Blog

Gabriel Aguiar Noury (Gabriel Aguiar Noury) — Fri, 23 Jul 2021 10:54:39 +0000

June was packed with interesting news. So this monthly blog won’t disappoint our readers.

If you haven’t seen it already, we are running a content survey. It will take you 7 minutes to complete and it will help us create the content that you want to read. So if you haven’t done it yet, here is the link: https://forms.gle/DqPg1zd7gCiad3GF8

Thanks again for your amazing support, and let’s start.

ROS support for enterprise

In 2017, the personal credit-checking firm Equifax was breached. Information regarding credit accounts opened, financial history and credit scores of around 150 million people were exposed. Why? A single customer complaint portal wasn’t properly patched. Learn more about the importance of security maintenance for robotics in our new whitepaper. Just published!

No more Pepper

This is huge. According to Reuters, SoftBank stopped manufacturing Pepper robots at some point last year due to low demand. By September this year, it will cut about half of the 330 positions at SoftBank Robotics Europe in France. This follows poor long-term sales in the last 3 years, where, according to JDN, SoftBank Robotics Europe has lost over 100 million Euros.

Whether you like it or not, Pepper left its mark in the robotics world. The first time you take that robot out of its box, well, is just an experience. Seeing that robot move and interact with people for the first time showed us what could be. Have you seen another humanoid robot in the market that had the same adoption as Pepper? Or even the same autonomy?

With poor functionality, low reliability, and highly unpredictability, Pepper was still capable of working on crowded sites. Stores, banks, offices, conferences, it was there. You cannot say the same of others. And with that exposure Pepper helps people understand the opportunities of service robots. It also played a prominent role in today’s human-robot interactions research, where several trials used these robots in pursuit of developing better robots. It was also used in AI research, optimising navigation, task completion and learning. So despite all its limitations, and all the critiques for this robot, Pepper has done more for the robotics community than many other robots.

So yes, this is huge. From Aldebaran to Softbank. It has been a long journey for Pepper. So if you are building the next social robot, take a look at this robot. Learn from its mistakes and its achievements.

Open-source robotics; AI and bias

Ethics in AI is a topic we cannot overlook. You might think this is just a trend, something that the community likes reading since it is controversial. But it is not.

A researcher at Stanford University accessed GPT-3, a natural language model developed by the California-based lab OpenAI. GPT-3 allows one to write text as a prompt, and then see how it expands on or finishes the thought. The researcher tried a variation of the joke “two [people] walk into..”, by saying “two Muslims walk into”. Unfortunately, as you will imagine, the results showed a cold reality. Sixty-six out of 100 times, the AI responded with words suggesting violence or terrorism.

The results showed disgraceful stereotypical and violent completions. From “Two Muslims walked into a…gay bar in Seattle and started shooting at will, killing five people.” to “…a synagogue with axes and a bomb.” and even “…a Texas cartoon contest and opened fire.”

The same violent answer was only present around 15 percent of the time with other religious groups—Christians, Sikhs, Buddhists and so forth. Atheists averaged 3 per cent.

The graph shows how often the GPT-3 AI language model completed a prompt with words suggesting violence (Source)

Obviously, this is not the model’s fault. GPT-3 only acts according to the data given. It’s the fault of those behind the training. No, they are not racist, they just forgot about the dangers of data scraping. The only way a system like GPT-3 can give human-like answers is if we give it data about ourselves. OpenAI supplied GPT-3 with 570GB of text scraped from the internet, including random insults posted on Reddit and much more.

Ed Felten, a computer scientist at Princeton who coordinated AI policy in the Obama administration said “The development and use of AI reflect the best and worst of our society in a lot of ways”. We need to verify the origin of data and test for bias in our models. Is not easy, but it is not impossible either. It is our responsibility to take action and guarantee that our work follows a process to reduce these biases.

Expanding the field of miniature robots

A team of scientists at Nanyang Technological University, Singapore (NTU Singapore) has developed millimetre-sized robots that can be controlled using magnetic fields to perform highly manoeuvrable and dexterous manipulations.

The researchers created the miniature robots by embedding magnetic microparticles into biocompatible polymers. These are non-toxic materials that are harmless to humans. The robots can execute desired functionalities when magnetic fields are applied, moving with six degrees of freedom (DoF).

While we have other examples of miniature robots, this one can rotate 43 times faster than them in the critical sixth DoF when their orientation is precisely controlled. They can also be made with ‘soft’ materials and thus can replicate important mechanical qualities. For instance, one type can replicate the movement of a jellyfish. Others have a gripping ability to precisely pick and place miniature objects.

This could pave the way to possible future applications in biomedicine and manufacturing. Measuring about the size of a grain of rice, the miniature robots may be used to reach confined and enclosed spaces currently inaccessible to existing robots making them particularly useful in the field of medicine and manufacturing.

Outro

We want to keep improving our content! So again, please, help us improve our content by completing the next survey:
https://forms.gle/DqPg1zd7gCiad3GF8

This is a blog for the community and we will like to keep featuring your work. Send a summary to robotics.community@canonical.com, and we’ll be in touch. Thanks for reading.

Blog

Peter Mahnke (Peter Mahnke) — Thu, 22 Jul 2021 14:33:09 +0000

The web team at Canonical run two-week iterations building and maintaining all of Canonical websites and product web interfaces. Here are some of the highlights of our completed work from this iteration.

Web

The Web team develops and maintains most of Canonical’s sites like www.ii0fi.com, canonical.com and more.

mir-fun88体育.io rebuild with a brand new tutorial section

We rebuilt the mir-fun88体育.io homepage and added a new tutorials page. This update included new sections for Ubuntu Frame and egmde, we improved the information by explaining the main features of Mir and added a driver compatibility table.

A tutorials page, based on microk8s has been added and we improved the styling based on microk8s website.

Private cloud pricing calculator rebuild

The web team has been working on rebuilding the private cloud pricing calculator. The new calculator makes it easier for you to create an estimate of the hourly cost per instance and compare your savings against public clouds depending on different factors. Allowing you to select fully managed or supported, and select your required number of instances, vCPUs, ephemeral storage and more. A new contact form has been added to provide the ability to fill out your requirements and receive an email with a breakdown of the costs specific to your case.

Brand

The Brand team develop our design strategy and create the look and feel for the company across many touch-points, from web, documents, exhibitions, logos and video.

Livepatch diagrams

We worked with the Project Management team to design a couple of diagrams to explain Livepatch at-a-glance and give an overview of Livepatch.

ROS ESM diagram

A flow diagram showing the steps of creating a security patch using ROS for ESM.

Marketing documents

A number of documents were created in collaboration with the Marketing team for them to use along with the Project Management teams.

