| opendevreview | Ghanshyam Maan proposed openstack/nova master: Shutdown thread pool executors during graceful shutdown https://review.opendev.org/c/openstack/nova/+/1000211 | 00:20 |
|---|---|---|
| gmaan | gibi: dansmith ^^ updated the shutdown executors with wait=True | 00:21 |
| opendevreview | Ghanshyam Maan proposed openstack/nova master: Add doc and release notes for the graceful shutdown task tracking https://review.opendev.org/c/openstack/nova/+/997141 | 00:28 |
| opendevreview | Ghanshyam Maan proposed openstack/nova master: Add doc and release notes for the graceful shutdown task tracking https://review.opendev.org/c/openstack/nova/+/997141 | 00:31 |
| gmaan | melwitt: gibi ^^ updated the doc change also | 00:49 |
| opendevreview | Merged openstack/nova master: Bump python_version for mypy to 3.11 https://review.opendev.org/c/openstack/nova/+/1002290 | 02:16 |
| opendevreview | Merged openstack/nova master: Do not use format string in logs https://review.opendev.org/c/openstack/nova/+/987016 | 02:54 |
| opendevreview | Ghanshyam Maan proposed openstack/nova master: Fix race between RPC method completion and task tracking updates https://review.opendev.org/c/openstack/nova/+/1002432 | 03:06 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Extract share management from ComputeManager https://review.opendev.org/c/openstack/nova/+/999349 | 04:33 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Support cold migration with virtiofs shares https://review.opendev.org/c/openstack/nova/+/989633 | 04:33 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | 04:33 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | 05:02 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | 05:48 |
| opendevreview | Daniel Schulz proposed openstack/nova master: Prevent orphaned attachments when shelve is preempted by a delete https://review.opendev.org/c/openstack/nova/+/1002439 | 06:22 |
| opendevreview | Daniel Schulz proposed openstack/nova master: Prevent orphaned attachments when shelve is preempted by a delete https://review.opendev.org/c/openstack/nova/+/1002439 | 06:24 |
| opendevreview | Daniel Schulz proposed openstack/nova master: Prevent orphaned attachments by preemptive delete https://review.opendev.org/c/openstack/nova/+/1002439 | 06:25 |
| opendevreview | Merged openstack/nova master: Use service shutdown related config options in nova-graceful-shutdown https://review.opendev.org/c/openstack/nova/+/1001017 | 07:03 |
| antia | gibi: Is there anything to resolve, other than the gate errors, for the TDX series? | 08:21 |
| gibi | antia: I'm not tracking anything else just the gate | 08:24 |
| gibi | antia: if you have time contributing whitebox test for TDX would be nice | 08:25 |
| gibi | also if you want you can write a blogpost somewhere about how to configured you HW and tested the series (or even about your overall contribution experience) and we will probably link to it in our doc :) | 08:25 |
| antia | I already started on the whitebox testing, so I'll try to finish that :) | 08:27 |
| stephenfin | sean-k-mooney: melwitt: Because we're doing some deeper diving on KSA at the moment... I've proposed https://review.opendev.org/c/openstack/nova/+/1002359. That is a small initial step that would allow us to move away from cinderclient in a future release. efried started the effort years ago but never closed it out. I'd appreciate your reviews if possible | 11:02 |
| sean-k-mooney | stephenfin: i saw that in my notifications but didnt look so closely | 11:03 |
| sean-k-mooney | i think some of the changes that melwitt has in the cybrog patch are still not required | 11:03 |
| sean-k-mooney | i think it will now work | 11:03 |
| sean-k-mooney | but im not sure why we need to pass in ksa_auth | 11:03 |
| sean-k-mooney | stephenfin: do you know why https://review.opendev.org/c/openstack/nova/+/1002007/11/nova/utils.py is required | 11:04 |
| sean-k-mooney | am i missing somthing in the admin false path? | 11:04 |
| sean-k-mooney | its creating a service token and then usign the user token form the context to create the connections? | 11:05 |
| sean-k-mooney | or is that wrong | 11:05 |
| sean-k-mooney | was the previous admin=false path not passing a service token as well as the user token | 11:06 |
