| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-08-27 | |||
| 19:16:09 | sean-k-mooney | it could be nice to include that in 2024.1 before it goes unmaintained but that wont happen until 2025.2 is released so there si a little time still | |
| 19:25:48 | dansmith | yeah, should be backported | |
| 19:26:08 | dansmith | I guess I dunno how far it really needs, I was thinking just to 2025.1 | |
| 19:27:14 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:27:43 | sean-k-mooney | i woudl say what is ever open when you get aroudn to it but 2025.1 is a good baseline | |
| 19:28:05 | sean-k-mooney | by open i mean still stable/* | |
| 19:32:28 | sean-k-mooney | gmaan: same question to you https://review.opendev.org/c/openstack/nova/+/957578/comment/2b782393_1a20e07c/ | |
| 19:32:57 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:33:53 | sean-k-mooney | im +2 i can +w but if you feel like adressing the final nit then im ok with fast approving or having dan proxy | |
| 19:34:14 | opendevreview | Ghanshyam proposed openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |
| 19:34:30 | gmaan | dansmith: sean-k-mooney ^^ updated, I need to fix api-ref failure also. so this is updated one now | |
| 19:34:39 | sean-k-mooney | ah yes stephsn sample split patch merged | |
| 19:34:48 | gmaan | yeah :) | |
| 19:35:10 | sean-k-mooney | i was wonderign what the prior conflict was | |
| 19:47:17 | gmaan | dansmith: sean-k-mooney thanks. can you please review this devstack change also which is needed but tempest service role tests https://review.opendev.org/c/openstack/devstack/+/958612 | |
| 19:51:56 | sean-k-mooney | im actully going to finish reviewing the first change in the sev serice but yes i can aftger | |
| 19:52:04 | sean-k-mooney | then ill call it a day. | |
| 19:52:28 | sean-k-mooney | my priorty tomorrwo will be to try and finish hte sev serise adn maybe the provider.yaml one | |
| 19:53:12 | gmaan | thanks | |
| 19:53:19 | sean-k-mooney | ok its litrally jsut adding thr service role | |
| 19:53:32 | gmaan | yeah, quick one :) | |
| 19:53:50 | sean-k-mooney | im +2 bnut shoud there be a comment above | |
| 19:54:04 | sean-k-mooney | or shoudl you also mention that the service role is added in 2025.2 | |
| 19:54:17 | sean-k-mooney | basicly im wonderign why you left the first comment | |
| 19:54:53 | gmaan | i might just missed that, i can fix later once touching that file for related things | |
| 19:55:03 | sean-k-mooney | ack | |
| 19:55:15 | sean-k-mooney | i was just wonderign is there a convention that i shoudl be reviewing for | |
| 19:55:53 | sean-k-mooney | like in nova-next we sometime add comment when testing a future default so we know we can drop it form the job when it actully becomes the default | |
| 19:56:20 | sean-k-mooney | is noting the manager role so you can knwo when tempst can depend on it ? | |
| 19:56:56 | gmaan | yeah, that is helpful specially to know when to drop those things once they are in all supported releases | |
| 19:57:08 | sean-k-mooney | ack | |
| 20:18:19 | sean-k-mooney | ok first patch doen and it looks ok but i defintly dont have the brain power to go deeper in teh sev series today | |
| 20:18:30 | sean-k-mooney | ill try an complete it tomorrow | |
| 23:50:58 | opendevreview | Takashi Kajinami proposed openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685 | |
| 23:50:58 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706 | |
| 23:50:59 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106 | |
| 23:50:59 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add functional test scenario for mixed SEV RPs https://review.opendev.org/c/openstack/nova/+/958562 | |
| 23:51:00 | opendevreview | Takashi Kajinami proposed openstack/nova master: Purge nested SEV RPs when SEV is disabled https://review.opendev.org/c/openstack/nova/+/958626 | |
| #openstack-nova - 2025-08-28 | |||
| 08:16:50 | bauzas | looks like we have a CI pipeline issue :( | |
| 08:16:54 | bauzas | Uggla: ^ | |
| 08:17:10 | bauzas | example here https://zuul.opendev.org/t/openstack/build/7626e6d8c1e3423f921fa65667467d64 | |
| 08:17:48 | bauzas | tkajinam: please just add something when you say "recheck", something like "recheck timeout" :)= | |
| 08:18:05 | bauzas | this is fine tho, please don't recheck again | |
| 08:26:28 | Uggla | bauzas, you "recheck" it again ? | |
| 08:26:48 | bauzas | lemme check where we are in the gate for the series | |
| 08:29:40 | bauzas | Uggla: the first patch in the series is fine, and I see the next 3 ones in the check pipeline, so no need to recheck | |
| 08:30:58 | drannou | Hello nova ! Quick question: we would like to harden nova-compute rights, what is the strict minimum right nova-compute needed ? Does anyone already have a specific policy.json ? | |
| 08:39:02 | Uggla | bauzas, I was not sure about the second one. Cool if they are in the pipeline. | |
| 08:39:22 | bauzas | Uggla: as a reminder, you can look at https://zuul.opendev.org/t/openstack/status?change=921814 | |
| 08:40:20 | bauzas | drannou: not sure I understand your question, you're mixing API policies that are public and nova-compute RPC calls that are internal | |
| 08:40:46 | bauzas | or are you talking of the privilege escalation that the nova-compute python service can do ? | |
| 08:41:31 | Uggla | bauzas, yep I know about it. But I was probably too fast and I did not find it at a first glance. | |
