| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-08-28 | |||
| 08:18:05 | bauzas | this is fine tho, please don't recheck again | |
| 08:26:28 | Uggla | bauzas, you "recheck" it again ? | |
| 08:26:48 | bauzas | lemme check where we are in the gate for the series | |
| 08:29:40 | bauzas | Uggla: the first patch in the series is fine, and I see the next 3 ones in the check pipeline, so no need to recheck | |
| 08:30:58 | drannou | Hello nova ! Quick question: we would like to harden nova-compute rights, what is the strict minimum right nova-compute needed ? Does anyone already have a specific policy.json ? | |
| 08:39:02 | Uggla | bauzas, I was not sure about the second one. Cool if they are in the pipeline. | |
| 08:39:22 | bauzas | Uggla: as a reminder, you can look at https://zuul.opendev.org/t/openstack/status?change=921814 | |
| 08:40:20 | bauzas | drannou: not sure I understand your question, you're mixing API policies that are public and nova-compute RPC calls that are internal | |
| 08:40:46 | bauzas | or are you talking of the privilege escalation that the nova-compute python service can do ? | |
| 08:41:31 | Uggla | bauzas, yep I know about it. But I was probably too fast and I did not find it at a first glance. | |
| 08:42:18 | drannou | only nova-compute internal API (http) calls, let's imagine that I don't trust the nova-compute hosts (Vm escape), I would like to create dedicated role for nova-comptue with the strict minimum rights on API calls (neutron, glance, cinder, placement). Of course for RPC, I know that we have not "rights" available | |
| 09:04:50 | gibi | bauzas: Uggla: I saw grenade issues wiht | |
| 09:04:51 | gibi | 2025-08-27 17:29:17.139980 | compute1 | /opt/stack/old/devstack/functions-common: line 2189: 30613 Segmentation fault sudo usermod -a -G "$group" "$user" | |
| 09:05:08 | gibi | and general issues with "Error: Failed to update project openstack/nova" | |
| 09:05:16 | gibi | the latter is random in differnt jobs | |
| 09:05:31 | gibi | but I had not time to dig deeper | |
| 09:05:35 | bauzas | this is not on a single job | |
| 09:05:36 | gibi | or file bugs or notifiy infra | |
| 09:05:45 | bauzas | I was about to see the next results | |
| 09:05:49 | bauzas | before calling infra | |
| 09:05:56 | bauzas | maybe some node(s) are having issues | |
| 09:06:14 | bauzas | gibi: I'll continue to follow-up, thanks for your help | |
| 09:06:46 | bauzas | drannou: oh, you're talking of a service persona | |
| 09:07:09 | Uggla | that's really weird to get a segfault on "sudo usermod". | |
| 09:07:10 | bauzas | for nova calling the other serfvices | |
| 09:07:37 | bauzas | drannou: there are good news for you, do you know about something called Secure RBAC ? | |
| 09:08:17 | bauzas | Uggla: I saw that once, IIRC this was due to a tainted kernel | |
| 09:08:40 | bauzas | that's just an user exception when calling sudo, but if you look at the system logs or dmesg, this is clear | |
| 09:08:55 | Uggla | (OO) | |
| 09:18:09 | drannou | bauzas: more (or may be) less :) | |
| 09:24:15 | bauzas | drannou: https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#isolate-service-to-service-apis-to-the-service-role | |
| 09:24:52 | bauzas | drannou: and that's litterally what I'm currently reviewing https://review.opendev.org/c/openstack/nova/+/957578 | |
| 09:33:03 | drannou | bauzas: wonderful, I will check that thx | |
| 10:10:22 | opendevreview | Stephen Finucane proposed openstack/nova master: db: Move regex helpers to utils https://review.opendev.org/c/openstack/nova/+/958745 | |
| 10:10:22 | opendevreview | Stephen Finucane proposed openstack/nova master: tests: Clean up flavors tests https://review.opendev.org/c/openstack/nova/+/958746 | |
