May 2022 - CoreOS - Fedora mailing-lists

Fedora CoreOS Community Video Meeting 2022-06-01
by Dusty Mabe 02 Jun '22

02 Jun '22

Time: 16:30 UTC (same as normal) on Wednesday June 1st Location: meet.google.com/sfc-fbzb-psd (will be recorded) Agenda/Notes: https://hackmd.io/Hc7KaotVSByOm0dxsGzmLA We will go over our high level goals for FCOS and cover recent updates and then start digging into CoreOS layering some more and the steps we need to take to implement the rest of the puzzle. See you all next Wednesday! Dusty

1 1

[Fedocal] Reminder meeting : Fedora CoreOS Group Weekly Meeting
by dusty＠dustymabe.com 31 May '22

31 May '22

Dear all, You are kindly invited to the meeting: Fedora CoreOS Group Weekly Meeting on 2022-06-01 from 16:30:00 to 17:30:00 UTC At fedora-meeting-1(a)irc.libera.chat The meeting will be about: This is the meeting for the Fedora CoreOS Working Group. We typically go over previous meeting action items and then cover all tickets with the meeting keyword: https://github.com/coreos/fedora-coreos-tracker/labels/meeting. For how to run the meeting, see https://github.com/coreos/fedora-coreos-tracker#steps-to-run-the-meeting Source: https://calendar.fedoraproject.org//meeting/9437/

1 0

[Fedocal] Reminder meeting : Fedora CoreOS Group Weekly Meeting
by dusty＠dustymabe.com 24 May '22

24 May '22

Dear all, You are kindly invited to the meeting: Fedora CoreOS Group Weekly Meeting on 2022-05-25 from 16:30:00 to 17:30:00 UTC At fedora-meeting-1(a)irc.libera.chat The meeting will be about: This is the meeting for the Fedora CoreOS Working Group. We typically go over previous meeting action items and then cover all tickets with the meeting keyword: https://github.com/coreos/fedora-coreos-tracker/labels/meeting. For how to run the meeting, see https://github.com/coreos/fedora-coreos-tracker#steps-to-run-the-meeting Source: https://calendar.fedoraproject.org//meeting/9437/

1 0

Re: [coreos-status] Ignition config accessible to unprivileged software on VMware
by Aleksandar Kostadinov 23 May '22

23 May '22

Hi, thank you for this update! I tried to understand how this works on bare metal. After installation with ignition file provided on a local file system, is the file still accessible unencrypted anywhere after the installation completes? For machines that are remote and no human interaction is possible, I don't see how credentials in ignition can be avoided. Even if hashicorp is used, then some credentials for hashicorp should be present. Or am I mistaken? Thank you! On Fri, May 20, 2022 at 12:38 AM Benjamin Gilbert <bgilbert(a)redhat.com> wrote: > Hi all, > > Unprivileged software in VMware VMs, including software running in > unprivileged containers, can retrieve an Ignition config stored in a > hypervisor guestinfo variable or OVF environment. If the Ignition config > contains secrets, this can result in the compromise of sensitive > information. > > Starting with next week's Fedora CoreOS `testing` and `next` releases, > Ignition will delete the Ignition config from supported hypervisors > (currently VMware and VirtualBox) during the first boot. This ensures that > unprivileged software cannot retrieve the Ignition config from the > hypervisor. Existing machines will likewise delete the config when first > upgraded to a new release. This change will be promoted to Fedora CoreOS > `stable` after two weeks, as usual. > > Note that in general, we do not recommend storing secrets in Ignition > configs [1]. In addition to VMware, many cloud platforms allow > unprivileged > software in a VM to retrieve the Ignition config from a networked cloud > metadata service. While platform-specific mitigation is possible, such as > firewall rules that prevent access to the metadata service, it's better to > store secrets in a dedicated platform such as Hashicorp Vault [2]. > > If you have external tooling that requires the Ignition config to remain > accessible in VM metadata after provisioning, and your Ignition config does > not include sensitive information, you can prevent deletion by masking > ignition-delete-config.service. For newly-launched machines: > > variant: fcos > version: 1.0.0 > systemd: > units: > - name: ignition-delete-config.service > mask: true > > To prevent upgrades from affecting existing machines: > > $ sudo systemctl mask ignition-delete-config.service > > If you have any questions or concerns, contact us in #fedora-coreos on > Libera.Chat or open an issue in the Fedora CoreOS tracker [3]. > > --Benjamin Gilbert, for the Fedora CoreOS team > > [1]: https://coreos.github.io/ignition/operator-notes/#secrets > [2]: https://www.vaultproject.io/ > [3]: https://github.com/coreos/fedora-coreos-tracker/issues/new/choose > _______________________________________________ > coreos-status mailing list -- coreos-status(a)lists.fedoraproject.org > To unsubscribe send an email to > coreos-status-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/coreos-status@lists.fedorapro… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >

2 1

Fedora CoreOS Meeting Minutes 2022-05-18
by Dusty Mabe 18 May '22

18 May '22

Minutes: https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-18/fedora_coreos… Minutes (text): https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-18/fedora_coreos… Log: https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-18/fedora_coreos… ======================================== #fedora-meeting-1: fedora_coreos_meeting ======================================== Meeting started by dustymabe at 16:30:01 UTC. The full logs are available at https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-18/fedora_coreos… . Meeting summary --------------- * roll call (dustymabe, 16:30:04) * Action items from last meeting (dustymabe, 16:36:29) * May Edition of "This Month in FCOS" (dustymabe, 16:37:35) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1188 (dustymabe, 16:37:42) * LINK: https://github.com/coreos/rpm-ostree/releases/tag/v2022.9 (lucab, 16:45:54) * LINK: https://github.com/ostreedev/ostree/releases/tag/v2022.3 (lucab, 16:47:27) * develop strategy around organization and naming for our containers in quay.io (dustymabe, 16:49:39) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1171 (dustymabe, 16:49:44) * ACTION: dustymabe jaimelm to reach out to fedora infra about creds for pushing to `quay.io/fedora/fedora-coreos` and `quay.io/fedora/fedora-coreos-kubevirt`. (dustymabe, 16:50:32) * open floor (dustymabe, 16:51:50) * LINK: https://github.com/coreos/fedora-coreos-cincinnati/pull/65#issuecomment-113… (lucab, 17:01:42) * LINK: https://github.com/coreos/fedora-coreos-cincinnati/pull/66#issuecomment-113… (lucab, 17:04:55) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1203 (miabbott, 17:05:25) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1201 (lucab, 17:09:25) Meeting ended at 17:32:17 UTC. Action Items ------------ * dustymabe jaimelm to reach out to fedora infra about creds for pushing to `quay.io/fedora/fedora-coreos` and `quay.io/fedora/fedora-coreos-kubevirt`. Action Items, by person ----------------------- * dustymabe * dustymabe jaimelm to reach out to fedora infra about creds for pushing to `quay.io/fedora/fedora-coreos` and `quay.io/fedora/fedora-coreos-kubevirt`. * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * dustymabe (114) * lucab (62) * zodbot (34) * travier (25) * jlebon (20) * miabbott (8) * mnguyen_ (3) * aaradhak (2) * travier_ (1) * jmarrero (1) * ravanelli (1) * gursewak (1) Generated by `MeetBot`_ 0.4 .. _`MeetBot`: https://fedoraproject.org/wiki/Zodbot#Meeting_Functions

1 0

[Fedocal] Reminder meeting : Fedora CoreOS Group Weekly Meeting
by dusty＠dustymabe.com 17 May '22

17 May '22

Dear all, You are kindly invited to the meeting: Fedora CoreOS Group Weekly Meeting on 2022-05-18 from 16:30:00 to 17:30:00 UTC At fedora-meeting-1(a)irc.libera.chat The meeting will be about: This is the meeting for the Fedora CoreOS Working Group. We typically go over previous meeting action items and then cover all tickets with the meeting keyword: https://github.com/coreos/fedora-coreos-tracker/labels/meeting. For how to run the meeting, see https://github.com/coreos/fedora-coreos-tracker#steps-to-run-the-meeting Source: https://calendar.fedoraproject.org//meeting/9437/

1 0

Fedora CoreOS Meeting Minutes 2022-05-11
by Timothée Ravier 11 May '22

11 May '22

Minutes: https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-11/fedora_coreos… Minutes (text): https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-11/fedora_coreos… Log: https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-11/fedora_coreos… ======================================== #fedora-meeting-1: fedora_coreos_meeting ======================================== Meeting started by travier at 16:32:37 UTC. The full logs are available at https://meetbot.fedoraproject.org/fedora-meeting-1/2022-05-11/fedora_coreos… . Meeting summary --------------- * roll call (travier, 16:32:41) * Action items from last meeting (travier, 16:36:24) * coreos autoinstall creates huge number of xfs allocation groups #1183 (travier, 16:38:22) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1183 (travier, 16:38:29) * AGREED: Given that we have a valid and recommended workaround for this issue, we will investigate option A (adding auto-detection and auto re-provisioning). We will reach out to XFS folks to get a better understanding of our options and to see if F is also doable. (travier, 17:08:22) * New Package Request: nmstate-libs and nmstate #1175 (travier, 17:11:12) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1175 (travier, 17:11:18) * use internal qcow2 compression for nutanix image #1191 (travier, 17:12:02) * LINK: https://github.com/coreos/fedora-coreos-tracker/issues/1191 (travier, 17:12:09) * LINK: https://github.com/coreos/coreos-assembler/pull/2848 (Sid__, 17:14:17) * AGREED: We will switch the Nutanix artifacts to an internally compressed qcow2 image for the next cycle for testing & next and the following one for stable. This breaking change will be announced ASAP. (travier, 17:33:45) * Open Floor (travier, 17:33:56) * Fedora 36 has been release to our `testing` stream! (dustymabe, 17:35:10) * LINK: https://hopin.com/events/fedora-linux-36-release-party/registration (dustymabe, 17:37:28) Meeting ended at 17:41:33 UTC. Action Items ------------ Action Items, by person ----------------------- * **UNASSIGNED** * (none) People Present (lines said) --------------------------- * dustymabe (76) * travier (67) * bgilbert (62) * jlebon (34) * zodbot (23) * cmurf (21) * lucab (19) * Sid__ (14) * miabbott (8) * ravanell_ (4) * saqali (1) * miabbott_ (1) * aaradhak (1) * walters (1) * aaradhak[m] (1) * mikelo_ (0) * +cmurf (0) Generated by `MeetBot`_ 0.4 .. _`MeetBot`: https://fedoraproject.org/wiki/Zodbot#Meeting_Functions

