| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-08-07 | |||
| 05:51:06 | noonedeadpunk | sean-k-mooney: but it's not yet feature freeze for 2025.2 if I read the schedule right? and this is is quite tiny, easy, so maybe it's the right place? ;) | |
| 09:58:33 | sean-k-mooney | noonedeadpunk: we are well pass the spec approval freeze so this is something for next cycle | |
| 09:58:51 | sean-k-mooney | noonedeadpunk: the spec freeze was milestone 2 | |
| 10:02:10 | noonedeadpunk | ah, right, true | |
| 10:02:17 | noonedeadpunk | I was looking for feature freeze | |
| 10:03:22 | sean-k-mooney | that does not mean it cant merge early in 2026.1 as in late september/october | |
| 10:03:26 | noonedeadpunk | it's kinda sad though, as this is pretty much the only way so far to get live migrations working reliable until gnutls is patched and with memory being encrypted | |
| 10:03:59 | noonedeadpunk | or well... use tunnels... | |
| 10:03:59 | sean-k-mooney | well its not actully fixing the issue | |
| 10:04:10 | noonedeadpunk | yeah, true | |
| 10:04:24 | sean-k-mooney | it just make it less likely as each coonenction gets it own rekey timer | |
| 10:04:39 | sean-k-mooney | the workaroudn for now is to just disable tls3 with aes | |
| 10:04:44 | sean-k-mooney | via the crypto polices | |
| 10:04:56 | noonedeadpunk | which you can;'t do outside of EL | |
| 10:04:58 | sean-k-mooney | i.e. disable the specific policy that has the issue | |
| 10:05:05 | sean-k-mooney | EL? | |
| 10:05:10 | noonedeadpunk | *RHEL | |
| 10:05:22 | sean-k-mooney | oh well that not a rhel thing as far as im aware | |
| 10:05:34 | noonedeadpunk | as I tried to place a gnutls config on ubuntu and qemu just ignores it | |
| 10:05:43 | noonedeadpunk | so it's not a thing on debian/ubuntu | |
| 10:05:58 | noonedeadpunk | Maybe it does work on centos/rocky - dunno | |
| 10:06:00 | sean-k-mooney | i suspect it might be but uses a diffent location | |
| 10:06:32 | noonedeadpunk | Ubuntu just dropped policy package with comment it never-ever worked on ubuntu 24.04 to start with | |
| 10:06:44 | sean-k-mooney | https://wiki.debian.org/CryptoPolicy | |
| 10:06:51 | noonedeadpunk | https://bugs.launchpad.net/ubuntu/+source/crypto-policies/+bug/2069129 | |
| 10:06:59 | sean-k-mooney | so apprently it s a fedora thing? | |
| 10:07:11 | sean-k-mooney | https://fedoraproject.org/wiki/Changes/CryptoPolicy | |
| 10:07:21 | noonedeadpunk | well, I think anyway it does not work on debian/ubuntu | |
| 10:07:27 | sean-k-mooney | form 2014 that they were loooking to upstream | |
| 10:07:42 | noonedeadpunk | "crypto-policies is not supported on Ubuntu: it requires deep integration with the packages and their configurations. This integration doesn't exist and is unlikely to ever exist outside of redhat-based distributions" | |
| 10:08:03 | sean-k-mooney | https://manpages.ubuntu.com/manpages/jammy/en/man8/update-crypto-policies.8.html | |
| 10:08:22 | sean-k-mooney | well the pakcage for doing it is in ubuntu | |
| 10:08:31 | noonedeadpunk | So 2069129 claims it never worked despoite being packaged | |
| 10:08:43 | noonedeadpunk | which is the reason it's dropped | |
| 10:08:56 | sean-k-mooney | ya so this is in rhel to make fips work | |
| 10:09:15 | sean-k-mooney | i know cannonicals fipes supprot is a paied extra | |
| 10:09:43 | noonedeadpunk | anyway, I didn't find the way so far to make ubuntu to use POLY1305 | |
| 10:09:50 | sean-k-mooney | ack | |
| 10:10:29 | noonedeadpunk | even though I blacklisted AES in gnutls config and gnutls output was like that: https://paste.openstack.org/show/b2VjO9rv4976Y4prCtt9/ | |
| 10:10:42 | noonedeadpunk | seems that qemu was still doing what it wanted | |
| 10:11:30 | sean-k-mooney | you using kolla right | |
| 10:11:34 | noonedeadpunk | osa | |
| 10:11:47 | sean-k-mooney | oh so not in a contianer then | |
| 10:11:56 | sean-k-mooney | i was going to ask if you updated it in the contianer | |
| 10:12:12 | noonedeadpunk | yeah, it's just on the node | |
| 10:12:13 | sean-k-mooney | or suggest you try the centos libvirt contianer to see if that woudl work around it | |
| 10:12:48 | noonedeadpunk | well... I probably could do that.... | |