| stephenfin | looking | 11:06 |
| sean-k-mooney | stephenfin: ya thats the chnage | 11:15 |
| sean-k-mooney | well | 11:15 |
| stephenfin | sorry, wanted to double check stuff | 11:15 |
| stephenfin | my understanding of those changes was that we needed to pre-build the auth plugin becuse one of the other services currently using SDK appear to be using service tokens | 11:16 |
| stephenfin | (i.e. ironic and and manila) | 11:16 |
| sean-k-mooney | so manila i think needed the service toke already | 11:16 |
| sean-k-mooney | but in any case i can see that the new flow does build it correctly | 11:17 |
| sean-k-mooney | the old flow might of or may have needed us to add it after the connection was created | 11:17 |
| sean-k-mooney | so this is a bit cleaner in that when we get the adapter back we know it has it | 11:17 |
| sean-k-mooney | but also less clean as it requires use to manually build it and pass it in | 11:18 |
| stephenfin | we don't seem to be using service tokens for manila currently? https://github.com/openstack/nova/blob/master/nova/share/manila.py#L32-L48 | 11:18 |
| sean-k-mooney | we are ment ot use service tokesn for ever call ot other services if tis defiend in the config | 11:19 |
| stephenfin | unless I'm missing something (that's what I was looking for) | 11:19 |
| sean-k-mooney | and you cant talk to cinder or cyrbog without them | 11:19 |
| sean-k-mooney | so the service user section is effectivly alwasy required now | 11:19 |
| sean-k-mooney | stephenfin: i rememebr there was a lot of issues tryign to figurfe out how to make serivce user tokens work before with the sdk | 11:19 |
| sean-k-mooney | so my guess is this nerver got wiered in and we hav ejust and a bug the hwole time | 11:20 |
| stephenfin | I suspect so, though again I might be missing something | 11:20 |
| stephenfin | You're likely right about this not being as simple as it could be. we probably should have get_sdk_adapter handle the whole service token logic for us (and I assume it should default to doing just that) | 11:21 |
| sean-k-mooney | well i think in either case if tis not obviouysly using it its a opertunity to impvoe it | 11:21 |
| sean-k-mooney | stephenfin: that is waht i was expecting | 11:22 |
| sean-k-mooney | for the get_sdk_adapter to uncondtionally add the service token when its in the config | 11:22 |
| sean-k-mooney | i think we can likely proceed with mels patch for now, and then we can do that cleanup with or after your cidner one | 11:23 |
| sean-k-mooney | alsthough we can see what mel things ill leave a suggestion in the review | 11:23 |
| stephenfin | Yes, we dont want to block the other cyborg work you've got going on. I'll pull that down and see if I can tidy it up somewhat. We've still got another day or two before freeze for SDK so if there are feature gaps there, we could close them out | 11:24 |
| sean-k-mooney | i think in the long term it might be nice to have a more native way to do this in the sdk, ie and interface that allwo use to pass 2 config section and optionally an exisitng token when we want to use that as the user token | 11:25 |
| sean-k-mooney | and jsut let the sdk deal with it but not right now | 11:25 |
| sean-k-mooney | stephenfin: ok left my comments and +2'd ill hold +w unitil mel is aroudn and she can catchup | 11:42 |
| sean-k-mooney | ill go look at your cidner patch next | 11:42 |
| sean-k-mooney | stephenfin: oh that `'[cinder] catalog_info` ya that annorying and we shoudl fix that | 11:43 |
| sean-k-mooney | it was "special" when we were creating the now redhat installer and i rememebr havign to confirue it differencly | 11:44 |
| sean-k-mooney | that shoudl allwo use to clean up some fo this in devstack also | 11:45 |
| stephenfin | sean-k-mooney: I agree RE: SDK support here. I forgot that I wrote docs on this back when Uggla was working on the Manila stuff, but I think he never got it work (?) https://review.opendev.org/c/openstack/openstacksdk/+/893505 | 11:45 |
| sean-k-mooney | we have some common fucntion for configruign the ksa sections which dont quite work with cidner if i recall | 11:45 |
| stephenfin | sean-k-mooney: I looked at devstack and it doesn't set those weird Cinder options, thankfully | 11:46 |
