| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-08-21 | |||
| 16:21:22 | opendevreview | Stephen Finucane proposed openstack/nova stable/2025.1: api: Fix validators for hw:cpu_max_* extra specs https://review.opendev.org/c/openstack/nova/+/957739 | |
| 16:21:54 | opendevreview | Stephen Finucane proposed openstack/nova stable/2024.2: api: Fix validators for hw:cpu_max_* extra specs https://review.opendev.org/c/openstack/nova/+/957744 | |
| 16:22:25 | opendevreview | Stephen Finucane proposed openstack/nova stable/2024.1: api: Fix validators for hw:cpu_max_* extra specs https://review.opendev.org/c/openstack/nova/+/957745 | |
| 16:24:15 | opendevreview | Max proposed openstack/nova master: performance: reduce calls to libvirt / add caching https://review.opendev.org/c/openstack/nova/+/922855 | |
| 17:24:09 | opendevreview | Masahito Muroi proposed openstack/nova master: Add image_response_extra_properties config https://review.opendev.org/c/openstack/nova/+/958230 | |
| 17:30:00 | masahito | hi, nova team. We have already used the image properties fields to see our own custom image properties which not listed in the image meta object. if nova keeps showing the properties, it's super helpful. please review the patch if it's not a wrong direction. | |
| 18:26:38 | melwitt | sean-k-mooney: do you know if host domain capabilities like TPM are ever expected to be available in CI? I tried to create some regular tempest TPM tests and it failed bc there was tpm=no in host domain caps | |
| 18:27:24 | sean-k-mooney | you mean upstream | |
| 18:27:26 | sean-k-mooney | it shoudl work | |
| 18:27:36 | sean-k-mooney | vtpm does not depend on havign a tpm on the host | |
| 18:27:47 | sean-k-mooney | youjust need ot have the swtpm package isntalled | |
| 18:28:19 | sean-k-mooney | and ubuntu 24.04 is new enoguht to meet all our requiremetns | |
| 18:28:26 | sean-k-mooney | melwitt: do you have an exampel failure | |
| 18:28:46 | melwitt | uhm yeah, sec | |
| 18:29:42 | melwitt | sean-k-mooney: this, just trying to run only the nova-live-migration job https://review.opendev.org/c/openstack/nova/+/957477 | |
| 18:29:46 | melwitt | ok I must need some additional setup or such | |
| 18:33:28 | sean-k-mooney | is https://docs.openstack.org/nova/latest/configuration/config.html#libvirt.swtpm_enabled set to true | |
| 18:34:32 | sean-k-mooney | ok it is https://fdc1d05a9a337a8993b4-089607d394060d72ce519e30966a0033.ssl.cf2.rackcdn.com/openstack/4eb4b144eadc47b2848afc0e4ac315c8/controller/logs/etc/nova/nova-cpu_conf.txt | |
| 18:34:34 | melwitt | yes but I don't have the swtpm_user and swtpm_group set, not sure if that matters | |
| 18:34:45 | sean-k-mooney | it shouldnt by default | |
| 18:34:45 | melwitt | I noticed in whitebox it sets those | |
| 18:34:56 | sean-k-mooney | hum is it passign there? | |
| 18:35:06 | sean-k-mooney | the default should work | |
| 18:36:05 | sean-k-mooney | i dont see the swtpm package installed | |
| 18:36:09 | sean-k-mooney | https://fdc1d05a9a337a8993b4-089607d394060d72ce519e30966a0033.ssl.cf2.rackcdn.com/openstack/4eb4b144eadc47b2848afc0e4ac315c8/controller/logs/dpkg-l.txt | |
| 18:36:26 | sean-k-mooney | i wonder if its a suggested or recomemned package | |
| 18:36:37 | melwitt | yeah when you said that earlier I was thinking I need to add something to install it probablah | |
| 18:36:55 | sean-k-mooney | 25-08-16 18:29:02.173 | alsa-ucm-conf alsa-topology-conf libxml2-utils swtpm swtpm-tools mdevctl | |
| 18:37:01 | sean-k-mooney | so it in recommended | |
| 18:37:45 | melwitt | I shall try it. thanks | |
| 18:37:59 | sean-k-mooney | https://paste.opendev.org/show/bcoAzqGjo8UbLR3JWy1i/ | |
| 18:38:35 | melwitt | right next to our friend mdevctl | |
| 18:39:22 | sean-k-mooney | https://github.com/openstack/devstack/blob/master/lib/nova_plugins/functions-libvirt#L72 | |
| 18:39:26 | sean-k-mooney | you can add it there | |
| 18:39:53 | sean-k-mooney | proably with mdevctl while yoru at it for good messure | |
| 18:40:44 | melwitt | cool thanks :) | |
| 18:41:42 | sean-k-mooney | i woudl sepcficly add `swtpm swtpm-tools mdevctl` | |
| 18:42:05 | sean-k-mooney | i think the names are the same for centos too but i woudl just do it for ubuntu for now | |
