From 860bfd4fe24e06e3a1c04444fb3ae905edf85099 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Thu, 4 Jun 2026 16:50:30 +0200 Subject: [PATCH 1/7] Simplify scs-0101-v1 to remove gratuitous regulation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- Standards/scs-0101-v1-entropy.md | 13 +++++-------- ...scs-0101-w1-entropy-implementation-testing.md | 16 +++++++--------- Tests/scs-compatible-iaas.yaml | 10 +--------- 3 files changed, 13 insertions(+), 26 deletions(-) diff --git a/Standards/scs-0101-v1-entropy.md b/Standards/scs-0101-v1-entropy.md index 2b719079f..dc7f44c70 100644 --- a/Standards/scs-0101-v1-entropy.md +++ b/Standards/scs-0101-v1-entropy.md @@ -96,15 +96,11 @@ will be available in virtual instances. ### Flavors -It is recommended that all flavors have the following attribute: +The following optional flavor extra_specs are relevant in case an +external HRNG is to be used: ```console hw_rng:allowed=True -``` - -The following attributes are optional: - -```console hw_rng:rate_bytes - The allowed amount of bytes for the the guest to read from the host's entropy per period. hw_rng:rate_period - Sets the duration of a read period in seconds. @@ -116,9 +112,10 @@ It is recommended to use images having a kernel (patch level) version 5.18 or up. This condition is already satisfied by every mandatory image defined in the [Image Metadata Standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0102-v1-image-metadata.md). -It is recommended that images activate the attribute `hw_rng_model: virtio`. +An image may activate the attribute `hw_rng_model: virtio` so +that an external HRNG can be used. -The daemon `rngd` must be installed (usually from `rng-tools` +The daemon `rngd` may be installed (usually from `rng-tools` or `rng-utils`). The user may choose to use the `virtio-rng` device via `rngd`. diff --git a/Standards/scs-0101-w1-entropy-implementation-testing.md b/Standards/scs-0101-w1-entropy-implementation-testing.md index 2b318267a..63c151c35 100644 --- a/Standards/scs-0101-w1-entropy-implementation-testing.md +++ b/Standards/scs-0101-w1-entropy-implementation-testing.md @@ -12,24 +12,16 @@ With reasonably recent hardware—x86 CPU with RDRAND/RDSEED (Intel from 2012, AMD from 2015) or ARM CPU with FEAT_RNG or FEAT_RNG_TRAP—and recent VM image—Linux kernel 5.18 or higher—, there is (almost) nothing to be done. -Only the flavor and image attributes required by the standard have to be set: - -- flavor extra_spec: `hw_rng:allowed=True` , -- image property: `hw_rng_model: virtio` . - ## Automated tests The following testcases [are implemented](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/openstack_test.py): -- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`, -- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`, -- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM, - `scs-0101-entropy-avail` ensures that the special file `/proc/sys/kernel/random/entropy_avail` contains the value 256 (pinned since kernel 5.18) on a sample VM, - `scs-0101-fips-test` ensures that the number of FIPS 140-2 failures is below 5 out of 1000 blocks tested, as determined by `cat /dev/random | rngtest -c 1000` on a sample VM. -Note: The latter two items act as surrogates for the following item, which +These testcases act as surrogates for the following item, which cannot be detected directly: - CPU instructions for accessing entropy are available to the VMs. @@ -39,6 +31,12 @@ checked, because of two reasons: (a) we already check the file `entropy_avail` (see subsection on Errors), and (b) users can always choose a recent image, as ensured by the image metadata standard. +Three further testcases are available, but currently unused: + +- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`, +- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`, +- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM. + ## Manual