| *** mhen_ is now known as mhen | 01:15 | |
| bauzas | looks like we have a CI pipeline issue :( | 08:16 |
|---|---|---|
| bauzas | Uggla: ^ | 08:16 |
| bauzas | example here https://zuul.opendev.org/t/openstack/build/7626e6d8c1e3423f921fa65667467d64 | 08:17 |
| bauzas | tkajinam: please just add something when you say "recheck", something like "recheck timeout" :)= | 08:17 |
| bauzas | this is fine tho, please don't recheck again | 08:18 |
| Uggla | bauzas, you "recheck" it again ? | 08:26 |
| bauzas | lemme check where we are in the gate for the series | 08:26 |
| bauzas | Uggla: the first patch in the series is fine, and I see the next 3 ones in the check pipeline, so no need to recheck | 08:29 |
| drannou | Hello nova ! Quick question: we would like to harden nova-compute rights, what is the strict minimum right nova-compute needed ? Does anyone already have a specific policy.json ? | 08:30 |
| Uggla | bauzas, I was not sure about the second one. Cool if they are in the pipeline. | 08:39 |
| bauzas | Uggla: as a reminder, you can look at https://zuul.opendev.org/t/openstack/status?change=921814 | 08:39 |
| bauzas | drannou: not sure I understand your question, you're mixing API policies that are public and nova-compute RPC calls that are internal | 08:40 |
| bauzas | or are you talking of the privilege escalation that the nova-compute python service can do ? | 08:40 |
| Uggla | bauzas, yep I know about it. But I was probably too fast and I did not find it at a first glance. | 08:41 |
| drannou | only nova-compute internal API (http) calls, let's imagine that I don't trust the nova-compute hosts (Vm escape), I would like to create dedicated role for nova-comptue with the strict minimum rights on API calls (neutron, glance, cinder, placement). Of course for RPC, I know that we have not "rights" available | 08:42 |
| *** ralonsoh_ is now known as ralonsoh | 08:43 | |
| gibi | bauzas: Uggla: I saw grenade issues wiht | 09:04 |
| gibi | 2025-08-27 17:29:17.139980 | compute1 | /opt/stack/old/devstack/functions-common: line 2189: 30613 Segmentation fault sudo usermod -a -G "$group" "$user" | 09:04 |
| gibi | and general issues with "Error: Failed to update project openstack/nova" | 09:05 |
| gibi | the latter is random in differnt jobs | 09:05 |
| gibi | but I had not time to dig deeper | 09:05 |
| bauzas | this is not on a single job | 09:05 |
| gibi | or file bugs or notifiy infra | 09:05 |
| bauzas | I was about to see the next results | 09:05 |
| bauzas | before calling infra | 09:05 |
| bauzas | maybe some node(s) are having issues | 09:05 |
| bauzas | gibi: I'll continue to follow-up, thanks for your help | 09:06 |
| bauzas | drannou: oh, you're talking of a service persona | 09:06 |
| Uggla | that's really weird to get a segfault on "sudo usermod". | 09:07 |
| bauzas | for nova calling the other serfvices | 09:07 |
| bauzas | drannou: there are good news for you, do you know about something called Secure RBAC ? | 09:07 |
| bauzas | Uggla: I saw that once, IIRC this was due to a tainted kernel | 09:08 |
| bauzas | that's just an user exception when calling sudo, but if you look at the system logs or dmesg, this is clear | 09:08 |
| Uggla | (OO) | 09:08 |
| drannou | bauzas: more (or may be) less :) | 09:18 |
| bauzas | drannou: https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#isolate-service-to-service-apis-to-the-service-role | 09:24 |
| bauzas | drannou: and that's litterally what I'm currently reviewing https://review.opendev.org/c/openstack/nova/+/957578 | 09:24 |
| drannou | bauzas: wonderful, I will check that thx | 09:33 |
| opendevreview | Stephen Finucane proposed openstack/nova master: db: Move regex helpers to utils https://review.opendev.org/c/openstack/nova/+/958745 | 10:10 |