| 10:10:23 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Simplify API version check for flavor description https://review.opendev.org/c/openstack/nova/+/958747 | |
| 10:10:23 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Add ability to filter flavors by name https://review.opendev.org/c/openstack/nova/+/958748 | |
| 10:10:24 | opendevreview | Stephen Finucane proposed openstack/nova master: api: Remove dead fields from flavors response https://review.opendev.org/c/openstack/nova/+/958749 | |
| 10:10:24 | opendevreview | Stephen Finucane proposed openstack/nova master: WIP: api: Restrict additional query string arguments https://review.opendev.org/c/openstack/nova/+/958750 | |
| 11:48:34 | gibi | bauzas: Uggla: I see full green runs on patches now so I think at least the "Error: Failed to update project openstack/nova" issue is not happening any more (or not that frequently)j | |
| 11:48:59 | bauzas | yup, probably a transient issue on some subnodes | |
| 11:49:04 | bauzas | we will see | |
| 11:55:29 | gibi | yepp | |
| 11:58:26 | sean-k-mooney | bauzas: gibi gmaan will any of ye have tiem to review stephenfin's https://review.opendev.org/q/topic:%22bp/flavor-search-by-name%22 flavor search by name series. im +2 on the first 4 patches which are pretty easy to review and deliver the main feature, im readign the 5th which is optional and does all the cleanup of the flavor api that we wanted to include in the same | |
| 11:58:28 | sean-k-mooney | microversion but htat could happen in a seperate one if we don tget to it. the 6th wip patch just prevent using unrecongisned query args which again is optional and jsut api cleanup and can happen in a future release. so the first 4 patches which are pretty easy to review and the optional 5th patch wouuld be nice to review. we are still waitign on ci resutls for most of them | |
| 11:58:30 | sean-k-mooney | but it woudl be nice ot also compelte that spec. | |
| 11:59:04 | bauzas | the series was just created today, right? | |
| 11:59:26 | bauzas | I looked at all the BPs on Monday and I didn't found any implementation for it | |
| 11:59:35 | sean-k-mooney | yes, an i know its very late to propose it it just short and easy to reveiw | |
| 11:59:55 | sean-k-mooney | if it goes to next cycle that also ok | |
| 11:59:57 | bauzas | I can try then but this is also providing an API microversion, right ? | |
| 12:00:04 | sean-k-mooney | i just wanted to mention it before i go back to the sev one | |
| 12:00:17 | sean-k-mooney | bauzas: yes it is 101 | |
| 12:00:25 | bauzas | if so, I need to make sure we won't have any issue as we couldn't revert a change if we find an issue | |
| 12:00:32 | sean-k-mooney | thre are no other api changes im aware of competing for a micoverison at this point | |
| 12:00:40 | bauzas | sean-k-mooney: thanks for the SEV-ES series review btw. | |
| 12:00:50 | bauzas | sean-k-mooney: yup, I haven't found any | |
| 12:00:52 | sean-k-mooney | the microversion is they 4th patch the first 3 are just clean up | |
| 12:01:11 | bauzas | okay, then I'll look at it today | |
| 12:01:26 | sean-k-mooney | by cleanup i mean code cleanup no externally visable changes | |
| 12:40:47 | gibi | sean-k-mooney: I can take a quick look | |
| 13:08:13 | Uggla | gibi, sorry was distracted and I have just noticed your msg about the patches run. Thanks for letting me know. | |
| 13:08:22 | gibi | sure no worries | |
| 14:22:07 | dansmith | anyone else seeing python3.9 dep resolving failures? | |
| 14:22:24 | dansmith | I'm wondering if placement should drop that job | |
