Thursday, 2025-12-11

*** mhen_ is now known as mhen02:09
opendevreviewMarkus Hentsch proposed openstack/glance-specs master: Re-propose image encryption spec  https://review.opendev.org/c/openstack/glance-specs/+/96475509:21
opendevreviewMarkus Hentsch proposed openstack/glance master: Standardization of encrypted images  https://review.opendev.org/c/openstack/glance/+/92629510:16
fricklercroelandt: https://review.opendev.org/c/openstack/glance/+/963294 could use another nudge :)10:50
croelandtfrickler: ok I'll mention this in today's meeting in 2 hours11:55
croelandtsee if Abhishek can take a look11:55
croelandtotherwise I'll merge it tomorrow :)11:56
LuziHi I am currently trying to test a db migration in glance. I have the migration script and the 'db migrate' output says: 'Migrated 3 rows'.13:25
LuziThe number is correct, but it somewhow doesn'T show up in my database. Can anyone think of a reason for this?13:25
LuziI am testing on a simple devstack13:26
opendevreviewJosephine Seifert proposed openstack/glance master: migrate cinder_encryption* to os_encrypt* in db for Image Encryption  https://review.opendev.org/c/openstack/glance/+/92690513:34
Luzi^ that is the migration that seems to work, but somehow doesn't13:35
croelandthey hey hey14:00
croelandtGlance meeting, sick PTL edition, let's go14:00
croelandt#startmeeting glance14:00
opendevmeetMeeting started Thu Dec 11 14:00:45 2025 UTC and is due to finish in 60 minutes.  The chair is croelandt. Information about MeetBot at http://wiki.debian.org/MeetBot.14:00
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.14:00
opendevmeetThe meeting name has been set to 'glance'14:00
croelandt#topic roll call14:00
croelandto/14:00
mheno/14:00
Luzio/14:00
croelandtrosmaita: are you around?14:02
croelandtabhishekk: are you around?14:04
flelain_35o/14:04
abhishekko/14:04
rosmaitao/ (though in another meeting)14:05
croelandt#topic  Release/periodic job updates14:06
croelandtAll good!14:06
croelandt#topic operator-required image properties (rosmaita)14:06
croelandtrosmaita: you have the floor, leave the other meeting14:06
rosmaitai want to make sure that the project team is cool with this proposal14:07
croelandtwhat's the big picture here?14:07
rosmaitathe original design was that the image schema would be operator-extensible14:07
rosmaitai don't know if anyone uses that14:07
rosmaitaanyway, the patch proposer was looking for a way to make some image properties mandatory for his cloud14:08
rosmaitaand used a list config option14:08
rosmaitai suggested using the schema instead and making the properties required14:08
rosmaitathat way, an end user can discover these properties14:08
croelandtWe have so much stuff that may or may not be used14:09
croelandtThis always surprises me14:09
croelandtevery month I come across a feature I did not know about14:09
rosmaitaso the infra people *hate* this feature14:10
rosmaitabecause it makes all clouds different14:10
rosmaitabut variety is the spice of life14:10
croelandtso I don't think we can remove it14:10
croelandtit seems people actually use it14:10
croelandtnow changing the way it works (while keeping backwards compatibility) is something that should have been discussed at PTG14:11
rosmaitaok, cool ... so then the next thing is that it needs to function properly14:11
croelandtor at least requires a spec14:11
croelandtis there one?14:11
rosmaitanot sure this would need a spec, it's more of a bug that it doesn't work out of the box14:12
rosmaitaanyway, take a look at my comments on PS1 of https://review.opendev.org/c/openstack/glance/+/96996714:12
croelandthm it does define a new format, right?14:12
rosmaitano14:13
croelandtoh no it's teh same format14:13
croelandtbut parsed properly?14:13
rosmaitathat's the way i see it14:13
croelandtok so that is quite different14:13
croelandtso that is basically a no brainer here14:14
croelandtif we're not parsing the format we're documenting, this is a bug14:14
rosmaitaok, leave a comment on the patch to file a bug (the author can basically copy text from the commit message)14:16
rosmaitathat's all from me14:16
croelandtand I mean we *must* fix it14:16
croelandtthanks for bringing this up14:16
croelandt#topic image encryption (mhen, Luzi)14:17
croelandtmhen: you are up14:17
croelandtLuzi: you too :)14:17
