Allow nova_api_audit_map.conf in DefaultConfigOverride by vyzigold · Pull Request #1104 · openstack-k8s-operators/nova-operator

vyzigold · 2026-04-22T13:25:27Z

Allow providing a nova_api_audit_map.conf file throug the DefaultConfigOverride to NovaAPI.

gibizer

Could you please providing reasoning why this changes is needed?

SeanMooney · 2026-04-23T12:09:17Z

this might be requried for non default middelware? but we do not support modifying the mideddlware without a supprort exectpion so this probaly needs deicssion about how this will be tested and if it will be supproted in the product at all unless that has alreayd happend

in either case any feature work shoudl be assocated with a jira issue in osprh so at a minimum that context need to be capture before this proceeds.

SeanMooney · 2026-04-23T12:14:45Z

this appares to be realted to https://opendev.org/openstack/pycadf/src/branch/master/doc/source/audit_maps.rst#L43
but https://opendev.org/openstack/keystonemiddleware/src/branch/master/keystonemiddleware/audit/_api.py

has never been suprpoted in optream nova with any testing and is not supproted in our downstream today.

it might work but there is 0 testing or supprot for that form the nova maintaienr today
which is shy that woudl requrie a supprot expction to enable.

i dont nessiarlly object to supprotign the config file but customer woudl not be able to use this without violdating the supprot for the nova api.

if they have any api perfonce issue or geniss issue we woudl require them to repoduce with the default middelware set before there requrest would be supproted and all issue related to this woudl have to be feilded by the Secrity team or how eve fis the formal maintaienr of that in our downstrema

so can you please provide the jira planing docs and work wirht teh relevent product owners to ensure this is planned properly before we proceed.

vyzigold · 2026-04-23T17:30:13Z

We have a feature for providing documentation on how to enable and forward audit logs. I added the task to enable the nova_api_audit_map.conf customization in nova-operator in the PR description following an example I saw in some other PR here.

@SeanMooney we have a whole feature based around audit logs https://redhat.atlassian.net/browse/RHOSSTRAT-1255 . Plan is to provide documentation on how to enable audit logs and how to configure openshift-logging to distinguish them and to forward them into a separate log storage. As part of the feature we'll also work on providing test coverage. Feel free to leave feedback if you want.

SeanMooney

I have commented on the Jira, but this is not sufficient to enable this feature.

The CADF middleware that this is for uses RabbitMQ by default and falls back to the notification message bus if its own config options are not set:
https://opendev.org/openstack/keystonemiddleware/src/branch/master/keystonemiddleware/audit/__init__.py#L44-L66

It is not correct to set the transport_url via the CustomServiceConfig or the nova-api-audit-map.conf, as that would be in plain text. This means that today there is no protection from enabling the middleware via api-paste.ini when
you have not passed a notification bus.

This patch is also missing Kuttl tests to show that the feature works end-to-end in that environment. Ideally, this would be enabled in one of the EDPM jobs—either the Ceph job or the local storage job, whichever has notifications enabled.

The fact that middleware can use a RabbitMQ connection running in the Nova API process without our knowledge is also concerning from a performance and concurrency point of view, especially given the Eventlet removal efforts and the change to how that works now.

We do not allow long-running connections in the API process, and if it is killed and recreated on every request, that will also slow down every request by at least the TCP handshake time for every notification it sends.

openshift-ci · 2026-04-23T18:47:46Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vyzigold
Once this PR has been reviewed and has the lgtm label, please ask for approval from gibizer. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vyzigold · 2026-04-24T09:07:01Z

We don't plan to use RabbitMQ or a notification bus, since we don't have anything, that'd listen there for these logs. The documentation will have users set the log driver for the audit middleware like this:

          [audit_middleware_notifications]
          driver = log

Logs will then get collected by the openshift-logging and stored.

I'll add kuttl-test coverage 👍

SeanMooney · 2026-04-24T11:45:58Z

We don't plan to use RabbitMQ or a notification bus, since we don't have anything, that'd listen there for these logs. The documentation will have users set the log driver for the audit middleware like this:
          [audit_middleware_notifications]
          driver = log
Logs will then get collected by the openshift-logging and stored.

I'll add kuttl-test coverage 👍

or we could default the value of use_oslo_messaging

[audit_middleware_notifications]
use_oslo_messaging = < true if notification bus is passed else false>

whey woudl still have to opt into the middlware by modifying the pipeline
but then it would route to the logs if notification were disabled
and send the notification to the notifcation buss
if they want to overreid that they can then also add driver = log
to alwasy send it to the logs.

softwarefactory-project-zuul · 2026-04-24T11:54:50Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/5fdad4322b6d4f1582634d34e221b439

✔️ openstack-meta-content-provider SUCCESS in 2h 31m 55s
❌ nova-operator-kuttl FAILURE in 55m 29s
✔️ nova-operator-tempest-multinode SUCCESS in 2h 15m 25s
❌ nova-operator-tempest-multinode-ceph FAILURE in 39m 22s

ill see if i can find time to re reivew but i think most of my feedback has been adressed
but i still want the compute folks to way in on if they are ok wiht this in general

softwarefactory-project-zuul · 2026-04-27T13:00:15Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/202ae4c0635347cea19e10a20918927f

