)]}'
{"specs/liberty/approved/hyper-v-uefi-secureboot.rst":[{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"163f9ad63f72616f7f881dc14f14aa01d06b5a8b","unresolved":false,"context_lines":[{"line_number":44,"context_line":"do not support it will result in a hanging VM. Thus, the Hyper-V Driver will"},{"line_number":45,"context_line":"check for the instance\u0027s image property ``supports_secure_boot`` and if it is"},{"line_number":46,"context_line":"True (it will be considered False by default), it will create an instance with"},{"line_number":47,"context_line":"Secure Boot enabled."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Linux guests are supported in Windows / Hyper-V Server Technical Preview and"},{"line_number":50,"context_line":"they also require the bootloader\u0027s digital signature. This will also be"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_b920ba9c","line":47,"updated":"2015-06-16 09:34:33.000000000","message":"Given out naming prefix convenion, we should have \u0027os_\u0027 on the image property name. I also don\u0027t think that a single boolean is necessarily sufficient.  Your property indicates whether the image is capable of secure boot or not.  In the case where the cloud has a mixture of compute nodes, some with secure boot support, some without, then I think we should also have a notion of whether the image /requires/ secure boot or not. eg to prevent an image being run on a non-secure boot host.\n\nWe could either have two boolean properties\n\n - os_secure_boot_supported\u003dtrue|false\n - os_secure_boot_required\u003dtrue|false\n\nOr have a single enum property \n\n - os_secure_boot\u003ddisabled|optional|required\n\nWhere \u0027disabled\u0027 means the image must not be run with secure boot, \u0027optional\u0027 means it can be run secure or non-secure, and \u0027required\u0027 means it must be run secure.\n\nI have a preference towards the single enum property.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bbec97c96c9729c3d324fe3919ac4371c57aff4d","unresolved":false,"context_lines":[{"line_number":44,"context_line":"do not support it will result in a hanging VM. Thus, the Hyper-V Driver will"},{"line_number":45,"context_line":"check for the instance\u0027s image property ``supports_secure_boot`` and if it is"},{"line_number":46,"context_line":"True (it will be considered False by default), it will create an instance with"},{"line_number":47,"context_line":"Secure Boot enabled."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Linux guests are supported in Windows / Hyper-V Server Technical Preview and"},{"line_number":50,"context_line":"they also require the bootloader\u0027s digital signature. This will also be"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_3c97b549","line":47,"in_reply_to":"fa32b979_b920ba9c","updated":"2015-06-16 10:51:31.000000000","message":"Makes sense.\n\nI also don\u0027t like having to define 2 image properties for this. I prefer the enum option.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"163f9ad63f72616f7f881dc14f14aa01d06b5a8b","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"If the given instance has the ``supports_secure_boot\u003dTrue`` image property set"},{"line_number":54,"context_line":"but it does not contain the ``hw_machine_type\u003dhyperv-gen2`` image property,"},{"line_number":55,"context_line":"the instance creation should fail, as Secure Boot requires Generation 2 VMs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"},{"line_number":58,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_79b0f243","line":55,"updated":"2015-06-16 09:34:33.000000000","message":"I think you need to describe how the scheduler will ensure a guest is placed on a compute node that supports secure boot if that\u0027s required by the image property. Or indeed whether any schedular code enhancements are required to achieve that.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bbec97c96c9729c3d324fe3919ac4371c57aff4d","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"If the given instance has the ``supports_secure_boot\u003dTrue`` image property set"},{"line_number":54,"context_line":"but it does not contain the ``hw_machine_type\u003dhyperv-gen2`` image property,"},{"line_number":55,"context_line":"the instance creation should fail, as Secure Boot requires Generation 2 VMs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"},{"line_number":58,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_1903e310","line":55,"in_reply_to":"fa32b979_79b0f243","updated":"2015-06-16 10:51:31.000000000","message":"I think I missed explaining that point here, but I did explain in Other deployer impact.\n\nThe scheduler will ensure a guest is placed on a compute node that supports secure boot by specifying the ``hypervisor_version_requires`` image property.