| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-07-30 | |||
| 01:03:19 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `host` secret security https://review.opendev.org/c/openstack/nova/+/941795 | |
| 01:03:19 | opendevreview | melanie witt proposed openstack/nova master: Add vtpm_secret_(uuid|value) to LiveMigrateData https://review.opendev.org/c/openstack/nova/+/952628 | |
| 01:03:20 | opendevreview | melanie witt proposed openstack/nova master: TPM: support live migration of `host` secret security https://review.opendev.org/c/openstack/nova/+/941483 | |
| 01:03:21 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `deployment` secret security https://review.opendev.org/c/openstack/nova/+/942021 | |
| 01:03:21 | opendevreview | melanie witt proposed openstack/nova master: TPM: support live migration of `deployment` secret security https://review.opendev.org/c/openstack/nova/+/925771 | |
| 01:03:23 | opendevreview | melanie witt proposed openstack/nova master: TPM: test live migration between hosts with different security https://review.opendev.org/c/openstack/nova/+/952629 | |
| 01:03:23 | opendevreview | melanie witt proposed openstack/nova master: TPM: update instance request_spec with secret security https://review.opendev.org/c/openstack/nova/+/952630 | |
| 01:03:25 | opendevreview | melanie witt proposed openstack/nova master: TPM: confirm secret security via hard reboot https://review.opendev.org/c/openstack/nova/+/955847 | |
| 01:12:59 | opendevreview | melanie witt proposed openstack/nova master: TPM: migrate legacy instances to new security policy https://review.opendev.org/c/openstack/nova/+/942501 | |
| 01:13:00 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `user` secret security https://review.opendev.org/c/openstack/nova/+/942502 | |
| 01:13:00 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `host` secret security https://review.opendev.org/c/openstack/nova/+/941795 | |
| 01:13:01 | opendevreview | melanie witt proposed openstack/nova master: Add vtpm_secret_(uuid|value) to LiveMigrateData https://review.opendev.org/c/openstack/nova/+/952628 | |
| 01:13:01 | opendevreview | melanie witt proposed openstack/nova master: TPM: support live migration of `host` secret security https://review.opendev.org/c/openstack/nova/+/941483 | |
| 01:13:02 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `deployment` secret security https://review.opendev.org/c/openstack/nova/+/942021 | |
| 01:13:02 | opendevreview | melanie witt proposed openstack/nova master: TPM: support live migration of `deployment` secret security https://review.opendev.org/c/openstack/nova/+/925771 | |
| 01:13:03 | opendevreview | melanie witt proposed openstack/nova master: TPM: test live migration between hosts with different security https://review.opendev.org/c/openstack/nova/+/952629 | |
| 01:13:03 | opendevreview | melanie witt proposed openstack/nova master: TPM: update instance request_spec with secret security https://review.opendev.org/c/openstack/nova/+/952630 | |
| 01:13:05 | opendevreview | melanie witt proposed openstack/nova master: TPM: confirm secret security via hard reboot https://review.opendev.org/c/openstack/nova/+/955847 | |
| 01:17:26 | sean-k-mooney | melwitt: im actully going to go to sleep now instead of saying i will and not but do you have tempest test for that and or a devstack config you can share. i dont think i have any locally with barbican but the rest is pretty simple. | |
| 01:17:33 | sean-k-mooney | oh you have whitebox https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/955969 | |
| 01:18:47 | melwitt | sean-k-mooney: yes whitebox so far but I'm thinking of writing up some plain tempest tests also. thanks :) | |
| 01:19:19 | sean-k-mooney | https://zuul.opendev.org/t/openstack/build/c0bce36dbd29472bb743b4e883d0dfc0/log/controller/logs/local_conf.txt i can prbably steal the bit i will need form ther | |
| 01:19:39 | sean-k-mooney | ack ya whitebox is nice but not strictly needed for this | |
| 01:20:08 | sean-k-mooney | its useful for checkign the libvirt secrete flags in the deployment one | |
| 01:20:25 | sean-k-mooney | but the base functionalty can be done in core tempest | |
| 01:21:16 | melwitt | yeah the main configs you need are swtpm_enabled = True and supported_tpm_secret_security = <list>. there is also default_tpm_secret_security = <string> that you specify if you want | |
