From 85ad69e9976b23e4a2c4c63e62c0a7b7ef21d46d Mon Sep 17 00:00:00 2001 From: Goutham Pacha Ravi Date: Sun, 12 Jul 2026 22:05:35 -0700 Subject: [PATCH 1/5] Pull container image from quay.io The container driver's docker image was hosted as a tarball on a personal GitHub account since 2016. Switch to pulling from quay.io/openstack-manila where the image is published by manila-image-elements CI. Also fix import_docker_service_image_ubuntu to handle file:// URLs (copy to $FILES before gunzip) and registry references (docker pull + tag). Change-Id: I6106959f0f2dc894b66f1a2c7b5c4a567fdf72a3 Partial-Bug: #2160440 Signed-off-by: Goutham Pacha Ravi (cherry picked from commit 1334dc19bb4443506b3cd9ba145318ac88d1f35a) (cherry picked from commit 97856941445dccb2055d7c4015c72fcbf05d8282) (cherry picked from commit 1dd89926a295c8267c402c115a1e4dc202443952) --- devstack/plugin.sh | 29 +++++++++++++++++++++-------- devstack/settings | 4 +--- 2 files changed, 22 insertions(+), 11 deletions(-) diff --git a/devstack/plugin.sh b/devstack/plugin.sh index 9babd3e1bf..99bd82da7f 100755 --- a/devstack/plugin.sh +++ b/devstack/plugin.sh @@ -985,14 +985,27 @@ function download_image { } function import_docker_service_image_ubuntu { - GZIPPED_IMG_NAME=`basename "$MANILA_DOCKER_IMAGE_URL"` - IMG_NAME_LOAD=${GZIPPED_IMG_NAME%.*} - LOCAL_IMG_NAME=${IMG_NAME_LOAD%.*} - if [[ "$(sudo docker images -q $LOCAL_IMG_NAME)" == "" ]]; then - download_image $MANILA_DOCKER_IMAGE_URL - # Import image in Docker - gzip -d $FILES/$GZIPPED_IMG_NAME - sudo docker load --input $FILES/$IMG_NAME_LOAD + if [[ $MANILA_DOCKER_IMAGE_URL == *"/"*":"* ]] || [[ $MANILA_DOCKER_IMAGE_URL == *"/"*"/"* ]]; then + # Registry reference (e.g., quay.io/org/image:tag) + if [[ "$(sudo docker images -q $MANILA_DOCKER_IMAGE_URL)" == "" ]]; then + sudo docker pull "$MANILA_DOCKER_IMAGE_URL" + fi + sudo docker tag "$MANILA_DOCKER_IMAGE_URL" manila-docker-container + else + # Tarball URL (http/https/file) + GZIPPED_IMG_NAME=$(basename "$MANILA_DOCKER_IMAGE_URL") + IMG_NAME_LOAD=${GZIPPED_IMG_NAME%.*} + LOCAL_IMG_NAME=${IMG_NAME_LOAD%.*} + if [[ "$(sudo docker images -q $LOCAL_IMG_NAME)" == "" ]]; then + download_image $MANILA_DOCKER_IMAGE_URL + if [[ $MANILA_DOCKER_IMAGE_URL == file* ]]; then + local src_path + src_path=$(echo "$MANILA_DOCKER_IMAGE_URL" | sed "s|^file://||") + cp "$src_path" "$FILES/$GZIPPED_IMG_NAME" + fi + gzip -d "$FILES/$GZIPPED_IMG_NAME" + sudo docker load --input "$FILES/$IMG_NAME_LOAD" + fi fi } diff --git a/devstack/settings b/devstack/settings index 42db48fcf4..98b056b77d 100644 --- a/devstack/settings +++ b/devstack/settings @@ -174,9 +174,7 @@ MANILA_ZFSONLINUX_REPLICATION_DOMAIN=${MANILA_ZFSONLINUX_REPLICATION_DOMAIN:-"ZF MANILA_CONTAINER_DRIVER=${MANILA_CONTAINER_DRIVER:-"manila.share.drivers.container.driver.ContainerShareDriver"} MANILA_DOCKER_IMAGE_ALIAS=${MANILA_DOCKER_IMAGE_ALIAS:-"manila_docker_image"} MANILA_CONTAINER_VOLUME_GROUP_NAME=${MANILA_CONTAINER_VOLUME_GROUP_NAME:-"manila_docker_volumes"} -# (aovchinnikov): This location is temporary and will be changed to a -# permanent one as soon as