November 2025 - openstack-discuss

[nova][libvirt][qemu] Windows 11 Nested Virtualization Boot Loop on OpenStack (Emerald Rapids Hosts)
by Hai Pham Thanh 21 Nov '25

21 Nov '25

Hi community, We would like to report an issue we are encountering with nested virtualization on Windows 11 instances running on OpenStack. On our OpenStack platform, a Windows 11 VM becomes unable to boot after enabling Virtual Machine Platform/Hyper-V inside the VM and performing a hard reboot (VM does not show a BSOD but fails to boot into the OS and gets stuck in a boot loop in Tianocore logo). This issue does not occur on Windows 10 under the same conditions. System: * Compute node CPU: Intel Xeon Gold 6538Y+ (Emerald Rapids) with nested virtualization is enabled. * OpenStack 2024.2 * libvirt 8.0.0 * QEMU API 8.0.0 * QEMU hypervisor 6.2.0 Initially, our Nova CPU configuration was: * cpu_mode=host-model * cpu_model_extra_flags=+vmx,-hypervisor,-xsaves According to virsh dumpxml, host-model maps to Icelake-Server. We tested several cpu_mode=custom configurations and observed the following: * cpu_models=Icelake-Server-noTSX → error (boot loop) * cpu_models=Icelake-Server → error (boot loop) * cpu_models=Broadwell-noTSX-IBRS → works * cpu_models=Cascadelake-Server-noTSX → works The working models correspond to the Preferred CPU models recommended by QEMU: https://qemu-project.gitlab.io/qemu/system/qemu-cpu-models.html#preferred-c… We would like to ask: 1. Has anyone encountered this issue with Windows 11 + nested virtualization on Icelake/Emerald Rapids hosts? 2. Are there known root causes explaining why newer CPU models fail while preferred (older) models work? 3. Is there a recommended fix other than switching to a preferred older CPU model? Best regards, Hai Pham

2 1

[manila] No IRC meeting next week (Thu, Nov 27th 2025)
by Goutham Pacha Ravi 20 Nov '25

20 Nov '25

Hello Zorillas and interested Stackers, The Manila team's weekly meeting next week (Nov 27th 2025) has been cancelled due to a lack of quorum. This could be a theme for a few weeks in the remainder of 2025 as we hit local holidays and end-of-the-year holidays observed around the world. Please follow the meeting's wiki page for updates [1]. In the meantime, feel free to chime in on OFTC's #openstack-manila. The next weekly IRC meeting will be on December 4th 2025 at 1500 UTC in #openstack-meeting-alt on OFTC. Thanks, Goutham Pacha Ravi [1] https://wiki.openstack.org/wiki/Manila/Meetings#Next_meeting

1 0

[hacking][all] Expanding set of import exceptions
by Stephen Finucane 20 Nov '25

20 Nov '25

o/ I've been slowly adding type hints to oslo and SDK projects of late as time has allowed. One thing that I've noticed is that strict adherence to hacking's H301 (Do not import more than one module per line) and H303 (Do not use wildcard * import) rules results in both stupidly long groups of imports and overly verbose and difficult to read signatures [1]. I've therefore proposed a change to these rules that exempt some typing-related libraries - collections.abc, types, and typing - from these rules. This is proposed at [2]. As noted there, exceptions already exist for the sqlalchemy and projects' i18n modules for the same reason so this should be nothing new. I am instead bringing this up so projects currently using e.g. 'import typing as ty' imports can pivot to something sooner once this is merged. Cheers, Stephen [1] If you've already started writing a reply about how type hints *themselves* make function signatures more verbose and difficult to read, (a) is your name Sean Mooney and (b) stop right there, go enable an LSP in your editor, then come back to me in a month once you've seen the quality of life improvement hints provide. Then we'll talk 😄 [2] https://review.opendev.org/c/openstack/hacking/+/967719

4 7

openstack server create fails with: Invalid PCI alias definition: Expecting property name enclosed in double quotes
by Sigurd Kristian Brinch 20 Nov '25

20 Nov '25

When I try to create a VM with: openstack server create and the flavor has a property set with "pci_passthrough:alias"="NVIDIA-H200-35C:1" The error message is: novaclient.exceptions.BadRequest: Invalid PCI alias definition: Expecting property name enclosed in double quotes: line 1 column 29 (char 28) (HTTP 400) (Request-ID: req-66fb38d8-8f49-4073-99a2-fa4677d9b48e) Anyone have any idea what is causing this? A similar command worked fine just last week. Attached is the debug output from the create command BR Sigurd

2 2

[blazar] Extending the payload of a notification, to send the entire lease data
by NITIN GUPTA 20 Nov '25

20 Nov '25

Hello Blazar Team, May I have the following change reviewed, for extending the payload of a notification, to send the entire lease data: *https://review.opendev.org/c/openstack/blazar/+/965448 <https://review.opendev.org/c/openstack/blazar/+/965448>* Looking for your feedback as soon as possible. Best regards. -- NITIN GUPTA

2 3

[horizon] Considering a change in how SCSS styles are handled
by Radomir Dopieralski 19 Nov '25

