| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-11-14 | |||
| 19:45:17 | mriedem | and we can ram it through | |
| 19:46:14 | efried | crlb To be sure you are modifying the same review, the Change-Id in the commit message needs to remain the same. If you run `git commit` with the `--amend` flag, it'll make sure you're staying on the same change set. Otherwise (without `--amend`) it'll create a new change on top of the previous one and you'll wind up with separate reviews. | |
| 19:48:15 | efried | crlb At this point I believe you'll want to squash these changes together, assuming they're going after the same thing. | |
| 20:12:06 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add security release note for OSSA-2017-005 https://review.openstack.org/519738 | |
| 20:12:15 | mriedem | sdague: dansmith: ^ if this looks ok, let's get it in and i'll do backports | |
| 20:21:31 | dansmith | mriedem: I dunno if that's common for a cve or not (to mention the cve but not describe it) | |
| 20:21:50 | mriedem | that's what the link is for | |
| 20:21:55 | dansmith | but if it is, it's cool with me | |
| 20:22:16 | dansmith | yeah, just seems sparse compared to what we'd normally do | |
| 20:22:23 | mriedem | let me find an old one | |
| 20:22:41 | mriedem | https://docs.openstack.org/releasenotes/nova/newton.html#security-issues | |
| 20:22:44 | dansmith | normally -> for a normal bug | |
| 20:23:06 | mriedem | https://docs.openstack.org/releasenotes/nova/newton.html#id15 | |
| 20:23:07 | dansmith | mriedem: even that example is more descriptive | |
| 20:23:18 | mriedem | ok i'll wordsmith this a bit | |
| 20:24:07 | dansmith | I don't care that much, I would just expect it to say "this includes a fix for cve 123, which could result in instances rebuilt with images not normally allowed on their host" or something | |
| 20:26:40 | openstackgerrit | Merged openstack/nova stable/pike: Correct log message when removing a security group https://review.openstack.org/519583 | |
| 20:27:01 | openstackgerrit | Merged openstack/nova master: Validate new image via scheduler during rebuild https://review.openstack.org/519662 | |
| 20:27:08 | openstackgerrit | Merged openstack/nova stable/pike: Validate new image via scheduler during rebuild https://review.openstack.org/519672 | |
| 20:27:15 | openstackgerrit | Merged openstack/nova master: Add FlavorPayload.description for versioned notifications https://review.openstack.org/514782 | |
| 20:27:20 | openstackgerrit | Merged openstack/nova stable/pike: Pick ironic nodes without VCPU set https://review.openstack.org/513678 | |
| 20:27:33 | openstackgerrit | Merged openstack/nova stable/ocata: Set group_members when converting to legacy request spec https://review.openstack.org/517860 | |
| 20:27:50 | openstackgerrit | Merged openstack/nova stable/ocata: Validate new image via scheduler during rebuild https://review.openstack.org/519681 | |
| 20:32:44 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add security release note for OSSA-2017-005 https://review.openstack.org/519738 | |
| 20:32:45 | mriedem | dansmith: ^ added more detail | |
| 20:33:22 | dansmith | mriedem: thanks | |
| 20:34:24 | mriedem | jaypipes: melwitt: can you hit https://review.openstack.org/#/c/519738/ so i can start backports? | |
| 20:34:47 | dansmith | mriedem: melwitt is out for a couple weeks, AFAIK | |
| 20:34:52 | mriedem | orly | |
| 20:34:59 | mriedem | plural? | |
| 20:35:07 | dansmith | this week and part of next week I think | |
| 20:35:10 | mriedem | ok | |
| 20:35:25 | dansmith | through Nov 20 | |
| 20:35:33 | mriedem | i'll give my jay and sean pings 5 more minutes and then i say we just approve | |
| 20:35:56 | dansmith | I can just fast approve. it's a reno. | |
| 20:35:58 | mriedem | ok | |
| 20:36:20 | mriedem | the fixes for newton are failing devstack, presumably because neutron is eol and things are just not going to work there anymore | |
| 20:37:13 | mriedem | if only we had LTS support... | |
| 20:37:34 | dansmith | um... | |
| 20:37:48 | mriedem | yeah, fudge, devstack in newton can't find stable/newton the branch, so it pip installs from master | |
| 20:37:55 | mriedem | farq | |
| 20:38:25 | dansmith | for nova? | |
| 20:38:33 | mriedem | no, devstack fails to setup | |
| 20:38:38 | mriedem | http://logs.openstack.org/19/516119/1/gate/legacy-tempest-dsvm-neutron-full/f24b24b/logs/devstacklog.txt.gz#_2017-11-14_17_24_29_768 | |
| 20:38:40 | mriedem | b/c newton is eol | |
| 20:39:06 | dansmith | that's because neutron's branch is gone right? | |
