Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2025-08-27
18:22:33 sean-k-mooney having a per service config section i think is better
18:22:47 sean-k-mooney but you could have one fallback to the other if not configured
18:22:47 gmaan yeah, do not know what use we can break
18:23:06 gmaan ok, let me propose the changes today and will add you both as reviewer.
18:23:35 gmaan sean-k-mooney: you want me to do it in your glance revert or separate one as this is more than revert and add admin right also with serviec role?
18:24:20 sean-k-mooney gmaan: that valid. i have alreayd modifed it once. its up to you if you want to review the review/changeid go for ti
18:24:21 whoami-rajat_ modifications in the revert might not be clean and confuse people doing blame in the future, can we go for a new patch?
18:24:30 sean-k-mooney otherwise i can abandon it in favor of yours
18:25:08 whoami-rajat_ gmaan, just to be sure, you will be working on the cinder patch as well right? to use [glance] config section
18:25:18 gmaan ok let's do with new patch
18:25:43 gmaan whoami-rajat_: yes, whole series + devstack one and testing it together like I did for nova
18:25:51 whoami-rajat_ okay, thanks!
18:26:58 whoami-rajat_ thanks again gmaan and sean-k-mooney for the details, I will go now, let me know when the glance and cinder patches are ready and i can help in merging them
18:27:14 gmaan thanks, might be late for you
18:28:42 whoami-rajat_ generally I've stopped working late now but this was important so :D
18:28:45 whoami-rajat_ thanks again!
18:29:15 gmaan good for you :)
19:10:44 sean-k-mooney dansmith: so im more or less +w but before i hit it do you want to make this chagne https://review.opendev.org/c/openstack/placement/+/945465/comment/b1e034dd_f7b0b442/ or will i just approve as is
19:12:16 sean-k-mooney dansmith: the wrodign change is defintly minor enouch that i dont think it needs a respon and gibi resolved there nit when they +2'd
19:13:04 sean-k-mooney so in the absence of a prefence one way or another ill add +w before i finish for today
19:13:10 sean-k-mooney but jsut said i woudl ask
19:13:12 dansmith yeah, I dunno, I remember trying to figure out what to say there.. "does not increase existing overage" sounds a bit weird to me, even though I know what you mean
19:13:36 dansmith my preference is to +W so the code is right, and we can FUP the log text if we want
19:13:37 sean-k-mooney ya same that waws the second time i wrote that
19:13:50 sean-k-mooney ack ill do that so
19:15:04 sean-k-mooney done ok im going to try and finsin in the next 15 mins or so. i assume your going to backport those at some point
19:16:09 sean-k-mooney it could be nice to include that in 2024.1 before it goes unmaintained but that wont happen until 2025.2 is released so there si a little time still
19:25:48 dansmith yeah, should be backported
19:26:08 dansmith I guess I dunno how far it really needs, I was thinking just to 2025.1
19:27:14 opendevreview Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578
19:27:43 sean-k-mooney i woudl say what is ever open when you get aroudn to it but 2025.1 is a good baseline
19:28:05 sean-k-mooney by open i mean still stable/*
19:32:28 sean-k-mooney gmaan: same question to you https://review.opendev.org/c/openstack/nova/+/957578/comment/2b782393_1a20e07c/
19:32:57 opendevreview Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578
19:33:53 sean-k-mooney im +2 i can +w but if you feel like adressing the final nit then im ok with fast approving or having dan proxy
19:34:14 opendevreview Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578
19:34:30 gmaan dansmith: sean-k-mooney ^^ updated, I need to fix api-ref failure also. so this is updated one now
19:34:39 sean-k-mooney ah yes stephsn sample split patch merged
19:34:48 gmaan yeah :)
19:35:10 sean-k-mooney i was wonderign what the prior conflict was
19:47:17 gmaan dansmith: sean-k-mooney thanks. can you please review this devstack change also which is needed but tempest service role tests https://review.opendev.org/c/openstack/devstack/+/958612
19:51:56 sean-k-mooney im actully going to finish reviewing the first change in the sev serice but yes i can aftger
19:52:04 sean-k-mooney then ill call it a day.
19:52:28 sean-k-mooney my priorty tomorrwo will be to try and finish hte sev serise adn maybe the provider.yaml one
19:53:12 gmaan thanks
19:53:19 sean-k-mooney ok its litrally jsut adding thr service role
19:53:32 gmaan yeah, quick one :)
19:53:50 sean-k-mooney im +2 bnut shoud there be a comment above
19:54:04 sean-k-mooney or shoudl you also mention that the service role is added in 2025.2
19:54:17 sean-k-mooney basicly im wonderign why you left the first comment
19:54:53 gmaan i might just missed that, i can fix later once touching that file for related things
19:55:03 sean-k-mooney ack
19:55:15 sean-k-mooney i was just wonderign is there a convention that i shoudl be reviewing for
19:55:53 sean-k-mooney like in nova-next we sometime add comment when testing a future default so we know we can drop it form the job when it actully becomes the default
19:56:20 sean-k-mooney is noting the manager role so you can knwo when tempst can depend on it ?
