| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-07-04 | |||
| 15:18:00 | gibi | I have to drop for the weekend but I have to go back to the bugfix to do the proper tests anyhow next week | |
| 15:18:12 | gibi | o/ | |
| 15:18:15 | sean-k-mooney | gibi: yep although if we chang this now we probaly shoudl add a workaroudn flag | |
| 15:18:22 | sean-k-mooney | gibi: o/ | |
| 15:19:54 | gmaan | sean-k-mooney: you asked me to remind about manager role series review, whenever you have time https://review.opendev.org/q/topic:%22bp/policy-manager-role-default%22+status:open | |
| 15:20:30 | gmaan | I migrated all existing migration (live and cold) tempest tests to use manager role, changes are linked in same topic | |
| 15:21:16 | gmaan | one tempest change adding abort/force complete test is in progress which I am working in parallel but those things are covered in nova side tests also but I just want to write tempest test also if we can | |
| 15:22:12 | sean-k-mooney | cool, im trying to start wrappign up for the week so i likely wont get to it till monday | |
| 15:22:58 | gmaan | no issue, thanks | |
| 15:23:40 | sean-k-mooney | https://review.opendev.org/c/openstack/tempest/+/953847/6/tempest/lib/api_schema/response/compute/v2_1/servers.py so we just didnt have tempest schema for that before? | |
| 15:24:14 | sean-k-mooney | i guess tempest never tested those api in the past then? | |
| 15:24:48 | sean-k-mooney | i feel like any test that try to use abort/force complete woudl eb racy | |
| 15:25:29 | sean-k-mooney | unless you plannig to add somthign to slow down the migration by creating memory load | |
| 15:25:43 | sean-k-mooney | btu even then that seam hard to properly test | |
| 15:26:35 | gmaan | yeah, we did not had tests/schema for list migration (in-progress live migration list), tempest has migration list (list all migration) schema though | |
| 15:27:27 | gmaan | yeah, I am trying in try block if migration is still going on then perform the force complet/abort | |
| 15:27:49 | gmaan | I know that is best we can test and log if test is not able to perform the operation | |
| 15:28:28 | gmaan | I am not 100% convince if that will help or make a good tempest test but in some cases it can perform the things it want | |
| 15:31:23 | gmaan | for abort, it is like if test able to perform the abort migration it pass otherwise skip test saying 'abort is not performed bcz migration was completed before that' | |
| 18:00:26 | opendevreview | Merged openstack/nova master: Replace utils.spawn_n with spawn https://review.opendev.org/c/openstack/nova/+/948076 | |
| #openstack-nova - 2025-07-05 | |||
| 08:24:41 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utf8 utility https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:28:17 | opendevreview | Takashi Kajinami proposed openstack/nova master: Use oslo.utils to escape IPv6 address https://review.opendev.org/c/openstack/nova/+/954175 | |
| 08:35:01 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utilities https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:35:59 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utilities https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:37:33 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utilities https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:39:58 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utilities https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:41:39 | opendevreview | Takashi Kajinami proposed openstack/nova master: Remove unused utilities https://review.opendev.org/c/openstack/nova/+/954174 | |
| 08:47:19 | opendevreview | Takashi Kajinami proposed openstack/nova master: Migrate ExceptionHelper to test utilities https://review.opendev.org/c/openstack/nova/+/954176 | |
| 08:47:57 | opendevreview | Takashi Kajinami proposed openstack/nova master: Migrate ExceptionHelper to test utilities https://review.opendev.org/c/openstack/nova/+/954176 | |
| 11:13:03 | opendevreview | Takashi Kajinami proposed openstack/nova master: Use oslo.utils to escape IPv6 address https://review.opendev.org/c/openstack/nova/+/954175 | |
| 11:31:54 | opendevreview | Takashi Kajinami proposed openstack/nova master: Use oslo.utils to escape IPv6 address https://review.opendev.org/c/openstack/nova/+/954175 | |
| 13:05:39 | opendevreview | sean mooney proposed openstack/nova master: [DNM] testing py3.13 eventlet bug workaround https://review.opendev.org/c/openstack/nova/+/951749 | |
| #openstack-nova - 2025-07-06 | |||
| 06:00:14 | opendevreview | sean mooney proposed openstack/nova master: [DNM] testing py3.13 eventlet bug workaround https://review.opendev.org/c/openstack/nova/+/951749 | |
