| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-07-02 | |||
| 12:22:39 | gibi | stephenfin: ack, that is a bummer but the I agree to deprecate | |
| 12:23:14 | fungi | mikal: can you expand on what "config drive was meant to be gone by now" means? is there a better metadata source that doesn't depend on flaky/inconsistent networking or hard-coded addresses? see also the latest cloud-init security fix where using configdrive is literally the recommendation for non-x86 guests now | |
| 12:24:24 | fungi | the reason we use configdrive with glean is because network-supplied metadata has been pretty terrible in lots of clouds | |
| 12:24:26 | gibi | brace for impact... | |
| 12:24:31 | opendevreview | Balazs Gibizer proposed openstack/nova master: Add spawn_on https://review.opendev.org/c/openstack/nova/+/948079 | |
| 12:24:32 | opendevreview | Balazs Gibizer proposed openstack/nova master: Move ComputeManager to use spawn_on https://review.opendev.org/c/openstack/nova/+/948186 | |
| 12:24:32 | opendevreview | Balazs Gibizer proposed openstack/nova master: Move ConductorManager to use spawn_on https://review.opendev.org/c/openstack/nova/+/948187 | |
| 12:24:33 | opendevreview | Balazs Gibizer proposed openstack/nova master: Make nova.utils.pass_context private https://review.opendev.org/c/openstack/nova/+/948188 | |
| 12:24:33 | opendevreview | Balazs Gibizer proposed openstack/nova master: Rename DEFAULT_GREEN_POOL to DEFAULT_EXECUTOR https://review.opendev.org/c/openstack/nova/+/948086 | |
| 12:24:34 | opendevreview | Balazs Gibizer proposed openstack/nova master: Make the default executor configurable https://review.opendev.org/c/openstack/nova/+/948087 | |
| 12:24:34 | opendevreview | Balazs Gibizer proposed openstack/nova master: Print ThreadPool statistics https://review.opendev.org/c/openstack/nova/+/948340 | |
| 12:24:35 | opendevreview | Balazs Gibizer proposed openstack/nova master: Document native threading mode and tuneables https://review.opendev.org/c/openstack/nova/+/949364 | |
| 12:24:35 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow services to start with threading https://review.opendev.org/c/openstack/nova/+/948311 | |
| 12:24:37 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-next with n-sch in threading mode https://review.opendev.org/c/openstack/nova/+/948450 | |
| 12:24:37 | opendevreview | Balazs Gibizer proposed openstack/nova master: Do not yield in threading mode https://review.opendev.org/c/openstack/nova/+/950994 | |
| 12:24:39 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow to start unit test without eventlet https://review.opendev.org/c/openstack/nova/+/953436 | |
| 12:24:39 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run unit test with threading mode https://review.opendev.org/c/openstack/nova/+/953475 | |
| 12:24:41 | opendevreview | Balazs Gibizer proposed openstack/nova master: [test]RPC using threading or eventlet selectively https://review.opendev.org/c/openstack/nova/+/953815 | |
| 12:33:18 | opendevreview | Balazs Gibizer proposed openstack/nova master: Do not yield in threading mode https://review.opendev.org/c/openstack/nova/+/950994 | |
| 12:33:19 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-api and -metadata in threaded mode https://review.opendev.org/c/openstack/nova/+/951957 | |
| 12:33:19 | opendevreview | Balazs Gibizer proposed openstack/nova master: Warn on long task wait time for executor https://review.opendev.org/c/openstack/nova/+/952666 | |
| 12:34:39 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow to start unit test without eventlet https://review.opendev.org/c/openstack/nova/+/953436 | |
| 12:34:39 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run unit test with threading mode https://review.opendev.org/c/openstack/nova/+/953475 | |
| 12:34:40 | opendevreview | Balazs Gibizer proposed openstack/nova master: [test]RPC using threading or eventlet selectively https://review.opendev.org/c/openstack/nova/+/953815 | |
| 12:34:48 | gibi | now sign-offs in place :) | |
| 12:38:22 | opendevreview | Kamil Sambor proposed openstack/nova master: Replace eventlet.event.Event with threading.Event https://review.opendev.org/c/openstack/nova/+/949754 | |
| 12:47:26 | sean-k-mooney | fungi: there was discssion in the past to remove it a very long time ago, the reason we have kep it is for things like ironic or where you need to use metadata form the config drive to confirgure networkign before you can actully call the metadata api | |
| 12:48:01 | sean-k-mooney | there are also envionment where the metadta api is not deployed | |
| 12:48:44 | sean-k-mooney | or where its in accapble in specific neutron network toplogies like whne you are booted directly to an external network and you are not using ovn or dhcp | |
