| *** mhen_ is now known as mhen | 02:56 | |
| jkulik | nicolairuckel: I understood from the discussion yesterday that it's fine that the permissions change - they should just change back to the originals i.e. back to being owned by nova once the VM isn't running anymore. that's not reflected in the ticket. did I misunderstand that part? | 07:44 |
|---|---|---|
| jkulik | nicolairuckel: iirc, we also talked about it working like that ^ for disks. so having things behave differently would be something libvirt should consider and thus should be mentioned in the ticket, too, imho | 07:46 |
| nicolairuckel | ah, right. I'll update the ticket. | 08:05 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Rally job for eventlet-removal https://review.opendev.org/c/openstack/nova/+/960130 | 09:05 |
| opendevreview | Nisha Brahmankar proposed openstack/nova-specs master: Add nova compute graceful shutdown spec https://review.opendev.org/c/openstack/nova-specs/+/965355 | 09:33 |
| opendevreview | Nisha Brahmankar proposed openstack/nova-specs master: Add nova compute graceful shutdown spec https://review.opendev.org/c/openstack/nova-specs/+/965355 | 09:37 |
| nisha04 | Thanks Uggla for the session schedule with a friendly timeslot :) I will see some of you at 00:00 UTC. Meanwhile please do check the spec if you get a chance! | 09:47 |
| Uggla | Hi nisha04, happy that works for you ! | 09:49 |
| Uggla | bauzas, gibi if you have a chance to look at the above spec from nisha04 ^ | 10:06 |
| bauzas | Uggla: nisha04: no promises, we have a packed agenda and a limited time, I'll *try* | 10:35 |
| Uggla | nisha04, also some of your colleagues wanted to bring metadata protection topic. But this was not submitted. Do you still want a slot about it ? | 10:38 |
| gibi | Uggla: ack | 11:41 |
| opendevreview | Takashi Kajinami proposed openstack/nova master: DNM: Let libvirt to select the correct UEFI firmware file https://review.opendev.org/c/openstack/nova/+/965366 | 11:47 |
| gibi | I left my initial feedback on the graceful shutdown spec | 11:53 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Rally job for eventlet-removal https://review.opendev.org/c/openstack/nova/+/960130 | 12:02 |
| *** iurygregory_ is now known as iurygregory | 12:57 | |
| Uggla | gibi thanks | 13:00 |
| Uggla | Info: PTG Confidential computing related topics in around 15mn. | 13:46 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Rally job for eventlet-removal https://review.opendev.org/c/openstack/nova/+/960130 | 13:55 |
| *** ykarel_ is now known as ykarel | 14:19 | |
| tkajinam | does anyone remember when we discussed image formatter thing ? | 15:42 |
| tkajinam | I remember we discussed direct kernel boot at that time and I'm trying to find out the discussion log ... | 15:42 |
| dansmith | tkajinam: you mean when we discussed deprecating that stuff? | 15:49 |
| dansmith | I looked it up and we technically only deprecated AMI and related formats not direct kernel boot | 15:49 |
| dansmith | I can't remember but ... is direct kernel boot necessary for the confidential computing stuff? | 15:50 |
| tkajinam | yeah | 15:50 |
| tkajinam | https://review.opendev.org/c/openstack/nova/+/926144 | 15:50 |
| tkajinam | I found the same in git log | 15:50 |
| tkajinam | dansmith, yeah. that's the first option to measure kernel and ramdisk at this moment | 15:50 |
| tkajinam | there are some works to provide "trusted TPM" to do that measurement but that has been still in-progress for long | 15:51 |
| tkajinam | direct kernel boot is used so that kernel binary, initramfs binary and OVMF code are passed down to CPU directly without any intermediate layers | 15:51 |
| tkajinam | (and kernel command line) | 15:52 |
| tkajinam | in that way CPU can measure these binaries and we can guarantee integrity of boot chain | 15:52 |
| tkajinam | TPM and secure boot is used for similar manner but in confidential computing use case it's quite tricky to make sure integrity and trustness of TPM | 15:53 |
| tkajinam | swtpm can't be trusted. It should run within the domain with encrypted data | 15:53 |
| dansmith | ack, I think that the kernel/ramdisk support is still really gross and confusing, especially in a world where glance enforces the formats of things you upload to it, | 15:53 |
