sep 17 00:00:00 2001 From: Friedrich Zahn Date: Mon, 16 Feb 2026 17:38:17 +0100 Subject: [PATCH 1/4] Draft clarification on mandatory service types Fixes #1004. ToDo: Move to v2. Signed-off-by: Friedrich Zahn --- ...1-mandatory-and-supported-IaaS-services.md | 40 +++++++------------ ...-supported-IaaS-services-implementation.md | 5 +-- 2 files changed, 17 insertions(+), 28 deletions(-) diff --git a/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md b/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md index a1d798922..9d67d9e31 100644 --- a/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md +++ b/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md @@ -26,9 +26,10 @@ Any unsupported APIs will not be tested. ## Mandatory IaaS APIs -The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services: +The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services. +The endpoints of services MUST be findable through the `catalog list` of the identity API[^1]. -| Mandatory API | corresponding OpenStack Service | description | +| Mandatory API service type | corresponding OpenStack Service | description | |-----|-----|-----| | **block-storage** | Cinder | Block Storage service | | **compute** | Nova | Compute service | @@ -36,35 +37,26 @@ The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and co | **image** | Glance | Image service | | **load-balancer** | Octavia | Load-balancer service | | **network** | Neutron | Networking service | -| **s3** | S3 API object storage | Object Storage service | - -:::caution - -S3 API implementations may differ in certain offered features. -CSPs must publicly describe the endpoints of their S3 solutions and which implementations they use in their deployment. -Users should always research whether a needed feature is supported in the offered implementation. +| **s3**[^2] | N/A | s3 compatible Object Storage service | -::: - -The endpoints of services MUST be findable through the `catalog list` of the identity API[^1]. - -[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html) +Aliases for these service types are only permitted where defined by the [OpenStack Service Type Authority](https://specs.openstack.org/openstack/service-types-authority/#aliases-optional). +Catalog entries SHOULD use the canonical service type, not aliases. ## Supported IaaS APIs -The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented thorugh the corresponding OpenStack services, and are considered in the SCS standards. +The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented through the corresponding OpenStack services, and are considered in the SCS standards. -| Supported API | corresponding OpenStack Service | description | +| Supported API service type | corresponding OpenStack Service | description | |-----|-----|-----| -| **bare-metal** | Ironic | Bare Metal provisioning service | -| **billing** | CloudKitty | Rating/Billing service | +| **baremetal** | Ironic | Bare Metal provisioning service | +| **rating** | CloudKitty | Rating/Billing service | | **dns** | Designate | DNS service | -| **ha** | Masakari | Instances High Availability service | +| **instance-ha** | Masakari | Instances High Availability service | | **key-manager** | Barbican | Key Manager service | | **object-store** | Swift | Object Store with different possible backends | | **orchestration** | Heat | Orchestration service | -| **shared-file-systems** | Manila | Shared File Systems service | -| **time-series-database** | Gnocchi | Time Series Database service | +| **shared-file-system** | Manila | Shared File Systems service | +| **time-series-database**[^2] | Gnocchi | Time Series Database service | ## Unsupported IaaS APIs @@ -76,7 +68,5 @@ The SCS standard offers no guarantees for compatibility or reliability of servic [The OpenStack Services](https://www.openstack.org/software/) -## Conformance Tests - -The presence of the mandatory OpenStack APIs will be tested in [this test-script](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/scs_0123_mandatory_services/mandatory_services.py) -The test will further check whether the object-store endpoint is compatible to s3. +[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html) +[^2]: These service types have not been assigned by the OpenStack Service Type Authority diff --git a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md index 2b53cf7eb..2820c4af9 100644 --- a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md +++ b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md @@ -11,6 +11,5 @@ supplements: We [implemented](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/openstack_test.py) the following testcases in accordance with the standard: -- `scs-0123-service-X` (with varying `X`) ensures that a service of type X can be found in the service catalog, -- `scs-0123-storage-apis` ensures that a service of one of the following types can be found: "volume", "volumev3", "block-storage", -- `scs-0123-swift-s3` ensures that S3 can be used to access object storage using EC2 credentials from the identity API. +- `scs-0123-service-` ensures that a service with the given type can be found in the service catalog +- `scs-0123-storage-apis` ensures that a service of one of the following types can be found: "volume", "volumev3", "block-storage" From 8ec7b8611ec66bb0dadde3e95cb707ce65cbd941 Mon Sep 17 00:00:00 2001 From: Friedrich Zahn Date: Tue, 17 Feb 2026 09:03:39 +0100 Subject: [PATCH 2/4] Add test definitions for SCS-0123-v2 Signed-off-by: Friedrich Zahn --- ...nd-supported-IaaS-services-implementation.md | 6 ++++++ Tests/iaas/openstack_test.py | 2 ++ Tests/scs-compatible-iaas.yaml | 17 ++++++++++++++++- 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md index 2820c4af9..4fe636289 100644 --- a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md +++ b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md @@ -4,6 +4,7 @@ type: Supplement track: IaaS supplements: - scs-0123-v1-mandatory-and-supported-IaaS-services.md + - scs-0123-v2-services.md --- ## Automated tests @@ -13,3 +14,8 @@ the following testcases in accordance with the standard: - `scs-0123-service-` ensures that a service with the given type can be found in the service catalog - `scs-0123-storage-apis` ensures that a service of one of the following types can be found: "volume", "volumev3", "block-storage" + +### Deprecated tests +#### v1 only +- `scs-0123-swift-s3` ensures that S3 can be used to access object storage using EC2 credentials from the identity API + diff --git a/Tests/iaas/openstack_test.py b/Tests/iaas/openstack_test.py index 27b57880c..081febb16 100755 --- a/Tests/iaas/openstack_test.py +++ b/Tests/iaas/openstack_test.py @@ -150,7 +150,9 @@ def make_container(cloud): c.add_function('scs_0123_service_load_balancer', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'load-balancer')) c.add_function('scs_0123_service_placement', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'placement')) c.add_function('scs_0123_storage_apis', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'volume', 'volumev3', 'block-storage')) + c.add_function('scs_0123_service_s3', lambda c: compute_scs_0123_service_presence(c.services_lookup, 's3')) c.add_function('scs_0123_swift_s3', lambda c: compute_scs_0123_swift_s3(c.services_lookup, c.conn)) + return c diff --git a/Tests/scs-compatible-iaas.yaml b/Tests/scs-compatible-iaas.yaml index 12ead9e2a..efceb3c14 100644 --- a/Tests/scs-compatible-iaas.yaml +++ b/Tests/scs-compatible-iaas.yaml @@ -269,6 +269,9 @@ scripts: - id: scs-0123-storage-apis description: The block-storage API is discoverable as `volume`, `volumev3`, or `block-storage`. url: https://docs.scs.community/standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation#automated-tests + - id: scs-0123-service-s3 + description: s3 service is discoverable. + url: https://docs.scs.community/standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation#automated-tests - id: scs-0123-swift-s3 description: The object-storage API is compatible with S3. url: https://docs.scs.community/standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation#automated-tests @@ -479,6 +482,18 @@ modules: - scs-0123-service-placement - scs-0123-storage-apis - scs-0123-swift-s3 + - id: scs-0123-v2 + name: Mandatory and Supported IaaS Services + url: https://docs.scs.community/standards/scs-0123-v2-services + targets: + main: + - scs-0123-service-compute + - scs-0123-service-identity + - scs-0123-service-image + - scs-0123-service-network + - scs-0123-service-load-balancer + - scs-0123-storage-apis + - scs-0123-service-s3 - id: scs-0302-v1 name: Domain Manager Role url: https://docs.scs.community/standards/scs-0302-v1-domain-manager-role @@ -523,7 +538,7 @@ versions: - scs-0116-v1 - scs-0117-v1 - scs-0121-v1 - - scs-0123-v1 + - scs-0123-v2 - scs-0302-v1 - version: v5.1 # copy of v5, but with include "scs-0123-v1", which had simply been forgotten stabilized_at: 2024-12-19 From 58e3c86c8002ad4be599fece927aa0177c5b6598 Mon Sep 17 00:00:00 2001 From: Friedrich Zahn Date: Tue, 2 Jun 2026 15:24:02 +0200 Subject: [PATCH 3/4] Move to v2 Signed-off-by: Friedrich Zahn --- ...1-mandatory-and-supported-IaaS-services.md | 40 +++++++---- Standards/scs-0123-v2-services.md | 71 +++++++++++++++++++ ...-supported-IaaS-services-implementation.md | 3 +- 3 files changed, 98 insertions(+), 16 deletions(-) create mode 100644 Standards/scs-0123-v2-services.md diff --git a/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md b/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md index 9d67d9e31..a1d798922 100644 --- a/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md +++ b/Standards/scs-0123-v1-mandatory-and-supported-IaaS-services.md @@ -26,10 +26,9 @@ Any unsupported APIs will not be tested. ## Mandatory IaaS APIs -The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services. -The endpoints of services MUST be findable through the `catalog list` of the identity API[^1]. +The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services: -| Mandatory API service type | corresponding OpenStack Service | description | +| Mandatory API | corresponding OpenStack Service | description | |-----|-----|-----| | **block-storage** | Cinder | Block Storage service | | **compute** | Nova | Compute service | @@ -37,26 +36,35 @@ The endpoints of services MUST be findable through