Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2025-08-07
09:58:33 sean-k-mooney noonedeadpunk: we are well pass the spec approval freeze so this is something for next cycle
09:58:51 sean-k-mooney noonedeadpunk: the spec freeze was milestone 2
10:02:10 noonedeadpunk ah, right, true
10:02:17 noonedeadpunk I was looking for feature freeze
10:03:22 sean-k-mooney that does not mean it cant merge early in 2026.1 as in late september/october
10:03:26 noonedeadpunk it's kinda sad though, as this is pretty much the only way so far to get live migrations working reliable until gnutls is patched and with memory being encrypted
10:03:59 sean-k-mooney well its not actully fixing the issue
10:03:59 noonedeadpunk or well... use tunnels...
10:04:10 noonedeadpunk yeah, true
10:04:24 sean-k-mooney it just make it less likely as each coonenction gets it own rekey timer
10:04:39 sean-k-mooney the workaroudn for now is to just disable tls3 with aes
10:04:44 sean-k-mooney via the crypto polices
10:04:56 noonedeadpunk which you can;'t do outside of EL
10:04:58 sean-k-mooney i.e. disable the specific policy that has the issue
10:05:05 sean-k-mooney EL?
10:05:10 noonedeadpunk *RHEL
10:05:22 sean-k-mooney oh well that not a rhel thing as far as im aware
10:05:34 noonedeadpunk as I tried to place a gnutls config on ubuntu and qemu just ignores it
10:05:43 noonedeadpunk so it's not a thing on debian/ubuntu
10:05:58 noonedeadpunk Maybe it does work on centos/rocky - dunno
10:06:00 sean-k-mooney i suspect it might be but uses a diffent location
10:06:32 noonedeadpunk Ubuntu just dropped policy package with comment it never-ever worked on ubuntu 24.04 to start with
10:06:44 sean-k-mooney https://wiki.debian.org/CryptoPolicy
10:06:51 noonedeadpunk https://bugs.launchpad.net/ubuntu/+source/crypto-policies/+bug/2069129
10:06:59 sean-k-mooney so apprently it s a fedora thing?
10:07:11 sean-k-mooney https://fedoraproject.org/wiki/Changes/CryptoPolicy
10:07:21 noonedeadpunk well, I think anyway it does not work on debian/ubuntu
10:07:27 sean-k-mooney form 2014 that they were loooking to upstream
10:07:42 noonedeadpunk "crypto-policies is not supported on Ubuntu: it requires deep integration with the packages and their configurations. This integration doesn't exist and is unlikely to ever exist outside of redhat-based distributions"
10:08:03 sean-k-mooney https://manpages.ubuntu.com/manpages/jammy/en/man8/update-crypto-policies.8.html
10:08:22 sean-k-mooney well the pakcage for doing it is in ubuntu
10:08:31 noonedeadpunk So 2069129 claims it never worked despoite being packaged
10:08:43 noonedeadpunk which is the reason it's dropped
10:08:56 sean-k-mooney ya so this is in rhel to make fips work
10:09:15 sean-k-mooney i know cannonicals fipes supprot is a paied extra
10:09:43 noonedeadpunk anyway, I didn't find the way so far to make ubuntu to use POLY1305
10:09:50 sean-k-mooney ack
10:10:29 noonedeadpunk even though I blacklisted AES in gnutls config and gnutls output was like that: https://paste.openstack.org/show/b2VjO9rv4976Y4prCtt9/
10:10:42 noonedeadpunk seems that qemu was still doing what it wanted
10:11:30 sean-k-mooney you using kolla right
10:11:34 noonedeadpunk osa
10:11:47 sean-k-mooney oh so not in a contianer then
10:11:56 sean-k-mooney i was going to ask if you updated it in the contianer
10:12:12 noonedeadpunk yeah, it's just on the node
10:12:13 sean-k-mooney or suggest you try the centos libvirt contianer to see if that woudl work around it
10:12:48 noonedeadpunk well... I probably could do that....
