| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-01-14 | |||
| 10:42:08 | gibi | it had an approved spec so I think the nova core team was OK with that feature proposal. So if you are interested it can be revived. | |
| 10:43:53 | gibi | if you are new to openstack then here are our contributor guide https://docs.openstack.org/nova/latest/contributor/index.html | |
| 10:48:37 | gibi | JayF: +2+A thanks for the explanation | |
| 10:56:58 | gokhan | It is very helpful to know that enforce_session_timeout is the server-side solution we were looking for. We now understand that token_ttl serves as both the link validity period and the maximum session duration when this feature is enabled. We will set a reasonable TTL (like 3600s) to balance security and user experience. | |
| 10:56:58 | gokhan | Thanks a lot for the clarification, Gibi! | |
| 10:56:58 | gokhan | Regarding the password authentication; it’s a bit disappointing that it wasn’t fully implemented, but knowing its current status helps us explain the situation to our security audit team. We will evaluate the possibility of developing and reviving this feature with our team. | |
| 10:58:46 | gibi | ralonsoh: re pyroute2 0.9.5 the job you run actaully shows the same error about the event loop https://zuul.opendev.org/t/openstack/build/9e54327cbaa94a4b8ecf9c5472934c97/log/controller/logs/screen-n-cpu.txt#48564-48581 | |
| 10:59:15 | gibi | gokhan: cool. Happy to help | |
| 11:00:51 | ralonsoh | gibi, ok I thought that was fixed | |
| 11:04:56 | gokhan | gibi, I have also created a bug : Live Migration Rollback Corrupts Block Device Mapping of Unrelated VM : https://bugs.launchpad.net/nova/+bug/2133501 do you have any insgihts about it ? we will send a patch for this. this worked for us but I want to be sure I don't ignore critical things > https://bugs.launchpad.net/nova/+bug/2133501/comments/10 | |
| 12:11:35 | sean-k-mooney | gokhan: passward auth was not impletned because it very insecure | |
| 12:12:03 | sean-k-mooney | gokhan: we felt adding ti was mroe harmful as it woudl lead operator to think that it was a sufficnet security mechanium to use in production | |
| 12:12:58 | sean-k-mooney | gokhan: vnc's password auth can have a maxium of i belive 7 ascii pritnabale charters as the password so the password space is very small | |
| 12:13:26 | sean-k-mooney | gokhan: we implented vencypt to do cert based auth between the proxy and the qemu instance instead | |
| 12:13:51 | sean-k-mooney | and then expect the guest passwoard auth to be used on the guest | |
| 12:15:11 | sean-k-mooney | gokhan:... any corss instece behiver is generaly treated as a possible secuirty bug so it shoudl not be filed publicly but its too late to change that now | |
| 12:18:10 | sean-k-mooney | hum i see that proably should have been set as public security rahter hten just public | |
| 12:18:20 | sean-k-mooney | as there are still security and multi tenant aspect to this | |
| 12:29:37 | opendevreview | Balazs Gibizer proposed openstack/nova master: Upgrade note for concurrency mode default change https://review.opendev.org/c/openstack/nova/+/969888 | |
| 12:39:15 | opendevreview | Balazs Gibizer proposed openstack/nova master: Remove eventlet from libvirt/test_driver https://review.opendev.org/c/openstack/nova/+/970070 | |
| 12:39:15 | opendevreview | Balazs Gibizer proposed openstack/nova master: Remove eventlet from CacheConcurrencyTestCase https://review.opendev.org/c/openstack/nova/+/970069 | |
| 12:39:16 | opendevreview | Balazs Gibizer proposed openstack/nova master: Remove eventlet from libvirt/volume/test_mount https://review.opendev.org/c/openstack/nova/+/970071 | |
| 12:42:35 | opendevreview | Balazs Gibizer proposed openstack/nova master: Remove eventlet from libvirt/volume/test_mount https://review.opendev.org/c/openstack/nova/+/970071 | |
