| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-05-13 | |||
| 17:06:01 | Uggla | Are you ok to do one more bug ? | |
| 17:06:49 | sean-k-mooney | sure | |
| 17:06:56 | Uggla | https://bugs.launchpad.net/nova/+bug/2103413 | |
| 17:07:17 | sean-k-mooney | that seams to be mostly the same thing? | |
| 17:07:53 | sean-k-mooney | wiat its exaclty the same bug | |
| 17:08:23 | sean-k-mooney | Uggla: did you mean to post a differnt url? | |
| 17:08:23 | gibi | then we are done :) | |
| 17:08:23 | Uggla | https://bugs.launchpad.net/nova/+bug/2103513 | |
| 17:08:39 | Uggla | sorry wrong copy pasta | |
| 17:09:05 | gibi | I have no clue about TLS spice | |
| 17:09:57 | sean-k-mooney | so i dont know if nova actully supprot this yet | |
| 17:10:13 | sean-k-mooney | i remember talking about this in the recent spci enabling | |
| 17:10:14 | Uggla | what it is on dalmatian | |
| 17:10:32 | sean-k-mooney | right but im not sure if that is expected to work even on master | |
| 17:10:38 | Uggla | oh | |
| 17:10:46 | sean-k-mooney | it might | |
| 17:10:56 | sean-k-mooney | but i dont belilve we have tempest testing of it currently | |
| 17:11:08 | sean-k-mooney | we only recnetly readded spice testing last cycle | |
| 17:11:16 | sean-k-mooney | after not having any tempest testing with it for years | |
| 17:11:29 | sean-k-mooney | lets loop back to this again next week | |
| 17:11:52 | sean-k-mooney | and maybe ask mikal about it | |
| 17:12:02 | Uggla | ok that sounds good. | |
| 17:12:33 | Uggla | At least I can right a comment about it. | |
| 17:12:44 | Uggla | that's all for today. | |
| 17:13:18 | sean-k-mooney | https://review.opendev.org/c/openstack/nova/+/922544 | |
| 17:13:47 | sean-k-mooney | ok in theory that was added in dalmation | |
| 17:13:55 | sean-k-mooney | but perhaps only when usign kerbside | |
| 17:14:05 | sean-k-mooney | in anycase we can wrap for today | |
| 17:14:25 | Uggla | Thanks all and thanks for the extended time for bug triage. | |
| 17:14:33 | Uggla | #endmeeting | |
| 17:14:33 | opendevmeet | Meeting ended Tue May 13 17:14:33 2025 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | |
| 17:14:33 | opendevmeet | Minutes: https://meetings.opendev.org/meetings/nova/2025/nova.2025-05-13-16.01.html | |
| 17:14:33 | opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/nova/2025/nova.2025-05-13-16.01.txt | |
| 17:14:33 | opendevmeet | Log: https://meetings.opendev.org/meetings/nova/2025/nova.2025-05-13-16.01.log.html | |
| 17:14:39 | gibi | Uggla: thanks | |
| 17:14:50 | masahito | thanks | |
| 17:15:09 | Uggla | you are welcome | |
| 17:16:55 | Uggla | Fyi I will fill the tickets tomorrow morning. I need to afk now to feed the family. | |
| 18:39:56 | opendevreview | Merged openstack/nova master: Replace eventlet semaphores with threading one https://review.opendev.org/c/openstack/nova/+/948437 | |
| 18:40:09 | opendevreview | Merged openstack/nova master: [hacking] N373 do not use eventlet primitives https://review.opendev.org/c/openstack/nova/+/947265 | |
| 20:02:52 | opendevreview | Dan Smith proposed openstack/nova master: Example NVMe cleaning script for one-time-use https://review.opendev.org/c/openstack/nova/+/948446 | |
| #openstack-nova - 2025-05-14 | |||
| 06:41:42 | opendevreview | Merged openstack/nova master: Example NVMe cleaning script for one-time-use https://review.opendev.org/c/openstack/nova/+/948446 | |
| 07:47:38 | Luzi | hi, is someone still working on the AMD SEV-ES patches? https://review.opendev.org/q/topic:bp/amd-sev-es-libvirt-support | |
| 07:49:43 | Luzi | tkajinam, have you implemented this? | |
| 08:25:15 | schwicke | About the vGPU discussion yesterday: Last year, we got hands on some 4x H100 NVIDIA GPUs, and I finally managed to rework our patch at CERN for Nova (still on Yoga, sorry). | |
