| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-09-03 | |||
| 12:05:19 | sean-k-mooney | gibi: we debuged that cidner volume isseu a few weeks ago | |
| 12:05:40 | sean-k-mooney | jkulik: i belivw ew do not suprot live migration with encypted volumes today | |
| 12:05:57 | jkulik | ah. ok. I was assuming :) | |
| 12:06:18 | sean-k-mooney | jkulik: that was a limitation intially and we plan to solve it using the same stragey for vtpm mitragion when that is complete | |
| 12:06:54 | gibi | sean-k-mooney: it is the same? what is the solution? is there a bug I can duplicate mine to? | |
| 12:07:10 | sean-k-mooney | for vtpm migration we are introducing 2 other modes, deployment where the encyrption keey will be owned by nova not the end user and host where the secret will be copied form host to host by reading it form libvirt and creating it | |
| 12:07:56 | sean-k-mooney | gibi: no, i dough into it, found the error and looked at how cidner is implemtneding cpu trotteling breifly | |
| 12:08:19 | sean-k-mooney | i brought it up on the QA channel | |
| 12:08:44 | sean-k-mooney | but i think i found a bz for it | |
| 12:08:47 | sean-k-mooney | ill need to check back | |
| 12:09:10 | jkulik | very helpful. thank you. also found the spec for that: https://github.com/openstack/nova-specs/blob/master/specs/2025.2/approved/vtpm-live-migration.rst | |
| 12:09:13 | sean-k-mooney | there is a diffent bug in teh qemu we are suing on debian 12 that i think is already fixed | |
| 12:09:37 | sean-k-mooney | gibi: let me check the irc logs and see if i can find the details | |
| 12:10:29 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2025.1: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959308 | |
| 12:10:30 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2025.1: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959309 | |
| 12:10:35 | gibi | sean-k-mooney: thanks | |
| 12:12:03 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.2: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959310 | |
| 12:12:04 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.2: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959311 | |
| 12:13:02 | sean-k-mooney | gibi: https://meetings.opendev.org/irclogs/%23openstack-qa/%23openstack-qa.2025-08-12.log.html | |
| 12:13:10 | sean-k-mooney | so its https://bugzilla.redhat.com/show_bug.cgi?id=2336437 | |
| 12:13:17 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.1: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959313 | |
| 12:13:18 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.1: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959314 | |
| 12:13:26 | sean-k-mooney | gibi: oh right i stated trying to fix it | |
| 12:13:47 | sean-k-mooney | so i put this on hold due to the security bug then FF | |
| 12:14:01 | sean-k-mooney | gibi: teh fix i starteed on is using a newer qemu form the backports repo | |
| 12:14:24 | sean-k-mooney | there are 2 ways to do that i was trying the one clark suggested althouth the other way is simpler | |
| 12:15:29 | sean-k-mooney | the fixed qemu is avaibel in debian 12 backporta dn proably debian 13 so we can jsut swap the job to 13 on master after RC1 once we clean up the devstack patch for debian 13, so that will be a month or so away | |
| 12:15:30 | gibi | ack. I added the bz to the cinder bug | |
| 12:16:27 | sean-k-mooney | for stable if we use qemu form the backprots repo it "should" fix it but we will need to either use -t to enabel the backports repo when isntalling qemu or update the name of the package to include /backprots or wahtever | |
| 12:16:48 | sean-k-mooney | the latter is the harder approch i was trying but then i need to list all the package however it would be cleaner in the long rung | |
| 12:17:10 | sean-k-mooney | the former is eaiser to do but it requires use to supprot that in the package_install comamnd | |
| 12:17:24 | sean-k-mooney | which is doable jsut need some extra pluming to make it happen | |
| 12:18:01 | gibi | I see | |
| 12:18:41 | gibi | I will use the bug I filed on cinder as the target of rechecks but feel free to re-target that bug from cinder to whathever we use to track package issues | |
