| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-03-21 | |||
| 23:23:59 | mriedem | how terrible would it be if we s/https/http/ in this cinderclient code? | |
| 23:24:20 | efried | MITM? | |
| 23:24:29 | mriedem | aaS | |
| 23:25:44 | efried | mordred: Care to render an opinion? (TL;DR: is it okay to demote https to http if we're just getting the version document?) | |
| 23:26:15 | cfriesen | any way to do a MiTM attack with the version document? | |
| 23:26:29 | cfriesen | whoops, efried already said that | |
| 23:26:34 | efried | Other than, like, corrupting it. | |
| 23:26:47 | efried | Or maybe spoofing a microversion with a known security flaw? | |
| 23:26:54 | cfriesen | yeah, that's what I was thinking | |
| 23:28:14 | mriedem | otherwise i can probably hack something like where we actually create a cinderclient client object, and then use it's internal client to make the request | |
| 23:28:16 | efried | mriedem: The alternative, though, is for this method (still in cinderclient) to use proper ksa loading instead of direct requests.get | |
| 23:28:18 | mriedem | or, just use ksa | |
| 23:28:23 | efried | yeah, any of that. | |
| 23:31:16 | efried | mriedem: If we want to keep that method in cinderclient, we could add a kwarg that lets you pass in a ksa session. Then from nova use the _SESSION global which we've already loaded by that point. | |
| 23:31:17 | openstackgerrit | Jay Pipes proposed openstack/nova-specs master: Standardize CPU resource tracking https://review.openstack.org/555081 | |
| 23:31:25 | efried | mriedem: Howzat sound? | |
| 23:31:37 | mriedem | efried: i'd then have to plumb that through into cinderclient i think | |
| 23:31:44 | efried | yes, that's what I mean. | |
| 23:31:50 | mriedem | see https://bugs.launchpad.net/nova/+bug/1752152/comments/2 | |
| 23:31:51 | openstack | Launchpad bug 1752152 in OpenStack Compute (nova) queens "Attach Volume Fails with secure call to cinder" [Undecided,Triaged] | |
| 23:31:57 | mriedem | i would like to just cut out cinderclient altogether | |
| 23:31:58 | efried | The alternative is duplicating the cinderclient code in nova. | |
| 23:32:03 | efried | yeah, that. | |
| 23:32:07 | openstackgerrit | melanie witt proposed openstack/nova master: Add functional regression test for bug 1746509 https://review.openstack.org/555092 | |
| 23:32:08 | openstackgerrit | melanie witt proposed openstack/nova master: Move _make_instance_list call outside of DB transaction context https://review.openstack.org/555093 | |
| 23:32:08 | openstack | bug 1746509 in OpenStack Compute (nova) "TypeError: Can't upgrade a READER transaction to a WRITER mid-transaction" [Medium,Confirmed] https://launchpad.net/bugs/1746509 | |
| 23:32:51 | mriedem | also, we can't change cinderclient API code and require a new minimum version on stable | |
| 23:32:55 | mriedem | so that's kind of a non-starter | |
| 23:34:01 | mriedem | alright, i can make that my tomorrow if i can get a recreate with devstack configuring cinder for ssl | |
| 23:37:35 | mriedem | actually this is strange because devstack already sets up the endpoint using https if tls-proxy is enabled, which it is in our CI runs | |
| 23:40:05 | melwitt | mriedem: not always right? we had to enable it explicitly for nova-next, right? | |
| 23:40:22 | mriedem | http://logs.openstack.org/45/508345/13/check/tempest-full/893771e/controller/logs/devstacklog.txt.gz#_2018-03-15_19_48_10_167 | |
| 23:40:28 | openstackgerrit | melanie witt proposed openstack/nova master: Add functional regression test for bug 1746509 https://review.openstack.org/555092 | |
| 23:40:29 | mriedem | ENABLED_SERVICES=g-reg,rabbit,n-api,c-api,g-api,mysql,tempest,etcd3,s-proxy,q-dhcp,n-api-meta,tls-proxy,q-l3,c-sch,n-novnc,s-object,peakmem_tracker,n-cauth,q-metering,key,n-cond,s-container,q-meta,q-svc,placement-api,n-cpu,s-account,c-vol,n-obj,c-bak,q-agt,cinder,n-sch,dstat | |
| 23:40:29 | openstackgerrit | melanie witt proposed openstack/nova master: Move _make_instance_list call outside of DB transaction context https://review.openstack.org/555093 | |
| 23:40:29 | openstack | bug 1746509 in OpenStack Compute (nova) "TypeError: Can't upgrade a READER transaction to a WRITER mid-transaction" [Medium,In progress] https://launchpad.net/bugs/1746509 - Assigned to melanie witt (melwitt) | |
| 23:42:00 | melwitt | hm, okay | |
