| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-07-03 | |||
| 11:19:18 | sean-k-mooney | im not agaisnt taht i just dont want to keep pinging fungi, you or clark ot do that | |
| 11:19:38 | zhhuabj | hi team, does anyone know why ci can't run in this patch - https://review.opendev.org/c/openstack/nova/+/909611 | |
| 11:19:49 | sean-k-mooney | oh ya they are not related any more. we had a fully green run last night on the last patch so the set as a whole i think is good | |
| 11:19:51 | frickler | well currently it is me who keeps pinging nova people with the offer ;) | |
| 11:20:32 | sean-k-mooney | i think we have got enouch results form check in agggreate to be ok with mergeing them as is at this point | |
| 11:20:37 | frickler | zhhuabj: that patch needs a rebase, see the "not current" on the relation chain | |
| 11:24:24 | zhhuabj | thanks frickler, I will ping patch owner to do rebase to have a try, thanks | |
| 11:30:18 | sean-k-mooney | zhhuabj: i left some feedback on the parent patch https://review.opendev.org/c/openstack/nova/+/920374 | |
| 11:31:02 | sean-k-mooney | the unit tests you added are not inline with our code style, specifcaly you are addming mulitle diffent test cases in a single test method and you are not using asserts correctly. | |
| 11:31:18 | frickler | ok, so now I need to refresh my memory on how that "enqueue into gate" actually works ;) | |
| 11:44:42 | frickler | hmm, got myself a keycloak account, but that only seems to allow dequeue + promote, need to read more docs | |
| 12:07:20 | zhhuabj | hi sean-k-mooney , I saw your comments , thanks for your review. you mentioned using assert_called_with instead of 'assert str(expected_call) == str(actual_call)', deepcopy may change object's memory address as well, so assert_called_with will not work | |
| 12:07:37 | fungi | also, i'm done with my morning errands and can help (re)enqueue changes into the gate, reorder the queue, delete verified -2 results, et cetera | |
| 12:08:18 | fungi | frickler: i keep forgetting about the webui, just been using the zuul-client cli | |
| 12:10:02 | zhhuabj | sean-k-mooney: this is error log when using assert_called_with, we can see actually these two strings are equal, but assert-called-with will throw the exception, so I think that's the reason deepcopy has changed memory address of object - https://paste.openstack.org/show/boR6m5V8Zegg5p9iRXlG/ | |
| 12:11:57 | sean-k-mooney | that is proably because instance jobjstefc has changed field tahre are not being printed | |
| 12:13:05 | sean-k-mooney | you could compare the object_to_primitive dump but just comaprign the srting wont compare them properly | |
| 12:13:45 | frickler | fungi: yes, I just needed to figure out how to drop the V-2 first, but found that in the force-merge guide | |
| 12:14:17 | frickler | now I was just a little bit confused because I only touched one change, but the whole stack landed in gate at the same time | |
| 12:14:43 | frickler | but it seems all the others had already finished their rechecks | |
| 12:15:03 | fungi | zuul will auto-enqueue dependent changes if they meet its requirements | |
| 12:25:59 | zhhuabj | sean-k-moonkey: do you mean this one - https://paste.openstack.org/show/bd510w2dMMZdwOOjEvS7/ | |
| 12:35:02 | sean-k-mooney | kindof depending on which parmater had the untracked changes | |
| 12:36:23 | opendevreview | Takashi Kajinami proposed openstack/os-vif master: Remove old excludes https://review.opendev.org/c/openstack/os-vif/+/917611 | |
| 12:52:28 | opendevreview | Zhang Hua proposed openstack/nova master: BlockDeviceMapping object has no attribute copy https://review.opendev.org/c/openstack/nova/+/920374 | |
| 12:54:44 | zhhuabj | hi sean-k-mooney , I posted a new change to address your comment - https://review.opendev.org/c/openstack/nova/+/920374/3/nova/tests/unit/virt/libvirt/test_blockinfo.py | |
| 12:56:24 | opendevreview | Merged openstack/nova stable/2023.2: Fix disk_formats in ceph job tempest config https://review.opendev.org/c/openstack/nova/+/923343 | |
| 12:58:05 | opendevreview | Sahid Orentino Ferdjaoui proposed openstack/nova master: scheduler: fix _get_sharing_providers to support unlimited aggr https://review.opendev.org/c/openstack/nova/+/921665 | |
| 13:04:18 | sean-k-mooney | zhhuabj: thansk we are currently focusing on upstream and downstream tasks related to the cve discustion yesterdaty but we will loop back and review when we have time | |
| 13:10:17 | opendevreview | Andrei Yachmenev proposed openstack/nova master: Fix processing uniqueness of instance host names https://review.opendev.org/c/openstack/nova/+/923395 | |
