| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-09-29 | |||
| 17:46:51 | pino | penick: mriedem: (and Jay Pipes, can't find his handle) a few days ago I asked about injecting dynamically generated SSH certificates into the host. You pointed me to vendordata, cloud-init (and the novajoin example). I've played with it and have some more questions/issues. Do you have a few minutes? | |
| 17:47:14 | leakypipes | pino: I'm leakypipes on Fridays :) | |
| 17:47:19 | pino | Specifically, I'm worried about the SSH host certificate. | |
| 17:47:36 | pino | leakypipes: :-) | |
| 17:48:18 | pino | So, the problem with the host certificate is that you need to pass the host public key to the Host CA signing service to generate the certificate, then inject it back. | |
| 17:49:02 | pino | But vendor data doesn't take any arguments, so you're forced to either generate the host keys off the instance, or you need to expose a service directly to the instance. | |
| 17:50:31 | pino | Both are problematic: exposing the signing service to the instance means the instance has to be able to authenticate itself to the service (chicken-and-egg problem). | |
| 17:50:34 | mriedem | interop tag?! | |
| 17:50:55 | pino | Is that comment for me? | |
| 17:51:00 | mriedem | no | |
| 17:51:02 | mriedem | sorry | |
| 17:53:33 | pino | Maybe an e-mail would be more effective... | |
| 17:53:50 | pino | I'll write it all up and send to the mailing list instead. | |
| 17:53:58 | mriedem | pino: to the openstack-dev mailing yeah, probably | |
| 18:02:05 | mriedem | leakypipes: the explanations for https://review.openstack.org/#/c/506093/ are in the commit message | |
| 18:02:13 | mriedem | the functional test fails without those changes to the fake virt driver | |
| 18:02:22 | leakypipes | mriedem: I still couldn't understand the explanation. | |
| 18:02:30 | leakypipes | mriedem: which is what I said in the comment../. | |
| 18:02:39 | mriedem | if you do live migration with block_migration=auto, | |
| 18:02:45 | mriedem | that passes block_migration=None, | |
| 18:02:55 | mriedem | which you can't set on MigrateData b/c it's not a nullable=True field | |
| 18:03:25 | cburgess | Do we have a supported/approved method for purge deleted instances from the DB? | |
| 18:03:27 | mriedem | and we have to return migrate_data from the other method otherwise it doesn't come out during post_live_migration, and we can't set the status on the migration object to 'completed', which is what the functional test is waiting for | |
| 18:03:33 | mriedem | cburgess: we don't | |
| 18:03:39 | cburgess | mriedem Wow still really? | |
| 18:03:40 | mriedem | we had a spec a few releases ago | |
| 18:03:49 | mriedem | and a patch at one point | |
| 18:04:00 | cburgess | *sad panda* | |
| 18:05:17 | cburgess | My life just got a lot more complicated. | |
| 18:05:32 | mriedem | did you find out you're pregnant? | |
| 18:05:41 | cburgess | No the lack of purge support... | |
| 18:05:46 | mriedem | oh, that | |
| 18:05:57 | melwitt | I thought archived_deleted_rows mostly worked now | |
| 18:05:59 | mriedem | https://specs.openstack.org/openstack/nova-specs/specs/mitaka/approved/purge-deleted-instances-cmd.html | |
| 18:06:03 | mriedem | archive != purge | |
| 18:06:08 | cburgess | OK.. | |
| 18:06:08 | cburgess | Wait.. | |
| 18:06:16 | superdan | archive should be a lot better now yeah | |
| 18:06:17 | cburgess | So whats archived_deleted_rows | |
| 18:06:19 | mriedem | archive means, put some shit in the storage room but don't delete it | |
| 18:06:20 | cburgess | ? | |
| 18:06:26 | mriedem | moves things to shadow tables | |
| 18:06:29 | superdan | and then you can dump the storage room after each thing | |
| 18:06:31 | superdan | easily | |
| 18:06:31 | mriedem | deleted things | |