| 12:55:35 | opendevreview | Takashi Natsume proposed openstack/nova-specs master: Create specs directory for 2026.2 Hibiscus https://review.opendev.org/c/openstack/nova-specs/+/973373 | |
| 12:57:30 | opendevreview | Merged openstack/nova master: [ironic] Use constants from Ironic, test w/ddt https://review.opendev.org/c/openstack/nova/+/969321 | |
| 12:58:39 | gokhan | Thanks for the warning and the detailed explanation, Sean. | |
| 12:58:40 | gokhan | I now understand the rationale behind not implementing the 7-8 character weak password auth. We will focus on hardening the session management side instead. Thanks again for your time and the heads-up! | |
| 12:58:40 | gokhan | Following your advice, we will rely on vEncrypt for proxy-to-instance security and utilize enforce_session_timeout (implemented in Caracal) to mitigate the risks raised by our security team. | |
| 12:58:40 | gokhan | I shared this publicly because I saw the "approved" status on the Wallaby spec and assumed it was a standard feature discussion rather than a zero-day vulnerability. Interestingly, even that spec mentions: "the VNC password is not a very strong security mechanism" which aligns perfectly with what you said. | |
| 12:59:04 | gokhan | sean-k-mooney, ^^ | |
| 13:01:27 | sean-k-mooney | no worries. when we were eveualting the password auth we had some converstation with the qemu and libvirt maintainer and it was there advice to not implement it in nova and pivot to the vencypt approch orginally | |
| 13:02:19 | sean-k-mooney | the enforce_session_timeout was also part of the dicsussion on general hardening of the capablities | |
| 13:04:30 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Use firmware auto-selection by libvirt https://review.opendev.org/c/openstack/nova/+/969132 | |
| 13:12:30 | gokhan | Thanks for the insights on vEncrypt and the 8-character limit of VNC passwords. sean-k-mooney. we have a specific "Session Hijacking" concern. When a legitimate user requests a console URL, logs into the Guest OS, and then someone else copies that exact URL (with the token) to another browser/machine, they find themselves already logged into the session without needing any credentials. | |
| 13:12:59 | gokhan | Is there a way to enforce "One-Time Use" for console tokens, so that once a WebSocket connection is established, the token becomes invalid for any subsequent connection attempts? | |
| 13:13:05 | sean-k-mooney | gokhan: so the mitigation for that is intened to be using ssl | |
| 13:13:30 | sean-k-mooney | i.e. so that the console token cannot eb intersepted over the wire | |
| 13:13:45 | sean-k-mooney | if your worred about client side hijacts in the browser then that diffent | |
| 13:13:54 | sean-k-mooney | and now we do not have the consept of one time use tokens | |
| 13:14:49 | sean-k-mooney | one time use tokes woudl break browser reresh or when you pop the console out into its own tab in horizong but it could eb something we consider supportign eventually | |
| 13:15:31 | sean-k-mooney | it would not be soemthign we could enabel by default IMO based on the end user ux regression it woudl bring | |
| 13:40:59 | opendevreview | sean mooney proposed openstack/os-vif master: Add TAP device pre-creation support for OVS/OVN https://review.opendev.org/c/openstack/os-vif/+/971231 | |
| 14:48:50 | tkajinam | stephenfin, hi do you mind voting +2+A to https://review.opendev.org/c/openstack/osc-placement/+/970058 again ? | |
| 14:49:13 | tkajinam | previous review scores were wiped when I fixed that depends-on link ... | |
| 14:59:49 | tkajinam | stephenfin, oh, gibi++ already approved it :-) | |
| 15:03:57 | opendevreview | Merged openstack/osc-placement master: Add Python 3.13 functional tests https://review.opendev.org/c/openstack/osc-placement/+/970058 | |
| 15:39:25 | gokhan | token if they originate from a different Source IP. | |