| 13:23:22 | dansmith | head nova patch is going to fail openstacksdk again | |
| 13:25:18 | dansmith | same autoallocate thing it appears :( | |
| 13:28:07 | sean-k-mooney | that has been flaky for a while it seams do we want to make it non voting until the cve patches are laneded or just recheck | |
| 13:28:22 | dansmith | idk | |
| 13:28:43 | sean-k-mooney | we could quickly update it with the flaky decorator | |
| 13:28:52 | sean-k-mooney | that will skip if it fails and run it otherwise | |
| 13:29:10 | sean-k-mooney | but the sdk team would need to be aware they need to fix it | |
| 13:33:24 | frickler | there's a fix already proposed for the sdk job https://review.opendev.org/c/openstack/openstacksdk/+/923379 | |
| 13:36:44 | frickler | I guess we should fast-approve that and fix stephenfin's comments in a followup? | |
| 13:37:19 | sean-k-mooney | stephenfin: ^ | |
| 13:37:23 | sean-k-mooney | yes i think so | |
| 13:41:53 | frickler | done and promoted to top of gate. I think we should also dequeue and re-enqueue the nova stack? | |
| 13:42:30 | frickler | oh, the promotion took care of that already | |
| 13:46:55 | bauzas | sorry my IRC bouncer has some problems | |
| 13:47:02 | bauzas | frickler: where are we now ? | |
| 13:48:45 | frickler | bauzas: the nova stack was failing again due to an issue in the sdk job. this is to be fixed by https://review.opendev.org/c/openstack/openstacksdk/+/923379 which I've now promoted to the head of the gate pipeline | |
| 13:49:23 | bauzas | ack | |
| 13:49:55 | frickler | also https://meetings.opendev.org/irclogs/%23openstack-nova/latest.log.html is always there to help you, but updated only every 15 minutes | |
| 13:59:31 | fungi | if you're in a hurry and don't want to wait for the update, the less fancy txt version should be more continuously updated too | |
| 14:00:33 | fungi | the opendevmeet logbot buffers messages somewhat but streams them more quickly to the txt file, then a cronjob periodically generates the html version from that | |
| 14:03:24 | fungi | which is the reason for the apparent delay if you're only looking at the html version of the file | |
| 14:05:42 | fungi | for example https://meetings.opendev.org/irclogs/%23openstack-nova/%23openstack-nova.2024-07-03.log (we don't have a "latest" redirector or any direct links for those, but could probably add them without too much work) | |
| 14:18:24 | frickler | sdk patch got updated and gate restarted. I'll leave it like that unless the sdk job fails again in the top nova patch (doesn't seem to be happening 100%) | |
| 14:19:50 | ygk_12345 | hi folks | |
| 14:20:31 | ygk_12345 | can anyone tell me why we need to check resource limits when executing a qemu command in nova-compute using oslo prlimit utility ? | |
| 14:24:27 | fungi | ygk_12345: because qemu is not designed for running untrusted images, and broken or malicious images can cause it to consume unlimited resources (among other things) | |
| 14:25:24 | ygk_12345 | fungi: u mean something like ddos attacks | |
| 14:31:24 | fungi | ygk_12345: well, not ddos (the first d in ddos means "distributed") | |
| 14:31:45 | fungi | this would just be a plain old denial of service | |
| 14:34:26 | fungi | ygk_12345: though qemu tools can be coerced into doing worse things than just that, which is why we try to deeply inspect image files. see https://security.openstack.org/ossa/OSSA-2024-001.html and https://bugzilla.redhat.com/show_bug.cgi?id=2278875 for examples | |
| 14:38:32 | ygk_12345 | fungi: is this a new addition in bobcat release or is it in earlier versions as well ? | |
| 14:39:56 | fungi | ygk_12345: the openstack security advisory links to patches for releases as far back as 2023.1 (antelope), but there are also patches in the linked bug that make it possible to backport as far back as victoria (with some additional effort) | |
| 14:40:19 | fungi | or possibly even train | |
| 14:42:44 | ygk_12345 | fungi: one question though. the prlimit code, is it included in oslo_concurrency tool long back before this vulnerability was reported ? Also, do our antelope setups also have to be patched ? | |
| 14:45:03 | fungi | the prlimit work was done previously, yes, in order to mitigate other known resource consumption risks in qemu. i was mentioning yesterday's openstack security advisory and that qemu bug as examples of other risks | |
| 14:45:29 | fungi | er, examples of additional risks i mean | |
| 14:47:11 | fungi | the patches linked in ossa-2024-001 are new fixes for a vulnerability we just announced yesterday. the prlimit checks have been around much longer | |
| 14:59:45 | ygk_12345 | fungi: thanks for the information | |
| 15:02:26 | fungi | you're welcome | |
| 16:19:53 | frickler | another gate failure, timeout on tempest-integrated-compute-enforce-scope-new-defaults, luckily only on the 3rd patch and #4 was out already anyway with sdk failure. will re-enqueue once zuul finishes on them https://zuul.opendev.org/t/openstack/build/4c80df617e06413e9635e0968947809f | |
| 16:23:20 | frickler | hmm, that did reset the whole bunch of 15 other bunches behind it, though. so CI will be fully loaded for quite some more time | |
| 16:23:25 | fungi | tempest-integrated-compute-enforce-scope-new-defaults is what i was seeing repeated timeouts on yesterday as well | |
| 16:23:36 | opendevreview | Merged openstack/nova master: Reject qcow files with data-file attributes https://review.opendev.org/c/openstack/nova/+/923255 | |
| 16:23:59 | frickler | \o/ 1 done, 20 or so to go? ;) | |
| 16:24:50 | fungi | 20 or so if you're just talking about nova. across the three affected projects and four maintained branches for the full ossa it's about 50 changes | |
| 16:27:20 | fungi | maybe more now | |
| 16:27:44 | fungi | i think we linked 48 in the advisory, but that's not including the additional testing fixes that ended up going in yesterday | |
| 16:37:35 | frickler | yes, we should seriously reconsider whether doing more than a single patch per branch is really a good idea before next time | |
| 16:38:02 | frickler | unless of course we fix all gate stability and capacity issues until then :-D | |
| 16:38:46 | clarkb | its probably also worth considering reducing the bar set by the gate (both prior to major time sensitive changes showing up and generally) | |
| 16:39:56 | fungi | well, usually we try very, very, VERY hard not to do feature development for emergency security fixes and make them as concise and minimal as possible. this issue was an exception because of discovering that we basically needed to rip out any reliance on qemu-img being safe to rely on for security-sensitive codepaths | |
| 16:40:04 | clarkb | once upon a time removing jobs that were unreliable was a relatively common expectation (this is part of the reason we have the silent and experimental pipelines (though maybe silent is gone now)) | |
| 16:40:11 | frickler | well that's more questionable IMO. the high bar did at least notice a regression in cinder that went unnoticed before | |
| 16:41:08 | clarkb | yes it is a tradeoff. The ideal is that if you've got a test job because you believe it is valuable to run that it will also be maintained to keep it reliable | |
| 16:41:44 | clarkb | but unfortunately doing so is often difficult and openstack has basically never managed to do so consistently over time and constantly flip flops between sad and more happy states | |
| 16:42:03 | fungi | the original fix to just address the problem initially described in the bug report, and for which the ossa text focuses on, was going to be a single concise patch for each service | |
| 16:42:42 | fungi | it was complicated by the discovery that the method we'd been relying on already to do those things isn't considered safe by the maintainers of the tool we were using for it | |
| 16:43:36 | fungi | and when we started down that road, the qemu maintainers had made it clear to us that they had no intention of fixing it to be safe in any immediate timeframe | |
| 16:44:18 | fungi | (turns out they did later decide to release a security fix for qemu anyway, but the approach we ended up with should be a lot more future-proof) | |
| 17:18:41 | opendevreview | Merged openstack/nova master: Check images with format_inspector for safety https://review.opendev.org/c/openstack/nova/+/923256 | |
| 18:02:11 | dansmith | sean-k-mooney: melwitt: gibi: bauzas: Tempest tests for glance import are going to fail in our ceph job when glance patches merge and until a tempest fix is merged, which is currently stuck waiting on tempest-core | |
| 18:02:48 | dansmith | we can either mark that job n-v (which is easy) or try to strategically skip those tests, or we can just wait for tempest when gmann shows up and sees | |
| 18:02:54 | dansmith | what's your preference? | |
| 18:04:20 | dansmith | okay gmann to the rescue | |
| 18:04:32 | dansmith | fungi: abhishek_ I think gmann is +Wing now | |
| 18:04:40 | gmann | just logged in, checking | |
| 18:05:07 | dansmith | fungi: so I would prioritize *those* and drop abhi's patch I think | |
| 18:05:07 | gmann | dansmith: abhishek_: this one also right ? https://review.opendev.org/c/openstack/tempest/+/923357 | |
| 18:05:15 | fungi | okay... | |
| 18:05:16 | dansmith | yes | |