| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2026-09-04 | |||
| 18:59:01 | sean-k-mooney | sure but for nova rbd driver we mostly use the same cephx key | |
| 18:59:07 | sean-k-mooney | technially it can vary per host | |
| 18:59:14 | sean-k-mooney | but i dont really knwo of any installer that does that | |
| 18:59:37 | sean-k-mooney | we just use a single nova key on all compute nodes | |
| 19:00:32 | sean-k-mooney | so using shared ceph keyrings between host is not generally a sefutiy issue but i dont really have an object to hardening | |
| 19:01:06 | dansmith | I'm not sure our bad behavior is a justification to do it badly.. but those ceph shares are less user-visible than these I think | |
| 19:01:20 | dansmith | and the current implementation sort of can't even track which hosts should and should not have access to a share as a result | |
| 19:01:44 | sean-k-mooney | ack as i said i have no real issue with hardenign | |
| 19:01:58 | sean-k-mooney | jsut notign that it not the same as nova provisend rbd voluems | |
| 19:02:11 | sean-k-mooney | i think for cidner we are given a cephx key in teh conenciton info to ues | |
| 19:02:16 | sean-k-mooney | possibel per voluem? | |
| 19:02:50 | sean-k-mooney | and as i said ther is nothign prventign you minting a per host key for images_type=rbd today | |
| 19:03:21 | sean-k-mooney | but ya as you said if you have escaped to the host your already have other compomise vector to worry about | |
| 19:07:07 | sean-k-mooney | for the peroupus of share attachment the client of the sheare was desiged to be nova rather then the instnace | |
| 19:07:47 | sean-k-mooney | the same way as nova is the sincel client for ceph voleusm for images_type=rbd | |
| 19:07:53 | dansmith | that's how the code is designed now, but I think that was probably wrong | |
| 19:08:26 | sean-k-mooney | it depend on your pesertive of who own the expore the end user or nova | |
| 19:08:35 | sean-k-mooney | if its nova which is howe we desgiend it its correct | |
| 19:08:40 | dansmith | treating all of nova as a single unit is a bad idea, whether it be shares, volumes, access to the MQ or DB, etc.. in 2010 I think that was a lot more normal but today it seems verging on irresponsible to me | |
| 19:08:48 | gouthamr | ++ | |
| 19:08:58 | sean-k-mooney | if its the end user then the cephex key shoudl be in barbican liek cinder encyption keys | |
| 19:09:49 | sean-k-mooney | right as i said im oke with hardenign but that feels mroe like a security feature then soemthign we would activly backport | |
| 19:10:02 | gouthamr | cephfs != rbd, for RBD, cephx is one of several layers. For a CephFS share, the cephx access rule is the access-control layer.. | |
| 19:10:09 | dansmith | it is and you could surely argue that it's not backport-worthy IMHO | |
| 19:10:35 | gouthamr | even there though, we could make a better choice than having a single shared credential, imo.. | |
| 19:11:01 | sean-k-mooney | gouthamr: we dont require it to be shared in nova today taht up to the installer | |
| 19:11:02 | melwitt | so are we thinking a separate patch for the ShareMappingList.get_share_ids_for_host() to go in front of the reconcile patch? | |
| 19:11:27 | gouthamr | melwitt: i'll fold it in.. | |
| 19:11:37 | melwitt | to try and minimize churn on the reconcile? ok | |
| 19:11:48 | gouthamr | sean-k-mooney: ack, yes, but in this case, it's hardcoded so worse :( | |
| 19:12:12 | gouthamr | melwitt: it was the last patch in the series, so i can fix it up in isolation :) | |
| 19:13:31 | gouthamr | dansmith: i'm exploring psutil.disk_partitions.. i see its being used by quobyte: https://opendev.org/openstack/nova/src/branch/master/nova/virt/libvirt/volume/quobyte.py#L112 | |
| 19:14:04 | dansmith | gouthamr: aha, nice | |
| 19:14:06 | gouthamr | dansmith: it solves my problem of not hemorrhaging on an inaccessible hard mount | |
| 19:16:13 | dansmith | so realistically here.. unfortunately monday is a holiday for many of us | |
| 19:16:29 | dansmith | I wish Uggla was around but I assume merging this on tuesday is pretty dang late | |
| 19:16:48 | dansmith | I almost wish melwitt had been less of a responsible person and sent the bottom patches to the gate already :) | |