| 12:20:08 | nate | sean-k-mooney: Thanks for the clarification. But how does nova create the secret in libvirt. How does it access the secret stored in barbican ? You mentioned end-user access token. How is it passed to nova-compute ? | |
| 12:20:12 | sean-k-mooney | looks like i did a dumb and deleted my psi vm for debian 12 with the patch i have not pushed yet but i didn tget that far anyway | |
| 12:21:16 | sean-k-mooney | nate: yes so wehn a use attaches an encypted volume or creates a vm with it the pass a keystoen token, nova uses that token to access barbican and retrive the key and store it in libvirt | |
| 12:21:37 | sean-k-mooney | nate: but we only have that token in memory while we are processign teh api request form the user | |
| 12:21:51 | sean-k-mooney | so its discarded and nova does nto have access beyond that intial point | |
| 12:22:12 | sean-k-mooney | gibi: ill at this to my list to work on again next week | |
| 12:23:39 | nate | sean-k-mooney: Ok so nova running on the compute node get this token and use it to retrieve the encryption key ? Am I correct ? | |
| 12:24:10 | nate | sean-k-mooney: because I have a call to barbicanclient in the logs of nova on my compute node | |
| 12:24:27 | sean-k-mooney | yes | |
| 12:24:52 | sean-k-mooney | nova uses the toke supplied by the user to talk to other service like glance to get the image or barbican to get the secret | |
| 12:25:12 | sean-k-mooney | nova itself does nto have the ablity to retirive the barbica seccret with the creditals in the nova.conf | |
| 12:25:39 | sean-k-mooney | but the users token does adn like all service we are expected to use the users token where possibel to talk to other service when processing a users request | |
| 12:26:02 | sean-k-mooney | that why a user can take the action but an admin cannot | |
| 12:29:00 | nate | sean-k-mooney: Perfect great ! Thank you that clarifies it. | |
| 12:30:08 | sean-k-mooney | gibi: just for contenxt this is the call that either need to be done with -t backports https://github.com/openstack/devstack/blob/master/lib/nova_plugins/functions-libvirt#L72 or we need to move thos packages to here with /backports and # dist:debian12 | |
| 12:31:58 | sean-k-mooney | i tired claks suggestion and while i could get it to work having to specyify all the deps one by one is more fagile IMO then doign it the other way so i think im goign to try the -t approch isntead next time. | |
| 12:32:40 | sean-k-mooney | gibi: basiclly i would have to list all the same packages you did in yoru downgrade patch for qemu-img and thats a pain | |
| 12:33:52 | sean-k-mooney | addin a branch to install_libvirt for debian 12 i think its just simpler the refactoing the install to use files | |
| 12:51:27 | Uggla | gibi thanks for the above info. | |
| 12:53:06 | Uggla | the msg from qemu-img is quite strange. | |
| 13:11:58 | opendevreview | Tobias Urdin proposed openstack/nova master: Retry more volume API functions on server error https://review.opendev.org/c/openstack/nova/+/942981 | |
| 14:02:22 | ratailor | sean-k-mooney, gibi could you please review https://review.opendev.org/c/openstack/nova/+/946733 and https://review.opendev.org/c/openstack/nova/+/954460 | |
| 14:03:43 | opendevreview | Rajesh Tailor proposed openstack/nova master: Fix typos https://review.opendev.org/c/openstack/nova/+/959322 | |
| 14:06:28 | ratailor | Uggla, could you please review this clean backport to stable/2024.1 https://review.opendev.org/c/openstack/nova/+/952961 | |
| 14:06:55 | Uggla | ratailor, sure I'm going to do it. | |
| 14:07:05 | ratailor | Uggla, Thanks! | |
| 14:12:50 | gibi | ratailor: https://review.opendev.org/c/openstack/nova/+/954460 is pretty featury so that probably need to wait G | |
| 14:14:16 | gibi | I'm +2 on https://review.opendev.org/c/openstack/nova/+/946733 | |
| 14:14:22 | ratailor | gibi, ack. Thanks! could you please glance through it and check if anything is missing. when you have time. | |
| 14:22:25 | sean-k-mooney | ya i feel the same about 954460 | |
| 14:22:39 | sean-k-mooney | we can revisit it after rc1 is cut in 8 days | |
| 14:22:47 | sean-k-mooney | so ping us again in like 2 weeks | |
| 14:23:46 | sean-k-mooney | https://review.opendev.org/c/openstack/nova/+/946733 is ok before RC1 but ill review it properly when i get back to my desk, grabing coffee | |