| 23:42:35 | mriedem | maybe it's a legacy job vs zuulv3 job thing, not sure | |
| 23:42:38 | mriedem | tempest-full is zuulv3 native | |
| 23:42:41 | melwitt | yep, enabled there. not sure why we had to enable it in nova-next | |
| 23:45:38 | mriedem | yeah right here http://logs.openstack.org/45/508345/13/check/nova-next/aa61d86/logs/screen-c-api.txt.gz#_Mar_15_20_00_06_201395 | |
| 23:45:43 | mriedem | Mar 15 20:00:06.201395 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: INFO cinder.api.openstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] GET https://198.72.124.205/volume/ | |
| 23:46:11 | mriedem | nstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] https://198.72.124.205/volume/ returned with HTTP 300 | |
| 23:46:11 | mriedem | pi.openstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] Calling method '<bound method VersionsController.all of <cinder.api.versions.VersionsController object at 0x7f81c53a0550>>' {{(pid=32243) _process_stack /opt/stack/new/cinder/cinder/api/openstack/wsgi.py:872}} Mar 15 20:00:06.202926 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: INFO cinder.api | |
| 23:46:11 | mriedem | Mar 15 20:00:06.201628 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: DEBUG cinder.api.openstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] Empty body provided in request {{(pid=32243) get_body /opt/stack/new/cinder/cinder/api/openstack/wsgi.py:718}} Mar 15 20:00:06.202003 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: DEBUG cind | |
| 23:46:15 | mriedem | yikes | |
| 23:46:22 | mriedem | Mar 15 20:00:06.202003 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: DEBUG cinder.api.openstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] Calling method '<bound method VersionsController.all of <cinder.api.versions.VersionsController object at 0x7f81c53a0550>>' {{(pid=32243) _process_stack /opt/stack/new/cinder/cinder/api/openstack/wsgi.py:872}} | |
| 23:46:26 | mriedem | that's hitting the versions controller | |
| 23:46:30 | mriedem | Mar 15 20:00:06.202926 ubuntu-xenial-inap-mtl01-0002993032 devstack@c-api.service[32240]: INFO cinder.api.openstack.wsgi [req-2e3a55fd-3ed7-4b7f-b902-c4671afa83c4 req-d6e11ad6-95b0-42ed-bcb2-af3996a69096 admin admin] https://198.72.124.205/volume/ returned with HTTP 300 | |
| 23:47:44 | mriedem | idk, maybe that's via the client doing it's own version negotiation | |
| 23:48:49 | mriedem | also, if this has been regressed since pike, i'm pretty sure we would have heard more about this by now right? | |
| 23:48:56 | mriedem | i assume most clouds are using ssl | |
| 23:50:53 | openstackgerrit | Artom Lifshitz proposed openstack/nova-specs master: NUMA-aware live migration https://review.openstack.org/552722 | |
| 23:58:04 | openstackgerrit | Merged openstack/nova master: Rename '_numa_get_constraints_XXX' functions https://review.openstack.org/385072 | |
| #openstack-nova - 2018-03-22 | |||
| 00:02:03 | openstackgerrit | Artom Lifshitz proposed openstack/nova-specs master: NUMA-aware live migration https://review.openstack.org/552722 | |
| 00:27:27 | openstackgerrit | Eric Fried proposed openstack/nova master: Use update_provider_tree from resource tracker https://review.openstack.org/520246 | |
| 00:27:27 | openstackgerrit | Eric Fried proposed openstack/nova master: SchedulerReportClient.update_from_provider_tree https://review.openstack.org/533821 | |
| 00:27:28 | openstackgerrit | Eric Fried proposed openstack/nova master: Move refresh time from report client to prov tree https://review.openstack.org/535517 | |
| 00:27:28 | openstackgerrit | Eric Fried proposed openstack/nova master: Fix nits in update_provider_tree series https://review.openstack.org/531260 | |
| 00:27:29 | openstackgerrit | Eric Fried proposed openstack/nova master: WIP: Add nested resources to server moving tests https://review.openstack.org/527728 | |
| 00:27:29 | openstackgerrit | Eric Fried proposed openstack/nova master: Make generation optional in ProviderTree https://review.openstack.org/539324 | |
| 00:27:31 | efried | blayum | |
| 00:32:49 | openstackgerrit | Eric Fried proposed openstack/nova-specs master: Mention (no) granular support for image traits https://review.openstack.org/554305 | |
| 00:53:20 | tetsuro | Good morning. | |
| 00:58:35 | Spazmotic | +1 more blayum? :p | |
| 00:58:36 | Spazmotic | Morning | |
| 01:00:06 | efried | Hi, and goodbye. The wife's getting pretty antsy. | |
| 01:07:06 | openstackgerrit | Merged openstack/nova master: Add disabled column to cell_mappings table. https://review.openstack.org/552505 | |
| 01:07:30 | openstackgerrit | Merged openstack/nova master: libvirt: move get_numa_memnode in designer module https://review.openstack.org/554850 | |
| 01:07:44 | openstackgerrit | Merged openstack/nova master: libvirt: move vpu_realtime_scheduler in designer https://review.openstack.org/554851 | |
| 01:10:07 | sean-k-mooney[m] | mriedem: bauzas can ye take a look at this backport for os-vif when ye get time https://review.openstack.org/#/c/531465/1 its minor but has been up for a while. just wondering if i should keep it open or abandon it. | |
| 01:11:19 | sean-k-mooney[m] | !cmd freenode AWAY until noon gmt | |
| 01:11:20 | openstack | sean-k-mooney[m]: Error: "cmd" is not a valid command. | |
| 01:11:23 | sean-k-mooney[m] | data did not work... | |
| 01:11:28 | sean-k-mooney[m] | *that | |
| 01:22:33 | openstackgerrit | zhufl proposed openstack/nova master: Fix api-ref: nova image-meta is deprecated from 2.39 https://review.openstack.org/554813 | |
| 01:24:37 | openstackgerrit | zhufl proposed openstack/nova master: Fix api-ref: nova image-meta is deprecated from 2.39 https://review.openstack.org/554813 | |
| 02:02:00 | openstackgerrit | zhufl proposed openstack/nova master: Fix api-ref: nova image-meta is deprecated from 2.39 https://review.openstack.org/554813 | |
| 03:22:38 | Spaz-Work | Morning again :P | |
| 03:32:55 | openstackgerrit | Jie Li proposed openstack/nova-specs master: Support volume-backed server rebuild https://review.openstack.org/532407 | |
| 03:42:56 | yikun | Anyone knows why NUMACell obj add the fields (1.1, 1.2) but without obj_make_compatible changing? | |
| 03:43:01 | yikun | https://github.com/openstack/nova/blob/master/nova/objects/numa.py#L51-L53 | |
| 03:43:08 | yikun | It seems only this one is an exception in all Nova object. | |
| 04:14:59 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: trivial: omit condition evaluations https://review.openstack.org/545248 | |
| 04:21:24 | openstackgerrit | Yikun Jiang (Kero) proposed openstack/nova master: WIP: Add host info to instance action events https://review.openstack.org/555146 | |
| 04:28:08 | openstackgerrit | Merged openstack/nova master: Preserve multiattach flag when refreshing connection_info https://review.openstack.org/554667 | |
| 05:16:12 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: add check before adding cpus to cpuset_reserved https://review.openstack.org/539865 | |
| 05:24:16 | openstackgerrit | jichenjc proposed openstack/nova master: fix race condition of instance host https://review.openstack.org/494458 | |
| 05:28:03 | openstackgerrit | jichenjc proposed openstack/nova master: Move placement test cases from db to placement https://review.openstack.org/553149 | |
| 05:48:41 | openstackgerrit | jichenjc proposed openstack/nova master: Avoid live migrate to same host https://review.openstack.org/542689 | |
| 06:10:18 | openstackgerrit | jichenjc proposed openstack/nova master: Not instance to ERROR if set_admin_password failed https://review.openstack.org/555160 | |
| 06:10:52 | openstackgerrit | OpenStack Proposal Bot proposed openstack/nova master: Imported Translations from Zanata https://review.openstack.org/548772 | |
| 06:14:53 | openstackgerrit | jichenjc proposed openstack/nova master: Trivial fix: move log to earlier https://review.openstack.org/555164 | |
| 06:30:48 | openstackgerrit | Merged openstack/nova stable/queens: Handle not found error on taking snapshot https://review.openstack.org/550660 | |
| 06:45:10 | openstackgerrit | pippo proposed openstack/nova master: Update links in README https://review.openstack.org/555169 | |
| 06:45:18 | zer0c00l | if my nova endpoint is at https://novaapi.example.com:4443/nova_api, when i curl that endpoint i get something like http://novaapi.example.com/v2/ instead of https://novaapi.example.com/nova_api/v2 | |
| 06:45:32 | zer0c00l | why is that? is that because some kind of misconfiguration or is it expected | |
| 07:00:44 | mayur_ind | hi folks | |
| 07:01:08 | mayur_ind | getting following error in nova http://paste.openstack.org/show/708826/ | |
| 07:01:36 | mayur_ind | what may be the reason for this, is there way to solve it.? | |