possible. -MANILA_DOCKER_IMAGE_URL=${MANILA_DOCKER_IMAGE_URL:-"https://github.com/a-ovchinnikov/manila-image-elements-lxd-images/releases/download/0.1.0/manila-docker-container.tar.gz"} +MANILA_DOCKER_IMAGE_URL=${MANILA_DOCKER_IMAGE_URL:-"quay.io/openstack-manila/manila-docker-container:latest"} # Network Plugin MANILA_NETWORK_API_CLASS=${MANILA_NETWORK_API_CLASS:-"manila.network.neutron.neutron_network_plugin.NeutronBindNetworkPlugin"} From 07ca0b1249a1afcced9555f676353486c183cb63 Mon Sep 17 00:00:00 2001 From: Carlos da Silva Date: Wed, 22 Jul 2026 21:00:15 -0300 Subject: [PATCH 2/5] Prevent unauthorized resource locks search The resource locks mechanism allows filtering locks by project UUIDs. This feature is helpful for identifying the locks and letting their users and/or administrators to quickly filter. However, in the current code path, we were allowing unauthorized cross-project visibility into resource locks data for users that were not members, admin or readers of a given project. This change fixes this issue by adding a check to ensure whether the user has authorization to look up resource locks in the project they are supplying as part of the query. Closes-Bug: #2161287 Change-Id: I03eebf6bb951583378340365dbf69122f124ffc8 Signed-off-by: Carlos da Silva (cherry picked from commit 81195700d41ae216602bb508505136f2e0ac0490) --- manila/db/sqlalchemy/api.py | 2 ++ ...vent-unprivileged-locks-filtering-9f40a2f48475429e.yaml | 7 +++++++ 2 files changed, 9 insertions(+) create mode 100644 releasenotes/notes/bug-2161287-prevent-unprivileged-locks-filtering-9f40a2f48475429e.yaml diff --git a/manila/db/sqlalchemy/api.py b/manila/db/sqlalchemy/api.py index 1e71aff27e..67f1a8fe50 100644 --- a/manila/db/sqlalchemy/api.py +++ b/manila/db/sqlalchemy/api.py @@ -7713,6 +7713,8 @@ def resource_lock_get_all(context, filters=None, limit=None, offset=None, all_projects = filters.get('all_projects') or filters.get('all_tenants') if project_id is None and not all_projects: filters['project_id'] = context.project_id + if project_id is not None: + authorize_project_context(context, project_id) legal_filter_keys = ('id', 'user_id', 'resource_id', 'resource_type', 'lock_context', 'resource_action', 'created_since', diff --git a/releasenotes/notes/bug-2161287-prevent-unprivileged-locks-filtering-9f40a2f48475429e.yaml b/releasenotes/notes/bug-2161287-prevent-unprivileged-locks-filtering-9f40a2f48475429e.yaml new file mode 100644 index 0000000000..c3f318e8fb --- /dev/null +++ b/releasenotes/notes/bug-2161287-prevent-unprivileged-locks-filtering-9f40a2f48475429e.yaml @@ -0,0 +1,7 @@ +--- +security: + - | + Manila now prevents resource locks to be filtered by a project UUID in + case the requester is not an admininistrator or a member of the project + they are attempting to look up. For more details, please refer to + `Launchpad bug `. From bfb25c20b2e8257786b32a6f537a4250ea391419 Mon Sep 17 00:00:00 2001 From: sakumbha Date: Thu, 23 Jul 2026 06:08:07 +0000 Subject: [PATCH 3/5] Fix literal string "exc" in _log_share_error() log message The LOG.error call was passing the string literal "exc" instead of the exc variable, causing error logs to never show the actual failure reason from a previous share-create attempt. Closes-Bug: #2161592 Change-Id: Ic2d35329f071986d0264ff62be55c8cada31954c Signed-off-by: sakumbha (cherry picked from commit aeeb0822adfe265ba4b77874989e7bc15770ab7d) (cherry picked from commit 8f68924426b1e7a14a9ee1fbf8831b770cec8f6d) (cherry picked from commit 5d770727aaef9ac737cad5afe520f5c29c0358dc) --- manila/scheduler/drivers/filter.