| sean-k-mooney | stephenfin: that or the patch is siting on review somewhere | 11:46 |
| sean-k-mooney | stephenfin: oh good to know | 11:46 |
| sean-k-mooney | https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L362-L377 | 11:47 |
| stephenfin | well good and not good. not good because the manila integration currently doesn't use service tokens so it suffers from the token expiry issues service tokens are supposed to work around | 11:47 |
| sean-k-mooney | we needed to use the internal endpoint in our installer so i had to set them | 11:47 |
| stephenfin | good because Mel's changes should let us fix that? | 11:47 |
| sean-k-mooney | yes | 11:48 |
| sean-k-mooney | if we passk in the ksa_auth | 11:48 |
| sean-k-mooney | or if we do my suggetion and inline it | 11:48 |
| sean-k-mooney | then it woudl "just work" | 11:48 |
| stephenfin | why not just set interface instead of catalog_info? | 11:48 |
| sean-k-mooney | because we woudl start sendign it when ever it was enabled in the config | 11:48 |
| stephenfin | in https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L362-L377 | 11:48 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Stabilize TestSerialConsoleLiveMigrate https://review.opendev.org/c/openstack/nova/+/1002477 | 11:49 |
| sean-k-mooney | so the standard field is valid_interfaces = internal | 11:49 |
| sean-k-mooney | which is a list ans we coudl not use that | 11:49 |
| stephenfin | interface also works though, I believe? | 11:49 |
| sean-k-mooney | interface may have worksed but i just used what was in kolla or tripleo | 11:49 |
| gibi | sean-k-mooney: stephenfin: https://review.opendev.org/c/openstack/nova/+/1002477 is yet another gate stabilization patch if you have a bit of spare cycles | 11:49 |
| sean-k-mooney | stephenfin: https://docs.openstack.org/nova/latest/configuration/config.html#cinder its not one of the document options | 11:50 |
| sean-k-mooney | stephenfin: so i didnt use it | 11:50 |
| stephenfin | fair. interface is disabled tbf, but we nothing ever gets removed in ksa š | 11:50 |
| stephenfin | okay that's an oversight. devstack sets `interface`, fwiw | 11:50 |
| stephenfin | gibi: looking | 11:50 |
| sean-k-mooney | stephenfin: by the way it loks like barbica is also slightly special | 11:51 |
| sean-k-mooney | https://github.com/openstack-k8s-operators/nova-operator/blob/main/templates/nova/nova.conf#L394 | 11:51 |
| sean-k-mooney | but that is coming form castalean | 11:51 |
| stephenfin | gibi: done. dead simple | 11:51 |
| sean-k-mooney | gibi: dont we alrady have a wait_for_migration_status in the integrate helpers | 11:53 |
| stephenfin | sean-k-mooney: read the commit message :) | 11:54 |
| sean-k-mooney | we copy that function in some of the regression tets and we reuse it in others | 11:54 |
| gibi | sean-k-mooney: as I noted in the commit message this regression does not use our helper mixing | 11:54 |
| gibi | s/g// | 11:54 |
| gibi | hence I vendored the helper | 11:54 |
| gibi | I didn't wanted the bigger change to pull in a new base class | 11:54 |
| sean-k-mooney | ya i was just debating the value of that vs the copy | 11:55 |
| sean-k-mooney | +2w | 11:55 |
| gibi | thanks | 11:55 |
| sean-k-mooney | im alway 50:50 on that, i perfer when our regression tests follow our docs and inherit form our base test case with minimal depency on those deper classes, on the other hand the integrate heleprs mixin is very useful and keeps them small | 11:58 |
| sean-k-mooney | so i prefer reading them when it uses it :) and writeing them i guess but it creats more depencnece on the internals | 11:58 |
| sean-k-mooney | stephenfin: so just to confirm with the cinder change i should now be able to use valid_interface internal,public for cidner right | 11:59 |
| sean-k-mooney | we get that for free form ksa | 11:59 |
| sean-k-mooney | i think in our installer we woudl still jut have it defautl to only internal | 12:00 |
| sean-k-mooney | but its nice to have the option to have it be a list | 12:00 |
| stephenfin | without the change you can use interface already. I'm not sure about valid_interface | 12:03 |
| stephenfin | but with the change, you can use either | 12:03 |
| sean-k-mooney | interface is not a list | 12:03 |
| sean-k-mooney | so withoug the change you can have a list of endpoint to fall back on | 12:03 |
