| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-04-19 | |||
| 20:36:56 | mriedem | if i don't have barbican, i can't support trusted certs | |
| 20:37:10 | mriedem | s/barbican/any castellan implementation' | |
| 20:38:26 | mriedem | heh looks like we don't have os_compute_api:servers:attach_volume documented | |
| 20:38:42 | mriedem | oh os_compute_api:servers:create:attach_volume | |
| 20:39:17 | mriedem | jackie-truong: yeah so i'd expect to see a policy rule like os_compute_api:servers:trusted_certs | |
| 20:39:21 | jackie-truong | oh okay, i see | |
| 20:39:24 | mriedem | use that for both server create and rebuild | |
| 20:39:36 | mriedem | and no need to check the policy rule on the response (in the view builder) | |
| 20:40:20 | mriedem | if we wanted to get super granular we could have both os_compute_api:servers:create:trusted_certs and os_compute_api:servers:rebuild:trusted_certs | |
| 20:40:28 | mriedem | i do'nt know why we would need to, maybe edmondsw has a preference | |
| 20:40:32 | mriedem | he dreams about this stuff | |
| 20:41:03 | openstackgerrit | Merged openstack/nova stable/ocata: Refactor a test method including 3 test cases https://review.openstack.org/561603 | |
| 20:41:16 | edmondsw | lol | |
| 20:41:33 | mriedem | you know it's true, waking up in a sweat, | |
| 20:41:38 | edmondsw | why are we creating a policy for this? | |
| 20:41:39 | mriedem | "what was it honey? bad dream?" | |
| 20:41:42 | mriedem | "POLICY?!!?!" | |
| 20:41:49 | edmondsw | definitely a bad dream | |
| 20:42:03 | mriedem | edmondsw: http://lists.openstack.org/pipermail/openstack-dev/2018-April/129494.html | |
| 20:42:23 | edmondsw | I saw that, haven't gotten to replying... but seems more like a conf than policy thing | |
| 20:42:32 | dansmith | heh | |
| 20:42:36 | edmondsw | policy is when you want to allow some folks to do it but not others | |
| 20:42:45 | edmondsw | not when you want to enable/disable something entirely | |
| 20:42:59 | edmondsw | did I misunderstand? | |
| 20:43:24 | mriedem | well, | |
| 20:43:25 | dansmith | 🍿 | |
| 20:43:26 | jaypipes | zzzeek_: noticed this littering unit test output nowadays: http://paste.openstack.org/show/719587/. I'm actually not sure how to fix... any ideas? | |
| 20:43:36 | mriedem | consider you have some tenants that want/can do the trusted certs thing, | |
| 20:43:53 | mriedem | and you have those tenants tied to host aggregates via the tenant isolation multitenancy filter | |
| 20:43:59 | melwitt | well, can be both right? if one cloud wants to disable something but another wants to enable it, having it controlled by policy at least gives a consistent behavior where you can get 403 if you're not allowed or if that cloud doesn't allow | |
| 20:44:02 | mriedem | and you know those hosts are configured for cert validation | |
| 20:44:11 | mriedem | melwitt: yes | |
| 20:44:23 | mriedem | i'm looking for consistent api behavior with a 403 | |
| 20:44:45 | edmondsw | ok, so that's what I missed... you DO want to allow it for some folks and not for others in a single cloud | |
| 20:44:59 | melwitt | dansmith: good job putting emoji in here, didn't know we could do that | |
| 20:45:25 | dansmith | melwitt: really? cdent does it incessantly | |
| 20:45:30 | openstackgerrit | Merged openstack/os-traits master: GPU: define traits for maximum display heads https://review.openstack.org/553277 | |
| 20:45:53 | melwitt | oh, that checkmark thing. I have seen that | |
| 20:45:57 | edmondsw | dansmith cdent who wants to teach the rest of us? ;) | |
| 20:46:13 | dansmith | um.. paste? | |
| 20:46:20 | melwitt | but the popcorn has at least three colors in it | |
| 20:46:26 | edmondsw | oh, that simple | |
| 20:46:28 | dansmith | https://emojipedia.org/popcorn/ | |
| 20:46:31 | dansmith | click copy | |
| 20:46:33 | dansmith | then paste | |
| 20:46:35 | dansmith | it's like | |
| 20:46:37 | dansmith | rocket surgery | |
| 20:46:45 | edmondsw | lol | |
| 20:46:50 | melwitt | wah, that's hard | |
| 20:47:49 | zzzeek_ | jaypipes: this is the context for that: https://bitbucket.org/zzzeek/sqlalchemy/commits/63a7b2d2d940#chg-test/orm/test_evaluator.py | |
| 20:48:05 | zzzeek_ | jaypipes: it means you are doing query.update({Object.foo = column('bar')}) | |
| 20:48:34 | zzzeek_ | jaypipes: need to use the real Whereever.bar column. that was an error raise until nova caused a lot of failures :) | |
| 20:48:49 | zzzeek_ | jaypipes: *or*, dont use the "evaluate" strategy | |
| 20:49:06 | melwitt | 🍿<-- dazzling | |