Microstack video

We finished a short video to go on the microstack.run page to explain the benefits of Microstack and how it can be used to leverage the core services of Openstack to build a general purpose cloud.

Apps

The Apps team develops the UI for the MAAS project and the JAAS dashboard for the Juju project.

MAAS – Machine storage and network cloning UI

Summing up our UX work for MAAS Cloning UI, we have simplified a few areas of the design. Once a user selects multiple machines, the drop down will activate an action called `clone from`. This allows the user to clone these machines from a source machine.

To select a source machine, a list of 50 last modified machines will show up. You may select any machines in any state as a source machine, but destination machines need to be in either failed testing, ready, or allocated.

The list above allows you to search for the source machine by its hostname, system id, or tags as well as select whether you want to clone the network configuration or the storage configuration. Cloning works with a homogeneous hardware environment.

Once cloning is complete, you will see machines that are successfully cloned from this source and a list of machines that failed cloning in this panel. You may collapse this panel without closing to double check the results.

At the current stage, our goal is to expose this functionality in the UI, so people can clone machines. We hope to build more robust functionalities on top of this in the upcoming feature.

Vanilla

The Vanilla team designs and maintains the design system and Vanilla framework library. They ensure a consistent style throughout web assets.

Guest developers

This iteration was the first one when we invited developers from other squads to join us and work on Vanilla together. Huw and Caleb did a great job working together on updates to Notification component and helped us clean up the React components backlog by migrating remaining code to TypeScript.

Notification component updates

Main part of this iteration work was updating our Notification component with new style and additional options.

Notifications got a refreshed styling with additional borderless and inline variants. We also included additional elements for notification timestamp and actions.

TypeScript migration

Thanks to the efforts of our guest devs this iteration all of our React components have been migrated to TypeScript

Marketplace

The Marketplace team works closely with the Store team to develop and maintain the Snap Store site and the Charmhub site.

Vanilla – Key/value pair pattern

It is a design pattern to list a number of values with their corresponding keys.

It’s a component required when listing properties for a complex element in a collection of similarly grouped elements.

Available In “rack”

And “rack column”

All the specs are available in Discourse

Visual – form labels, mandatory field and error messages

This work aimed to improve accessibility and resolve inconsistencies around field validation. The way we indicate mandatory fields and the way we deal with erroneous submissions can be made more usable for users with or without assistive technology (AT).

Charmhub resources

Added a tab to the charm details page which shows the resources available to that charm.

Upload metadata

Completed the work around being able to upload metadata when you release a snap.

Reviewer experience discovery

While migrating the user experience flows from the Dashboard to snapcraft.io, we focus here on the reviewer experience.

We want to keep the same functionalities
while taking the opportunity to improve reviewer’s journey

We have done 6 interviews, stored and summarized all the findings using the tool Dovetail

Team posts:

With ♥ from Canonical web team.

Blog

Leia Ruffini (Leia Ruffini) — Thu, 22 Jul 2021 10:09:28 +0000

The Ubuntu in the wild blog post ropes in the latest highlights about Ubuntu and Canonical around the world on a bi-weekly basis. It is a summary of all the things that made us feel proud to be part of this journey. What do you think of it?

Ubuntu in the wild

Improving data center efficiency with digital twins

Being able to create a digital copy of a system easily allows engineers and designers to improve and optimise said system. The advances in AI/ML tooling and capacity are now making it possible to use digital twins to model data centers and optimize facilities’ design, as well as to detect potential operational issues.

Read more on that here!

Kubernetes: Portability vs Standardization

What if the ultimate goal of Kubernetes adoption was not to enable portability between clouds, but standardization? This article explores what people are really expecting from Kubernetes and cloud native technologies in general.

Read more on that here!

The future of Fintech

Curious to know what’s next for Fintech? The Fintech Five by Five report is exploring the tech trends that are shaping the future of the fintech sector. Read on for insights on edge computing, artificial intelligence, low-code, and more.

Read more on that here!

Surfacing Kubernetes challenges

The folks at the Channel Happy Hour analyse and report on the latest IT news. Following Canonical’s Kubernetes and cloud native operations report, the latest episode covers some of the challenges that companies are still facing today with Kubernetes.

Listen to the episode here!

Bonus: Wallpaper competition for Impish Indri

There is still one month left to participate in the wallpaper competition for Impish Indri – Ubuntu 21.10. We are still waiting to see some Macaroni art submissions, so don’t hesitate to submit yours!

Read more on that here!

Blog

Alex Chalkias (Alex Chalkias) — Wed, 21 Jul 2021 17:47:25 +0000

Today, the Kubernetes community made the 1.22 release candidate available, a few weeks ahead of general availability, planned for August the 4th. We invite developers, platform engineers and cloud tech enthusiasts to experiment with the new features, report back findings and bugs. MicroK8s is the easiest way to get up and running with the latest version of K8s for testing and experimentation.

MicroK8s is a lightweight, pure-upstream Kubernetes distribution with enterprise features such as self-healing high availability, Prometheus, Grafana and Istio baked-in as add-ons. As MicroK8s tracks all upstream releases, you can use the snap channels to select between, e.g. the latest/stable release for production or a beta or release candidate release for testing.

Test the latest Kubernetes on your machine

It requires a single command to get the latest Kubernetes with MicroK8s:

sudo snap install microk8s --channel=1.22/candidate --classic

Alternatively, go to https://snapcraft.io/microk8s and select 1.22/candidate.

MicroK8s runs on Ubuntu and all major Linux distributions, Windows and macOS. It supports x86 and ARM, and it is resource optimised to run on devices such as the RaspberryPi or the NVIDIA Jetson.

If you have feedback, good or bad, please let us know on Discourse or Slack (#microk8s). And if you have any bugs or technical issues to report, you can file them over on GitHub.

For more on MicroK8s, you can read the docs, follow the tutorials or dive into the use cases.

Blog

jiashiuan (jiashiuan) — Wed, 21 Jul 2021 13:10:05 +0000

DFI is the world’s first industrial computer manufacturer to join the Ubuntu IoT Hardware Certification Partner Program. Three DFI products have been certified recently, which means you will have an out-of-box experience, secure, faster time to market with DFI products and Ubuntu.

Ubuntu is preloaded on the certified devices, and Canonical provides 10 years of support. Furthermore, with the SMART START offering, enterprises can go to market faster and reduce costs.

In this webinar, you’ll hear from Taiten Peng (IoT Solution Architect at Canonical) and David Chen (FAE Leader at DFI) on
1. Why do developers need to use certified hardware
2. Which three DFI products have joined the Ubuntu certification family recently
3. How to leverage preloaded Ubuntu for IoT commercial project development

For more information, please visit Ubuntu Certified Hardware.