| sean-k-mooney | valid_interfaces allwos you to do internal,public,admin | 12:04 |
| sean-k-mooney | and it will try them in that order | 12:04 |
| sean-k-mooney | well try to resovle them in that order | 12:04 |
| sean-k-mooney | i.e. it check if there is an internal endpoint in the catalong and ifn not i twill check for public | 12:04 |
| sean-k-mooney | it wont change the number of requests | 12:05 |
| stephenfin | oh yeah I know there's a difference. What I don't know is whether cinderclient supported it | 12:05 |
| sean-k-mooney | but it allwos you to write yoru config a bit more geneircally | 12:05 |
| sean-k-mooney | i think that is resoveld before the cindercient but not sure, in anycasye the cidner change looks good to me | 12:06 |
| stephenfin | looks like if you pass a list of strings to cinderclient's Client, it will pass it straight through to ksa's LegacyJsonAdapter | 12:08 |
| sean-k-mooney | i tought it was ksa that handeedl this to be honest | 12:08 |
| sean-k-mooney | i.e. that it was chooing the endpoint to use rather then the client | 12:09 |
| stephenfin | but I guess you'd need a ListOpt to ensure the nova.conf value is transformed to a list instead of being given as a string | 12:09 |
| sean-k-mooney | since its realy just the url for the request form the catalog that this is selecting | 12:09 |
| stephenfin | yeah, that's been ksa for years | 12:09 |
| stephenfin | and keystoneclient before that, iirc | 12:09 |
| sean-k-mooney | ya so it should "just work" vai the common shared code path | 12:10 |
| sean-k-mooney | cinder client is really just dealing with formating the payload | 12:10 |
| sean-k-mooney | so my meta hope is to move placement and cybrog to using the sdk and proxy apis in 2027.1 | 12:11 |
| sean-k-mooney | and then all that is left i think is neutron and cidner to have nova fully using the sdk | 12:12 |
| sean-k-mooney | bar barbican with goes via castalan | 12:12 |
| stephenfin | and glance? | 12:13 |
| sean-k-mooney | oh i tought glance was already done | 12:13 |
| sean-k-mooney | maybe not | 12:13 |
| stephenfin | I think I tried glance before but it's weird because it can talk to multiple glance deployments or something like that (?) | 12:13 |
| sean-k-mooney | oh your right | 12:13 |
| sean-k-mooney | so glancce is the only thing that cybrog talks to not via the sdk today | 12:14 |
| sean-k-mooney | so maybe i can find some time to do that for both nova and cybrog | 12:14 |
| sean-k-mooney | i know the glance client has some extra logic aroudn how ti does image streaming that a bit more complx then a standard rest call | 12:15 |
| sean-k-mooney | all the multipatrt mime stuff | 12:15 |
| sean-k-mooney | so ya the fact it supprot multi store | 12:15 |
| sean-k-mooney | and that make galnce a bit tricker | 12:15 |
| sean-k-mooney | im 99% sure if you try to use any of the fancier parts of the glance api cyborg will just break | 12:16 |
| sean-k-mooney | there has never been any testign of multi store there and beyond that while the client was litrally copy pasted form nova it didnt include all its depencies form nova so i suspect adopting the sdk there and actully testing it will be a large improvment | 12:18 |
| opendevreview | Merged openstack/nova master: Improve the graceful shutdown job ansible tasks name https://review.opendev.org/c/openstack/nova/+/1001212 | 12:51 |
| opendevreview | Merged openstack/nova master: libvirt: Generalize memory encryption config https://review.opendev.org/c/openstack/nova/+/998466 | 12:51 |
| opendevreview | Merged openstack/nova master: libvirt: Add memory encryption config for TDX https://review.opendev.org/c/openstack/nova/+/998608 | 12:56 |
| opendevreview | Merged openstack/nova master: libvirt: Add os_firmware_secure https://review.opendev.org/c/openstack/nova/+/1000472 | 12:59 |
| sean-k-mooney | gibi: i kind of hate how effective adding random `import time; time.sleep(2)` into the code seams to be at finding these intermitent races | 13:02 |
| sean-k-mooney | it reminds me of time wehre adding a print statement to debug code stop the bug form happening :) | 13:03 |
| sean-k-mooney | am i being stupid "nova.exception.ServiceTooOld: This service is older (v72) than the minimum (v73) version of the rest of the deployment. Unable to continue." | 13:13 |
