| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-01-14 | |||
| 13:13:05 | sean-k-mooney | gokhan: so the mitigation for that is intened to be using ssl | |
| 13:13:30 | sean-k-mooney | i.e. so that the console token cannot eb intersepted over the wire | |
| 13:13:45 | sean-k-mooney | if your worred about client side hijacts in the browser then that diffent | |
| 13:13:54 | sean-k-mooney | and now we do not have the consept of one time use tokens | |
| 13:14:49 | sean-k-mooney | one time use tokes woudl break browser reresh or when you pop the console out into its own tab in horizong but it could eb something we consider supportign eventually | |
| 13:15:31 | sean-k-mooney | it would not be soemthign we could enabel by default IMO based on the end user ux regression it woudl bring | |
| 13:40:59 | opendevreview | sean mooney proposed openstack/os-vif master: Add TAP device pre-creation support for OVS/OVN https://review.opendev.org/c/openstack/os-vif/+/971231 | |
| 14:48:50 | tkajinam | stephenfin, hi do you mind voting +2+A to https://review.opendev.org/c/openstack/osc-placement/+/970058 again ? | |
| 14:49:13 | tkajinam | previous review scores were wiped when I fixed that depends-on link ... | |
| 14:59:49 | tkajinam | stephenfin, oh, gibi++ already approved it :-) | |
| 15:03:57 | opendevreview | Merged openstack/osc-placement master: Add Python 3.13 functional tests https://review.opendev.org/c/openstack/osc-placement/+/970058 | |
| 15:39:25 | gokhan | token if they originate from a different Source IP. | |
| 15:39:25 | gokhan | thanks sean-k-mooney I am worried about client side hijacks in the browser. Now I am considering a workaround at the Load Balancer (HAProxy) level to mitigate the risk of URL sharing/theft. I am trying to implement IP-to-Token Pinning" using HAProxy stick-tables. Catch the token parameter from the VNC URL.Store the Source IP of the first requester for that specific token in a stick-table. Reject (403 Forbidden) any subsequent requests for the same | |
| 16:07:51 | sean-k-mooney | gibi so for the os-vif init its implemnted here https://github.com/openstack/os-vif/blob/master/os_vif/__init__.py#L24-L49 which calls load on the plugin to regester the plugin config options but i dont see anythign that would cause the ovs conenction to be established | |
| 16:08:32 | sean-k-mooney | gibi: so that backgorund heatbeat to vos shodul not be established until the first time we call plug on a vif object that uses ovs | |
| 16:09:05 | sean-k-mooney | i.e. after the service is fully created so it shoudl not be a factor in the service creation workflow | |
| 16:10:58 | sean-k-mooney | i lazy load teh ovs db connection on first use here https://github.com/openstack/os-vif/blob/master/vif_plug_ovs/ovsdb/ovsdb_lib.py#L35-L44 | |
| 16:41:04 | gibi | sean-k-mooney: cool. thanks for checking it | |
| 17:10:30 | opendevreview | sean mooney proposed openstack/nova master: Support os-vif TAP pre-creation for OVS/OVN ports https://review.opendev.org/c/openstack/nova/+/973414 | |
| 17:11:55 | opendevreview | sean mooney proposed openstack/nova master: Support os-vif TAP pre-creation for OVS/OVN ports https://review.opendev.org/c/openstack/nova/+/973149 | |
| 17:14:41 | sean-k-mooney | ralonsoh: ^ should work with your chagnes now | |
| 17:15:04 | sean-k-mooney | ignore 973414 i abandoed that the change id got messed up | |
| 18:27:34 | ralonsoh | sean-k-mooney, I'll recheck the testing patch again | |
| 20:47:15 | opendevreview | sean mooney proposed openstack/nova master: FairLockGuard: Support cross-thread sharing and nesting https://review.opendev.org/c/openstack/nova/+/973438 | |
| 20:54:05 | gmaan | dansmith: melwitt: this is one cleanup for RBAC alias, please check whenever you have time. I just realized that it is still not merged https://review.opendev.org/c/openstack/nova/+/968410 | |
| 21:23:30 | opendevreview | Merged openstack/nova master: Upgrade note for concurrency mode default change https://review.opendev.org/c/openstack/nova/+/969888 | |
| #openstack-nova - 2026-01-15 | |||
| 05:31:15 | opendevreview | Merged openstack/nova master: api: Add response body schemas for limits API https://review.opendev.org/c/openstack/nova/+/956139 | |
| 10:45:59 | opendevreview | Bodo Petermann proposed openstack/os-vif master: Stabilize functional test https://review.opendev.org/c/openstack/os-vif/+/973455 | |
| 10:48:05 | opendevreview | Bodo Petermann proposed openstack/os-vif master: Stabilize functional test https://review.opendev.org/c/openstack/os-vif/+/973455 | |
| 12:39:05 | opendevreview | Balazs Gibizer proposed openstack/nova master: DNM:Test with oslo.vmware eventlet removal patches https://review.opendev.org/c/openstack/nova/+/967487 | |
| 12:42:20 | opendevreview | Balazs Gibizer proposed openstack/nova master: DNM:Test with oslo.vmware + compute eventlet removal patches https://review.opendev.org/c/openstack/nova/+/973468 | |