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"163f9ad63f72616f7f881dc14f14aa01d06b5a8b","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":99,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":100,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In order to properly use Secure Boot, images should be created as follows:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_993db6bd","line":100,"updated":"2015-06-16 09:34:33.000000000","message":"What is this \u0027hypervisor_version_requires\u0027 property you are referring to ? AFAIK, there is no such property that exists today, and its not mentioned as being added in the proposed change part of this spec","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"be3f5c32dc7c190c5976610969bde157000c647f","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":99,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":100,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In order to properly use Secure Boot, images should be created as follows:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_5df1ac94","line":100,"in_reply_to":"fa32b979_009ec962","updated":"2015-06-19 12:59:30.000000000","message":"PS: having the scheduler know automatically where to put the instance based on the host capabilities, but I believe this certain topic should be addressed in another blueprint, on a higher level, since this would also impact other drivers and how the scheduler would use those capabilities to do its job.\n\nIf something like that is implemented, I would gladly update this spec post-approval to reflect this new, better reality. :)","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"48484e35bf033dfd9a38e1720d2f2ded2f3e4c1a","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":99,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":100,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In order to properly use Secure Boot, images should be created as follows:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_df2a3b7e","line":100,"in_reply_to":"fa32b979_7cde9d40","updated":"2015-06-16 11:05:23.000000000","message":"Hmm, ok, I see that now.\n\nI think it is quite an unattractive way to express this secure boot scheduling requirement though as it is requiring the end user to know about the different hypervisor software versions and their capabilities.\n\nI understand that you need to require different hypervisor versions depending on the OS in the guest image. We already have a \u0027os_type\u0027 image metadata field accepting \u0027linux\u0027 or \u0027windows\u0027 as values.\n\nSo, as an end user, I\u0027d expect to be able to merely say\n\n  os_type\u003dlinux os_secure_boot\u003drequired\n\nand have the scheduler just \"do the right thing\" without me needing to specify a hypervisor version.\n\nAlso, I wonder if we need to tie this concept into flavours in some way.  I could well see that secure boot is a concept that a cloud vendor may wish to control access to, in order to charge it at a different pricing rate.  The only mechanism we have for that is to make use of flavours.\n\nSo it feels like we should have some flavour extra spec which is a boolean flag indicating whether secure boot is permitted to be used or not.\n\nWhat I\u0027m unclear on is how to expose the compute host capabilities to express that they support secure boot with certain guest os, so the scheduler can do something sane.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bbec97c96c9729c3d324fe3919ac4371c57aff4d","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":99,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":100,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In order to properly use Secure Boot, images should be created as follows:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_7cde9d40","line":100,"in_reply_to":"fa32b979_993db6bd","updated":"2015-06-16 10:51:31.000000000","message":"The ``hypervisor_version_requires`` image property has been present for quite some time. It also existed in Kilo, that I know for certain, as I\u0027ve used it before.\n\nThis image property is checked by the nova.scheduler.filters.image_props_filter, it checks if the given host has a satisfactory hypervisor_version for the image.\n\n    https://github.com/openstack/nova/blob/master/nova/scheduler/filters/image_props_filter.py#L75","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"60846b174ef01e5a254d6925d4cc1390cbcecaf7","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":99,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":100,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"In order to properly use Secure Boot, images should be created as follows:"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"fa32b979_009ec962","line":100,"in_reply_to":"fa32b979_df2a3b7e","updated":"2015-06-17 11:53:19.000000000","message":"I agree with you, having to specify the hypervisor version in order to properly schedule the instance on a node that supports a feature is ugly. It is not the first time this has been done and a better way should be conceived. Since some features are dependent on certain host capabilities, it would be great if the hosts expose those capabilities and have schedule filters check those capabilities. This way, the ``requires_hypervisor_version`` is not necessary and making it much easier to use. I\u0027ll take a look if something like this already exists and if so, how it can be used in this blueprint.