| sean-k-mooney | so i deployed master yesterday | 13:13 |
| sean-k-mooney | and i just checked out mel's cybrog change now | 13:14 |
| sean-k-mooney | oh | 13:14 |
| sean-k-mooney | i ownder if it need a rebase | 13:14 |
| sean-k-mooney | we might have merged a new version in between? | 13:14 |
| sean-k-mooney | ya ok it works after a rebase | 13:17 |
| gibi | sean-k-mooney: with native threading, task can be switched any time. with eventlet they switch at certain places only (sleep and io) | 13:18 |
| gibi | so our test are relied on those eventlet run to completion guarantees | 13:18 |
| gibi | but it cannot rely on it any more | 13:18 |
| gibi | I'm pretty happy that these are only test instabilities and we haven't found any new code races yet | 13:19 |
| sean-k-mooney | ya, in the real code we were better about treating shared memory access as if it was real thread and using locks | 13:20 |
| sean-k-mooney | i for one alwasy preetened it was a real thread for the most part hwen reviewing | 13:20 |
| sean-k-mooney | but i woudl be surppriesed if we never mised a case where we relised on the eventlet behavior | 13:20 |
| gibi | :) | 13:21 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Stabilize live migration tests https://review.opendev.org/c/openstack/nova/+/1002493 | 13:39 |
| gibi | the follow up :) ^^ | 13:39 |
| melwitt | sean-k-mooney, stephenfin: from what I understand, the ServiceTokenAuthWrapper is required in order to send user+service token https://github.com/openstack/keystoneauth/blob/9e083fd5ae63aef66349ca980cdd315f5df4c767/keystoneauth1/service_token.py#L26 so that has to be passed in somehow | 14:08 |
| opendevreview | Daniel Schulz proposed openstack/nova master: Prevent orphaned attachments by preemptive delete https://review.opendev.org/c/openstack/nova/+/1002439 | 14:09 |
| melwitt | there's already a helper in nova to create one https://github.com/openstack/nova/blob/bbe520dd911be598273dd3d6d5a09fd35a56ddca/nova/service_auth.py#L69 so you get an auth plugin | 14:10 |
| melwitt | and have to pass that to sdk somehow | 14:11 |
| melwitt | ok I am seeing the rest of the review comments now | 14:17 |
| gibi | gmaan: filed one more instabilities https://bugs.launchpad.net/nova/+bug/2165149 and assigned it to myself | 14:40 |
| gibi | aaand file one more https://bugs.launchpad.net/nova/+bug/2165150 | 14:46 |
| gibi | Uggla: I confirmed that your shelve offload / unshelve race is the same as we see on the gate so I reviewed your repor and fix and left comments | 14:50 |
| Uggla | gibi cool ! I will try to jump on it ASAP | 14:51 |
| sean-k-mooney | melwitt: so i think we can proceed with your change as is | 14:51 |
| sean-k-mooney | melwitt: i think we can tidy things up in a followup and make manilla interaction use the service user tokes ectra based on this infra | 14:51 |
| Uggla | Right now I'm testing cold migration of shares and found couple of issues. | 14:51 |
| gibi | and marked https://bugs.launchpad.net/nova/+bug/2163552 as duplicate of https://bugs.launchpad.net/nova/+bug/2120927 (cc gmaan ) | 14:51 |
| melwitt | sean-k-mooney: ok that is good news! | 14:52 |
| sean-k-mooney | i held +w in case you wanted to look at refactoring the ksa plugin creation in this patch but i think its better to defer that | 14:52 |
| sean-k-mooney | so i can add +w now if you dont intend to make any other changes | 14:53 |
| sean-k-mooney | melwitt: we are expcting to update this code again after the sdk release too right | 14:53 |
| sean-k-mooney | so we can defer those topic to that patch or a followup | 14:53 |
| melwitt | sean-k-mooney: you mean the keystoneauth release? yeah although I think I see that got released this morning | 14:54 |
| melwitt | it's not in upper-constraints yet though so I think we can't use yet | 14:55 |
| melwitt | sean-k-mooney: yeah I mean AFAICT we do need 3 options in get_sdk_adapter (I replied on the review) so I'm not sure there is a cleaner way to do it | 14:57 |
| melwitt | for manila, do we know we want to send service tokens along with it too? I wondered if it is intentional that it does not today | 14:59 |
| sean-k-mooney | yes | 14:59 |
