| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-08-26 | |||
| 14:53:28 | sean-k-mooney | melwitt: we are expcting to update this code again after the sdk release too right | |
| 14:53:44 | sean-k-mooney | so we can defer those topic to that patch or a followup | |
| 14:54:23 | melwitt | sean-k-mooney: you mean the keystoneauth release? yeah although I think I see that got released this morning | |
| 14:55:24 | melwitt | it's not in upper-constraints yet though so I think we can't use yet | |
| 14:57:20 | melwitt | sean-k-mooney: yeah I mean AFAICT we do need 3 options in get_sdk_adapter (I replied on the review) so I'm not sure there is a cleaner way to do it | |
| 14:59:27 | melwitt | for manila, do we know we want to send service tokens along with it too? I wondered if it is intentional that it does not today | |
| 14:59:37 | sean-k-mooney | yes | |
| 14:59:45 | sean-k-mooney | infact orginally we didnt want to merge it without it | |
| 14:59:54 | melwitt | oh, interesting | |
| 15:00:31 | sean-k-mooney | there were issue with doing that at the teim becuase there was no end ot end example of using service tokens wiht the sdk | |
| 15:01:02 | sean-k-mooney | basiclly we shoudl always send service user tokens if we can to prevent token exeriation issues | |
| 15:01:02 | melwitt | ah, gotcha | |
| 15:02:50 | gmaan | gibi: ack and thanks | |
| 15:03:06 | gmaan | gibi: no eventlet meeting today right/? | |
| 15:03:20 | gmaan | i did not find in my calendar this week | |
| 15:04:16 | stephenfin | melwitt: I'm only reading the scrollback now, but https://review.opendev.org/c/openstack/requirements/+/1002461 is winding it's way through the gate | |
| 15:04:35 | melwitt | stephenfin: a-ha cool | |
| 15:05:06 | stephenfin | Also, you probably saw this in the scrollback but these are the docs I wrote on using service token with SDK a few years back https://review.opendev.org/c/openstack/openstacksdk/+/893505 | |
| 15:05:20 | melwitt | so yeah when that lands IIUC we could update the sdk patch to require 5.16.0 and remove the workaround wrapper | |
| 15:05:36 | melwitt | oh, yes thanks | |
| 15:05:59 | stephenfin | As I noted, I recall Uggla wasn't able to get it working. I did some testing and it turns out your KSA patch was the missing part 😄 | |
| 15:06:13 | stephenfin | *And I also noted that | |
| 15:06:14 | melwitt | ahh yeah | |
| 15:07:49 | stephenfin | and yeah, once the requirements patch merges, we could tweak your patch to bump the ksa version and drop the local workaround | |
| 15:08:19 | melwitt | sean-k-mooney: thanks for the +W. I think that is safer to merge as-is first and then I do a follow on patch to bump the ksa version and drop the workaround JUST in case it does not work | |
| 15:08:21 | stephenfin | or we can just merge it as-is now and fix it in a follow-up. I'm okay with either. If you or sean-k-mooney want to do the former, feel free to carry my +2 forward | |
| 15:08:25 | gibi | gmaan: right no eventlet meeting today | |
| 15:08:35 | stephenfin | okay well that solves that :) | |
| 15:08:47 | gmaan | ok | |
| 15:09:37 | sean-k-mooney | stephenfin: no i +w'd as is just noting that 3 probaly is an existing bug | |
| 15:09:51 | sean-k-mooney | stephenfin: but being an exsting bug we should fix it as such later | |
| 15:11:32 | gmaan | gibi: melwitt: I am not sure if dansmith will be able to re-review it but we need to merge it as FF is approaching. melwitt if you can check this? or gibi can +w https://review.opendev.org/c/openstack/nova/+/1000211 | |
| 15:12:02 | gmaan | gibi: melwitt and doc change which i updated as per feedback and replied on other comments, please check https://review.opendev.org/c/openstack/nova/+/997141/13 | |
| 15:13:35 | melwitt | gmaan: yeah I think dansmith will not be able to re-review today, I can do it | |
| 15:13:45 | gmaan | melwitt: thanks | |
| 15:13:57 | gibi | I will check those tomorrow my morning | |
| 15:14:08 | gmaan | ack, thanks | |
| 15:14:09 | gibi | and add some +w if needed | |
| 15:14:15 | gmaan | ok | |
| 15:14:43 | gmaan | thanks for review on the bug fixes, let me check your comment today and fix but I see things are merging at least | |
| 15:15:06 | gibi | yeah we merged some TDX patches | |
| 15:15:27 | gmaan | yeah i saw those very first thing in morning :) | |
| 15:15:45 | sean-k-mooney | about half | |
| 15:15:57 | sean-k-mooney | i saw gibi already rechecked the failures | |
| 15:16:02 | gibi | yep | |
| 15:16:07 | gibi | I'm keeping an eye of that series | |
| 15:16:22 | gibi | a/of/on/ | |
| 15:16:25 | gmaan | yeah, will continue in my TZ | |
| 15:17:07 | sean-k-mooney | i assume we will apply our normal rules, if its +2w'd before FF we can recheck without a FFE until monday if requried | |
| 15:17:18 | sean-k-mooney | then talk about it in the meeting | |
| 15:18:04 | melwitt | that is my understanding | |
| 15:18:23 | sean-k-mooney | as an aside obviously wont be around friday but ill be off on monday as well | |
| 15:18:38 | melwitt | same for me | |
| 15:18:44 | gibi | I can do some recheck on Friday too | |
