Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2024-07-24
09:45:57 sean-k-mooney the prvious cve was also impacted by theuse of the uec images
09:46:30 sean-k-mooney but that ended up bing partly mitigated
10:01:07 ykarel sean-k-mooney, ack atleast in our jobs we have not reproduced that issue with uec image
10:06:44 frickler sean-k-mooney: I noticed that I do have stable core powers, so added +2, but leaving the approval for you
10:13:25 sean-k-mooney ill give bauzas an hour or so and move forward if he or stephenfin dont have time to review https://review.opendev.org/c/openstack/nova/+/923831 by noon(utc+1)
10:16:08 bauzas here now
10:17:10 bauzas https://review.opendev.org/c/openstack/nova/+/923831 +Wd
10:17:22 sean-k-mooney bauzas: thanks
10:49:08 opendevreview Michael Still proposed openstack/nova master: libvirt: Add config option to require secure SPICE. https://review.opendev.org/c/openstack/nova/+/922544
10:49:09 opendevreview Michael Still proposed openstack/nova master: WIP: libvirt: Add guest devices to support SPICE USB. https://review.opendev.org/c/openstack/nova/+/922547
10:49:09 opendevreview Michael Still proposed openstack/nova master: libvirt: allow concurrent access to SPICE consoles. https://review.opendev.org/c/openstack/nova/+/922546
10:49:10 opendevreview Michael Still proposed openstack/nova master: WIP: libvirt: Optionally support sound when using SPICE. https://review.opendev.org/c/openstack/nova/+/922549
10:49:10 opendevreview Michael Still proposed openstack/nova master: WIP: libvirt: Optionally enable SPICE debug logging. https://review.opendev.org/c/openstack/nova/+/922548
10:49:11 opendevreview Michael Still proposed openstack/nova master: libvirt: allow direct SPICE connections to qemu https://review.opendev.org/c/openstack/nova/+/924844
10:49:44 mikal sean-k-mooney: https://review.opendev.org/c/openstack/nova/+/924844/1 is my first swing at the reworking of the Nova APIs for the SPICE consoles.
10:51:12 sean-k-mooney mikal: stephenfin is working on a paralle series to add openapi schema validation that might collide with that by the way but we can cross that bridge wehn we get there
10:51:55 mikal sean-k-mooney: yeah, fair enough. Imma just gonna keep rebasing and uploading for now.
10:53:38 sean-k-mooney mikal: currently my focuse is unfortuentlly on backporting a cve fix upstream and downstream so while i skimmed that i proably wont be able to start reviewing properly unitl next week
10:53:41 mikal sean-k-mooney: assuming that the bottom three of those pass CI (and the first two already have before), I'll move onto reimplementing the sound model as an extra spec next. There is also a patch in that stack which adds USB redirect devices, I am undecided if I should make the number of devices configurable in extra specs as well.
10:53:51 sean-k-mooney hopefullly we will get most of the cve patches landed today
10:54:39 mikal sean-k-mooney: yeah fair enough, I'm just a bit concerned about the code complete deadline, so I want to get them out there as quick as I can.
10:54:40 sean-k-mooney we make the number of serial ports configurable in the flavor extra specs and image properlteis i belive
10:54:47 sean-k-mooney so i dont see a harm in supproting bot
10:55:13 sean-k-mooney i.e. supportign usb count in both flavor and image
10:55:30 mikal I haven't read https://review.opendev.org/c/openstack/nova-specs/+/920687 in depth yet, but I will do so before doing any USB stuff which might conflict.
10:55:34 sean-k-mooney jsu tmake sure if they disagree that you raise a falvor_image_configlct exctption in the api properly
10:55:51 mikal Is there a good example of a previous extra spec which does what you want that I can cargo cult?
10:56:35 sean-k-mooney mikal: am yes i can proably find one. likely the vPMU or vIOMMu ones
10:56:45 sean-k-mooney one sec ill grab the relevent review
10:57:05 mikal sean-k-mooney: ok cool. No rush though, its basically my bed time so I wont look at this until tomorrow morning your time anyways.
10:57:49 sean-k-mooney mikal: as prior arut to allwoign it to be set in flavor i woudl sight https://github.com/openstack/nova/blob/master/nova/api/validation/extra_specs/hw.py#L448-L459 as evidnce :)
10:58:47 sean-k-mooney mikal: https://github.com/openstack/nova/commit/326bc658eef04576230d5ba90d2a02bf32deee03
10:59:25 sean-k-mooney mikal: that predates the flavor extra spec validation feature by the way
10:59:56 mikal sean-k-mooney: oh, that makes me realise I probably should have written release notes for these changes...
11:00:21 sean-k-mooney mikal: so when addign flavor extra specs please make sure you add a vlaidator too
11:00:53 sean-k-mooney mikal: yes you have two options on that front. start a singel releasenote in the base patch that has a useable feature and update it in the rest
11:01:15 sean-k-mooney or have a sperate release note for each seperate adddtion of funcitonality
11:01:26 mikal sean-k-mooney: yeah, that's not going to happen tonight. That can be tomorrow Michael's problem.
11:01:33 sean-k-mooney :)
11:02:01 sean-k-mooney we sometimes put hte release not in the api patch that enabels the fucntionaltiy, we normlaly keep that to the end of the series by the way
11:02:03 mikal Either way I'd appreciate feedback, but I get that you're busy. I'll do release notes tomorrow before I move onto extra specs etc.
11:02:54 sean-k-mooney mikal: well the main feedback is you put the api change before the dirver change that implemted the feature
11:02:58 sean-k-mooney that is the wrogn order
11:03:03 mikal In my head the remaining patches (after the first three) are "more optional". You can live without USB redirection and sound if you need to. The feature is still useful to some people without those.
