| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-02-07 | |||
| 17:16:38 | sfinucan | sean-k-mooney: Here https://github.com/openstack/nova/blob/master/nova/virt/libvirt/firewall.py#L181-L193 | |
| 17:16:39 | mriedem | if it was smart, then yes i said it | |
| 17:16:45 | mdbooth | hehe | |
| 17:16:59 | sfinucan | sean-k-mooney: Which is in turn called here https://github.com/openstack/nova/blob/master/nova/virt/libvirt/firewall.py#L112-L136 | |
| 17:17:43 | sean-k-mooney | yep tracking back now. im trying to figure out if this code is still executed with os-vif | |
| 17:18:06 | sfinucan | sean-k-mooney: I think it is. It's called in a few places in the libvirt driver.py | |
| 17:18:09 | mdbooth | mriedem: So, I've been through the ERRORs generated against my NFS patch with a fine toothed comb. There are 2, and they're both existing errors where we're double-calling disconnect from higher up. They cause no ill effects other than the log message. | |
| 17:18:10 | sean-k-mooney | basically i think we could move this to os-vif if it was still needed | |
| 17:18:21 | cburgess | mriedem Sorry missed your messages yesterday, yes we use live_migration_progress_timeout why? | |
| 17:18:43 | mriedem | cburgess: https://review.openstack.org/#/c/429798 | |
| 17:18:46 | mdbooth | I originally made them ERROR because I didn't expect the errors higher up, which with hindsight perhaps I should have. | |
| 17:19:02 | mdbooth | I suggest I turn them into warnings and file bugs about them, but that we go with the NFS patch anyway. | |
| 17:19:07 | nikeshm | hi | |
| 17:19:11 | sean-k-mooney | sfinucan: so it is really called here https://github.com/openstack/nova/blob/417dac50364357000c479bb2cb7c71773172a930/nova/virt/libvirt/driver.py#L1371 | |
| 17:19:20 | nikeshm | i am getting this error libvirtError: Requested operation is not valid: pivot of disk 'vdb' requires an active copy job | |
| 17:19:30 | mriedem | lyarwood: ^ | |
| 17:20:28 | cburgess | mriedem Oh cute... thanks for the heads up. This might actually explain some issues we saw recently. | |
| 17:20:39 | nikeshm | tempest.api.compute.admin.test_volume_swap.TestVolumeSwap.test_volume_swap [416.350838s] ... FAILED | |
| 17:20:41 | mdbooth | lyarwood: If mriedem is looking for a detailed second opinion, I don't mind walking you through the logs in the morning. | |
| 17:20:50 | mdbooth | Would probably take an hour or so. | |
| 17:20:55 | lyarwood | mdbooth: sure | |
| 17:20:57 | sfinucan | sean-k-mooney: Yup | |
| 17:21:11 | sean-k-mooney | sfinucan: so this si currently called after plug but im not sure its valide to call it here in all cases. | |
| 17:21:13 | sfinucan | and it's used for "MAC, IP, and ARP spoofing protection" | |
| 17:21:18 | lyarwood | nikeshm: what virt_type are you using? | |
| 17:21:25 | mdbooth | lyarwood: Thanks! It's a date. | |
| 17:21:31 | sean-k-mooney | sfinucan: i dont think this will have any effect for vhost-user for example | |
| 17:21:46 | sfinucan | sean-k-mooney: No? How come? | |
| 17:22:10 | nikeshm | lyarwood: virt_type = qemu | |
| 17:22:16 | sean-k-mooney | how would that function configure mac,arp,ip spoofing on a vhost-user interfaces | |
| 17:22:30 | sean-k-mooney | sfinucan: that would have to be done in ovs | |
| 17:22:33 | lyarwood | nikeshm: and which verison of qemu? | |
| 17:22:41 | sfinucan | sean-k-mooney: aha, correct | |
| 17:22:48 | sfinucan | that is for IPTables only | |
| 17:23:03 | sfinucan | it's part of the IptablesFirewallDriver | |
| 17:23:09 | sean-k-mooney | sfinucan: it is for when you are using the old nova firewall not neutron security groups | |
| 17:23:23 | sfinucan | sean-k-mooney: danpb suggested otherwise though | |
| 17:23:25 | sean-k-mooney | sfinucan: it basically part of nova networks i think | |
| 17:23:36 | sean-k-mooney | sfinucan: i could be wrong | |
| 17:23:46 | mdbooth | lyarwood: Plan is to walk through the errors reported here: http://logs.openstack.org/09/395709/6/check/gate-tempest-dsvm-full-devstack-plugin-nfs-nv/c8091c2/logs/screen-n-cpu.txt.gz?level=ERROR | |
| 17:24:06 | sean-k-mooney | sfinucan: but i dont think this will have any eefect with the conntrack firewall driver in neutron for example | |
| 17:24:12 | dansmith | mriedem: you want me to replicate that multiline warning on each help string for transport and db? | |
| 17:24:43 | mriedem | dansmith: well they'd be slightly different but yeah, i don't think the actual docstring gets dumped in the cli help | |
| 17:24:45 | mriedem | i can check quick | |
| 17:25:15 | dansmith | oh I thought it did | |