tests None. diff --git a/Tests/scs-compatible-iaas.yaml b/Tests/scs-compatible-iaas.yaml index c652f78cd..9e66ebfe9 100644 --- a/Tests/scs-compatible-iaas.yaml +++ b/Tests/scs-compatible-iaas.yaml @@ -308,16 +308,8 @@ modules: url: https://docs.scs.community/standards/scs-0101-v1-entropy targets: main: - - scs-0101-rngd - scs-0101-entropy-avail - scs-0101-fips-test - - id: scs-0101-v1-rec - name: Entropy v1 - url: https://docs.scs.community/standards/scs-0101-v1-entropy - targets: - recommended: - - scs-0101-flavor-property - - scs-0101-image-property - id: scs-0102-v1 name: Image metadata v1 url: https://docs.scs.community/standards/scs-0102-v1-image-metadata @@ -580,7 +572,7 @@ versions: include: - opc-v2022.11 - scs-0100-v3.1 - - scs-0101-v1 + # - scs-0101-v1 remove this because it hasn't been an issue for quite a while - scs-0102-v2 # instead of scs-0102-v1 - scs-0103-v1 - ref: scs-0104-v1-2 From 6e61513ed5e3fdcd7d0ea9fd39c5c27ec22507b3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Thu, 4 Jun 2026 16:58:20 +0200 Subject: [PATCH 2/7] Simplify scs-0100-v3 to remove gratuitous regulation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Moreover, fix uneven number test to check on advertised RAM instead of actual RAM Signed-off-by: Matthias Büchse --- Standards/scs-0100-v3-flavor-naming.md | 2 -- .../scs_0100_flavor_naming/flavor_names_check.py | 16 +++++++--------- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/Standards/scs-0100-v3-flavor-naming.md b/Standards/scs-0100-v3-flavor-naming.md index 336bc0d14..1dcee00b7 100644 --- a/Standards/scs-0100-v3-flavor-naming.md +++ b/Standards/scs-0100-v3-flavor-naming.md @@ -171,8 +171,6 @@ If memory is oversubscribed, you must expose this with the `o` suffix. ### [OPTIONAL] Disk sizes and types -Disk sizes (in GB) should use sizes 5, 10, 20, 50, 100, 200, 500, 1000. - | Disk type | Meaning | | --------- | ------------------------------------ | | n | Network shared storage (ceph/cinder) | diff --git a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py index 9bbab493b..a53f226eb 100644 --- a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py +++ b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py @@ -65,20 +65,18 @@ def compute_scs_0100_semantics_check(scs_flavors: list) -> bool: elif flv.vcpus > cpuram.cpus: logger.info(f"Flavor {flv.name} CPU underpromise: {flv.vcpus} > {cpuram.cpus}") # RAM + advram = cpuram.ram # advertised RAM flvram = int((flv.ram + 51) / 102.4) / 10 # Warn for strange sizes (want integer numbers, half allowed for < 10GiB) - if flvram >= 10 and flvram != int(flvram) or flvram * 2 != int(flvram * 2): - logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {flvram:.1f} GiB") - if flvram < cpuram.ram: - logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {cpuram.ram:.1f}") + if advram >= 10 and advram != int(advram) or advram * 2 != int(advram * 2): + logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {advram:.1f} GiB") + if flvram < advram: + logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {advram:.1f}") problems.add(flv.name) - elif flvram > cpuram.ram: - logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {cpuram.ram:.1f}") + elif flvram > advram: + logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {advram:.1f}") # Disk could have been omitted disksize = flavorname.disk.disksize if flavorname.disk else 0 - # We have a recommendation for disk size steps - if disksize not in ACC_DISK: - logger.info(f"Flavor {flv.name} non-standard disk size {disksize}, should have (5, 10, 20, 50, 100, 200, ...)") if flv.disk < disksize: logger.error(f"Flavor {flv.name} disk overpromise {flv.disk} < {disksize}") problems.add(flv.name) From b720296f544b7d66a854e2e0af81156805d2f2cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Thu, 4 Jun 2026 17:00:19 +0200 Subject: [PATCH 3/7] Remove unused code for entropy check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- ...