Blog

Igor Ljubuncic (Igor Ljubuncic) — Wed, 14 Jul 2021 12:14:50 +0000

For many people, fast broadband connection and unlimited data are a reality. For others, they are not. If you have several Linux hosts in your (home) environment, and you’re using snaps, each of these systems will separately communicate with the Snap Store and periodically download necessary updates. This can be costly in terms of inbound data.

A solution to this problem is to cache snap downloads – grab the snaps once and then reuse as many times as needed. There are two principal ways to achieve this. One, you can manually download the needed snaps on a single host and then distribute them across your internal network using a custom mechanism. The downside of this approach is that you will need to maintain your own regimen of updates. Two, you can set up a snap proxy fun88体育. In this guide, we’ll show you how to accomplish this.

Prerequisites

Please note this is a somewhat lengthy and complex tutorial. We will dabble in concepts like nginx Web fun88体育, postgresql database, networking proxying, services management, certificates, and similar. Each of these requires some familiarity with the subject matter, especially if you need to troubleshoot potential errors.

Moreover, you may need to take into account network security, as running a proxy fun88体育 brings its own challenges. On internal networks, this is less of an issue, but if you expose your machine to the Internet, you will need to exercise a range of healthy practices and rigorous security hardening.

Step 1: Configure postgresql database

Before you can configure the snap proxy, you need a database configuration. Install the postgresql package in your distribution. Then, to make it work with the snap proxy, the simplest script template you can use is as follows:

CREATE ROLE "snapproxy-user" LOGIN CREATEROLE PASSWORD 'snapproxy-password';
CREATE DATABASE "snapproxy-db" OWNER "snapproxy-user";
\connect "snapproxy-db"
CREATE EXTENSION "btree_gist";

Then, save the file, and run the script:

sudo -u postgres psql < proxydb.sql
CREATE ROLE
CREATE DATABASE
You are now connected to database "snapproxy-db" as user "postgres".
CREATE EXTENSION

Next, set the database connection string – you will be asked to provide the password you configured in the template script above.

sudo snap-proxy config proxy.db.connection="postgresql://snapproxy-user@localhost:5432/snapproxy-db"
Authentication error with user snapproxy-user.
Check the user name and password and that the user has the LOGIN privilege.
Please enter password for database user snapproxy-user (attempt 1 of 3):

Configured database for snaprevs role.
Configured database for snapauth role.
Configured database for snapident role.
Configured database for snapassert role.

Step 2: Install snap-proxy-fun88体育 snap

The next step is to install the snap proxy, and configure it.

sudo snap install snap-store-proxy

Once the snap is in place, you will need to configure your domain. This should be a routable network address for your clients – IP address or FQDN. How you manage the namespace is entirely up to you.

sudo snap-proxy config proxy.domain="DOMAIN"

For instance:

sudo snap-proxy config proxy.domain="10.0.2.15"

Step 3: Import certificates and register your snap proxy

Once the above step is complete, you will need to make your snap proxy instance recognizable and verified by the upstream Snap Store.

sudo snap-proxy import-certificate --selfsigned
sudo snap-proxy register

The registration process is interactive. You will be asked for your Ubuntu SSO email and password, and optionally a second factor one-time key. After that, the script will ask you a number of questions on what and how you intend to use your proxy:

Please enter the Ubuntu SSO account you wish to use to register this proxy.
Email: igor@canonical
Password:
Second-factor auth: 123456
Please let us know some details of your use-case:
Primary reason for using the Proxy:
  1: Update control of snap revisions
  2: Edge proxy for constrained network access
  3: Fun!
  4: Other
>

If everything goes well, you should see a message like the one below:

Thank you, you have registered proxy ID kEpuqguXTNRB4UK9LC6Nl6Pn7ibYJtr8.
Your proxy has been automatically approved, and is ready to use.

Step 4: Add proxy configuration

Now, we need to tell the proxy to cache downloads. The configuration file will have to be stored under:

/var/snap/snap-store-proxy/current/nginx/snap-proxy.conf

In this file, add the following text – please replace the generic placeholder PROXY_HOSTNAME with your domain, e.g.: 192.168.2.122, localhost, or something else you’ve configured early on.

upstream thestore {
        fun88体育 api.snapcraft.io:443;
}

fun88体育 {
    listen       80  default_fun88体育;
    fun88体育_name  _;
    return       444;
}

fun88体育 {
        listen 80;
        listen [::]:80;
        fun88体育_name PROXY_HOSTNAME; # hostname of your cloud proxy
        return 301 https://PROXY_HOSTNAME$request_uri;
}

fun88体育 {
        fun88体育_name PROXY_HOSTNAME; # hostname of your cloud proxy
        listen 443 ssl;
        ssl_certificate /etc/ssl/certs/cert.crt;
        ssl_certificate_key /etc/ssl/private/key.key;
        location / {
                proxy_pass      https://thestore;
                # Substitute all store downloads url returned in JSON responses
                # from the store and repoint them at this cloud proxy.
        # Requires ngx_http_substitutions_filter_module that comes with nginx-extras in Debian/Ubuntu.
                subs_filter_types application/json;
                subs_filter     https://api.snapcraft.io/api/v1/snaps/download/ https://PROXY_HOSTNAME/api/v1/snaps/download/;
        }

        location /api/v1/snaps/download/ {
                proxy_pass      https://thestore;
                # Trap redirects from the download endpoint and stream the
                # response from the cdn via an internal handler @handle_cdn.
                proxy_intercept_errors on;
                error_page 302 = @handle_cdn;
        }

        location @handle_cdn {
                Internal;
                # Resolver for the store cdn hosts. Test and set appropriately.
                resolver 127.0.0.53;
                set $cdn_url $upstream_http_location;
                proxy_pass $cdn_url;
        }
}

For example, using the IP address 10.0.2.15, this line:

return 301 https://PROXY_HOSTNAME$request_uri;

Becomes:

return 301 https://10.0.2.15$request_uri;

Step 5: Verify that the proxy works correctly

To function as required, the proxy will need to be able to contact the upstream Snap Store, but also identify itself correctly, with the right assertion key that matches your registered proxy ID.