| 17:25:18 | sean-k-mooney | sfinucan: looking at https://github.com/openstack/nova/blob/d5f113de34589933c23a7cecc25ca0bf5f47207d/nova/virt/libvirt/firewall.py#L117-L120 | |
| 17:25:22 | dansmith | that's the point of putting return value stuff in there right? | |
| 17:25:23 | mriedem | the help for the args is printed out, | |
| 17:25:31 | sean-k-mooney | sfinucan: it will disable this code if securty groupd are enabled | |
| 17:25:36 | mriedem | but i don't think the docstring gets into the help output for the command | |
| 17:25:45 | mriedem | and i guess i don't have a test vm handy to verify | |
| 17:25:50 | mriedem | but i had that issue with the nova-status stuff | |
| 17:25:55 | mriedem | which is why i also pushed for man pages | |
| 17:26:36 | dansmith | hmm | |
| 17:26:58 | dansmith | mriedem: remember you making me document the return values for the new cells commands there? I thought that was because the user, you know, sees that shit :) | |
| 17:27:38 | mriedem | do you have a devstack you can verify quick because i don't | |
| 17:27:42 | lyarwood | nikeshm: feel free to write this up in a bug btw if it's easier - https://bugs.launchpad.net/nova/+filebug | |
| 17:28:14 | dansmith | mriedem: I have an old one only, but let me look | |
| 17:28:46 | mriedem | just do like: nova-manage cell_v2 create_cell -h | |
| 17:29:01 | dansmith | it's too old for that :) | |
| 17:29:08 | sfinucan | sean-k-mooney: Yeah, all the guides I'm seeing suggest that nwfilter - the thing that reads that config - is only for ebtables | |
| 17:29:11 | sfinucan | i.e. not OVS | |
| 17:29:14 | sfinucan | https://www.redhat.com/archives/libvir-list/2013-November/msg00234.html | |
| 17:29:23 | dansmith | mriedem: my liberty system doesn't show that text at least | |
| 17:29:27 | dansmith | so unless something has changed... | |
| 17:29:37 | mriedem | nova-manage db sync -h | |
| 17:29:47 | mriedem | would show "Sync the database up to the most recent version" if it worked | |
| 17:30:08 | mriedem | it should show the help on the --version option though "Database version" | |
| 17:31:26 | sean-k-mooney | sfinucan: yes so this code should really only be run for linuxbridge or macvtap binding | |
| 17:31:47 | sean-k-mooney | so it proable should be moved into the linuxbridge pluging for os-vif | |
| 17:31:55 | sfinucan | sean-k-mooney: ...and even then, doesn't neutron have its own anti-spoofing stuff? | |
| 17:32:01 | sfinucan | e.g. http://kimizhang.com/neutron-ml2-port-security/ | |
| 17:32:03 | sean-k-mooney | for ovs yes | |
| 17:32:09 | sean-k-mooney | for linux bridge proably | |
| 17:32:13 | sean-k-mooney | not sure though | |
| 17:32:24 | sean-k-mooney | again i think this is mainly for nova-networks | |
| 17:32:25 | sfinucan | that blog suggests yes for linucbridge | |
| 17:32:31 | sfinucan | *linuxbridge | |
| 17:32:42 | openstackgerrit | Dan Smith proposed openstack/nova master: Add an update_cell command to nova-manage https://review.openstack.org/430354 | |
| 17:33:05 | sean-k-mooney | if you are using nova-netwokrs this code would be needed for firewall support because you would not have nova | |
| 17:33:09 | sean-k-mooney | * neutron | |
| 17:33:18 | nikeshm | lyarwood: qemu-utils 2.0.0+dfsg-2ubuntu1.30 amd64 QEMU utilities | |
| 17:33:23 | sean-k-mooney | nova-networks without nova would be hard | |
| 17:34:31 | sean-k-mooney | general question but is nova-networks dead yet? | |
| 17:35:06 | sean-k-mooney | can we actully start deleting the code for it. i kindof lost track of that effort | |
| 17:35:21 | lyarwood | nikeshm: and libvirt? | |
| 17:36:21 | nikeshm | lyarwood: libvirt-dev 1.2.2-0ubuntu13.1.17 amd64 development files for the libvirt library | |
| 17:40:34 | sfinucan | sean-k-mooney: Nope. It's there for another 2-3 cycles at least :( | |
| 17:41:10 | sean-k-mooney | :( really... why... | |
| 17:42:32 | sfinucan | sean-k-mooney: cells v1 | |
| 17:42:48 | sfinucan | need a migration path to cells v2 then another cycle for folks to switch over | |
| 17:42:49 | sean-k-mooney | cells v1 only works with nova-networks? | |
| 17:43:45 | sfinucan | from the looks of things, yup | |
| 17:43:57 | sean-k-mooney | sfinucan: so ocate cells v2 pike miragtion and queens remove nova networks? | |
| 17:44:20 | sfinucan | nope. cells v2 isn't complete yet | |
| 17:44:28 | sean-k-mooney | hum ok i taught cells v1 worked with neutron i guess not. | |
| 17:44:35 | sfinucan | you can't use more than one cell in cells v2 | |
| 17:44:54 | mriedem | sean-k-mooney: sfinucan: you can use neutron with cells v1 | |
| 17:44:58 | mriedem | godaddy is running ovs | |
| 17:45:07 | mriedem | it requires patches for the external vif plug event callbackstuff | |