| 08:27:04 | schwicke | It now allows to configure each of the 4 cards in a single server differently with MIG while in the old days all cards had to have the same setup. | |
| 08:27:12 | schwicke | Happy to share if people are interested. | |
| 08:56:23 | opendevreview | ribaudr proposed openstack/nova master: Mention IRC topic update in PTL post-PTG checklist https://review.opendev.org/c/openstack/nova/+/949711 | |
| 09:05:38 | mikal | sean-k-mooney: thanks for the hints on doing an os-traits release. Who do I need to ask to review https://review.opendev.org/c/openstack/releases/+/949710 ? | |
| 09:25:14 | Luzi | hi, is someone still working on the AMD SEV-ES patches? https://review.opendev.org/q/topic:bp/amd-sev-es-libvirt-support | |
| 09:44:57 | stephenfin | mikal: that would be Uggla as PTL | |
| 09:45:12 | stephenfin | (and sorry, I missed your ping yesterday but glad you got to the bottom of it) | |
| 09:46:54 | Uggla | mikal, cool I'll have a look and check if it's ok. | |
| 09:48:08 | Uggla | mikal, btw we checked this but yesterday any feedback about it ? https://bugs.launchpad.net/nova/+bug/2103513 | |
| 09:56:46 | mikal | Uggla: I replied to that bug earlier today... I am no javascript developer, but I can't see any evidence that the HTML5 SPICE client supports TLS. It would be possible to do, but I can't imagine anyone wants to do it. | |
| 09:57:18 | mikal | So my recommendation would be people using the HTML5 client not enable require_secure. | |
| 10:04:14 | Uggla | mikal, thx for updating the bug. I understand the issue is not a nova one, more something about HTML5 SPICE client (spice-html5). Am i correct ? | |
| 10:07:09 | mikal | Yes. The SPICE HTML5 client is quite old and doesn't seem particularly maintained. It does not appear to support TLS as best as I can tell. | |
| 10:08:36 | Uggla | ok cool so I can deal with the triage of this bug. Thx for your help mikal. | |
| 10:08:41 | Uggla | mikal++ | |
| 10:09:50 | Uggla | To all, I have updated the ttps://etherpad.opendev.org/p/nova-2025.2-status document. All known specs for Flamingo should be referred. If you see something wrong please let me know. | |
| 10:10:14 | Uggla | https://etherpad.opendev.org/p/nova-2025.2-status | |
| 10:11:31 | mikal | Uggla: no worries. Let me know if I can help somehow, as long as that isn't re-writing the JavaScript client. ;) | |
| 10:12:48 | Uggla | Just for my knowledge is the spice client (not html) is using encryption ? | |
| 10:13:25 | mikal | Uggla: yes. Remote viewer for example if it connects on the unencrypted port is automatically redirected to the encrypted port if TLS is turned on. | |
| 10:13:40 | mikal | One sec, fiddling with my client... | |
| 10:16:55 | mikal | Uggla: so yeah, there are a few moving parts with SPICE. It goes a bit like this... Before I came along, all SPICE connections to VMs were unencrypted. This continues to work if you don't turn require_secure on. The HTML5 client appears to only support unencrypted connections because old. | |
| 10:17:36 | mikal | Uggla: If require_secure is enabled, then connections to the encrypted TCP port for a given VM still work, but are greeted with a message redirecting to the encrypted port. IIRC that message doesn't actually say what the unencrypted port number is though. | |
| 10:18:23 | mikal | Uggla: normally that configuration (which TCP ports to use) is part of the .vv configuration the client used to connect. Kerbside generates that on the fly to map things to the right ports, although its a little more complicated than that because its doing some proxying and back to back TLS as well. | |
| 10:19:04 | mikal | Uggla: people don't have to use Kerbside, but if they don't want to expose TCP ports on their hypervisors to random users, they do need to use either Kerbside or something like it. | |
| 10:19:35 | mikal | Uggla: I am unaware of any other such proxy apart from oVirt's haproxy setup, which is a lot more terrible than Kerbside (although likely more performant given its not written in python). | |