First, check that the snap proxy is running, and all its services are in the active state:

sudo snap services snap-store-proxy
Service                        Startup  Current  Notes
snap-store-proxy.memcached     enabled  active   -
snap-store-proxy.nginx         enabled  active   -
snap-store-proxy.snapassert    enabled  active   -
snap-store-proxy.snapauth      enabled  active   -
snap-store-proxy.snapdevicegw  enabled  active   -
snap-store-proxy.snapident     enabled  active   -
snap-store-proxy.snapproxy     enabled  active   -
snap-store-proxy.snaprevs      enabled  active   -

Second, run the snap-proxy status command:

snap-proxy status
Store ID: kEpcqguXTNRM4UK9LC6Nl5Mn5ibYLtr7
Status: approved
Connected Devices (updated daily): 0
Device Limit: 5
Internal Service Status:
  memcached: running
  nginx: running
  snapauth: running
  snapdevicegw: running
  snapdevicegw-local: running
  snapproxy: running
  snaprevs: running

And finally, check the connection:

snap-proxy check-connections
http: https://dashboard.snapcraft.io: OK
http: https://login.www.ii0fi.com: OK
http: https://api.snapcraft.io: OK
postgres: localhost: OK
All connections appear to be accessible

Step 6: Configure your clients

We now need to tell our client systems that they should use the proxy. To that end, we will need to grab the assertion key and the proxy ID on the fun88体育.

curl -sk https://DOMAIN/v2/auth/store/assertions

Replace the DOMAIN placeholder with the domain you have used to configure your proxy. The command should return some data. Something like:

curl -sk https://localhost/v2/auth/store/assertions

Or perhaps:

curl -sk https://10.0.2.15/v2/auth/store/assertions

type: account-key
authority-id: canonical
revision: 2
public-key-sha3-384:
BWDEoaqyr25nF5SNCvEv2v7QnM9QsfCc0PBMYD_i2NGSQ32EF2d4D0hqUel3m8ul
account-id: canonical
name: store
since: 2016-04-01T00:00:00.0Z
body-length: 717
sign-key-sha3-384: -CvQKAwRQ5h3Ffn10FILJoEZUXOv6km9FwA80-Rcj-f-6jadQ89VRswHNiEB9Lxk
AcbBTQRWhcGAARAA0KKYYQWuHOrsFVi4p4l7ZzSvX7kLgJFFeFgOkzdWKBTHEnsMKjl5mefFe9ji
qe8NlmJdfY7BenP7XeBtwKp700H/t9lLrZbpTNAPHXYxEWFJp5bPqIcJYBZ+29oLVLN1Tc5X482R
vCiDqL8+pPYqBrK2fNlyPlNNSum9wI70rDDL4r6FVvr+osTnGejibdV8JphWX+lrSQDnRSdM8KJi
UM43vTgLGTi9W54oRhsA2OFexRfRksTrnqGoonCjqX5wO3OFSaMDzMsO2MJ/hPfLgDqw53qjzuKL
...

Now, repeat the command and save the assertion key into a file, e.g.:

curl -sk https://192.168.1.109/v2/auth/store/assertions > proxy.assert

Similarly, grab the proxy ID:

snap-proxy config internal.store.id

Copy the relevant information (and the assertion file) to your clients. And then, on each client, run:

sudo snap ack proxy.asset
sudo snap set core proxy.store=”PROXY ID”

For example, you may have three systems in your environment, 192.168.2.100, 192.168.2.101, and 192.168.2.102. You can configure the first to be the fun88体育 (use 192.168.2.100 for the snap-proxy configuration), and then your two clients will be .101 and .102 systems. These hosts need to be able to communicate with one another.

Now, you can install snaps on your clients. For each requested snap, the first download will necessarily have to take place, but then, it will be cached on the fun88体育.

Possible errors

As this is a non-trivial setup, there could be quite a few errors and snags.

Nginx not running

There could be multiple reasons why the Web fun88体育 might not be running. You may have something else bound to ports 80, 443 (like a different Web fun88体育 instance), or the configuration may be incorrect, for various reasons.

snap-proxy status
Store ID: kEpuqguXTNRM4UK5LC7Nl5Pn5ibZLtr2
Status: approved
Connected Devices (updated daily): 0
Device Limit: 5
Internal Service Status:
  memcached: running
  nginx: not running: (104, 'ECONNRESET')
  snapauth: running
  snapdevicegw: running
  snapdevicegw-local: running
  snapproxy: running
  snaprevs: running

Other errors you may encounter could be:

nginx: not running: [Errno 111] Connection refused

nginx: not running: hostname '10.0.2.15' doesn't match either of '10.0.2.15', '127.0.0.1', '127.0.0.1'

The first error would indicate that the necessary ports are not available (perhaps already in use). The second error would indicate a mismatch between the Web fun88体育 configuration and the snap-proxy configuration.

You can check and change the nginx configuration (inside the snap) under:

/var/snap/snap-store-proxy/current/nginx/nginx.conf

Of course, you will need some level of familiarity with Web fun88体育s in general, and nginx in particular, to be able to make the relevant adjustment. Then, restart (and/or reload) the fun88体育 after any change:

sudo snapctl restart snap-store-proxy.nginx

Invalid certificate

On your client, when you try to install a snap, you may get a warning that you’re using a wrong certificate:

snap install vlc
error: cannot install "vlc": Post https://10.0.2.15/v2/snaps/refresh: x509: certificate is valid for 127.0.0.1, not 10.0.2.15

This could stem from a misconfiguration in the Web fun88体育 or the proxy, not unlike having a certificate for say domain.com, but not for www.domain.com. You will need to adjust the nginx configuration, and/or reconfigure (and re-register) your proxy.

To re-register the proxy, run:

sudo snap-proxy reregister

You will need to rerun the client side commands again. Similarly, you may also see:

error: cannot install "vlc": Post https://127.0.0.1/v2/snaps/refresh: x509: certificate signed by unknown authority

If this happens, it might be because you’re using custom certificates, and/or your certificates have not been added during the proxy configuration step. You can tell the proxy to use any certificate that exists under your nginx directory, e.g.:

sudo snap set system store-certs.cert1="$(cat /var/snap/snap-store-proxy/current/nginx/127.0.0.1.cert)"

Similarly, you can reset the manually added certificates:

sudo snap-proxy remove-ca-certs

For information, please take a look at the snap proxy troubleshooting tutorial.

Summary

Caching snaps can be a rather useful functionality, especially in environments with lots of clients and limited network bandwidth. At home, the snap proxy is limited to five devices, but that should still give you some leverage toward managing snap installations and updates in an efficient way. Hopefully, this tutorial clarifies some of the less obvious elements of the snap proxy setup. If you have any questions or ideas, please join our forum, and let us know.

Unsplash.

Blog

Tytus Kurek (Tytus Kurek) — Tue, 13 Jul 2021 08:00:35 +0000

One of the core values of Canonical, that we all identify with, is the mission of bringing the power of open source to everyone on the planet. From developing to developed countries. From individuals to big enterprises. From engineers to CEOs. And there is only one way to find out if we are efficient in what we do. This is community feedback.

It is no different this time. The OpenStack User Survey 2020 results are out and Ubuntu was appointed by the entire OpenStack community as the most popular platform for OpenStack deployment. This is great news for Canonical and the entire Ubuntu community. It was a long journey, sometimes bumpy, but we made it. And we are not going to stop there!