✔️ openstack-meta-content-provider SUCCESS in 3h 55m 35s
❌ nova-operator-kuttl FAILURE in 51m 03s
❌ nova-operator-tempest-multinode FAILURE in 2h 13m 07s
✔️ nova-operator-tempest-multinode-ceph SUCCESS in 2h 58m 31s

Allow providing a nova_api_audit_map.conf file through the DefaultConfigOverride to NovaAPI.

softwarefactory-project-zuul · 2026-04-29T09:28:14Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/d2b200289b52491283b1b69f94c8ab0c

❌ openstack-meta-content-provider FAILURE in 5m 23s
⚠️ nova-operator-kuttl SKIPPED Skipped due to failed job openstack-meta-content-provider
⚠️ nova-operator-tempest-multinode SKIPPED Skipped due to failed job openstack-meta-content-provider
⚠️ nova-operator-tempest-multinode-ceph SKIPPED Skipped due to failed job openstack-meta-content-provider

vyzigold · 2026-04-29T11:54:20Z

recheck download tools issue

TristanCacqueray · 2026-04-29T15:27:23Z

recheck

centosinfra-prod-github-app · 2026-04-29T15:37:16Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdo/buildset/bb24970215534cecb26784e4431fdf55

❌ openstack-meta-content-provider NODE_FAILURE Node(set) request 100-0000082651 failed in 0s
⚠️ nova-operator-kuttl SKIPPED Skipped due to failed job openstack-meta-content-provider
⚠️ nova-operator-tempest-multinode SKIPPED Skipped due to failed job openstack-meta-content-provider
⚠️ nova-operator-tempest-multinode-ceph SKIPPED Skipped due to failed job openstack-meta-content-provider

TristanCacqueray · 2026-04-29T16:48:25Z

recheck

centosinfra-prod-github-app · 2026-04-29T20:20:45Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdo/buildset/107c3c8012ac4f15807b47f493ec8188

✔️ openstack-meta-content-provider SUCCESS in 3h 23m 13s
❌ nova-operator-kuttl RETRY_LIMIT in 1m 02s
❌ nova-operator-tempest-multinode RETRY_LIMIT in 33s
❌ nova-operator-tempest-multinode-ceph RETRY_LIMIT in 33s

Configure the use_oslo_messaging to false and log_name to nova.audit in tests to reflect how audit logging will be documented. This way we achieve the same result while completely bypassing the oslo messaging.

centosinfra-prod-github-app · 2026-05-05T02:22:18Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdo/buildset/776b5003add34f8bacfea51788fd8f55

✔️ openstack-meta-content-provider SUCCESS in 2h 55m 44s
❌ nova-operator-kuttl FAILURE in 54m 10s
❌ nova-operator-tempest-multinode FAILURE in 35m 09s
✔️ nova-operator-tempest-multinode-ceph SUCCESS in 2h 39m 31s

openshift-ci Bot requested review from abays and mrkisaolamb April 22, 2026 13:25

gibizer requested changes Apr 23, 2026

View reviewed changes

openshift-ci Bot assigned gibizer Apr 23, 2026

SeanMooney previously requested changes Apr 23, 2026

View reviewed changes

openshift-ci Bot assigned SeanMooney Apr 23, 2026

vyzigold force-pushed the allow_nova_api_audit_map_conf branch 2 times, most recently from ed882bf to b87609b Compare April 24, 2026 09:21

vyzigold force-pushed the allow_nova_api_audit_map_conf branch from b87609b to 652bfcd Compare April 27, 2026 09:02

Allow nova_api_audit_map.conf in DefaultConfigOverride

0545a2d

Allow providing a nova_api_audit_map.conf file through the DefaultConfigOverride to NovaAPI.

vyzigold force-pushed the allow_nova_api_audit_map_conf branch from 652bfcd to 0545a2d Compare April 29, 2026 09:10

Use log notifier for audit logging

f25b7cf

Configure the use_oslo_messaging to false and log_name to nova.audit in tests to reflect how audit logging will be documented. This way we achieve the same result while completely bypassing the oslo messaging.

Conversation

vyzigold commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gibizer left a comment

Choose a reason for hiding this comment

Uh oh!

SeanMooney commented Apr 23, 2026

Uh oh!

SeanMooney commented Apr 23, 2026

Uh oh!

vyzigold commented Apr 23, 2026

Uh oh!

SeanMooney left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Apr 23, 2026

Uh oh!

vyzigold commented Apr 24, 2026

Uh oh!

SeanMooney commented Apr 24, 2026

Uh oh!

softwarefactory-project-zuul Bot commented Apr 24, 2026

Uh oh!

softwarefactory-project-zuul Bot commented Apr 27, 2026

Uh oh!

softwarefactory-project-zuul Bot commented Apr 29, 2026

Uh oh!

vyzigold commented Apr 29, 2026

Uh oh!

TristanCacqueray commented Apr 29, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Apr 29, 2026

Uh oh!

TristanCacqueray commented Apr 29, 2026

Uh oh!

centosinfra-prod-github-app Bot commented Apr 29, 2026

Uh oh!

centosinfra-prod-github-app Bot commented May 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

vyzigold commented Apr 22, 2026 •

edited

Loading