| 10:20:56 | mikal | Uggla: honestly this is all a bit of a moving target right now. I am still in the process of building all this out, although it does actually work in my lab environment right now. I have prototype deployment patches for Kolla-Ansible, but I haven't proposed them upstream yet. They are in the kerbside-patches repo on github though. | |
| 10:21:37 | mikal | Uggla: but anyways, let me know if I can be helpful somehow, although noting that I live in an unfashionable timezone. | |
| 10:26:32 | Uggla | mikal, cool thanks for the info. +1 | |
| 10:30:50 | sean-k-mooney | mikal: you more or less got your anser but tis the ptl or release liason | |
| 10:31:04 | sean-k-mooney | those are listed in the release repo too | |
| 10:31:32 | sean-k-mooney | actully the liasons might be in the governace repo | |
| 10:32:33 | sean-k-mooney | no release repo https://github.com/openstack/releases/blob/master/data/release_liaisons.yaml | |
| 10:32:48 | sean-k-mooney | mikal: if your ever wondering who can do a release you can check ^ | |
| 10:33:26 | sean-k-mooney | bauzas: would you mind reviewing https://review.opendev.org/c/openstack/releases/+/949710 for mikal once your online | |
| 10:37:17 | mikal | sean-k-mooney: thanks for the pointers yet again | |
| 10:41:11 | opendevreview | Serhii Ivanov proposed openstack/nova-specs master: Proposes `Add Graceful Nova Compute Shutdown` https://review.opendev.org/c/openstack/nova-specs/+/937185 | |
| 11:11:18 | Luzi | hi, is someone still working on the AMD SEV-ES patches? https://review.opendev.org/q/topic:bp/amd-sev-es-libvirt-support | |
| 11:12:00 | gibi | Luzi: I think takashi has the intention but you should check with him | |
| 11:12:24 | Luzi | thank you gibi | |
| 11:13:47 | gibi | tkajinam ^^ | |
| 11:33:43 | stephenfin | sean-k-mooney: gmaan: Could we set aside a day in the next 2-3 weeks to buzz through those openapi patches, while things are _relatively_ quiet? | |
| 11:35:17 | sean-k-mooney | ill try perhaps the 27th ill try to do it before m2 | |
| 11:35:30 | sean-k-mooney | if i find time before then ill do oen or two reviews | |
| 11:36:17 | stephenfin | ack | |
| 12:35:02 | sean-k-mooney | by the way this https://review.opendev.org/q/topic:%22update-precommit%22 is my series to update our use of precommit. it start with just updatign the version to get 3.13 supprot in autopep8 then i have soem refinment to oru exsitng hook and added some new ones. the final patch add bandit to do some security scanning and i reviewd and adress all the medium and high issues | |
| 12:35:04 | sean-k-mooney | found | |
| 12:36:29 | sean-k-mooney | i have tired ot keep each patch fairly small and self contained but some changes are partly down to taste so feedback is welcome | |
| 12:40:20 | gibi | sean-k-mooney: I'm +2 all over it. Thanks | |
| 12:43:36 | opendevreview | Lajos Katona proposed openstack/os-vif master: OVS Trunk: Add bridge_name to external_ids https://review.opendev.org/c/openstack/os-vif/+/949736 | |
| 13:05:18 | opendevreview | Balazs Gibizer proposed openstack/nova master: Translate scatter-gather to futurist https://review.opendev.org/c/openstack/nova/+/947966 | |
| 13:05:18 | opendevreview | Balazs Gibizer proposed openstack/nova master: Use futurist for _get_default_green_pool() https://review.opendev.org/c/openstack/nova/+/948072 | |
| 13:05:19 | opendevreview | Balazs Gibizer proposed openstack/nova master: Replace utils.spawn_n with spawn https://review.opendev.org/c/openstack/nova/+/948076 | |
| 13:05:19 | opendevreview | Balazs Gibizer proposed openstack/nova master: Add spawn_on https://review.opendev.org/c/openstack/nova/+/948079 | |
| 13:05:20 | opendevreview | Balazs Gibizer proposed openstack/nova master: Move ComputeManager to use spawn_on https://review.opendev.org/c/openstack/nova/+/948186 | |