| 18:06:32 | melwitt | it deletes it from the main tables | |
| 18:06:33 | superdan | without constraints | |
| 18:06:35 | cburgess | Oh.. | |
| 18:06:45 | cburgess | That would do what I needed. | |
| 18:06:52 | mriedem | cburgess: nova-manage db archive_deleted_rows --verbose --until-complete | |
| 18:07:03 | cburgess | Cool. I'll look into it. Thanks. | |
| 18:07:18 | cburgess | Oh this.. https://blueprints.launchpad.net/nova/+spec/archive-deleted-rows-all | |
| 18:07:22 | superdan | mriedem: wanna peek behind my curtain? | |
| 18:07:23 | mriedem | it's not multicell aware, but you're on folsom so that doesn't matter for you | |
| 18:07:24 | cburgess | Looks like melwitt Worked on it. | |
| 18:07:31 | cburgess | I'm not on folsom.. god.. | |
| 18:07:39 | mriedem | superdan: which curtain? | |
| 18:07:39 | cburgess | We never used Folsom. | |
| 18:07:54 | superdan | mriedem: this one over here.. the one that hides my current git tree | |
| 18:08:05 | melwitt | yeah, there might be some issues if you keep the archived data indefinitely. recently I learned primary keys can be reused after a DB restart with innodb, so archive can fail if there are dupes | |
| 18:08:22 | superdan | melwitt: cburgess wants to dump the shadow tables immediately though, so no problem | |
| 18:08:35 | melwitt | yep +1 | |
| 18:08:38 | cburgess | Yeah cool. | |
| 18:08:45 | cburgess | I will investigate this feature. Thanks team! | |
| 18:08:54 | melwitt | just sharing my recent revelation, just in case | |
| 18:09:01 | superdan | mriedem: | |
| 18:09:02 | superdan | a3d7d30 Merge build requests into the sortmaster 9000 | |
| 18:09:02 | superdan | % gsl HEAD^.. | |
| 18:09:32 | superdan | mriedem: you may ooh and ahh now | |
| 18:10:26 | mriedem | i don't know what you're talking about | |
| 18:10:38 | mriedem | oh | |
| 18:10:39 | superdan | bah | |
| 18:10:40 | mriedem | now i get it | |
| 18:11:07 | mriedem | jesus, is there anything the sortmaster 9000 can't do? | |
| 18:11:15 | mriedem | oh i know | |
| 18:11:31 | mriedem | RFE: please make the sortmaster 9000 allow me to pass a volume type during boot from volume | |
| 18:12:57 | mriedem | oh btw | |
| 18:13:04 | mriedem | http://zuulv3.openstack.org/ | |
| 18:13:04 | mriedem | if you're looking for queued stuff | |
| 18:14:44 | mriedem | this pike regression fix needs another +2 https://review.openstack.org/#/c/507938/ | |
| 18:14:47 | mriedem | the zuul failure is the nnet job | |
| 18:15:49 | superdan | which hasn't merged yet right? | |
| 18:15:51 | superdan | the nnet fix? | |
| 18:15:57 | mriedem | i'm watching it | |
| 18:16:00 | mriedem | but no | |
| 18:16:52 | melwitt | I have a tox.ini patch up for adding stderr/stdout capture and test timeout to the functional and api_sample_tests https://review.openstack.org/#/c/507976 | |
| 18:17:12 | melwitt | if anyone wants to help get stdout capturing back | |
| 18:19:18 | mriedem | melwitt: commented, | |
| 18:19:23 | mriedem | there might be a way to avoid the duplication | |
| 18:20:44 | melwitt | thanks | |
| 18:36:54 | mriedem | ok i think these nnet zuul job changes are all passing | |
| 18:36:58 | mriedem | so i'll bug infra after that | |
| 18:44:22 | cburgess | mriedem melwitt Is there a minimum reliable version that supported the archive thing (as in not before liberty etc)? Looks like the command first went in for grizzly. | |
| 18:44:35 | cburgess | superdan too | |
| 18:44:37 | mriedem | looking | |
| 18:44:41 | mriedem | you want the --until-complete thing | |
| 18:44:46 | cburgess | OK. | |
| 18:44:51 | mriedem | i want to say ocata | |
| 18:44:51 | cburgess | I can figure out when that went in then. | |
| 18:45:05 | cburgess | Prior to that it didn't work at all or... it was just inefficient? | |