mhencouple small updates14:17
mhenabhishekk asked us to summarize the PTG results in the spec; I added this to the "Security impact" section14:17
mhenon https://review.opendev.org/c/openstack/glance-specs/+/96475514:17
mhendansmith also did a review on it, which I responded to14:18
mhenin the main patchset I added user documentation and an adjustment for the image conversion import plugin to correctly reject encrypted images as per spec14:18
mhenmain patchset: https://review.opendev.org/c/openstack/glance/+/92629514:19
mhenif anybody could review especially those added parts, I'd really appreciate it14:19
croelandtso are we exactly clear on what needs to be done across all OpenStack projects?14:20
mhenI mean we have both the specs and already implementation patchsets for it14:20
mhenthe only thing that is still in the open is future usage in Nova for directly booting instances, i.e., encrypted ephemeral storage from those imagesg14:21
mhenbut the spec already mentions that14:21
mhenbut usage in Glance and Cinder is both described in specs as well as already implemented as patchsets14:22
croelandtso I don't want to end up merging something in Glance that then needs to be modified because Nova has different needs14:22
croelandtthat is my concern14:22
mhenin Nova, the implementation patchset only covers the usage of resulting Cinder volumes for now, as ephemeral storage encryption is not ready on their side yet14:22
croelandthm, ok14:23
mhenmy interpretation of the PTG session is that we agreed on things that will make sure Nova can simply base on it later14:23
mhenat least dansmith was heavily involved in the discussion14:23
croelandtok14:25
croelandtso yes, we could do another pass on the review14:25
LuziIn addition to the updated spec and patches, I rebased and updated the db migration patch: https://review.opendev.org/c/openstack/glance/+/92690514:25
abhishekkluzi I will have a look at migration patch, (probably tomorrow during my day time)14:26
Luzithank you abhishekk - it would be nice to now, why i don't see the migration in the db14:26
croelandtok, anything else?14:27
mhennot from my side14:27
croelandtLuzi: all good for you as well?14:27
Luziyeah14:27
abhishekkmany of my patches are open, it will be good if we go 14:27
abhishekkdecompression patches before year end14:27
abhishekkand the one property protection related as well, it will help me to move further with eventlet removal14:28
abhishekkALSO are we going to have meetings till new year?14:29
croelandtso14:29
croelandt#topic  One easy patch per core dev (not mandatory :p):14:29
croelandtI had14:29
croelandt#link https://review.opendev.org/c/openstack/glance/+/96329414:29
croelandtfor you abhishekk ^14:30
croelandtfrickler: ^14:30
croelandtand yeah I know I need to re-read the decompression patches14:30
croelandt#topic Open Discussion14:30
croelandtI'll be around next week14:30
flelain_35Hey everyone, I'd like to draw your attention on this spec related to Temp URL generation for image download whatever the object storage backend is (https://review.opendev.org/c/openstack/glance-specs/+/970214)14:30
abhishekk25th is Thursday so that will off14:30
rosmaitacroelandt: what's the idea of this? patches that we are watching, or have reviewed, or merged?14:30
croelandtthen on PTO for the resto f the year14:30
abhishekkcroelandt: I will have a look14:30
flelain_35If possible to tackle it in this section :)14:30
croelandtrosmaita: the idea of what?14:30
flelain_35otherwise as a topic next week14:31
croelandtflelain_35: I can already tell the lines are too long, I'm surprised the CI passes14:31
rosmaitasorry, meant to ask "what is the goal of this section of the agenda?"14:31
croelandtrosmaita: "Open Discussion" is "talk about anything you want" because sometimes people are shy about editing theagenda14:32
croelandtor come up with last minute topics14:32
croelandtwe just want people to not wait for a week because the agenda was not updated14:32
flelain_35croelandt: mhh, we'll have a look at that. Weird the CI did not complain, right!14:32
croelandtflelain_35: temp URLs would be backend specific, right?14:33
rosmaitano, when i asked, the section of the meeting was "#topic  One easy patch per core dev (not mandatory :p):"14:33
croelandt"f store backend does not support temp URL, method would stay unimplemented"14:33