| 15:39:25 | gokhan | thanks sean-k-mooney I am worried about client side hijacks in the browser. Now I am considering a workaround at the Load Balancer (HAProxy) level to mitigate the risk of URL sharing/theft. I am trying to implement IP-to-Token Pinning" using HAProxy stick-tables. Catch the token parameter from the VNC URL.Store the Source IP of the first requester for that specific token in a stick-table. Reject (403 Forbidden) any subsequent requests for the same | |
| 16:07:51 | sean-k-mooney | gibi so for the os-vif init its implemnted here https://github.com/openstack/os-vif/blob/master/os_vif/__init__.py#L24-L49 which calls load on the plugin to regester the plugin config options but i dont see anythign that would cause the ovs conenction to be established | |
| 16:08:32 | sean-k-mooney | gibi: so that backgorund heatbeat to vos shodul not be established until the first time we call plug on a vif object that uses ovs | |
| 16:09:05 | sean-k-mooney | i.e. after the service is fully created so it shoudl not be a factor in the service creation workflow | |
| 16:10:58 | sean-k-mooney | i lazy load teh ovs db connection on first use here https://github.com/openstack/os-vif/blob/master/vif_plug_ovs/ovsdb/ovsdb_lib.py#L35-L44 | |
| 16:41:04 | gibi | sean-k-mooney: cool. thanks for checking it | |
| 17:10:30 | opendevreview | sean mooney proposed openstack/nova master: Support os-vif TAP pre-creation for OVS/OVN ports https://review.opendev.org/c/openstack/nova/+/973414 | |
| 17:11:55 | opendevreview | sean mooney proposed openstack/nova master: Support os-vif TAP pre-creation for OVS/OVN ports https://review.opendev.org/c/openstack/nova/+/973149 | |
| 17:14:41 | sean-k-mooney | ralonsoh: ^ should work with your chagnes now | |
| 17:15:04 | sean-k-mooney | ignore 973414 i abandoed that the change id got messed up | |
| 18:27:34 | ralonsoh | sean-k-mooney, I'll recheck the testing patch again | |
| 20:47:15 | opendevreview | sean mooney proposed openstack/nova master: FairLockGuard: Support cross-thread sharing and nesting https://review.opendev.org/c/openstack/nova/+/973438 | |
| 20:54:05 | gmaan | dansmith: melwitt: this is one cleanup for RBAC alias, please check whenever you have time. I just realized that it is still not merged https://review.opendev.org/c/openstack/nova/+/968410 | |
| 21:23:30 | opendevreview | Merged openstack/nova master: Upgrade note for concurrency mode default change https://review.opendev.org/c/openstack/nova/+/969888 | |
| #openstack-nova - 2026-01-15 | |||
| 05:31:15 | opendevreview | Merged openstack/nova master: api: Add response body schemas for limits API https://review.opendev.org/c/openstack/nova/+/956139 | |
| 10:45:59 | opendevreview | Bodo Petermann proposed openstack/os-vif master: Stabilize functional test https://review.opendev.org/c/openstack/os-vif/+/973455 | |
| 10:48:05 | opendevreview | Bodo Petermann proposed openstack/os-vif master: Stabilize functional test https://review.opendev.org/c/openstack/os-vif/+/973455 | |
| 12:39:05 | opendevreview | Balazs Gibizer proposed openstack/nova master: DNM:Test with oslo.vmware eventlet removal patches https://review.opendev.org/c/openstack/nova/+/967487 | |
| 12:42:20 | opendevreview | Balazs Gibizer proposed openstack/nova master: DNM:Test with oslo.vmware + compute eventlet removal patches https://review.opendev.org/c/openstack/nova/+/973468 | |
| 13:40:22 | opendevreview | Balazs Gibizer proposed openstack/nova master: Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 13:40:23 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-compute in native threading mode https://review.opendev.org/c/openstack/nova/+/965467 | |
| 13:40:23 | opendevreview | Balazs Gibizer proposed openstack/nova master: Libvirt event handling without eventlet https://review.opendev.org/c/openstack/nova/+/965949 | |
