From 25ed65f1fa1d50cf3d5f757736b6cfb506ce402f Mon Sep 17 00:00:00 2001 From: Ivan Pchelintsev Date: Mon, 1 Jun 2020 12:00:50 +0300 Subject: [PATCH] Remove VxFlex OS credentials from connection_properties VxFlex OS password is not stored in block_device_mapping table. Instead of this passwords are stored in separate file and are retrieved during each attach/detach operation. Closes-Bug: #1823200 Change-Id: I3f6bfe360491c295bdb81008c31ad2d4e3305736 --- .../volume/drivers/dell_emc/scaleio/driver.py | 6 +-- .../drivers/dell-emc-vxflex-driver.rst | 49 +++++++++++++++++-- lower-constraints.txt | 2 +- .../bug-1823200-stein-e2d29dacf4cbfdd6.yaml | 25 ++++++++++ requirements.txt | 2 +- 5 files changed, 76 insertions(+), 8 deletions(-) create mode 100644 releasenotes/notes/bug-1823200-stein-e2d29dacf4cbfdd6.yaml diff --git a/cinder/volume/drivers/dell_emc/scaleio/driver.py b/cinder/volume/drivers/dell_emc/scaleio/driver.py index 20e019b32ca..ff331c30c52 100644 --- a/cinder/volume/drivers/dell_emc/scaleio/driver.py +++ b/cinder/volume/drivers/dell_emc/scaleio/driver.py @@ -152,9 +152,10 @@ class ScaleIODriver(driver.VolumeDriver): 2.0.2: Added consistency group support to generic volume groups 2.0.3: Added cache for storage pool and protection domains info 2.0.4: Added compatibility with os_brick>1.15.3 + 2.0.4.1: Fix for Bug #1823200. See OSSN-0086 for details. """ - VERSION = "2.0.4" + VERSION = "2.0.4.1" # ThirdPartySystems wiki CI_WIKI_NAME = "DELL_EMC_ScaleIO_CI" @@ -228,8 +229,7 @@ class ScaleIODriver(driver.VolumeDriver): 'serverIP': self.server_ip, 'serverPort': self.server_port, 'serverUsername': self.server_username, - 'serverPassword': self.server_password, - 'serverToken': self.server_token, + 'config_group': self.configuration.config_group, 'iopsLimit': None, 'bandwidthLimit': None, } diff --git a/doc/source/configuration/block-storage/drivers/dell-emc-vxflex-driver.rst b/doc/source/configuration/block-storage/drivers/dell-emc-vxflex-driver.rst index 12646eab923..e879d93c940 100644 --- a/doc/source/configuration/block-storage/drivers/dell-emc-vxflex-driver.rst +++ b/doc/source/configuration/block-storage/drivers/dell-emc-vxflex-driver.rst @@ -211,6 +211,33 @@ parameters as follows: san_password = SIO_PASSWD san_thin_provision = false +Connector configuration +~~~~~~~~~~~~~~~~~~~~~~~ + +Before using attach/detach volume operations VxFlex OS connector must be +properly configured. On each node where VxFlex OS SDC is installed do the +following: + +#. Create ``/opt/emc/scaleio/openstack/connector.conf`` if it does not + exist. + + .. code-block:: console + + $ mkdir -p /opt/emc/scaleio/openstack + $ touch /opt/emc/scaleio/openstack/connector.conf + +#. For each VxFlex OS section in the ``cinder.conf`` create the same section in + the ``/opt/emc/scaleio/openstack/connector.conf`` and populate it with + passwords. Example: + + .. code-block:: ini + + [vxflexos] + san_password = SIO_PASSWD + + [vxflexos-new] + san_password = SIO2_PASSWD + .. _cg_configuration_options_emc: Configuration options @@ -301,6 +328,22 @@ is attached to an instance, and thus to a compute node/SDC. Using VxFlex OS Storage with a containerized overcloud ------------------------------------------------------ -When using a containerized overcloud, such as one deployed via TripleO or -Red Hat OpenStack version 13 and above, install the Storage Data Client -(SDC) on all nodes after deploying the overcloud. +#. Create a file with below contents: + + .. code-block:: yaml + + parameter_defaults: + NovaComputeOptVolumes: + - /opt/emc/scaleio:/opt/emc/scaleio + CinderVolumeOptVolumes: + - /opt/emc/scaleio:/opt/emc/scaleio + GlanceApiOptVolumes: + - /opt/emc/scaleio:/opt/emc/scaleio + + + Name it whatever you like, e.g. ``vxflexos_volumes.yml``. + +#. Use ``-e`` to include this customization file to deploy command. + +#. Install the Storage Data Client (SDC) on all nodes after deploying + the overcloud. diff --git a/lower-constraints.txt b/lower-constraints.txt index b8c61048430..06f01e21220 100644 --- a/lower-constraints.txt +++ b/lower-constraints.txt @@ -64,7 +64,7 @@ networkx==1.11 oauth2client==1.5.0 openstackdocstheme==1.20.0 os-api-ref==1.4.0 -os-brick==2.2.0 +os-brick==2.8.5 os-client-config==1.29.0 os-win==3.0.0 oslo.cache==1.29.0 diff --git a/releasenotes/notes/bug-1823200-stein-e2d29dacf4cbfdd6.yaml b/releasenotes/notes/bug-1823200-stein-e2d29dacf4cbfdd6.yaml new file mode 100644 index 00000000000..8e6b5e1f351 --- /dev/null +++ b/releasenotes/notes/bug-1823200-stein-e2d29dacf4cbfdd6.yaml @@ -0,0 +1,25 @@ +--- +upgrade: + - | + The fix for `Bug #1823200 + `_ requires + ``os-brick`` >= 2.8.5 but < 2.9.0. +security: + - | + Dell EMC VxFlex OS driver: This release contains a fix for + `Bug #1823200 `_. + See `OSSN-0086 `_ + for details. +fixes: + - | + `Bug #1823200 `_: + This release contains an updated Dell EMC VxFlex OS driver. It must + be used with ``os-brick`` >= 2.8.5 but < 2.9.0. + and requires that a new configuration file be deployed on compute + nodes, cinder nodes, and anywhere you would perform a volume attachment + in your deployment. + See the `Dell EMC VxFlex OS (ScaleIO) Storage driver + `_ + documentation for details about the configuration file, and see + `OSSN-0086 `_ for + more information about the security vulnerability. diff --git a/requirements.txt b/requirements.txt index ea5378f13ab..1e316627f3c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -58,7 +58,7 @@ suds-jurko>=0.6 # LGPLv3+ WebOb>=1.7.1 # MIT oslo.i18n>=3.15.3 # Apache-2.0 oslo.vmware>=2.17.0 # Apache-2.0 -os-brick>=2.2.0 # Apache-2.0 +os-brick>=2.8.5 # Apache-2.0 os-win>=3.0.0 # Apache-2.0 tooz>=1.58.0 # Apache-2.0 google-api-python-client>=1.4.2 # Apache-2.0