| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-07-08 | |||
| 17:27:18 | sean-k-mooney | we could perhaps replace the 7 bytes with 7k later to have an unaligend read test be a little fater but ya for now it should be fine | |
| 17:29:50 | sean-k-mooney | ok those are going to take a while to go though the gate so ill likely take this time to cook dinner and ill check back after | |
| 17:30:23 | dansmith | ++ | |
| 18:30:01 | dansmith | hmm, might have a requirements conflict: gabbi 3.0.0 depends on jsonpath-rw-ext>=1.0.0 | |
| 18:30:05 | dansmith | just failed in gate | |
| 18:34:31 | dansmith | okay might've just been the requirements change that was in front of it | |
| 18:34:48 | dansmith | that failed (with multiple issues) and the nova restart passed that point I think | |
| 18:40:50 | frickler | that sounds like pypi is having some issues | |
| 18:41:20 | dansmith | maybe | |
| 18:43:03 | clarkb | those sorts of failures can occur when we get served old indexes from pypi | |
| 18:48:11 | dansmith | okay the requirements patch wasn't changing either of those packages, and one other job on it failed in a different way (but the nova one failed the same way the nova patch behind it did) | |
| 18:56:43 | opendevreview | Merged openstack/nova master: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923507 | |
| 20:29:09 | opendevreview | Merged openstack/nova master: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923533 | |
| 20:32:54 | sean-k-mooney | sweet ^ ill start backporting those | |
| 20:45:39 | dansmith | \o/ | |
| #openstack-nova - 2024-07-09 | |||
| 00:18:54 | opendevreview | Merged openstack/nova master: Fix port group network metadata generation https://review.opendev.org/c/openstack/nova/+/923530 | |
| 00:26:12 | opendevreview | Mohammed Naser proposed openstack/nova stable/2024.1: Fix port group network metadata generation https://review.opendev.org/c/openstack/nova/+/923689 | |
| 03:27:25 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted backing files for qcow2 https://review.opendev.org/c/openstack/nova/+/907961 | |
| 03:27:25 | opendevreview | melanie witt proposed openstack/nova master: Support rescue with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/873675 | |
| 03:27:26 | opendevreview | melanie witt proposed openstack/nova master: Support snapshot with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870937 | |
| 03:27:26 | opendevreview | melanie witt proposed openstack/nova master: Support cross cell resize with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/909595 | |
| 03:27:27 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for raw with LUKS https://review.opendev.org/c/openstack/nova/+/884313 | |
| 03:27:27 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for rbd with LUKS https://review.opendev.org/c/openstack/nova/+/889912 | |
| 04:08:14 | opendevreview | Merged openstack/nova stable/2024.1: add functional repoducer for bug 2065927 https://review.opendev.org/c/openstack/nova/+/922950 | |
| 05:41:33 | opendevreview | Merged openstack/nova stable/2024.1: retry write_sys call on device busy https://review.opendev.org/c/openstack/nova/+/922984 | |
| 06:05:02 | opendevreview | melanie witt proposed openstack/nova master: Consolidate vTPM and ephemeral encryption secret creation https://review.opendev.org/c/openstack/nova/+/912094 | |
| 06:05:03 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Add optional 'description' kwarg to create_secret() https://review.opendev.org/c/openstack/nova/+/919986 | |
| 06:05:03 | opendevreview | melanie witt proposed openstack/nova master: Follow up for encryption secret create consolidation https://review.opendev.org/c/openstack/nova/+/921586 | |
| 06:05:04 | opendevreview | melanie witt proposed openstack/nova master: Remove use of (hw:|hw_)ephemeral_encryption_format https://review.opendev.org/c/openstack/nova/+/921343 | |
| 06:05:04 | opendevreview | melanie witt proposed openstack/nova master: Add EncryptDetails object for ephemeral encryption https://review.opendev.org/c/openstack/nova/+/921344 | |
| 06:05:05 | opendevreview | melanie witt proposed openstack/nova master: Add database migration to ALTER encryption_options https://review.opendev.org/c/openstack/nova/+/921587 | |
| 06:05:05 | opendevreview | melanie witt proposed openstack/nova master: Support create with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870932 | |
| 06:05:06 | opendevreview | melanie witt proposed openstack/nova master: Validate key manager create access in API https://review.opendev.org/c/openstack/nova/+/919989 | |
| 06:05:06 | opendevreview | melanie witt proposed openstack/nova master: Clean up unused ephemeral encryption libvirt secrets https://review.opendev.org/c/openstack/nova/+/919990 | |
