diff --git a/Standards/scs-0100-v3-flavor-naming.md b/Standards/scs-0100-v3-flavor-naming.md index 336bc0d14..1dcee00b7 100644 --- a/Standards/scs-0100-v3-flavor-naming.md +++ b/Standards/scs-0100-v3-flavor-naming.md @@ -171,8 +171,6 @@ If memory is oversubscribed, you must expose this with the `o` suffix. ### [OPTIONAL] Disk sizes and types -Disk sizes (in GB) should use sizes 5, 10, 20, 50, 100, 200, 500, 1000. - | Disk type | Meaning | | --------- | ------------------------------------ | | n | Network shared storage (ceph/cinder) | diff --git a/Standards/scs-0101-v1-entropy.md b/Standards/scs-0101-v1-entropy.md index 2b719079f..afc6437af 100644 --- a/Standards/scs-0101-v1-entropy.md +++ b/Standards/scs-0101-v1-entropy.md @@ -15,6 +15,8 @@ description: | ## Introduction +This is v1.1 of the standard. See section on version history for details. + ### Entropy in information technology Entropy is a concept that is widely used in the scope of information @@ -39,7 +41,7 @@ bus timings, or keyboard timings, to name a few. _More recent methods_ of generating entropy include measuring IRQ jitter (available in Linux since kernel 5.4 or, before that, via a daemon such as -[HavegeD](http://www.issihosts.com/haveged/)) as well as dedicated CPU +[HavegeD](https://github.com/jirka-h/haveged)) as well as dedicated CPU instructions (available in virtually all major CPUs: RDSEED or RDRAND on x86_64 and RNDR on arm64). @@ -94,39 +96,15 @@ will be available in virtual instances. ## Entropy in SCS clouds -### Flavors - -It is recommended that all flavors have the following attribute: - -```console -hw_rng:allowed=True -``` - -The following attributes are optional: - -```console -hw_rng:rate_bytes - The allowed amount of bytes for the the guest - to read from the host's entropy per period. -hw_rng:rate_period - Sets the duration of a read period in seconds. -``` - -### Images - It is recommended to use images having a kernel (patch level) version 5.18 or up. This condition is already satisfied by every mandatory image defined in the [Image Metadata Standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0102-v1-image-metadata.md). -It is recommended that images activate the attribute `hw_rng_model: virtio`. - -The daemon `rngd` must be installed (usually from `rng-tools` -or `rng-utils`). - -The user may choose to use the `virtio-rng` device via `rngd`. - -### Compute nodes - Compute nodes must use CPUs that offer instructions for accessing entropy (such as RDSEED or RDRAND on x86_64 or RNDR on arm64), and these instructions may not be filtered by the hypervisor. -Compute nodes may provide a HRNG via `rngd`. +## Version history + +As of version 1.1, the method of injecting entropy into a VM using a +virtualized HRNG together with `rngd` is no longer recommended. diff --git a/Standards/scs-0101-w1-entropy-implementation-testing.md b/Standards/scs-0101-w1-entropy-implementation-testing.md index 2b318267a..4761ce405 100644 --- a/Standards/scs-0101-w1-entropy-implementation-testing.md +++ b/Standards/scs-0101-w1-entropy-implementation-testing.md @@ -12,24 +12,16 @@ With reasonably recent hardware—x86 CPU with RDRAND/RDSEED (Intel from 2012, AMD from 2015) or ARM CPU with FEAT_RNG or FEAT_RNG_TRAP—and recent VM image—Linux kernel 5.18 or higher—, there is (almost) nothing to be done. -Only the flavor and image attributes required by the standard have to be set: - -- flavor extra_spec: `hw_rng:allowed=True` , -- image property: `hw_rng_model: virtio` . - ## Automated tests The following testcases [are implemented](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/openstack_test.py): -- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`, -- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`, -- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM, - `scs-0101-entropy-avail` ensures that the special file `/proc/sys/kernel/random/entropy_avail` contains the value 256 (pinned since kernel 5.18) on a sample VM, - `scs-0101-fips-test` ensures that the number of FIPS 140-2 failures is below 5 out of 1000 blocks tested, as determined