Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2017-01-18
17:40:26 mriedem that seems weird
17:40:49 mriedem i'd think that would be confusing to people new to openstack
17:40:55 cdent mriedem: this https://review.openstack.org/#/c/416761/ needs to come before https://review.openstack.org/#/c/416760/ in that stack of fixes
17:41:17 mriedem cdent: ah, well that's easy enough
17:41:36 cdent mriedem: docs people want lower case project names, I've never seen the reason why, but I also though they wanted service names instead of project names in docs?
17:42:10 mriedem yeah the idea is Compute service, Bare Metal service, Networking service, etc
17:42:19 mriedem what happens when they get to Monitoring service :)
17:42:28 cdent everyone runs and hides
17:42:35 mriedem Image Repository Service
17:43:57 cdent mriedem: you want me to reorder that stuff, or you got it?
17:44:21 mriedem cdent: i'll get it, i have to rebase the last 2 in the series anyway now due to merge conflicts
17:44:29 cdent ✔
17:46:37 mriedem jroll: ok so begins the elusive hunt for that 2nd core https://review.openstack.org/#/c/364413/
17:55:28 gabor_antal mriedem: Did you have any time to think about my problem or so? If it would be better, I can commit what I've done on the patchset, but it is not mine, just wanted to review.
18:01:50 shewless hello. does anyone know what user the oslo_service.service runs as for nova?
18:02:24 shewless Trying to get SSL to work.. but apparently it can't the key_file.. I think it's because the key file is owned by root
18:02:41 mriedem gabor_antal: you can't live migrate to the same host
18:02:45 mriedem only resize
18:03:01 shewless I guessed nova but I don't think that's right
18:03:01 mriedem gabor_antal: so what i think you're trying to test isn't going to work this way
18:04:11 mriedem gabor_antal: so for testing you'd need 2 fake compute services, boot an instance on one and live migrate it to the other
18:05:08 gabor_antal mriedem: I thought that way also, but in the kilo, there were a conf flag to use the same host to migrate (for testing), http://docs.openstack.org/kilo/config-reference/content/list-of-compute-config-options.html
18:05:53 gabor_antal mriedem: do you know about any examples which works like you mentioned?
18:06:43 shewless if I open up the permissions of my "private" SSL cert directory so that "everyone" has read access then I get past that error.. so that's how I know it's a permission problem
18:07:12 mriedem gabor_antal: not without digging
18:08:19 openstackgerrit Davanum Srinivas (dims) proposed openstack/nova: [WIP] ignore me - trying experimental jobs https://review.openstack.org/421209
18:09:30 shewless So to summarize I found all the nova.conf settings to enable nova-api to be SSL but I don't know what user/permissions to use for my SSL keys.
18:09:46 shewless I have the users/permissions setup such that they work with apache but nova will have non of it
18:10:01 shewless can anyone point me in the right direction?
18:10:36 mriedem gabor_antal: btw this is the patch that removed the allow_migrate_to_same_host option in liberty https://review.openstack.org/#/c/118604/ - it was never for live migration
18:11:53 gabor_antal mriedem: thanks for the info
18:12:13 mriedem shewless: there is nothing in here http://docs.openstack.org/security-guide/compute.html ?
18:12:20 gabor_antal mriedem: you mean something like this? https://github.com/openstack/nova/blob/master/nova/tests/functional/test_server_group.py
18:12:47 mriedem gabor_antal: yeah something like this https://github.com/openstack/nova/blob/master/nova/tests/functional/test_server_group.py#L114
18:13:50 shewless mriedem: no nothing that goes down that low.
18:13:59 shewless mriedem: the error I see is ERROR oslo_service.service RuntimeError: Unable to find key_file : /etc/pki/tls/private/mykey.key
18:14:44 shewless mriedem: if I change the private directory to 777 just to test I get past that error and hit another silly permission error
18:15:06 shewless ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied
18:15:52 shewless I assume this oslo_service is either running as root or nova.. but that doesn't seem to be the case because I've set the "read" permissions on the files so that both nova and root can access them
18:22:00 shewless sigh. I can't get past this error even if I open up the permisions on my certs for everyone: ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied
18:23:02 mriedem shewless: clarkb got TLS working in the upstream CI environment, he might be able to help (maybe in #openstack-dev), else i'd probably ask in #openstack-operators or just #openstack
18:23:37 shewless mriedem: thanks. SSL support for nova seems to be pretty dodgy..
18:23:47 mriedem is this just nova or all of your services though?
18:23:51 mriedem i'd expect this to be universal
18:23:59 shewless mridem: nova so far
18:24:04 shewless I have keystone working perfectly
18:24:08 shewless mind you that's through apache
18:24:12 shewless it just works
18:24:15 mriedem but glance/cinder/neutron too?