| opendevreview | Stephen Finucane proposed openstack/nova master: tests: Clean up flavors tests https://review.opendev.org/c/openstack/nova/+/958746 | 10:10 |
| opendevreview | Stephen Finucane proposed openstack/nova master: api: Simplify API version check for flavor description https://review.opendev.org/c/openstack/nova/+/958747 | 10:10 |
| opendevreview | Stephen Finucane proposed openstack/nova master: api: Add ability to filter flavors by name https://review.opendev.org/c/openstack/nova/+/958748 | 10:10 |
| opendevreview | Stephen Finucane proposed openstack/nova master: api: Remove dead fields from flavors response https://review.opendev.org/c/openstack/nova/+/958749 | 10:10 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: api: Restrict additional query string arguments https://review.opendev.org/c/openstack/nova/+/958750 | 10:10 |
| gibi | bauzas: Uggla: I see full green runs on patches now so I think at least the "Error: Failed to update project openstack/nova" issue is not happening any more (or not that frequently)j | 11:48 |
| bauzas | yup, probably a transient issue on some subnodes | 11:48 |
| bauzas | we will see | 11:49 |
| gibi | yepp | 11:55 |
| sean-k-mooney | bauzas: gibi gmaan will any of ye have tiem to review stephenfin's https://review.opendev.org/q/topic:%22bp/flavor-search-by-name%22 flavor search by name series. im +2 on the first 4 patches which are pretty easy to review and deliver the main feature, im readign the 5th which is optional and does all the cleanup of the flavor api that we wanted to include in the same | 11:58 |
| sean-k-mooney | microversion but htat could happen in a seperate one if we don tget to it. the 6th wip patch just prevent using unrecongisned query args which again is optional and jsut api cleanup and can happen in a future release. so the first 4 patches which are pretty easy to review and the optional 5th patch wouuld be nice to review. we are still waitign on ci resutls for most of them | 11:58 |
| sean-k-mooney | but it woudl be nice ot also compelte that spec. | 11:58 |
| bauzas | the series was just created today, right? | 11:59 |
| bauzas | I looked at all the BPs on Monday and I didn't found any implementation for it | 11:59 |
| sean-k-mooney | yes, an i know its very late to propose it it just short and easy to reveiw | 11:59 |
| sean-k-mooney | if it goes to next cycle that also ok | 11:59 |
| bauzas | I can try then but this is also providing an API microversion, right ? | 11:59 |
| sean-k-mooney | i just wanted to mention it before i go back to the sev one | 12:00 |
| sean-k-mooney | bauzas: yes it is 101 | 12:00 |
| bauzas | if so, I need to make sure we won't have any issue as we couldn't revert a change if we find an issue | 12:00 |
| sean-k-mooney | thre are no other api changes im aware of competing for a micoverison at this point | 12:00 |
| bauzas | sean-k-mooney: thanks for the SEV-ES series review btw. | 12:00 |
| bauzas | sean-k-mooney: yup, I haven't found any | 12:00 |
| sean-k-mooney | the microversion is they 4th patch the first 3 are just clean up | 12:00 |
| bauzas | okay, then I'll look at it today | 12:01 |
| sean-k-mooney | by cleanup i mean code cleanup no externally visable changes | 12:01 |
| gibi | sean-k-mooney: I can take a quick look | 12:40 |
| Uggla | gibi, sorry was distracted and I have just noticed your msg about the patches run. Thanks for letting me know. | 13:08 |
| gibi | sure no worries | 13:08 |
| dansmith | anyone else seeing python3.9 dep resolving failures? | 14:22 |
| dansmith | I'm wondering if placement should drop that job | 14:22 |
| gibi | dansmith: yapp we should drop it F has no 3.9 requirements https://governance.openstack.org/tc/reference/runtimes/2025.2.html | 14:34 |