| 20:49:36 | jaypipes | zzzeek_: I have no idea what that means :( | |
| 20:49:57 | zzzeek_ | jaypipes: need to show me where you are caling query.update() | |
| 20:50:00 | melwitt | mriedem: looks like things are happy with this backport now. care to reapply +W? https://review.openstack.org/#/c/539013 | |
| 20:50:24 | jaypipes | zzzeek_: I'm not... it's literally appears thousands of times when I run the unit tests in nova. | |
| 20:50:49 | zzzeek_ | jaypipes: ok by "you" i mean, "you nova people" | |
| 20:50:50 | jaypipes | zzzeek_: fresh master checkout, nothing to do with my local changes. | |
| 20:50:57 | melwitt | *gasp* | |
| 20:51:00 | zzzeek_ | jaypipes: it's not related to your changes it's related to existing code in nova | |
| 20:51:22 | jaypipes | zzzeek_: ok. where we are calling query.update() or query.delete()? | |
| 20:51:30 | edmondsw | mriedem jackie-truong so I don't reallly have a strong opinion between 1) os_compute_api:servers:trusted_certs and 2) both os_compute_api:servers:create:trusted_certs and os_compute_api:servers:rebuild:trusted_certs | |
| 20:51:33 | edmondsw | at least not today :) | |
| 20:51:54 | mriedem | alright | |
| 20:51:57 | zzzeek_ | jaypipes: i dunno. maybe turn those warnigs into error raises and stacktrace will show | |
| 20:52:08 | zzzeek_ | jaypipes: unless nova is calling some other ORM-related application | |
| 20:52:14 | edmondsw | I'd probably go granular, but there are pros and cons | |
| 20:52:14 | jackie-truong | edmondsw: Np. I went with option 2 | |
| 20:52:20 | edmondsw | cool | |
| 20:52:35 | melwitt | gmann has a spec proposed for making policy more granular | |
| 20:52:59 | edmondsw | oh? | |
| 20:53:07 | edmondsw | I'll have to go find that | |
| 20:53:19 | melwitt | or consistently granular https://review.openstack.org/#/c/547850 | |
| 20:53:36 | melwitt | more granular | |
| 20:54:27 | mriedem | melwitt: hmm, how is https://review.openstack.org/#/c/539013/ passing if https://review.openstack.org/#/c/562739/ isn't merged yet? | |
| 20:54:40 | melwitt | mriedem: hah, good question | |
| 20:54:58 | edmondsw | melwitt tx, added to my queue | |
| 20:55:09 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/ocata: WIP Revert "Proper error handling by _ensure_resource_provider" https://review.openstack.org/562739 | |
| 20:55:36 | mriedem | melwitt: unless it's a race | |
| 20:55:49 | melwitt | yeah, might be. that would make more sense | |
| 20:57:32 | melwitt | ugh, hit the same on the ceph job on stable/ocata http://logs.openstack.org/30/511230/1/check/legacy-tempest-dsvm-full-devstack-plugin-ceph/819c5da/logs/screen-n-cpu.txt.gz?level=TRACE | |
| 20:57:49 | melwitt | well, in trying to fix the ceph job on stable/ocata | |
| 20:58:15 | melwitt | that patch is what I thought would fix it, but then ran into the AttributeError: 'NoneType' object has no attribute 'generation' afterward | |
| 21:05:44 | mriedem | ok that would explain how it slipped through the gate too | |
| 21:06:03 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/ocata: Revert "Proper error handling by _ensure_resource_provider" https://review.openstack.org/562739 | |
| 21:10:15 | jackie-truong | mriedem: Do you just want the rules. Or also to enforce it when booting from volume? Or are we just relying on the fail message when booting from volume? | |
| 21:11:06 | mriedem | jackie-truong: the policy rule is separate from boot from volume | |
| 21:11:18 | mriedem | bfv is a flat out 400 when used with trusted_certs because it's not supported | |
| 21:11:33 | mriedem | the policy rule is for disabling the feature if your cloud can't support it, regardless of bfv | |
| 21:11:43 | jackie-truong | got it | |
| 21:11:53 | jackie-truong | And should the policy rule be a separate patch? | |
| 21:11:59 | jackie-truong | Or can I just plug it into the API patch? | |
| 21:15:57 | openstackgerrit | Ken'ichi Ohmichi proposed openstack/nova master: fix a typo https://review.openstack.org/556455 | |
| 21:17:31 | dansmith | jackie-truong: kinda has to be in the api patch no? | |
| 21:17:42 | dansmith | otherwise you'd open it to everyone in one and then close it off in the next one | |
| 21:18:04 | jackie-truong | dansmith: mmm yeah good point | |
| 21:18:39 | openstack | Launchpad bug 1761062 in OpenStack Compute (nova) " clean source instance directory failed in _cleanup_resize when images_type is rbd" [Undecided,New] | |
| 21:18:39 | mriedem | this is a fun bug https://bugs.launchpad.net/nova/+bug/1761062 | |