| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-08-27 | |||
| 18:22:26 | gmaan | nova also has per service config users | |
| 18:22:33 | sean-k-mooney | having a per service config section i think is better | |
| 18:22:47 | sean-k-mooney | but you could have one fallback to the other if not configured | |
| 18:22:47 | gmaan | yeah, do not know what use we can break | |
| 18:23:06 | gmaan | ok, let me propose the changes today and will add you both as reviewer. | |
| 18:23:35 | gmaan | sean-k-mooney: you want me to do it in your glance revert or separate one as this is more than revert and add admin right also with serviec role? | |
| 18:24:20 | sean-k-mooney | gmaan: that valid. i have alreayd modifed it once. its up to you if you want to review the review/changeid go for ti | |
| 18:24:21 | whoami-rajat_ | modifications in the revert might not be clean and confuse people doing blame in the future, can we go for a new patch? | |
| 18:24:30 | sean-k-mooney | otherwise i can abandon it in favor of yours | |
| 18:25:08 | whoami-rajat_ | gmaan, just to be sure, you will be working on the cinder patch as well right? to use [glance] config section | |
| 18:25:18 | gmaan | ok let's do with new patch | |
| 18:25:43 | gmaan | whoami-rajat_: yes, whole series + devstack one and testing it together like I did for nova | |
| 18:25:51 | whoami-rajat_ | okay, thanks! | |
| 18:26:58 | whoami-rajat_ | thanks again gmaan and sean-k-mooney for the details, I will go now, let me know when the glance and cinder patches are ready and i can help in merging them | |
| 18:27:14 | gmaan | thanks, might be late for you | |
| 18:28:42 | whoami-rajat_ | generally I've stopped working late now but this was important so :D | |
| 18:28:45 | whoami-rajat_ | thanks again! | |
| 18:29:15 | gmaan | good for you :) | |
| 19:10:44 | sean-k-mooney | dansmith: so im more or less +w but before i hit it do you want to make this chagne https://review.opendev.org/c/openstack/placement/+/945465/comment/b1e034dd_f7b0b442/ or will i just approve as is | |
| 19:12:16 | sean-k-mooney | dansmith: the wrodign change is defintly minor enouch that i dont think it needs a respon and gibi resolved there nit when they +2'd | |
| 19:13:04 | sean-k-mooney | so in the absence of a prefence one way or another ill add +w before i finish for today | |
| 19:13:10 | sean-k-mooney | but jsut said i woudl ask | |
| 19:13:12 | dansmith | yeah, I dunno, I remember trying to figure out what to say there.. "does not increase existing overage" sounds a bit weird to me, even though I know what you mean | |
| 19:13:36 | dansmith | my preference is to +W so the code is right, and we can FUP the log text if we want | |
| 19:13:37 | sean-k-mooney | ya same that waws the second time i wrote that | |
| 19:13:50 | sean-k-mooney | ack ill do that so | |
| 19:15:04 | sean-k-mooney | done ok im going to try and finsin in the next 15 mins or so. i assume your going to backport those at some point | |
| 19:16:09 | sean-k-mooney | it could be nice to include that in 2024.1 before it goes unmaintained but that wont happen until 2025.2 is released so there si a little time still | |
| 19:25:48 | dansmith | yeah, should be backported | |
| 19:26:08 | dansmith | I guess I dunno how far it really needs, I was thinking just to 2025.1 | |
| 19:27:14 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:27:43 | sean-k-mooney | i woudl say what is ever open when you get aroudn to it but 2025.1 is a good baseline | |
| 19:28:05 | sean-k-mooney | by open i mean still stable/* | |
| 19:32:28 | sean-k-mooney | gmaan: same question to you https://review.opendev.org/c/openstack/nova/+/957578/comment/2b782393_1a20e07c/ | |
| 19:32:57 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:33:53 | sean-k-mooney | im +2 i can +w but if you feel like adressing the final nit then im ok with fast approving or having dan proxy | |
| 19:34:14 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:34:30 | gmaan | dansmith: sean-k-mooney ^^ updated, I need to fix api-ref failure also. so this is updated one now | |
| 19:34:39 | sean-k-mooney | ah yes stephsn sample split patch merged | |
| 19:34:48 | gmaan | yeah :) | |
| 19:35:10 | sean-k-mooney | i was wonderign what the prior conflict was | |
| 19:47:17 | gmaan | dansmith: sean-k-mooney thanks. can you please review this devstack change also which is needed but tempest service role tests https://review.opendev.org/c/openstack/devstack/+/958612 | |
| 19:51:56 | sean-k-mooney | im actully going to finish reviewing the first change in the sev serice but yes i can aftger | |
| 19:52:04 | sean-k-mooney | then ill call it a day. | |
| 19:52:28 | sean-k-mooney | my priorty tomorrwo will be to try and finish hte sev serise adn maybe the provider.yaml one | |
| 19:53:12 | gmaan | thanks | |
| 19:53:19 | sean-k-mooney | ok its litrally jsut adding thr service role | |
| 19:53:32 | gmaan | yeah, quick one :) | |
| 19:53:50 | sean-k-mooney | im +2 bnut shoud there be a comment above | |
| 19:54:04 | sean-k-mooney | or shoudl you also mention that the service role is added in 2025.2 | |