by `cat /dev/random | rngtest -c 1000` on a sample VM. -Note: The latter two items act as surrogates for the following item, which +These testcases act as surrogates for the following item, which cannot be detected directly: - CPU instructions for accessing entropy are available to the VMs. diff --git a/Tests/iaas/openstack_test.py b/Tests/iaas/openstack_test.py index 8a69c92b8..dd5cef2ef 100755 --- a/Tests/iaas/openstack_test.py +++ b/Tests/iaas/openstack_test.py @@ -18,8 +18,7 @@ from scs_0100_flavor_naming.flavor_names_check import \ compute_scs_flavors, compute_scs_0100_syntax_check, compute_scs_0100_semantics_check from scs_0101_entropy.entropy_check import \ - compute_scs_0101_image_property, compute_scs_0101_flavor_property, compute_canonical_image, \ - compute_collected_vm_output, compute_scs_0101_entropy_avail, compute_scs_0101_rngd, \ + compute_canonical_image, compute_collected_vm_output, compute_scs_0101_entropy_avail, \ compute_scs_0101_fips_test from scs_0102_image_metadata.image_metadata import \ compute_scs_0102_prop_architecture, compute_scs_0102_prop_hash_algo, compute_scs_0102_prop_min_disk, \ @@ -73,10 +72,7 @@ def make_container(cloud): # scs_0101_entropy c.add_function('canonical_image', lambda c: compute_canonical_image(c.images)) c.add_function('collected_vm_output', lambda c: compute_collected_vm_output(c.conn, c.flavors, c.canonical_image)) - c.add_function('scs_0101_image_property', lambda c: compute_scs_0101_image_property(c.images)) - c.add_function('scs_0101_flavor_property', lambda c: compute_scs_0101_flavor_property(c.flavors)) c.add_function('scs_0101_entropy_avail', lambda c: compute_scs_0101_entropy_avail(c.collected_vm_output, c.canonical_image.name)) - c.add_function('scs_0101_rngd', lambda c: compute_scs_0101_rngd(c.collected_vm_output, c.canonical_image.name)) c.add_function('scs_0101_fips_test', lambda c: compute_scs_0101_fips_test(c.collected_vm_output, c.canonical_image.name)) # scs_0102_image_metadata c.add_function('scs_0102_prop_architecture', lambda c: compute_scs_0102_prop_architecture(c.images)) diff --git a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py index 9bbab493b..3269d8c36 100644 --- a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py +++ b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py @@ -15,7 +15,6 @@ parsers=(flavor_names.parser_v3, ), tolerated_parsers=(flavor_names.parser_v2, flavor_names.parser_v1), ) -ACC_DISK = (0, 5, 10, 20, 50, 100, 200, 500, 1000, 2000, 5000, 10000, 20000, 50000, 100000) def compute_scs_flavors(flavors: typing.List[openstack.compute.v2.flavor.Flavor], parser=STRATEGY) -> list: @@ -65,20 +64,18 @@ def compute_scs_0100_semantics_check(scs_flavors: list) -> bool: elif flv.vcpus > cpuram.cpus: logger.info(f"Flavor {flv.name} CPU underpromise: {flv.vcpus} > {cpuram.cpus}") # RAM + advram = cpuram.ram # advertised RAM flvram = int((flv.ram + 51) / 102.4) / 10 # Warn for strange sizes (want integer numbers, half allowed for < 10GiB) - if flvram >= 10 and flvram != int(flvram) or flvram * 2 != int(flvram * 2): - logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {flvram:.1f} GiB") - if flvram < cpuram.ram: - logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {cpuram.ram:.1f}") + if advram >= 10 and advram != int(advram) or advram * 2 != int(advram * 2): + logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {advram:.1f} GiB") + if flvram < advram: + logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {advram:.1f}") problems.add(flv.name) - elif flvram > cpuram.ram: - logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {cpuram.ram:.1f}") + elif flvram > advram: + logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {advram:.1f}") # Disk could have been omitted disksize = flavorname.disk.disksize if flavorname.disk else 0 - # We have a recommendation for disk size steps - if disksize not in ACC_DISK: - logger.info(f"Flavor {flv.name} non-standard disk size {disksize}, should have (5, 10, 20, 50, 100, 200, ...)") if flv.disk < disksize: logger.error(f"Flavor {flv.name} disk overpromise {flv.disk} < {disksize}") problems.add(flv.name) diff --git a/Tests/iaas/scs_0101_entropy/entropy_check.py b/Tests/iaas/scs_0101_entropy/entropy_check.py index 94d7cb006..f76225e48 100644 --- a/Tests/iaas/scs_0101_entropy/entropy_check.py +++ b/Tests/iaas/scs_0101_entropy/entropy_check.py @@ -17,18 +17,6 @@ SECURITY_GROUP_NAME = "_scs-0101-group" KEYPAIR_NAME = "_scs-0101-keypair" -IMAGE_ATTRIBUTES = { - # https://docs.openstack.org/glance/2023.1/admin/useful-image-properties.html#image-property-keys-and-values - # type: str - "hw_rng_model": "virtio", -} -FLAVOR_ATTRIBUTES = { - # https://docs.openstack.org/nova/2023.1/configuration/extra-specs.html#hw-rng - # type: bool - "hw_rng:allowed": "True", # testing showed that it is indeed a string? -} -FLAVOR_OPTIONAL = ("hw_rng:rate_bytes", "hw_rng:rate_period") - TIMEOUT = 5 * 60 # timeout in seconds after which we no longer wait for the VM to complete the run MARKER = '_scs-test-' @@ -70,38 +58,6 @@ } -def compute_scs_0101_image_property(images, attributes=IMAGE_ATTRIBUTES): - """This test ensures that each image has the relevant properties.""" - candidates = [ - (image.name, [f"{key}={value}" for key, value in attributes.items() if image.get(key) != value]) - for image in images - ] - # drop those candidates that are fine - offenders = [candidate for candidate in candidates if candidate[1]] - for name, wrong in offenders: - logger.error(f"Image '{name}' missing attributes: {', '.join(wrong)}") - return not offenders - - -def compute_scs_0101_flavor_property(flavors, attributes=FLAVOR_ATTRIBUTES, optional=FLAVOR_OPTIONAL): - """This test ensures that each flavor has the relevant extra_spec.""" - offenses = 0 - for flavor in flavors: - extra_specs = flavor['extra_specs'] - wrong = [f"{key}={value}" for key, value in attributes.items() if extra_specs.get(key) != value] - miss_opt = [key for key in optional if extra_specs.get(key) is None] - if wrong: - offenses += 1 - message = f"Flavor '{flavor.name}' missing attributes: {', '.join(wrong)}" - # only report missing optional attributes if main ones are missing as well - # reasoning here is that these optional attributes are merely a hint for implementers - # and if the main ones are present, we assume that implementers have done their job already - if miss_opt: - message += f"; additionally, missing optional attributes: {', '.join(miss_opt)}" - logger.error(message) - return not offenses - - def compute_scs_0101_entropy_avail(collected_vm_output, image_name): """This test ensures that the `entropy_avail` value is correct for a test VM.""" lines = collected_vm_output['entropy-avail'] @@ -115,15 +71,6 @@ def compute_scs_0101_entropy_avail(collected_vm_output, image_name): return True -def compute_scs_0101_rngd(collected_vm_output, image_name): - """This test ensures that the `rngd` service is running on a test VM.""" - lines = collected_vm_output['rngd'] - if "could not be found" in '\n'.join(lines): - logger.error(f"VM '{image_name}' doesn't provide service rngd") - return False - return True - - def compute_scs_0101_fips_test(collected_vm_output, image_name): """This test ensures that the 'fips test' via `rngtest` is passed on a test VM.""" lines = collected_vm_output['fips-test'] diff --git a/Tests/scs-compatible-iaas.yaml b/Tests/scs-compatible-iaas.yaml index 32f2621da..42f68be0d 100644 --- a/Tests/scs-compatible-iaas.yaml +++ b/Tests/scs-compatible-iaas.yaml @@ -304,20 +304,13 @@ modules: - scs-0100-syntax-check - scs-0100-semantics-check - id: scs-0101-v1 - name: Entropy v1 + # leap from v1 to v1.1 in place because it's a very minor relaxation; all essential testcases are kept + name: Entropy v1.1 url: https://docs.scs.community/standards/scs-0101-v1-entropy targets: main: - - scs-0101-rngd - scs-0101-entropy-avail - scs-0101-fips-test - - id: scs-0101-v1-rec - name: Entropy v1 - url: https://docs.scs.community/standards/scs-0101-v1-entropy - targets: - recommended: - - scs-0101-flavor-property - - scs-0101-image-property - id: scs-0102-v1 name: Image metadata v1 url: https://docs.scs.community/standards/scs-0102-v1-image-metadata