Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-11-01
20:47:27 jroll if we do this all in castellan, we can make a castellan backend for our thing
20:47:32 efried ...yeah
20:47:35 jroll seems like the right thing to do anyway
20:47:57 efried right, iiuc nova requires whatever key manager to be brokered/brokerable through castellan.
20:48:07 jroll mhm
20:50:07 efried okay, so
20:50:07 efried - nova creates a new secret in $backend via castellan
20:50:07 efried - nova uses secret to virSecretSetValue to get $secret_uuid
20:50:07 efried - nova boots instance with <encryption secret='$secret_uuid'>
20:50:07 efried Now does the tpm show up to the VM user as virginal?
20:50:07 jroll efried: anything else I can help with?
20:50:22 jroll I assume just like a new TPM
20:50:24 jroll or hope?
20:50:34 efried And the VM user bootstraps the tpm with his own secret, which only he knows
20:50:40 jroll that is a question for a qemu or swtpm person, I guess
20:50:42 jroll right
20:51:07 efried so nova ("the nova user") has to be the root of trust
20:51:16 efried in this scenario
20:52:08 jroll I guess by some definition, yes
20:52:15 jroll it always comes down to the "hardware" supplier :)
20:52:18 efried because at any time "the nova user" could go grab that secret, decrypt the vtpm, and get at the VM user's secret
20:52:37 jroll right
20:52:47 efried okay, so "walk away with disk" is a requirement, but "compromised root" is not.
20:52:49 jroll assuming the nova user has the encrypted vtpm state
20:52:59 efried yeah, ability to read memory or whatever.
20:53:17 jroll yeah, I think that's something we just have to live with, in an emulated world
20:53:30 jroll if you've root on the hypervisor you can just go ahead and read the VM's memory anyway, right
20:53:42 efried I guess?
20:54:04 efried Okay, thanks for the talk jroll. If our assumptions are correct, I think I can work with this.
20:54:17 jroll efried: you're welcome, I hope they are correct :)
20:54:37 efried penick said he was going to get "security people" to vet things, but it would be a while before they were available.
20:54:58 jroll ¯\_(ツ)_/¯
20:55:00 efried I'll at least write up spec content under these assumptions, so that they can have something to point at and say it's wrong, rather than just a void.
20:55:07 jroll I forgot about this thing for the last couple months, until today
20:56:51 openstackgerrit Merged openstack/nova master: Switch to devstack-plugin-ceph-tempest-py3 for ceph https://review.opendev.org/691765
21:34:48 openstackgerrit Merged openstack/nova master: Avoid error 500 on shelve task_state race https://review.opendev.org/692206
21:38:33 openstackgerrit Matt Riedemann proposed openstack/nova master: Convert legacy nova-live-migration and nova-multinode-grenade to py3 https://review.opendev.org/692374
22:50:16 openstackgerrit Merged openstack/nova stable/train: Add regression test for bug 1824435 https://review.opendev.org/691402
22:50:16 openstack bug 1824435 in OpenStack Compute (nova) train "fill_virtual_interface_list migration fails on second attempt" [Medium,In progress] https://launchpad.net/bugs/1824435 - Assigned to melanie witt (melwitt)
22:50:20 openstackgerrit Merged openstack/nova stable/queens: libvirt: Ignore volume exceptions during post_live_migration https://review.opendev.org/691284
23:50:47 openstackgerrit Artom Lifshitz proposed openstack/nova stable/train: Avoid error 500 on shelve task_state race https://review.opendev.org/692628
#openstack-nova - 2019-11-02
00:09:38 openstackgerrit Merged openstack/nova master: Add new policy rule for viewing host status UNKNOWN https://review.opendev.org/679181
00:16:19 openstackgerrit Artom Lifshitz proposed openstack/nova stable/stein: Avoid error 500 on shelve task_state race https://review.opendev.org/692630
00:24:48 openstackgerrit Artom Lifshitz proposed openstack/nova stable/rocky: Avoid error 500 on shelve task_state race https://review.opendev.org/692631
00:30:29 openstackgerrit Artom Lifshitz proposed openstack/nova stable/queens: Avoid error 500 on shelve task_state race https://review.opendev.org/692632
01:19:44 openstackgerrit Merged openstack/nova master: Add Aggregate image caching progress notifications https://review.opendev.org/691390
02:34:33 henriqueof Can someone please help
02:35:05 henriqueof Just got various randon instance at paused energy state and can't get them back uop.