| 14:27:57 | ratailor | sean-k-mooney, sure. Thanks! I will do. | |
| 14:28:05 | ratailor | sean-k-mooney, should I resolve conflict here https://review.opendev.org/c/openstack/nova/+/957958 with your permission, looks like you backported directly from UI. | |
| 14:47:15 | sean-k-mooney | i did and i just have not had time to update it | |
| 14:47:25 | bauzas | gibi: sorry forgot the eventlet meeting, do we have it ? | |
| 14:47:51 | sean-k-mooney | i fyou want to rebase it properly feel free i was going to wait until i cleared my current backlog of patche befoer redoing it | |
| 14:48:12 | sean-k-mooney | that why i set - workflow on the patch orginally | |
| 14:48:32 | sean-k-mooney | i wanted to wait until after FF/RC was out of the way to finish the backport | |
| 15:00:36 | opendevreview | Rajesh Tailor proposed openstack/nova stable/2025.1: only show standard image properties in server show. https://review.opendev.org/c/openstack/nova/+/957958 | |
| 15:28:33 | zigo | It's obviously failing when building the sphinx doc. Anyways, does anyone have a clue what I could do? (except a painful tempest.cmd folder rename) | |
| 15:28:33 | zigo | https://paste.opendev.org/show/bb1c8yKdZi4J7aKd4KsY/ | |
| 15:28:33 | zigo | I'm having an issue with tempest's packaging: it's having tempest/cmd which conflicts with sytem's cmd.Cmd. Here's the build log: | |
| 15:38:54 | clarkb | is something doing from tempest import cmd? Otherwise they shouldn't conflict right? | |
| 15:40:46 | clarkb | hrm maybe it is part of the sphinx imports situation. Looks like your traceback has a whole import_module() routine that could be "polluting" things | |
| 16:05:42 | sean-k-mooney | so you can have issue like that on ocation if thing do relitive imporat based on your workign dir btu this wi oen of the reason we never use relitive imports in openstack | |
| 16:06:55 | sean-k-mooney | zigo: by the way this is proably more suitbale for #openstack-qa | |
| 16:07:05 | sean-k-mooney | sinc ethis does not seam to be related to nova in nay way | |
| 16:07:15 | sean-k-mooney | zigo: oh | |
| 16:07:21 | gibi | bauzas: yeah we had one, I forgot to ping here. Bottom line we discussed a bit of scale testing, a bit of fixing sync rpc calls like volume attach and a bit of switching defaults in early G from eventlet to threading in the API | |
| 16:07:28 | sean-k-mooney | zigo: why are you doing PYTHONPATH=. | |
| 16:07:41 | sean-k-mooney | your adding the current workign dir into the python path | |
| 16:07:50 | bauzas | gibi: thanks for the summary | |
| 16:07:54 | sean-k-mooney | that could cause import issues like that | |
| 16:08:31 | sean-k-mooney | gibi: ah sorry i ment to join i got nerd sniped by somethign else | |
| 16:09:47 | sean-k-mooney | gibi: by the way i almost never use our fake driver, but if we wanted to test a mroe compelte fake driver eventually we coudl likely enabel the libvirt fixture in it vai a config option or siilar. it still would not actully talk to libvirt but it would be much more complete | |
| 16:10:04 | sean-k-mooney | basiclly run it the way we do in the libvirt fucntional tests | |
| 16:10:35 | sean-k-mooney | i dont think you can do that via config today but it could be intersting to try | |
| 16:11:09 | sean-k-mooney | kolla has or at least had the ablity to deploy multiple copies of the nova and neutorn fake drivers per physical host in the past | |
| 16:11:39 | sean-k-mooney | allowing you to take 3 host and run 10s to 100s of fake hosts | |
| 16:12:22 | sean-k-mooney | i think devstack might eb able to do that too but its been 8 years or so since i actully tried to use any of that | |
| 16:14:16 | gibi | yeah it is a good idea to try to upgrade our fake driver to use the libvirt fixture. I have an item for G to have fake driver based scale testing that can be extended with this | |
| 16:16:25 | sean-k-mooney | https://docs.openstack.org/devstack/latest/guides/nova.html#fake-virt-driver | |
| 16:17:27 | sean-k-mooney | so we do still have the basic supprot but i dotn knwo if this ever worked with ovn adn i suspect there coudl be other issues. | |
| 16:17:41 | sean-k-mooney | just bit rot honstly more then anything fundemental | |