Ubuntu

[MIR] maas

Reported by Andres Rodriguez on 2012-03-21
14
This bug affects 1 person
Affects Status Importance Assigned to Milestone
maas (Ubuntu)
High
Andres Rodriguez

Bug Description

1. Availability: all

2. Rationale:
This package is the MAAS project, which replaces the Orchestra project. This project is used to deploy machines as a service. It also serves as a provider for Juju. This completely replaces the features implemented by Orchestra.

3. Security: No CVEs

4. QA:
Ubuntu contain only released version of this package. The code is in [1].

5. UI standards: none

6. Dependencies:
cobbler (MIR LP: #950193)
convoy (MIR LP: #961376)
txlonpoll (MIR LP: #961389)
oops (MIR LP: #961398)
oops-twisted (MIR LP: #961409)
oops-amqp (MIR LP: #961416)
oops-wsgi (MIR LP: #961417)
oops-datedir-repo (MIR LP: #961422)
python-django-south (MIR LP: #961434)
python-django-piston (MIR LP: #961449)
squid-deb-proxy
txamqp (LP: #961427)

7. Standards:
No lintian Warnings nor errors
Package is packaged with debhelper, and has no patching system. Source format is 3.0

8. Maintenance: medium

9. Background information:
This package is the project MAAS that replaces Orchestra. It is used to deploy machines over the network. It interfaces with juju and uses cobbler to manage preseeds.

[1]: https://code.launchpad.net/maas

Changed in maas (Ubuntu):
assignee: nobody → Andres Rodriguez (andreserl)
status: New → Incomplete
status: Incomplete → In Progress
description: updated
description: updated
description: updated
description: updated
Changed in maas (Ubuntu):
importance: Undecided → High
description: updated
description: updated
description: updated
description: updated
description: updated
description: updated
description: updated
Changed in maas (Ubuntu):
assignee: Andres Rodriguez (andreserl) → nobody
status: In Progress → New
Michael Terry (mterry) wrote :

Haven't done all of my review, but a couple quick things:
 * Test suite isn't being run, but one of the reasons given in bug 937121 for a standing freeze exception was the comprehensive test suite. This should be enabled in the build.
 * It carries duplicated internal copies of libjs-raphael and libjs-yui. Those should be dropped and the system ones should be used instead.

Changed in maas (Ubuntu):
status: New → Incomplete
Andres Rodriguez (andreserl) wrote :

Hi Michael,

1. The test suite cannot yet be enabled because various of its components are install installed from pypi. Once the migration to use system packages is complete, it iwll be enabled.
2. I'll check with upstream and see whether these are intended or a mistake and will be fixed in the next upload.

Thank you!

Changed in maas (Ubuntu):
status: Incomplete → New
Jamie Strandboge (jdstrand) wrote :
Download full text (9.0 KiB)

MAAS aims to provide an easy to use system for provisioning bare metal servers like how cloud providers provision virtual servers. At this point in time, it is able to do a number of things, but is not complete. At my review there was little usable documentation and MAAS is still undergoing a lot of development. I did not perform extensive code auditing since MAAS is undergoing a lot of change and will continue to do so during the 12.04 lifecycle. This should be considered a shallow audit. Understandably at its early stages of development, there are a lot of bugs that I encountered that affected usability. On quality and usability, there are a number of problems that prevent me from endorsing it for main in its present state, but understanding that MAAS is strategic, undergoing active development and will receive substantial bug fixes and features in the 12.04 cycle, I will have to take it on faith that these issues will be addressed. That said, I have the utmost confidence that the server team will fix the current issues and any new issues that arise.

The basic architecture is that a MAAS server is installed. This installs (among other things) a webserver, dns, tftp, and dhcp services. MAAS maintains a database of nodes. A node corresponds to a machine and MAAS tracks a machine's MAC address and few other characteristics. MAAS has a superuser which is capable of adding nodes, users and setting preferences via the web ui. Non-admin users are used by people who want to provision machines (eg, someone using the maas provider in juju must have a corresponding user in MAAS). Non-admin users are able to add nodes, but their enlistment must be approved by an admin user. Nodes can also auto-enlist themselves via the server installer CD (which also must be approved by the admin). When a node starts, it PXE boots using small netboot iso images that are available after using maas-import-isos (via cobbler). After booting the image, package installation for the node happens over the network and packages are fetched from a caching proxy (squid-deb-proxy). After a node is brought up, it is shown in MAAS as being allocated to a specific user. It is important to note that nodes must first be added to (or enlisted in) MAAS before trying to PXE boot a machine. This can happen either by a human in the web ui or by installation media.

MAAS has a lot of dependencies that affect the security of the server and performing an 'apt-get install maas' results in the following open ports:
- apache (80, privilege-separated)
- squid (8000, acls should keep this safe, non-root)
- dnsmasq (53, 67, non-root)
- sshd (standard Ubuntu priv-separation)
- postgres (localhost:5432)
- mass-pserv (5241, runs as root)
- maas-txlongpoll (5242, runs as root)
- epmd (4369, non-root)
- rabbitmq (non-root)
- rsyslog (udp 514, non-root)
- tftpd (69, privilege-separated)
- cobbler (localhost:25151, root)

In using this with juju, it appears that the server really only needs to have the following ports open to the nodes on the LAN:
- apache (80)
- squid (8000)
- dnsmasq (53, 67)
- tftpd (69)
- rsyslog (udp 514)

Because MAAS uses MAC addresses (which are easily spoofed), dhcp and tftp for...

Read more...

Changed in maas (Ubuntu):
status: New → In Progress
Jamie Strandboge (jdstrand) wrote :

Actually, since all the tracking bugs are in place and this was pre-promoted, I am going to mark this as 'Fix Released'.

Changed in maas (Ubuntu):
assignee: nobody → Andres Rodriguez (andreserl)
assignee: Andres Rodriguez (andreserl) → nobody
status: In Progress → Fix Released
Jamie Strandboge (jdstrand) wrote :

*Sigh*, please subscribe canonical-server (or similar) to all bug mail, then feel free to mark this as 'Fix Released'.

Changed in maas (Ubuntu):
assignee: nobody → Andres Rodriguez (andreserl)
status: Fix Released → In Progress
status: In Progress → Fix Committed
Jamie Strandboge (jdstrand) wrote :

Robbie subscribed ubuntu-server to this, so marking Fix Released.

Changed in maas (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers