| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-07-03 | |||
| 13:23:22 | dansmith | head nova patch is going to fail openstacksdk again | |
| 13:25:18 | dansmith | same autoallocate thing it appears :( | |
| 13:28:07 | sean-k-mooney | that has been flaky for a while it seams do we want to make it non voting until the cve patches are laneded or just recheck | |
| 13:28:22 | dansmith | idk | |
| 13:28:43 | sean-k-mooney | we could quickly update it with the flaky decorator | |
| 13:28:52 | sean-k-mooney | that will skip if it fails and run it otherwise | |
| 13:29:10 | sean-k-mooney | but the sdk team would need to be aware they need to fix it | |
| 13:33:24 | frickler | there's a fix already proposed for the sdk job https://review.opendev.org/c/openstack/openstacksdk/+/923379 | |
| 13:36:44 | frickler | I guess we should fast-approve that and fix stephenfin's comments in a followup? | |
| 13:37:19 | sean-k-mooney | stephenfin: ^ | |
| 13:37:23 | sean-k-mooney | yes i think so | |
| 13:41:53 | frickler | done and promoted to top of gate. I think we should also dequeue and re-enqueue the nova stack? | |
| 13:42:30 | frickler | oh, the promotion took care of that already | |
| 13:46:55 | bauzas | sorry my IRC bouncer has some problems | |
| 13:47:02 | bauzas | frickler: where are we now ? | |
| 13:48:45 | frickler | bauzas: the nova stack was failing again due to an issue in the sdk job. this is to be fixed by https://review.opendev.org/c/openstack/openstacksdk/+/923379 which I've now promoted to the head of the gate pipeline | |
| 13:49:23 | bauzas | ack | |
| 13:49:55 | frickler | also https://meetings.opendev.org/irclogs/%23openstack-nova/latest.log.html is always there to help you, but updated only every 15 minutes | |
| 13:59:31 | fungi | if you're in a hurry and don't want to wait for the update, the less fancy txt version should be more continuously updated too | |
| 14:00:33 | fungi | the opendevmeet logbot buffers messages somewhat but streams them more quickly to the txt file, then a cronjob periodically generates the html version from that | |
| 14:03:24 | fungi | which is the reason for the apparent delay if you're only looking at the html version of the file | |
| 14:05:42 | fungi | for example https://meetings.opendev.org/irclogs/%23openstack-nova/%23openstack-nova.2024-07-03.log (we don't have a "latest" redirector or any direct links for those, but could probably add them without too much work) | |
| 14:18:24 | frickler | sdk patch got updated and gate restarted. I'll leave it like that unless the sdk job fails again in the top nova patch (doesn't seem to be happening 100%) | |
| 14:19:50 | ygk_12345 | hi folks | |
| 14:20:31 | ygk_12345 | can anyone tell me why we need to check resource limits when executing a qemu command in nova-compute using oslo prlimit utility ? | |
| 14:24:27 | fungi | ygk_12345: because qemu is not designed for running untrusted images, and broken or malicious images can cause it to consume unlimited resources (among other things) | |
| 14:25:24 | ygk_12345 | fungi: u mean something like ddos attacks | |
| 14:31:24 | fungi | ygk_12345: well, not ddos (the first d in ddos means "distributed") | |
| 14:31:45 | fungi | this would just be a plain old denial of service | |
| 14:34:26 | fungi | ygk_12345: though qemu tools can be coerced into doing worse things than just that, which is why we try to deeply inspect image files. see https://security.openstack.org/ossa/OSSA-2024-001.html and https://bugzilla.redhat.com/show_bug.cgi?id=2278875 for examples | |
| 14:38:32 | ygk_12345 | fungi: is this a new addition in bobcat release or is it in earlier versions as well ? | |
| 14:39:56 | fungi | ygk_12345: the openstack security advisory links to patches for releases as far back as 2023.1 (antelope), but there are also patches in the linked bug that make it possible to backport as far back as victoria (with some additional effort) | |
| 14:40:19 | fungi | or possibly even train | |
| 14:42:44 | ygk_12345 | fungi: one question though. the prlimit code, is it included in oslo_concurrency tool long back before this vulnerability was reported ? Also, do our antelope setups also have to be patched ? | |
| 14:45:03 | fungi | the prlimit work was done previously, yes, in order to mitigate other known resource consumption risks in qemu. i was mentioning yesterday's openstack security advisory and that qemu bug as examples of other risks | |
| 14:45:29 | fungi | er, examples of additional risks i mean | |
| 14:47:11 | fungi | the patches linked in ossa-2024-001 are new fixes for a vulnerability we just announced yesterday. the prlimit checks have been around much longer | |
| 14:59:45 | ygk_12345 | fungi: thanks for the information | |
| 15:02:26 | fungi | you're welcome | |
| 16:19:53 | frickler | another gate failure, timeout on tempest-integrated-compute-enforce-scope-new-defaults, luckily only on the 3rd patch and #4 was out already anyway with sdk failure. will re-enqueue once zuul finishes on them https://zuul.opendev.org/t/openstack/build/4c80df617e06413e9635e0968947809f | |
| 16:23:20 | frickler | hmm, that did reset the whole bunch of 15 other bunches behind it, though. so CI will be fully loaded for quite some more time | |
| 16:23:25 | fungi | tempest-integrated-compute-enforce-scope-new-defaults is what i was seeing repeated timeouts on yesterday as well | |
| 16:23:36 | opendevreview | Merged openstack/nova master: Reject qcow files with data-file attributes https://review.opendev.org/c/openstack/nova/+/923255 | |
| 16:23:59 | frickler | \o/ 1 done, 20 or so to go? ;) | |
| 16:24:50 | fungi | 20 or so if you're just talking about nova. across the three affected projects and four maintained branches for the full ossa it's about 50 changes | |
| 16:27:20 | fungi | maybe more now | |
| 16:27:44 | fungi | i think we linked 48 in the advisory, but that's not including the additional testing fixes that ended up going in yesterday | |
| 16:37:35 | frickler | yes, we should seriously reconsider whether doing more than a single patch per branch is really a good idea before next time | |
| 16:38:02 | frickler | unless of course we fix all gate stability and capacity issues until then :-D | |
| 16:38:46 | clarkb | its probably also worth considering reducing the bar set by the gate (both prior to major time sensitive changes showing up and generally) | |
| 16:39:56 | fungi | well, usually we try very, very, VERY hard not to do feature development for emergency security fixes and make them as concise and minimal as possible. this issue was an exception because of discovering that we basically needed to rip out any reliance on qemu-img being safe to rely on for security-sensitive codepaths | |
| 16:40:04 | clarkb | once upon a time removing jobs that were unreliable was a relatively common expectation (this is part of the reason we have the silent and experimental pipelines (though maybe silent is gone now)) | |
| 16:40:11 | frickler | well that's more questionable IMO. the high bar did at least notice a regression in cinder that went unnoticed before | |
| 16:41:08 | clarkb | yes it is a tradeoff. The ideal is that if you've got a test job because you believe it is valuable to run that it will also be maintained to keep it reliable | |
| 16:41:44 | clarkb | but unfortunately doing so is often difficult and openstack has basically never managed to do so consistently over time and constantly flip flops between sad and more happy states | |
| 16:42:03 | fungi | the original fix to just address the problem initially described in the bug report, and for which the ossa text focuses on, was going to be a single concise patch for each service | |
