Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2025-08-19
19:41:38 dansmith melwitt: I don't have the brain power to think this through completely right now, so let me muse here in semi-persistent land
19:41:51 dansmith something gibi mentioned makes me think...
19:42:15 dansmith we're kinda depending on the scheduler doing the right thing for much of the enforcement of the policy (maybe more than I'd like even, as I noted, but alas)
19:42:37 dansmith maybe the better thing here is to think about the reqspec as the authoritative thing instead of sysmeta
19:43:36 dansmith like maybe we have a default (configurable or just default to host) or we require a policy on the flavor/image for new instances
19:44:02 dansmith and we just stamp it into the sysmeta on the way down
19:44:29 dansmith and handle the migration of existing instances differently.. either:
19:44:55 dansmith 1. stamp them as user and make them resize if they want "out". That's somewhat fitting in that right now the flavor they booted with doesn't have migrate ability, resize to a flavor that does fixes the problem
19:45:34 dansmith 2. make hard reboot pass down a default *or* have some other way for them to stamp a policy (either choice or agree to the default)
19:46:17 dansmith and then just focus on reqspec being the authoritative thing and sysmeta just becomes basically the write-once-read-many record of what was chosen so we know where to find a secret, but never change it (at the compute level)
19:50:40 melwitt I will need to think through these ... and I note that it feels like most of the spec is being rewritten (and the implementation thusly rewritten). not sure if this can realistically make FF :/
19:52:32 dansmith yeah, I know, I was thinking about this earlier too and wondering if we were to ignore the existing instances if we could even just like merge host+user, no hard reboot fix and push some of the details to the end
19:52:59 dansmith the above where we just require resize if you want out of the current limitation might also mean we need to merge less to hit our goal
19:53:14 dansmith and we could follow up with the hard reboot approve-in-place as an optimization
19:53:29 melwitt that's an interesting idea
20:02:14 gibi 1. feel very tempting at first read
20:02:41 gibi resize being the opt in is acceptable to me
20:04:14 gibi and for the cloud admin asking for a reboot or a resize is not a big difference, it is an ask anyhow
20:04:57 gibi also level=user becomes the default which I like :)
20:05:19 melwitt I agree resize opt in sounds reasonable for the first phase in any case
20:15:04 opendevreview Merged openstack/nova master: [tests] Add printing of sample and template paths https://review.opendev.org/c/openstack/nova/+/944054
20:15:55 dansmith resize as the opt-in also lets the admin force them to be moved if they don't want to mix user and host, for example. hard reboot does not give that option
20:44:56 sean-k-mooney does resizeing in this context mean selectign a new flavor with a diffent secreate policy to opt in.
20:45:18 sean-k-mooney im jsut wrapping for the day but i will try to read abck tomorrow if i rememeber
20:45:39 sean-k-mooney oh that the option 1 above
20:47:18 sean-k-mooney to do 1 we woudl ahve to update the isntance copy of the falvor as if the extra spec was set similar to how we often do that to fake the image property being set
20:47:44 sean-k-mooney which is proably ok but i think that a littel trickerer just becasue we store it diffently
20:47:56 opendevreview Merged openstack/python-novaclient master: tests: Stop "testing" against Identity v2 API https://review.opendev.org/c/openstack/python-novaclient/+/952984
20:48:08 sean-k-mooney tirvially so but it woudl be the first tiem to do that with the embeded falvor that i am aware of
20:51:45 melwitt yeah.. I need a moment to regain my bearings 😝 I have spent so much time working on this and implementing the spec. I need some time to re-adjust my mind to this new thing
20:55:14 sean-k-mooney ya i dont have ennoguh sapre brain power to load context and think about this with any depth tonight to say anythign more then "Maybe?"
20:56:17 melwitt heh
20:56:31 sean-k-mooney i vaguly got that dan want to avoid updating the request spec on all move operations which i agree should not be required but i dont knwo why the serisse currenlty is so i cant really comment
20:57:24 melwitt it's because the original design involves setting a default inside sysmeta down in the libvirt driver. so that has to make it to the request spec somehow in order to be honored during scheduling
20:58:04 melwitt this issue goes away if we require image/flavor for the policy, which is why that's being talked about above
20:58:04 sean-k-mooney as in fakign that it was selected in the image medata data
20:58:28 sean-k-mooney so your saying we need to sync the image metadata form teh cell db to the request spec
20:58:35 sean-k-mooney so that move ops fine the right host
20:58:53 melwitt yes pretty much. the entire design in the spec is to put a image_hw_tpm_secret_security into the instance sysmeta regardless of whether it came from an image or not
20:59:08 sean-k-mooney ghat that sound valid and unfortunet because the comptue shoudl nbot need to touch the api db
20:59:16 sean-k-mooney but how do we handel this today?