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manila/scheduler/drivers/filter.py b/manila/scheduler/drivers/filter.py index afdaa1ef29..0d059bbac6 100644 --- a/manila/scheduler/drivers/filter.py +++ b/manila/scheduler/drivers/filter.py @@ -340,7 +340,7 @@ def _log_share_error(self, share_id, retry): "%(last_host)s : %(exc)s", { "share_id": share_id, "last_host": last_host, - "exc": "exc" + "exc": exc }) def _populate_scheduler_hint(self, request_spec, hints, key, hint): From e65bdf3eb9af8441fab57e90bfb009c602446edd Mon Sep 17 00:00:00 2001 From: Carlos da Silva Date: Fri, 31 Jul 2026 20:37:59 -0300 Subject: [PATCH 4/5] [2025.1 only] Delete all the grenade jobs from the CI According to [1], all the grenade jobs testing an upgrade to 2025.1 should stop. We're also temporarily converting the LVM driver job to non-voting due to an unrelated bug in the gate. We'll get these voting again shortly [2] [1] https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/O6BSP3MDWOL7JQL7PN3LSBITIQ6MNUQX/ [2] https://review.opendev.org/c/openstack/manila/+/999499 Change-Id: Ieb1da688f01b3a4f5f50a0b234b684a7727b731b Signed-off-by: Carlos da Silva --- zuul.d/grenade-jobs.yaml | 95 ---------------------------------------- zuul.d/project.yaml | 7 ++- 2 files changed, 5 insertions(+), 97 deletions(-) delete mode 100644 zuul.d/grenade-jobs.yaml diff --git a/zuul.d/grenade-jobs.yaml b/zuul.d/grenade-jobs.yaml deleted file mode 100644 index 9eabe83531..0000000000 --- a/zuul.d/grenade-jobs.yaml +++ /dev/null @@ -1,95 +0,0 @@ -- job: - name: manila-grenade - parent: grenade - irrelevant-files: - - ^(test-|)requirements.txt$ - - ^.*\.rst$ - - ^api-ref/.*$ - - ^doc/.*$ - - ^manila/hacking/.*$ - - ^manila/tests/.*$ - - ^\.pre-commit-config\.yaml$ - - ^releasenotes/.*$ - - ^setup.cfg$ - - ^tools/.*$ - - ^tox.ini$ - required-projects: - - openstack/grenade - - openstack/manila - - openstack/python-manilaclient - - openstack/manila-tempest-plugin - vars: - grenade_devstack_localrc: - shared: - # This job performs data path tests, it's good to test - # both DHSS driver modes with it, but for now, it'll use the LVM - # driver (DHSS=False) - MANILA_ALLOW_NAS_SERVER_PORTS_ON_HOST: true - MANILA_DEFAULT_SHARE_TYPE_EXTRA_SPECS: 'snapshot_support=True create_share_from_snapshot_support=True revert_to_snapshot_support=True mount_snapshot_support=True' - MANILA_CONFIGURE_DEFAULT_TYPES: true - SHARE_DRIVER: manila.share.drivers.lvm.LVMShareDriver - MANILA_ENABLED_BACKENDS: london,paris - MANILA_OPTGROUP_london_driver_handles_share_servers: false - MANILA_OPTGROUP_paris_driver_handles_share_servers: false - SHARE_BACKING_FILE_SIZE: 32000M - devstack_plugins: - manila: https://opendev.org/openstack/manila.git - devstack_services: - manila: true - m-api: true - m-sch: true - m-shr: true - m-dat: true - # don't need some services - c-api: false - c-bak: false - c-vol: false - cinder: false - # These services can be turned off, if not - # for: https://launchpad.net/bugs/1887835 - # g-api: false - # n-api: false - # n-api-meta: false - # n-cond: false - # n-cpu: false - # n-novnc: false - # n-sch: false - # placement-api: false - # q-agt: false - # q-dhcp: false - # q-l3: false - # q-meta: false - # q-metering: false - # q-svc: false - s-account: false - s-container: false - s-object: false - s-proxy: false - devstack_local_conf: - test-config: - "$TEMPEST_CONFIG": - share: - default_share_type_name: default - run_mount_snapshot_tests: true - run_shrink_tests: false - run_revert_to_snapshot_tests: true - enable_user_rules_for_protocols: cifs - enable_ip_rules_for_protocols: nfs - multitenancy_enabled: False - backend_names: LONDON,PARIS - multi_backend: true - tempest_plugins: - - manila-tempest-plugin - tempest_test_regex: ^manila_tempest_tests.tests.api - tox_envlist: all - -- job: - name: manila-grenade-skip-level-always - description: | - Grenade job that skips a release, validating that deployers can skip - specific releases as prescribed by our process. - parent: manila-grenade - vars: - # Move this forward when a new release cycle start. grenade_from_branch - # should be always N-2 from master. - grenade_from_branch: stable/2024.1 diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 2ae7b28d60..8ae98b591a 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -11,6 +11,9 @@ check: jobs: - manila-tox-genconfig + # Temporary gate fix + - manila-tempest-plugin-lvm: + voting: false - openstack-tox-pylint: voting: false timeout: 5400 @@ -22,8 +25,6 @@ voting: false - manila-tempest-plugin-lvm-fips: voting: false - - manila-grenade - - manila-grenade-skip-level-always - manila-rally-no-ss: voting: false - manila-rally-ss: @@ -37,6 +38,8 @@ jobs: - manila-tempest-plugin-dummy-no-dhss - manila-tempest-plugin-dummy-dhss + - manila-tempest-plugin-lvm: + voting: false - job: name: manila-tox-genconfig From d98d9f86e7d83a95fe8485dc51c4162e3ce49c23 Mon Sep 17 00:00:00 2001 From: Goutham Pacha Ravi Date: Wed, 15 Apr 2026 23:19:04 -0700 Subject: [PATCH 5/5] Replace Quagga with FRR in devstack Quagga is no longer available on Ubuntu 22.04+. Replace it with FRR (FRRouting), its maintained fork and drop-in replacement. Also fix BGP peering on single-host devstack by giving FRR a separate IPv6 address and using "bgp listen range" to accept connections from any address in the public subnet. Closes-Bug: #1998489 Change-Id: I189eaee03286dc7641537bb3548b4fcafdaed67e Signed-off-by: Goutham Pacha Ravi (cherry picked from commit b7037f1dfaeccbfafa7dd3ba5776496a33924dc1) (cherry picked from commit 0c239987e5f6ba3c247d0fccf0827bf841544a91) (cherry picked from commit ecfacdecd606ad9ab340dcdf666a1b595dca7d63) --- devstack/plugin.sh | 109 +++++++++++++++++++++++++++----------------- zuul.d/project.yaml | 5 -- 2 files changed, 67 insertions(+), 47 deletions(-) diff --git a/devstack/plugin.sh b/devstack/plugin.sh index 9babd3e1bf..7361c4d58b 100755 --- a/devstack/plugin.sh +++ b/devstack/plugin.sh @@ -1085,6 +1085,19 @@ function setup_ipv6 { # Enabling interface is needed due to NEUTRON_CREATE_INITIAL_NETWORKS=False sudo ip link set $PUBLIC_BRIDGE up + # Allocate a separate IPv6 address on the public network for FRR's BGP + # identity so that FRR and os-ken (neutron BGP speaker) have distinct + # addresses - required for BGP peering on a single-host devstack. + local frr_bgp_ipv6=$(openstack --os-cloud devstack-admin port create \ + frr-bgp-peer --network $PUBLIC_NETWORK_NAME \ + --fixed-ip subnet=$IPV6_PUBLIC_SUBNET_NAME \ + -c fixed_ips -f value | grep -oE '[0-9a-f]+:[:0-9a-f]+') + sudo ip -6 addr add "$frr_bgp_ipv6"/$SUBNETPOOL_SIZE_V6 dev $PUBLIC_BRIDGE + + # Diagnostic: show kernel source address selection for connections to FRR + echo "=== Source address for connections to FRR ($frr_bgp_ipv6) ===" + ip -6 route get $frr_bgp_ipv6 + if [ "$SHARE_DRIVER" == "manila.share.drivers.lvm.LVMShareDriver" ]; then for backend_name in ${MANILA_ENABLED_BACKENDS//,/ }; do iniset $MANILA_CONF $backend_name lvm_share_export_ips $public_gateway_ipv4,$public_gateway_ipv6 @@ -1099,10 +1112,14 @@ function setup_ipv6 { iniset $MANILA_CONF DEFAULT data_node_access_ips $public_gateway_ipv4 fi - # install Quagga for setting up the host routes dynamically - install_package quagga + # install FRR for setting up the host routes dynamically + install_package frr + + # Remove the default integrated config so FRR reads per-daemon + # config files (bgpd.conf, zebra.conf) in traditional mode. + sudo rm -f /etc/frr/frr.conf - # set Quagga daemons + # set FRR daemons ( echo "zebra=yes" echo "bgpd=yes" @@ -1112,61 +1129,67 @@ function setup_ipv6 { echo "ripngd=no" echo "isisd=no" echo "babeld=no" - ) | sudo tee /etc/quagga/daemons > /dev/null + # Explicitly listen on all addresses (IPv4+IPv6); Debian's default + # daemons file restricts bgpd to 127.0.0.1 which blocks IPv6 peering. + echo 'zebra_options=" -A 127.0.0.1 -s 90000000"' + echo 'bgpd_options=" -A ::"' + ) | sudo tee /etc/frr/daemons > /dev/null - # set Quagga zebra.conf + # set FRR zebra.conf ( echo "hostname dsvm" echo "password openstack" - echo "log file /var/log/quagga/zebra.log" - ) | sudo tee /etc/quagga/zebra.conf > /dev/null + echo "log syslog informational" + echo "log file $DEST/logs/frr/zebra.log" + ) | sudo tee /etc/frr/zebra.conf > /dev/null - # set Quagga vtysh.conf + # set FRR vtysh.conf ( echo "service integrated-vtysh-config" - echo "username quagga nopassword" - ) | sudo tee /etc/quagga/vtysh.conf > /dev/null - - # set Quagga bgpd.conf + ) | sudo tee /etc/frr/vtysh.conf > /dev/null + + # set FRR bgpd.conf + # Use "bgp listen range" with a peer-group instead of a static neighbor + # so FRR accepts BGP connections from any address in the public subnet. + # This avoids source-address-matching issues on single-host devstack + # where os-ken and FRR share the same network namespace. + local public_subnet_cidr=$(openstack --os-cloud devstack-admin \ + subnet show $IPV6_PUBLIC_SUBNET_NAME -c cidr -f value) ( - echo "log file /var/log/quagga/bgpd.log" - echo "bgp multiple-instance" + echo "log syslog informational" + echo "log file $DEST/logs/frr/bgpd.log" echo "router bgp 200" echo " bgp router-id 1.2.3.4" - echo " neighbor $public_gateway_ipv6 remote-as 100" - echo " neighbor $public_gateway_ipv6 passive" - echo " address-family