| 18:42:31 | sean-k-mooney | if you submit a patch feel free to add me and ill take a look on monday | |
| 18:43:04 | sean-k-mooney | https://repology.org/project/swtpm/versions | |
| 18:43:12 | sean-k-mooney | swtpm is the same for waht its worth | |
| 18:43:23 | sean-k-mooney | im just not sure about the tools package | |
| 18:43:47 | sean-k-mooney | https://repology.org/project/mdevctl/versions | |
| 18:44:06 | sean-k-mooney | mdevctl also has the same name everywhere we care about | |
| 18:45:32 | sean-k-mooney | https://rpmfind.net/linux/rpm2html/search.php?query=swtpm-tools | |
| 18:45:41 | sean-k-mooney | swtpm-tools looks portable too | |
| 18:46:04 | sean-k-mooney | so you could add all 3 in both branches and just see if the devstack josb pass | |
| 18:46:08 | sean-k-mooney | it probly will | |
| 18:48:31 | melwitt | ok sweet thanks | |
| 21:14:09 | opendevreview | Merged openstack/nova master: api: Address issues with images APIs https://review.opendev.org/c/openstack/nova/+/956102 | |
| #openstack-nova - 2025-08-22 | |||
| 00:37:50 | opendevreview | melanie witt proposed openstack/nova master: DNM vtpm tempest https://review.opendev.org/c/openstack/nova/+/957477 | |
| 01:34:36 | opendevreview | Masahito Muroi proposed openstack/nova master: Add image_response_extra_properties config https://review.opendev.org/c/openstack/nova/+/958230 | |
| 02:50:43 | opendevreview | melanie witt proposed openstack/nova master: DNM vtpm tempest https://review.opendev.org/c/openstack/nova/+/957477 | |
| 07:02:46 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 07:27:28 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| #openstack-nova - 2025-08-25 | |||
| 09:42:21 | gibi | release liasions please check the pending nova stable releases we have an important security hardening bug in them | |
| 09:42:25 | gibi | https://ironicbaremetal.org/blog/coming-soon-threading/ | |
| 09:42:30 | gibi | https://review.opendev.org/c/openstack/releases/+/957951 | |
| 09:42:39 | gibi | https://review.opendev.org/c/openstack/releases/+/958009 | |
| 09:42:43 | gibi | https://review.opendev.org/c/openstack/releases/+/947847 | |
| 09:45:23 | gibi | ahh I see Uggla was there already. | |
| 09:46:41 | Uggla | @gibi, yes I think I have reviewed them, unless I miss one. | |
| 10:02:01 | opendevreview | Kamil Sambor proposed openstack/nova master: [hacking] Improve N373 to catch also other primitives https://review.opendev.org/c/openstack/nova/+/958408 | |
| 10:09:13 | elodilles | gibi: the release patches merged, things should be available on pypi and tarball.o.o, tags, etc., in some minutes | |
| 10:09:17 | elodilles | Uggla: ^^^ | |
| 10:13:53 | gibi | elodilles: thanks! | |
| 10:15:14 | elodilles | np | |
| 13:02:41 | opendevreview | Kamil Sambor proposed openstack/nova master: Switch nova-conductor to use ThreadPoolExecutor https://review.opendev.org/c/openstack/nova/+/957088 | |
| 13:13:16 | hayashino | Could someone review this patch? https://review.opendev.org/c/openstack/nova/+/942167 | |
| 13:52:40 | opendevreview | Kamil Sambor proposed openstack/nova master: Switch nova-conductor to use ThreadPoolExecutor https://review.opendev.org/c/openstack/nova/+/957088 | |
| 16:01:17 | bryanfraschetti | It might be worth mentioning that that we're seeing this on Ubuntu Jammy / Caracal, which contains the other two commits mentioned in that same comment. | |
| 16:01:17 | bryanfraschetti | https://bugs.launchpad.net/nova/+bug/2039803/comments/9, which mentioned that replacing the baselineCPU method is one of the remaining missing puzzle pieces but I don't have a lot of context on what's been done and what's needed. | |
| 16:01:17 | bryanfraschetti | Hope you're all doing well. I'm just wondering the current state of this bug: https://bugs.launchpad.net/nova/+bug/2039803, where live migration fails across similar hosts due to the compareHypervisorCPU check, and the associated topic: https://review.opendev.org/q/topic:%22bp/cpu-selection-with-hypervisor-consideration%22. I noticed that there was a recent comment | |
| 16:01:17 | bryanfraschetti | Hello Nova team o/ | |
