| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-07-08 | |||
| 16:20:23 | mnaser | well, elodilles did :) | |
| 16:25:14 | JayF | mnaser: feel free to add me as reviewer for any security backports in unmaintained/ that need additional review. | |
| 16:25:33 | JayF | mnaser: I have the one patch you've indicated opened in my window, will have a look | |
| 16:30:56 | JayF | Speaking of; mnaser has an important fix for the Ironic driver which will need to land in master + go back to Caracal, and is probably bad enough that I'd hope we could get it in a caracal point release: https://review.opendev.org/c/openstack/nova/+/923530 -- basically Ironic+Nova integrated environments with complex networking configurations will not have their metadata generated properly | |
| 16:33:08 | dansmith | JayF: +2d | |
| 16:33:30 | dansmith | looks simple enough, maybe gmann or melwitt could hit it for you | |
| 16:33:31 | JayF | dansmith: thank you very much \o/ (for this and for fixing the security issues over the last weeks) | |
| 16:36:21 | melwitt | +Wd | |
| 16:37:26 | JayF | awesome, I'll get a backport in once it lands | |
| 16:38:18 | JayF | I do have an item on my todo to follow up and make sure all those tests use iter([obj1,obj2]) to catch this kinda issue | |
| 17:19:47 | dansmith | sean-k-mooney: so the coverage job is still failing on your test_iso9660 | |
| 17:19:52 | dansmith | I don't really know why though | |
| 17:21:28 | dansmith | because it reads 10M 17 bytes at a time maybe? does it need to be that big? | |
| 17:23:13 | sean-k-mooney | didnt i fixt that already https://review.opendev.org/c/openstack/nova/+/923533/8/nova/tests/unit/image/test_format_inspector.py#211 | |
| 17:23:54 | sean-k-mooney | dansmith: https://review.opendev.org/c/openstack/nova/+/923507/3 still need a +w by the way | |
| 17:24:02 | sean-k-mooney | that why its not currently in the ci | |
| 17:24:28 | dansmith | oh yeah, I was looking at the wrong report | |
| 17:24:34 | dansmith | that's why duh | |
| 17:24:48 | dansmith | cool | |
| 17:24:57 | sean-k-mooney | but ya the 32KB system area makes it time out with 7 or 512 bytye blocks | |
| 17:25:02 | dansmith | I just changed to 128k locally and it works fine at that size, so no real need for it to be larger I think | |
| 17:25:10 | sean-k-mooney | btu the 64k and 1mb block size do it in a single read | |
| 17:25:41 | dansmith | but as long as it passes now all good, it's only temporary anyway | |
| 17:25:42 | sean-k-mooney | well its reading 34KB total so the 64K read size is enough | |
| 17:27:07 | dansmith | in the gate now | |
| 17:27:16 | dansmith | totes forgot about that repro patch below :D | |
| 17:27:18 | sean-k-mooney | we could perhaps replace the 7 bytes with 7k later to have an unaligend read test be a little fater but ya for now it should be fine | |
| 17:29:50 | sean-k-mooney | ok those are going to take a while to go though the gate so ill likely take this time to cook dinner and ill check back after | |
| 17:30:23 | dansmith | ++ | |
| 18:30:01 | dansmith | hmm, might have a requirements conflict: gabbi 3.0.0 depends on jsonpath-rw-ext>=1.0.0 | |
| 18:30:05 | dansmith | just failed in gate | |
| 18:34:31 | dansmith | okay might've just been the requirements change that was in front of it | |
| 18:34:48 | dansmith | that failed (with multiple issues) and the nova restart passed that point I think | |
| 18:40:50 | frickler | that sounds like pypi is having some issues | |
| 18:41:20 | dansmith | maybe | |
| 18:43:03 | clarkb | those sorts of failures can occur when we get served old indexes from pypi | |
| 18:48:11 | dansmith | okay the requirements patch wasn't changing either of those packages, and one other job on it failed in a different way (but the nova one failed the same way the nova patch behind it did) | |
| 18:56:43 | opendevreview | Merged openstack/nova master: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923507 | |
| 20:29:09 | opendevreview | Merged openstack/nova master: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923533 | |
| 20:32:54 | sean-k-mooney | sweet ^ ill start backporting those | |
| 20:45:39 | dansmith | \o/ | |
| #openstack-nova - 2024-07-09 | |||
| 00:18:54 | opendevreview | Merged openstack/nova master: Fix port group network metadata generation https://review.opendev.org/c/openstack/nova/+/923530 | |