| 08:42:18 | drannou | only nova-compute internal API (http) calls, let's imagine that I don't trust the nova-compute hosts (Vm escape), I would like to create dedicated role for nova-comptue with the strict minimum rights on API calls (neutron, glance, cinder, placement). Of course for RPC, I know that we have not "rights" available | |
| 09:04:50 | gibi | bauzas: Uggla: I saw grenade issues wiht | |
| 09:04:51 | gibi | 2025-08-27 17:29:17.139980 | compute1 | /opt/stack/old/devstack/functions-common: line 2189: 30613 Segmentation fault sudo usermod -a -G "$group" "$user" | |
| 09:05:08 | gibi | and general issues with "Error: Failed to update project openstack/nova" | |
| 09:05:16 | gibi | the latter is random in differnt jobs | |
| 09:05:31 | gibi | but I had not time to dig deeper | |
| 09:05:35 | bauzas | this is not on a single job | |
| 09:05:36 | gibi | or file bugs or notifiy infra | |
| 09:05:45 | bauzas | I was about to see the next results | |
| 09:05:49 | bauzas | before calling infra | |
| 09:05:56 | bauzas | maybe some node(s) are having issues | |
| 09:06:14 | bauzas | gibi: I'll continue to follow-up, thanks for your help | |
| 09:06:46 | bauzas | drannou: oh, you're talking of a service persona | |
| 09:07:09 | Uggla | that's really weird to get a segfault on "sudo usermod". | |
| 09:07:10 | bauzas | for nova calling the other serfvices | |
| 09:07:37 | bauzas | drannou: there are good news for you, do you know about something called Secure RBAC ? | |
| 09:08:17 | bauzas | Uggla: I saw that once, IIRC this was due to a tainted kernel | |
| 09:08:40 | bauzas | that's just an user exception when calling sudo, but if you look at the system logs or dmesg, this is clear | |
| 09:08:55 | Uggla | (OO) | |
| 09:18:09 | drannou | bauzas: more (or may be) less :) | |
| 09:24:15 | bauzas | drannou: https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#isolate-service-to-service-apis-to-the-service-role | |
| 09:24:52 | bauzas | drannou: and that's litterally what I'm currently reviewing https://review.opendev.org/c/openstack/nova/+/957578 | |
| 09:33:03 | drannou | bauzas: wonderful, I will check that thx | |
| 10:10:22 | opendevreview | Stephen Finucane proposed openstack/nova master: db: Move regex helpers to utils https://review.opendev.org/c/openstack/nova/+/958745 | |
| 10:10:22 | opendevreview | Stephen Finucane proposed openstack/nova master: tests: Clean up flavors tests https://review.opendev.org/c/openstack/nova/+/958746 | |
| 10:10:23 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Simplify API version check for flavor description https://review.opendev.org/c/openstack/nova/+/958747 | |
| 10:10:23 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add ability to filter flavors by name https://review.opendev.org/c/openstack/nova/+/958748 | |
| 10:10:24 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Remove dead fields from flavors response https://review.opendev.org/c/openstack/nova/+/958749 | |
| 10:10:24 | opendevreview | Stephen Finucane proposed openstack/nova master: WIP: api: Restrict additional query string arguments https://review.opendev.org/c/openstack/nova/+/958750 | |
| 11:48:34 | gibi | bauzas: Uggla: I see full green runs on patches now so I think at least the "Error: Failed to update project openstack/nova" issue is not happening any more (or not that frequently)j | |
| 11:48:59 | bauzas | yup, probably a transient issue on some subnodes | |
| 11:49:04 | bauzas | we will see | |
| 11:55:29 | gibi | yepp | |
| 11:58:26 | sean-k-mooney | bauzas: gibi gmaan will any of ye have tiem to review stephenfin's https://review.opendev.org/q/topic:%22bp/flavor-search-by-name%22 flavor search by name series. im +2 on the first 4 patches which are pretty easy to review and deliver the main feature, im readign the 5th which is optional and does all the cleanup of the flavor api that we wanted to include in the same | |
| 11:58:28 | sean-k-mooney | microversion but htat could happen in a seperate one if we don tget to it. the 6th wip patch just prevent using unrecongisned query args which again is optional and jsut api cleanup and can happen in a future release. so the first 4 patches which are pretty easy to review and the optional 5th patch wouuld be nice to review. we are still waitign on ci resutls for most of them | |
| 11:58:30 | sean-k-mooney | but it woudl be nice ot also compelte that spec. | |
| 11:59:04 | bauzas | the series was just created today, right? | |
| 11:59:26 | bauzas | I looked at all the BPs on Monday and I didn't found any implementation for it | |
| 11:59:35 | sean-k-mooney | yes, an i know its very late to propose it it just short and easy to reveiw | |
| 11:59:55 | sean-k-mooney | if it goes to next cycle that also ok | |
| 11:59:57 | bauzas | I can try then but this is also providing an API microversion, right ? | |
| 12:00:04 | sean-k-mooney | i just wanted to mention it before i go back to the sev one | |
| 12:00:17 | sean-k-mooney | bauzas: yes it is 101 | |
| 12:00:25 | bauzas | if so, I need to make sure we won't have any issue as we couldn't revert a change if we find an issue | |
| 12:00:32 | sean-k-mooney | thre are no other api changes im aware of competing for a micoverison at this point | |
| 12:00:40 | bauzas | sean-k-mooney: thanks for the SEV-ES series review btw. | |
| 12:00:50 | bauzas | sean-k-mooney: yup, I haven't found any | |
| 12:00:52 | sean-k-mooney | the microversion is they 4th patch the first 3 are just clean up | |