| 16:42:42 | fungi | it was complicated by the discovery that the method we'd been relying on already to do those things isn't considered safe by the maintainers of the tool we were using for it | |
| 16:43:36 | fungi | and when we started down that road, the qemu maintainers had made it clear to us that they had no intention of fixing it to be safe in any immediate timeframe | |
| 16:44:18 | fungi | (turns out they did later decide to release a security fix for qemu anyway, but the approach we ended up with should be a lot more future-proof) | |
| 17:18:41 | opendevreview | Merged openstack/nova master: Check images with format_inspector for safety https://review.opendev.org/c/openstack/nova/+/923256 | |
| 18:02:11 | dansmith | sean-k-mooney: melwitt: gibi: bauzas: Tempest tests for glance import are going to fail in our ceph job when glance patches merge and until a tempest fix is merged, which is currently stuck waiting on tempest-core | |
| 18:02:48 | dansmith | we can either mark that job n-v (which is easy) or try to strategically skip those tests, or we can just wait for tempest when gmann shows up and sees | |
| 18:02:54 | dansmith | what's your preference? | |
| 18:04:20 | dansmith | okay gmann to the rescue | |
| 18:04:32 | dansmith | fungi: abhishek_ I think gmann is +Wing now | |
| 18:04:40 | gmann | just logged in, checking | |
| 18:05:07 | dansmith | fungi: so I would prioritize *those* and drop abhi's patch I think | |
| 18:05:07 | gmann | dansmith: abhishek_: this one also right ? https://review.opendev.org/c/openstack/tempest/+/923357 | |
| 18:05:15 | fungi | okay... | |
| 18:05:16 | dansmith | yes | |
| 18:05:18 | fungi | just a sec | |
| 18:05:57 | abhishek_ | and this one as well, https://review.opendev.org/c/openstack/tempest/+/923352 | |
| 18:07:36 | fungi | 923357,3 and 923352,1 both for tempest | |
| 18:07:46 | abhishek_ | yes | |
| 18:08:08 | dansmith | I hope fungi is doing blowing smoke from his finger guns after each of these like I imagine in my head | |
| 18:08:22 | fungi | if only i were that cool | |
| 18:08:57 | abhishek_ | you are | |
| 18:09:04 | dansmith | +2 | |
| 18:09:14 | gmann | abhishek_: +w another one also, one comment for releasenotes but can be done in follow up https://review.opendev.org/c/openstack/tempest/+/923357/3/tempest/config.py#648 | |
| 18:09:15 | fungi | and both have approvals now, so doing | |
| 18:09:36 | gmann | ++ | |
| 18:09:41 | dansmith | thank you gmann | |
| 18:10:28 | gmann | np! sorry for login late. my toddler took a lot of time for his breakfast today :) | |
| 18:10:50 | fungi | okay all done and dequeued glance's 923433,2 at the same time | |
| 18:11:08 | abhishek_ | gmann: ack, thank you! | |
| 18:11:20 | dansmith | fungi: do it do it! | |
| 18:11:21 | abhishek_ | fungi ++ | |
| 18:11:48 | dansmith | YASS | |
| 18:12:05 | abhishek_ | :D | |
| 18:12:07 | fungi | count on me for all your fanservice needs | |
| 18:12:14 | dansmith | heh | |
| 18:19:11 | sean-k-mooney | dansmith: looks like gmann +w'd it | |
| 18:19:30 | sean-k-mooney | so i guess we want to wait for https://review.opendev.org/c/openstack/tempest/+/923352 to merge | |
| 18:19:36 | dansmith | sean-k-mooney: yes, it just unfolded as soon as I brought it up :D | |
| 18:19:59 | dansmith | sorry for the noise | |
| 20:36:04 | fungi | and both merged about 35 minutes ago now | |
| 20:51:13 | dansmith | ++ | |
| 21:23:12 | fungi | looking into options to less-disruptively speed merging for the remaining security patches... are there any other changes not explicitly mentioned in the ossa which i should avoid sending to the back of the line? | |
| 21:25:02 | fungi | going to start fiddling with some surgical queue reordering in about an hour once i get my dinner down | |
| 21:27:24 | melwitt | fungi: https://review.opendev.org/c/openstack/nova/+/923344 is a backport that some glance CVE patches depend on | |