| tkajinam | yeah | 15:54 |
| tkajinam | I probably have to check if it still works first | 15:54 |
| dansmith | but my main complaint is the AMI/ARI/AKI stuff itself, which nova has a bunch of garbage around | 15:54 |
| tkajinam | yeah I remember we talked about that point | 15:54 |
| dansmith | I tend to lump those formats together with AKI but as noted on that reno, they're not really the same thing and you can use direct kernel boot with other formats | 15:54 |
| tkajinam | at that time what we wanted to deprecate ASAP was these AXI things while DKB can be independent | 15:54 |
| dansmith | yes | 15:55 |
| tkajinam | I'll watch the status of "trusted TPM" work in case we can just use it when I start SNP support work but my current guess is that it may take a few more years and we have to start with direct kernel boot | 15:56 |
| tkajinam | (assuming the work needs another kernel/qemu/libvirt changes) | 15:56 |
| tkajinam | ratailor, is that finish time thing is to fix the port detach/attach timing problem we discussed some time ago in heat ? | 15:59 |
| tkajinam | I remember we need that mechanism to ensure that a port is fully released during port detach process | 16:00 |
| ratailor | tkajinam, not fully remember this, but it was initially came as a bug here https://bugs.launchpad.net/nova/+bug/2058928 and then became feature because we need to add microversion to add finish_time field. | 16:01 |
| tkajinam | ok. maybe I should ask that question to sean-k-mooney | 16:02 |
| ratailor | tkajinam, if you are talking about ``Duplicate entry 'MAC/UUID-0' for key 'uniq_virtual_interfaces0address0deleted'`` then its related to that only. | 16:03 |
| tkajinam | ah, ok and yes.that's one | 16:06 |
| sean-k-mooney | tkajinam: o/ | 16:11 |
| tkajinam | sean-k-mooney, hey :-) | 16:11 |
| sean-k-mooney | we just wrapped up the watcher session did you have a question | 16:11 |
| tkajinam | sean-k-mooney, I was wondering if adding finish_time to instance action API is to fix the port detach problem during heat stack update we discussed some time ago | 16:12 |
| tkajinam | I could not find the link for the bug/patch for some reason | 16:12 |
| sean-k-mooney | tkajinam: yes it is | 16:13 |
| tkajinam | ok | 16:13 |
| sean-k-mooney | tkajinam: we discusse the workaround | 16:13 |
| sean-k-mooney | which is heat can pool server show | 16:13 |
| tkajinam | yeah | 16:13 |
| tkajinam | I should probably look into updating heat to use that API though the tricky part is that heat is using novaclient at this moment :-P | 16:13 |
| sean-k-mooney | but the correct fix is to actully mark the action as completed | 16:13 |
| tkajinam | anyway that's one heat | 16:13 |
| tkajinam | yeah | 16:13 |
| tkajinam | that's "on" heat | 16:13 |
| *** benj_8 is now known as benj_ | 16:17 | |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Rally job for eventlet-removal https://review.opendev.org/c/openstack/nova/+/960130 | 16:18 |
| tkajinam | I'm dropping off. I might skip the sessions tomorrow. | 17:13 |
| gibi | tkajinam: thanks for the contribution | 17:13 |
| tkajinam | gibi, :-) | 17:13 |
| auniyal | Uggla, any ideas if there will be time today for cyborg discussion from Sean ? | 17:22 |
| Uggla | auniyal, yes probably. But I think the session will exceed 18:00UTC (sorry about that). | 17:23 |
| auniyal | okay | 17:25 |
| dansmith | Uggla: you're off mute | 17:40 |
| Uggla | dansmith, sorry thanks notifying me. | 17:41 |
| dansmith | Uggla: when you don't speak but are off mute, your AGC goes way high and we can hear everything in the background and even dust particles landing on your mic :) | 17:41 |
| Uggla | dansmith, as bauzas said already, it is a diabolic plan for introducing French in the session. ;) | 17:42 |
| dansmith | I will complain to the UN | 17:43 |
| Uggla | dansmith, Usually I take care to mute, but as the day progressing I tend to forget. Yes I'm becoming old. ;) | 17:44 |
| gibi | chrome has enable-webrtc-allow-input-volume-adjustment flag. But I don't have my wife home today to try it with the violin :) | 17:46 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!