| 00:26:12 | opendevreview | Mohammed Naser proposed openstack/nova stable/2024.1: Fix port group network metadata generation https://review.opendev.org/c/openstack/nova/+/923689 | |
| 03:27:25 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted backing files for qcow2 https://review.opendev.org/c/openstack/nova/+/907961 | |
| 03:27:25 | opendevreview | melanie witt proposed openstack/nova master: Support rescue with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/873675 | |
| 03:27:26 | opendevreview | melanie witt proposed openstack/nova master: Support snapshot with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870937 | |
| 03:27:26 | opendevreview | melanie witt proposed openstack/nova master: Support cross cell resize with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/909595 | |
| 03:27:27 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for raw with LUKS https://review.opendev.org/c/openstack/nova/+/884313 | |
| 03:27:27 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for rbd with LUKS https://review.opendev.org/c/openstack/nova/+/889912 | |
| 04:08:14 | opendevreview | Merged openstack/nova stable/2024.1: add functional repoducer for bug 2065927 https://review.opendev.org/c/openstack/nova/+/922950 | |
| 05:41:33 | opendevreview | Merged openstack/nova stable/2024.1: retry write_sys call on device busy https://review.opendev.org/c/openstack/nova/+/922984 | |
| 06:05:02 | opendevreview | melanie witt proposed openstack/nova master: Consolidate vTPM and ephemeral encryption secret creation https://review.opendev.org/c/openstack/nova/+/912094 | |
| 06:05:03 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Add optional 'description' kwarg to create_secret() https://review.opendev.org/c/openstack/nova/+/919986 | |
| 06:05:03 | opendevreview | melanie witt proposed openstack/nova master: Follow up for encryption secret create consolidation https://review.opendev.org/c/openstack/nova/+/921586 | |
| 06:05:04 | opendevreview | melanie witt proposed openstack/nova master: Remove use of (hw:|hw_)ephemeral_encryption_format https://review.opendev.org/c/openstack/nova/+/921343 | |
| 06:05:04 | opendevreview | melanie witt proposed openstack/nova master: Add EncryptDetails object for ephemeral encryption https://review.opendev.org/c/openstack/nova/+/921344 | |
| 06:05:05 | opendevreview | melanie witt proposed openstack/nova master: Add database migration to ALTER encryption_options https://review.opendev.org/c/openstack/nova/+/921587 | |
| 06:05:05 | opendevreview | melanie witt proposed openstack/nova master: Support create with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870932 | |
| 06:05:06 | opendevreview | melanie witt proposed openstack/nova master: Validate key manager create access in API https://review.opendev.org/c/openstack/nova/+/919989 | |
| 06:05:06 | opendevreview | melanie witt proposed openstack/nova master: Clean up unused ephemeral encryption libvirt secrets https://review.opendev.org/c/openstack/nova/+/919990 | |
| 06:05:08 | opendevreview | melanie witt proposed openstack/nova master: libvirt: "Auto heal" ephemeral encryption secrets on guest launch https://review.opendev.org/c/openstack/nova/+/919991 | |
| 06:05:08 | opendevreview | melanie witt proposed openstack/nova master: Support (resize|cold migration) with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870933 | |
| 06:05:10 | opendevreview | melanie witt proposed openstack/nova master: Support live migration with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/905512 | |
| 06:05:10 | opendevreview | melanie witt proposed openstack/nova master: Support rebuild with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870939 | |
| 06:05:12 | opendevreview | melanie witt proposed openstack/nova master: Add Glance standardized encryption image properties https://review.opendev.org/c/openstack/nova/+/921345 | |
| 06:05:12 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted source images for qcow2 https://review.opendev.org/c/openstack/nova/+/919992 | |
| 06:05:14 | opendevreview | melanie witt proposed openstack/nova master: Add encryption support to qemu-img rebase https://review.opendev.org/c/openstack/nova/+/870936 | |
| 06:05:14 | opendevreview | melanie witt proposed openstack/nova master: Add backing_encryption_secret_uuid to BlockDeviceMapping https://review.opendev.org/c/openstack/nova/+/907960 | |
| 06:05:16 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted backing files for qcow2 https://review.opendev.org/c/openstack/nova/+/907961 | |
