| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-05-20 | |||
| 19:33:59 | sean-k-mooney | melwitt: ya i think those two are requried and likely the type as well i.e. symetic | |
| 19:34:15 | melwitt | ah ok | |
| 19:34:17 | sean-k-mooney | having said that i think we are only going to support symmetric encption | |
| 19:34:26 | melwitt | ah right | |
| 19:34:30 | sean-k-mooney | so i guess if its single valued | |
| 19:34:34 | sean-k-mooney | it does not matter for now | |
| 19:36:01 | sean-k-mooney | melwitt: you know what would help | |
| 19:36:14 | melwitt | yeah, we can adapt that as we go along. if we think more than just those two should be required to be present to be valid | |
| 19:36:18 | melwitt | because the other use case is an individual user uploading an encrypted image | |
| 19:36:26 | sean-k-mooney | in your spec can you define the only values of the os_glance_encrypt* properties that will actully work for now | |
| 19:36:28 | melwitt | so not sure if they will be required to provide all image properties | |
| 19:37:53 | sean-k-mooney | like will you be using os_glance_decrypt_size? | |
| 19:38:11 | sean-k-mooney | i dont think you are your using virt_size + 1G in the check right | |
| 19:38:15 | melwitt | sure I can add specifics about which ones we are requiring | |
| 19:38:35 | melwitt | there is a check for that somewhere actually | |
| 19:38:39 | sean-k-mooney | well it might hjsut be good to say hay nova is not using os_glance_decrypt_size | |
| 19:39:12 | melwitt | today we validate image size in some way and I had to add the "plus overhead" to the calc if encrypted for it to pass | |
| 19:39:19 | sean-k-mooney | right | |
| 19:39:41 | sean-k-mooney | but if i rememebr reviewing that code we do not use os_glance_decrypt_size | |
| 19:40:22 | melwitt | yeah I guess really i could use os_glance_decrypt_size instead for the validation if the image is encrypted. since that's what we actually care about, is if the decrypted size will fit in the chosen flavor | |
| 19:40:46 | melwitt | no we didn't have os_glance* properties proposed at the time | |
| 19:40:49 | sean-k-mooney | os_glance_decrypt_size and os_glance_decrypt_container_format i think are for the usecase of booting form an encypted iamge and decypting it on the host | |
| 19:40:56 | melwitt | well, sorry | |
| 19:41:03 | sean-k-mooney | which would imply they expect the virtual_size to include the overhead | |
| 19:41:06 | melwitt | they were proposed already but we were not planning to use them initially | |
| 19:41:09 | sean-k-mooney | when its encypted | |
| 19:41:24 | melwitt | but at the ptg we agreed to use them so I will be changing where needed to use those instead of what I had put | |
| 19:41:52 | sean-k-mooney | sure but os_glance_decrypt_size is defied as "size after payload decryption" | |
| 19:42:07 | sean-k-mooney | which would be the size of the data insid ethe luks encyption | |
| 19:42:15 | sean-k-mooney | not the size on disk fo the encypted images | |
| 19:42:45 | sean-k-mooney | so i dont think it actully helps us | |
| 19:42:52 | melwitt | right.. maybe I'm getting confused | |
| 19:43:11 | sean-k-mooney | i think this is explcitly for the usecase of booting non encypted instance form an encypted image | |
| 19:43:26 | melwitt | the point I was meaning really is I'll use them when applicable | |
| 19:43:26 | sean-k-mooney | so that we woudl know how big it is after we strip the encyption from it | |
| 19:43:34 | sean-k-mooney | ack | |
| 19:44:04 | sean-k-mooney | ok ill chat ot you tomorrow o/ | |
| 19:44:14 | melwitt | ok I see what you're saying | |
| 19:44:18 | melwitt | ok, seeya tomorrow o/ | |
| 21:41:25 | opendevreview | Merged openstack/nova master: Enable virtio-scsi in nova-next https://review.opendev.org/c/openstack/nova/+/918458 | |
| #openstack-nova - 2024-05-21 | |||
| 04:36:36 | opendevreview | melanie witt proposed openstack/nova-specs master: Re-propose specs for ephemeral encryption https://review.opendev.org/c/openstack/nova-specs/+/907654 | |