| 12:49:23 | fungi | yeah, and also (at least currently) no means for the host to signal the location of a network metadata source with non-x86 platforms | |
| 12:49:51 | sean-k-mooney | how does x86 factor into this? | |
| 12:50:41 | fungi | sean-k-mooney: https://bugs.debian.org/1108403 | |
| 12:50:43 | sean-k-mooney | is there someting arm or power speciic that woud prevent it doing dhcp adn using the well know adress? | |
| 12:51:33 | sean-k-mooney | ok so that not really nova related its a bug in cloud-init | |
| 12:51:52 | sean-k-mooney | glean or other first boot agenst are not nessiarly impacted right | |
| 12:52:01 | fungi | i have lost access to the more verbose explanation in the (still private) lp bug about how qemu passes information from host to guest that is x86-specific | |
| 12:52:48 | sean-k-mooney | ok but the point is qemu is not ment ot be passign info form the host to the guest in general. config dirve is a way to do that | |
| 12:53:40 | fungi | nova is able to indicate the address of the metadata server through a host-to-guest communication channel when it's x86 platform, but not on other platforms, so cloud-init had a workaround where it just assumed a specific linklocal address, but this was a security problem if booting on other cloud platforms | |
| 12:54:42 | sean-k-mooney | we dont do that however | |
| 12:55:03 | fungi | whatever trick qemu provides for that signalling is specific to emulated x86 systems | |
| 12:55:24 | sean-k-mooney | so im not aware of the mechisim yoru refering too | |
| 12:55:28 | fungi | so cloud-init queries that when run in x86 guests | |
| 12:55:47 | sean-k-mooney | the metaddat discover is ment to be to a hardcoded ip adress in cloud-init or to the defautl gateway as a fall back | |
| 12:56:01 | fungi | really wish they weren't continuing to keep that bug private after referring to it in the commit message of a public security fix | |
| 12:56:20 | sean-k-mooney | to be clear lookign at https://github.com/canonical/cloud-init/commit/f43937f0b462734eb9c76700491c18fe4133c8e1 | |
| 12:56:26 | sean-k-mooney | im not even sure that shoudl be a cve | |
| 12:56:56 | sean-k-mooney | but in any case cloud init will use the ec2 well knwo adress in an openstack env | |
| 12:57:19 | sean-k-mooney | so that would apply equally to that | |
| 12:57:39 | fungi | yeah, my understanding is that they're dropping that functionality with the commit there | |
| 12:58:00 | sean-k-mooney | tahts a major brakign change | |
| 12:58:09 | fungi | because they considered it a security risk if you ran cloud-init in an environment where some other bad actor on a shared network was able to spoof that well-known address | |
| 12:58:21 | fungi | yes, it's a breaking change | |
| 12:58:36 | sean-k-mooney | not that the dmi interface they are now relaying on | |
| 12:58:46 | sean-k-mooney | is not part of nova api contract to the guest runtime | |
| 12:58:56 | sean-k-mooney | its an internal impelmation detail of the livbirt driver | |
| 12:59:01 | fungi | ah, yes, dmi was how they were saying it worked for x86 guests, so they kept that | |
| 12:59:17 | sean-k-mooney | ya so that is not a thing for ironic vmware hyperv ectra | |
| 12:59:21 | fungi | and recommend that any other architectures now rely on configdrive | |
| 12:59:32 | sean-k-mooney | so that is not somthign they can use to detect if its oepnstack | |
| 12:59:59 | sean-k-mooney | it will work for libvirt with qemu but its not genrelaly correct to do | |
| 13:00:28 | fungi | right, all the rationale and debate as to available options is still locked up in a private lp bug | |
| 13:02:24 | sean-k-mooney | so to me the behaivor it hasd to reach out to the link local adress was the correct behavior and not a security issue | |
| 13:02:50 | sean-k-mooney | you can disable datasouce via the cloud init config in yoru image if you wanted too | |
| 13:05:22 | sean-k-mooney | im not ok with https://review.opendev.org/c/openstack/nova/+/953732 by the way | |
| 13:05:51 | sean-k-mooney | fungi: i guess that is why that was being rasised earlier in the week | |
| 13:41:44 | sean-k-mooney | fungi: by the way the dmi info when it is provided to vms is also configuabel via the downstream distobution https://github.com/openstack/nova/blob/2c19c07d5e29ca5445fa6dd45a6117542951714c/nova/version.py#L49-L63 | |
| 13:44:28 | sean-k-mooney | i dont hink we have used this historically downstream | |
| 13:44:37 | sean-k-mooney | but its a thing that can be configured | |
| 13:47:44 | gibi | I'm sorry there was a botched rebased in the bottom of the series... | |