| gibi | https://review.opendev.org/c/openstack/placement/+/953367 we need this | 14:35 |
| gibi | just approved | 14:35 |
| dansmith | ack | 14:35 |
| bauzas | sean-k-mooney: can you please review again the SEV-ES series ? https://review.opendev.org/c/openstack/nova/+/925685/ and upper | 15:58 |
| sean-k-mooney | yep ill be around for the next 3 hours maybe a little longer so ill get to it once i push one watcher patch | 16:01 |
| sean-k-mooney | its next on my todo list | 16:02 |
| gmaan | sean-k-mooney: ack, i can check it today | 16:14 |
| sean-k-mooney | no rush gibi notcied a reduction in test coverge becuase stephn delete a test instead of moving it in the first patch | 16:21 |
| sean-k-mooney | gmaan: and im not expectign a respin | 16:21 |
| gmaan | k | 16:21 |
| sean-k-mooney | so we can pick that back up early next cycle | 16:21 |
| gmaan | so we are not targeting that for this? | 16:22 |
| gmaan | and this is still WIP, which is easy but big change https://review.opendev.org/c/openstack/nova/+/958750/1 | 16:25 |
| sean-k-mooney | we were | 16:25 |
| sean-k-mooney | but stephenfin is feeling unwell today and realsiticly its not going to land | 16:25 |
| gmaan | ohk. got it. | 16:26 |
| sean-k-mooney | so we can do it all early next cycle and still have 1 microversion for the feature and api cleanup | 16:26 |
| gmaan | ++ | 16:26 |
| gmaan | dansmith: can you +w this devstack change (quick one) for service role https://review.opendev.org/c/openstack/devstack/+/958612 | 16:27 |
| dansmith | gmaan: got it | 16:27 |
| gmaan | thanks | 16:27 |
| gmaan | sean-k-mooney: whoami-rajat_ FYI, service API things on cinder/glance working now - https://zuul.opendev.org/t/openstack/build/03e62efae4054b7997f8fc6a4ca3db7c | 17:02 |
| gmaan | consider configuring and devstack setting glance user in cinder properly https://zuul.opendev.org/t/openstack/build/03e62efae4054b7997f8fc6a4ca3db7c/log/controller/logs/etc/cinder/cinder_conf.txt#74 | 17:02 |
| gmaan | there are unit test etc failure in fixes, I will fix those and ping in cinder. glance channel | 17:02 |
| gmaan | this is testing change on top of fixes in glance, cinder, devstack https://review.opendev.org/c/openstack/cinder/+/958719 | 17:03 |
| sean-k-mooney | ack i can join those if needed | 17:14 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: libvirt: Remove tpm supoort detection for libvirt < 8.0.0 https://review.opendev.org/c/openstack/nova/+/952308 | 17:14 |
| whoami-rajat_ | gmaan, ack, looks good, thanks | 17:41 |
| sean-k-mooney | tkajinam: this is my main comment on the second sev patch https://review.opendev.org/c/openstack/nova/+/925685/comment/6a462652_db266f95/ if you have time can you respond whil i continue to review the rest | 17:42 |
| sean-k-mooney | tkajinam: if you agree that we shoudl accomidate SEV_ES hosts with no SEV slot then we can adress that in a patch at the end of the seriese | 17:44 |
| tkajinam | sean-k-mooney, thanks and checking it now | 17:47 |
| sean-k-mooney | i dont think there si any hardware today that exclsivly supprot SEV-ES and not vanila SEV so i doing think its an edgecase we will actully hit | 17:47 |
| sean-k-mooney | but i dont know if that will change going forward so just calling it out | 17:48 |
| opendevreview | Merged openstack/nova master: Add service role in Nova policy https://review.opendev.org/c/openstack/nova/+/957578 | 17:52 |
| tkajinam | sean-k-mooney, I've replied to your comment about sev/sev-es support. at this moment kernel requires that sev is enabled when sev-es is enabled and I followed that logic. | 17:58 |
| sean-k-mooney | ack that works for me | 17:59 |
| sean-k-mooney | i just didnt want use to encode somethign that that might not hold true in general | 17:59 |
