Commit Graph

4505 Commits

Author SHA1 Message Date
Balazs Gibizer 9e678b83eb [compute]Use single long task executor
Move the execution of build_and_run_instance and snapshot_instance to
one common long task executor. Originally snapshot ran
on the RPC pool, build_and_run_instance ran on the default pool.
Also each of these tasks had a separate concurrency limit enforced by a
semaphore.

After this patch each of these tasks use a common Executor. The size of
that executor and the way how we limit the concurrency differs in
eventlet and in native threading mode.

In eventlet mode we have one big Executor with "unlimit" size and
individual semaphores are used for each task type to enforce the
configured limits.

In threading mode we requests the admin to configure the 2 limits to the
same number, and we warn if not. We use that limit (or the max of the 2
limits) as the size of the long task Executor. As the limits are the
same we don't enforce individual limit any more. The executor size will
ensure the shared limit is kept. As the limit is shared a single
operation type can consume the whole limit.

Note that while live migration is a long-running task we cannot put it into
the same long_task_executor as build and snapshot as we need:
1. a very small limit of concurrent live migrations compared to
   builds and snapshots
2. a way to cancel live migrations easily that are waiting due to the
   limit

Change-Id: I88a6a593af8a5b518715e1245a76ee54752afe83
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2026-02-24 16:28:06 +01:00
Zuul 99a2835bd2 Merge "api: Add response body schemas for quota class sets API" 2026-01-24 07:28:38 +00:00
Zuul 7a77815204 Merge "Replace obsolete PCRE packages" 2026-01-23 05:00:28 +00:00
Stephen Finucane e785ab52dc typing: Replace objects from typing with literals
We also replace the use of typing.Union and add missing parameters and
returns types for Callable types.

Change-Id: I75ed4d1cc4d84515910a5bd315f8626135258148
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2026-01-21 10:55:57 +00:00
Takashi Kajinami b1a50e67a1 Replace obsolete PCRE packages
pcre3 was removed from recent debian-based releases (eg. Trixie[1]),
while RHEL10/CentOS Stream 10 no longer ships pcre in favor of pcre2.

Use the latest whereto library release (0.5.0) which uses pcre2
instead.

[1] https://lists.debian.org/debian-devel/2021/11/msg00176.html

Depends-on: https://review.opendev.org/c/openstack/requirements/+/971428
Change-Id: I5ae44fa16128bb8dc9817a2bf2c8e349db75156b
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2026-01-20 23:14:18 +09:00
Zuul 68cec593a7 Merge "Compute manager to use thread pools selectively" 2026-01-16 21:03:28 +00:00
Balazs Gibizer 3c23390cc8 Compute manager to use thread pools selectively
This changes the thread pool usage of the ComputeManager to go through
the concurrency mode aware util functions.

The concurrent live migration pool had a seemingly unlimited option
when configured with value 0, but in reality GreenThreadPool has a
default worker size of 1000. In reality it is almost never right to
have more than one live migration running concurrently. Also with
native threading having 1000 worker is just too costly. So we
decided to deprecate the value 0 and changed the implementation of
unlimited to mean 5 threads in native threading mode. We kept the 1000
greenthread in eventlet mode for backward compatibility.

The _sync_power_states periodic task also spawn tasks for each instance
to be synced. As it uses a shared data structure across these tasks
and the caller a lock is needed to avoid race conditions.
Also the default pool size is 1000 for these tasks in our configuration.
That would use a lot of memory on a busy host in native threading mode.
So we changed the default value from 1000 to 5.

Change-Id: I9567d5fabdf086b5d0493103d9f6bde4f66af387
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2026-01-16 09:47:42 +01:00
Zuul 80753c5745 Merge "Upgrade note for concurrency mode default change" 2026-01-14 21:23:21 +00:00
Balazs Gibizer f73a23b4d4 Upgrade note for concurrency mode default change
This is a follow up for the release notes added in the commit
35207ee8b5 that changed the default mode
for the scheduler and the API services. At that time we missed to note
the upgrade impact of such change. So this patch extends the reno with
an upgrade note.