croelandtrosmaita: oh14:33
croelandtyeah the idea is to put one patch you +2ed and think is really easy to review and say "come on, don't be lazy, just go push this"14:33
flelain_35croelandt: yeah, for sure. Now, what else than Swift and S3?14:33
croelandtso don't put the encryption patch in that section14:34
croelandtbut rather a small bug fix, something you can't really ninja approve, but still don't want to rot for 5 years in the queue 14:34
rosmaitacroelandt: ok, thanks14:34
croelandtrosmaita: I expect a link from you in this section next week!14:35
flelain_35croelandt: f store backend?14:35
rosmaitacroelandt: ack14:35
croelandtI'm not good at copy pasting with a mouse so the starting "i" is missing14:35
flelain_35croelandt: ok thx, I understand it now :) yeah, we'd have to handle that on a backend techno basis.14:36
opendevreviewAntonin Ruan proposed openstack/glance-specs master: [spec] Generate temp URL for images in object storage backend  https://review.opendev.org/c/openstack/glance-specs/+/97021414:37
croelandtok14:37
croelandtwe'll take a look at teh spec14:37
croelandtanything else before we close?14:37
rosmaitaflelain_35: my swift knowledge is pretty old, but aren't temp urls kind of insecure?14:37
womaxjust update the line count being wrong at the begining14:37
flelain_35croelandt: we see interesting advantages to go there. DL from nova w/o dealing with creds there, giving Ironic the ability to use S3 as a backend, ...14:37
flelain_35rosmaita: haven't seen anything about that yet. Do you have any ref in mind?14:38
croelandtthat is my concern as well14:38
rosmaitawell, just that anyone with the temp url can download the data14:38
rosmaitathey used to be unrestricted public urls14:39
flelain_35rosmaita/croelandt: that's why it's temporary and useabale only for DL14:39
flelain_35AFAIK Ironic has kept it to operate on its images DL14:40
rosmaitaok, but temporary as in microseconds or minutes14:40
womaxrosmaita: configurable but current default in Ironic is 20 minutes14:40
rosmaitathat's kind of a big window, but i guess i need to read the spec14:41
croelandtyeah gotta figure out the details here14:41
womaxobviously we may figure maximum duration allowed, ig ironic has kind of a large window to let bm server boot properly and url still be valid when needed14:42
womaxbut maybe (at least for if used only for nova behind) it could be reduced without too much problems14:43
rosmaitawomax: do you know what happens to a download in progress if the temp url expires?14:43
womaxno didn't test it specificly and it didn't happen either while I was playing with them14:43
rosmaitait's probably documented somewhere14:44
womaxmy best guess is that as it is an established HTTP connection it would continue14:44
womaxbut that just guessing14:44
rosmaitai suspect you are correct, but i don't know either14:44
rosmaitai can see someone adding a bugfix or feature to swift that could cut off the download, though14:45
flelain_35womax: yeah I do think so too14:46
flelain_35I could add that Ironic project seems to be keen on having such a feature on Glance14:47
rosmaitaso, apologies for being "that guy who didn't read the spec yet", is the goal of proposing this to speed up downloads?14:47
flelain_35rosamaita: first, for us at OVHcloud is give Ironic a way to use S3 as easily as Swift14:48
flelain_35rosmaita: second would be to see Glance as an actual Control Plane node, delegating images DL (and why not UL at some point) to computes - avoiding Glance to be a bottleneck on such flows14:48
flelain_35and w/o spreading backend creds all over the place14:49
croelandtso you currently have a temp url implementation for swift that works with glance store?14:49
rosmaitai'm just wondering whether enhancing the glance cache might be a better way to go14:49
rosmaitacroelandt: it bypasses glance store completely, i believe14:50
flelain_35I believe rosmaita is right14:50
croelandtso why not bypass the glance store for s3 as well?14:51
flelain_35womax: what do you think?14:51
womaxcroelandt: for the time being i only implemented s3 temp url in ironic to match features for swift14:52
womaxi did nothing in glance14:52
rosmaitawell, the problem is that if we modify how the swift glance_store works under the covers, it can easily break ironic14:52