| 20:39:15 | dansmith | any one project deletes their branch and devstack stops working yes? | |
| 20:39:46 | mriedem | yes | |
| 20:39:52 | mriedem | well, anything we need for our base install | |
| 20:40:03 | dansmith | so that's what I meant by "for nova?" ... meaning "for which project?" | |
| 20:40:13 | mriedem | i could remove neutron from ENABLED_SERVICES but then nova just won't work, unless nova-net | |
| 20:40:25 | mriedem | which in newton works w/o cellsv1.... | |
| 20:40:26 | mriedem | :) | |
| 20:40:32 | mriedem | i think | |
| 20:40:44 | dansmith | or ask for the branch to be re-created based on the discussion at summit | |
| 20:40:54 | dansmith | mordred said it was easy to just resurrect that | |
| 20:41:07 | mriedem | it is, but then it would be EOL'ed next week ago | |
| 20:41:09 | mriedem | *again | |
| 20:41:39 | dansmith | or we start disabling jobs that don't work, per the discussion :) | |
| 20:41:40 | mordred | whatdididonow? | |
| 20:41:53 | mriedem | in this case it's easier probably to just disable the job | |
| 20:42:12 | mriedem | mordred: we have a cve fix for newton that can't pass the gate b/c dsvm jobs fail trying to install neutron, | |
| 20:42:15 | mriedem | because neutron newton is eol | |
| 20:42:19 | dansmith | mordred: we're trying to backport a cve fix to nova's newton branch and can't because neutron has eol'd theirs | |
| 20:42:39 | mordred | ah. yah. | |
| 20:43:26 | tonyb | mriedem: s/features/fixes/ on that backport is fine by me. | |
| 20:43:33 | mriedem | um, cinder newton must be eol too | |
| 20:43:37 | mriedem | http://logs.openstack.org/19/516119/1/gate/legacy-tempest-dsvm-cells/9e11a37/logs/devstacklog.txt.gz#_2017-11-14_17_21_45_400 | |
| 20:43:45 | tonyb | Oh rats :( | |
| 20:43:51 | mriedem | it is | |
| 20:43:53 | smcginnis | mriedem: Everyone is EOL on Newton I thought. | |
| 20:43:56 | mriedem | so yeah, dsvm just won't work on netwon | |
| 20:44:00 | mriedem | smcginnis: except nova | |
| 20:44:13 | smcginnis | mriedem: You snooze you lose. | |
| 20:44:15 | tonyb | Yeah everyone except nova, ironic and cycle-trainling | |
| 20:44:28 | mriedem | tonyb: ok so looking at https://review.openstack.org/#/c/516119/ | |
| 20:44:33 | dansmith | mriedem: the question comes up if we should even release newton if we never ran a devstack job against it | |
| 20:44:49 | mriedem | tonyb: i'd have to skip these jobs | |
| 20:44:51 | mriedem | legacy-tempest-dsvm-cellsFAILURE in 19m 44slegacy-tempest-dsvm-multinode-live-migrationFAILURE in 19m 43slegacy-tempest-dsvm-neutron-fullFAILURE in 18m 41s | |
| 20:44:53 | openstackgerrit | Merged openstack/nova stable/ocata: Correct log message when removing a security group https://review.openstack.org/519585 | |
| 20:45:15 | mriedem | dansmith: well this patch passed dsvm on 10/30 https://review.openstack.org/#/c/516119/ | |
| 20:45:56 | dansmith | mriedem: but you can't get a dsvm job run on the actual cve fix anymore right? | |
| 20:45:59 | mriedem | somehow https://review.openstack.org/#/c/519684/ did run legacy-tempest-dsvm-neutron-full earlier today | |
| 20:46:04 | mriedem | ^ did | |
| 20:46:44 | tonyb | mriedem: Yeah we only have 2 options patch devstack to work with eol-tags or accept the risk and drop the dsvm tests | |
| 20:47:14 | mriedem | i could try patching devstack, but it might be awhile | |
| 20:48:04 | dansmith | mriedem: hmm, how did that work? | |
| 20:48:07 | mriedem | dansmith: no idea | |
| 20:48:12 | mriedem | not sure if there are mirrors involved | |
| 20:48:25 | tonyb | I can also try to see how bad it is but not until after I've dropped the kids at school | |
| 20:48:32 | mriedem | ok, so i'm goign to get the reno backported for pike and ocata, then get the release requests up for those branches and will deal with newton | |
| 20:48:39 | mriedem | s/school/pool/ | |
| 20:48:56 | tonyb | ;P | |
| 20:50:11 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/pike: Add security release note for OSSA-2017-005 https://review.openstack.org/519752 | |
| 20:50:15 | tonyb | newton is xenial right? | |
| 20:50:45 | mriedem | yes | |
| 20:50:58 | tonyb | cool | |
| 20:51:41 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/ocata: Add security release note for OSSA-2017-005 https://review.openstack.org/519753 | |
| 20:55:07 | dansmith | mriedem: tonyb: +2 on the reno backports | |
| 20:55:12 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/newton: Pass requested_destination in filter_properties https://review.openstack.org/516119 | |