Change-Id: I280e7eb9c1da6eeaf50e96e8b19e296961f2651a
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2026-01-14 13:29:07 +01:00
Zuul dadc136d11 Merge "api: Add response body schemas for server usage audit log APIs" 2025-12-15 18:03:27 +00:00
Stephen Finucane 164c3f0f61 Remove openSUSE/SLES from install guide
This has not been supported for some time.

Change-Id: Ic7073740deb0bf9670eebe77f0f8b0daca100a5c
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-12-02 16:35:38 +00:00
Zuul 16e65e74b2 Merge "docs: Corrects a typo on a placement audit command" 2025-11-21 15:23:30 +00:00
Zuul c09e17582d Merge "api: Add response body schemas for security group APIs" 2025-11-20 23:35:27 +00:00
Balazs Gibizer 35207ee8b5 Default native threading for sch, api and metadata
This patch switches the default concurrency mode to native threading
for the services that gained native threading support in Flamingo:
nova-scheduler, nova-api, and nova-metadata.

The OS_NOVA_DISABLE_EVENTLET_PATCHING env variable still can be used to
explicitly switch the concurrency mode to eventlet by

  OS_NOVA_DISABLE_EVENTLET_PATCHING=false

We also ensure that the cover, docs, py3xx and functional tox targets
are still running with eventlet while py312-threading kept running
with native threading.

Change-Id: I86c7f31f19ca3345218171f0abfa8ddd4f8fc7ea
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-11-06 19:42:24 +01:00
Stephen Finucane 5da2dc2060 setup: Remove pbr's wsgi_scripts
This is technical dead end and not something we're going to be able to
support long-term in pbr. We need to push users away from this. Doing so
highlights quite a few place where our docs need some work, particularly
in light of the recent removal of the eventlet servers.

Change-Id: I2ffaed710fac2612f5337aca5192af15eab46861
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-11-04 16:11:50 +00:00
Zuul a2fa7b1fa1 Merge "[doc]PCI in Placement tuning" 2025-10-21 11:58:39 +00:00
Zuul 6d5cf6845e Merge "Fix fill_metadata usage for the ImagePropertiesWeigher" 2025-10-16 23:56:01 +00:00
Balazs Gibizer 35b8a1cae9 [doc]PCI in Placement tuning
Related-Bug: #2070257
Related-Bug: #2126751

Change-Id: I602c78e02d1821fab202a91fc4e42e1b0cae42ad
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-10-16 17:29:16 +02:00
Sylvain Bauza 98885344bd Fix fill_metadata usage for the ImagePropertiesWeigher
When using the weigher, we need to target the right cell context for the
existing instances in the host.
fill_metadata was also having an issue as we need to pass the dict value
from the updated dict by keying the instance uuid, not the whole dict of
updated instances.

Change-Id: I18260095ed263da4204f21de27f866568843804e
Closes-Bug: #2125935
Signed-off-by: Sylvain Bauza <sbauza@redhat.com>
2025-10-16 11:09:45 +02:00
Zuul 7278e661a4 Merge "doc: Fix typo in nova-manage command" 2025-10-07 12:10:58 +00:00
Pierre Riteau 7cae672a74 doc: Fix typo in nova-manage command
Change-Id: Id9ba4e984418b9da20b5be313485d8892ef98c0e
Signed-off-by: Pierre Riteau <pierre@stackhpc.com>
2025-09-23 09:14:52 +02:00
Balazs Gibizer ec426532c3 Run nova-conductor in native threading mode
Previous patches removed direct eventlet usage from nova-conductor so
now we can run it with native threading as well. This patch documents
the possibility and switches both nova-conductor process to native
threading mode in the nova-next job.

Change-Id: If26c0c7199cbda157f24b99a419697ecb6618fa6
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-09-22 10:17:39 +00:00
Thomas Goirand 187ffa120f Update Debian qemu/libvirt/libguestfs versions
Change-Id: I99b742bd527672cb32dd7cf8e80c20aeb8b7a5b0
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2025-09-10 18:44:57 +09:00
Takashi Kajinami 51aceec3ab docs: Update libvirt version support matrix for Flamingo
Change-Id: I05ac8ec870e75d58095b9f34a63ce786a47c3922
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2025-09-10 02:25:08 +09:00
Rajesh Tailor 68fbace8af Fix duplicate words
This change fixes duplicate consecutive words from docs
as well as code.