| 06:17:44 | opendevreview | sean mooney proposed openstack/nova master: [DNM] testing py3.13 eventlet bug workaround https://review.opendev.org/c/openstack/nova/+/951749 | |
| 07:02:37 | opendevreview | sean mooney proposed openstack/nova master: [DNM] testing py3.13 eventlet bug workaround https://review.opendev.org/c/openstack/nova/+/951749 | |
| 20:20:38 | opendevreview | Michael Still proposed openstack/nova master: libvirt: Add objects and notifications for sound model. https://review.opendev.org/c/openstack/nova/+/926126 | |
| 20:20:39 | opendevreview | Michael Still proposed openstack/nova master: Implement sound model extra spec for libvirt. https://review.opendev.org/c/openstack/nova/+/940770 | |
| 20:20:39 | opendevreview | Michael Still proposed openstack/nova master: libvirt: Add objects and notifications for USB controller model. https://review.opendev.org/c/openstack/nova/+/927354 | |
| 20:20:40 | opendevreview | Michael Still proposed openstack/nova master: Implement USB controller extra spec for libvirt. https://review.opendev.org/c/openstack/nova/+/950643 | |
| #openstack-nova - 2025-07-07 | |||
| 01:39:49 | masahito | sean-k-mooney: late ack. Thanks. yes, I'm thinking to push the PoC code early as much as possible and trying to go the features in the early next cycle. | |
| 02:25:55 | mikal | Oh nice, because rebasing a patch series now involves adding a signed off header, it also invalidates all votes against that review, even if the code hasn't changed. | |
| 04:52:25 | opendevreview | Michael Still proposed openstack/nova master: libvirt: Add objects and notifications for sound model. https://review.opendev.org/c/openstack/nova/+/926126 | |
| 04:52:26 | opendevreview | Michael Still proposed openstack/nova master: Implement sound model extra spec for libvirt. https://review.opendev.org/c/openstack/nova/+/940770 | |
| 04:52:26 | opendevreview | Michael Still proposed openstack/nova master: libvirt: Add objects and notifications for USB controller model. https://review.opendev.org/c/openstack/nova/+/927354 | |
| 04:52:27 | opendevreview | Michael Still proposed openstack/nova master: Implement USB controller extra spec for libvirt. https://review.opendev.org/c/openstack/nova/+/950643 | |
| 07:53:01 | opendevreview | benlei proposed openstack/nova master: FIX: instance live migration failed after swap volume https://review.opendev.org/c/openstack/nova/+/954210 | |
| 11:12:09 | opendevreview | benlei proposed openstack/nova master: FIX: instance live migration failed after swap volume https://review.opendev.org/c/openstack/nova/+/954210 | |
| 14:43:39 | opendevreview | Kamil Sambor proposed openstack/nova master: Replace eventlet.event.Event with threading.Event https://review.opendev.org/c/openstack/nova/+/949754 | |
| 15:11:53 | opendevreview | Balazs Gibizer proposed openstack/nova master: [pci]Keep used dev in Placement regardless of dev_spec https://review.opendev.org/c/openstack/nova/+/954149 | |
| 15:50:00 | opendevreview | Rajesh Tailor proposed openstack/nova master: Clarify that [pci]device_spec={} matches all devices https://review.opendev.org/c/openstack/nova/+/954274 | |
| 18:01:05 | fungi | sean-k-mooney: https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/2069607 was finally switched to public on friday, and contains the rationale behind cloud-init's decision to break that functionality we were discussing | |
| 19:29:19 | sean-k-mooney | fungi: ack ill skim it but the problem is that even on x86_64 using dmi is not a correct way to determin if the openstack data souce shoudl be enabled | |
| 19:29:55 | mikal | How does AWS handle this given they use exactly the same IP mechanism (we copied from them)? | |
| 19:30:05 | sean-k-mooney | for it to be somethign they could rely on it would have to be somethign we suport for all virt driever includign ironic | |
| 19:30:25 | sean-k-mooney | mikal: it handeled by you confiruting the backedn in the image | |
| 19:30:35 | sean-k-mooney | you are ment ot have custom images per cloud | |
| 19:30:52 | sean-k-mooney | so the uec images are the amazon flavor | |
| 19:30:54 | mikal | Also, its not strictly true that someone can man in the middle that IP address, assuming they're actually on OpenStack. We intercept that traffic and special case it. | |
| 19:31:18 | sean-k-mooney | well the 169 address were chosen because those are not allowed to be routed | |
| 19:31:22 | fungi | yeah, where this presents a challenge is e.g. distros producing official bootable cloud images that are intended for use in multiple environments | |
| 19:31:51 | fungi | mikal: yes, the concern raised was booting a generic cloud image in a non-openstack environment | |