10:12:55 sean-k-mooney its possible that htey staic link it or something like that but debian is normlaly all in on dynmaic linking everything
10:14:26 sean-k-mooney in your case i think tunnled migration or using just tcp if you are allow too is the best approch unless you want to carry that patch downstream until its landed upstream
10:14:44 sean-k-mooney still to fix iti properly you will need the qemu fix when that is ready
10:15:14 noonedeadpunk we have local drives as nova drives, which we expect to live migrate as well, which does not work with the trunnel;
10:15:16 opendevreview Stephen Finucane proposed openstack/nova master: api: Add response body schemas for servers APIs (5/6) https://review.opendev.org/c/openstack/nova/+/956239
10:15:17 opendevreview Stephen Finucane proposed openstack/nova master: api: Add response body schemas for servers APIs (6/6) https://review.opendev.org/c/openstack/nova/+/956240
10:15:17 opendevreview Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server shares APIs https://review.opendev.org/c/openstack/nova/+/956266
10:15:18 opendevreview Stephen Finucane proposed openstack/nova master: tests: Invert validation check https://review.opendev.org/c/openstack/nova/+/956241
10:15:21 noonedeadpunk anyway
10:18:04 opendevreview Dmitriy Rabotyagov proposed openstack/nova-specs master: Add 2026.1 specs folder https://review.opendev.org/c/openstack/nova-specs/+/956767
10:19:47 opendevreview Dmitriy Rabotyagov proposed openstack/nova-specs master: Propose enabling parallel live migrations for libvirt https://review.opendev.org/c/openstack/nova-specs/+/955783
10:35:15 opendevreview Merged openstack/nova master: Revert^2 "Support glance's new location API" https://review.opendev.org/c/openstack/nova/+/950623
10:45:03 opendevreview Takashi Kajinami proposed openstack/nova master: Migrate MEM_ENCRYPTION_CONTEXT from root provider https://review.opendev.org/c/openstack/nova/+/921814
10:45:04 opendevreview Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685
10:45:04 opendevreview Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706
10:45:05 opendevreview Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106
10:46:55 tkajinam Uggla, I wonder if I can ask for your help to move this series forward ^^^ I've been receiving emails regularly to ask progress about this work (from different parties, which is interesting) and I'm hoping that I can move it forward (getting it merged is the best but I at least need some feedback)
10:50:57 Uggla Hi tkajinam, I'll do my best to try to review it and warn cores for reviews, as this is an important feature.
10:51:48 tkajinam Uggla, thanks !
10:56:27 sean-k-mooney oh the sev work
10:56:48 sean-k-mooney ya it woudl be good to compelte that this cycle givein it missed last cycle due to review bandwith
10:57:57 Uggla sean-k-mooney I agree
11:11:05 tkajinam support for sev-sep, which is more sophisticated version of sev, is reaching downstream distros, and tdx support was merged to the latest kernel. so I expect more people may be interested in using memory encryption features.
11:11:35 tkajinam and this could be a base work to extend current sev support, to support more cpu features
11:28:11 opendevreview Callum Dickinson proposed openstack/nova master: Add more flavor metadata to libvirt guest XML https://review.opendev.org/c/openstack/nova/+/942974
11:28:11 opendevreview Callum Dickinson proposed openstack/nova master: Fix image ID in libvirt metadata when unshelving https://review.opendev.org/c/openstack/nova/+/942973
11:28:12 opendevreview Callum Dickinson proposed openstack/nova master: Add image meta to libvirt XML metadata https://review.opendev.org/c/openstack/nova/+/942766
12:14:32 opendevreview Callum Dickinson proposed openstack/nova master: Add more flavor metadata to libvirt guest XML https://review.opendev.org/c/openstack/nova/+/942974
12:14:33 opendevreview Callum Dickinson proposed openstack/nova master: Add image meta to libvirt XML metadata https://review.opendev.org/c/openstack/nova/+/942766
14:01:52 opendevreview Johannes Beisiegel proposed openstack/nova master: fix: ensure to remove cinder attachments on delete of building instance https://review.opendev.org/c/openstack/nova/+/956789
14:02:45 opendevreview Johannes Beisiegel proposed openstack/nova master: fix: ensure to remove cinder attachments on delete of building instance https://review.opendev.org/c/openstack/nova/+/956789
17:28:31 opendevreview Rajesh Tailor proposed openstack/nova master: Add support for using cell-name in cell_v2 commands https://review.opendev.org/c/openstack/nova/+/954460
#openstack-nova - 2025-08-08
09:05:04 opendevreview Masanori Kuroha proposed openstack/nova master: Copy applied provider.yaml https://review.opendev.org/c/openstack/nova/+/948304
10:01:49 opendevreview Johannes Kulik proposed openstack/nova master: db: Fix api_db_opts reading main_db_opts https://review.opendev.org/c/openstack/nova/+/956869
10:03:23 jkulik hi folks, one of my colleagues found a bug in the code ^ do you also need a bug-report in launchpad? imho this is a quite obvious one :)
10:39:10 frickler jkulik: since the bug appears to be 4 years old, I think a bug report would be better to allow easier backporting to stable branches, even though the fix looks obvious
10:39:22 jkulik ok
10:43:33 opendevreview Johannes Kulik proposed openstack/nova master: db: Fix api_db_opts reading main_db_opts https://review.opendev.org/c/openstack/nova/+/956869
10:48:16 tkajinam Can https://review.opendev.org/c/openstack/placement/+/953367 get some attention. it's just one of the hosekeeping updates.
