Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2017-11-23
11:24:48 mdbooth Indeed
11:24:50 lyarwood mdbooth: we don't cache it and can't fetch it at start up
11:25:14 mdbooth I think with encryption credentials we *mustn't* cache it, right?
11:26:07 lyarwood mdbooth: if we want to avoid the start up issue yeah, the rest of the time we are just fetching them from cinder with each encryptor attach/detach
11:26:18 lyarwood ah sorry
11:26:22 lyarwood mustn't
11:26:25 lyarwood didn't parse that
11:26:49 lyarwood yeah we don't want to store the key locally etc
11:26:55 mdbooth I mean, it seems dumb to isolate the security of your volume from Nova, then store the key material in Nova's db
11:27:01 lyarwood yeah
11:28:08 mdbooth The behaviour of libvirt's _get_guest_storage_config is extremely unfortunate
11:28:15 mdbooth It really shouldn't be connecting volumes
11:54:59 openstackgerrit Merged openstack/python-novaclient master: Add support for microversion 2.55 - flavor description https://review.openstack.org/520819
12:10:17 openstackgerrit Balazs Gibizer proposed openstack/nova master: Transform missing delete notifications https://review.openstack.org/410297
12:10:18 openstackgerrit Balazs Gibizer proposed openstack/nova master: Send soft_delete from context manager https://review.openstack.org/476459
12:18:34 openstackgerrit Merged openstack/nova master: factor out compute service start in ServerMovingTest https://review.openstack.org/503037
12:18:42 openstackgerrit Merged openstack/nova master: Test resource allocation during soft delete https://review.openstack.org/495159
12:22:02 kashyap mdbooth: Random aside -- Nova does use 'cache=none' by default; except for network storage backends (as you know).
12:22:13 kashyap libvirt/driver.py --> disk_cachemode() --> self._disk_cachemode = "none"
12:22:23 openstackgerrit Ildiko Vancsa proposed openstack/nova master: Implement new attach Cinder flow https://review.openstack.org/330285
12:22:24 openstackgerrit Ildiko Vancsa proposed openstack/nova master: libvirt: Allow multiple volume attachments https://review.openstack.org/267587
12:28:44 openstackgerrit Ildiko Vancsa proposed openstack/nova master: Implement new attach Cinder flow https://review.openstack.org/330285
12:28:45 openstackgerrit Ildiko Vancsa proposed openstack/nova master: libvirt: Allow multiple volume attachments https://review.openstack.org/267587
12:32:02 openstackgerrit sean mooney proposed openstack/nova master: WIP stub out changes for multi port bindings https://review.openstack.org/522537
12:33:16 openstackgerrit Ildiko Vancsa proposed openstack/nova master: libvirt: Allow multiple volume attachments https://review.openstack.org/267587
12:33:16 openstackgerrit Ildiko Vancsa proposed openstack/nova master: Implement new attach Cinder flow https://review.openstack.org/330285
12:43:09 openstackgerrit Merged openstack/nova master: Change live_migrate tests to use fakedriver https://review.openstack.org/505202
12:43:16 openstackgerrit Merged openstack/nova master: Use FakeLiveMigrateDriver in notification test https://review.openstack.org/519405
12:47:45 openstackgerrit Merged openstack/nova master: Transform instance-live_migration_pre notification https://review.openstack.org/482070
12:49:52 mdbooth kashyap: Right, that's what I thought from looking at the code. I think you showed me a CI log using writeback though, right?
12:50:03 kashyap mdbooth: Yes, that's for network storage (Ceph)
12:50:16 kashyap Which means something else, as you know.
12:50:34 mdbooth Ah, I thought the log you showed me was non-ceph
12:50:49 kashyap It was Ceph, sorry for misinforming. I sit corrected
12:50:51 mdbooth And I'd assumed we'd explicitly configured CI to prefer performance over data integrity
12:51:00 mdbooth Which wouldn't be unreasonable
12:51:04 kashyap Yeah
12:55:12 openstackgerrit Forest Romain proposed openstack/nova master: Fix list servers by hypervisor https://review.openstack.org/518699
12:56:03 kashyap mdbooth: Also - https://review.openstack.org/#/c/522067/1
13:06:20 openstackgerrit Merged openstack/nova master: Fix the usage of instance.snapshot notification sample https://review.openstack.org/520579
13:59:20 bauzas heh, I never saw the gate so empty :p
13:59:31 bauzas eat turkey, folks!
14:00:19 bauzas (at least, the ones wanting to eat turkey are just awakening and preparing the dinner :p )
14:20:57 mdbooth Can't build current requirements, as protobuf 3.5.0 doesn't seem to be a thing
14:21:24 mdbooth Although as it only seems to be in upper-requirement.txt, not entirely sure why it needs to be
14:21:28 mdbooth Anybody else hit this?