| 15:20:50 | Uggla | Upstream bug triage in ~10mn (I not prepared) | |
| 15:20:53 | stephenfin | sean-k-mooney: melwitt: Is there any time we *shouldn't* be sending service tokens when talking to other services? | |
| 15:21:09 | stephenfin | I assume not, but just checking in case I've missed something | |
| 15:21:30 | sean-k-mooney | stephenfin: my understanding is only if its not configured in the config or explcitly disabled in teh config | |
| 15:21:53 | sean-k-mooney | stephenfin: but nova requries them to be able to talks to cidner and manage attachment | |
| 15:21:57 | sean-k-mooney | and to cybrog | |
| 15:22:12 | sean-k-mooney | so i think we shoudl expect that its more or less alwasy configured | |
| 15:22:45 | melwitt | yeah I remember we had to require it for cinder, for deleting attachments | |
| 15:22:46 | gmaan | stephenfin: sean-k-mooney we should always, i know we had a temporary config option not to send it but that was added only for transition purpose and suppose to be removed (which did not happen) | |
| 15:22:53 | Uggla | link: meet.google.com/zjr-rxus-hzj (triage) | |
| 15:23:11 | gmaan | Uggla: in horizon meeting, might be little late | |
| 15:23:17 | sean-k-mooney | melwitt: ya so eventully we shoudl not require the service token to talk to cinder and cybrog | |
| 15:23:25 | Uggla | gmaan nw | |
| 15:23:29 | sean-k-mooney | but that requries chagne to nova and cinder | |
| 15:23:53 | sean-k-mooney | we abused the service token for security to close cves | |
| 15:24:27 | melwitt | what's the alternative? nova service user only or? | |
| 15:24:35 | sean-k-mooney | but nova shoudl eventually all nova iwth its own token with the service role instead and use the 2.1 microversion instead of 2.0 to bind/unbind ARQs | |
| 15:25:21 | sean-k-mooney | melwitt: yes exactly nova shoudl use its own token (with the service role) to do the privdage service ot service calls | |
| 15:25:26 | elodilles | Uggla: will there be an Upstream bug triage meeting today? | |
| 15:25:34 | melwitt | ok, yeah. I had to set that up with vtpm live migration "deployment" mode although we did not end up usingi t | |
| 15:25:51 | Uggla | elodilles yes | |
| 15:26:11 | elodilles | Uggla: sorry, forgot to scroll o:) just a heads up: i don't have any update, but i'll listen in o:) | |
| 15:26:28 | Uggla | elodilles no worries. | |
| 15:26:55 | melwitt | same, no update from me | |
| 15:31:31 | stephenfin | sean-k-mooney: I thought the point of the additional service token was for long-running operations? Isn't Nova's token (with or without the service role) subject to the same issue? | |
| 15:31:49 | stephenfin | Or do we assume a token is minted each time so that shouldn't ever happen? | |
| 15:33:21 | opendevreview | Leo Jenkins proposed openstack/nova-specs master: Support for Hostname-based Ceph Mon References https://review.opendev.org/c/openstack/nova-specs/+/1000098 | |
| 15:33:34 | sean-k-mooney | stephenfin: it is but the service user tokens are never cached and reused we create them on every request (where we dont share the client instnatce) | |
| 15:34:17 | sean-k-mooney | stephenfin: basiclly if the dest compute needt to call cinder to compelte the volume attachment on a live migration | |
| 15:34:29 | sean-k-mooney | it will use the user token for that and generate a new service token at that point | |
| 15:34:55 | sean-k-mooney | so the user token coudl be long expired at that point but the service user token will be freshly issued for that request | |
| 15:35:41 | sean-k-mooney | so the primay usecase for the service_user token is lifetime exstension of the users token | |
| 15:37:42 | sean-k-mooney | stephenfin: since the service_user token is alwasy created form config we can alwasy mint a new one when required as well | |
| 15:42:24 | stephenfin | Okay so "Or do we assume a token is minted each time so that shouldn't ever happen?" is the case | |
| 15:42:31 | stephenfin | fair enough | |
| 16:05:59 | opendevreview | sean mooney proposed openstack/placement master: bump min version of os-traits https://review.opendev.org/c/openstack/placement/+/1002526 | |
| 16:07:03 | sean-k-mooney | ^ that bumps to 3.9.0 with the NVME and TDX traits | |
| 16:07:29 | sean-k-mooney | previous min was 3.3.0 | |
| 16:08:50 | gibi | we bumped on the nova side but not on the placemnet side | |
| 16:08:53 | gibi | thanks Se | |
| 16:08:55 | gibi | Sean | |
| 16:09:49 | sean-k-mooney | on the cybog side we will need 3.9.0 if i end up merging the nvme driver but currently testing it so it might slip but it wont need nova's min to change | |
| 16:10:19 | sean-k-mooney | we also need to supprot older placemeent anyway but its nice to have a standard set of traits for any given release | |
| 16:20:10 | opendevreview | Balazs Gibizer proposed openstack/nova master: Lock on DB url in functional test https://review.opendev.org/c/openstack/nova/+/1002529 | |
| 16:20:53 | gibi | sean-k-mooney: melwitt: gmaan: here is a gate fix (and it parents) to look at ^^ | |
| 16:21:43 | gmaan | gibi: nice, will check | |