18:24:20 shewless nova has been a pain in my side
18:25:59 shewless my current goal is to get SSL to work for horizon (done), keystone (done), nova and spice. I haven't tried glance or neutron. But I'm dealing specifically with nova.conf.. not sure if neutron would have the same options
18:26:11 mriedem well,
18:26:19 mriedem the ssl options come from oslo.service I think
18:26:29 mriedem so that's why i figured it'd be a universal problem,
18:26:39 mriedem having said that, i think nova.conf has several different ssl-related options which gets confusing
18:26:55 shewless it sure does
18:27:07 shewless (get confusing)
18:27:30 gabor_antal mriedem: thanks, I try to do the job. I'll write you, if I have some problem
18:27:56 mriedem shewless: sorry. if you find an answer it'd be great to get that fed back into the docs - not entirely sure which docs those are, since i'm finding several related to security in docs.o.o
18:28:19 mriedem dane-fichter (not in channel atm) would be another good resource
18:28:52 mriedem dane was working on getting a security-specific CI job configured for testing the various security-related features/configurations in openstack, like signed images, using barbican for key mgmt, etc
18:29:01 mriedem so he knows infinitely more about this than i do
18:29:09 shewless okay thanks
18:29:47 openstackgerrit Matt Riedemann proposed openstack/nova: DNM: Test interface attach/detach for Ironic https://review.openstack.org/421638
18:31:11 shewless ah crap. restarting nova-api seemed to get rid of the error :( now to find out which change I made actually fixed the problem!
18:31:25 mriedem ha
18:31:34 mriedem my guess would be a config change?
18:31:41 mriedem restarting nova-api would pick up a config change
18:32:04 mriedem cdent: got that series all cleaned up now, thanks for helping me out there
18:32:19 cdent you're very welcome
18:32:23 shewless quite possibly.. there are two sets of ssl options advertised in nova.conf.. I removed 1 of them.. it was either that or the file permission changes I made
18:34:34 shewless mriedem you know it seems to be the file permissions.. when I change them I seem to need to restart nova-api for that error to go away
18:35:57 shewless anyways.. thanks.. I'm further on now
18:53:27 openstackgerrit Sivasathurappan Radhakrishnan proposed openstack/nova: Raise general error message when volume attach fails https://review.openstack.org/320163
19:00:16 mriedem https://review.openstack.org/#/c/398473/ needs another core
19:00:31 mriedem would get us down to 1 remaining change for ironic + resource classes
19:01:12 mriedem jaypipes: john is +2 on the osprofiler change now, which you were +2 on before if you are still https://review.openstack.org/#/c/254703/
19:01:18 mriedem and when you get a break
19:03:48 _gryf EmilienM, bauzas, cdent, mriedem, doesn't placement API supposed to run on 80 port? if so, than this apache vhost is configured somehow wrong, doesn't it? http://logs.openstack.org/04/419604/1/check/gate-puppet-openstack-integration-4-scenario004-tempest-centos-7/5d95a8c/logs/apache_config/10-placement_wsgi.conf.txt.gz
19:03:56 _gryf or maybe it is not relevant at all?
19:04:38 EmilienM this is not relevant, you can run an API how you like on the port you like
19:04:48 cdent _gryf: how devstack configures things and how puppet configures things is not necessary going to be the same
19:04:49 _gryf okay
19:08:59 openstackgerrit Claudiu Belu proposed openstack/nova: hyper-v: Adds support for VMs with nested virtualization https://review.openstack.org/398509
19:09:33 openstackgerrit Diana Clarke proposed openstack/nova: Fix map_cell_and_hosts help https://review.openstack.org/422171
19:10:38 openstackgerrit Vasyl Saienko proposed openstack/nova: Generate necessary network metadata for ironic port groups https://review.openstack.org/388756
19:11:43 openstackgerrit Dean Troyer proposed openstack/python-novaclient: DNM: another OSC+SDK check https://review.openstack.org/422174
19:21:21 jaypipes mriedem: done.
19:37:14 mriedem jroll: can you have the same vif id in a list of ports and a list of portgroups?
19:37:16 mriedem for the same node?
19:53:27 mriedem vdrok: i've got some questions in https://review.openstack.org/#/c/388756/
19:53:32 jroll mriedem: no, a vif id can only be attached to one thing, AIUI
19:54:21 mriedem jroll: question the 2nd: can you have a port in more than one portgroup for the same node?
19:55:29 jroll mriedem: no
19:55:53 mriedem 3rd: who is your daddy and what does he do?
19:58:39 jroll :P
19:59:18 vdrok mriedem: thanks, a bit late now, will post replies tomorrow. Short version - duplicates are not possible because of the way nova generates id ( was asked by rloo in previous PS ) and cloud init does not validate parameters :)
19:59:46 mriedem ok
20:13:04 wasmum instance build from an image - running fine. needed a reboot. The original image is no longer in the image store and thus instance erroring out. Any way to resolve that?
20:13:38 mriedem wasmum: did you snapshot the instance?

Earlier   Later