| *** jlejeune5 is now known as jlejeune | 03:57 | |
| masahito | abhishekk: thanks for the quick review. applied the comment. | 07:02 |
|---|---|---|
| abhishekk | masahito: ack, currently CI is failing so waiting for it to resolve the issue so we can get clean run | 09:02 |
| masahito | abhishekk: got it. thanks for the kindly reply. | 09:04 |
| abhishekk | np, welcome!! | 09:04 |
| opendevreview | Maxim Sava proposed openstack/glance master: ci: Discover S3 credentials for tempest tests https://review.opendev.org/c/openstack/glance/+/997191 | 11:15 |
| abhishekk | #startmeeting glance | 14:00 |
| opendevmeet | Meeting started Thu Aug 20 14:00:58 2026 UTC and is due to finish in 60 minutes. The chair is abhishekk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 14:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 14:00 |
| opendevmeet | The meeting name has been set to 'glance' | 14:00 |
| abhishekk | #topic roll call | 14:00 |
| abhishekk | #link https://etherpad.openstack.org/p/glance-team-meeting-agenda | 14:00 |
| abhishekk | o/ | 14:01 |
| mklejn | o/ | 14:01 |
| abhishekk | PTL is not around and we have no agenda so open for discussion | 14:01 |
| mklejn | perfect timing :D | 14:01 |
| abhishekk | yeah | 14:01 |
| abhishekk | you have anything to highlight? | 14:02 |
| mklejn | ok, so I'm back with topic of splitting api/data in glance. let's just say that this is cursed :) 307 redirect on PUT is dead idea, 2-part protocol is the only way on this one | 14:02 |
| dansmith | o/ | 14:03 |
| abhishekk | ack, I think anyway we need to discuss this in upcoming PTG | 14:03 |
| mklejn | and for host->s3 part, this is possible, but non-trivial. I had to employ surprising amount of tricks to have 95% of draft idea on this one | 14:03 |
| mklejn | ack, yes, topic is huge and needs high bw discussion IMO | 14:04 |
| abhishekk | may be you can list it here, https://etherpad.opendev.org/p/2027.1-ptg-glance-planning | 14:04 |
| mklejn | in the meantime, for next week I'll create etherpad with all of my loose notes rewritten into something paletable | 14:04 |
| abhishekk | ++ | 14:04 |
| mklejn | so I can have at least some initial comments | 14:04 |
| mklejn | abhishekk, ++ for PTG entry | 14:05 |
| abhishekk | good idea | 14:05 |
| abhishekk | we will discuss more next week if needed | 14:07 |
| mklejn | I _think_ that's about it for rough update, if you don't have specific questions or hard blockers -- don't let me detain you :) | 14:07 |
| abhishekk | atm, I have nothing on this | 14:07 |
| mklejn | yes, it will be easier to have proper discussion with file that outlines all ideas/issues | 14:07 |
| abhishekk | exactly | 14:07 |
| mhen | o/ | 14:08 |
| abhishekk | hey | 14:08 |
| abhishekk | I was about to close | 14:08 |
| mklejn | that's it from me then, I'm staying for mhen update because that's also something that we're interested in :) | 14:08 |
| abhishekk | mhen I see there is no progress on cinder blocker yet | 14:09 |
| mhen | there is kinda | 14:09 |
| abhishekk | then I missed it, I saw your detail comment on one patch though | 14:09 |
| mhen | so I dug deeper into the Cinder topic and discovered that they seem to have more fundamental issues right now concerning backing formats in the RemoteFS-based drivers (such as NFS): https://bugs.launchpad.net/cinder/+bug/2164526 | 14:10 |
| mhen | I discussed this in yesterday's midcycle | 14:10 |
| mhen | it seems like it's gonna take a while to get that sorted | 14:10 |
| abhishekk | ack, means we might be moving to next cycle with this | 14:11 |
| mhen | so I asked if we maybe could exclude this category of drivers for now in the image encryption patchset | 14:11 |
| mhen | and they said yes, we could do that | 14:11 |
| abhishekk | like document as know issue or something? | 14:11 |
| mhen | so I will try to push the patchset again | 14:11 |
| dansmith | what does that mean? snapshot is supported but just not for files on NFS? | 14:12 |
| mhen | dansmith: can you elaborate on your question? what do you mean by snapshot? | 14:13 |
| dansmith | this is about uploading snapshots of encrypted volumes, no? | 14:14 |
| mhen | no | 14:14 |
| mhen | not exactly | 14:14 |
| mhen | that is a part of it | 14:14 |
| dansmith | that's not the issue on the cinder side, but what you're saying is we'd be moving forward with encrypted snapshots of everything other than files on NFS...I thought | 14:15 |