\n\nThe previous idea would be quite straight-forward, if it wasn\u0027t for the os_type thing, which is like throwing a wrench into the mix. If filtering hosts by their capabilities is a good idea, exposing Secure Boot as a host capability would look like this:\n\n    # capabilities exposed by host as dict. Should be objectified.\n    host_capabilities \u003d {\n        ...\n        \u0027secure_boot\u0027: { \u0027os_type\u0027: [\u0027windows\u0027, \u0027linux\u0027]},\n        ...\n    }\n\n    or\n    \n    host_capabilites \u003d {\n       ...\n       \u0027secure_boot\u0027: [\u0027windows\u0027, \u0027linux\u0027],\n       ...\n    }\n\nThe second option is the simplest and nicest, but the first option is more extendable, if that will be ever necessary.\n\n--\n\nThe suggestion of having this as a flavor extra spec option is interesting. Haven\u0027t thought about it, but it would be nice to have. Though, this will lead to a couple of situations like:\n\n    image property os_secure_boot\u003drequired\n    flavor extra spec os:secure_boot\u003dFalse\n    or\n    image_property os_secure_boot\u003ddisabled\n    flavor extra spec os:secure_boot\u003dTrue\n\nThis kind of issue is not new, I\u0027ve seen other features with similar cases. Those cases will have to be treated.","commit_id":"47a795f84e8b5bebc529b65a03ae090efc203b8e"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f6caed87d03e8276d944bde212c02f3ecdaec4c0","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Linux guests are supported in Windows / Hyper-V Server Technical Preview and"},{"line_number":54,"context_line":"they also require the bootloader\u0027s digital signature. This will also be"},{"line_number":55,"context_line":"provided as an image property ``secure_boot_signature``."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"If the given instance has the ``os_secure_boot`` image property set to"},{"line_number":58,"context_line":"``optional`` or ``required`` but it does not contain the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_055c1eec","line":55,"updated":"2015-06-19 16:27:40.000000000","message":"This will need to have an \u0027os_\u0027 prefix on its name too.  What format is this data to be provided it (i\u0027m ignorant of what secure boot requires here) ?","commit_id":"9e9181a927be3ef84a8dbe72569b9660270ee3bd"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"b7fe2bb6abda0906d51020b7534d6681cf662230","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Linux guests are supported in Windows / Hyper-V Server Technical Preview and"},{"line_number":54,"context_line":"they also require the bootloader\u0027s digital signature. This will also be"},{"line_number":55,"context_line":"provided as an image property ``secure_boot_signature``."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"If the given instance has the ``os_secure_boot`` image property set to"},{"line_number":58,"context_line":"``optional`` or ``required`` but it does not contain the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_b88c5436","line":55,"in_reply_to":"fa32b979_055c1eec","updated":"2015-06-22 11:09:00.000000000","message":"Done.\n\nString format. It\u0027s the bootloader\u0027s hash.","commit_id":"9e9181a927be3ef84a8dbe72569b9660270ee3bd"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"f6caed87d03e8276d944bde212c02f3ecdaec4c0","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":65,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"},{"line_number":66,"context_line":"hosts."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Alternatives"},{"line_number":69,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_2587e213","line":66,"updated":"2015-06-19 16:27:40.000000000","message":"As mentioned in the previous patch, I\u0027m still not really a fan of the idea of the hypervisor_version_requires image property as this is leaking info about the hypervisor software versions and featureset out to the user :-(  That said, this image property already exists in the code, so I don\u0027t blame you for suggesting we can use it.\n\nSince it already exists, it is ok to use it and work on some schedular improvement to transparently do secure boot sheduling without this version property as a followon bit of work.\n\nCould you perhaps put a mention in this paragraph that this is only an initial approach to the scheduling problem  and explain that the desired thing is to somehow expose host capability info and magically match it to the basie os_secure_boot / os_type properties as future enhancement","commit_id":"9e9181a927be3ef84a8dbe72569b9660270ee3bd"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"b7fe2bb6abda0906d51020b7534d6681cf662230","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":65,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"},{"line_number":66,"context_line":"hosts."