ipv6" - echo " neighbor $public_gateway_ipv6 activate" - echo "line vty" + echo " no bgp ebgp-requires-policy" + echo " timers bgp 10 30" + echo " neighbor OSKEN peer-group" + echo " neighbor OSKEN remote-as 100" + echo " neighbor OSKEN timers 10 30" + echo " bgp listen range $public_subnet_cidr peer-group OSKEN" + echo " address-family ipv6 unicast" + echo " neighbor OSKEN activate" + echo " exit-address-family" + echo "!" echo "debug bgp events" echo "debug bgp filters" echo "debug bgp fsm" echo "debug bgp keepalives" echo "debug bgp updates" - ) | sudo tee /etc/quagga/bgpd.conf > /dev/null + ) | sudo tee /etc/frr/bgpd.conf > /dev/null - # Quagga logging - sudo mkdir -p /var/log/quagga - sudo touch /var/log/quagga/zebra.log - sudo touch /var/log/quagga/bgpd.log - sudo chown -R quagga:quagga /var/log/quagga + # FRR logging — write directly under $DEST/logs so Zuul collects them + sudo mkdir -p $DEST/logs/frr + sudo chown frr:frr $DEST/logs/frr + sudo systemctl enable frr + sudo systemctl restart frr - GetOSVersion - QUAGGA_SERVICES="zebra bgpd" - if [[ is_ubuntu && "$os_CODENAME" == "xenial" ]]; then - # In Ubuntu Xenial, the services bgpd and zebra are under - # one systemd unit: quagga - QUAGGA_SERVICES="quagga" - elif is_fedora; then - # Disable SELinux rule that conflicts with Zebra - sudo setsebool -P zebra_write_config 1 - fi - sudo systemctl enable $QUAGGA_SERVICES - sudo systemctl restart $QUAGGA_SERVICES - - # log the systemd status - sudo systemctl status $QUAGGA_SERVICES + # log the systemd status and BGP diagnostics + sudo systemctl status frr + sleep 2 + sudo ss -tlnp '( sport = 179 )' + sudo vtysh -c "show bgp summary" + sudo cat /etc/frr/bgpd.conf # This will fail with mutltiple default routes and is not needed in CI # but may be useful when developing with devstack locally @@ -1182,10 +1205,12 @@ function setup_ipv6 { } function setup_bgp_for_ipv6 { - public_gateway_ipv6=$(openstack --os-cloud devstack-admin subnet show ipv6-public-subnet -c gateway_ip -f value) + # FRR's separate BGP identity address (allocated in setup_ipv6) + local frr_bgp_ipv6=$(openstack --os-cloud devstack-admin port show \ + frr-bgp-peer -c fixed_ips -f value | grep -oE '[0-9a-f]+:[:0-9a-f]+') openstack --os-cloud devstack-admin bgp speaker create --ip-version 6 --local-as 100 bgpspeaker openstack --os-cloud devstack-admin bgp speaker add network bgpspeaker $PUBLIC_NETWORK_NAME - openstack --os-cloud devstack-admin bgp peer create --peer-ip $public_gateway_ipv6 --remote-as 200 bgppeer + openstack --os-cloud devstack-admin bgp peer create --peer-ip $frr_bgp_ipv6 --remote-as 200 bgppeer openstack --os-cloud devstack-admin bgp speaker add peer bgpspeaker bgppeer } diff --git a/zuul.d/project.yaml b/zuul.d/project.yaml index 8ae98b591a..3fc44337f1 100644 --- a/zuul.d/project.yaml +++ b/zuul.d/project.yaml @@ -11,9 +11,6 @@ check: jobs: - manila-tox-genconfig - # Temporary gate fix - - manila-tempest-plugin-lvm: - voting: false - openstack-tox-pylint: voting: false timeout: 5400 @@ -38,8 +35,6 @@ jobs: - manila-tempest-plugin-dummy-no-dhss - manila-tempest-plugin-dummy-dhss - - manila-tempest-plugin-lvm: - voting: false - job: name: manila-tox-genconfig