| 06:05:22 | opendevreview | xielijie proposed openstack/nova master: Fix Timestamp Inconsistency During VM Creation https://review.opendev.org/c/openstack/nova/+/920074 | |
| 07:50:16 | opendevreview | Andrew Bonney proposed openstack/nova master: Set port dns_name when unshelving instances https://review.opendev.org/c/openstack/nova/+/919961 | |
| 07:52:34 | opendevreview | Andrew Bonney proposed openstack/nova master: Set port dns_name when unshelving instances https://review.opendev.org/c/openstack/nova/+/919961 | |
| 08:59:22 | opendevreview | Merged openstack/nova-specs master: Add openapi spec https://review.opendev.org/c/openstack/nova-specs/+/909448 | |
| 09:18:25 | opendevreview | Andrew Bonney proposed openstack/nova master: Don't reset port dns_name when shelving instances https://review.opendev.org/c/openstack/nova/+/919961 | |
| 10:59:43 | opendevreview | sean mooney proposed openstack/nova master: ensure correct cleanup of multi-attach volumes https://review.opendev.org/c/openstack/nova/+/916322 | |
| 10:59:43 | opendevreview | sean mooney proposed openstack/nova master: add functional repoducer for bug 2048837 https://review.opendev.org/c/openstack/nova/+/919979 | |
| 11:11:17 | opendevreview | sean mooney proposed openstack/nova master: fix py312 tox definitions https://review.opendev.org/c/openstack/nova/+/920090 | |
| 11:11:18 | opendevreview | sean mooney proposed openstack/nova master: tox: Drop envdir https://review.opendev.org/c/openstack/nova/+/920091 | |
| 11:12:57 | sean-k-mooney | dansmith: can you look at https://review.opendev.org/c/openstack/nova/+/907591 and https://review.opendev.org/c/openstack/nova/+/920090/1 to fix our tox usage when your about | |
| 13:30:23 | opendevreview | sean mooney proposed openstack/nova master: ensure correct cleanup of multi-attach volumes https://review.opendev.org/c/openstack/nova/+/916322 | |
| 13:30:23 | opendevreview | sean mooney proposed openstack/nova master: add functional repoducer for bug 2048837 https://review.opendev.org/c/openstack/nova/+/919979 | |
| 13:38:57 | dansmith | sean-k-mooney: ah sorry I had made the tox change locally and I guess I didn't get it into my commit, sorry | |
| 13:39:25 | sean-k-mooney | no worries i just noticed it was running the wrong thing when i saw a ci run fail | |
| 13:41:27 | sean-k-mooney | on the plus side the job is still passing when its runing to correct content so looks like we have not regressed since we merged it | |
| 15:17:46 | opendevreview | Merged openstack/nova master: tox: Drop envdir https://review.opendev.org/c/openstack/nova/+/907591 | |
| 16:09:38 | dansmith | just did my fifth recheck trying to get the de-UEC patch merged.. none of the failures were kernel crashes, but dang.. seems bad the last couple days | |
| 16:19:40 | sean-k-mooney | is that includign the one i did this morning | |
| 16:19:52 | sean-k-mooney | but ya im not sure what has changed | |
| 16:57:38 | opendevreview | sean mooney proposed openstack/nova master: add functional repoducer for bug 2065927 https://review.opendev.org/c/openstack/nova/+/920119 | |
| 17:13:59 | opendevreview | Merged openstack/osc-placement master: tox: Drop envdir https://review.opendev.org/c/openstack/osc-placement/+/907596 | |
| 17:43:29 | opendevreview | Merged openstack/nova master: fix py312 tox definitions https://review.opendev.org/c/openstack/nova/+/920090 | |
| 18:19:33 | opendevreview | Alexey Stupnikov proposed openstack/nova master: [doc] Improve description for nova-manage db purge https://review.opendev.org/c/openstack/nova/+/919746 | |
| 18:19:48 | opendevreview | Merged openstack/placement master: tox: Drop envdir https://review.opendev.org/c/openstack/placement/+/907590 | |
| #openstack-nova - 2024-05-22 | |||
| 02:44:52 | opendevreview | Merged openstack/nova master: [doc] Improve description for nova-manage db purge https://review.opendev.org/c/openstack/nova/+/919746 | |
| 07:06:23 | opendevreview | Rajesh Tailor proposed openstack/nova master: Handle neutron-client conflict https://review.opendev.org/c/openstack/nova/+/918048 | |
| 12:36:25 | zigo | Hi. Is it still the case that VMs with SEV cannot be live-migrated? | |