| 19:54:17 | sean-k-mooney | basicly im wonderign why you left the first comment | |
| 19:54:53 | gmaan | i might just missed that, i can fix later once touching that file for related things | |
| 19:55:03 | sean-k-mooney | ack | |
| 19:55:15 | sean-k-mooney | i was just wonderign is there a convention that i shoudl be reviewing for | |
| 19:55:53 | sean-k-mooney | like in nova-next we sometime add comment when testing a future default so we know we can drop it form the job when it actully becomes the default | |
| 19:56:20 | sean-k-mooney | is noting the manager role so you can knwo when tempst can depend on it ? | |
| 19:56:56 | gmaan | yeah, that is helpful specially to know when to drop those things once they are in all supported releases | |
| 19:57:08 | sean-k-mooney | ack | |
| 20:18:19 | sean-k-mooney | ok first patch doen and it looks ok but i defintly dont have the brain power to go deeper in teh sev series today | |
| 20:18:30 | sean-k-mooney | ill try an complete it tomorrow | |
| 23:50:58 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706 | |
| 23:50:58 | opendevreview | Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685 | |
| 23:50:59 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add functional test scenario for mixed SEV RPs https://review.opendev.org/c/openstack/nova/+/958562 | |
| 23:50:59 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106 | |
| 23:51:00 | opendevreview | Takashi Kajinami proposed openstack/nova master: Purge nested SEV RPs when SEV is disabled https://review.opendev.org/c/openstack/nova/+/958626 | |
| #openstack-nova - 2025-08-28 | |||
| 08:16:50 | bauzas | looks like we have a CI pipeline issue :( | |
| 08:16:54 | bauzas | Uggla: ^ | |
| 08:17:10 | bauzas | example here https://zuul.opendev.org/t/openstack/build/7626e6d8c1e3423f921fa65667467d64 | |
| 08:17:48 | bauzas | tkajinam: please just add something when you say "recheck", something like "recheck timeout" :)= | |
| 08:18:05 | bauzas | this is fine tho, please don't recheck again | |
| 08:26:28 | Uggla | bauzas, you "recheck" it again ? | |
| 08:26:48 | bauzas | lemme check where we are in the gate for the series | |
| 08:29:40 | bauzas | Uggla: the first patch in the series is fine, and I see the next 3 ones in the check pipeline, so no need to recheck | |
| 08:30:58 | drannou | Hello nova ! Quick question: we would like to harden nova-compute rights, what is the strict minimum right nova-compute needed ? Does anyone already have a specific policy.json ? | |
| 08:39:02 | Uggla | bauzas, I was not sure about the second one. Cool if they are in the pipeline. | |
| 08:39:22 | bauzas | Uggla: as a reminder, you can look at https://zuul.opendev.org/t/openstack/status?change=921814 | |
| 08:40:20 | bauzas | drannou: not sure I understand your question, you're mixing API policies that are public and nova-compute RPC calls that are internal | |
| 08:40:46 | bauzas | or are you talking of the privilege escalation that the nova-compute python service can do ? | |
| 08:41:31 | Uggla | bauzas, yep I know about it. But I was probably too fast and I did not find it at a first glance. | |
| 08:42:18 | drannou | only nova-compute internal API (http) calls, let's imagine that I don't trust the nova-compute hosts (Vm escape), I would like to create dedicated role for nova-comptue with the strict minimum rights on API calls (neutron, glance, cinder, placement). Of course for RPC, I know that we have not "rights" available | |
| 09:04:50 | gibi | bauzas: Uggla: I saw grenade issues wiht | |
| 09:04:51 | gibi | 2025-08-27 17:29:17.139980 | compute1 | /opt/stack/old/devstack/functions-common: line 2189: 30613 Segmentation fault sudo usermod -a -G "$group" "$user" | |
| 09:05:08 | gibi | and general issues with "Error: Failed to update project openstack/nova" | |
| 09:05:16 | gibi | the latter is random in differnt jobs | |
| 09:05:31 | gibi | but I had not time to dig deeper | |
| 09:05:35 | bauzas | this is not on a single job | |
| 09:05:36 | gibi | or file bugs or notifiy infra | |
| 09:05:45 | bauzas | I was about to see the next results | |
| 09:05:49 | bauzas | before calling infra | |
| 09:05:56 | bauzas | maybe some node(s) are having issues | |
| 09:06:14 | bauzas | gibi: I'll continue to follow-up, thanks for your help | |
| 09:06:46 | bauzas | drannou: oh, you're talking of a service persona | |
| 09:07:09 | Uggla | that's really weird to get a segfault on "sudo usermod". | |
| 09:07:10 | bauzas | for nova calling the other serfvices | |
| 09:07:37 | bauzas | drannou: there are good news for you, do you know about something called Secure RBAC ? | |
| 09:08:17 | bauzas | Uggla: I saw that once, IIRC this was due to a tainted kernel | |
| 09:08:40 | bauzas | that's just an user exception when calling sudo, but if you look at the system logs or dmesg, this is clear | |
| 09:08:55 | Uggla | (OO) | |
| 09:18:09 | drannou | bauzas: more (or may be) less :) | |
| 09:24:15 | bauzas | drannou: https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#isolate-service-to-service-apis-to-the-service-role | |