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Alternatives"},{"line_number":69,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_98307009","line":66,"in_reply_to":"fa32b979_2587e213","updated":"2015-06-22 11:09:00.000000000","message":"Sure.","commit_id":"9e9181a927be3ef84a8dbe72569b9660270ee3bd"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"baf48b926751c4755ca320d3639c56783d210186","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"  glance image-update --property secure_boot_signature\u003d$SIGNATURE img-secure"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  glance image-update --property hypervisor_version_requires\u003d\u0027\u003e\u003d6.3\u0027 img-secure"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Developer impact"},{"line_number":159,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa32b979_16d7f3ed","line":156,"updated":"2015-06-19 12:54:38.000000000","message":"hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027","commit_id":"9e9181a927be3ef84a8dbe72569b9660270ee3bd"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"7d54b6c856e1b69b1cfb4efaf837b505dbae89a1","unresolved":false,"context_lines":[{"line_number":63,"context_line":"introduced in the Kilo release (see Dependencies section)."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":66,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"},{"line_number":67,"context_line":"hosts. This is the initial approach to solving the scheduling problem. Ideally,"},{"line_number":68,"context_line":"this problem will be solved by exposing this feature as a host capability and"},{"line_number":69,"context_line":"having the ``os_secure_boot`` and ``os_type`` image properties match the host"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_eea7f3a4","line":66,"updated":"2015-07-02 13:27:31.000000000","message":"Can\u0027t we do this another way somehow, like only allow os_secure_boot \u003d true go to hosts that support that feature, without making the user know about versions?","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"9595a2cc79395f49f9e26ed30e3ea1beb6d76673","unresolved":false,"context_lines":[{"line_number":63,"context_line":"introduced in the Kilo release (see Dependencies section)."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":66,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"},{"line_number":67,"context_line":"hosts. This is the initial approach to solving the scheduling problem. Ideally,"},{"line_number":68,"context_line":"this problem will be solved by exposing this feature as a host capability and"},{"line_number":69,"context_line":"having the ``os_secure_boot`` and ``os_type`` image properties match the host"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_d1616ed4","line":66,"in_reply_to":"ba3cc151_eea7f3a4","updated":"2015-07-02 13:35:19.000000000","message":"Yes, that would be the preferred approach, but I don\u0027t think we have a way to achieve that, without setting up host aggregates and creating separate flavours\n\nWe really need a general extensible mechanism to report compute host capabilities, which the schedular can then match on. This should probably be mentioned as a future enhancement in the alternatives section of the spec.","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"854c5bbfc5a5b733d7deb9aaf399d2c5412b221a","unresolved":false,"context_lines":[{"line_number":63,"context_line":"introduced in the Kilo release (see Dependencies section)."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Scheduling is assured by the ImagePropertiesFilter [5], which checks if the"},{"line_number":66,"context_line":"image property ``hypervisor_version_requires`` is satisfied by the given"},{"line_number":67,"context_line":"hosts. This is the initial approach to solving the scheduling problem. Ideally,"},{"line_number":68,"context_line":"this problem will be solved by exposing this feature as a host capability and"},{"line_number":69,"context_line":"having the ``os_secure_boot`` and ``os_type`` image properties match the host"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_5140fe06","line":66,"in_reply_to":"ba3cc151_eea7f3a4","updated":"2015-07-02 13:38:14.000000000","message":"yeah, that would be ideal. This would require exposing the hypervisor capabilities. As I\u0027ve mentioned here, it would be great to have, but it should not block this feature.