11:03:16 sean-k-mooney you need to put the api change at the end because once the api is intoduced the feature shoudl be useable fully
11:03:42 sean-k-mooney oh actully
11:03:49 mikal The feature should be fully usable after patch three.
11:03:57 sean-k-mooney ok ya i see
11:04:09 mikal (Technically patch 3 would work on its own, but the others were already up there).
11:04:16 sean-k-mooney the rest are sound, debuging and usb
11:04:22 sean-k-mooney ok then its fine as is
11:04:26 mikal Yeah, and I might drop debugging. I am undecided.
11:04:53 sean-k-mooney it proably does not need seperate debug log cofnig form our normal debug config
11:04:54 mikal Its so verbose (and so weird because its GTK debugging) that its useful sometimes, but you have to be quite sad to turn it on.
11:05:00 sean-k-mooney unless your very very verbose
11:05:09 mikal Its very very verbose debugs in the libvirt qemu logs.
11:05:26 mikal Its orchestrating qemu to write debug logs, not nova.
11:05:54 mikal It helped when I was reverse engineering some bits of the protocol and occasionally crashing the hypervisor.
11:06:02 sean-k-mooney mikal: oh ...
11:06:17 sean-k-mooney you are aware we don not allow wemu command line options to be used in nova right
11:06:21 mikal The SPICE protocol docs are... not good.
11:07:16 mikal sean-k-mooney: as in what happens in https://review.opendev.org/c/openstack/nova/+/922546/5/nova/virt/libvirt/config.py is banned?
11:07:20 sean-k-mooney so we cant procedd with https://review.opendev.org/c/openstack/nova/+/922546/5/nova/virt/libvirt/config.py
11:07:44 mikal That is a shame, because that feature is cool.
11:07:57 mikal But libvirt only exposed it as a command line flag.
11:08:12 sean-k-mooney then we need a livbirt chagne before we can support configuing tha tin nova
11:08:22 sean-k-mooney i have unfrutaly had to do that dance several times
11:08:24 mikal Its this -- https://www.spice-space.org/multiple-clients.html
11:09:01 sean-k-mooney if we use the qemu command elemets directly it marks the domain as tainted and voids all supprot form most distors virt teams
11:09:19 sean-k-mooney as a result we have had a strict ban on it upstream for as long as i have worked on openstack
11:09:38 mikal I thought secure boot required it too though?
11:09:45 sean-k-mooney nope
11:10:08 mikal Herm, I no longer remember why I believe that <qemu:arg value='-global'/><qemu:arg value='ICH9-LPC.disable_s3=1'/> is required with secure boot.
11:10:46 mikal Oh, its required for Windows 11 support I think... https://github.com/quickemu-project/quickemu/issues/220
11:10:50 sean-k-mooney mikal: are you perhaps usign secvure boto with the pc machine type or somethign like that
11:11:43 sean-k-mooney mikal: becasue officaly secure boot is considered experimiantal unless your useing q35
11:12:35 mikal sean-k-mooney: no, I'm definitely using q35 with secure boot. This wasn't in nova though, it was another code base.
11:13:01 mikal Said other code base just has three examples of qemu command line setting: this ICH9 thing; nvme disks; and concurrent SPICE sessions.
11:13:46 sean-k-mooney ich9 i thnk is either the dound device or the chipset
11:13:50 mikal Anyways, I can drop that patch from the series of Nova doesn't want to support concurrent SPICE sessions, its just a nice feature to have.
11:14:03 mikal Yeah, ICH9 is a sound device.
11:14:08 sean-k-mooney well we can supprot it but we need libvirt to supprot it first
11:14:23 sean-k-mooney mikal: ok well we dont add soudn device today if i recall
11:14:28 mikal Well, its an IO controller hub, which does sound. Its one of the libvirt sound model options.
11:14:56 sean-k-mooney yep i have plaied with the setting in virt-manager before
11:15:12 sean-k-mooney i just dont recall if we generate that upstream or not
11:15:47 mikal I'll just drop the SPICE concurrency patch for now. There is zero chance of me pursuing a libvirt patch right now.
12:46:39 opendevreview Merged openstack/nova stable/2024.1: Stop using split UEC image (mostly) https://review.opendev.org/c/openstack/nova/+/923831
13:14:58 frickler sean-k-mooney: bauzas: grenade jobs are failing on the 2023.1 patch, but should grenade actually still run there when zed is eom? https://review.opendev.org/c/openstack/nova/+/924734
13:16:40 frickler (seems more of the setuptools woe happening there)
13:16:51 frickler also https://zuul.opendev.org/t/openstack/build/c8fbe90f70974d2f918ee7fa6da54575 looks recheckable to me
13:19:44 sean-k-mooney frickler: we have debated that before. so its failign because of the setuptool issue right
13:21:14 frickler sean-k-mooney: the grenade failures that I looked at, yes. note the failure is on the controller, the later failure on compute1 is just secondary
13:21:46 sean-k-mooney i skimed them this morning and didnt see anytign really related to the patch
13:22:16 sean-k-mooney i didnt really look into test_get_list_deleted_instance_actions closely
13:23:24 sean-k-mooney Build of instance 38107228-1260-473d-b6a8-7f3148a135ce aborted: Failed to allocate the network(s), not rescheduling.: nova.exception.BuildAbortException: Build of instance 38107228-1260-473d-b6a8-7f3148a135ce aborted: Failed to allocate the network(s), not rescheduling.
13:23:36 sean-k-mooney ok so that is also unrelated
13:24:31 bauzas ....
13:31:32 sean-k-mooney frickler: so yes i think that will pass if we reject if the upper constraits bump for packaging has been merged
13:31:39 sean-k-mooney to fix the focal issues

Earlier   Later