1 0

[Fedocal] Reminder meeting : Fedora CoreOS Group Weekly Meeting
by dusty＠dustymabe.com 10 May '22

10 May '22

Dear all, You are kindly invited to the meeting: Fedora CoreOS Group Weekly Meeting on 2022-05-11 from 16:30:00 to 17:30:00 UTC At fedora-meeting-1(a)irc.libera.chat The meeting will be about: This is the meeting for the Fedora CoreOS Working Group. We typically go over previous meeting action items and then cover all tickets with the meeting keyword: https://github.com/coreos/fedora-coreos-tracker/labels/meeting. For how to run the meeting, see https://github.com/coreos/fedora-coreos-tracker#steps-to-run-the-meeting Source: https://calendar.fedoraproject.org//meeting/9437/

1 0

Fedora CoreOS streams rebasing to Fedora Linux 36
by Dusty Mabe 09 May '22

09 May '22

Following our scheduling policy around Fedora major version releases [1] we will be rolling out the Fedora Linux 36 rebase over the next few weeks. This will start tomorrow with the `testing` stream. During this development cycle we continued to follow the Fedora Change process more closely [2] in order to provide a smoother transition of incoming Fedora Changes. We also closely watched our package additions/removals [3] to carefully evaluate any changes and determine if they were intentional. Current known issues: - network device IP doesn't get displayed to console [4] Notable transitions in the Fedora 36 rebase: - Podman 4.0, with some backwards incompatible changes [5] - iptables nft by default, along with auto-migration [6] Some highlights of recently added features/improvements: - added a VirtualBox artifact [7] and updated documentation [8] - added a Nutanix artifact [9] - added support for a minimal ISO image [10] - updated the VMWare OVA to use UEFI/SecureBoot by default [11] - added CI testing for Azure [12] Thanks to everyone who participated in the test week [13] and to everyone that follows the `testing` and `next` streams to help us identify and fix issues before they get to `stable`. Dusty Mabe, for the Fedora CoreOS team [1] https://github.com/coreos/fedora-coreos-tracker/blob/main/Design.md#major-f… [2] https://github.com/coreos/fedora-coreos-tracker/issues/918 [3] https://github.com/coreos/fedora-coreos-tracker/issues/1128 [4] https://github.com/coreos/fedora-coreos-tracker/issues/1153 [5] https://discussion.fedoraproject.org/t/fedora-coreos-moving-to-podman-v4/37… [6] https://discussion.fedoraproject.org/t/fedora-coreos-moving-to-iptables-nft… [7] https://github.com/coreos/fedora-coreos-tracker/issues/1008 [8] https://docs.fedoraproject.org/en-US/fedora-coreos/provisioning-virtualbox/ [9] https://github.com/coreos/fedora-coreos-tracker/issues/1007 [10] https://github.com/coreos/fedora-coreos-tracker/issues/868 [11] https://github.com/coreos/fedora-coreos-tracker/issues/1140 [12] https://github.com/coreos/fedora-coreos-tracker/issues/1020 [13] https://github.com/coreos/fedora-coreos-tracker/issues/1123#issuecomment-10…

1 0

Fedora CoreOS Community Video Meeting 2022-05-04
by Dusty Mabe 05 May '22

05 May '22

Time: 16:30 UTC (same as normal) on Wednesday May 4th Location: meet.google.com/meo-enbb-rur (will be recorded) Agenda/Notes: https://hackmd.io/agQyAznoTSyWP8DZOZAQ9A Brian Tomlinson will join us to discuss his project that automates bringup on the Raspberry Pi 4. This was originally shared with the community in a discussion forum post. We will also carry forward discussion last week about nmstate and Fedora CoreOS. See you all tomorrow! Dusty

1 1

2024

2023

2022

2021

2020

2019

2018

CoreOS May 2022