| tkajinam | it can be changed in the future and we can decouple these checks when kernel actually changes its logic | 17:59 |
| sean-k-mooney | +1 | 17:59 |
| sean-k-mooney | tkajinam: ill loop back to the lower patches but i am +2 on the main ones | 18:05 |
| tkajinam | sean-k-mooney, thanks ! | 18:06 |
| sean-k-mooney | tkajinam: is it late or very early for you | 18:08 |
| sean-k-mooney | tkajinam: i have never internalised what timezone you are in | 18:08 |
| tkajinam | ;-) | 18:09 |
| tkajinam | It's 3 am in UTC+9 so it's "still" late time here | 18:11 |
| tkajinam | some may say it's early though | 18:11 |
| dansmith | 2300 is late, 0300 is definitely early | 18:12 |
| gmaan | I think sun rises there that time or may be an hr later :) | 18:14 |
| sean-k-mooney | sunrise is my favorit time to wake up or fall asleep although i do the latter much more frequently | 18:15 |
| gmaan | :) later for me during weekends | 18:15 |
| tkajinam | ok I'm leaving before sunrise. I'll check the status of these patches and work on follow-ups once I wake up | 18:18 |
| sean-k-mooney | tkajinam: i have +2w'd the series now | 18:21 |
| tkajinam | sean-k-mooney, thank you ! \o/ | 18:22 |
| sean-k-mooney | tkajinam: none of the comments i left rise to the point of needing a respin but if you submit a followup im happy to review | 18:22 |
| sean-k-mooney | Uggla: https://bugs.launchpad.net/nova/+bug/2121617 fun little bug. apprently you cant set the region_name in our config for manilla and for legacy reason barbican and cidner dont use a option called region_name for that like eveythign else | 18:46 |
| sean-k-mooney | Uggla: we shoudl fix the endpoint discovery logic for manilla and backport that but we should also deprecate the non standar names and supprot the standard ones for cidner/barbican | 18:47 |
| sean-k-mooney | i didnt check the rest of the config options for consitency but we proably shoudl when fixign this. | 18:48 |
| sean-k-mooney | you coudl make manilla work in a multi region setup today if you explcitly set the url however we also do not supprot that so your stuck. you cant use the manilla shares feature in a multi region openstack unless the same instance of manilla is used by all regions | 18:50 |
| sean-k-mooney | setting https://docs.openstack.org/nova/latest/configuration/config.html#manila.auth_url might work if you configre it to talk to the local keyston region api but that would assume each region has its own keystoen with federation which is not really how people deploy multi region openstack | 18:51 |
| sean-k-mooney | so ya we shoudl plan to fix and backport some subset of this but its not a regression intoduced this cycle so we can fix it as a normal bug | 18:54 |
| opendevreview | Merged openstack/nova master: Migrate MEM_ENCRYPTION_CONTEXT from root provider https://review.opendev.org/c/openstack/nova/+/921814 | 20:36 |
| opendevreview | Merged openstack/nova master: Detect AMD SEV-ES support https://review.opendev.org/c/openstack/nova/+/925685 | 20:36 |
| opendevreview | Merged openstack/nova master: Add hw_mem_encryption_model image property https://review.opendev.org/c/openstack/nova/+/927706 | 21:03 |
| opendevreview | Merged openstack/nova master: libvirt: Launch instances with SEV-ES memory encryption https://review.opendev.org/c/openstack/nova/+/926106 | 23:24 |
| opendevreview | Merged openstack/nova master: Add functional test scenario for mixed SEV RPs https://review.opendev.org/c/openstack/nova/+/958562 | 23:25 |
| opendevreview | Merged openstack/nova master: Purge nested SEV RPs when SEV is disabled https://review.opendev.org/c/openstack/nova/+/958626 | 23:27 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!