| 14:34:30 | gibi | dansmith: yapp we should drop it F has no 3.9 requirements https://governance.openstack.org/tc/reference/runtimes/2025.2.html | |
| 14:35:17 | gibi | https://review.opendev.org/c/openstack/placement/+/953367 we need this | |
| 14:35:28 | gibi | just approved | |
| 14:35:40 | dansmith | ack | |
| 15:58:31 | bauzas | sean-k-mooney: can you please review again the SEV-ES series ? https://review.opendev.org/c/openstack/nova/+/925685/ and upper | |
| 16:01:52 | sean-k-mooney | yep ill be around for the next 3 hours maybe a little longer so ill get to it once i push one watcher patch | |
| 16:02:00 | sean-k-mooney | its next on my todo list | |
| 16:14:05 | gmaan | sean-k-mooney: ack, i can check it today | |
| 16:21:20 | sean-k-mooney | no rush gibi notcied a reduction in test coverge becuase stephn delete a test instead of moving it in the first patch | |
| 16:21:33 | sean-k-mooney | gmaan: and im not expectign a respin | |
| 16:21:42 | gmaan | k | |
| 16:21:48 | sean-k-mooney | so we can pick that back up early next cycle | |
| 16:22:48 | gmaan | so we are not targeting that for this? | |
| 16:25:28 | gmaan | and this is still WIP, which is easy but big change https://review.opendev.org/c/openstack/nova/+/958750/1 | |
| 16:25:34 | sean-k-mooney | we were | |
| 16:25:57 | sean-k-mooney | but stephenfin is feeling unwell today and realsiticly its not going to land | |
| 16:26:12 | gmaan | ohk. got it. | |
| 16:26:38 | sean-k-mooney | so we can do it all early next cycle and still have 1 microversion for the feature and api cleanup | |
| 16:26:49 | gmaan | ++ | |
| 16:27:20 | gmaan | dansmith: can you +w this devstack change (quick one) for service role https://review.opendev.org/c/openstack/devstack/+/958612 | |
| 16:27:40 | dansmith | gmaan: got it | |
| 16:27:51 | gmaan | thanks | |
| 17:02:05 | gmaan | sean-k-mooney: whoami-rajat_ FYI, service API things on cinder/glance working now - https://zuul.opendev.org/t/openstack/build/03e62efae4054b7997f8fc6a4ca3db7c | |
| 17:02:25 | gmaan | consider configuring and devstack setting glance user in cinder properly https://zuul.opendev.org/t/openstack/build/03e62efae4054b7997f8fc6a4ca3db7c/log/controller/logs/etc/cinder/cinder_conf.txt#74 | |
| 17:02:46 | gmaan | there are unit test etc failure in fixes, I will fix those and ping in cinder. glance channel | |
| 17:03:10 | gmaan | this is testing change on top of fixes in glance, cinder, devstack https://review.opendev.org/c/openstack/cinder/+/958719 | |
| 17:14:31 | sean-k-mooney | ack i can join those if needed | |
| 17:14:38 | opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Remove tpm supoort detection for libvirt < 8.0.0 https://review.opendev.org/c/openstack/nova/+/952308 | |
| 17:41:19 | whoami-rajat_ | gmaan, ack, looks good, thanks | |
| 17:42:29 | sean-k-mooney | tkajinam: this is my main comment on the second sev patch https://review.opendev.org/c/openstack/nova/+/925685/comment/6a462652_db266f95/ if you have time can you respond whil i continue to review the rest | |
| 17:44:09 | sean-k-mooney | tkajinam: if you agree that we shoudl accomidate SEV_ES hosts with no SEV slot then we can adress that in a patch at the end of the seriese | |
| 17:47:45 | tkajinam | sean-k-mooney, thanks and checking it now | |
| 17:47:56 | sean-k-mooney | i dont think there si any hardware today that exclsivly supprot SEV-ES and not vanila SEV so i doing think its an edgecase we will actully hit | |
| 17:48:23 | sean-k-mooney | but i dont know if that will change going forward so just calling it out | |
| 17:52:47 | opendevreview | Merged openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | |