Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2017-01-13
22:34:19 melwitt I've been noticing feedback about it and think it will make people think they have to put them on the command line
22:34:31 dansmith melwitt: because if you don't, then you don't see the magic that $db_cell0 is used, etc
22:34:53 dansmith melwitt: then it's just three commands you run, but you don't know what thing in the config file goes with what
22:34:55 melwitt okay. maybe we'll just note that it's not required in words in each section or something
22:35:15 melwitt because I think in real life, operators will not pass those things on the command line
22:35:16 dansmith melwitt: yeah, I can add something about that
22:35:30 melwitt it's more about what --config they pass to nova-manage
22:35:36 melwitt that will determine where it gets the values from
22:35:52 dansmith melwitt: the thing is, I think the current situation we have with doing everything from the config file is just really obscure
22:35:54 openstackgerrit Scott DAngelo proposed openstack/nova: WIP Do Not Merge https://review.openstack.org/420201
22:36:12 dansmith melwitt: when writing that, I started without the args, and had to go look up how we figure out what the values would be
22:36:23 melwitt dansmith: it is. so I'm cool with just notes that they don't have to do that and probably shouldn't in a real scenario
22:37:01 melwitt that it will pull the values from the nova.conf passed to nova-manage --config <nova.conf>
22:42:18 melwitt dansmith: overall looks reasonable to me
22:42:29 mriedem i don't consider those whitespaces as reasonable
22:43:20 melwitt that's true. shame on you dansmith
22:44:02 mriedem gdi where is jay when i need him
22:44:21 dansmith melwitt: I feel like operators that are sensitive about their creds are also not hand-typing them into a history-preserving bash shell, but.. regardless, I think the changes I just made will appease the concern
22:44:21 melwitt in the air, right? I thought he mentioned he was traveling today
22:44:57 mriedem i think i figured it out
22:45:19 melwitt dansmith: what do you mean? i.e. what is the case you're talking about where they type them somewhere but don't put them in the nova-manage command?
22:46:28 openstackgerrit Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198
22:47:47 dansmith melwitt: not sure I grok that.. I'm just saying I think being afraid of creds on on the command line is being overly sensitive, given the lack of security we enforce on the very same systems you'd be running these on
22:47:56 dansmith melwitt: see what you think about that ^
22:51:51 melwitt dansmith: oh. I think at my last company they wouldn't put db/mq creds on the command line at all. but I have also gotten feedback from mwhahaha about the same issue recently. so I think there's enough reason to be really clear about it so people understand what their options are
22:52:28 dansmith yeah, I totally get that people are worried about it, I just think it's silly :)
22:52:33 melwitt heh, okay
22:52:39 mwhahaha well it's information leakage
22:52:53 mwhahaha it's always been a bad idea and continues to be so
22:53:06 mwhahaha even though many newer apps have all their stuff via command line
22:53:34 dansmith it didn't used to be reasonable to use secure throw-away VMs as consoles for this kind of stuff
22:53:49 dansmith and since this should be stuff you run from an administrative console...
22:53:53 dansmith but regardless,
22:54:06 dansmith the visual correlation of which url goes with which thing is what I think is important for the examples
22:54:16 mriedem figleaf: can i not use env vars in a gabbit query string like this?
22:54:17 mwhahaha well it then ends up in scripts and other stuffs
22:54:17 mriedem PUT: /resource_providers/$ENVIRON['RP_UUID']/aggregates
22:54:22 dansmith much easier to map things in your head when you're trying to grok it
22:54:42 figleaf mriedem: yes, that's pretty much how you have to do it
22:55:11 mwhahaha anyway it's something we need to be conscious of especially if we want our apps to be consumed in the finance and government space
22:55:23 mriedem ok i was missing "content-type"
22:55:25 mriedem oops
22:55:30 melwitt dansmith: cool, thanks. I see you kept the trailing whitespace though, mriedem wouldn't approve
22:55:37 mriedem i was missing the content-type: application/json request header
22:55:43 dansmith melwitt: I fixed a few
22:55:50 mwhahaha whether or not it's silly is moot in the eyes of regulations and audits
22:55:51 figleaf mriedem: I go through about 20 oops a day with gabbi
22:55:52 dansmith melwitt: thought I got them all.. my editor's rst mode is working against me
22:55:55 melwitt that's all you're getting mriedem
22:55:57 figleaf the only way to learn!
22:56:07 mriedem figleaf: yeah, copy/paste is about the only way i make this work
22:56:09 mriedem but now i've got it
22:56:25 mriedem ok, RP ?resources= patch update coming
22:56:31 mriedem with a bunch more edge case testing
22:57:39 openstackgerrit Matt Riedemann proposed openstack/nova: Expose a REST API for a specific list of RPs https://review.openstack.org/392569
22:57:40 mriedem OH F YEAH ^
22:57:40 openstackgerrit Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198
22:57:49 openstackgerrit Davanum Srinivas (dims) proposed openstack/nova: [WIP] Ignore me - ry py35 functional with a clean slate https://review.openstack.org/419968
22:57:54 mriedem bauzas: i addressed my concerns in https://review.openstack.org/392569
22:57:57 mriedem and added a bunch more testing
22:58:53 mriedem plus more docs about min/max unit and step size consideratoins
22:58:56 mriedem *considerations
23:00:03 mwhahaha dansmith: it should noted that these command in the case of puppet may get logged which is why I asked for using the config and not cmd line params. we have things to hide secrets when they get put into the config files but not so much for command line executions
23:00:39 dansmith mwhahaha: I understand your plight
23:01:02 mriedem does it matter that we leak tokens in the logs all over the place?
23:01:05 dansmith mwhahaha: hopefully you understand my point about illustrative examples with big fat caveats
23:01:10 mriedem and people post the logs to bug reports and kibana
23:01:23 mwhahaha we're not supposed to be leaking tokens anywhere
23:01:27 mriedem if your token expires fast enough it's not an issue
23:01:33 mriedem but...
23:01:40 mwhahaha but yea, i get it but passwords don't change like tokens :D
23:01:55 melwitt mriedem: yeah, it matters. we had some patches to redact tokens in the logs
23:02:04 mriedem i know, but it's whack a mole
23:02:10 melwitt yes. that's true
23:02:12 mwhahaha always is
23:02:51 mwhahaha database passwords are worse because many times the permissions people are setting with the service users are wide open
23:02:51 dansmith these credentials are super easy for you to programmatically rotate too, if you're concerned about it
23:03:37 mwhahaha well they should be, but i've done my fair share of db password rotations and it never goes well
23:03:55 mwhahaha cause someone ultimately uses it for something aren't supposed to and the world falls apart :D
23:04:36 melwitt that depends on your infra whether it's easy to rotate them, but yeah
23:04:38 dansmith well, I see we're far outside the realm of realism here
23:04:52 dansmith melwitt: have you got anything brewing for that create_cell patch?
23:04:55 mriedem sdague: alex_xu: i'm +2 on this now https://review.openstack.org/#/c/392569/
23:05:05 melwitt it was not a picnic when the passwords got compromised and had to be changed, in my recollection
23:05:22 dansmith oh,
23:05:22 melwitt dansmith: yeah, it's failing py35 test only and I'm trying to fix it
23:05:32 dansmith I see you already did
23:06:14 mriedem alright i'm heading out
23:06:19 mriedem will be back on this week i'm sure
23:06:24 mriedem *weekend
23:06:33 melwitt *sad trombone*
23:06:41 mriedem but getting that scheduler RPs query thing +2ed unblocks the scheduler using placement
23:06:49 mriedem so is a high priority to get that patch in
23:07:04 melwitt is that the one you mentioned to me this morning?
23:07:13 mriedem i don't think so?
23:07:34 melwitt okay. nvm then
23:07:38 mriedem if you're looking, https://review.openstack.org/#/c/398472/ and https://review.openstack.org/#/c/417962/ are +2 and need to get in
23:08:19 melwitt okay yeah it was the first one you mentioned
23:08:48 mriedem ok now i'm out - i'm told there is casserole at home dontchaknow
23:11:15 openstackgerrit Anusha Unnam proposed openstack/nova: Add keypairs field to InstancePayload https://review.openstack.org/419730

Earlier   Later