| mhen | core problem is, Cinder aims to create an encrypted qcow2 backing file for RemoteFS-based volumes using encryption but once attached to a Nova instance, it gets reformatted as raw LUKS on first use | 14:15 |
| mhen | in the image encryption spec we do not account for encrypted qcow2 in Cinder since we do not expect Cinder to use this format at all currently | 14:16 |
| mhen | depending on which way Cinder will go about fixing this, that assumption might change | 14:16 |
| mhen | and all processes involving transfer between image and volume might need adjustment | 14:16 |
| rosmaita | well, cinder is going to have to continue using qcow2-with-luks-inside because otherwise you can't snapshot volumes on an nfs-based backend | 14:17 |
| dansmith | I guess my point is it seems risky to move forward with implementation stuff that may not apply to the other and require yet more changes.. | 14:17 |
| rosmaita | i think what we could maybe do in cinder is only allow upload as a "regular" luks container | 14:18 |
| dansmith | rosmaita: you mean luks inside qcow2, just as you would LUKS in a raw image, and *not* using qcow2's native luks mode where it's sort of blended, is that right? | 14:18 |
| rosmaita | holy shit, give me a minute to digest that sentence | 14:18 |
| abhishekk | :D | 14:19 |
| mhen | dansmith: no, right now, Cinder uses the qcow2 native LUKS | 14:19 |
| dansmith | um... okay | 14:19 |
| mhen | but that gets overwritten by accident (?) in os-brick | 14:19 |
| mhen | ... making it work for Nova magically | 14:19 |
| dansmith | mhen: ack, okay | 14:19 |
| rosmaita | well, volumes on an nfs based backend are a bit crazy | 14:19 |
| rosmaita | they are sometimes just flat files, and sometimes qcow2 | 14:20 |
| rosmaita | depending on what's happening to them | 14:20 |
| dansmith | mhen: so what is the part of the scheme that is not well-defined.. the glance side described LUKS and qcow2+LUKS, so what about the cinder part is ill-defined specifically? | 14:20 |
| rosmaita | so if on first use, a volume is raw, that's probably what you'd expect | 14:21 |
| rosmaita | but if you snapshot it, it turns into qcow2 | 14:21 |
| rosmaita | but if you delete the snapshot, it may turn back to raw | 14:21 |
| mhen | cinder formats the empty NFS volume with qemu-img as qcow2-native LUKS | 14:21 |
| dansmith | rosmaita: wow. | 14:21 |
| mhen | os-brick on attachment does not recognize the qcow2 header and reformats as raw LUKS | 14:22 |
| mhen | the actual backing file entirely changes type after its first attachment | 14:22 |
| mhen | qcow2 is discarded | 14:22 |
| mhen | look at the bug I linked above | 14:22 |
| dansmith | mhen: I'd sort of hope it wasn't trying to inspect the disk at all and was going based on some volume metadata to know what to do/use :/ | 14:22 |
| dansmith | because...we've seen this movie before | 14:22 |
| mhen | os-brick does not define any encryptor for qcow2+luks | 14:23 |
| mhen | and cinder only says "luks" in metadata | 14:23 |
| * dansmith has yet to get launchpad to load this morning, FWIW | 14:23 | |
| mhen | this maps to the raw LUKS encryptor in os-brick | 14:23 |
| rosmaita | well, i'm not claiming that nfs encryption works, i'm just saying that it's going to have to have the same workflow in nova as un-encrypted nfs volumes | 14:24 |
| mhen | Cinder establishes a format I don't think os-brick and nova are prepared to handle currently | 14:24 |
| rosmaita | or else you can't do snapshots or anything | 14:24 |
| mhen | when Nova crafts the libvirt XML it attaches it as raw LUKS using QEMU definitions | 14:24 |
| mhen | so if Cinder wants to actually make use of the qcow2 it tries to establish, I think it needs extension for this in os-brick and Nova | 14:25 |
| rosmaita | well, i really wish that no one had had the bright idea to use nfs to represent block storage devices | 14:26 |
| mhen | https://opendev.org/openstack/os-brick/src/commit/379b7a5fe27ee22148fe48b68c454059485b8ec9/os_brick/encryptors/luks.py#L190-L195 | 14:26 |
| dansmith | yeah, that's what I'm saying - brick should be looking at some communicated detail about the format of the file and not trying to guess for sure.. if LUKS is already being communicated (to mean regular LUKS) then surely it's as "simple" as just adding another format | 14:26 |