02:35:49 henriqueof Whenever I try to force reboot nova-comput logs just says : Instance is paused unexpectedly. Ignore.
02:51:37 henriqueof Joust found the reason, my storage went on emergency mode and locked any IO, looks like it is fixed now.
05:58:57 openstackgerrit Merged openstack/nova master: Nova compute: add in log exception to help debug failures https://review.opendev.org/669545
12:23:38 openstackgerrit Matt Riedemann proposed openstack/nova stable/train: Nova compute: add in log exception to help debug failures https://review.opendev.org/692662
17:10:54 openstackgerrit Merged openstack/nova stable/train: Remove redundant call to get/create default security group https://review.opendev.org/691403
20:53:32 openstackgerrit Matt Riedemann proposed openstack/nova stable/train: Nova compute: add in log exception to help debug failures https://review.opendev.org/692662
23:57:39 openstackgerrit Matt Riedemann proposed openstack/nova master: Add finish_snapshot_based_resize_at_dest compute method https://review.opendev.org/635080
23:57:39 openstackgerrit Matt Riedemann proposed openstack/nova master: Add FinishResizeAtDestTask https://review.opendev.org/635646
23:57:40 openstackgerrit Matt Riedemann proposed openstack/nova master: Execute CrossCellMigrationTask from MigrationTask https://review.opendev.org/635668
23:57:40 openstackgerrit Matt Riedemann proposed openstack/nova master: Plumb allow_cross_cell_resize into compute API resize() https://review.opendev.org/635684
23:57:41 openstackgerrit Matt Riedemann proposed openstack/nova master: Filter duplicates from compute API get_migrations_sorted() https://review.opendev.org/636224
23:57:42 openstackgerrit Matt Riedemann proposed openstack/nova master: Start functional testing for cross-cell resize https://review.opendev.org/636253
23:57:42 openstackgerrit Matt Riedemann proposed openstack/nova master: Handle target host cross-cell cold migration in conductor https://review.opendev.org/642591
23:57:43 openstackgerrit Matt Riedemann proposed openstack/nova master: Validate image/create during cross-cell resize functional testing https://review.opendev.org/642592
23:57:43 openstackgerrit Matt Riedemann proposed openstack/nova master: Add zones wrinkle to TestMultiCellMigrate https://review.opendev.org/643450
23:57:44 openstackgerrit Matt Riedemann proposed openstack/nova master: Add negative test for cross-cell finish_resize failing https://review.opendev.org/643451
23:57:44 openstackgerrit Matt Riedemann proposed openstack/nova master: Refresh instance in MigrationTask.execute Exception handler https://review.opendev.org/669012
23:57:45 openstackgerrit Matt Riedemann proposed openstack/nova master: Add negative test for prep_snapshot_based_resize_at_source failing https://review.opendev.org/669013
23:57:45 openstackgerrit Matt Riedemann proposed openstack/nova master: Add confirm_snapshot_based_resize_at_source compute method https://review.opendev.org/637058
23:57:46 openstackgerrit Matt Riedemann proposed openstack/nova master: Add ConfirmResizeTask https://review.opendev.org/637070
23:57:46 openstackgerrit Matt Riedemann proposed openstack/nova master: Add confirm_snapshot_based_resize conductor RPC method https://review.opendev.org/637075
23:57:47 openstackgerrit Matt Riedemann proposed openstack/nova master: Confirm cross-cell resize from the API https://review.opendev.org/637316
23:57:47 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: Add revert_snapshot_based_resize_at_dest compute method https://review.opendev.org/637630
23:57:48 openstackgerrit Matt Riedemann proposed openstack/nova master: Deal with cross-cell resize in _remove_deleted_instances_allocations https://review.opendev.org/639453
#openstack-nova - 2019-11-03
06:27:05 openstackgerrit OpenStack Proposal Bot proposed openstack/nova stable/stein: Imported Translations from Zanata https://review.opendev.org/692701
