| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-03-24 | |||
| 18:40:14 | nkorabli | look into the second screenshot I attached, you can see all the command I run and status of the instance | |
| 18:40:17 | mriedem | that gets stored in the instance metadata when shelving on the compute https://github.com/openstack/nova/blob/master/nova/compute/manager.py#L4326 | |
| 18:40:39 | nkorabli | I don't think I deleted any snapshot | |
| 18:40:55 | mriedem | when you unshelve, conductor looks up the snapshot image from that metadata https://github.com/openstack/nova/blob/master/nova/conductor/manager.py#L656 | |
| 18:41:03 | mriedem | and would use that image to recreate the instance on another compute | |
| 18:41:15 | mriedem | you're hitting a problem where the snapshot image ID can't be found | |
| 18:41:18 | mriedem | for the shelved instance | |
| 18:41:30 | openstackgerrit | Anusha Unnam proposed openstack/nova master: Add keypairs field to InstancePayload https://review.openstack.org/419730 | |
| 18:41:55 | mriedem | nkorabli: do you have access to the database? | |
| 18:42:15 | mriedem | i would check the glance database (or api i guess) for the snapshot image with that id in the error | |
| 18:42:22 | mriedem | the 52d95c... id | |
| 18:42:24 | nkorabli | I can check, I tested that it all with devstack | |
| 18:42:53 | mriedem | did you unshelve before the instance was completely marked as 'shelved_offloaded'? | |
| 18:43:01 | mriedem | these are async operations | |
| 18:43:06 | nkorabli | nope | |
| 18:43:40 | mriedem | your command screenshot doesn't show the unshelve command you ran | |
| 18:44:01 | nkorabli | take a look at the second screenshot I attached, I do a check after every action - to see what is the state of instance | |
| 18:44:06 | mriedem | oh wait a minute, | |
| 18:44:09 | nkorabli | hmmm | |
| 18:44:10 | mriedem | i bet i know the issue, | |
| 18:44:13 | mriedem | you shelved as one user, | |
| 18:44:23 | mriedem | so the snapshot image only has access from that user, | |
| 18:44:35 | mriedem | so when you go to unshelve, the unshelve user context doesn't have access to the private snapshot image | |
| 18:44:38 | mriedem | and you get a 404 | |
| 18:45:00 | nkorabli | Yeah, I described this in the bug description | |
| 18:45:22 | nkorabli | I mean, that snapshot is stored under admin | |
| 18:45:29 | mriedem | yeah sorry i missed that | |
| 18:45:34 | mriedem | just connected those dots :) | |
| 18:45:59 | nkorabli | no problems :) it's always good to ask questions and double check :) | |
| 18:46:10 | nkorabli | So, I suppose it's a bug | |
| 18:46:16 | mriedem | i believe the admin user can give membership access to the demo user so they can use the image | |
| 18:46:43 | mriedem | it may be a bug in nova that we aren't using the instance owner for the image | |
| 18:47:39 | nkorabli | I just want to find the right workflow - like if it's shelved by admin, than demo user shoudn't be able to unshelve it? or not? | |
| 18:49:25 | mriedem | i'd need to see what we do for snapshot, since it's a similar case, | |
| 18:49:38 | mriedem | if the admin snapshots a demo user's instance, can the demo user access that snapshot image | |
| 18:49:57 | mriedem | it's slightly different though because the demo user doesn't need to really care about that snapshot image, they may never need it, | |
| 18:50:01 | mriedem | but for unshelve, the instance is tied to it | |
| 18:51:09 | nkorabli | yeaaah :) it's confusing a bit | |
| 18:54:45 | jroll | mriedem: I've got $20 on that behavior coming from some forensics use case | |
| 18:55:02 | mriedem | jroll: like, murder? | |
| 18:55:09 | jroll | maybe! | |
| 18:55:14 | jroll | all sorts of crime, really | |
| 19:02:11 | mriedem | i've got to say i'm not following the CIS angle to this | |
| 19:02:25 | mriedem | is that some kind of michigander joke? | |
| 19:03:56 | nkorabli | mriedem: I also realized, that I have not attached the whole list of commands I ran. Updated it | |
| 19:07:42 | openstackgerrit | Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779 | |
| 19:10:36 | openstackgerrit | Anusha Unnam proposed openstack/nova master: Add description to policies in services.py https://review.openstack.org/449782 | |
| 19:11:12 | openstackgerrit | Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779 | |
| 19:14:09 | mriedem | it looks like when we create a snapshot image, we set is_public=False, which for glance v2 is visibility=private | |
| 19:14:18 | mriedem | looking at the image api docs, the default visibility is shared | |
| 19:14:35 | mriedem | which means we could add the instance owner to the snapshot as a member | |
| 19:15:19 | mriedem | i start to get totally lost when talking about image membership, and the image.owner value | |