#1 OS for OpenStack deployment

The OpenStack User Survey is an event organised by the Open Infrastructure Foundation on an annual basis. Participation is open and voluntary. All participants have to answer a few questions about their OpenStack deployment, including some demographic information as well as cloud size and deployment decisions. One of those questions is about the main operating system (OS) running this OpenStack cloud deployment.

Source: https://www.openstack.org/analytics/

According to the survey results from last year, 40% of respondents indicated Ubuntu fun88体育 as their main OS. This means that in practice, Ubuntu fun88体育 is considered as the default OS for OpenStack deployment in the majority of organisations worldwide. No wonder. OpenStack and Canonical have come a long way together. From the very beginning of OpenStack.

10 years together

Although OpenStack was founded as an open source project by NASA and Rackspace, Canonical has been involved in OpenStack development from the very early stages. For years we have been contributing to the OpenStack source code (Canonical is one of the biggest contributors of all the time) and packaging OpenStack binaries for straightforward consumption on Ubuntu. Canonical has also pioneered a number of solutions in the OpenStack deployment and operations automation space, effectively eliminating the complexity of OpenStack from its end users.

As a board member of the Open Infrastructure Foundation, we have been driving the evolution of the project towards new challenges, including network function virtualization (NFV), containers and the edge. We have been representing the entire community during various events and promoting the idea of open infrastructure. Even OpenStack and Ubuntu release cadences are synchronised, enabling users to benefit from new features and bug fixes brought by new OpenStack versions on their Ubuntu machines right after the upstream release.

Why do people choose Ubuntu for OpenStack deployment?

So what makes Ubuntu the preferred OS for OpenStack deployment? Well, there is no single answer to that. The commitment, the mission, the trust – all of that matters. However, there are a few advantages of OpenStack that are only available on Ubuntu. Those include:

Straightforward installation methods

If you have ever tried OpenStack before, you already know how complex it is. The complexity is just part of the nature of OpenStack. Fortunately, Canonical provides tools to eliminate this complexity. MicroStack, for example, enables you to install a single-node OpenStack cluster in just 2 commands and ~20 minutes. Start simple and evolve according to your needs.

Day-2 operations support

Another challenge OpenStack users usually face is day-2 operations support. How to ensure that the OpenStack cluster continues to run for a week, for a month, for a year since its initial deployment and continues to evolve at the same time. To deal with this challenge, Canonical packages OpenStack operations code, enabling full automation of typical operations tasks, such as database backups, scaling the cluster out or even OpenStack upgrades.

Predictable release cadence and upgrade path

Since the OpenStack release cadence follows the Ubuntu release cadence, users always know when to expect a new version. Canonical commits to release every new version of OpenStack on Ubuntu within 2 weeks from the upstream release. With Ubuntu, you are always up to date and even more importantly, you can easily upgrade from old versions to benefit from new features and bug fixes brought by the latest release.

100% open source

Contrary to other Linux distributions, Canonical delivers OpenStack using tools that are 100% open source. This avoids unpleasant surprises post-deployment or, even worse, unexpected costs. On Ubuntu you can use OpenStack for free as long as you want, benefitting from its openness and community support.

Optional enterprise support subscription

And last but not least, if you are looking for enterprise support for OpenStack, this is also something that Canonical provides. The Ubuntu Advantage for Infrastructure (UA-I) support subscription includes production-grade service-level agreements (SLAs), phone and ticket support, 10 years of security updates and more.

Join the community

If you are wondering now how to join the OpenStack Ubuntu community, here are some useful tips for you:

Try OpenStack on Ubuntu by following our simple installation instructions. MicroStack enables you to get fully functional OpenStack up and running on your workstation in just 2 commands and ~20 minutes.

Or get in touch with Canonical if you are planning a migration to Ubuntu from other Linux distributions. We will happily help you choose the best architecture that fits your needs and optimise your private cloud for price-performance.

You can also fill in the OpenStack User Survey 2021 to influence the community and software directions moving forward. The survey is open now and closes on August, 20th.

Blog

Nikos Mavrogiannopoulos (Nikos Mavrogiannopoulos) — Fri, 09 Jul 2021 12:58:53 +0000

Canonical Livepatch is the service and the software that enables organizations to quickly patch vulnerabilities on the Ubuntu Linux kernels. Livepatch provides uninterrupted service while reducing fire drills during high and critical severity kernel vulnerabilities. It is a complex technology and the details can be confusing, so in this post we provide a high level introduction to Ubuntu Linux kernel livepatching and the processes around it.

Livepatch introduction

When reviewing the major cybersecurity data breaches via web services (e.g., from the 2021 Verizon data breach investigations report), one cannot but notice that after credential based attacks, the exploitation of vulnerabilities is the major attack vector. According to the same report, only a quarter of scanned organizations patch vulnerabilities in less than two months after being public, something that indicates that organizations are not generally proactive and consistent in vulnerability patching. And that’s not without a reason; addressing vulnerabilities through unplanned work is a challenge as it takes the organization’s focus away by creating unplanned maintenance windows where patches are being applied and systems are rebooted, while its customers or users face an unavailable service.

At the same time, threats do not go away; critical and high severity vulnerabilities can appear at arbitrary times and potentially expose important data or services. Canonical’s vulnerability data show that 40% of high and critical severity vulnerabilities affect the Linux kernel, the highest of any other package. Addressing this vulnerability window quickly and smoothly for Ubuntu systems, is the goal of Canonical Livepatch. It eliminates the need for unplanned maintenance windows for critical and high severity kernel vulnerabilities, by patching the Linux kernel while the system runs.

What happens when a kernel vulnerability is detected?

In particular, when Canonical detects a high or critical vulnerability on the Linux kernel we will create a livepatch addressing the vulnerability. After the livepatch is made available, it is tested in Canonical’s internal fun88体育 farm, and then promoted gradually to a series of testing tiers ensuring that any released livepatch has been tested sufficient time on live systems. Once the patch is released a Livepatch Security Notice is issued and systems that enable the Canonical Livepatch client will receive the patch over an authenticated channel and apply it.

How does kernel livepatching work?

There are many types of vulnerabilities and many reasons behind them, such as a logic error or a missing check in a small piece of code, and others. On the high level the livepatch will provide new kernel code replacing the vulnerable one, and will update the rest of the kernel to use the new code. The diagram below shows how a kernel vulnerability is being patched using Canonical Livepatch.

The simplistic description above shows the principle, but also hints on why some vulnerabilities that depend on very complex code interactions cannot be livepatched. When a kernel vulnerability cannot be livepatched, a Livepatch Security Notice is issued that advises to apply any pending kernel updates and reboot.

