Cut back gratuitous regulation

Standards/scs-0100-v3-flavor-naming.md

@@ -171,8 +171,6 @@ If memory is oversubscribed, you must expose this with the `o` suffix.
 
 ### [OPTIONAL] Disk sizes and types
 
-Disk sizes (in GB) should use sizes 5, 10, 20, 50, 100, 200, 500, 1000.
-
 | Disk type | Meaning                              |
 | --------- | ------------------------------------ |
 | n         | Network shared storage (ceph/cinder) |

Standards/scs-0101-v1-entropy.md

@@ -15,6 +15,8 @@ description: |
 
 ## Introduction
 
+This is v1.1 of the standard. See section on version history for details.
+
 ### Entropy in information technology
 
 Entropy is a concept that is widely used in the scope of information
@@ -39,7 +41,7 @@ bus timings, or keyboard timings, to name a few.
 
 _More recent methods_ of generating entropy include measuring IRQ jitter
 (available in Linux since kernel 5.4 or, before that, via a daemon such as
-[HavegeD](http://www.issihosts.com/haveged/)) as well as dedicated CPU
+[HavegeD](https://github.com/jirka-h/haveged)) as well as dedicated CPU
 instructions (available in virtually all major CPUs: RDSEED or RDRAND
 on x86_64 and RNDR on arm64).
 
@@ -94,39 +96,15 @@ will be available in virtual instances.
 
 ## Entropy in SCS clouds
 
-### Flavors
-
-It is recommended that all flavors have the following attribute:
-
-```console
-hw_rng:allowed=True
-```
-
-The following attributes are optional:
-
-```console
-hw_rng:rate_bytes - The allowed amount of bytes for the the guest
-    to read from the host's entropy per period.
-hw_rng:rate_period - Sets the duration of a read period in seconds.
-```
-
-### Images
-
 It is recommended to use images having a kernel (patch level) version 5.18
 or up. This condition is already satisfied by every mandatory image defined
 in the [Image Metadata Standard](https://github.com/SovereignCloudStack/standards/blob/main/Standards/scs-0102-v1-image-metadata.md).
 
-It is recommended that images activate the attribute `hw_rng_model: virtio`.
-
-The daemon `rngd` must be installed (usually from `rng-tools`
-or `rng-utils`).
-
-The user may choose to use the `virtio-rng` device via `rngd`.
-
-### Compute nodes
-
 Compute nodes must use CPUs that offer instructions for accessing
 entropy (such as RDSEED or RDRAND on x86_64 or RNDR on arm64), and
 these instructions may not be filtered by the hypervisor.
 
-Compute nodes may provide a HRNG via `rngd`.
+## Version history
+
+As of version 1.1, the method of injecting entropy into a VM using a
+virtualized HRNG together with `rngd` is no longer recommended.

Standards/scs-0101-w1-entropy-implementation-testing.md

@@ -12,24 +12,16 @@ With reasonably recent hardware—x86 CPU with RDRAND/RDSEED (Intel from 2012,
 AMD from 2015) or ARM CPU with FEAT_RNG or FEAT_RNG_TRAP—and recent VM image—Linux
 kernel 5.18 or higher—, there is (almost) nothing to be done.
 
-Only the flavor and image attributes required by the standard have to be set:
-
-- flavor extra_spec: `hw_rng:allowed=True` ,
-- image property: `hw_rng_model: virtio` .
-
 ## Automated tests
 
 The following testcases [are implemented](https://github.com/SovereignCloudStack/standards/blob/main/Tests/iaas/openstack_test.py):
 
-- `scs-0101-image-property` ensures that each flavor has the extra spec `hw_rng:allowed=True`,
-- `scs-0101-flavor-property` ensures that each public image has the property `hw_rng_model: virtio`,
-- `scs-0101-rngd` ensures that the service `rngd` is present on a sample VM,
 - `scs-0101-entropy-avail` ensures that the special file `/proc/sys/kernel/random/entropy_avail` contains
   the value 256 (pinned since kernel 5.18) on a sample VM,
 - `scs-0101-fips-test` ensures that the number of FIPS 140-2 failures is below 5 out of 1000 blocks
   tested, as determined by `cat /dev/random | rngtest -c 1000` on a sample VM.
 
-Note: The latter two items act as surrogates for the following item, which
+These testcases act as surrogates for the following item, which
 cannot be detected directly:
 
 - CPU instructions for accessing entropy are available to the VMs.