| 19:17:54 | sean-k-mooney | so realsticlly , we cut rc1 without this next week, we can still merge this on master it just will be for next cycel if we reapprove the spec | |
| 19:18:14 | sean-k-mooney | and we can repprose that already | |
| 19:18:26 | dansmith | I have no plans for this weekend other than recharging my brokenness.. I'm not really up for reviewing tomorrow but I guess I could come back later today if it happens that it's all ready | |
| 19:19:21 | dansmith | but it's feeling pretty rushed for sure | |
| 19:20:22 | melwitt | I can also review if updated today | |
| 19:21:11 | melwitt | and I can check up on it over the weekend | |
| 19:21:46 | gouthamr | from my (probably biased) vantage point, the reconciliation of rules because we're trying not to wedge instances on cold migration is good hardening.. cold migration will be used no doubt if we shipped this even without the reconciliation - but, we're doing this right and i wouldn't do it differently.. | |
| 19:22:59 | gouthamr | I know of a few <redacted> clouds that would be happy to have this feature land in H.. but they're all really waiting for a day their can hot-attach cephfs and call it a day - it's killing their cloud right now when person 100001 is coming to them to enable this, and they have to tell them they'd have to roll out their own tenant-scoped ceph cluster | |
| 19:23:16 | dansmith | gouthamr: we also know the reconciliation will not be backportable if it becomes more of a problem than you think | |
| 19:23:24 | gouthamr | yes | |
| 19:23:36 | melwitt | yeah, that's the problem, reconcile would not be backportable | |
| 19:23:53 | dansmith | IME instances wedged in the middle of migrations is not that uncommon so I'm nervous about having no path for cleanup for something users can trigger | |
| 19:24:49 | gouthamr | ack; i'll flush this out and test it and have something for your eyes in a bit.. the psutil change was the simplest :) but, the share mapping object update, i'll deep-test | |
| 19:25:09 | melwitt | that is my experience also. maybe the biggest complaint about nova is stuff stuck in a state requiring manual database intervention to recover | |
| 19:25:16 | dansmith | yup | |
| 19:25:36 | dansmith | gouthamr: okay then I'll take a break for a bit so I can be available for a bit later | |
| 19:25:49 | gouthamr | ack, thank you dansmith! | |
| 19:25:55 | gouthamr | same, melwitt and sean-k-mooney! | |
| 20:07:02 | opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | |
| 20:07:03 | opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Only load same-host instances when checking share usage https://review.opendev.org/c/openstack/nova/+/1004057 | |
| 20:39:42 | gouthamr | s | |
| 21:10:35 | dansmith | melwitt: looks okay to me | |
| 21:16:25 | gouthamr | dansmith: do you mind me folding follow up comments into a single commit post these merging | |
| 21:16:39 | gouthamr | like a low-risk follow up that'll land next week? | |
| 21:16:48 | dansmith | which comments? | |
| 21:17:22 | gouthamr | you're right about "is_mounted()".. it's a mount path that we're check | |
| 21:17:25 | gouthamr | checking* | |
| 21:17:35 | dansmith | oh yeah that's why I said "not critical to fix right now" | |
| 21:18:07 | gouthamr | ++ ack, ty will watch for melwitt's comments as well | |
| 21:39:29 | melwitt | will be looking | |
| 21:42:14 | gmaan | dansmith: thanks for review on task tracking fix, I replied to your commment https://review.opendev.org/c/openstack/nova/+/1003386/comments/25784b40_6a5b7aad | |
| 21:42:27 | gmaan | if we are ok to do RPC versioning bupm, | |
| 21:43:22 | gmaan | * RPC version bump, then i can add a new RPC cast to end the task which will not impact the dest rollback for old compute mixed env | |
| 21:43:55 | gmaan | I was thinking to handle that generacally in part-3 | |
| #openstack-nova - 2026-09-05 | |||
| 01:04:32 | opendevreview | Ghanshyam Maan proposed openstack/nova master: Fix the test_migrate_disk_and_power_off_crash_finish_revert_migration https://review.opendev.org/c/openstack/nova/+/1003910 | |
| 01:16:20 | opendevreview | Ghanshyam Maan proposed openstack/nova master: [func test]Catch hanging task at graceful shutdown https://review.opendev.org/c/openstack/nova/+/1003266 | |
| 01:43:01 | opendevreview | Ghanshyam Maan proposed openstack/nova master: Reduce the unnecessary executors shutdown logs in test jobs https://review.opendev.org/c/openstack/nova/+/1004160 | |
| 01:44:51 | gmaan | gibi: ^^ i saw there were lot of threadpool factory logs in functional threading jobs, fixing it ^^ | |
| 02:11:01 | opendevreview | Ghanshyam Maan proposed openstack/nova master: Reduce the unnecessary executors shutdown logs in test jobs https://review.opendev.org/c/openstack/nova/+/1004160 | |
| 05:46:34 | opendevreview | Merged openstack/nova master: Use a per-instance cephx identity for CephFS shares https://review.opendev.org/c/openstack/nova/+/1001900 | |
| 22:37:16 | opendevreview | Merged openstack/nova master: Extract share management from ComputeManager https://review.opendev.org/c/openstack/nova/+/999349 | |
| #openstack-nova - 2026-09-06 | |||
| 02:29:29 | opendevreview | Merged openstack/nova master: Support cold migration with virtiofs shares https://review.opendev.org/c/openstack/nova/+/989633 | |
| 19:45:49 | opendevreview | Ivan Anfimov proposed openstack/os-vif master: Fix typo https://review.opendev.org/c/openstack/os-vif/+/1004326 | |
| 19:46:37 | opendevreview | Ivan Anfimov proposed openstack/os-vif master: Fix typo https://review.opendev.org/c/openstack/os-vif/+/1004326 | |
| 20:23:29 | opendevreview | Merged openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | |
| 21:02:47 | opendevreview | Merged openstack/nova master: Only load same-host instances when checking share usage https://review.opendev.org/c/openstack/nova/+/1004057 | |
| 23:51:20 | opendevreview | Ivan Anfimov proposed openstack/os-vif master: Fix typos https://review.opendev.org/c/openstack/os-vif/+/1004326 | |
| #openstack-nova - 2026-09-07 | |||
| 07:12:27 | opendevreview | Kamil Sambor proposed openstack/nova master: Replace StaticallyDelayingWrapper with futurist DelayingExecutor https://review.opendev.org/c/openstack/nova/+/997410 | |
| 08:17:38 | opendevreview | HyungJoon Kim proposed openstack/nova master: Add regression test for bug #2166652 https://review.opendev.org/c/openstack/nova/+/1004388 | |
| 08:48:36 | gibi | stephenfin: Uggla: do we need to bump the min version of os-vif in nova to 5.2.1? https://github.com/openstack/nova/blob/master/requirements.txt#L54 | |
| 10:06:17 | stephenfin | gibi: Unless we need some particular feature that was added recently, I don't think we have to. The packaging issues was only present in 5.2.0 which won't get dragged in by default | |
| 10:07:46 | stephenfin | 3.1.0 is nearly 4 years old https://pypi.org/project/os-vif/3.1.0/ There's a high possibility it doesn't actually work, but we could likely say the same about a lot of our minimums? | |
| 10:08:28 | stephenfin | So maybe we could bump that, or maybe we should just go and bump to the latest major version (X.0.0) for all our deps? idk | |
| 11:10:13 | opendevreview | HyungJoon Kim proposed openstack/nova master: Sort claimed PCI devices by host PCI address https://review.opendev.org/c/openstack/nova/+/1004411 | |
| 11:33:35 | opendevreview | Merged openstack/os-vif master: Fix typos https://review.opendev.org/c/openstack/os-vif/+/1004326 | |
| 12:55:11 | Uggla | gouthamr, dansmith, melwitt well done for the virtiofs cold migration! 👍 | |
| 13:17:58 | opendevreview | Emma Foley proposed openstack/placement master: [pyproject] Update setuptools config https://review.opendev.org/c/openstack/placement/+/1004418 | |
| 13:18:02 | sean-k-mooney | Uggla: an fyi we may need to fix one packaging issue in placement before we cut rc1 ^ | |
| 13:18:14 | sean-k-mooney | or do an RC2 if we have already done that | |
| 13:18:44 | sean-k-mooney | emma basiclaly is portign the same fix that stephenfin did for nova https://github.com/openstack/nova/commit/3881260b1cb179cd0f8bb2a37282325a5f5fb24a | |
| 13:22:25 | sean-k-mooney | i also fixed this in cybrog watcher as well | |
| 13:22:48 | sean-k-mooney | we shoudl proably check all the pyproject.tomls for this | |
| 13:23:39 | sean-k-mooney | looks like os-vif might be impacted as well https://github.com/openstack/os-vif/blob/master/pyproject.toml#L40-L46 | |