Signed-off-by: Rajesh Tailor <ratailor@redhat.com>
Change-Id: I236ff41fccf831023b6f85840097148a30e84743
2025-09-02 18:06:31 +05:30
Zuul aed238c064 Merge "Drop CentOS 8 Stream" 2025-09-01 11:30:40 +00:00
Stephen Finucane 78498e7d89 api: Add response body schemas for server usage audit log APIs
Change-Id: I20b7fec44149fd97049cd1f8602d084c45a690f5
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-29 10:16:49 +01:00
Stephen Finucane 8d8edf73fc api: Add response body schemas for security group APIs
We also tackle the server security group and security group rules
controllers at the same time since they are so similar.

Change-Id: I7a039cdc172de59392215e9d6a9a24d03144cb85
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-29 10:16:49 +01:00
Zuul dcf90dbb25 Merge "Ask for pre-prod testing for native threading" 2025-08-29 04:35:24 +00:00
Zuul 32d76d08cb Merge "libvirt: Launch instances with SEV-ES memory encryption" 2025-08-28 23:24:30 +00:00
Zuul f4ca2e3ef9 Merge "Add hw_mem_encryption_model image property" 2025-08-28 21:03:27 +00:00
Takashi Kajinami 4f5a3f3c00 libvirt: Launch instances with SEV-ES memory encryption
This is the last piece to allow users to request AMD SEV-ES for memory
encryption instead of AMD SEV. The CPU feature for memory encryption
can now be requested via the hw:mem_encryption_model flavor extra spec
or via the hw_mem_encryption_model image property.

Implements: blueprint amd-sev-es-libvirt-support
Change-Id: Ifc9b86ad7db887cc22b2cd252fe8adc81fdc29c6
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2025-08-28 08:47:49 +09:00
Takashi Kajinami dc6641baad Add hw_mem_encryption_model image property
This is prep work to support launching instances with AMD SEV-ES memory
encryption and adds the object field to select the CPU feature to
encrypt and protect memory data of instances.

Partially-Implements: blueprint amd-sev-es-libvirt-support
Change-Id: I71fde5438d4e22c9e2566f8a684c5a965a7f3dd3
Signed-off-by: Takashi Kajinami <kajinamit@oss.nttdata.com>
2025-08-28 08:47:49 +09:00
Ghanshyam Maan f914cb185c Add service role in Nova policy
RBAC community wide goal phase-2[1] is to add 'service'
role for the service APIs policy rule. This commit
defaults the service APIs to 'service' role. This way
service APIs will be allowed for service user only.

Tempest tests also modified to simulate the service-to-service
communication. Tempest tests send the user with service
role to nova API.
- https://review.opendev.org/c/openstack/tempest/+/892639>

Partial implement blueprint policy-service-role-default

[1] https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html#phase-2

Change-Id: I1565ea163fa2c8212f71c9ba375654d2aab28330
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
2025-08-27 19:34:04 +00:00
Balazs Gibizer 2a9cbdabce Ask for pre-prod testing for native threading
This patch refines our logging, doc, and release notes about the native
threading mode of scheduler, api, and metadata services to ask for
pre-prod testing before enabled in production.

Change-Id: I04bbb3d7e4664a0cab8b30f4c34ee71774536353
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-08-27 18:46:31 +02:00
Stephen Finucane 2a546a8645 tests: Use valid UUIDs for cinder resources
This necessitates adding some missing return values for various mocks.
Combined, this brings our tests closer to reality and will be needed
once we add response schemas for these.

Change-Id: I1ff23082d257f98e4f63b84b287a3c374a62bf0b
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-26 13:54:47 +01:00
Stephen Finucane a8651eaff3 api: Separate volume, snapshot and volume attachments
These all belong in separate files. Make it so.