\n\nI will try to develop a POC on the hypervisor_capabilities exposure, and if it will be merged, that the ``hypervisor_version_requires`` won\u0027t be needed.","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"6bab746a9f1b8558c5a5072c997db257ff3f26bf","unresolved":false,"context_lines":[{"line_number":174,"context_line":"Secure Boot VMs can also be requested as a flavor extra spec called"},{"line_number":175,"context_line":"``os:secure_boot``, having the value ``required``. Example:"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    nova flavor-key m1.your.flavor set \"hyperv:secure_boot\u003drequired\""},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Developer impact"},{"line_number":180,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_0e6c97cc","line":177,"updated":"2015-07-02 13:25:25.000000000","message":"Why is this specific to hyperv, could we not use  a more general property?","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"},{"author":{"_account_id":1779,"name":"Daniel Berrange","email":"berrange@redhat.com","username":"berrange"},"change_message_id":"9595a2cc79395f49f9e26ed30e3ea1beb6d76673","unresolved":false,"context_lines":[{"line_number":174,"context_line":"Secure Boot VMs can also be requested as a flavor extra spec called"},{"line_number":175,"context_line":"``os:secure_boot``, having the value ``required``. Example:"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    nova flavor-key m1.your.flavor set \"hyperv:secure_boot\u003drequired\""},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Developer impact"},{"line_number":180,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_d1b88e2c","line":177,"in_reply_to":"ba3cc151_0e6c97cc","updated":"2015-07-02 13:35:19.000000000","message":"Yeah, it should be os:secure_boot to match the image prop name.","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"854c5bbfc5a5b733d7deb9aaf399d2c5412b221a","unresolved":false,"context_lines":[{"line_number":174,"context_line":"Secure Boot VMs can also be requested as a flavor extra spec called"},{"line_number":175,"context_line":"``os:secure_boot``, having the value ``required``. Example:"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"    nova flavor-key m1.your.flavor set \"hyperv:secure_boot\u003drequired\""},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Developer impact"},{"line_number":180,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_0e101756","line":177,"in_reply_to":"ba3cc151_0e6c97cc","updated":"2015-07-02 13:38:14.000000000","message":"sorry, typo. it was supposed to be os:secure_boot, I did not notice this mistake.","commit_id":"342bdfd5d86c17edda71844644f70852f8bb5331"}],"specs/mitaka/approved/hyper-v-uefi-secureboot.rst":[{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"ee9d88b6b59dfc6820844629480f8a509e6841dd","unresolved":false,"context_lines":[{"line_number":45,"context_line":"be enabled by setting the ``os_secure_boot`` image property or the"},{"line_number":46,"context_line":"``os:secure_boot`` flavor extra spec to ``required``. Other possible values"},{"line_number":47,"context_line":"are: ``disabled`` and ``optional``. The flavor extra spec value overrides the"},{"line_number":48,"context_line":"image property value."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The image property values are: ``disabled, optional, required``. If the"},{"line_number":51,"context_line":"property is not defined, the default value ``disabled`` will be used."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a2fa921_6e0a9ed4","line":48,"updated":"2015-10-06 01:06:41.000000000","message":"Does libvirt or any other driver have similar functionality? is there an existing image property that could be re-used here? If not, I think that\u0027s worth noting as the rationale for adding a new one.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"f761fb0399de1060ec8441ca6dc0ec38349b0306","unresolved":false,"context_lines":[{"line_number":45,"context_line":"be enabled by setting the ``os_secure_boot`` image property or the"},{"line_number":46,"context_line":"``os:secure_boot`` flavor extra spec to ``required``. Other possible values"},{"line_number":47,"context_line":"are: ``disabled`` and ``optional``. The flavor extra spec value overrides the"},{"line_number":48,"context_line":"image property value."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The image property values are: ``disabled, optional, required``. If the"},{"line_number":51,"context_line":"property is not defined, the default value ``disabled`` will be used."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a2fa921_2dd4811e","line":48,"in_reply_to":"7a2fa921_6e0a9ed4","updated":"2015-10-06 20:19:23.000000000","message":"not in nova, no. It seems ironic had something to do with UEFI secure boot as well, but they used flavor extra spec. http://specs.openstack.org/openstack/ironic-specs/specs/kilo-implemented/uefi-secure-boot.html","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"728c1d380221a10ec573b34f2f056b7ecbfa5868","unresolved":false,"context_lines":[{"line_number":114,"context_line":"spawn with Secure Boot off."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Images should be for Generation 2 VMs images. The image property"},{"line_number":117,"context_line":"``hw_machine_type\u003dhyperv-gen2`` is mandatory."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":120,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_25d3423a","line":117,"updated":"2015-10-02 17:07:11.000000000","message":"I wonder if we should default to gen2 at some point, maybe not I guess.