| 01:21:42 | sean-k-mooney | that and deploying barbican :) | |
| 01:21:55 | melwitt | also with barbican, the thing to know is if you have enforce_new_defaults = False then you need the 'creator' role to create secrets | |
| 01:21:58 | sean-k-mooney | which is the main thing missing form my config i think btu the rest is useful | |
| 01:22:18 | melwitt | if you have enforce_new_defaults = True then being a project member is good enough for creating secrets | |
| 01:22:55 | sean-k-mooney | melwitt: so i need to deploy my 3 node devstack with watcher ot test some other stuff but ill add barbican to it when i do and then probly next week ill checkout your tpm serise and try and use it | |
| 01:23:22 | sean-k-mooney | the new defautl shoudl be the default now | |
| 01:23:32 | sean-k-mooney | so ya member shoudl be fine or admin i guess fo rthe migration | |
| 01:23:32 | melwitt | sean-k-mooney: that would be super :) thanks | |
| 01:23:51 | melwitt | yeah admin for live migration unless you change the policy | |
| 01:24:15 | melwitt | also in my experience barbican by default got deployed with enforce_new_defaults = False. dunno if it's a devstack thing or what | |
| 01:24:52 | sean-k-mooney | in the whitebox test can you check that the libvirt secret is defiend a snot epmeral or private | |
| 01:24:54 | sean-k-mooney | https://review.opendev.org/c/openstack/whitebox-tempest-plugin/+/955969/8/whitebox_tempest_plugin/api/compute/test_vtpm.py#198 | |
| 01:25:30 | sean-k-mooney | basicly for deployment you shoudl check that we its readable via virsh or just check the flag on the secret | |
| 01:25:59 | melwitt | yes I can add that. I have been wondering how to add more stuff to the tests | |
| 01:26:03 | melwitt | yeah I was thinking the xml | |
| 01:26:24 | sean-k-mooney | i think either is fine that the main thing that core tempest cant asssert | |
| 01:26:47 | sean-k-mooney | so that where whitebox can add coverage. i knwo we will have unit/functional tests too | |
| 01:26:48 | melwitt | yeah core tempest won't be able to | |
| 01:26:50 | sean-k-mooney | so im not that concerend | |
| 01:27:22 | sean-k-mooney | before i go, unrealted to live mgiration specificly | |
| 01:27:34 | sean-k-mooney | we may want to add some vtpm test ot show data is preserved | |
| 01:27:49 | sean-k-mooney | i.e. ssh into the vm and add somethign to the tpm | |
| 01:28:02 | sean-k-mooney | then live migrate it or hard reboot it and show its still there | |
| 01:28:10 | melwitt | that would be good if we can. I was thinking about that yesterday with regard to the reboot bug/launchpad | |
| 01:28:11 | sean-k-mooney | i dotn actuly know how to do that | |
| 01:28:28 | sean-k-mooney | i assume there is a tool for that but its probaly not in busy box | |
| 01:28:31 | melwitt | I don't either. will have to do some research | |
| 01:29:03 | sean-k-mooney | i dont knwo enought about tpms to know if there is a /sys interface that we can jsut echo too or something adn read back with cat | |
| 01:29:20 | sean-k-mooney | that woudl be the best option but future us problem | |
| 01:29:31 | melwitt | yeah. I hope it could be that easy | |
| 01:30:29 | gmaan | sean-k-mooney: for your tomorrow. did you get chance to look into manager role tests, stephenfin is +2 on that now, waiting for your review https://review.opendev.org/q/topic:%22bp/policy-manager-role-default%22+status:open | |
| 01:31:34 | sean-k-mooney | partly but that actully what im hoping to do in the morning. so all going well ill add +2w later tomorrow | |
| 01:31:46 | gmaan | thanks | |
| 01:31:48 | sean-k-mooney | i was happy with the production code i just did not fuly look at the test code before | |
| 01:32:57 | gmaan | k, in summary for tests coverage: 1. I moved existing tests to use member token 2. added a few new tests | |
| 01:34:22 | sean-k-mooney | cool night all o/ | |
| 01:34:29 | gmaan | GN | |
| 01:35:58 | melwitt | gnight o/ | |
| 03:03:43 | gmaan | stephenfin: finished the openapi series, some comments for follow up and some for fixing. | |
| 09:45:45 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Address issues with images APIs https://review.opendev.org/c/openstack/nova/+/956102 | |
| 09:45:46 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Separate volume, snapshot and volume attachments https://review.opendev.org/c/openstack/nova/+/952347 | |
