| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2025-09-02 | |||
| 16:47:44 | bauzas | if so, I'm afraid of any backport | |
| 16:47:54 | gmaan | sean-k-mooney: service only or admin-or-service? | |
| 16:47:57 | sean-k-mooney | what i can do is make time to do a poc | |
| 16:48:04 | sean-k-mooney | gmaan: it shoudl be service only eventually | |
| 16:48:10 | sean-k-mooney | humans shoudl never modify its content | |
| 16:48:27 | sean-k-mooney | only nova ironic or zun shoudl ever modify binding:profile | |
| 16:48:56 | sean-k-mooney | and hta twas the sechruity issue. you had to relax access to people to modify its content to use trusted_vif | |
| 16:49:30 | gmaan | i see | |
| 16:49:49 | Uggla | I have the feeling that a specless BP looks more adequate. | |
| 16:49:52 | sean-k-mooney | what i can do is see if i can find time to do a poc before the ptg or a future irc meeting | |
| 16:50:01 | sean-k-mooney | and we can revisit then | |
| 16:50:33 | sean-k-mooney | note we treated a similer issue for hardware offloaded ovs as a securyt hardining bug | |
| 16:50:37 | sean-k-mooney | that why i asked | |
| 16:50:46 | gmaan | neutron API extension is done this cycle? | |
| 16:51:20 | sean-k-mooney | https://bugs.launchpad.net/nova/+bug/2020813 | |
| 16:51:32 | sean-k-mooney | gmaan: it was done in 2025.1 i belive so epoxy | |
| 16:52:35 | gmaan | yeah, since 2025.1 https://github.com/openstack/neutron-lib/blob/stable/2025.1/neutron_lib/api/definitions/port_trusted_vif.py | |
| 16:52:50 | sean-k-mooney | https://review.opendev.org/c/openstack/neutron/+/926068 | |
| 16:53:07 | sean-k-mooney | the neutron change is older? not sure but i see 2024.2 | |
| 16:54:06 | sean-k-mooney | anyway i just wanted to get an initial read form folks | |
| 16:54:13 | sean-k-mooney | to me it was the same as https://bugs.launchpad.net/nova/+bug/2020813 | |
| 16:54:38 | gmaan | I think till we have neutron API available, we can backport it but not beyond that | |
| 16:55:11 | sean-k-mooney | we can also defer the backporting question until we see what the patch looks like | |
| 16:55:27 | gmaan | ++ | |
| 16:55:33 | sean-k-mooney | it shoudl be small and non invaisves in general but i have not witten it yet | |
| 16:57:11 | Uggla | ok, bauzas, you would like to discuss something. I hope it will be ok in the remaing time. | |
| 16:57:22 | bauzas | just a quick one | |
| 16:57:30 | bauzas | but let's discuss this in the next meeting | |
| 16:57:56 | bauzas | (about the pavilion on the openinfra summit, whether we would want to be there) | |
| 16:59:39 | sean-k-mooney | waht is that? | |
| 17:00:03 | sean-k-mooney | do you mean the fourm sessions that used to be part fo sumit? | |
| 17:00:10 | bauzas | https://lists.openstack.org/archives/list/openstack-discuss@lists.openstack.org/thread/MM4OJO5CCC4GHMYUN3OJBDHTSZNB32H2/ | |
| 17:00:17 | bauzas | but let's discuss this next ween | |
| 17:00:23 | bauzas | I have another TC meeting now | |
| 17:00:52 | sean-k-mooney | oh its effectivly lightnight talks or showcases | |
| 17:01:03 | sean-k-mooney | for project to have tiem in a shared presenting space | |
| 17:01:17 | sean-k-mooney | sure we can think on that and revisit next week | |
| 17:01:41 | sean-k-mooney | `The deadline to sign up is 26 September!` ok so we also have time | |
| 17:01:47 | sean-k-mooney | to respond to this ask | |
| 17:01:54 | Uggla | yep. | |
| 17:03:37 | Uggla | We’ve reached the top of the hour, so thanks to everyone attending this meeting. | |
| 17:03:46 | gibi | thanks Uggla | |
| 17:04:00 | Uggla | #endmeeting | |
| 17:04:00 | opendevmeet | Meeting ended Tue Sep 2 17:04:00 2025 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | |
| 17:04:00 | opendevmeet | Minutes: https://meetings.opendev.org/meetings/nova/2025/nova.2025-09-02-16.00.html | |
