feat: add playbooks for managing KVM nested virt#2415
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces two new Ansible playbooks to enable or disable KVM nested virtualization on compute hosts, acting as an early mitigation for CVE-2026-53359. The review feedback highlights several critical improvements for both playbooks: handling potential KeyError exceptions when the CPU vendor is unknown by using .get(), stopping the kolla-nova_libvirt-container before attempting to unload the KVM module to prevent locks, and safely defaulting ansible_facts.processor to prevent undefined variable errors in minimal environments.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
jackhodgkiss
force-pushed
the
add-kvm-nested-virt-playbooks
branch
2 times, most recently
from
bc7e8d7 to
4c6efa6
Compare
In response to CVE-2026-53359 [1] it is possible to disable nested virtualisation whilst appropriate kernel patches are made available. The two playbooks can be used to either enable or disable nested virtualisation. Hosts must have nova-compute disabled and empty prior to running these playbooks. See `nova-compute-disable.yml` and `nova-compute-drain.yml` playbooks to assist with this. Ensure that `admin-openrc.sh` credentials are sourced prior to running the playbooks. [1]: https://www.openwall.com/lists/oss-security/2026/07/06/7 Signed-off-by: Jack Hodgkiss <jack@stackhpc.com>
jackhodgkiss
force-pushed
the
add-kvm-nested-virt-playbooks
branch
from
4c6efa6 to
d3bbdd9
Compare
| that: | ||
| - kvm_module_name != '' |
There was a problem hiding this comment.
More likely to be unknown than undefined
| that: | |
| - kvm_module_name != '' | |
| that: | |
| - kvm_module_name != '' | |
| - kvm_module_name != 'unknown' |
| block: | ||
| - name: Unload the KVM module | ||
| community.general.modprobe: | ||
| name: "{{ kvm_module_name}}" |
There was a problem hiding this comment.
nit: spacing
| name: "{{ kvm_module_name}}" | |
| name: "{{ kvm_module_name }}" |
|
|
||
| - name: Ensure KVM module is enabled and nested virtualisation is disabled | ||
| community.general.modprobe: | ||
| name: "{{ kvm_module_name}}" |
There was a problem hiding this comment.
nit: spacing
| name: "{{ kvm_module_name}}" | |
| name: "{{ kvm_module_name }}" |
| - name: Assert supported CPU is present | ||
| ansible.builtin.assert: | ||
| that: | ||
| - kvm_module_name != '' |
github-actions
Bot
added
waiting-author-response
2 participants
In response to CVE-2026-53359 1 it is possible to disable nested virtualisation whilst appropriate kernel patches are made available.
The two playbooks can be used to either enable or disable nested virtualisation. Hosts must have nova-compute disabled and empty prior to running these playbooks. See
nova-compute-disable.ymlandnova-compute-drain.ymlplaybooks to assist with this.Ensure that
admin-openrc.shcredentials are sourced prior to running the playbooks.