| 13:47:53 | opendevreview | Balazs Gibizer proposed openstack/nova master: Use futurist for _get_default_green_pool() https://review.opendev.org/c/openstack/nova/+/948072 | |
| 13:47:54 | opendevreview | Balazs Gibizer proposed openstack/nova master: Replace utils.spawn_n with spawn https://review.opendev.org/c/openstack/nova/+/948076 | |
| 13:47:54 | opendevreview | Balazs Gibizer proposed openstack/nova master: Add spawn_on https://review.opendev.org/c/openstack/nova/+/948079 | |
| 13:47:55 | opendevreview | Balazs Gibizer proposed openstack/nova master: Move ComputeManager to use spawn_on https://review.opendev.org/c/openstack/nova/+/948186 | |
| 13:47:55 | opendevreview | Balazs Gibizer proposed openstack/nova master: Move ConductorManager to use spawn_on https://review.opendev.org/c/openstack/nova/+/948187 | |
| 13:47:56 | opendevreview | Balazs Gibizer proposed openstack/nova master: Make nova.utils.pass_context private https://review.opendev.org/c/openstack/nova/+/948188 | |
| 13:47:56 | opendevreview | Balazs Gibizer proposed openstack/nova master: Rename DEFAULT_GREEN_POOL to DEFAULT_EXECUTOR https://review.opendev.org/c/openstack/nova/+/948086 | |
| 13:47:57 | opendevreview | Balazs Gibizer proposed openstack/nova master: Make the default executor configurable https://review.opendev.org/c/openstack/nova/+/948087 | |
| 13:47:57 | opendevreview | Balazs Gibizer proposed openstack/nova master: Print ThreadPool statistics https://review.opendev.org/c/openstack/nova/+/948340 | |
| 13:47:59 | opendevreview | Balazs Gibizer proposed openstack/nova master: Document native threading mode and tuneables https://review.opendev.org/c/openstack/nova/+/949364 | |
| 13:47:59 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow services to start with threading https://review.opendev.org/c/openstack/nova/+/948311 | |
| 13:48:01 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-next with n-sch in threading mode https://review.opendev.org/c/openstack/nova/+/948450 | |
| 13:48:01 | opendevreview | Balazs Gibizer proposed openstack/nova master: Do not yield in threading mode https://review.opendev.org/c/openstack/nova/+/950994 | |
| 13:48:03 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run nova-api and -metadata in threaded mode https://review.opendev.org/c/openstack/nova/+/951957 | |
| 13:48:03 | opendevreview | Balazs Gibizer proposed openstack/nova master: Warn on long task wait time for executor https://review.opendev.org/c/openstack/nova/+/952666 | |
| 13:48:05 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow to start unit test without eventlet https://review.opendev.org/c/openstack/nova/+/953436 | |
| 13:48:05 | opendevreview | Balazs Gibizer proposed openstack/nova master: Run unit test with threading mode https://review.opendev.org/c/openstack/nova/+/953475 | |
| 13:48:07 | opendevreview | Balazs Gibizer proposed openstack/nova master: [test]RPC using threading or eventlet selectively https://review.opendev.org/c/openstack/nova/+/953815 | |
| 13:49:53 | opendevreview | Balazs Gibizer proposed openstack/nova master: FUP: Translate scatter-gather to futurist https://review.opendev.org/c/openstack/nova/+/953338 | |
| 14:31:14 | opendevreview | Kamil Sambor proposed openstack/nova master: Replace eventlet.event.Event with threading.Event https://review.opendev.org/c/openstack/nova/+/949754 | |
| 14:32:52 | gibi | eventlet sycn https://meet.google.com/bcy-uqoz-hje?authuser=0 | |
| 14:53:03 | fungi | sean-k-mooney: thanks, yeah revisiting my recollections of the original bug, it's that cloud-init is guessing whether it's booting in an openstack environment based on the dmi data, but that only works for qemu virtual machines on x86, so on e.g. arm cloud-init can't decide whether it's safe to assume the metadata source is legitimate or potentially spoofed by some attacker | |
| 14:53:05 | fungi | because it doesn't know whether it's in an openstack cloud | |
| 14:56:24 | sean-k-mooney | right but you can contol that by the cloud-init config in the guest when you build the image | |
| 14:56:39 | sean-k-mooney | adn the expect behiovr is to enumerate all data souces that are enabled in the image | |
| 14:57:02 | sean-k-mooney | so to me removign the enumeration is fundementaly breakign how this was inteded to work | |
| 14:57:15 | sean-k-mooney | no i think they are jsut chagnign there defaults in there config | |
| 14:57:19 | sean-k-mooney | rather then entirly removing it | |
| 14:58:21 | sean-k-mooney | i.e. if you expiclty customise an image and enable the openstack data souce adn upload it to glance | |
| 14:58:35 | sean-k-mooney | you can still use ti with vmware or lxc or ironic | |
| 15:01:14 | sean-k-mooney | i would not be surpised if some distros decide to revert back when buidling there cloud images | |