the `catalog list` of the ide | **image** | Glance | Image service | | **load-balancer** | Octavia | Load-balancer service | | **network** | Neutron | Networking service | -| **s3**[^2] | N/A | s3 compatible Object Storage service | +| **s3** | S3 API object storage | Object Storage service | + +:::caution + +S3 API implementations may differ in certain offered features. +CSPs must publicly describe the endpoints of their S3 solutions and which implementations they use in their deployment. +Users should always research whether a needed feature is supported in the offered implementation. -Aliases for these service types are only permitted where defined by the [OpenStack Service Type Authority](https://specs.openstack.org/openstack/service-types-authority/#aliases-optional). -Catalog entries SHOULD use the canonical service type, not aliases. +::: + +The endpoints of services MUST be findable through the `catalog list` of the identity API[^1]. + +[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html) ## Supported IaaS APIs -The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented through the corresponding OpenStack services, and are considered in the SCS standards. +The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented thorugh the corresponding OpenStack services, and are considered in the SCS standards. -| Supported API service type | corresponding OpenStack Service | description | +| Supported API | corresponding OpenStack Service | description | |-----|-----|-----| -| **baremetal** | Ironic | Bare Metal provisioning service | -| **rating** | CloudKitty | Rating/Billing service | +| **bare-metal** | Ironic | Bare Metal provisioning service | +| **billing** | CloudKitty | Rating/Billing service | | **dns** | Designate | DNS service | -| **instance-ha** | Masakari | Instances High Availability service | +| **ha** | Masakari | Instances High Availability service | | **key-manager** | Barbican | Key Manager service | | **object-store** | Swift | Object Store with different possible backends | | **orchestration** | Heat | Orchestration service | -| **shared-file-system** | Manila | Shared File Systems service | -| **time-series-database**[^2] | Gnocchi | Time Series Database service | +| **shared-file-systems** | Manila | Shared File Systems service | +| **time-series-database** | Gnocchi | Time Series Database service | ## Unsupported IaaS APIs @@ -68,5 +76,7 @@ The SCS standard offers no guarantees for compatibility or reliability of servic [The OpenStack Services](https://www.openstack.org/software/) -[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html) -[^2]: These service types have not been assigned by the OpenStack Service Type Authority +## Conformance Tests + +The presence of the mandatory OpenStack APIs will be tested in [this test-script](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/scs_0123_mandatory_services/mandatory_services.py) +The test will further check whether the object-store endpoint is compatible to s3. diff --git a/Standards/scs-0123-v2-services.md b/Standards/scs-0123-v2-services.md new file mode 100644 index 000000000..48da45aa0 --- /dev/null +++ b/Standards/scs-0123-v2-services.md @@ -0,0 +1,71 @@ +--- +title: Mandatory and Supported IaaS Services +type: Standard +status: Draft +track: IaaS +--- + +## Introduction + +To be SCS-compliant a Cloud Service Provider (CSP) has to fulfill all SCS standards. +Some of those standards are broad and consider all APIs of all services on the IaaS-Layer like the consideration of a [role standard](https://github.com/SovereignCloudStack/issues/issues/396). +There exist many services on that layer and for a first step they need to be limited to have a clear scope for the standards and the Cloud Service Providers following them. +For this purpose, this standard will establish lists for mandatory services whose APIs have to be present in a SCS cloud as well as supported services, which APIs are considered by some standards and may even be tested for their integration but are optional in a sense that their omission will not violate SCS conformance. + +## Motivation + +There are many OpenStack APIs and their corresponding services that can be deployed on the IaaS level. +These services have differences in the quality of their implementation and liveness and some of them may be easily omitted when creating an IaaS deployment. +To fulfill all SCS-provided standards only a subset of these APIs are required. +Some more but not all remaining OpenStack APIs are also supported additionally by the SCS project and may be part of its reference implementation. +This results in different levels of support for specific services. +This document will give readers insight about how the SCS classifies the OpenStack APIs accordingly. +If a cloud provides all mandatory and any number of supported OpenStack APIs, it can be tested for SCS-compliance. +Any unsupported APIs will not be tested. + +## Mandatory IaaS APIs + +The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services. +The endpoints of services MUST be findable through the `catalog list` of the identity API[^1]. + +| Mandatory API service type | corresponding OpenStack