| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-21 | |||
| 10:52:06 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add regression for bug 1787606 https://review.openstack.org/593073 | |
| 10:52:28 | openstackgerrit | Lee Yarwood proposed openstack/nova master: fixtures: Track volume attachments within CinderFixtureNewAttachFlow https://review.openstack.org/587013 | |
| 10:52:29 | openstackgerrit | Lee Yarwood proposed openstack/nova master: conductor: Recreate volume attachments during a reschedule https://review.openstack.org/587071 | |
| 10:52:29 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add regression test for bug#1784353 https://review.openstack.org/587014 | |
| 10:55:14 | openstack | Launchpad bug 1785827 in OpenStack Compute (nova) "Performance regression in libvirt get_available_resource()" [Undecided,Fix released] - Assigned to Lee Yarwood (lyarwood) | |
| 10:55:14 | s10 | Please review backports for the https://bugs.launchpad.net/nova/+bug/1785827 | |
| 10:55:21 | s10 | https://review.openstack.org/#/q/topic:bug/1785827+(status:open+OR+status:merged) | |
| 11:32:18 | openstackgerrit | Brin Zhang proposed openstack/nova master: Specifies the storage backend to boot instance https://review.openstack.org/579360 | |
| 11:38:50 | openstack | Launchpad bug 1209101 in OpenStack Compute (nova) "Non-public flavor cannot be used in created tenant" [High,Fix released] - Assigned to Sumanth Nagadavalli (sumanth-nagadavalli) | |
| 11:38:50 | s10 | Please reopen bug https://bugs.launchpad.net/nova/+bug/1209101 , it was reintroduced in https://github.com/openstack/nova/commit/2a81337a#diff-46d9a1430ccd8406e9dae8eee9e1f699R81 | |
| 11:48:31 | openstackgerrit | Merged openstack/nova master: Resource retrieving: add changes-before filter https://review.openstack.org/599276 | |
| 12:01:40 | openstackgerrit | Merged openstack/nova stable/pike: Add unshelve instance error info to fault table https://review.openstack.org/583426 | |
| 12:01:47 | openstackgerrit | Merged openstack/nova stable/rocky: Delete instance_group_member records from API DB during archive https://review.openstack.org/598953 | |
| 12:01:59 | openstackgerrit | Merged openstack/nova stable/queens: Remove noisy DEBUG log https://review.openstack.org/600372 | |
| 12:10:26 | openstackgerrit | Merged openstack/nova master: Optimize AZ lookup during schedule_and_build_instances https://review.openstack.org/588665 | |
| 12:17:35 | giblet | stephenfin: rubasov published the blogpost about the bandwidth demo https://rubasov.github.io/2018/09/21/openstack-qos-min-bw-demo.html | |
| 12:33:42 | cdent | +many on that blog post | |
| 12:43:36 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Consumer gen support for delete instance allocations https://review.openstack.org/591597 | |
| 12:59:29 | openstackgerrit | Merged openstack/nova master: libvirt: Drop MIN_LIBVIRT_PF_WITH_NO_VFS_CAP_VERSION https://review.openstack.org/565517 | |
| 12:59:45 | openstackgerrit | Merged openstack/nova master: Filter deleted computes from get_all_by_uuids() https://review.openstack.org/604108 | |
| 12:59:57 | openstackgerrit | Merged openstack/nova master: Delete instance_id_mappings record in instance_destroy https://review.openstack.org/591558 | |
| 13:00:06 | openstackgerrit | Merged openstack/nova master: Remove an unnecessary comment https://review.openstack.org/603924 | |
| 13:00:15 | openstackgerrit | Merged openstack/nova master: Imported Translations from Zanata https://review.openstack.org/601047 | |
| 13:27:15 | mdbooth | Oh, fun. LVM encryption is useless :) | |
| 13:28:01 | mdbooth | johnthetubaguy: Just writing up a detailed response to that bug | |
| 13:28:38 | lyarwood | which bug? | |
| 13:28:47 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 13:28:47 | mdbooth | https://bugs.launchpad.net/nova/+bug/1793159 | |
| 13:30:39 | mdbooth | johnthetubaguy: A para from the wip response: | |
| 13:30:56 | mdbooth | underlying device, both of which have the same access. The dm-crypt device is only removed if the instance is deleted, or implicitly if the compute host is rebooted. | |