| sean-k-mooney | infact orginally we didnt want to merge it without it | 14:59 |
| melwitt | oh, interesting | 14:59 |
| sean-k-mooney | there were issue with doing that at the teim becuase there was no end ot end example of using service tokens wiht the sdk | 15:00 |
| sean-k-mooney | basiclly we shoudl always send service user tokens if we can to prevent token exeriation issues | 15:01 |
| melwitt | ah, gotcha | 15:01 |
| gmaan | gibi: ack and thanks | 15:02 |
| gmaan | gibi: no eventlet meeting today right/? | 15:03 |
| gmaan | i did not find in my calendar this week | 15:03 |
| stephenfin | melwitt: I'm only reading the scrollback now, but https://review.opendev.org/c/openstack/requirements/+/1002461 is winding it's way through the gate | 15:04 |
| melwitt | stephenfin: a-ha cool | 15:04 |
| stephenfin | Also, you probably saw this in the scrollback but these are the docs I wrote on using service token with SDK a few years back https://review.opendev.org/c/openstack/openstacksdk/+/893505 | 15:05 |
| melwitt | so yeah when that lands IIUC we could update the sdk patch to require 5.16.0 and remove the workaround wrapper | 15:05 |
| melwitt | oh, yes thanks | 15:05 |
| stephenfin | As I noted, I recall Uggla wasn't able to get it working. I did some testing and it turns out your KSA patch was the missing part š | 15:05 |
| stephenfin | *And I also noted that | 15:06 |
| melwitt | ahh yeah | 15:06 |
| stephenfin | and yeah, once the requirements patch merges, we could tweak your patch to bump the ksa version and drop the local workaround | 15:07 |
| melwitt | sean-k-mooney: thanks for the +W. I think that is safer to merge as-is first and then I do a follow on patch to bump the ksa version and drop the workaround JUST in case it does not work | 15:08 |
| stephenfin | or we can just merge it as-is now and fix it in a follow-up. I'm okay with either. If you or sean-k-mooney want to do the former, feel free to carry my +2 forward | 15:08 |
| gibi | gmaan: right no eventlet meeting today | 15:08 |
| stephenfin | okay well that solves that :) | 15:08 |
| gmaan | ok | 15:08 |
| sean-k-mooney | stephenfin: no i +w'd as is just noting that 3 probaly is an existing bug | 15:09 |
| sean-k-mooney | stephenfin: but being an exsting bug we should fix it as such later | 15:09 |
| gmaan | gibi: melwitt: I am not sure if dansmith will be able to re-review it but we need to merge it as FF is approaching. melwitt if you can check this? or gibi can +w https://review.opendev.org/c/openstack/nova/+/1000211 | 15:11 |
| gmaan | gibi: melwitt and doc change which i updated as per feedback and replied on other comments, please check https://review.opendev.org/c/openstack/nova/+/997141/13 | 15:12 |
| melwitt | gmaan: yeah I think dansmith will not be able to re-review today, I can do it | 15:13 |
| gmaan | melwitt: thanks | 15:13 |
| gibi | I will check those tomorrow my morning | 15:13 |
| gmaan | ack, thanks | 15:14 |
| gibi | and add some +w if needed | 15:14 |
| gmaan | ok | 15:14 |
| gmaan | thanks for review on the bug fixes, let me check your comment today and fix but I see things are merging at least | 15:14 |
| gibi | yeah we merged some TDX patches | 15:15 |
| gmaan | yeah i saw those very first thing in morning :) | 15:15 |
| sean-k-mooney | about half | 15:15 |
| sean-k-mooney | i saw gibi already rechecked the failures | 15:15 |
| gibi | yep | 15:16 |
| gibi | I'm keeping an eye of that series | 15:16 |
| gibi | a/of/on/ | 15:16 |
| gmaan | yeah, will continue in my TZ | 15:16 |
| sean-k-mooney | i assume we will apply our normal rules, if its +2w'd before FF we can recheck without a FFE until monday if requried | 15:17 |
| sean-k-mooney | then talk about it in the meeting | 15:17 |
| melwitt | that is my understanding | 15:18 |
| sean-k-mooney | as an aside obviously wont be around friday but ill be off on monday as well | 15:18 |
| melwitt | same for me | 15:18 |
| gibi | I can do some recheck on Friday too | 15:18 |
| Uggla | Upstream bug triage in ~10mn (I not prepared) | 15:20 |
| stephenfin | sean-k-mooney: melwitt: Is there any time we *shouldn't* be sending service tokens when talking to other services? | 15:20 |
| stephenfin | I assume not, but just checking in case I've missed something | 15:21 |
| sean-k-mooney | stephenfin: my understanding is only if its not configured in the config or explcitly disabled in teh config | 15:21 |
| sean-k-mooney | stephenfin: but nova requries them to be able to talks to cidner and manage attachment | 15:21 |
| sean-k-mooney | and to cybrog | 15:21 |
| sean-k-mooney | so i think we shoudl expect that its more or less alwasy configured | 15:22 |
| melwitt | yeah I remember we had to require it for cinder, for deleting attachments | 15:22 |
| gmaan | stephenfin: sean-k-mooney we should always, i know we had a temporary config option not to send it but that was added only for transition purpose and suppose to be removed (which did not happen) | 15:22 |
| Uggla | link: meet.google.com/zjr-rxus-hzj (triage) | 15:22 |
| gmaan | Uggla: in horizon meeting, might be little late | 15:23 |
| sean-k-mooney | melwitt: ya so eventully we shoudl not require the service token to talk to cinder and cybrog | 15:23 |
| Uggla | gmaan nw | 15:23 |
| sean-k-mooney | but that requries chagne to nova and cinder | 15:23 |
| sean-k-mooney | we abused the service token for security to close cves | 15:23 |
| melwitt | what's the alternative? nova service user only or? | 15:24 |
| sean-k-mooney | but nova shoudl eventually all nova iwth its own token with the service role instead and use the 2.1 microversion instead of 2.0 to bind/unbind ARQs | 15:24 |
| sean-k-mooney | melwitt: yes exactly nova shoudl use its own token (with the service role) to do the privdage service ot service calls | 15:25 |
| elodilles | Uggla: will there be an Upstream bug triage meeting today? | 15:25 |
| melwitt | ok, yeah. I had to set that up with vtpm live migration "deployment" mode although we did not end up usingi t | 15:25 |
| Uggla | elodilles yes | 15:25 |
| * melwitt wonders if we should have reverted out that code | 15:26 | |
| elodilles | Uggla: sorry, forgot to scroll o:) just a heads up: i don't have any update, but i'll listen in o:) | 15:26 |
| Uggla | elodilles no worries. | 15:26 |
| melwitt | same, no update from me | 15:26 |
| stephenfin | sean-k-mooney: I thought the point of the additional service token was for long-running operations? Isn't Nova's token (with or without the service role) subject to the same issue? | 15:31 |
| stephenfin | Or do we assume a token is minted each time so that shouldn't ever happen? | 15:31 |
| opendevreview | Leo Jenkins proposed openstack/nova-specs master: Support for Hostname-based Ceph Mon References https://review.opendev.org/c/openstack/nova-specs/+/1000098 | 15:33 |
| sean-k-mooney | stephenfin: it is but the service user tokens are never cached and reused we create them on every request (where we dont share the client instnatce) | 15:33 |
| sean-k-mooney | stephenfin: basiclly if the dest compute needt to call cinder to compelte the volume attachment on a live migration | 15:34 |
| sean-k-mooney | it will use the user token for that and generate a new service token at that point | 15:34 |
| sean-k-mooney | so the user token coudl be long expired at that point but the service user token will be freshly issued for that request | 15:34 |
| sean-k-mooney | so the primay usecase for the service_user token is lifetime exstension of the users token | 15:35 |
| sean-k-mooney | stephenfin: since the service_user token is alwasy created form config we can alwasy mint a new one when required as well | 15:37 |
| stephenfin | Okay so "Or do we assume a token is minted each time so that shouldn't ever happen?" is the case | 15:42 |
| stephenfin | fair enough | 15:42 |
| opendevreview | sean mooney proposed openstack/placement master: bump min version of os-traits https://review.opendev.org/c/openstack/placement/+/1002526 | 16:05 |
| sean-k-mooney | ^ that bumps to 3.9.0 with the NVME and TDX traits | 16:07 |
| sean-k-mooney | previous min was 3.3.0 | 16:07 |
| gibi | we bumped on the nova side but not on the placemnet side | 16:08 |
| gibi | thanks Se | 16:08 |
| gibi | Sean | 16:08 |
| sean-k-mooney | on the cybog side we will need 3.9.0 if i end up merging the nvme driver but currently testing it so it might slip but it wont need nova's min to change | 16:09 |
| sean-k-mooney | we also need to supprot older placemeent anyway but its nice to have a standard set of traits for any given release | 16:10 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Lock on DB url in functional test https://review.opendev.org/c/openstack/nova/+/1002529 | 16:20 |
| gibi | sean-k-mooney: melwitt: gmaan: here is a gate fix (and it parents) to look at ^^ | 16:20 |
| gmaan | gibi: nice, will check | 16:21 |
| melwitt | sean-k-mooney: do we need to bump nova too for nvme traits? I guess you said no it would not? | 16:21 |
| sean-k-mooney | melwitt: nova will never report them so not a depency for it | 16:22 |
| melwitt | oh I see, cool | 16:22 |
| sean-k-mooney | cyborg need it for the constant adn placmenet so we can say 2026.2 will alwasy have them | 16:22 |
| sean-k-mooney | techinally the standard traits can be newer if placment has a newer os-tratis installed | 16:22 |
| melwitt | gotcha | 16:23 |
| sean-k-mooney | that why it was working in ci we alwasy use whatever is allwoed by UC | 16:23 |
| gibi | I stopping for today. o/ | 16:24 |
| sean-k-mooney | o/ | 16:24 |
| opendevreview | Clif Houck proposed openstack/nova master: perf(ironic): eliminate O(NĀ²) ProviderTree deepcopy at startup https://review.opendev.org/c/openstack/nova/+/980676 | 16:24 |
| opendevreview | Clif Houck proposed openstack/nova master: Parallelize per-node resource updates https://review.opendev.org/c/openstack/nova/+/980679 | 16:24 |
| sean-k-mooney | ill be swaping to watcher review sortly too and tomorrow ill be mainly focusing on watcher and cyborg | 16:24 |
| opendevreview | Clif Houck proposed openstack/nova master: Parallelize per-node resource updates https://review.opendev.org/c/openstack/nova/+/980679 | 16:57 |
| opendevreview | Merged openstack/nova master: Switch Cyborg client from keystoneauth1 to openstacksdk https://review.opendev.org/c/openstack/nova/+/1002007 | 17:04 |
| opendevreview | Merged openstack/nova master: libvirt: Launch security Intel TDX https://review.opendev.org/c/openstack/nova/+/999249 | 17:30 |
| opendevreview | Merged openstack/nova master: doc: Add documentation for Intel TDX https://review.opendev.org/c/openstack/nova/+/1000081 | 17:31 |
| opendevreview | melanie witt proposed openstack/nova master: Remove workaround for ServiceAuthTokenWrapper get_endpoint_data() https://review.opendev.org/c/openstack/nova/+/1002540 | 17:48 |
| opendevreview | melanie witt proposed openstack/nova master: Remove workaround for ServiceAuthTokenWrapper get_endpoint_data() https://review.opendev.org/c/openstack/nova/+/1002540 | 17:52 |
| melwitt | stephenfin, sean-k-mooney: seems to work fine ^ tested on my devstack | 17:52 |
| opendevreview | Ghanshyam Maan proposed openstack/nova master: Fix race between RPC method completion and task tracking updates https://review.opendev.org/c/openstack/nova/+/1002432 | 18:42 |
| *** erlon5 is now known as erlon | 19:08 | |
| opendevreview | Merged openstack/placement master: bump min version of os-traits https://review.opendev.org/c/openstack/placement/+/1002526 | 19:29 |
| opendevreview | melanie witt proposed openstack/nova master: tests: Functional reproducer for bug 2088831 https://review.opendev.org/c/openstack/nova/+/935565 | 20:46 |
| opendevreview | melanie witt proposed openstack/nova master: Include image in unified limits quota check https://review.opendev.org/c/openstack/nova/+/1002553 | 20:46 |
| opendevreview | Merged openstack/nova master: Stabilize TestSerialConsoleLiveMigrate https://review.opendev.org/c/openstack/nova/+/1002477 | 21:14 |
| opendevreview | Merged openstack/nova master: Stabilize live migration tests https://review.opendev.org/c/openstack/nova/+/1002493 | 21:14 |
| opendevreview | Merged openstack/nova master: Lock on DB url in functional test https://review.opendev.org/c/openstack/nova/+/1002529 | 21:14 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Support cold migration with virtiofs shares https://review.opendev.org/c/openstack/nova/+/989633 | 22:38 |
| opendevreview | Goutham Pacha Ravi proposed openstack/nova master: Reconcile stale Manila share access rules https://review.opendev.org/c/openstack/nova/+/1001916 | 22:38 |
| opendevreview | Merged openstack/nova master: libvirt: reject_mem_enc_instances https://review.opendev.org/c/openstack/nova/+/1000082 | 22:59 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!