Service | description | +|-----|-----|-----| +| **block-storage** | Cinder | Block Storage service | +| **compute** | Nova | Compute service | +| **identity** | Keystone | Identity service | +| **image** | Glance | Image service | +| **load-balancer** | Octavia | Load-balancer service | +| **network** | Neutron | Networking service | +| **s3**[^2] | N/A | s3 compatible Object Storage service | + +Aliases for these service types are only permitted where defined by the [OpenStack Service Type Authority](https://specs.openstack.org/openstack/service-types-authority/#aliases-optional). +Catalog entries SHOULD use the canonical service type, not aliases. + +## Supported IaaS APIs + +The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented through the corresponding OpenStack services, and are considered in the SCS standards. + +| Supported API service type | corresponding OpenStack Service | description | +|-----|-----|-----| +| **baremetal** | Ironic | Bare Metal provisioning service | +| **rating** | CloudKitty | Rating/Billing service | +| **dns** | Designate | DNS service | +| **instance-ha** | Masakari | Instances High Availability service | +| **key-manager** | Barbican | Key Manager service | +| **object-store** | Swift | Object Store with different possible backends | +| **orchestration** | Heat | Orchestration service | +| **shared-file-system** | Manila | Shared File Systems service | +| **time-series-database**[^2] | Gnocchi | Time Series Database service | + +## Unsupported IaaS APIs + +All other OpenStack services, whose APIs are not mentioned in the mandatory or supported lists will not be tested for their compatibility and conformance in SCS clouds by the SCS community. +Those services MAY be integrated into IaaS deployments by a Cloud Service Provider on their own responsibility but SCS will not assume they are present and potential issues that occur during deployment or usage have to be handled by the CSP on their own accord. +The SCS standard offers no guarantees for compatibility or reliability of services categorized as unsupported. + +## Related Documents + +[The OpenStack Services](https://www.openstack.org/software/) + +[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html) +[^2]: These service types have not been assigned by the OpenStack Service Type Authority diff --git a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md index 4fe636289..ea3caca1f 100644 --- a/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md +++ b/Standards/scs-0123-w1-mandatory-and-supported-IaaS-services-implementation.md @@ -16,6 +16,7 @@ the following testcases in accordance with the standard: - `scs-0123-storage-apis` ensures that a service of one of the following types can be found: "volume", "volumev3", "block-storage" ### Deprecated tests + #### v1 only -- `scs-0123-swift-s3` ensures that S3 can be used to access object storage using EC2 credentials from the identity API +- `scs-0123-swift-s3` ensures that S3 can be used to access object storage using EC2 credentials from the identity API From 4af7a97e6a8dffa022b05975ca25ee75fae1fac8 Mon Sep 17 00:00:00 2001 From: Friedrich Zahn Date: Wed, 3 Jun 2026 09:27:50 +0200 Subject: [PATCH 4/4] Use object-store-s3 as s3 service type As proposed by @garloff and @fzakfeld in #1004. Signed-off-by: Friedrich Zahn --- Standards/scs-0123-v2-services.md | 2 +- Tests/iaas/openstack_test.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Standards/scs-0123-v2-services.md b/Standards/scs-0123-v2-services.md index 48da45aa0..424246c7d 100644 --- a/Standards/scs-0123-v2-services.md +++ b/Standards/scs-0123-v2-services.md @@ -36,7 +36,7 @@ The endpoints of services MUST be findable through the `catalog list` of the ide | **image** | Glance | Image service | | **load-balancer** | Octavia | Load-balancer service | | **network** | Neutron | Networking service | -| **s3**[^2] | N/A | s3 compatible Object Storage service | +| **object-store-s3**[^2] | N/A | s3 compatible Object Storage service | Aliases for these service types are only permitted where defined by the [OpenStack Service Type Authority](https://specs.openstack.org/openstack/service-types-authority/#aliases-optional). Catalog entries SHOULD use the canonical service type, not aliases. diff --git a/Tests/iaas/openstack_test.py b/Tests/iaas/openstack_test.py index 081febb16..56cffcd97 100755 --- a/Tests/iaas/openstack_test.py +++ b/Tests/iaas/openstack_test.py @@ -150,7 +150,7 @@ def make_container(cloud): c.add_function('scs_0123_service_load_balancer', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'load-balancer')) c.add_function('scs_0123_service_placement', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'placement')) c.add_function('scs_0123_storage_apis', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'volume', 'volumev3', 'block-storage')) - c.add_function('scs_0123_service_s3', lambda c: compute_scs_0123_service_presence(c.services_lookup, 's3')) + c.add_function('scs_0123_service_s3', lambda c: compute_scs_0123_service_presence(c.services_lookup, 'object-store-s3')) c.add_function('scs_0123_swift_s3', lambda c: compute_scs_0123_swift_s3(c.services_lookup, c.conn)) return c