We also rename the volume_attachment schema file to volume_attachments,
to better link it to the actual API code, and tweak an error message to
fix some capitalization.

Change-Id: Iffefc263bbf19d18137207c0432c16fdb3c513f9
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-26 13:54:43 +01:00
Zuul 3dbbe830a4 Merge "only show standard image properties in server show." 2025-08-19 16:39:30 +00:00
Zuul 64d73d5e79 Merge "api: Deprecate v2 API" 2025-08-18 22:18:54 +00:00
Zuul e39bac965a Merge "Run nova-api and -metadata in threaded mode" 2025-08-15 11:53:36 +00:00
Balazs Gibizer d6a3f86329 Run nova-api and -metadata in threaded mode
It turns out that nova-api and nova-metadata only depend on spawning
threads via scatter-gather. The scatter-gather already supports both
eventlet and threading mode so we can switch these services.

Our WSGI services (nova-api, nova-metadata) are not relying on
oslo.service to fork worker processes, but expect the web server to
handle that (uwsgi, apache mod_wsgi). This means we don't need to handle
any forking issues as no nova code runs before the fork.

Change-Id: Id3a339c605dfc730bdb7994c3ca45baafeb5af80
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-08-14 13:39:25 +02:00
Zuul e4340cd8e5 Merge "Allow services to start with threading" 2025-08-14 04:27:59 +00:00
Sean Mooney c7eac94fc5 only show standard image properties in server show.
nova stopped supporting custom image properties many years
ago with the introduction of ovo.

when the image property show feature was added it incorrectly
filtered the instance_system_metadata table for the image prefix
but didnt restrict the responce to only standard image properties

This change adds that filtering and fixes minor issues with the
responce schema validation.

Related-Bug: #2098384
Change-Id: I11a8783b02f35b7dfc964bf49f1a8a0a2469abc3
Signed-off-by: Sean Mooney <work@seanmooney.info>
2025-08-13 21:24:23 +01:00
Balazs Gibizer 5cbe39aca9 Allow services to start with threading
At the service startup nova need to initialize either the eventlet or
the threading backend of oslo.service. So this patch reuses the existing
logic behind OS_NOVA_DISABLE_EVENTLET_PATCHING.

When OS_NOVA_DISABLE_EVENTLET_PATCHING env variable is set to true the
service will select the threading backend otherwise the eventlet
backend.

Also to avoid later monkey patch calls to invalidated the selection if
the threading backend is selected then the monkey_patch code is
poisoned.

This patch also makes sure that oslo.messaging also initialized with the
matching executor backend.

As this is the last step to make nova-scheduler run in threading mode
this patch adds a release notes as well.

Change-Id: I6e2e6a43df78d23580b5e7402352a5036100ab36
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-08-12 07:51:01 -07:00
Stephen Finucane df630cd1b2 api: Deprecate v2 API
Change-Id: Ie236cc001ddc6362b92119710ec1672ae733318e
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-11 12:12:13 +01:00
Stephen Finucane d238306aa6 api: Remove '[api] auth_strategy', NoAuthMiddlware
Also remove associated tests.

Change-Id: I098f1d4b61fabb10c4da3de02f10337b2ad6c544
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
2025-08-11 12:12:13 +01:00
Zuul 4100d4d8fb Merge "Document native threading mode and tuneables" 2025-08-01 14:14:36 +00:00
Balazs Gibizer 8701a93743 Document native threading mode and tuneables
Change-Id: I003177de3a9f69c71c19eb8eaa7232785e03e669
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
2025-08-01 12:15:20 +02:00
Zuul b2a9d275dd Merge "Fix doc comment on manager role change" 2025-07-31 19:12:28 +00:00
Ghanshyam Maan f8d0b2ee98 Fix doc comment on manager role change
Fixing the review comments from
- https://review.opendev.org/c/openstack/nova/+/953063

Implement blueprint policy-manager-role-default

Change-Id: Idf376d9bd2eea981206738d0217ddc578875b280
Signed-off-by: Ghanshyam Maan <gmaan@ghanshyammann.com>
2025-07-31 10:24:25 +01:00