19:56:56 gmaan yeah, that is helpful specially to know when to drop those things once they are in all supported releases
19:57:08 sean-k-mooney ack
20:18:19 sean-k-mooney ok first patch doen and it looks ok but i defintly dont have the brain power to go deeper in teh sev series today
20:18:30 sean-k-mooney ill try an complete it tomorrow
23:50:58 opendevreview Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706
23:50:58 opendevreview Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685
23:50:59 opendevreview Takashi Kajinami proposed openstack/nova master: Add functional test scenario for mixed SEV RPs https://review.opendev.org/c/openstack/nova/+/958562
23:50:59 opendevreview Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106
23:51:00 opendevreview Takashi Kajinami proposed openstack/nova master: Purge nested SEV RPs when SEV is disabled https://review.opendev.org/c/openstack/nova/+/958626
#openstack-nova - 2025-08-28
08:16:50 bauzas looks like we have a CI pipeline issue :(
08:16:54 bauzas Uggla: ^
08:17:10 bauzas example here https://zuul.opendev.org/t/openstack/build/7626e6d8c1e3423f921fa65667467d64
08:17:48 bauzas tkajinam: please just add something when you say "recheck", something like "recheck timeout" :)=
08:18:05 bauzas this is fine tho, please don't recheck again
08:26:28 Uggla bauzas, you "recheck" it again ?
08:26:48 bauzas lemme check where we are in the gate for the series
08:29:40 bauzas Uggla: the first patch in the series is fine, and I see the next 3 ones in the check pipeline, so no need to recheck
08:30:58 drannou Hello nova ! Quick question: we would like to harden nova-compute rights, what is the strict minimum right nova-compute needed ? Does anyone already have a specific policy.json ?
08:39:02 Uggla bauzas, I was not sure about the second one. Cool if they are in the pipeline.
08:39:22 bauzas Uggla: as a reminder, you can look at https://zuul.opendev.org/t/openstack/status?change=921814
08:40:20 bauzas drannou: not sure I understand your question, you're mixing API policies that are public and nova-compute RPC calls that are internal
08:40:46 bauzas or are you talking of the privilege escalation that the nova-compute python service can do ?
08:41:31 Uggla bauzas, yep I know about it. But I was probably too fast and I did not find it at a first glance.
08:42:18 drannou only nova-compute internal API (http) calls, let's imagine that I don't trust the nova-compute hosts (Vm escape), I would like to create dedicated role for nova-comptue with the strict minimum rights on API calls (neutron, glance, cinder, placement). Of course for RPC, I know that we have not "rights" available
09:04:50 gibi bauzas: Uggla: I saw grenade issues wiht
09:04:51 gibi 2025-08-27 17:29:17.139980 | compute1 | /opt/stack/old/devstack/functions-common: line 2189: 30613 Segmentation fault sudo usermod -a -G "$group" "$user"
09:05:08 gibi and general issues with "Error: Failed to update project openstack/nova"
09:05:16 gibi the latter is random in differnt jobs
09:05:31 gibi but I had not time to dig deeper
09:05:35 bauzas this is not on a single job
09:05:36 gibi or file bugs or notifiy infra
09:05:45 bauzas I was about to see the next results
09:05:49 bauzas before calling infra
09:05:56 bauzas maybe some node(s) are having issues
09:06:14 bauzas gibi: I'll continue to follow-up, thanks for your help
09:06:46 bauzas drannou: oh, you're talking of a service persona
09:07:09 Uggla that's really weird to get a segfault on "sudo usermod".
09:07:10 bauzas for nova calling the other serfvices
09:07:37 bauzas drannou: there are good news for you, do you know about something called Secure RBAC ?
09:08:17 bauzas Uggla: I saw that once, IIRC this was due to a tainted kernel
09:08:40 bauzas that's just an user exception when calling sudo, but if you look at the system logs or dmesg, this is clear
09:08:55 Uggla (OO)
09:18:09 drannou bauzas: more (or may be) less :)
09:24:15 bauzas drannou: https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#isolate-service-to-service-apis-to-the-service-role
09:24:52 bauzas drannou: and that's litterally what I'm currently reviewing https://review.opendev.org/c/openstack/nova/+/957578

Earlier   Later