| 19:31:58 | sean-k-mooney | and since clouds are ment to prvode thing like ip/mac spoofing protection in general | |
| 19:32:09 | sean-k-mooney | spoofing that ip shoudl nto be possibel in general | |
| 19:32:10 | mikal | Honestly this seems like a pretty weak security concern to me. | |
| 19:32:49 | sean-k-mooney | fungi so wether someitng responce on that address is ment ot be how you determin if its ec2/openstack | |
| 19:33:07 | sean-k-mooney | you differecniate tbetween the two based on the reported filestyem in the metadtaa endpoint | |
| 19:33:09 | fungi | on non-x86 architectures cloud-init was assuming that the metadata addresses, if they replied, were trustworthy and not an attacker serving up backdoor userdata | |
| 19:33:22 | sean-k-mooney | fungi: it does that on x86 as well | |
| 19:33:46 | sean-k-mooney | the may have added some ectra condtional checks at some point | |
| 19:33:49 | fungi | but only if the dmi data indicates it's booted by nova (or ec2 i suppose?) | |
| 19:33:52 | mikal | Can't I make the same argument about DHCP? I just trust the first reply, that reply needs to not be malicious. | |
| 19:33:59 | sean-k-mooney | but ofrigally it woudl hit the ec2 endpoint even on openstack | |
| 19:34:46 | sean-k-mooney | fungi: not that im aware of. i think in older release if it was enabeld in the config it was used uncondtionally even on x86 | |
| 19:34:55 | fungi | mikal: yes, i think this is the same degree of risk as a rogue dhcp server, assuming the system is configured to also run arbitrary code at boot that the dhcp server points it to? (not sure, that could be a bit of a pathological situation) | |
| 19:35:41 | sean-k-mooney | but there are several other first boot systems like ignition and cloudbase init that use the same 169.254.169.254 or http://f8e0 well know adddreses | |
| 19:36:12 | fungi | right, i have no idea if cloud-init supports getting metadata from those | |
| 19:36:36 | mikal | Wouldn't it be better to spend any development effort here on something like TLS for the metadata service with certificate verification turned on, instead of changing a mechanism that no one has complained about in nearly 20 years? | |
| 19:37:16 | sean-k-mooney | i think they "fixed" it by just chaging thte default in the config to not enmebrate by defualt | |
| 19:37:26 | fungi | well, technically someone *did* complain about it, hence the bug report | |
| 19:37:27 | sean-k-mooney | but i woudl expect distor to override that | |
| 19:38:10 | fungi | yes, distros could override it, or they could just build separate ec2/openstack images and othercloud images | |
| 19:38:12 | sean-k-mooney | as it stands they will have broken metadata supprot for ironic by default. so if you dont enbale configdrive with yoru ironic instnace it wong be able to use metadata out of the box | |
| 19:38:47 | fungi | i have no idea if e.g. debian's or ubuntu's generic cloud images are used on ironic | |
| 19:39:01 | sean-k-mooney | i have used them before | |
| 19:39:04 | mikal | Building N cloud images is actually a fairly big hosting problem I imagine. That's a fair bit of repeated data just for a very minor problem. | |
| 19:39:07 | sean-k-mooney | but it depend on yoru hardware | |
| 19:39:09 | fungi | seems like you'd want a more full-featured image with broader hardware support? | |
| 19:39:16 | fungi | yeah | |
| 19:39:18 | sean-k-mooney | somethime they dont have the drivers requried soemtimes they do | |
| 19:39:48 | sean-k-mooney | its been a long time since i tried but i think i used diskimage builder with the cloud image as a base to build one | |
| 19:40:19 | sean-k-mooney | cloud image doen nto mean qemu/kvm or vm based | |
| 19:40:21 | fungi | debian not including ahci support in the generic cloud kernels because "most" cloud providers (amazon/azure/google) is a good example of why i'd be skeptical of using such images in ironic for bare metal | |
| 19:40:31 | mikal | DIB definitely uses the various cloud images as the base for builds. | |
| 19:40:48 | sean-k-mooney | mikal: it can/does btu it can replace the kernel ectra | |
| 19:41:11 | mikal | sean-k-mooney: yeah, package installs etc etc. | |
| 19:41:23 | fungi | mmm, these days the dib elements we're using start from docker images instead, though previously we used elements that bootstrapped from scratch with tools like debootstrap | |
| 19:41:28 | mikal | This is how the SF "official" images are built. DIB with the SF agent sprinkled in.' | |
| 19:42:07 | sean-k-mooney | fungi: when did we move the ubuntu ones | |
| 19:42:09 | fungi | but yes, i think dib does have some non-"minimal" elements that instead modify cloud images with virsh tools | |
| 19:42:17 | sean-k-mooney | because they used to use the cloud image until relitivly recently | |