| 06:05:16 | opendevreview | melanie witt proposed openstack/nova master: Support rescue with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/873675 | |
| 06:05:18 | opendevreview | melanie witt proposed openstack/nova master: Support snapshot with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870937 | |
| 06:05:18 | opendevreview | melanie witt proposed openstack/nova master: Support cross cell resize with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/909595 | |
| 06:05:20 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for raw with LUKS https://review.opendev.org/c/openstack/nova/+/884313 | |
| 06:05:20 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for rbd with LUKS https://review.opendev.org/c/openstack/nova/+/889912 | |
| 06:23:16 | opendevreview | Robert Hoffmann proposed openstack/nova master: Fix: clean up volume attachments https://review.opendev.org/c/openstack/nova/+/923646 | |
| 06:34:09 | opendevreview | Takashi Kajinami proposed openstack/nova master: Migrate MEM_ENCRYPTION_CONTEXT from root provider https://review.opendev.org/c/openstack/nova/+/921814 | |
| 08:17:58 | mikal | sean-k-mooney: I've been off sick for the last week and a half. I'll take a look at your review comments ASAP... | |
| 08:25:37 | sean-k-mooney | mikal: no worries we have a week and a half till spec freeze | |
| 08:26:14 | sean-k-mooney | im curently working on some backprot so my attention is else where at the moment | |
| 09:41:59 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923722 | |
| 09:42:00 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923723 | |
| 09:42:01 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923724 | |
| 09:54:57 | mikal | sean-k-mooney: the bit I don't understand without reading more code (and perhaps you can short circuit that for me) is where we'd store the access token. So if nova provided the user with a token and the user took that token to kerbside, how does kerbside turn it back into a tcp host and port from nova? | |
| 09:55:34 | mikal | sean-k-mooney: I guess I am hoping there's some existing websocket proxy mechanism that can be reused instead of changing the database schema, but I haven't felt well enough to dig into it yet. | |
| 10:14:00 | sean-k-mooney | mikal: the token is stored in the cell db | |
| 10:14:31 | sean-k-mooney | so kerbside would call the console show api with the console token using a keyston token with the service role | |
| 10:14:47 | sean-k-mooney | and we would include the host specifc port/ip info in the responce | |
| 10:18:29 | mikal | sean-k-mooney: oh that would be nice if it avoids changing the mysql schema. I will dig into this ASAP. | |
| 10:18:30 | sean-k-mooney | mikal:i was basically hoping that https://docs.openstack.org/api-ref/compute/#show-console-connection-information would work for your usecase. | |
| 10:19:38 | sean-k-mooney | the main proablem i see with that today is 1.) ensuring it has the info you need, 2.) ensuring you can call it for the given teanta/project | |
| 10:19:50 | sean-k-mooney | normaly that api is called with a project scoped token | |
| 10:20:37 | sean-k-mooney | so what we might need is for the use to call kerbside with a project scoped token and for kerbside to call nova with the user provided keystone token + a service token to show the extra info | |
| 10:21:37 | sean-k-mooney | the user token will have the keystone project info allowing the api call to be scope to the correct project/tenant and the service user token (generated by kerbside) will grant access to any required hypervisor specific info | |
| 10:22:24 | sean-k-mooney | the console token(sepreate form the keystone token) acks a the lookup key | |
| 10:22:33 | sean-k-mooney | to pull the infor for the relevent instnace | |
| 10:22:58 | sean-k-mooney | i konw its kind of confusing to have 3 tokens at play but hopefully that makes sense | |
| 10:27:59 | mikal | sean-k-mooney: yeah, I think that makes sense. I don't know how to code it, but I am sure that's a learnable thing. | |
| 10:29:19 | sean-k-mooney | this is not the best example since its using keyston auth not the sdk but https://github.com/openstack/nova/blob/master/nova/service_auth.py | |
| 10:29:43 | sean-k-mooney | the service token is just an addtional header with a second keyston token | |
| 10:30:24 | sean-k-mooney | its orginal use was "trust be bro when the user called me the user token had not expired yet" | |