| 09:45:46 | opendevreview | Stephen Finucane proposed openstack/nova master: tests: Use valid UUIDs for cinder resources https://review.opendev.org/c/openstack/nova/+/952935 | |
| 09:45:47 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Only apply "soft" additionalProperties validation to requests https://review.opendev.org/c/openstack/nova/+/952936 | |
| 09:45:47 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for volumes APIs https://review.opendev.org/c/openstack/nova/+/952348 | |
| 09:45:48 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for snapshots APIs https://review.opendev.org/c/openstack/nova/+/952349 | |
| 09:45:48 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for volume attachments APIs https://review.opendev.org/c/openstack/nova/+/952350 | |
| 09:45:49 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for floating IP APIs https://review.opendev.org/c/openstack/nova/+/952972 | |
| 09:45:49 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for security group APIs https://review.opendev.org/c/openstack/nova/+/952973 | |
| 09:45:51 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for services APIs https://review.opendev.org/c/openstack/nova/+/953196 | |
| 09:45:51 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server usage audit log APIs https://review.opendev.org/c/openstack/nova/+/953209 | |
| 09:45:53 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for tenant network APIs https://review.opendev.org/c/openstack/nova/+/956088 | |
| 09:45:53 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for simple tenant usage APIs https://review.opendev.org/c/openstack/nova/+/956096 | |
| 09:45:55 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for limits API https://review.opendev.org/c/openstack/nova/+/956139 | |
| 09:45:55 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for quota class sets API https://review.opendev.org/c/openstack/nova/+/956140 | |
| 09:45:57 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for quota sets API https://review.opendev.org/c/openstack/nova/+/956141 | |
| 09:45:57 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for migrations API https://review.opendev.org/c/openstack/nova/+/956142 | |
| 09:45:59 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server migrations API https://review.opendev.org/c/openstack/nova/+/956143 | |
| 09:45:59 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server tags API https://review.opendev.org/c/openstack/nova/+/956144 | |
| 09:46:01 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server metadata APIs https://review.opendev.org/c/openstack/nova/+/956145 | |
| 09:47:07 | opendevreview | Ian Watson proposed openstack/nova master: Changing how placement updates are triggered in RT https://review.opendev.org/c/openstack/nova/+/955687 | |
| 09:48:56 | opendevreview | Ian Watson proposed openstack/nova master: Changing how placement updates are triggered in RT https://review.opendev.org/c/openstack/nova/+/955687 | |
| 10:00:17 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 10:12:16 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 10:30:26 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 10:58:12 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:00:48 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:02:00 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:02:53 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:04:29 | opendevreview | Ian Watson proposed openstack/nova master: Add migrations_supported methed for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:04:59 | opendevreview | Ian Watson proposed openstack/nova master: Add migration conditional for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:06:32 | opendevreview | Ian Watson proposed openstack/nova master: Add migration conditional for resource tracker https://review.opendev.org/c/openstack/nova/+/955690 | |
| 11:49:21 | opendevreview | Merged openstack/nova master: [test]Speed up fs retry tests by mocking sleep https://review.opendev.org/c/openstack/nova/+/955904 | |
| 11:50:56 | opendevreview | Merged openstack/nova master: [test]Speed up ironic console test by decreasing timeout https://review.opendev.org/c/openstack/nova/+/955905 | |
| 11:51:26 | opendevreview | Merged openstack/nova master: [test]Speed up RBD test by decreasing retry interval https://review.opendev.org/c/openstack/nova/+/955906 | |