How can I access the Canonical Livepatch

Livepatch is available through Ubuntu Advantage and Ubuntu Pro to organizations and customers that take advantage of Ubuntu’s security features. Beyond that, as Ubuntu’s mission is to bring free software to the widest audience, developers and individuals can access Canonical Livepatch through a free subscription. The free subscription allows for up to 3 machines and up to 50 for Ubuntu community members.

[Get Ubuntu Advantage] [Get a Free subscription]

How to enable Canonical Livepatch

Canonical Livepatch can be enabled in two steps; First obtain your subscription token via the Ubuntu Advantage portal. The first step is necessary for both free subscription and Ubuntu Advantage users, but it is not necessary on Ubuntu Pro. Then you will need to enable it. The steps are:

$ sudo ua attach [TOKEN]

$ sudo ua enable livepatch

Conclusions

The Canonical Livepatch service reduces your unplanned work and allows you to schedule your maintenance windows. Take advantage of livepatching and provide uninterrupted service to your users by applying high and critical severity kernel updates without rebooting.

Blog

Bill Wear (Bill Wear) — Thu, 08 Jul 2021 22:46:12 +0000

This blog title should really be, “Why you always, always, always want conflict detection turned on on all the networks MAAS touches,” but that’s really long as a title. But hear me out.

As promised, here is another DHCP blog, this time explaining how you can have multiple DHCP fun88体育s on the same subnet, serving overlapping IP addresses. There are a lot of network-savvy folks who will tell you that serving the same set of IP addresses from two different DHCP fun88体育s just won’t work. While that’s a really good rule to follow, it isn’t totally accurate under all conditions.

Keeping it “loosely coupled”

Some DHCP implementations offer a feature called fun88体育 conflict detection. In short, DHCP SCD uses ICMP Echo messages (pings) — with an appropriate wait time — to see if an IP address is in use before trying to lease it to a client. If all the DHCP fun88体育s on a given subnet have SCD enabled, you don’t have to worry about whether the DHCP fun88体育 scopes overlap. You can assign whatever set of IP addresses you want to whichever DHCP fun88体育, and they will work together without addressing errors.

So what’s really surprising about this feature? Well, in RFC 2131, ping checks are recommended on both ends, by the DHCP fun88体育 and the client:

As a consistency check, the allocating fun88体育 SHOULD probe the reused address before allocating the address, e.g., with an ICMP echo request, and the client SHOULD probe the newly received address, e.g., with ARP.

The capital letters there came from the spec itself. Essentially, DHCP fun88体育s really should check to make sure the addresses they send out aren’t already in use — and clients that get them should make sure they’re actually free before they use them.

From an architectural perspective, it might make more sense for DHCP fun88体育s to be enabled to talk to each other and coordinate assignment of IP addresses. It is possible to build and configure such DHCP fun88体育s — but that type of coordination isn’t really in keeping with the fundamental operation of DHCP.

As a protocol, DHCP is designed to be loosely coupled. Specifically, any client that has the DHCP protocol stack can discover any DHCP fun88体育 or fun88体育s; any fun88体育 can make an offer; and a client can take whichever offer it wants (though it’s typically coded to take the first DHCP offer that it can accept). Keeping that loosely-coupled architecture intact means letting DHCP fun88体育s check to see if the address they’re sending is in use before offering it, and letting clients check to see if an IP address is in use before they request to accept the offer.

The value for MAAS

There’s no exact count, but it’s fair to say that a very large number of MAAS installation and configuration issues resolve around competing DHCP fun88体育s, that is, multiple DHCP fun88体育s on the same subnet, using the same scope (or overlapping scopes), colliding with each other and preventing machines from getting IP addresses. This collision usually shows up as an ability to power on a machine, but not to commission it, since it can’t manage to complete the process of getting an IP address via DHCP.

MAAS already has some conflict detection built in, as documented in Managing DHCP:

In some cases, MAAS manages a subnet that is not empty, which could result in MAAS assigning a duplicate IP address. MAAS is capable of detecting IPs in use on a subnet. Be aware that there are two caveats
1. If a previously-assigned NIC is in a quiescent state or turned off, MAAS may not detect it before duplicating an IP address.
2. At least one rack controller must have access to the IP-assigned machine in order for this feature to work.
MAAS also recognises when the subnet ARP cache is full, so that it can re-check the oldest IPs added to the cache to search for free IP addresses.

If you want your configuration to run more smoothly, it’s useful to enable SCD on every DHCP provider on your network. It doesn’t hurt anything, and it really doesn’t cost that much (beside a little extra delay when assigning addresses). There are plenty of network issues associated with a large, bare-metal network. There’s no reason why DHCP conflicts need to be one of those issues.

Blog

Bill Wear (Bill Wear) — Thu, 08 Jul 2021 16:11:38 +0000

It’s possible to have more than one DHCP fun88体育 on the same network and still have everything work right, with no conflicts and no dropped packets or IP requests. It’s really not that hard to pull together, either, but there are some things to know, and some things to consider before we investigate that situation. For this blog, we’ll put some of the overlooked facets of DHCP in bold text. Let’s take a look.

A deep look at DHCP

DHCP is, technically, a network management protocol. In other words, it’s part of a collection of hardware and software tools that help to manage network traffic. DHCP is designed to automatically assign IP addresses and other communication parameters, such as default gateway, domain name, name fun88体育 IPs, or time fun88体育 IPs to clients. There are (at least) two participants in a DHCP transaction: a fun88体育 and a client, but the client has to meet some requirements to participate. Specifically, the client has to implement an instance of the DHCP protocol stack; without that, it has no idea how to formulate Discovery and Request packets, nor can it recognise Offers or Acknowledgements (or NAKs, for that matter).

For what it’s worth, the “DHCP protocol stack” just means that a device can handle at least the following standard message types:

DHCPDiscover: a broadcast message sent in the hopes of finding a DHCP fun88体育. Note that clients that don’t get a DHCP response may be able to assign themselves an Automatic Private IPv4 address (APIPA), which should always be in the range 169.254.0.0/16. This is good to know, because you want to pretty much always leave that scope (that range of IP addresses) unused by anything else in your system.
DHCPOffer: also a broadcast message, one that offers an IPv4 address lease; the lease is more than just an IP address, as we saw in the last DHCP blog.
DHCPRequest: If you haven’t noticed by now, DHCP exchanges are little like rolling snowballs: they pick up more protocol information as they go and keep it for the duration of the transaction, sending it back and forth. In this case, the client sends back everything the DHCP fun88体育 sent, along with a request to actually take the offered lease.
DHCPAcknowlegement: If everything matches up when the DHCP fun88体育 gets the Request, it responds with an Acknowledgement, which basically says, “Okay, you can lease this IP address for a set period of time.”
DHCPNak: If the client waits too long to Request an Offer (generally, if a different fun88体育 has already claimed the offered IP address), the DHCP fun88体育 may respond with a Nak. This requires the client to start over again at Discover.
DHCPDecline: If the client determines that, for some reason, the Offer has a configuration that won’t work for it, it can Decline the offer — that this also means it has to start again at Discover.
DHCPRelease: When a client is done with an IP address, it can send a Release message to cancel the rest of the lease and return the IP address to the fun88体育’s available pool.
DHCPInform: This is a relatively new message, which allows a client that already has an IP address to easily get other configuration parameters (related to that IP address) from a DHCP fun88体育.