06:48:32 openstackgerrit Sundar Nadathur proposed openstack/nova master: ksa auth conf and client for Cyborg access https://review.opendev.org/631242
06:48:32 openstackgerrit Sundar Nadathur proposed openstack/nova master: Add Cyborg device profile groups to request spec. https://review.opendev.org/631243
06:48:33 openstackgerrit Sundar Nadathur proposed openstack/nova master: Create and bind Cyborg ARQs. https://review.opendev.org/631244
06:48:33 openstackgerrit Sundar Nadathur proposed openstack/nova master: Get resolved Cyborg ARQs and add PCI BDFs to VM's domain XML. https://review.opendev.org/631245
06:48:34 openstackgerrit Sundar Nadathur proposed openstack/nova master: Delete ARQs for an instance when the instance is deleted. https://review.opendev.org/673735
06:48:34 openstackgerrit Sundar Nadathur proposed openstack/nova master: Add cyborg tempest job. https://review.opendev.org/670999
06:48:35 openstackgerrit Sundar Nadathur proposed openstack/nova master: Define Cyborg ARQ binding notification event. https://review.opendev.org/692707
06:51:50 openstackgerrit OpenStack Proposal Bot proposed openstack/nova stable/train: Imported Translations from Zanata https://review.opendev.org/692710
14:08:27 openstackgerrit Liang Fang proposed openstack/nova-specs master: Support volume local cache https://review.opendev.org/689070
15:30:16 openstackgerrit Brin Zhang proposed openstack/nova-specs master: Add flavor group https://review.opendev.org/663563
15:56:14 openstackgerrit Lenny Verkhovsky proposed openstack/os-vif master: WIP: Testing CI https://review.opendev.org/686937
17:15:37 openstackgerrit Merged openstack/nova stable/train: Imported Translations from Zanata https://review.opendev.org/692710
17:16:48 openstackgerrit Matt Riedemann proposed openstack/nova master: Add archive_deleted_rows wrinkle to cross-cell functional test https://review.opendev.org/651650
17:16:48 openstackgerrit Matt Riedemann proposed openstack/nova master: Add CrossCellWeigher https://review.opendev.org/614353
17:16:49 openstackgerrit Matt Riedemann proposed openstack/nova master: Add functional test for anti-affinity cross-cell migration https://review.opendev.org/661859
17:16:49 openstackgerrit Matt Riedemann proposed openstack/nova master: Support cross-cell moves in external_instance_event https://review.opendev.org/658478
17:16:50 openstackgerrit Matt Riedemann proposed openstack/nova master: libvirt: flatten rbd image during cross-cell move spawn at dest https://review.opendev.org/691991
17:16:50 openstackgerrit Matt Riedemann proposed openstack/nova master: Add cross-cell resize policy rule and enable in API https://review.opendev.org/638269
17:16:51 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: Enable cross-cell resize in the nova-multi-cell job https://review.opendev.org/656656
17:16:51 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: Add negative test to delete server during cross-cell resize claim https://review.opendev.org/688832
#openstack-nova - 2019-11-04
01:25:58 gibi_ptg ~>
01:32:03 gibi_ptg stephenfin: hi! it would be nice to sync up about the nova project update today after 17:30
05:38:23 gibi_cn alex_xu: talked to stephenfin we will meet up at 14:00 in front of the Marketplace entrance
09:06:28 openstackgerrit Brin Zhang proposed openstack/nova-specs master: Add flavor group https://review.opendev.org/663563
11:52:52 openstackgerrit Merged openstack/nova stable/train: Avoid error 500 on shelve task_state race https://review.opendev.org/692628
13:54:26 mriedem dansmith: so back in rocky the aggregate mirroring stuff was added with a todo to remove some placement failures in the api if you didn't have the api configured for placement (to ease upgrades),
13:54:40 mriedem i'm removing that handling now but there is one thing that is bugging me on the remove case,

Earlier   Later