| 16:32:03 | sean-k-mooney | bryanfraschetti: ya so it depend on the specific cpu version you have | |
| 16:32:11 | sean-k-mooney | the root cause si effectivly this | |
| 16:32:47 | sean-k-mooney | for some cpus the diffent ebtween the capablities api and domcapabiltys api out can cause the migration check in nova to fail | |
| 16:33:14 | sean-k-mooney | there is a workaroudn config option to disable the nova check in pre-migration and rely on the much later libvirt check | |
| 16:33:36 | sean-k-mooney | that is much more costly to revert when it fails but ti will work in more cases | |
| 16:34:01 | sean-k-mooney | the other alternitive is to use an explcit custom model instead of host-model or leaving the cpu_mode empty | |
| 16:34:19 | sean-k-mooney | cpu_mode unset and host-model are almsot but not quite identical | |
| 16:35:01 | sean-k-mooney | they are ment to select teh virtual cpu model that supprot hte largest subset of the host cpu features | |
| 16:35:20 | sean-k-mooney | that should be the closest cpu model to the hsot i.e. the host-model | |
| 16:36:04 | sean-k-mooney | for soem intel cpus in particalr but also newer amd cpus the odl and new api may differ. | |
| 16:36:14 | sean-k-mooney | using the new api in all places coudl fix it | |
| 16:36:41 | sean-k-mooney | the only concern then woudl be makeign sure the havior fo host-model and unset remains the same | |
| 16:37:42 | sean-k-mooney | bryanfraschetti: given Feature Freeze for this cycle is on thrusday this is not currently a priorty for the core team however if someone has time to work on fixign it we wont boject | |
| 16:37:59 | sean-k-mooney | but we likely wont have time to review for a week or two | |
| 16:56:11 | bryanfraschetti | Quick Q about the workaround options which skip the pre-migration check. What happens if these are enabled (eg. skip_cpu_check_on_start and skip_check_on_dest), but the hypervisors truly are incompatible and migration fails? Will this be caught by the libvirt check, and will the migration roll back - effectively not migrating, or will the migration be left in a broken state? | |
| 16:56:11 | bryanfraschetti | Thanks @sean-k-mooney for the explanation that clarifies things a lot actually. So the issue isn't so much the new approach of comparing hypervisors but rather that there's mixed usage of new and old approaches to check the capabilities, which can sometimes disagree - especially on new intel cpus. Consistently applying the new approach should resolve the discrepancies, which makes sense. | |
| 16:58:43 | gmaan | sean-k-mooney: on service role, I was checking if neutron has documented that nova service user need 'service' role or not but I could not find. Cinder has documented it so that is good. | |
| 16:59:24 | gmaan | sean-k-mooney: and I am now thinking many operator might have not have 'service' role and might have configured only admin role in neutron.conf | |
| 17:00:19 | gmaan | and nova policy change to 'role:service' will break them. I am now re-thinking on keep allowing admin also for those service API at least for this cycle - https://review.opendev.org/c/openstack/nova/+/957578/comment/a097d558_fee01375/ | |
| 17:00:45 | gmaan | and this cycle I can update neutron doc and release notes about requiring 'service' role to nova user | |
| 17:02:18 | gmaan | when I objected on not allowing admin, I thought of only direct user usage of service APIs which should be blocked right away but did not know that neutron did not state about 'service' role for their service users | |
| 17:02:49 | gmaan | and new default enable by default makes nova change to break such neutron deployment which has only admin role on nova user | |
| 17:04:26 | gmaan | I know you are ok with admin-or-service role but just want to confirm that we are on same page as I spent lot of time on service token things in tempest, neutron, oslo.policy check side which I should not have if discussed with you in advance :( | |
| 17:04:46 | sean-k-mooney | gmaan: so that why i orginlly propsoed doing `service or admin` last cycle | |
| 17:04:52 | sean-k-mooney | for upgrades | |
| 17:05:16 | sean-k-mooney | in our installer we alwasy create the users for service with both admin and service roles | |