20:59:27 sean-k-mooney we set a buch fo thing liek that already
21:00:07 melwitt you mean like for AZs? that got brought up in the gerrit review
21:00:28 sean-k-mooney like we set the request for a config drive or the machine tyep when the isntace lands on a comptue node
21:00:45 sean-k-mooney and recored them in instance_system_metadta during spawn
21:02:19 sean-k-mooney https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L7190-L7200
21:03:22 sean-k-mooney we do it in other palcees too that just the first palce i found
21:03:46 melwitt yeah that's very similar thing. but I don't find that ever makes it to the request spec
21:04:10 sean-k-mooney there are a bunch of debug lgos when we boot a vm where we recored specific values to make sure they dont change over the lifetime of the vm
21:04:20 melwitt not sure if any of those cases are things that are required for scheduling
21:06:13 sean-k-mooney ya nor am i
21:10:27 sean-k-mooney oh i set config_drive on the instance object not the image meta github.com/openstack/nova/blob/master/nova/compute/manager.py#L2255-L2268 https://github.com/openstack/nova/blob/master/nova/compute/manager.py#L2255-L2268
21:10:37 sean-k-mooney and we do not schduler on that either
21:19:44 sean-k-mooney melwitt: https://paste.opendev.org/show/bGufCv4fBSCZwAP3m6qT/ thos are the log message i ment
21:20:37 sean-k-mooney which is https://github.com/openstack/nova/blob/master/nova/compute/manager.py#L2255-L2268
21:20:53 sean-k-mooney sorry wrong link
21:21:06 sean-k-mooney https://github.com/openstack/nova/blob/d5cfdfd16d7573a83b05dd6c0656b7610e77c4c4/nova/virt/libvirt/driver.py#L993-L1043
21:21:52 sean-k-mooney we can scheduler on 'hw_video_model', 'hw_vif_model'
21:22:10 sean-k-mooney via a placement prefileter
21:22:23 sean-k-mooney but perhaps that only works fi you ahve it set on the iamge properly
21:22:54 melwitt hm yeah maybe
21:23:10 sean-k-mooney https://github.com/openstack/nova/blob/master/nova/compute/manager.py#L2255-L2268
21:23:32 sean-k-mooney wehn i wrote that i was not thinkign fo this other way of populating it
21:23:35 sean-k-mooney ...
21:23:46 sean-k-mooney way is that link stuck in my copy past buffer
21:23:57 sean-k-mooney https://github.com/openstack/nova/blob/d5cfdfd16d7573a83b05dd6c0656b7610e77c4c4/nova/scheduler/request_filter.py#L199
21:24:10 melwitt it really wants you to talk about that link I guess
21:24:12 sean-k-mooney oh its becasue the url was not updating in my firefox
21:24:36 sean-k-mooney you know the way if you edit the url but then navigate it does not updstea properly i think that is what happend
21:25:35 melwitt yeah that request filter is assuming the image properties are already in the request spec
21:25:41 sean-k-mooney so lee added this registration logic so that we could freely change the defautls without affectin new instnaces
21:26:02 sean-k-mooney but it was never inteded for scheduleing really
21:26:12 sean-k-mooney but i guess that was an oversight in the orignal feature
21:26:48 sean-k-mooney we never provide a way to sync the request spec with those if it was ever needed
21:27:23 sean-k-mooney melwitt: this is were your nova audit proroal woudl have been useful
21:27:40 sean-k-mooney i.e. to do a perodic sync of this info form the cell db to the api db
21:29:15 melwitt nova-janitor
21:31:50 opendevreview Merged openstack/python-novaclient master: Replace keystoneclient with openstacksdk https://review.opendev.org/c/openstack/python-novaclient/+/952986
21:37:47 opendevreview Merged openstack/nova stable/2024.1: restrict swap volume to cinder https://review.opendev.org/c/openstack/nova/+/957764
23:54:06 opendevreview Merged openstack/nova stable/2025.1: Ignore metadata tags in pci/stats _find_pool logic https://review.opendev.org/c/openstack/nova/+/945096
#openstack-nova - 2025-08-20
05:53:44 opendevreview Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578
06:46:54 opendevreview Max proposed openstack/nova master: fix: leftover volume_attachment on instance delete https://review.opendev.org/c/openstack/nova/+/934984
06:52:32 opendevreview Max proposed openstack/nova master: fix: leftover volume_attachment on instance delete https://review.opendev.org/c/openstack/nova/+/934984
11:19:01 priteau Hello. I am looking for reviewers for the backports fixing https://bugs.launchpad.net/nova/+bug/2098496.
11:19:19 priteau 2024.2 patches are ready to approve now:
11:19:21 priteau - https://review.opendev.org/c/openstack/nova/+/945098
11:19:24 priteau - https://review.opendev.org/c/openstack/nova/+/945099
15:28:29 jssfr does openstack have a workflow for booting a VM based off a unified kernel image (i.e. kernel + initramfs)?
15:42:43 pas-ha[m] jssfr: I'd think you still can, but it is deprecated since 2024.2 https://review.opendev.org/c/openstack/nova/+/926144
15:43:51 jssfr lovely
15:44:13 jssfr thanks!
#openstack-nova - 2025-08-21
08:56:59 zigo sean-k-mooney: Is Zed affected by OSSN-0094 ? That's in Debian Bookworm (ie: oldstable), which is why I wonder. So far, I did the work for caracal, dalmatian and epoxy, as there was patches available.
08:58:36 zigo It'd be nice ot have patches for zed, antelope and bobcat btw.
11:10:01 sean-k-mooney zigo: well those are unmaintended so as a rule the core team do not patch any bugs on them but we have antelop downstream and i think it was a clean cherry pick
11:11:12 sean-k-mooney zigo: but yes this has basicly been a thing forever. gibi did some monumental heavy liftign to backprot to wallabyt and train inertnally with a lot fo conflict in the tests.
11:11:24 sean-k-mooney but you might be able to just apply it back to zed
11:12:25 sean-k-mooney zigo: the risk profile fo this is relitivly low which is why we didn not push for a CVE ro similar
11:13:00 sean-k-mooney but i woudl encurage packages to patch it where ever they deem resonable
11:19:23 zigo If it's clean apply for Zed to Bobcat, then I'll attempt it.
11:21:58 zigo It doesn't apply on antelope, though it's only one hunk.

Earlier   Later