| 17:04:00 | opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/nova/2025/nova.2025-09-02-16.00.txt | |
| 17:04:00 | opendevmeet | Log: https://meetings.opendev.org/meetings/nova/2025/nova.2025-09-02-16.00.log.html | |
| 17:04:08 | elodilles | thanks o/ | |
| 20:20:12 | opendevreview | Merged openstack/nova master: Add service version for Falmingo https://review.opendev.org/c/openstack/nova/+/959184 | |
| 20:20:47 | opendevreview | Merged openstack/nova master: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/953972 | |
| 22:12:55 | gmaan | Uggla: commented in this, I am ok to fix this as bug and no need to bump microversion. I think you are planning to backport also https://review.opendev.org/c/openstack/nova/+/952895 | |
| 22:13:13 | gmaan | some suggestion to fix comment and explain detail in commit msg otherwise fix lgtm | |
| #openstack-nova - 2025-09-03 | |||
| 08:05:37 | opendevreview | ribaudr proposed openstack/nova master: Reproducer for bug 2114951 https://review.opendev.org/c/openstack/nova/+/952894 | |
| 08:05:38 | opendevreview | ribaudr proposed openstack/nova master: Fix bug 2114951 https://review.opendev.org/c/openstack/nova/+/952895 | |
| 08:25:03 | opendevreview | ribaudr proposed openstack/nova master: Add Flamingo prelude section https://review.opendev.org/c/openstack/nova/+/959188 | |
| 10:00:15 | opendevreview | Tobias Urdin proposed openstack/nova master: Prevent leaking host info when HostMappingNotFound https://review.opendev.org/c/openstack/nova/+/959296 | |
| 10:23:46 | opendevreview | ribaudr proposed openstack/nova master: Add Flamingo prelude section https://review.opendev.org/c/openstack/nova/+/959188 | |
| 10:24:07 | opendevreview | Merged openstack/nova master: Fix duplicate words https://review.opendev.org/c/openstack/nova/+/959136 | |
| 10:24:39 | nate | Hi ! I have a question regarding compute nodes and cinder volume encryption. We use a ceph backend with RBD with LUKS encrypted volume with encryption keys stored in barbican. At volume creation, the key belong to the end-user creating the volume. But our compute node, who has a dedicated compute-nodeX openstack user, can access this key. How does this magic happen in term of | |
| 10:24:41 | nate | rights, since our compute nodes do not have any admin role ? | |
| 10:31:32 | nate | Our compute nodes have the service role on the service project, as well as a custom admin-compute role that only has two extra policies in neutron | |
| 10:40:41 | opendevreview | Merged openstack/nova master: [CI]Make nova-tox-py312-threading voting https://review.opendev.org/c/openstack/nova/+/955791 | |
| 11:41:11 | gibi | Uggla: re ceph volume creation gate issue. I filed https://bugs.launchpad.net/cinder/+bug/2121941 | |
| 11:41:41 | gibi | it happens about 30% of the time | |
| 11:48:32 | gibi | Uggla: as the patch making the py312-threading job voting landed I marked https://blueprints.launchpad.net/nova/+spec/eventlet-removal-part-1 as implemented and opened https://blueprints.launchpad.net/nova/+spec/eventlet-removal-gazpacho as the continuation | |
| 12:03:23 | sean-k-mooney | nate: the comput and admin cannot access the key, we store it in libvirt using the enduser access when the vm is creatd | |
| 12:03:43 | sean-k-mooney | its the presence of the key as a libvirt secreate that allows it to work | |
| 12:04:33 | sean-k-mooney | so it was the user keystone token that granted access but we only have that whiel we are attachign the voluem or creating the vm based on there request | |
| 12:05:16 | jkulik | sean-k-mooney: would that key then get transported on live-migration to another node, too? does libvirt do that automatically or is there some special mechanism in Nova? | |
| 12:05:19 | sean-k-mooney | gibi: we debuged that cidner volume isseu a few weeks ago | |
| 12:05:40 | sean-k-mooney | jkulik: i belivw ew do not suprot live migration with encypted volumes today | |
| 12:05:57 | jkulik | ah. ok. I was assuming :) | |
| 12:06:18 | sean-k-mooney | jkulik: that was a limitation intially and we plan to solve it using the same stragey for vtpm mitragion when that is complete | |
| 12:06:54 | gibi | sean-k-mooney: it is the same? what is the solution? is there a bug I can duplicate mine to? | |
| 12:07:10 | sean-k-mooney | for vtpm migration we are introducing 2 other modes, deployment where the encyrption keey will be owned by nova not the end user and host where the secret will be copied form host to host by reading it form libvirt and creating it | |
| 12:07:56 | sean-k-mooney | gibi: no, i dough into it, found the error and looked at how cidner is implemtneding cpu trotteling breifly | |
| 12:08:19 | sean-k-mooney | i brought it up on the QA channel | |
| 12:08:44 | sean-k-mooney | but i think i found a bz for it | |
| 12:08:47 | sean-k-mooney | ill need to check back | |
| 12:09:10 | jkulik | very helpful. thank you. also found the spec for that: https://github.com/openstack/nova-specs/blob/master/specs/2025.2/approved/vtpm-live-migration.rst | |
| 12:09:13 | sean-k-mooney | there is a diffent bug in teh qemu we are suing on debian 12 that i think is already fixed | |
| 12:09:37 | sean-k-mooney | gibi: let me check the irc logs and see if i can find the details | |
| 12:10:29 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2025.1: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959308 | |
| 12:10:30 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2025.1: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959309 | |
| 12:10:35 | gibi | sean-k-mooney: thanks | |
| 12:12:03 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.2: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959310 | |
| 12:12:04 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.2: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959311 | |
| 12:13:02 | sean-k-mooney | gibi: https://meetings.opendev.org/irclogs/%23openstack-qa/%23openstack-qa.2025-08-12.log.html | |
| 12:13:10 | sean-k-mooney | so its https://bugzilla.redhat.com/show_bug.cgi?id=2336437 | |
| 12:13:17 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.1: Reproduce that only half of the PCI devs are removed https://review.opendev.org/c/openstack/nova/+/959313 | |
| 12:13:18 | opendevreview | Balazs Gibizer proposed openstack/nova stable/2024.1: Fix pci_tracker.save to delete all removed devs https://review.opendev.org/c/openstack/nova/+/959314 | |
| 12:13:26 | sean-k-mooney | gibi: oh right i stated trying to fix it | |
| 12:13:47 | sean-k-mooney | so i put this on hold due to the security bug then FF | |
| 12:14:01 | sean-k-mooney | gibi: teh fix i starteed on is using a newer qemu form the backports repo | |
| 12:14:24 | sean-k-mooney | there are 2 ways to do that i was trying the one clark suggested althouth the other way is simpler | |
| 12:15:29 | sean-k-mooney | the fixed qemu is avaibel in debian 12 backporta dn proably debian 13 so we can jsut swap the job to 13 on master after RC1 once we clean up the devstack patch for debian 13, so that will be a month or so away | |
| 12:15:30 | gibi | ack. I added the bz to the cinder bug | |
| 12:16:27 | sean-k-mooney | for stable if we use qemu form the backprots repo it "should" fix it but we will need to either use -t to enabel the backports repo when isntalling qemu or update the name of the package to include /backprots or wahtever | |
| 12:16:48 | sean-k-mooney | the latter is the harder approch i was trying but then i need to list all the package however it would be cleaner in the long rung | |
| 12:17:10 | sean-k-mooney | the former is eaiser to do but it requires use to supprot that in the package_install comamnd | |