| 10:12:55 | sean-k-mooney | its possible that htey staic link it or something like that but debian is normlaly all in on dynmaic linking everything | |
| 10:14:26 | sean-k-mooney | in your case i think tunnled migration or using just tcp if you are allow too is the best approch unless you want to carry that patch downstream until its landed upstream | |
| 10:14:44 | sean-k-mooney | still to fix iti properly you will need the qemu fix when that is ready | |
| 10:15:14 | noonedeadpunk | we have local drives as nova drives, which we expect to live migrate as well, which does not work with the trunnel; | |
| 10:15:16 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for servers APIs (5/6) https://review.opendev.org/c/openstack/nova/+/956239 | |
| 10:15:17 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for server shares APIs https://review.opendev.org/c/openstack/nova/+/956266 | |
| 10:15:17 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add response body schemas for servers APIs (6/6) https://review.opendev.org/c/openstack/nova/+/956240 | |
| 10:15:18 | opendevreview | Stephen Finucane proposed openstack/nova master: tests: Invert validation check https://review.opendev.org/c/openstack/nova/+/956241 | |
| 10:15:21 | noonedeadpunk | anyway | |
| 10:18:04 | opendevreview | Dmitriy Rabotyagov proposed openstack/nova-specs master: Add 2026.1 specs folder https://review.opendev.org/c/openstack/nova-specs/+/956767 | |
| 10:19:47 | opendevreview | Dmitriy Rabotyagov proposed openstack/nova-specs master: Propose enabling parallel live migrations for libvirt https://review.opendev.org/c/openstack/nova-specs/+/955783 | |
| 10:35:15 | opendevreview | Merged openstack/nova master: Revert^2 "Support glance's new location API" https://review.opendev.org/c/openstack/nova/+/950623 | |
| 10:45:03 | opendevreview | Takashi Kajinami proposed openstack/nova master: Migrate MEM_ENCRYPTION_CONTEXT from root provider https://review.opendev.org/c/openstack/nova/+/921814 | |
| 10:45:04 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706 | |
| 10:45:04 | opendevreview | Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685 | |
| 10:45:05 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106 | |
| 10:46:55 | tkajinam | Uggla, I wonder if I can ask for your help to move this series forward ^^^ I've been receiving emails regularly to ask progress about this work (from different parties, which is interesting) and I'm hoping that I can move it forward (getting it merged is the best but I at least need some feedback) | |
| 10:50:57 | Uggla | Hi tkajinam, I'll do my best to try to review it and warn cores for reviews, as this is an important feature. | |
| 10:51:48 | tkajinam | Uggla, thanks ! | |
| 10:56:27 | sean-k-mooney | oh the sev work | |
| 10:56:48 | sean-k-mooney | ya it woudl be good to compelte that this cycle givein it missed last cycle due to review bandwith | |
| 10:57:57 | Uggla | sean-k-mooney I agree | |
| 11:11:05 | tkajinam | support for sev-sep, which is more sophisticated version of sev, is reaching downstream distros, and tdx support was merged to the latest kernel. so I expect more people may be interested in using memory encryption features. | |
| 11:11:35 | tkajinam | and this could be a base work to extend current sev support, to support more cpu features | |
| 11:28:11 | opendevreview | Callum Dickinson proposed openstack/nova master: Fix image ID in libvirt metadata when unshelving https://review.opendev.org/c/openstack/nova/+/942973 | |
| 11:28:11 | opendevreview | Callum Dickinson proposed openstack/nova master: Add more flavor metadata to libvirt guest XML https://review.opendev.org/c/openstack/nova/+/942974 | |
| 11:28:12 | opendevreview | Callum Dickinson proposed openstack/nova master: Add image meta to libvirt XML metadata https://review.opendev.org/c/openstack/nova/+/942766 | |
| 12:14:32 | opendevreview | Callum Dickinson proposed openstack/nova master: Add more flavor metadata to libvirt guest XML https://review.opendev.org/c/openstack/nova/+/942974 | |
| 12:14:33 | opendevreview | Callum Dickinson proposed openstack/nova master: Add image meta to libvirt XML metadata https://review.opendev.org/c/openstack/nova/+/942766 | |
| 14:01:52 | opendevreview | Johannes Beisiegel proposed openstack/nova master: fix: ensure to remove cinder attachments on delete of building instance https://review.opendev.org/c/openstack/nova/+/956789 | |
| 14:02:45 | opendevreview | Johannes Beisiegel proposed openstack/nova master: fix: ensure to remove cinder attachments on delete of building instance https://review.opendev.org/c/openstack/nova/+/956789 | |
| 17:28:31 | opendevreview | Rajesh Tailor proposed openstack/nova master: Add support for using cell-name in cell_v2 commands https://review.opendev.org/c/openstack/nova/+/954460 | |
| #openstack-nova - 2025-08-08 | |||
| 09:05:04 | opendevreview | Masanori Kuroha proposed openstack/nova master: Copy applied provider.yaml https://review.opendev.org/c/openstack/nova/+/948304 | |
| 10:01:49 | opendevreview | Johannes Kulik proposed openstack/nova master: db: Fix api_db_opts reading main_db_opts https://review.opendev.org/c/openstack/nova/+/956869 | |
| 10:03:23 | jkulik | hi folks, one of my colleagues found a bug in the code ^ do you also need a bug-report in launchpad? imho this is a quite obvious one :) | |
| 10:39:10 | frickler | jkulik: since the bug appears to be 4 years old, I think a bug report would be better to allow easier backporting to stable branches, even though the fix looks obvious | |
| 10:39:22 | jkulik | ok | |
| 10:43:33 | opendevreview | Johannes Kulik proposed openstack/nova master: db: Fix api_db_opts reading main_db_opts https://review.opendev.org/c/openstack/nova/+/956869 | |
| 10:48:16 | tkajinam | Can https://review.opendev.org/c/openstack/placement/+/953367 get some attention. it's just one of the hosekeeping updates. | |
| 14:12:29 | opendevreview | Stefan Hoffmann proposed openstack/nova master: POC: setup tap interface by nova https://review.opendev.org/c/openstack/nova/+/956907 | |
| 14:14:53 | opendevreview | Stefan Hoffmann proposed openstack/nova master: POC: setup tap interface by nova https://review.opendev.org/c/openstack/nova/+/956907 | |
| 14:40:15 | sthoffmann[m] | Like discussed at the last PTG, I provided a POC for letting neutron wait till ovn-controller on destination host has the change and let therefore nova create the tap interface.... (full message at <https://matrix.org/oftc/media/v1/media/download/AcK7tVlei75Wjt7vLary51xZAItVJ4c5v-eSjBPuJhQN-w4LXaTO8jzvgi_S84-s7GhXW08xw4TvM1xnZCT5SnxCeY0jkb2AAG1hdHJpeC5vcmcvb0NZaVRvTWhJTWpCWnpEaGtnRG1ITWt0>) | |
| 15:21:38 | sean-k-mooney | sthoffmann[m]: if we are goign to create the tap atead of tiem weo would do that in os-vif | |
| 15:22:22 | sean-k-mooney | we would jsut have nova pass a flag to tell os-vif to do it | |
| 16:51:38 | opendevreview | Merged openstack/nova master: Fix image ID in libvirt metadata when unshelving https://review.opendev.org/c/openstack/nova/+/942973 | |
| 17:13:57 | opendevreview | Pavlo Shchelokovskyy proposed openstack/nova master: Remove max config limit for libvirt.num_pcie_ports https://review.opendev.org/c/openstack/nova/+/956942 | |
| 19:20:04 | opendevreview | Ghanshyam proposed openstack/nova master: Disable server reset state API by default https://review.opendev.org/c/openstack/nova/+/956959 | |
| 20:35:24 | opendevreview | Ghanshyam proposed openstack/nova master: Disable server reset state API by default https://review.opendev.org/c/openstack/nova/+/956959 | |
| #openstack-nova - 2025-08-09 | |||
| 01:15:35 | opendevreview | melanie witt proposed openstack/nova master: TPM: migrate legacy instances to new security policy https://review.opendev.org/c/openstack/nova/+/942501 | |
| 01:15:35 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `user` secret security https://review.opendev.org/c/openstack/nova/+/942502 | |
| 01:15:36 | opendevreview | melanie witt proposed openstack/nova master: TPM: support instances with `host` secret security https://review.opendev.org/c/openstack/nova/+/941795 | |
| 01:15:36 | opendevreview | melanie witt proposed openstack/nova master: Add vtpm_secret_(uuid|value) to LibvirtLiveMigrateData https://review.opendev.org/c/openstack/nova/+/952628 | |
| 01:15:37 | opendevreview | melanie witt proposed openstack/nova master: TPM: support live migration of `host` secret security https://review.opendev.org/c/openstack/nova/+/941483 | |