| 13:41:07 | gibi | gmaan: bauzas: ^^ I have fixed you review comments in Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 13:43:12 | sean-k-mooney | gibi: can you reivew https://review.opendev.org/c/openstack/os-vif/+/971231 and https://review.opendev.org/c/openstack/nova/+/973149 if you have time next week? its the os-vif and nova part of https://bugs.launchpad.net/neutron/+bug/2069718 basicly adressing live migratoin connectivy loss with ovn when ovn is over loaded by creatign the tap in pre-live migrate instead of | |
| 13:43:14 | sean-k-mooney | having libvirt do it durign migrate | |
| 13:44:39 | sean-k-mooney | its the live migration issue i menteion in the neutorn cross project session at the ptg ralonsoh is workign on the neutorn parts so we are hopign to resolve that this cycle | |
| 13:45:15 | ralonsoh | sean-k-mooney, btw, there is a testing patch (one sec) | |
| 13:45:37 | sean-k-mooney | one thing to not is i plan to add a second nova patch to bump the min os-vif version and enable this in ci that depends on the neturon patch. the current nova patch does not depend on the os-vif change or neutron one directly but it will use the fature if your version are new enouch | |
| 13:45:43 | ralonsoh | #link https://review.opendev.org/c/openstack/neutron/+/972820 | |
| 13:45:48 | sean-k-mooney | ralonsoh: yep i saw that passed last night | |
| 13:46:04 | ralonsoh | ^^ this patch is using all 4 related patches and it is passing | |
| 13:46:42 | sean-k-mooney | so the second nova ptch im goign to add is basiclly just goign to make sure we have this enabeld in one of our live migraiton jobs | |
| 13:46:57 | sean-k-mooney | we will leave it disable in the other so we cover both neutron configs | |
| 13:50:54 | sean-k-mooney | ralonsoh: regardign https://review.opendev.org/c/openstack/neutron/+/956910 im not sure stefan has time to activly work on that | |
| 13:51:16 | sean-k-mooney | so maybe it makes sense for oen of use ot update it for them | |
| 13:51:18 | ralonsoh | sean-k-mooney, I'll address all comments today | |
| 13:51:37 | ralonsoh | I'll take ownership of this patch | |
| 13:51:42 | sean-k-mooney | ack | |
| 13:52:04 | sean-k-mooney | that simplifes thigns as all patches are either owned by you or i then | |
| 13:53:35 | sean-k-mooney | upstream is this somethign you woudl want to backprot? its not really somethign i woudl typically backport upstream but its somethign we cna discuss once we have the final solution | |
| 13:54:12 | sean-k-mooney | downstream this is a little more reasonabel but still we can dicuss that seperately once all the patchs are complete | |
| 13:55:18 | ralonsoh | sean-k-mooney, not in U/S, for sure in D/S | |
| 13:55:56 | sean-k-mooney | ack | |
| 15:23:49 | jkulik | kj/cle | |
| 15:24:04 | jkulik | sorry. mistyped | |
| 16:03:43 | gmaan | gibi: ack | |
| 16:24:17 | gmaan | gibi: lgtm, but unit test failure is related, you need to fix one unit test for threading mode | |
| 16:26:59 | gmaan | I am wondering, how that test was passing on PS 14 ? there also max_worker were changed from 1000 to 5 | |
| 16:27:49 | gmaan | this is PS 14 result where it should have failed https://zuul.opendev.org/t/openstack/build/19d41e51d45a43aaa11ecf11bea7e6c7/log/job-output.txt#19666 | |
| 17:56:53 | opendevreview | sean mooney proposed openstack/nova master: FairLockGuard: Support cross-thread sharing and nesting https://review.opendev.org/c/openstack/nova/+/973438 | |
| 20:11:00 | opendevreview | Merged openstack/nova master: Migrate upper functional job to Python 3.13 https://review.opendev.org/c/openstack/nova/+/970011 | |
| #openstack-nova - 2026-01-16 | |||
| 03:05:37 | melwitt | in case anyone else runs into this, launchpad is currently down and is being worked on to fix: https://status.canonical.com | |
| 08:22:20 | amorin_ | hello team, we used to tune api-paste.ini in nova, neutron etc. to enable some custom middleware in our platform. I will have to perform the same on placement, but AFAICS placement is not using paste-deploy so that wont be possible. Do you have a rough idea on the best way to achieve similar thing in placement? | |