| 13:40:22 | opendevreview | Balazs Gibizer proposed openstack/nova master: Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 13:40:23 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-compute in native threading mode https://review.opendev.org/c/openstack/nova/+/965467 | |
| 13:40:23 | opendevreview | Balazs Gibizer proposed openstack/nova master: Libvirt event handling without eventlet https://review.opendev.org/c/openstack/nova/+/965949 | |
| 13:41:07 | gibi | gmaan: bauzas: ^^ I have fixed you review comments in Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 13:43:12 | sean-k-mooney | gibi: can you reivew https://review.opendev.org/c/openstack/os-vif/+/971231 and https://review.opendev.org/c/openstack/nova/+/973149 if you have time next week? its the os-vif and nova part of https://bugs.launchpad.net/neutron/+bug/2069718 basicly adressing live migratoin connectivy loss with ovn when ovn is over loaded by creatign the tap in pre-live migrate instead of | |
| 13:43:14 | sean-k-mooney | having libvirt do it durign migrate | |
| 13:44:39 | sean-k-mooney | its the live migration issue i menteion in the neutorn cross project session at the ptg ralonsoh is workign on the neutorn parts so we are hopign to resolve that this cycle | |
| 13:45:15 | ralonsoh | sean-k-mooney, btw, there is a testing patch (one sec) | |
| 13:45:37 | sean-k-mooney | one thing to not is i plan to add a second nova patch to bump the min os-vif version and enable this in ci that depends on the neturon patch. the current nova patch does not depend on the os-vif change or neutron one directly but it will use the fature if your version are new enouch | |
| 13:45:43 | ralonsoh | #link https://review.opendev.org/c/openstack/neutron/+/972820 | |
| 13:45:48 | sean-k-mooney | ralonsoh: yep i saw that passed last night | |
| 13:46:04 | ralonsoh | ^^ this patch is using all 4 related patches and it is passing | |
| 13:46:42 | sean-k-mooney | so the second nova ptch im goign to add is basiclly just goign to make sure we have this enabeld in one of our live migraiton jobs | |
| 13:46:57 | sean-k-mooney | we will leave it disable in the other so we cover both neutron configs | |
| 13:50:54 | sean-k-mooney | ralonsoh: regardign https://review.opendev.org/c/openstack/neutron/+/956910 im not sure stefan has time to activly work on that | |
| 13:51:16 | sean-k-mooney | so maybe it makes sense for oen of use ot update it for them | |
| 13:51:18 | ralonsoh | sean-k-mooney, I'll address all comments today | |
| 13:51:37 | ralonsoh | I'll take ownership of this patch | |
| 13:51:42 | sean-k-mooney | ack | |
| 13:52:04 | sean-k-mooney | that simplifes thigns as all patches are either owned by you or i then | |
| 13:53:35 | sean-k-mooney | upstream is this somethign you woudl want to backprot? its not really somethign i woudl typically backport upstream but its somethign we cna discuss once we have the final solution | |
| 13:54:12 | sean-k-mooney | downstream this is a little more reasonabel but still we can dicuss that seperately once all the patchs are complete | |
| 13:55:18 | ralonsoh | sean-k-mooney, not in U/S, for sure in D/S | |
| 13:55:56 | sean-k-mooney | ack | |
| 15:23:49 | jkulik | kj/cle | |
| 15:24:04 | jkulik | sorry. mistyped | |
| 16:03:43 | gmaan | gibi: ack | |
| 16:24:17 | gmaan | gibi: lgtm, but unit test failure is related, you need to fix one unit test for threading mode | |
| 16:26:59 | gmaan | I am wondering, how that test was passing on PS 14 ? there also max_worker were changed from 1000 to 5 | |
| 16:27:49 | gmaan | this is PS 14 result where it should have failed https://zuul.opendev.org/t/openstack/build/19d41e51d45a43aaa11ecf11bea7e6c7/log/job-output.txt#19666 | |
| 17:56:53 | opendevreview | sean mooney proposed openstack/nova master: FairLockGuard: Support cross-thread sharing and nesting https://review.opendev.org/c/openstack/nova/+/973438 | |
| 20:11:00 | opendevreview | Merged openstack/nova master: Migrate upper functional job to Python 3.13 https://review.opendev.org/c/openstack/nova/+/970011 | |
| #openstack-nova - 2026-01-16 | |||
| 03:05:37 | melwitt | in case anyone else runs into this, launchpad is currently down and is being worked on to fix: https://status.canonical.com | |
| 08:22:20 | amorin_ | hello team, we used to tune api-paste.ini in nova, neutron etc. to enable some custom middleware in our platform. I will have to perform the same on placement, but AFAICS placement is not using paste-deploy so that wont be possible. Do you have a rough idea on the best way to achieve similar thing in placement? | |
| 08:29:33 | jkulik | amorin: iirc, you'd have to change the code. afaics, all middleware get loaded here: https://github.com/openstack/placement/blob/5e61583504c4911ac862e1d0f2d7eb79e37066d0/placement/deploy.py#L89-L117 | |
| 08:31:05 | amorin | oh nice! | |
| 08:31:26 | amorin | thank you for the hint | |