| 19:15:31 | mriedem | because i believe it's all configurable in glance to behave differently | |
| 19:15:39 | mriedem | mordred: ^ i'm sure you've experienced this? | |
| 19:16:08 | mriedem | and the image member has to 'accept' membership before they can see the image | |
| 19:17:18 | nkorabli | but maybe demo user just shouldn't have permission to unshelve it once admin shelved it? I guess it make sense | |
| 19:17:38 | mriedem | the default policy on shelve and unshelve is admin or owner | |
| 19:17:50 | mriedem | so if the admin shelves my instance, i as the owner should still be able to unshelve it | |
| 19:18:03 | nkorabli | when demo user is an operator, for example and admin is aware of the resources and stuff.. | |
| 19:18:33 | mriedem | then idk, i guess restrict the policy on unshelve to be admin-only | |
| 19:18:43 | mriedem | but then why shelve at all? | |
| 19:20:03 | nkorabli | well, shelving is a mystery thing for me. As I would say it's kind of a rudiment.. I maybe wrong here :) | |
| 19:22:38 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404 | |
| 19:22:40 | nkorabli | but basically, it is maybe useful when you need to save resources.. Like - this VM won't be used for next week/month, but then you will need it, so you shelve and unshelve it... But I am not sure about it either. | |
| 19:23:58 | mriedem | well that's the idea yeah | |
| 19:24:07 | mriedem | why the admin would do it though, i'm not sure | |
| 19:25:24 | mordred | mriedem: looking | |
| 19:26:08 | mordred | mriedem: I have not played with shared images yet, no - although I'm starting to feel like maybe I shoud ... | |
| 19:26:19 | openstack | Launchpad bug 1675791 in OpenStack Compute (nova) "Instance created by demo user(non-admin), shelved by admin and unshelved by demo user --> ends up in error state " [Undecided,Invalid] | |
| 19:26:19 | mriedem | nkorabli: see if this makes sense https://bugs.launchpad.net/nova/+bug/1675791/comments/10 | |
| 19:26:23 | mriedem | but i think image membership is what we need | |
| 19:26:46 | mriedem | basically, if the admin shelves a user's instance, the admin owns the image, but the instance user owner needs to be a member on the share dimage, | |
| 19:26:48 | mriedem | *shared image | |
| 19:26:49 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #3: TaskFlow https://review.openstack.org/438729 | |
| 19:26:55 | mriedem | so the instance user can later unshelve the instance, | |
| 19:27:13 | mriedem | the docs say an image member can't see the image when listing images until they accept the membership, | |
| 19:27:20 | mriedem | but they can GET the image if they know the specific ID | |
| 19:27:22 | mriedem | which we do in the unshelve case | |
| 19:27:26 | mriedem | nkorabli: i think that's the fix | |
| 19:28:01 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #4: full flavor https://review.openstack.org/391288 | |
| 19:28:38 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: console https://review.openstack.org/409402 | |
| 19:29:08 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: SSP emphemeral disk support https://review.openstack.org/443189 | |
| 19:29:17 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404 | |
| 19:30:09 | efried | adreznec esberglu The whole pile is ready for subteam +1s again. | |
| 19:30:20 | efried | Got up to cfg_drv this time. | |
| 19:30:25 | efried | Will update the etherpad accordingly. | |
| 19:30:39 | esberglu | efried: ack | |
| 19:30:59 | efried | (mriedem I'm gonna keep the bottom one in "ready for your review" section - changes trivial since last subteam +1) | |
| 19:46:12 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: API support for tagged device attachment https://review.openstack.org/376021 | |
| 19:46:33 | nkorabli | mriedem: alright! I see. Still think that if it's shelved by admin - user shouldn't be able to unshelve it, though :) But it's kind of a bikeshed probablu | |
| 19:46:42 | nkorabli | *probably | |
| 19:47:18 | nkorabli | so should I change the ticket status? | |
| 19:47:19 | mriedem | nkorabli: in that case, i'd ask in the dev and operators mailing list since this is a latent issue | |
| 19:47:33 | mriedem | nkorabli: i'm genuinely curious what operators think about this | |
| 19:48:27 | melwitt | if the instance is owned by the user, I don't see why they shouldn't be able to unshelve it, no matter who shelved it | |
| 19:48:40 | mriedem | melwitt: i agree | |
| 19:48:49 | mriedem | nkorabli: do you want to send that email or should i? | |
| 19:48:55 | nkorabli | mriedem: Agree, it make sense | |
| 19:49:50 | nkorabli | mriedem: I can do this, just may need your help if someone won't get the idea.. | |
| 19:51:28 | nkorabli | just don't have any experience with mailing lists.. Is there any requirements of how I have to ask questions there? | |