Tests/iaas/openstack_test.py

@@ -18,8 +18,7 @@
 from scs_0100_flavor_naming.flavor_names_check import \
     compute_scs_flavors, compute_scs_0100_syntax_check, compute_scs_0100_semantics_check
 from scs_0101_entropy.entropy_check import \
-    compute_scs_0101_image_property, compute_scs_0101_flavor_property, compute_canonical_image, \
-    compute_collected_vm_output, compute_scs_0101_entropy_avail, compute_scs_0101_rngd, \
+    compute_canonical_image, compute_collected_vm_output, compute_scs_0101_entropy_avail, \
     compute_scs_0101_fips_test
 from scs_0102_image_metadata.image_metadata import \
     compute_scs_0102_prop_architecture, compute_scs_0102_prop_hash_algo, compute_scs_0102_prop_min_disk, \
@@ -73,10 +72,7 @@ def make_container(cloud):
     # scs_0101_entropy
     c.add_function('canonical_image', lambda c: compute_canonical_image(c.images))
     c.add_function('collected_vm_output', lambda c: compute_collected_vm_output(c.conn, c.flavors, c.canonical_image))
-    c.add_function('scs_0101_image_property', lambda c: compute_scs_0101_image_property(c.images))
-    c.add_function('scs_0101_flavor_property', lambda c: compute_scs_0101_flavor_property(c.flavors))
     c.add_function('scs_0101_entropy_avail', lambda c: compute_scs_0101_entropy_avail(c.collected_vm_output, c.canonical_image.name))
-    c.add_function('scs_0101_rngd', lambda c: compute_scs_0101_rngd(c.collected_vm_output, c.canonical_image.name))
     c.add_function('scs_0101_fips_test', lambda c: compute_scs_0101_fips_test(c.collected_vm_output, c.canonical_image.name))
     # scs_0102_image_metadata
     c.add_function('scs_0102_prop_architecture', lambda c: compute_scs_0102_prop_architecture(c.images))

Tests/iaas/scs_0100_flavor_naming/flavor_names_check.py

@@ -15,7 +15,6 @@
     parsers=(flavor_names.parser_v3, ),
     tolerated_parsers=(flavor_names.parser_v2, flavor_names.parser_v1),
 )
-ACC_DISK = (0, 5, 10, 20, 50, 100, 200, 500, 1000, 2000, 5000, 10000, 20000, 50000, 100000)
 
 
 def compute_scs_flavors(flavors: typing.List[openstack.compute.v2.flavor.Flavor], parser=STRATEGY) -> list:
@@ -65,20 +64,18 @@ def compute_scs_0100_semantics_check(scs_flavors: list) -> bool:
         elif flv.vcpus > cpuram.cpus:
             logger.info(f"Flavor {flv.name} CPU underpromise: {flv.vcpus} > {cpuram.cpus}")
         # RAM
+        advram = cpuram.ram  # advertised RAM
         flvram = int((flv.ram + 51) / 102.4) / 10
         # Warn for strange sizes (want integer numbers, half allowed for < 10GiB)
-        if flvram >= 10 and flvram != int(flvram) or flvram * 2 != int(flvram * 2):
-            logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {flvram:.1f} GiB")
-        if flvram < cpuram.ram:
-            logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {cpuram.ram:.1f}")
+        if advram >= 10 and advram != int(advram) or advram * 2 != int(advram * 2):
+            logger.info(f"Flavor {flv.name} uses discouraged uneven size of memory {advram:.1f} GiB")
+        if flvram < advram:
+            logger.error(f"Flavor {flv.name} RAM overpromise {flvram:.1f} < {advram:.1f}")
             problems.add(flv.name)
-        elif flvram > cpuram.ram:
-            logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {cpuram.ram:.1f}")
+        elif flvram > advram:
+            logger.info(f"Flavor {flv.name} RAM underpromise {flvram:.1f} > {advram:.1f}")
         # Disk could have been omitted
         disksize = flavorname.disk.disksize if flavorname.disk else 0
-        # We have a recommendation for disk size steps
-        if disksize not in ACC_DISK:
-            logger.info(f"Flavor {flv.name} non-standard disk size {disksize}, should have (5, 10, 20, 50, 100, 200, ...)")
         if flv.disk < disksize:
             logger.error(f"Flavor {flv.name} disk overpromise {flv.disk} < {disksize}")
             problems.add(flv.name)

Tests/iaas/scs_0101_entropy/entropy_check.py

@@ -17,18 +17,6 @@
 SECURITY_GROUP_NAME = "_scs-0101-group"
 KEYPAIR_NAME = "_scs-0101-keypair"
 
-IMAGE_ATTRIBUTES = {
-    # https://docs.openstack.org/glance/2023.1/admin/useful-image-properties.html#image-property-keys-and-values
-    # type: str
-    "hw_rng_model": "virtio",
-}
-FLAVOR_ATTRIBUTES = {
-    # https://docs.openstack.org/nova/2023.1/configuration/extra-specs.html#hw-rng
-    # type: bool
-    "hw_rng:allowed": "True",  # testing showed that it is indeed a string?
-}
-FLAVOR_OPTIONAL = ("hw_rng:rate_bytes", "hw_rng:rate_period")
-
 
 TIMEOUT = 5 * 60  # timeout in seconds after which we no longer wait for the VM to complete the run
 MARKER = '_scs-test-'
@@ -70,38 +58,6 @@
 }
 
 
-def compute_scs_0101_image_property(images, attributes=IMAGE_ATTRIBUTES):
-    """This test ensures that each image has the relevant properties."""
-    candidates = [
-        (image.name, [f"{key}={value}" for key, value in attributes.items() if image.get(key) != value])
-        for image in images
-    ]
-    # drop those candidates that are fine
-    offenders = [candidate for candidate in candidates if candidate[1]]
-    for name, wrong in offenders:
-        logger.error(f"Image '{name}' missing attributes: {', '.join(wrong)}")
-    return not offenders
-
-
-def compute_scs_0101_flavor_property(flavors, attributes=FLAVOR_ATTRIBUTES, optional=FLAVOR_OPTIONAL):
-    """This test ensures that each flavor has the relevant extra_spec."""
-    offenses = 0
-    for flavor in flavors:
-        extra_specs = flavor['extra_specs']
-        wrong = [f"{key}={value}" for key, value in attributes.items() if extra_specs.get(key) != value]
-        miss_opt = [key for key in optional if extra_specs.get(key) is None]
-        if wrong:
-            offenses += 1
-            message = f"Flavor '{flavor.name}' missing attributes: {', '.join(wrong)}"
-            # only report missing optional attributes if main ones are missing as well
-            # reasoning here is that these optional attributes are merely a hint for implementers
-            # and if the main ones are present, we assume that implementers have done their job already
-            if miss_opt:
-                message += f"; additionally, missing optional attributes: {', '.join(miss_opt)}"
-            logger.error(message)
-    return not offenses
-
-
 def compute_scs_0101_entropy_avail(collected_vm_output, image_name):
     """This test ensures that the `entropy_avail` value is correct for a test VM."""
     lines = collected_vm_output['entropy-avail']
@@ -115,15 +71,6 @@ def compute_scs_0101_entropy_avail(collected_vm_output, image_name):
     return True
 
 
-def compute_scs_0101_rngd(collected_vm_output, image_name):
-    """This test ensures that the `rngd` service is running on a test VM."""
-    lines = collected_vm_output['rngd']
-    if "could not be found" in '\n'.join(lines):
-        logger.error(f"VM '{image_name}' doesn't provide service rngd")
-        return False
-    return True
-
-
 def compute_scs_0101_fips_test(collected_vm_output, image_name):
     """This test ensures that the 'fips test' via `rngtest` is passed on a test VM."""
     lines = collected_vm_output['fips-test']

Tests/scs-compatible-iaas.yaml

@@ -304,20 +304,13 @@ modules:
       - scs-0100-syntax-check
       - scs-0100-semantics-check
   - id: scs-0101-v1
-    name: Entropy v1
+    # leap from v1 to v1.1 in place because it's a very minor relaxation; all essential testcases are kept
+    name: Entropy v1.1
     url: https://docs.scs.community/standards/scs-0101-v1-entropy
     targets:
       main:
-      - scs-0101-rngd
       - scs-0101-entropy-avail
       - scs-0101-fips-test
-  - id: scs-0101-v1-rec
-    name: Entropy v1
-    url: https://docs.scs.community/standards/scs-0101-v1-entropy
-    targets:
-      recommended:
-      - scs-0101-flavor-property
-      - scs-0101-image-property
   - id: scs-0102-v1
     name: Image metadata v1
     url: https://docs.scs.community/standards/scs-0102-v1-image-metadata