| 06:05:08 | opendevreview | melanie witt proposed openstack/nova master: libvirt: "Auto heal" ephemeral encryption secrets on guest launch https://review.opendev.org/c/openstack/nova/+/919991 | |
| 06:05:08 | opendevreview | melanie witt proposed openstack/nova master: Support (resize|cold migration) with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870933 | |
| 06:05:10 | opendevreview | melanie witt proposed openstack/nova master: Support live migration with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/905512 | |
| 06:05:10 | opendevreview | melanie witt proposed openstack/nova master: Support rebuild with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870939 | |
| 06:05:12 | opendevreview | melanie witt proposed openstack/nova master: Add Glance standardized encryption image properties https://review.opendev.org/c/openstack/nova/+/921345 | |
| 06:05:12 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted source images for qcow2 https://review.opendev.org/c/openstack/nova/+/919992 | |
| 06:05:14 | opendevreview | melanie witt proposed openstack/nova master: Add encryption support to qemu-img rebase https://review.opendev.org/c/openstack/nova/+/870936 | |
| 06:05:14 | opendevreview | melanie witt proposed openstack/nova master: Add backing_encryption_secret_uuid to BlockDeviceMapping https://review.opendev.org/c/openstack/nova/+/907960 | |
| 06:05:16 | opendevreview | melanie witt proposed openstack/nova master: Support encrypted backing files for qcow2 https://review.opendev.org/c/openstack/nova/+/907961 | |
| 06:05:16 | opendevreview | melanie witt proposed openstack/nova master: Support rescue with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/873675 | |
| 06:05:18 | opendevreview | melanie witt proposed openstack/nova master: Support snapshot with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870937 | |
| 06:05:18 | opendevreview | melanie witt proposed openstack/nova master: Support cross cell resize with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/909595 | |
| 06:05:20 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for raw with LUKS https://review.opendev.org/c/openstack/nova/+/884313 | |
| 06:05:20 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Introduce support for rbd with LUKS https://review.opendev.org/c/openstack/nova/+/889912 | |
| 06:23:16 | opendevreview | Robert Hoffmann proposed openstack/nova master: Fix: clean up volume attachments https://review.opendev.org/c/openstack/nova/+/923646 | |
| 06:34:09 | opendevreview | Takashi Kajinami proposed openstack/nova master: Migrate MEM_ENCRYPTION_CONTEXT from root provider https://review.opendev.org/c/openstack/nova/+/921814 | |
| 08:17:58 | mikal | sean-k-mooney: I've been off sick for the last week and a half. I'll take a look at your review comments ASAP... | |
| 08:25:37 | sean-k-mooney | mikal: no worries we have a week and a half till spec freeze | |
| 08:26:14 | sean-k-mooney | im curently working on some backprot so my attention is else where at the moment | |
| 09:41:59 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923722 | |
| 09:42:00 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923723 | |
| 09:42:01 | opendevreview | sean mooney proposed openstack/nova stable/2024.1: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923724 | |
| 09:54:57 | mikal | sean-k-mooney: the bit I don't understand without reading more code (and perhaps you can short circuit that for me) is where we'd store the access token. So if nova provided the user with a token and the user took that token to kerbside, how does kerbside turn it back into a tcp host and port from nova? | |
| 09:55:34 | mikal | sean-k-mooney: I guess I am hoping there's some existing websocket proxy mechanism that can be reused instead of changing the database schema, but I haven't felt well enough to dig into it yet. | |
| 10:14:00 | sean-k-mooney | mikal: the token is stored in the cell db | |
| 10:14:31 | sean-k-mooney | so kerbside would call the console show api with the console token using a keyston token with the service role | |
| 10:14:47 | sean-k-mooney | and we would include the host specifc port/ip info in the responce | |
| 10:18:29 | mikal | sean-k-mooney: oh that would be nice if it avoids changing the mysql schema. I will dig into this ASAP. | |
| 10:18:30 | sean-k-mooney | mikal:i was basically hoping that https://docs.openstack.org/api-ref/compute/#show-console-connection-information would work for your usecase. | |
| 10:19:38 | sean-k-mooney | the main proablem i see with that today is 1.) ensuring it has the info you need, 2.) ensuring you can call it for the given teanta/project | |
| 10:19:50 | sean-k-mooney | normaly that api is called with a project scoped token | |