| 13:30:56 | mdbooth | Unfortunately, 'encrypted' LVM as currently implemented is similarly vulnerable. When starting the instance we first created an LV for the disk which will store encrypted data. However, we then create a dm-crypt device which we initialise with the key we obtained from Barbican. This presents an unencrypted block device to the host, which we then present to the instance. Any attacker needs only use the dm-crypt device rather than the | |
| 13:31:51 | mdbooth | lyarwood: Native ephemeral encryption would improve ^^^ | |
| 13:32:31 | johnthetubaguy | well, I still think once you have root on the hypervisor its game over, any which way | |
| 13:32:51 | mdbooth | johnthetubaguy: Right. I'm addressing that, too. | |
| 13:33:17 | johnthetubaguy | I think they were thinking about an external storage system being compromised, and providing some protection against that | |
| 13:33:27 | mriedem | dansmith: i'll update the stable release patches once maya gets off to school. everything is merged that was approved except for https://review.openstack.org/#/c/592310/ but that's super latent anyway so i won't hold for it. | |
| 13:33:53 | dansmith | sweet | |
| 13:34:16 | lyarwood | mdbooth: yeah on my list for T overall, might try to get to rbd in S | |
| 13:40:24 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 13:40:24 | mdbooth | johnthetubaguy lyarwood: https://bugs.launchpad.net/nova/+bug/1793159 | |
| 13:40:27 | mdbooth | Commented | |
| 13:46:50 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Consumer gen support for put allocations https://review.openstack.org/591647 | |
| 13:47:31 | mdbooth | johnthetubaguy: So the point about being hosed if you have root on the hypervisor is obviously valid, but there's real-world practical gain to be had by requiring the admin to reconfigure the system first, as you have a chance to put additional controls around that. It'll also stop pretty much all 'innocent curiosity'. | |
| 13:47:57 | openstackgerrit | Mohammed Naser proposed openstack/nova stable/rocky: Filter deleted computes from get_all_by_uuids() https://review.openstack.org/604367 | |
| 13:48:49 | finucannot | giblet: Sweet, cheers | |
| 13:50:35 | mdbooth | SteelyDan: I think DonSmith might be more appropriate :D | |
| 13:50:46 | SteelyDan | eh? | |
| 13:50:51 | SteelyDan | Who is Don Smith? | |
| 13:51:02 | mdbooth | A mafioso, obviously | |
| 13:53:22 | openstackgerrit | Merged openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 13:54:18 | mriedem | nova stable releases https://review.openstack.org/#/q/topic:nova-stable-releases-sept-2018+(status:open+OR+status:merged) | |
| 13:55:50 | SteelyDan | mriedem: thanks for doing that | |
| 13:55:56 | lyarwood | about to jump on a call but I can take a look afterwards, thanks mriedem | |
| 13:58:04 | SteelyDan | mriedem: do we bug dims and smcginnis to look at those? | |
| 13:58:18 | openstackgerrit | Merged openstack/nova master: Add get_by_cell_and_project() method to InstanceMappingList https://review.openstack.org/591656 | |
| 13:58:30 | openstackgerrit | Merged openstack/nova master: Fix missing specifying doctrees directory https://review.openstack.org/604068 | |
| 13:58:39 | smcginnis | I looked at a couple. I can keep going if it helps. | |
| 13:58:50 | openstackgerrit | Merged openstack/nova master: Remove mox in test_compute_api.py (4) https://review.openstack.org/568462 | |
| 13:58:59 | openstackgerrit | Merged openstack/nova master: Remove deprecated hide_server_address_states option https://review.openstack.org/603831 | |
| 13:59:13 | openstackgerrit | Merged openstack/nova master: Remove mox in libvirt/test_driver.py (6) https://review.openstack.org/571330 | |
| 14:01:50 | SteelyDan | smcginnis: we haven't had releases in a while and there are like a hundred important pending fixes | |
| 14:01:56 | SteelyDan | so yeah it would be good if you can | |
| 14:02:09 | smcginnis | SteelyDan: Cool, I can spend a little time this morning going through there then. | |
| 14:02:15 | SteelyDan | thanks | |
| 14:02:50 | smcginnis | No problem | |
| 14:10:55 | mriedem | SteelyDan: i'm confused by tssurya's change here https://review.openstack.org/#/c/567785/ which looks like it adds the new microversion handling, but the microversion isn't actually introduced in that change, it's spread throughout several other patches after that | |
| 14:11:22 | mriedem | is the idea that none of this works until the end of the series? | |
| 14:11:44 | SteelyDan | yeah, that's generally how we do this right? | |
| 14:12:38 | mriedem | well, | |
| 14:12:46 | mriedem | we generally plumb the lower layers with flags and such, | |
| 14:12:59 | mriedem | but that change is actually checking the version the user passed in is 2.66 and if so, does something | |
| 14:13:11 | mriedem | i just don't know if that would actually work yet until the MAX_VERSION is updated later | |
| 14:13:25 | mriedem | the risk is that 2.66 is already approved in another change | |
| 14:13:41 | mriedem | iow, normally the change that introduces the actual microversion is at the end | |
| 14:13:56 | mriedem | i think i'm going to procedurally -2 this until the rest of the series is +W | |
| 14:14:17 | SteelyDan | right, that's what I asked for earlier .. is that no tthis? | |
| 14:16:38 | mriedem | i left comments and a -2, can discuss with tssurya later | |
| 14:18:32 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/rocky: Delete instance_id_mappings record in instance_destroy https://review.openstack.org/604373 | |
| 14:20:55 | mriedem | jroll: we should probably make this VirtDriverNotReady thing for ironic a warning yeah? http://logs.openstack.org/27/602127/2/check/ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa/4238d0f/controller/logs/screen-n-cpu.txt.gz?level=TRACE#_Sep_20_21_52_03_587436 | |
| 14:20:56 | mriedem | or info? | |
| 14:21:04 | mriedem | it's just a case of n-cpu starting up before ironic api right? | |
| 14:21:11 | mriedem | and it's self-healing? | |
| 14:23:20 | mriedem | gmann: i'm going to pull https://blueprints.launchpad.net/nova/+spec/api-extensions-merge-stein out of the runway slot since there are no open changes | |
| 14:36:24 | openstackgerrit | Merged openstack/nova-specs master: Placement: any traits in allocation_candidate query https://review.openstack.org/565730 | |
| 14:38:10 | openstackgerrit | Merged openstack/nova-specs master: Placement: support mixing required traits with any traits https://review.openstack.org/565741 | |
| 14:39:59 | openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/os-vif master: Add abstract OVSDB API https://review.openstack.org/476612 | |
| 14:47:08 | cdent | How disabled is a compute node that's been administratively disabled (compute service disable...)? Can an admin stil force a migration there? | |
| 14:47:26 | cdent | SteelyDan, mriedem ^ ? | |
| 14:47:48 | mriedem | i think they can | |
| 14:47:54 | mriedem | b/c a force would bypass the ComputeFilter | |
| 14:49:18 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Ignore VirtDriverNotReady in _sync_power_states periodic task https://review.openstack.org/604376 | |
| 14:49:22 | mriedem | jroll: ^ | |
| 14:49:42 | cdent | mriedem: is my understanding correct that there are two different kinds of force? one checks that the destination has the required resourcdes (and thus uses the sheduler/placement) and the other does not? | |
| 14:49:54 | mriedem | well, | |
| 14:50:00 | mriedem | there are a few ways to confuse 'force' here, | |
| 14:50:16 | mriedem | depends on the microversion used in the live migration api | |
| 14:50:28 | mriedem | https://developer.openstack.org/api-ref/compute/#live-migrate-server-os-migratelive-action | |
| 14:50:42 | cdent | anytime someone says "well" i want to run and hide | |
| 14:50:56 | mriedem | so before microversion 2.30, specifying the host bypasses the scheduler and forces it, | |
| 14:51:10 | mriedem | after microversion 2.30, if you specify a host but not force=true, the scheduler validates the host, | |