womaxbut for the spec we propse I think, as drivers lives in glance_store update would be need there aswell14:52
rosmaitabecause their tempurl generation depends on how we currently do things14:52
rosmaitaand naming conventions, etc14:52
womaxrosmaita: I think actually ironic does not use glance_sotre for swift14:53
rosmaitayeah, but if we change the way images are stored in swift, ironic is out of luck14:53
womaxit used custom field to define *one* swift store and then tries to download every image from there14:53
womaxactually we would not change how they are stored but only add a way to access it14:53
womaxironic would still works without modification, but changes there would be good to make use of a the new feature14:54
rosmaitawomax: i am not saying you might change things, i am saying that if *we* change things for glance purposes, it could break you14:54
womaxoh ok14:54
womaxI see what you mean, even if I don't really know what kind of change could break compatibility but it may indeed be a problem later on14:55
rosmaitathat's the main reason to put this into glance_store instead of doing it externally, it gives you some assurance that we won't go nuts and improve things for glance but break ironic (or whoever)14:55
*** vhari_ is now known as vhari14:55
croelandtyep, rosmaita is right14:59
croelandtbypassing the store seems a bit fragile14:59
womaxI am not sure to fully understand. As spec does also propose both change to glance_store, to generate temp URL, and change to glance api to access the feature in glance_store15:00
womaxso no store bypassing15:00
womaxbut maybe I did propose it wrong and it should be splitted in a spec for glance_store and then one for glance15:01
flelain_35womax: yes, thx for those details15:01
croelandtto be fair we have not read the spec yet15:02
croelandtso maybe we read it and talk about it again later15:02
croelandthow does that sound?15:02
flelain_35croelandt: sure, and sorry that was a cold pick! :)15:02
womaxcroelandt: sounds good to me15:03
flelain_35croelandt: do you think there's value in breaking down changes we expect for both glance and glance_store?15:03
croelandtthere is value in making it as easy as possible for us to understand15:04
croelandtnow I'm not sure how much the current spec breaks things up15:04
flelain_35croelandt: ok - we're gonna think it through again and I suggest we discuss it again next week15:05
flelain_35Thank you very much!15:06
rosmaitaok, keep in mind that we (glance team) don't know all about how ironic does it, or necessarily approve of the tempurl approach15:06
rosmaitai mean, keep that in mind when explaining your proposal to us15:06
croelandtyeah, OpenStack works very much in silos15:07
croelandtand also, a lot of people are just developers for component X15:07
croelandtwe are not sysadmins running actual OpenStack installs 15:07
croelandtso sometimes actual issues are far from obvious to us15:07
croelandtbut ok, let's talk more next week and let's end this meeting here15:08
croelandtThanks everyone for joining!15:08
croelandt#endmeeting15:08
opendevmeetMeeting ended Thu Dec 11 15:08:13 2025 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)15:08
opendevmeetMinutes:        https://meetings.opendev.org/meetings/glance/2025/glance.2025-12-11-14.00.html15:08
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/glance/2025/glance.2025-12-11-14.00.txt15:08
opendevmeetLog:            https://meetings.opendev.org/meetings/glance/2025/glance.2025-12-11-14.00.log.html15:08
opendevreviewIvan Anfimov proposed openstack/glance-specs master: Remove url tags from README  https://review.opendev.org/c/openstack/glance-specs/+/97069920:46
opendevreviewIvan Anfimov proposed openstack/glance-specs master: Remove url tags from README  https://review.opendev.org/c/openstack/glance-specs/+/97069920:50
vischan2Hello glance team, this is my first patch contribution to glance, so apologies if I am not following the the correct process to request for this. My patch has '+2 Code-Review' on https://review.opendev.org/c/openstack/glance/+/970048. Based on documentation, it appears I need another +2 Code-review (?). If the core team has a moment, can I request for review '+1 Workflow' on this minor patch fix? 22:57

Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!