Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2026-08-21
14:56:42 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Add Intel TDX host capability detection https://review.opendev.org/c/openstack/nova/+/994421
14:56:42 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Generalize memory encryption config https://review.opendev.org/c/openstack/nova/+/998466
14:56:43 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Add memory encryption config for TDX https://review.opendev.org/c/openstack/nova/+/998608
14:56:43 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Add os_firmware_secure https://review.opendev.org/c/openstack/nova/+/1000472
14:56:44 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Launch security Intel TDX https://review.opendev.org/c/openstack/nova/+/999249
14:56:44 opendevreview Anton Iacobaeus proposed openstack/nova master: doc: Add documentation for Intel TDX https://review.opendev.org/c/openstack/nova/+/1000081
14:56:45 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: reject_mem_enc_instances https://review.opendev.org/c/openstack/nova/+/1000082
14:56:45 opendevreview Anton Iacobaeus proposed openstack/nova master: libvirt: Check only x86_64 arch for Intel TDX https://review.opendev.org/c/openstack/nova/+/1000805
15:03:16 gmaan antia: thanks, will check today. i finished till doc yesterday but that is most of the key thing and last two were good maybe,
15:03:23 gmaan dansmith: ack, thanks
15:03:59 gmaan dansmith: and this doc/releasenotes one is last https://review.opendev.org/c/openstack/nova/+/997141/10
15:09:35 dansmith gmaan: yep, I know
15:10:37 gmaan dansmith: k. I will fix this if i re-spin it otherwise sometime later https://review.opendev.org/c/openstack/nova/+/1000211/comment/734dd672_9a340618/
15:10:50 gmaan or you want to push me a followup in thtis series?
15:12:18 dansmith not critical, see what other people think
15:15:01 gmaan ack
15:17:33 dansmith ugh, I can't put my finger on it right now.. Uggla when is FF?
15:18:09 Uggla Thursday next week
15:18:18 gmaan Aug 28, end of next week
15:18:19 dansmith duh, linked from the top of the H page
15:18:35 sean-k-mooney the non client lib freze shoudl have been yesterday i think as well
15:18:53 sean-k-mooney i was about to check if the os-tirat release we are waitign on happend?
15:18:57 dansmith ack, so I think we have plenty of time for gouthamr to at least try for a follow-up patch for reconciling missed share access rules
15:18:57 sean-k-mooney Uggla: do you know?
15:19:20 dansmith Uggla: I assume you would be up for a FFE if necessary to get that over the line if the rest of it is landed?
15:19:42 gmaan antia: sean-k-mooney on TDX one, before you both goes offline. one thing to discuss. i have to check the updated series but i cannot see VM create is rejected if os_secure_boot=required and TDX requested, https://review.opendev.org/c/openstack/nova/+/999249/5/nova/virt/libvirt/driver.py#7967
15:19:56 Uggla dansmith yes if we have a chance to do it.
15:19:58 gmaan is update/re-aranging series done or shoud i wait
15:20:49 sean-k-mooney Uggla: looks like the last release was 2 months ago so im going to go request a new release now
15:20:51 sean-k-mooney https://github.com/openstack/releases/blob/master/deliverables/_independent/os-traits.yaml#L115-L118
15:21:27 Uggla sean-k-mooney, I don't know. But things are probably lagging a bit because Elod is on pto
15:22:09 dansmith Uggla: AFAIK we're now just waiting for you to circle back on the exception handling comment here: https://review.opendev.org/c/openstack/nova/+/999349
15:22:23 sean-k-mooney well sylvain is the release liason so they would have been teh one to propeose it normally but they are also on pto
15:22:28 sean-k-mooney rather then elod
15:22:30 dansmith otherwise I think I'm +2 on both assuming gouthamr will propose a followup for a periodic resync of the share access rules
15:24:50 gmaan antia: this one https://review.opendev.org/c/openstack/nova/+/999249/3..5/nova/virt/libvirt/driver.py#b7976
15:25:25 gmaan i was expecting we reject the request when we find os_secure_boot is required and tdx-requested otherwise it still ignore it. no?
15:26:04 Uggla dansmith, thanks I'm gonna answer. Did you test with nfs or cephfs ?
15:26:14 dansmith nfs
15:27:39 dansmith Uggla: I put notes in the comments about the things I tested (although notably left out which driver I was using)
15:27:39 antia gmaan: There is a follow up patch, which I now moved to be in front, which solves the secure boot interaction with TDX
15:27:43 Uggla ok I have just setup a cephfs devstack for testing it. That should not fundamentally change. But it will be another check.
15:28:17 dansmith very good
15:28:20 antia https://review.opendev.org/c/openstack/nova/+/1000472 with this it shouldn't be required to reject on os_secure_boot=required for TDX
15:29:32 gmaan antia: ok, let me go through the whole series again, will do after sometime. btw which TZ you are in?
15:29:33 sean-k-mooney did gibi or you have time to test that secure boot actully worked in that version
15:30:06 antia gmaan: UTC+2, so just about to head off for the weekend :)
15:30:09 Uggla dansmith, I would have progressed more without yesterday escalation.
15:30:14 gmaan i did not have HW access, gibi had. i asked him about it but we will get to know on monday.
15:30:28 gmaan antia: ack
15:30:38 gmaan or antia may have tested?
15:30:42 sean-k-mooney gmaan: sorry that question was to antia
15:30:47 antia both me and gibi tested it
15:30:52 gmaan yeah, i know. just saying
15:31:55 sean-k-mooney ack we can stage thigns ready for gibi to +w on monday if we think its otehrwse ready adn he can do a final test if they have time
15:32:11 gmaan i asked gibi also but can we publish the testing results (if you can upload yours) somewhere, as we will not be testing it in upstream, it will be good ref to know what is tested and working fine
15:32:23 sean-k-mooney im almost done with the cybrog things i need to do today so ill be starting on the tdx review again in a bit
15:32:38 antia logs of my tests (but this is before the most recent changes): https://paste.openstack.org/show/bdbleKLLworBpma70kXB/
15:32:48 gmaan not sure where we can share as permanent doc
15:33:07 sean-k-mooney antia: but that does not actully should you checkign theat secure boot was enabled in the guest os image
15:33:14 sean-k-mooney and tha tit booted with that
15:33:24 gmaan i was thinking to have some doc existing in Nova repo with all testing you did. not detail maybe
15:33:52 sean-k-mooney we proably shoud nto merge that
15:33:56 antia sean-k-mooney: Ah that is true! I can do some more testing after the weekend
15:34:06 sean-k-mooney unless it written as a guide to testing
15:34:25 sean-k-mooney gmaan: we have similar guide for some numa stuff
15:34:59 sean-k-mooney gmaan: so somethign like https://github.com/openstack/nova/tree/master/doc/source/contributor/testing
15:35:01 gmaan sean-k-mooney: ++ yeah. i did not check numa one but yes guide to test/results
15:35:23 sean-k-mooney well i dont thinik we should comemit one off results
15:35:23 gmaan yup, kind of this
15:35:39 sean-k-mooney but we can commit docs of how to test it manually properly
15:35:40 gmaan at least, which one worked or not
15:36:22 sean-k-mooney so of this is going to end up automated later in whitebox/tempest too
15:37:00 sean-k-mooney the system gibi borrowed may eventully end up geting used to test this perodicily downstream
15:37:11 gmaan ++ for tempest/whitebox testing but if we have some 3rd party CI to run them somewhere
15:37:54 sean-k-mooney we kind of do. righ tnow we are not allwoe do report reuslt publicly because of infra info discustore risks
15:38:21 sean-k-mooney gmaan: we have internal nightly master job for cybrog
15:38:22 gmaan anyways, let's start with similar doc first, antia are you ok to push something next week. I am saying that is blocker for series to merge but good to have when we are merging it
15:38:38 sean-k-mooney we shoudl be able to do the saem for TDX in the coming weeks
15:38:42 sean-k-mooney not a blocker for the feature
15:38:46 gmaan yeah
15:39:03 sean-k-mooney jsut fyi that we hope to have that in place proably before the year is up
15:39:47 sean-k-mooney we are still exploring options for public third party ci bu thats complicated
15:39:53 antia would it be a document about TDX testing in https://github.com/openstack/nova/tree/master/doc/source/contributor/testing?
15:41:24 sean-k-mooney yes so like https://github.com/openstack/nova/blob/master/doc/source/contributor/testing/serial-console.rst
15:41:30 sean-k-mooney or the numa one
15:41:46 antia something like that I can fix
15:41:46 sean-k-mooney basiclly it woudl explain how to verify the feature is workign corectly
15:42:13 sean-k-mooney antia: i would keep that as a follwup patch provided that works for gmaan
15:42:36 gmaan yeah, works for me at the end of series. do not change existing series
15:42:46 antia sounds good
15:42:53 gmaan thanks
15:43:06 antia have a nice weekend all, and thanks for reviewing!
15:43:21 gmaan have a nice weekend antia
15:43:22 gmaan sean-k-mooney: I am not sure you are planning to go through series today but I will be able to do during end of my day. I will leave the merge things until gibi or you recheck. we still have 1 week before FF
15:44:27 sean-k-mooney im going to be aound for another hour or two
15:44:37 sean-k-mooney im trying to complete the cybrog nvme serise first
15:44:43 sean-k-mooney then loop back to this after
15:44:54 gmaan ack
15:45:05 sean-k-mooney the os-triats question above was we have a depency on the new os-trait release in that

Earlier   Later