19 Nov '25

Hello everyone, while working on some other part of Horizon, I recently looked at the source of the pages generated, and noticed that a substantial amount of each page is the style, compiled and included on every single page using the <style> tags. That is a rather bad practice for a number of reasons, from performance to waste of bandwidth. I decided to see if that could be easily fixed, so prepared this patch that instead includes the compiled style using a <link> tag: https://review.opendev.org/c/openstack/horizon/+/966665 Now, I'm writing to this list for two reasons. The first is to make sure that there isn't some rule or regulation, possibly introduced before the Web was invented, that requires all OpenStack software to handle the styles in that way, and that we would be breaking if we went with my patch. The second is of a more technical nature, and pertains to the change that had to be made to the `_components.scss` file in that patch. In short, a similar change would have to be done in any Horizon plugin that adds style sheets to `HORIZON_CONFIG.scss_files`. Since we don't have control over Horizon plugins and can't possibly force such a change, and since merging my patch without such changes would break the plugins, I would like to hear from the plugin maintainers about the best way to proceed with this (or, just leaving things as they are, if that is the better option). The change becomes necessary, because the included `scss_files` can no longer be compiled in one huge block with the rest of horizon's styles, but have to be included with their own <link> tags as separate files, which means that any dependencies they rely on have to be explicitly included using the `@import` mechanism. Most of those styles at the minimum will rely on the common variables from the theme, that's why this particular import, but there may be a need for more imports added depending on what the stylesheet in question uses. I'm also open to suggestions on how to avoid the need for this change and compile everything in one big blob as we are doing now, but don't inline the style on every page. Between Django, Django-compressor, SCSS compiler and template mechanism, I don't currently see a way to do this. Thank you for your feedback, -- Radomir Dopieralski

2 1

[cinder] festival of reviews friday 2025-11-21
by Brian Rosmaita 19 Nov '25

19 Nov '25

Hello Argonauts, This is a reminder that the most recent edition of the Cinder Festival of Reviews (no longer extra-small!) will be held at the end of this week on Friday 21 November. who: Everyone! what: The Cinder Festival of Reviews when: Friday 21 November 2025 from 1400-1600 UTC where: videoconf info on the etherpad etherpad: https://etherpad.opendev.org/p/cinder-festival-of-reviews This recurring meeting, that happens on the first and third Friday of each month, can be placed on your calendar by using this handy ICS file: https://meetings.opendev.org/calendars/cinder-festival-of-reviews.ics (though for some reason, the november 2025 meetings don't show up) See you there!

1 0

[Neutron][VPNaaS] Multiple tunnels per IPSec Service
by Shubham Yadav 19 Nov '25

19 Nov '25

Hello OpenStack Community, I'm working with OpenStack VPNaaS (using strongSwan as the backend driver) and have a question about tunnel configuration capabilities. *Current Setup:* OpenStack VPNaaS with strongSwan driver (StrongSwanDriver) Single VPN Service (gateway) with multiple IPSec Site Connections Each connection targets different remote peers with distinct subnets *Configuration Details:* VPN Service: Connected to a single router Multiple IPSec Site Connections under the same VPN Service: Connection 1: To MY office (10.10.100.0/24) via peer 68.x.y.34 Connection 2: To Rackspace (172.24.60.0/22) via peer 184.n.p.53 Shared IKE and IPSec policies across connections Local endpoint groups covering multiple subnets (192.168.0.0/24, 10.43.0.0/16) *Question:*Is it supported/recommended to have multiple IPSec Site Connections under a single VPN Service? I understand this creates multiple tunnels from the same OpenStack router to different remote peers. *Current Issue:*One of my connections shows "PENDING_CREATE" status while the other is "ACTIVE". I'm trying to determine if this is: A configuration issue on my end A limitation of having multiple tunnels per VPN service A strongSwan-specific behavior in the OpenStack context *Specific Questions:* Does VPNaaS officially support multiple IPSec connections per VPN Service? Are there any known limitations or best practices when using multiple tunnels? Should each remote site have its own dedicated VPN Service instead? I've checked the documentation but couldn't find clear guidance on multi-tunnel scenarios. Any insights from the community would be greatly appreciated. *Environment:* OpenStack version: 2024.2 Dalmatian Neutron VPNaaS with strongSwan backend Kubernetes-deployed OpenStack (OpenStack-Helm) Thank you for your time and assistance! Best regards, Shubham

1 0

GPU card for multiple users
by KK CHN 19 Nov '25

19 Nov '25

List, I am having NVIDIA L40s, PCle GPU installed in one of Ubuntu Server Box, How can I make use this NVIDIA L40s card to support multiple users for running their AI work loads. How to achieve this virtualization support for the NVIDIA Card. Some body can shed some light on this regard , what are the steps need to perform to get the GPU card virtualized ? Thanks in advance, Krishane

2 2

[eventlet-removal][Neutron] neutron-dynamic-routing project status
by Rodolfo Alonso Hernandez 19 Nov '25

19 Nov '25

Hello all: Since [1], Neutron removed any dependency of "eventlet", including several auxiliary methods used by other projects, in particular neutron-dynamic-routing. We have been trying to clean-up this project, updating the requirements (removing eventlet, updating os-ken) and refactoring the DR agent classes (similar to what was done in the DHCP or L3 agents). But the DR agent is still failing [2], maybe due to an incorrect implementation in os-ken. However, due to the limited time we have, we cannot investigate it. *This email is a request for assistance in getting the users/developers of that project to remediate the code and remove the eventlet dependency.* This topic and the resolution taken was mentioned in the last Neutron meeting [3]. Regards. [1]https://review.opendev.org/c/openstack/neutron/+/961210 [2]https://review.opendev.org/c/openstack/neutron-dynamic-routing/+/956747 [3] https://meetings.opendev.org/meetings/networking/2025/networking.2025-11-18…

1 0