| 12:46:00 | sean-k-mooney | im pretty sure we supprote sev live migration in the inital release | |
| 12:46:23 | sean-k-mooney | oh apprently not https://docs.openstack.org/nova/latest/admin/sev.html#impermanent-limitations | |
| 12:46:29 | zigo | That's not what the doc says indeed. | |
| 12:47:03 | sean-k-mooney | we have not modifyied it but the only reason we woudl not have supported it orginally is if qemu did not supprot it | |
| 12:48:00 | sean-k-mooney | https://lore.kernel.org/all/20190809185434.GH2840@work-vm/T/ there was a patch to enabel it | |
| 12:48:08 | sean-k-mooney | but i dont know if that ever merged | |
| 12:48:45 | sean-k-mooney | still listed as todo https://www.qemu.org/docs/master/system/i386/amd-memory-encryption.html#live-migration | |
| 12:58:59 | tkajinam | zigo, as you said the patch has never been merged. sev_mig_blocker is still present in the latest qemu. | |
| 12:59:34 | tkajinam | I'm not aware of any work to implement live migration for SEV instances recently. I guess AMD put more focus on SEV-SNP now | |
| 13:01:14 | tkajinam | Intel is working to implement live migration support in Intel TDX 1.5 . I don't know how long it would take until it reaches upstream (tdx 1.0 is not yet merged upstream afaik) but that's explained explicitly as an upcoming feature | |
| 13:54:15 | sean-k-mooney | tkajinam: well SEV-SNP would depend on live migration supprot for sev in general right | |
| 13:54:55 | sean-k-mooney | i.e. if amd wanted to supprot live-migration for SEV-SNP i doubt they coudl do that without first closing the general sev gap | |
| 13:55:14 | zigo | Ok, thanks for the details. | |
| 13:56:39 | sean-k-mooney | zigo: on a related not live migration is not currently supproted with vTPM either that is more upsetting as i expect it will be more widely used becasue of microsfot requiring it for windows server | |
| 13:57:34 | sean-k-mooney | as far as we can tell qemu currently only supprot live migration if you put the vtpm dir on nfs or another shared file system where they do not require the tpm data ot be copied... | |
| 13:58:57 | zigo | sean-k-mooney: But the vTPM files are somewhere in /etc/libvirt, no? | |
| 13:59:34 | sean-k-mooney | by default i think so yes | |
| 13:59:44 | sean-k-mooney | i woudl have to check the code | |
| 13:59:59 | sean-k-mooney | but they are not in /var/lib/nova/** as far as i recal | |
| 14:19:55 | tkajinam | sean-k-mooney, yeah I guess so, because SEV-SNP uses SEV as its core with additional protection features > lm support for SEV-SNP would depend on one for SEV | |
| 17:59:55 | opendevreview | sean mooney proposed openstack/nova master: [WIP] retry write_sys call on device busy https://review.opendev.org/c/openstack/nova/+/920203 | |
| 18:34:56 | opendevreview | Merged openstack/nova-specs master: Remove template files from non-empty directories https://review.opendev.org/c/openstack/nova-specs/+/919597 | |
| 19:03:34 | opendevreview | Merged openstack/nova master: Stop using split UEC image (mostly) https://review.opendev.org/c/openstack/nova/+/919739 | |
| 19:29:35 | opendevreview | melanie witt proposed openstack/nova-specs master: Re-propose specs for ephemeral encryption https://review.opendev.org/c/openstack/nova-specs/+/907654 | |
| #openstack-nova - 2024-05-23 | |||
| 07:28:14 | bauzas | good morning | |
| 15:35:55 | opendevreview | Merged openstack/nova master: scheduler: AggregateMultitenancyIsolation to support unlimited tenant https://review.opendev.org/c/openstack/nova/+/896512 | |
| 15:36:44 | sahid | o/ thank you dansmith, bauzas for your time on it :-) | |
| 16:46:12 | melwitt | bauzas: after your questions about unified limits I proposed to try to improve the docs about it if you might be interested https://review.opendev.org/c/openstack/nova/+/919913 | |
| 16:48:41 | bauzas | melwitt: cool thanks | |
| 16:49:15 | bauzas | fwiw, I got some people interested in unified limits testing yesterday on the OpenInfra Day France | |
| 16:52:34 | bauzas | +W | |
| 16:53:10 | bauzas | melwitt: I also +2d your persistent mdev patch just asking you to create a FUP | |