-0101-w1-entropy-implementation-testing.md | 6 --- Tests/iaas/openstack_test.py | 6 +-- Tests/iaas/scs_0101_entropy/entropy_check.py | 53 ------------------- 3 files changed, 1 insertion(+), 64 deletions(-) diff --git a/Standards/scs-0101-w1-entropy-implementation-testing.md b/Standards/scs-0101-w1-entropy-implementation-testing.md index 63c151c35..4761ce405 100644 --- a/Standards/scs-0101-w1-entropy-implementation-testing.md +++ b/Standards/scs-0101-w1-entropy-implementation-testing.md @@ -31,12 +31,6 @@ checked, because of two reasons: (a) we already check the file `entropy_avail` (see subsection on Errors), and (b) users can always choose a recent image, as ensured by the image metadata standard. -Three further testcases are available, but currently unused: - -- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`, -- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`, -- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM. - ## Manual tests None. diff --git a/Tests/iaas/openstack_test.py b/Tests/iaas/openstack_test.py index 56cffcd97..d8ea9cd9e 100755 --- a/Tests/iaas/openstack_test.py +++ b/Tests/iaas/openstack_test.py @@ -18,8 +18,7 @@ from scs_0100_flavor_naming.flavor_names_check import \ compute_scs_flavors, compute_scs_0100_syntax_check, compute_scs_0100_semantics_check from scs_0101_entropy.entropy_check import \ - compute_scs_0101_image_property, compute_scs_0101_flavor_property, compute_canonical_image, \ - compute_collected_vm_output, compute_scs_0101_entropy_avail, compute_scs_0101_rngd, \ + compute_canonical_image, compute_collected_vm_output, compute_scs_0101_entropy_avail, \ compute_scs_0101_fips_test from scs_0102_image_metadata.image_metadata import \ compute_scs_0102_prop_architecture, compute_scs_0102_prop_hash_algo, compute_scs_0102_prop_min_disk, \ @@ -73,10 +72,7 @@ def make_container(cloud): # scs_0101_entropy c.add_function('canonical_image', lambda c: compute_canonical_image(c.images)) c.add_function('collected_vm_output', lambda c: compute_collected_vm_output(c.conn, c.flavors, c.canonical_image)) - c.add_function('scs_0101_image_property', lambda c: compute_scs_0101_image_property(c.images)) - c.add_function('scs_0101_flavor_property', lambda c: compute_scs_0101_flavor_property(c.flavors)) c.add_function('scs_0101_entropy_avail', lambda c: compute_scs_0101_entropy_avail(c.collected_vm_output, c.canonical_image.name)) - c.add_function('scs_0101_rngd', lambda c: compute_scs_0101_rngd(c.collected_vm_output, c.canonical_image.name)) c.add_function('scs_0101_fips_test', lambda c: compute_scs_0101_fips_test(c.collected_vm_output, c.canonical_image.name)) # scs_0102_image_metadata c.add_function('scs_0102_prop_architecture', lambda c: compute_scs_0102_prop_architecture(c.images)) diff --git a/Tests/iaas/scs_0101_entropy/entropy_check.py b/Tests/iaas/scs_0101_entropy/entropy_check.py index 7405463fe..965abd353 100644 --- a/Tests/iaas/scs_0101_entropy/entropy_check.py +++ b/Tests/iaas/scs_0101_entropy/entropy_check.py @@ -17,18 +17,6 @@ SECURITY_GROUP_NAME = "_scs-0101-group" KEYPAIR_NAME = "_scs-0101-keypair" -IMAGE_ATTRIBUTES = { - # https://docs.openstack.org/glance/2023.1/admin/useful-image-properties.html#image-property-keys-and-values - # type: str - "hw_rng_model": "virtio", -} -FLAVOR_ATTRIBUTES = { - # https://docs.openstack.org/nova/2023.1/configuration/extra-specs.html#hw-rng - # type: bool - "hw_rng:allowed": "True", # testing showed that it is indeed a string? -} -FLAVOR_OPTIONAL = ("hw_rng:rate_bytes", "hw_rng:rate_period") - TIMEOUT = 5 * 60 # timeout in seconds after which we no longer wait for the VM to complete