14:22:27 mdbooth probuf was bumped in Ie610db5304707e3db9f7025037405a3af79d2ce3, which landed on 17th (last Friday)
14:23:41 tssurya mdbooth : yes
14:24:03 openstack Launchpad bug 1734009 in OpenStack Global Requirements "No matching distribution found for protobuf===3.5.0" [Undecided,New]
14:24:03 tssurya mdbooth : https://bugs.launchpad.net/openstack-requirements/+bug/1734009
14:24:21 mdbooth tssurya: Thanks
14:27:11 kashyap mdbooth: It's not Friday yet, but check out this easter egg here :-)
14:27:16 kashyap https://unix.stackexchange.com/questions/405783/why-does-man-print-gimme-gimme-gimme-at-0030
14:27:32 kashyap Typing 'man' command after 00:30 prints "gimme gimme gimme"
14:27:39 kashyap An allusion to some pop culture song :P
14:29:06 kashyap The "bug" is fixed, though. The author admits "It was never meant to affect non-error cases."
14:29:21 mdbooth kashyap: lol
14:29:47 kashyap mdbooth: But I like it that they fixed it _while_ retaining the easter egg.
14:52:08 johnthetubaguy mdbooth: +1 what lyarwood said, hoping for connection_info fetched from cinder every time, the current patches don't quite get there yet, but should be possible.
14:52:47 mdbooth johnthetubaguy: Was pretty sure that was where we were heading, but noted that it would regress restart after host reboot
14:53:15 johnthetubaguy mdbooth: you would just pull from cinder I think, or would that break for some reason?
14:53:31 mdbooth johnthetubaguy: This currently works only because we cache it, as we can't fetch it from cinder without an auth context
14:53:53 johnthetubaguy oh right, there are other cases as well I think
14:54:05 johnthetubaguy auto unrescue I think
14:54:14 johnthetubaguy we need an admin token like we do for neutron
14:54:22 johnthetubaguy I had totally forgotten about that mess
14:54:29 johnthetubaguy just as well we don't drop the cache yet
14:54:47 johnthetubaguy ildikov: tl;dr you are correct to keep caching connection_info for now: ^
14:55:04 johnthetubaguy mdbooth: great reminder, complete forgot all that
14:56:24 mdbooth johnthetubaguy: lyarwood Not familiar with the admin token thing. Does that provide Nova with some special admin privs when calling a remote service without requiring user creds?
14:56:40 mdbooth And does it exist already for cinder, or is it currently a neutron only concept?
14:58:17 mdbooth johnthetubaguy: For additional context, btw, encrypted volumes are broken in the above situation because we *don't* cache credentials (and mustn't)
14:58:44 johnthetubaguy ah, right...
14:58:51 openstackgerrit Balazs Gibizer proposed openstack/nova master: Send soft_delete from context manager https://review.openstack.org/476459
14:58:51 openstackgerrit Balazs Gibizer proposed openstack/nova master: Transform missing delete notifications https://review.openstack.org/410297
14:59:10 mdbooth So we're already not doing this properly for instances with volumes
14:59:17 johnthetubaguy mdbooth: the admin token is really just something that access all projects, so you don't need to use the non-existent user token
14:59:43 johnthetubaguy creds are just in the nova conf
14:59:58 mdbooth johnthetubaguy: Would that allow me to fetch a volume's encryption credentials?
15:00:15 johnthetubaguy I presume it should, for better or worse
15:00:34 mdbooth If it does, we might as well just cache them
15:00:42 mdbooth In which case, we might as well not have them
15:01:21 johnthetubaguy there was a plan to fetch it from nova-conductor, assuming AMQP gets secured, but you can still get the key
15:01:56 johnthetubaguy i.e. nova-conductor has the admin token and does the fetch on behalf of nova-compute
15:02:24 mdbooth That's still not separating the management domains.
15:02:31 johnthetubaguy agreed
15:02:40 mdbooth Unless I've completely misunderstood what volume encryption is for
15:03:00 johnthetubaguy the main use case I heard was when you don't trust the shared storage, rather than securing the hypervisor aas such
15:03:19 johnthetubaguy or rather, the shared storage is more shared than you would like
15:03:51 mdbooth Does cinder have an admin token?
15:04:14 mdbooth Or are we literally just talking about the bit bucket?
15:06:01 johnthetubaguy mdbooth: not sure what you mean, we don't have one in the conf yet, AFAIK
15:13:12 openstackgerrit jiangpf proposed openstack/nova master: Encode libvirt domain XML in UTF-8 https://review.openstack.org/522161
15:23:14 openstackgerrit Matt Riedemann proposed openstack/nova master: Deprecate file injection https://review.openstack.org/522027
15:29:46 openstackgerrit Merged openstack/python-novaclient master: Use utils.prepare_query_string instead of duplicated code https://review.openstack.org/515640
15:35:15 openstackgerrit Matt Riedemann proposed openstack/nova master: Fix NoneType error when [service_user] is misconfigured https://review.openstack.org/521947
15:38:04 openstackgerrit Stephen Finucane proposed openstack/nova master: live-mig: Add claims and proper resource tracking https://review.openstack.org/244489
15:43:39 smcginnis mdbooth: Some would argue he is.
15:55:23 openstackgerrit Stephen Finucane proposed openstack/nova master: live-mig: Add claims and proper resource tracking https://review.openstack.org/244489
15:55:46 stephenfin cfriesen: How bored are you today? ^

Earlier   Later