| 10:20:37 | sean-k-mooney | so what we might need is for the use to call kerbside with a project scoped token and for kerbside to call nova with the user provided keystone token + a service token to show the extra info | |
| 10:21:37 | sean-k-mooney | the user token will have the keystone project info allowing the api call to be scope to the correct project/tenant and the service user token (generated by kerbside) will grant access to any required hypervisor specific info | |
| 10:22:24 | sean-k-mooney | the console token(sepreate form the keystone token) acks a the lookup key | |
| 10:22:33 | sean-k-mooney | to pull the infor for the relevent instnace | |
| 10:22:58 | sean-k-mooney | i konw its kind of confusing to have 3 tokens at play but hopefully that makes sense | |
| 10:27:59 | mikal | sean-k-mooney: yeah, I think that makes sense. I don't know how to code it, but I am sure that's a learnable thing. | |
| 10:29:19 | sean-k-mooney | this is not the best example since its using keyston auth not the sdk but https://github.com/openstack/nova/blob/master/nova/service_auth.py | |
| 10:29:43 | sean-k-mooney | the service token is just an addtional header with a second keyston token | |
| 10:30:24 | sean-k-mooney | its orginal use was "trust be bro when the user called me the user token had not expired yet" | |
| 10:31:17 | sean-k-mooney | since then we have now intoduced the service role and a service token with that role denotes a call form a cloud infra level service | |
| 10:31:29 | sean-k-mooney | typeically another openstack service but in this case kerbside | |
| 10:33:42 | sean-k-mooney | so in theory all kerbside has to do is grab and reuse the users keyston token form the reques header, parse the console toke out of the url, generate a new keyston token form config with its own username/password ot use as the service token and call the get console endpoint | |
| 10:34:59 | sean-k-mooney | at which point nova internaly can lookup the hyperviors specific info and return it to kerbside and you can set up the proxy forwardign | |
| 10:35:41 | sean-k-mooney | im not sure that flow will work for your usecase but if it does it woudl be very similar to how the other proxies work | |
| 10:35:58 | sean-k-mooney | they just happen to have direct db access and can bypass the api call to get the hypervior info | |
| 10:37:33 | opendevreview | sean mooney proposed openstack/nova stable/2023.2: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923727 | |
| 10:37:34 | opendevreview | sean mooney proposed openstack/nova stable/2023.2: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923728 | |
| 10:37:35 | opendevreview | sean mooney proposed openstack/nova stable/2023.2: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923729 | |
| 10:38:38 | opendevreview | sean mooney proposed openstack/nova stable/2023.1: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923731 | |
| 10:38:39 | opendevreview | sean mooney proposed openstack/nova stable/2023.1: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923732 | |
| 10:38:40 | opendevreview | sean mooney proposed openstack/nova stable/2023.1: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923733 | |
| 10:42:11 | mikal | sean-k-mooney: I think that flow would work. I have to go put a kid to bed though, I will try and get some more done on this tomorrow. | |
| 10:44:34 | sean-k-mooney | mikal:ack hopefuly your feeling better, dont push your self too hard to get back into things o/ | |
| 10:44:59 | mikal | sean-k-mooney: although, does kerbside even need the user token? Surely possession of the console token itself is sufficient and then kerbside just uses it to lookup the specific connection details? The advantage of that is that SPICE clients just fetch a URL without understanding openstack at all, and bam they're in a console. | |
| 10:45:21 | sean-k-mooney | the user token is needed by nova to lookup thte console token currently | |
| 10:45:28 | mikal | sean-k-mooney: I am a bit worried about the approval deadline, but such is life. | |
| 10:45:29 | sean-k-mooney | its a project scoped api | |
| 10:45:41 | sean-k-mooney | we might be able to make it work without it | |
| 10:45:53 | sean-k-mooney | i m just not sure what the uniq constrait is on the console token | |
| 10:46:07 | mikal | sean-k-mooney: oh, that's a bit sad. It would be nice if that could be a token a service account could look up. | |
| 10:46:07 | sean-k-mooney | i.e. is it uniquce globaly, per project ectra | |
| 10:46:34 | sean-k-mooney | if its globally uniq we may be abell to just use the service token but im not sure on the exact code paths inovlved | |
| 10:46:35 | mikal | sean-k-mooney: I would hope this tokens are effectively large random numbers, but yeah I see the point. | |
| 10:46:47 | sean-k-mooney | i belive they are uuids | |
| 10:47:06 | sean-k-mooney | but ya we can check that and see what makes sense | |