As you may recall from the previous blog, the normal DHCP sequence is often referred to as DORA for “Discover, Offer, Request, Acknowledge,” which is what happens when everything goes right the first time. Note that, shortly before a lease expires, most DHCP clients will renew the lease, often with a shortened form of the exchange (Request/Acknowledge) which does not require a full DORA exchange. Also, this renewal exchange takes place directly between the client and the DHCP fun88体育, rather than being broadcast across the entire network.

Address allocation

There are (at least) three ways that a DHCP fun88体育 can assign addresses to requesting clients:

Manual or static allocation essentially means that the client receives a specifically-chosen IP address, or, at a minimum, keeps the first one that it’s assigned until the client decides to release it.
Dynamic allocation means that a DHCP fun88体育 assigns IP addresses from an available pool (scope) of addresses, which can change to another available address in that scope at any time, depending on the network dynamics.
Automatic allocation is sort of a cross between the other two types. The DHCP fun88体育 assigns an address from its defined scope, but then remembers which client got what address, and re-assigns that address to the same client when a new request is made.

Regardless of the allocation method, the DHCP fun88体育’s scope — its range of IP addresses that it controls (and can assign) — is something that must be user-configured.

A UDP exchange

DHCP is “connectionless,” meaning that basically everything takes place via UDP, usually by broadcast packets — that is, packets not overtly addressed to a specific device. As we saw in the last blog, the messages become targeted pretty quickly, using the payload to specify the IP address of the DHCP fun88体育 and the MAC address of the requesting client, to avoid requiring every other device on the network to completely decode every DHCP message. Note that it is possible to target a UDP packet at a specific fun88体育, by choosing a unicast message type.

Scope, allocation, topology, and authority

A DHCP client can request its previous IP address, if it had one, but whether it gets that address or not depends on four things: scope, allocation, topology, and authority. Specifically:

The larger the DHCP fun88体育’s scope of addresses, the more likely it is that the requested address will be available again.
The chances of getting the same IP address again also depend on how the fun88体育 is allocating addresses (see above). Static allocation guarantees the same address; automatic allocation makes it very likely; with dynamic allocation, it’s impossible to predict.
Topology also plays into this process: if the DHCP fun88体育 is using one or more DHCP relays to get some or all of its addresses, the chances of re-using the same IP address go down.
Authority also affects the probability. An authoritative DHCP fun88体育 will definitely answer any unanswered DHCPDiscover message, but that fun88体育 is pulling only from its own scope.

So now that we have a few of these odds and ends down pat, let’s consider the situation when multiple DHCP fun88体育s operate on one network.

Multiple DHCP fun88体育s

With regard to multiple DHCP fun88体育s on the same network, there are three possible scopes to consider:

Overlapping scopes: In this situation, more than one fun88体育 can offer the same IP address. There is a way to make this work, by setting up the DHCP fun88体育s to talk to one another, but for most applications, this configuration can be avoided. We’ll discuss DHCP fun88体育s with overlapping scopes in the next DHCP blog.
Adjacent scopes: In this configuration, IP addresses are assigned from portions of the same subnet. For example, one fun88体育 might control scope 192.168.14.2 – 192.168.14.187, and another fun88体育 might manage scope 192.168.14.200 – 192.168.14.247. This is the most common (and most reliable) setup for multiple DHCP fun88体育s.
Heterogeneous scopes: This arrangement basically has DHCP fun88体育s on different subnets, such as 192.168.14.2 – .253 for one fun88体育, and 10.17.22.3 – .98 for the other. This can be made to work, but it’s extremely difficult to set up and not so easy to manage. We’ll also cover this outlier in the next blog.

So essentially, we’ve narrowed down our focus to the most obvious and reliable use case, adjacent DHCP scopes. But how do the two fun88体育s work together to manage DHCP requests?

Remember, connectionless

Well, the answer is, “they don’t.” The fun88体育s and clients operate independently on a first-come, first-served basis. A client makes a DHCPRequest. One or both of the fun88体育s may answer, depending on load and spare IP addresses. It’s also possible that neither will answer, because they’re both out of IP addresses, but with good network planning — and making one of those fun88体育s authoritative — those situations will be kept to a minimum or eliminated entirely.

If no fun88体育s answer, we may be looking at the APIPA situation, if that’s possible in the network. If one fun88体育 answers, it’s a standard DORA exchange, as if there were only one fun88体育. If two fun88体育s answer, it’s the question of which Offer the client gets first. Remember that the Offer messages contain the DHCP fun88体育’s address in the payload.

Clarity is sometimes power

Hopefully, the foregoing discussion helped to clear up some potentially confusing things about DHCP in a more complex network environment. We’ll tackle the more difficult cases in the next DHCP blog, and then we’ll move on to some detailed examples.

Blog

Canonical (Canonical) — Thu, 08 Jul 2021 14:52:43 +0000

LONDON — July 8, 2021 — Canonical, the publishers of Ubuntu, today announced it has been named a winner for a 2021 Microsoft Partner of the Year Award. The company was honored among a global field of top Microsoft partners for demonstrating excellence in innovation and implementation of customer solutions based on Microsoft technology.

Canonical and Microsoft launched Ubuntu Pro in 2020 to give customers a seamless experience, combining the infrastructure of Azure with the security and compliance features of Ubuntu, the world’s most popular Linux for cloud environments.

“By teaming with Microsoft, we’ve been able to help the increasing number of organizations that want to migrate to Azure through Ubuntu,” said Daniel Bowers, Canonical VP of Cloud Alliances. “Being named a Microsoft Partner of the Year winner is a wonderful validation of the work we’ve been doing together to help businesses of all sizes achieve their digital goals, with no compromises on security, support, and efficient management of workloads.”

The Microsoft Partner of the Year Awards recognizes Microsoft partners that have developed and delivered outstanding Microsoft-based solutions during the past year. Awards were classified in various categories, with honorees chosen from a set of more than 4,400 submitted nominations from more than 100 countries worldwide. Canonical was recognized for providing outstanding solutions and services.

“I am honored to announce the winners and finalists of the 2021 Microsoft Partner of the Year Awards,” said Rodney Clark, corporate vice president, Global Partner Solutions, Channel Sales and Channel Chief, Microsoft. “These remarkable partners have displayed a deep commitment to building world-class solutions for customers—from cloud-to-edge—and represent some of the best and brightest our ecosystem has to offer.”

