In order to facilitate fixing the meltdown bug, I've modified the nova api to allow cumin to do per-labvirt selection. That's a live hack that looks like this:
diff --git a/nova/api/openstack/compute/servers.py b/nova/api/openstack/compute/servers.py index 22470cf..43b6e5d 100644 --- a/nova/api/openstack/compute/servers.py +++ b/nova/api/openstack/compute/servers.py @@ -1114,7 +1114,7 @@ class ServersController(wsgi.Controller): def _get_server_search_options(self, req): """Return server search options allowed by non-admin.""" opt_list = ('reservation_id', 'name', 'status', 'image', 'flavor', - 'ip', 'changes-since', 'all_tenants') + 'ip', 'changes-since', 'all_tenants', 'host') req_ver = req.api_version_request if req_ver > api_version_request.APIVersionRequest("2.4"): opt_list += ('ip6',)
Allowing this in a long-term way will be truly awful (either security-wise or lines-of-code-wise) so for this particular security intervention I'm going to live with the live hack and then revert later. Leaving it in place does not represent a security danger since there's nothing especially secret about where a given VM runs.