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"bd155a41f62022dbcf3ef7b8f0dff5c79f8c6597","unresolved":false,"context_lines":[{"line_number":114,"context_line":"spawn with Secure Boot off."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Images should be for Generation 2 VMs images. The image property"},{"line_number":117,"context_line":"``hw_machine_type\u003dhyperv-gen2`` is mandatory."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":120,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_333708b2","line":117,"in_reply_to":"9a1a9d01_25d3423a","updated":"2015-10-02 17:50:03.000000000","message":"I don\u0027t think we can do that yet or anytime soon. There are a couple of restrictions for Generation 2 VMs:\n\n* the image must be VHDX.\n* older guest OS are not supported (not even Windows 7, from what I\u0027ve read)\n* guests must support UEFI.\n* RemoteFX does not work in Generation 2 VMs, which is one of our oldest blueprints.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"853a0d214e5a2365972dd84f4565f90caf08eee3","unresolved":false,"context_lines":[{"line_number":114,"context_line":"spawn with Secure Boot off."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"Images should be for Generation 2 VMs images. The image property"},{"line_number":117,"context_line":"``hw_machine_type\u003dhyperv-gen2`` is mandatory."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":120,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_58c0707c","line":117,"in_reply_to":"9a1a9d01_333708b2","updated":"2015-10-05 11:23:12.000000000","message":"bummer, those are major blockers.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":2271,"name":"Michael Still","email":"mikal@stillhq.com","username":"mikalstill"},"change_message_id":"ee9d88b6b59dfc6820844629480f8a509e6841dd","unresolved":false,"context_lines":[{"line_number":117,"context_line":"``hw_machine_type\u003dhyperv-gen2`` is mandatory."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":120,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":121,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``. In"},{"line_number":122,"context_line":"this case, the image property ``os_secure_boot_signature`` containing the"},{"line_number":123,"context_line":"bootloader\u0027s digital signature is required."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a2fa921_ce20924c","line":120,"updated":"2015-10-06 01:06:41.000000000","message":"What is the timeline for this technical preview to be officially released? In the past we\u0027ve blocked features for the libvirt driver that require very new versions of libvirt, and I\u0027m unsure if we should be adding features to the hyper-v driver that require effectively unreleased versions of the hypervisor.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":8213,"name":"Claudiu Belu","email":"cbelu@cloudbasesolutions.com","username":"claudiub"},"change_message_id":"f761fb0399de1060ec8441ca6dc0ec38349b0306","unresolved":false,"context_lines":[{"line_number":117,"context_line":"``hw_machine_type\u003dhyperv-gen2`` is mandatory."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"Linux images requiring Secure Boot must be spawned on Windows / Hyper-V Server"},{"line_number":120,"context_line":"Technical Preview. In order for the instances to be properly scheduled, the"},{"line_number":121,"context_line":"images must contain the property ``hypervisor_version_requires\u003d\u0027\u003e\u003d10.0\u0027``. In"},{"line_number":122,"context_line":"this case, the image property ``os_secure_boot_signature`` containing the"},{"line_number":123,"context_line":"bootloader\u0027s digital signature is required."}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a2fa921_ad55f150","line":120,"in_reply_to":"7a2fa921_ce20924c","updated":"2015-10-06 20:19:23.000000000","message":"So, Technical Preview 2, which can support Linux UEFI secure boot, was released in May 2015 and Technical Preview 3 in August 2015.\n\nBut nonetheless, this feature is available and usable by Windows guests using Windows / Hyper-V Server 2012 R2, which was released a few years ago. See L133.","commit_id":"03e4e040e0ac7a034278ebe5b714676e92781681"},{"author":{"_account_id":782,"name":"John Garbutt","email":"john@johngarbutt.com","username":"johngarbutt"},"change_message_id":"df46c72b4b23c34780b8030140abcf96db43037f","unresolved":false,"context_lines":[{"line_number":78,"context_line":"-----------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"``os_secure_boot`` field must be added to the ImageMetaProps object, as there"},{"line_number":81,"context_line":"is no field for the image property with the same name."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"REST API impact"},{"line_number":84,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_f67167a9","line":81,"updated":"2015-10-07 08:52:58.000000000","message":"ah, good catch.","commit_id":"b1c08231e92a3c782f33625c8377d3f38755c308"}]}