| * abhishekk need to go afk urgently, making chair to rosmaita so that he can end the meeting once discussion is over | 14:27 | |
| rosmaita | why pick on me? | 14:27 |
| abhishekk | #chair rosmaita | 14:27 |
| opendevmeet | Current chairs: abhishekk rosmaita | 14:27 |
| rosmaita | :D | 14:27 |
| abhishekk | you can end this quickly :D | 14:27 |
| * abhishekk going afk, thank you and sorry!! | 14:27 | |
| mhen | the link shows the code in os-brick that makes the reformat happen and silently fixes the thing, making it usable in Nova | 14:27 |
| mhen | anyway, for the image encryption we'd need to limit the implementation to backends that use raw LUKS currently, excluding the RemoteFS-based ones | 14:29 |
| rosmaita | mhen: are you still hoping to land this in H ? | 14:30 |
| mhen | I have my doubts tbh | 14:30 |
| dansmith | honestly I can't see how it would happen at this point | 14:31 |
| mhen | I will need to place some safeguards in the Cinder patchsets and then push it again | 14:31 |
| rosmaita | we need to spend some time on this at the PTG | 14:31 |
| rosmaita | we do have cinder-tempest-plugin tests around encryption | 14:32 |
| rosmaita | and i believe they run as part of the nfs job | 14:32 |
| mhen | I have a hunch we will need a PTG session with Nova, Cinder and os-bricks folks for the backing format topic | 14:32 |
| rosmaita | but, i don't know if we have a scenario that goes deep enough | 14:32 |
| rosmaita | mhen: i think we need a working group so people actually spend time looking into this before the PTG | 14:33 |
| mhen | who is able to organize this? | 14:33 |
| rosmaita | well, it can be informal | 14:34 |
| rosmaita | it would be good to have some checkpoints | 14:34 |
| rosmaita | because the tempest tests i mentioned have come up before, but i don't think anyone has had/made time to actually check | 14:34 |
| rosmaita | mhen: when you say "who is able to organize", do you mean "who has time to organize" or "who is the appropriate person to organize"? | 14:35 |
| mhen | both | 14:36 |
| mhen | haha | 14:36 |
| rosmaita | i was thinking you :D | 14:36 |
| mhen | would it help if I were to sent a message to the ML, describe the topic briefly (with link to the bug) and some questions to be answered? | 14:36 |
| rosmaita | i think that would help ... we need to get melwitt in on this discussion, she has done a lot of work fixing some nfs-related issues in nova | 14:37 |
| rosmaita | hopefully, not so long ago that she's forgotten the details | 14:37 |
| mhen | would be good if some TC folks or PLs could push my ML entry then, I dunno how much weight it carries coming out of nowhere from some random guy | 14:39 |
| dansmith | uh, more weight than random TC or PTL members :) | 14:39 |
| rosmaita | i think you are hardly a random guy, you have been working on this for like 5 years | 14:39 |
| dansmith | there's no "stick" approach to success here | 14:40 |
| mhen | okay, I will try | 14:40 |
| rosmaita | you can begin the message, "I have been working on this for over 5 years now, and we have hit one more major issue we need to figure out before landing this feature" | 14:41 |
| rosmaita | "Please help me get this figured out so we can finally land it in Indri" | 14:42 |
| rosmaita | anything else? (I need to get my dog outside, she got into something, and her stomach is making weird noises) | 14:44 |
| mhen | that's all from me | 14:44 |
| rosmaita | ok, thanks ... sorry to dump more work on you, but hopefully we can get this moving | 14:44 |
| rosmaita | by the powers vested in my by abhishekk, i pronounce this meeting closed | 14:45 |
| rosmaita | #endmeeting | 14:45 |
| opendevmeet | Meeting ended Thu Aug 20 14:45:20 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 14:45 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/glance/2026/glance.2026-08-20-14.00.html | 14:45 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/glance/2026/glance.2026-08-20-14.00.txt | 14:45 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/glance/2026/glance.2026-08-20-14.00.log.html | 14:45 |
| melwitt | mhen: yes I think it would be good to make a ML post on the issue and I will reply if I know anything heh | 15:45 |
| mhen | I'm preparing one right now; I think I will post it tomorrow | 15:46 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!