the run MARKER = '_scs-test-' @@ -70,38 +58,6 @@ } -def compute_scs_0101_image_property(images, attributes=IMAGE_ATTRIBUTES): - """This test ensures that each image has the relevant properties.""" - candidates = [ - (image.name, [f"{key}={value}" for key, value in attributes.items() if image.get(key) != value]) - for image in images - ] - # drop those candidates that are fine - offenders = [candidate for candidate in candidates if candidate[1]] - for name, wrong in offenders: - logger.error(f"Image '{name}' missing attributes: {', '.join(wrong)}") - return not offenders - - -def compute_scs_0101_flavor_property(flavors, attributes=FLAVOR_ATTRIBUTES, optional=FLAVOR_OPTIONAL): - """This test ensures that each flavor has the relevant extra_spec.""" - offenses = 0 - for flavor in flavors: - extra_specs = flavor['extra_specs'] - wrong = [f"{key}={value}" for key, value in attributes.items() if extra_specs.get(key) != value] - miss_opt = [key for key in optional if extra_specs.get(key) is None] - if wrong: - offenses += 1 - message = f"Flavor '{flavor.name}' missing attributes: {', '.join(wrong)}" - # only report missing optional attributes if main ones are missing as well - # reasoning here is that these optional attributes are merely a hint for implementers - # and if the main ones are present, we assume that implementers have done their job already - if miss_opt: - message += f"; additionally, missing optional attributes: {', '.join(miss_opt)}" - logger.error(message) - return not offenses - - def compute_scs_0101_entropy_avail(collected_vm_output, image_name): """This test ensures that the `entropy_avail` value is correct for a test VM.""" lines = collected_vm_output['entropy-avail'] @@ -115,15 +71,6 @@ def compute_scs_0101_entropy_avail(collected_vm_output, image_name): return True -def compute_scs_0101_rngd(collected_vm_output, image_name): - """This test ensures that the `rngd` service is running on a test VM.""" - lines = collected_vm_output['rngd'] - if "could not be found" in '\n'.join(lines): - logger.error(f"VM '{image_name}' doesn't provide service rngd") - return False - return True - - def compute_scs_0101_fips_test(collected_vm_output, image_name): """This test ensures that the 'fips test' via `rngtest` is passed on a test VM.""" lines = collected_vm_output['fips-test'] From ed1df2d347ddeb6a9c618753f35c422576e30281 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Thu, 4 Jun 2026 17:15:34 +0200 Subject: [PATCH 4/7] Fix dead link (otherwise unrelated) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- Standards/scs-0101-v1-entropy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Standards/scs-0101-v1-entropy.md b/Standards/scs-0101-v1-entropy.md index dc7f44c70..23226e1d9 100644 --- a/Standards/scs-0101-v1-entropy.md +++ b/Standards/scs-0101-v1-entropy.md @@ -39,7 +39,7 @@ bus timings, or keyboard timings, to name a few. _More recent methods_ of generating entropy include measuring IRQ jitter (available in Linux since kernel 5.4 or, before that, via a daemon such as -[HavegeD](http://www.issihosts.com/haveged/)) as well as dedicated CPU +[HavegeD](https://github.com/jirka-h/haveged)) as well as dedicated CPU instructions (available in virtually all major CPUs: RDSEED or RDRAND on x86_64 and RNDR on arm64). From b731df7c4c0067483ef2e680acb1c8fdb9c9164c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Tue, 16 Jun 2026 16:11:33 +0200 Subject: [PATCH 5/7] Undo removal of scs-0101-v1 from SCS-compatible IaaS 'next' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- Tests/scs-compatible-iaas.