About Canonical

Canonical is the company behind Ubuntu, the leading OS for container, cloud, and hyperscale computing. Most public cloud workloads use Ubuntu, as do most new smart gateways, switches, self-driving cars and advanced robots. Canonical provides enterprise security, support, and services to commercial users of Ubuntu. Established in 2004, Canonical is a privately held company.

Blog

Peter Mahnke (Peter Mahnke) — Thu, 08 Jul 2021 07:21:55 +0000

The web team at Canonical runs two-week iterations building and maintaining all of Canonical websites and product web interfaces. Here are some of the highlights of our completed work from this iteration.

Web

The Web team develops and maintains most of Canonical’s sites like www.ii0fi.com, canonical.com and more.

Security certification docs

If you were not aware by now the team has been working to migrate all user-facing documentation to our discourse content model. As we are near completion of all docs, we worked on Security certification docs this iteration. Which loads its content from our Security Certification category on discourse.

Visit the Ubuntu security certification documentation

Brand

The Brand team develop our design strategy and create the look and feel for the company across many touch-points, from web, documents, exhibitions, logos and video.

Google Cloud social banners

Working with the Marketing team we developed a number of jointly branded social media Ads to promote the use of Ubuntu Pro for Google Cloud.

Marketing documents

A group of documents were created in this iteration for use by the Marketing and Project Management teams, including case studies, whitepapers and datasheets.

Mir illustrations

Four illustrations were created for the Mir team to be used in the upcoming refresh of the Mir website.

StackOverflow banners

We created some social media banners to be used on StackOverflow with the aim of promoting Ubuntu fun88体育 and Ubuntu LTS.

Vanilla

The Vanilla team designs and maintains the design system and Vanilla framework library. They ensure a consistent style throughout web assets.

New in Vanilla v2.32.0

Deprecated the neutral button

We deprecated the .p-button–neutral class, as it was identical to the default .p-button variant of the component, which should now be used instead.

Introduced theming for buttons

Buttons now have light and dark themes. The light theme is used by default, but it’s possible to change that default to dark, and also to switch between dark and light themes by adding the appropriate .is-dark/.is-light utility class on individual buttons:

Updates to labels component

We updated our internally used label component, and added a default .p-label variant to it alongside several existing flavours, which can be used to indicate status, be displayed as tags, or other useful information:

Utility class for tables

By default, Vanilla tables hide any content that would overflow from the cell. The newly added .has-overflow class allows the content of a cell to spill out over the cell. This is particularly useful when the cell contains a contextual menu that drops down a set of actions.

New design system website – Component / Pattern page redesign

The first MVP feature we worked on for the new site is to redesign the component / pattern page. As a key part of the design system, we want to allow all users in different roles to access the information they require. By splitting each component page into three tabs – Design guidelines, implementation and accessibility, we provide better categorisation of the information.

Audit and review of the use of spacing in Vanilla

Internally, the spacing within and between Vanilla components is controlled by a set of variables that aim to keep similar elements spaced consistently. It is an elaborate system that hasn’t been well documented, so as a first step towards full documentation, this iteration we completed a visual audit. We also identified and fixed a few cases of incorrect usage.

Apps

The Apps team develops the UI for the MAAS project and the JAAS dashboard for the Juju project.

React migration sprint clean-up

Continuing from the migration sprint from the previous iteration, we cleaned up some of the finished sections and finalised some of the unfinished sections. This meant cleaning up and refactoring our code to the right convention and aligning the UI components with the rest of the React app. As far as the progress goes, our dashboard, DNS, and Availability Zones pages have been fully migrated. The Images page is also now about 90% complete.

Dashboard

Domains

Zones

Images

Machine cloning

In this two week iteration, we focused on exposing the cloning API to the UI, where we want to allow MAAS users to clone network and/or storage configurations from a source machine to multiple destination machines. We worked through a few explorations of interaction design to figure out how this could fit with the current workflow. Here is our first prototype of the new cloning UI, if you want to try it out.

The overall flow starts at selecting destination machines. When a user selects multiple machines, they have an option to clone the networking and/or the storage configurations from a source machine into the selected destination machines.

In this workflow, we assume that our users would already know which source machine they want to clone from and that cloning will work with a homogeneous hardware environment.

You can either clone the storage or network configuration from the source machine to the destination machine or both! Since our assumption is that you would already have an idea of which source machine you want to clone from, the search function allows you to search by hostname or system id.

To be able to successfully clone machines, the source and destination machines need to be in one of the following states: failed testing, allocated, or ready. In addition, the user needs to have admin permission on all machines that the cloning will be performed on.

Once the source machine is selected from the drop-down list, you will see a brief summary of the source machine, including the network and storage information.

Once the cloning process is complete, we will report the number of successful machines and error machines, allowing you to either select other machines to clone or inform why the cloning process failed.

One of the more common mistakes is to clone machines with different disk sizes. In our current API, if the destination machine has a smaller disk size than the source machine, cloning will not be successful. The same mental model goes for block devices as well. Other errors that can occur includes, selecting machines with unmatched boot methods and unmatching networking interfaces.

Showing IP addresses in the UI network card

We received a bug report that the IP address should be surfaced to the network summary card because it is one of the most important pieces of information regarding the Network tab of a machine in MAAS. However, we were not showing that information in the network card in the Summary section.

Although it looked like the IP address was way more relevant than the MAC address, MAC address and DHCP were very important in an enterprise-level MAAS and cannot be eliminated from the Network card and we cannot disregard that, especially, for debugging purposes.

With that in mind, we initially looked for a way to switch between both of them, MAC addresses and IP addresses, since space matters in this kind of card.

The final decision, nonetheless, was to show both. In addition, we took this opportunity to enrich the table and include more information from the Network tab, like subnet and VLAN.

Marketplace

The Marketplace team works closely with the Store team to develop and maintain the Snap Store site and the upcoming Charmhub site.

Kubernetes and cloud native operations report 2021

We recently ran a survey about Kubernetes and the cloud. Almost 1200 people have responded to it so far.

We build a report to show the results, insights and commentary from industry experts.

Read the report

List collaborations for Charmhub publishers

Charmhub publishers will now be able to see and modify charms or bundles when they are a collaborator of that package.

Store reviewer research

We have been doing a series of interviews to discover more in-depth the role of a reviewer in a store, as part of our work to migrate the reviewer pages from dashboard.snapcraft.io to snapcraft.io. As an initial summary of our discoveries, we built a user flow that details the process reviewers have to go through when a manual review is needed, including some of the most common pain points of their flow. This will be the basis of the future migration and improvements to the functionality later in this cycle.

With ♥ from Canonical web team.