14:12:29 opendevreview Stefan Hoffmann proposed openstack/nova master: POC: setup tap interface by nova https://review.opendev.org/c/openstack/nova/+/956907
14:14:53 opendevreview Stefan Hoffmann proposed openstack/nova master: POC: setup tap interface by nova https://review.opendev.org/c/openstack/nova/+/956907
14:40:15 sthoffmann[m] Like discussed at the last PTG, I provided a POC for letting neutron wait till ovn-controller on destination host has the change and let therefore nova create the tap interface.... (full message at <https://matrix.org/oftc/media/v1/media/download/AcK7tVlei75Wjt7vLary51xZAItVJ4c5v-eSjBPuJhQN-w4LXaTO8jzvgi_S84-s7GhXW08xw4TvM1xnZCT5SnxCeY0jkb2AAG1hdHJpeC5vcmcvb0NZaVRvTWhJTWpCWnpEaGtnRG1ITWt0>)
15:21:38 sean-k-mooney sthoffmann[m]: if we are goign to create the tap atead of tiem weo would do that in os-vif
15:22:22 sean-k-mooney we would jsut have nova pass a flag to tell os-vif to do it
16:51:38 opendevreview Merged openstack/nova master: Fix image ID in libvirt metadata when unshelving https://review.opendev.org/c/openstack/nova/+/942973
17:13:57 opendevreview Pavlo Shchelokovskyy proposed openstack/nova master: Remove max config limit for libvirt.num_pcie_ports https://review.opendev.org/c/openstack/nova/+/956942
19:20:04 opendevreview Ghanshyam proposed openstack/nova master: Disable server reset state API by default https://review.opendev.org/c/openstack/nova/+/956959
20:35:24 opendevreview Ghanshyam proposed openstack/nova master: Disable server reset state API by default https://review.opendev.org/c/openstack/nova/+/956959
#openstack-nova - 2025-08-09
01:15:35 opendevreview melanie witt proposed openstack/nova master: TPM: support instances with `user` secret security https://review.opendev.org/c/openstack/nova/+/942502
01:15:35 opendevreview melanie witt proposed openstack/nova master: TPM: migrate legacy instances to new security policy https://review.opendev.org/c/openstack/nova/+/942501
01:15:36 opendevreview melanie witt proposed openstack/nova master: Add vtpm_secret_(uuid|value) to LibvirtLiveMigrateData https://review.opendev.org/c/openstack/nova/+/952628
01:15:36 opendevreview melanie witt proposed openstack/nova master: TPM: support instances with `host` secret security https://review.opendev.org/c/openstack/nova/+/941795
01:15:37 opendevreview melanie witt proposed openstack/nova master: TPM: support instances with `deployment` secret security https://review.opendev.org/c/openstack/nova/+/942021
01:15:37 opendevreview melanie witt proposed openstack/nova master: TPM: support live migration of `host` secret security https://review.opendev.org/c/openstack/nova/+/941483

Earlier   Later