| 08:32:46 | gibi | amorin: agree with jkulik, unfortunately placement has no configurable way to add a middleware. I think it is a valid feature request if you want to change it | |
| 08:36:03 | gibi | gmaan: I explained why PS14 was not affected but 15 is affected by that unit test failure. I will respin and fix it today https://review.opendev.org/c/openstack/nova/+/966016/15#message-5e9654d20672cf2d1cbacf6d015cfecd9de5333e | |
| 08:44:36 | opendevreview | Balazs Gibizer proposed openstack/nova master: Libvirt event handling without eventlet https://review.opendev.org/c/openstack/nova/+/965949 | |
| 08:44:36 | opendevreview | Balazs Gibizer proposed openstack/nova master: Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 08:44:37 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-compute in native threading mode https://review.opendev.org/c/openstack/nova/+/965467 | |
| 08:47:51 | opendevreview | Balazs Gibizer proposed openstack/nova master: Libvirt event handling without eventlet https://review.opendev.org/c/openstack/nova/+/965949 | |
| 08:47:51 | opendevreview | Balazs Gibizer proposed openstack/nova master: Compute manager to use thread pools selectively https://review.opendev.org/c/openstack/nova/+/966016 | |
| 08:47:52 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-compute in native threading mode https://review.opendev.org/c/openstack/nova/+/965467 | |
| 09:26:33 | amorin | thank you gibi | |
| 11:07:20 | sean-k-mooney | gibi: so on paste deploy in general its not really maintianed anymore so there has been dicssion about what we will eventually replace ti with. teh way api-paste.ini works is slightly problemtaic in that no other repalcement really supprot that kind of configuablity so one of the propasl was to remove midelware customeisation entirly or implemen a subset of it in oslo.wsgi, | |
| 11:07:22 | sean-k-mooney | that the is the new oslo project stephenfin was proposing to hlep project move. | |
| 11:07:58 | sean-k-mooney | quite a few project like placement and watcher never supproted middleware customisation so adding sopport for that today kind fo feels like addign supprot for eventlet to a project | |
| 11:08:23 | sean-k-mooney | in its current form it woudl be adding technial debt that we may not be able to maintian in the long term | |
| 11:09:23 | sean-k-mooney | so it could be a posibel feature but its not one i woudl rush to implement unit we have a long term plan for what to do with the paste/past-deploy stack | |
| 11:10:58 | sean-k-mooney | one of the suggestion i hasd was ot replace it with an oslo.config list of midelware isntead in the service .conf file or similar but i dont know if there is any concreate propals in genarl beyond the mailing list dicussion that stpehn started last year | |
| 11:15:58 | gibi | sean-k-mooney: note that I did not advocated directly for paste.ini but just for configurable middleware. I'm fine selecting a tool that is futureproof for that. | |
| 11:17:09 | sean-k-mooney | ack. its not exacty hard to implent a parser for paste.ini to supprot that as well in general | |
| 11:17:46 | sean-k-mooney | just pointing out that there is technial debt in that area so commmiting to supproting past.ini in a project is less tirvial then it would be if it was activly maintianed | |
| 11:19:12 | gibi | ack, I still think that configurable middleware is a valid feature request for placement, while I agree that we should not implement it via paste.ini as in nova due to valid maintainability concerns you raised | |
| 11:25:22 | sean-k-mooney | the oauth midelwayre that had the cve is not enabled in nova sdefault piple lien is it? | |
| 11:25:41 | sean-k-mooney | i dont see it in https://github.com/openstack/nova/blob/master/etc/nova/api-paste.ini although i dont really know what i should be lookign for | |
| 11:27:44 | sean-k-mooney | placement presumable does not use ExternalAuth2Protocol either? | |
| 11:28:06 | sean-k-mooney | well external_oauth2_token | |
| 11:30:45 | sean-k-mooney | https://bugs.launchpad.net/keystonemiddleware/+bug/2129018/comments/35 | |
| 11:31:05 | sean-k-mooney | gibi: https://bugs.launchpad.net/keystonemiddleware/+bug/2129018 is the tacker for it | |
| 11:31:18 | sean-k-mooney | it went public this week | |
| 11:32:49 | sean-k-mooney | based on zigo's comment would have to configure nova to accpate oauth2 tokens in the first place to enable the vulnerbale middlware | |
| 11:32:52 | sean-k-mooney | [pipeline:main] | |
| 11:32:54 | sean-k-mooney | pipeline = ext_oauth2_token | |
| 11:32:56 | sean-k-mooney | [filter:ext_oauth2_token] | |
| 11:32:58 | sean-k-mooney | paste.filter_factory = keystonemiddleware.external_oauth2_token:filter_factory | |
| 11:33:24 | sean-k-mooney | if that is correct the placment and watcher would nto be affected sicnce they are using hard coded midellware adn we dont config that o my knowlaage | |