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Tests/scs-compatible-iaas.yaml b/Tests/scs-compatible-iaas.yaml index 9e66ebfe9..0a858d176 100644 --- a/Tests/scs-compatible-iaas.yaml +++ b/Tests/scs-compatible-iaas.yaml @@ -572,7 +572,7 @@ versions: include: - opc-v2022.11 - scs-0100-v3.1 - # - scs-0101-v1 remove this because it hasn't been an issue for quite a while + - scs-0101-v1 - scs-0102-v2 # instead of scs-0102-v1 - scs-0103-v1 - ref: scs-0104-v1-2 From db26a35e62ba1e236e87a1fdeba4a1dca69cb215 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Tue, 16 Jun 2026 22:35:24 +0200 Subject: [PATCH 6/7] Introduce v1.1 of scs-0101. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- Standards/scs-0101-v1-entropy.md | 31 ++++++------------------------- Tests/scs-compatible-iaas.yaml | 3 ++- 2 files changed, 8 insertions(+), 26 deletions(-) diff --git a/Standards/scs-0101-v1-entropy.md b/Standards/scs-0101-v1-entropy.md index 23226e1d9..afc6437af 100644 --- a/Standards/scs-0101-v1-entropy.md +++ b/Standards/scs-0101-v1-entropy.md @@ -15,6 +15,8 @@ description: | ## Introduction +This is v1.1 of the standard. See section on version history for details. + ### Entropy in information technology Entropy is a concept that is widely used in the scope of information @@ -94,36 +96,15 @@ will be available in virtual instances. ## Entropy in SCS clouds -### Flavors - -The following optional flavor extra_specs are relevant in case an -external HRNG is to be used: - -```console -hw_rng:allowed=True -hw_rng:rate_bytes - The allowed amount of bytes for the the guest - to read from the host's entropy per period. -hw_rng:rate_period - Sets the duration of a read period in seconds. -``` - -### Images - It is recommended to use images having a kernel (patch level) version 5.18 or up. This condition is already satisfied by every mandatory image defined in the [Image Metadata Standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0102-v1-image-metadata.md). -An image may activate the attribute `hw_rng_model: virtio` so -that an external HRNG can be used. - -The daemon `rngd` may be installed (usually from `rng-tools` -or `rng-utils`). - -The user may choose to use the `virtio-rng` device via `rngd`. - -### Compute nodes - Compute nodes must use CPUs that offer instructions for accessing entropy (such as RDSEED or RDRAND on x86_64 or RNDR on arm64), and these instructions may not be filtered by the hypervisor. -Compute nodes may provide a HRNG via `rngd`. +## Version history + +As of version 1.1, the method of injecting entropy into a VM using a +virtualized HRNG together with `rngd` is no longer recommended. diff --git a/Tests/scs-compatible-iaas.yaml b/Tests/scs-compatible-iaas.yaml index 0a858d176..9fa199811 100644 --- a/Tests/scs-compatible-iaas.yaml +++ b/Tests/scs-compatible-iaas.yaml @@ -304,7 +304,8 @@ modules: - scs-0100-syntax-check - scs-0100-semantics-check - id: scs-0101-v1 - name: Entropy v1 + # leap from v1 to v1.1 in place because it's a very minor relaxation; all essential testcases are kept + name: Entropy v1.1 url: https://docs.scs.community/standards/scs-0101-v1-entropy targets: main: From c04d788f8549ca3fa026a2cf5268c4deb66282cf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Matthias=20B=C3=BCchse?= Date: Tue, 16 Jun 2026 22:39:26 +0200 Subject: [PATCH 7/7] Remove unused constant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Matthias Büchse --- Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py | 1 - 1 file changed, 1 deletion(-) diff --git a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py index a53f226eb..3269d8c36 100644 --- a/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py +++ b/Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py @@ -15,7 +15,6 @@ parsers=(flavor_names.parser_v3, ), tolerated_parsers=(flavor_names.parser_v2, flavor_names.parser_v1), ) -ACC_DISK = (0, 5, 10, 20, 50, 100, 200, 500, 1000, 2000, 5000, 10000, 20000, 50000, 100000) def compute_scs_flavors(flavors: typing.List[openstack.compute.v2.flavor.Flavor], parser=STRATEGY) -> list: