| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-21 | |||
| 13:28:38 | lyarwood | which bug? | |
| 13:28:47 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 13:28:47 | mdbooth | https://bugs.launchpad.net/nova/+bug/1793159 | |
| 13:30:39 | mdbooth | johnthetubaguy: A para from the wip response: | |
| 13:30:56 | mdbooth | underlying device, both of which have the same access. The dm-crypt device is only removed if the instance is deleted, or implicitly if the compute host is rebooted. | |
| 13:30:56 | mdbooth | Unfortunately, 'encrypted' LVM as currently implemented is similarly vulnerable. When starting the instance we first created an LV for the disk which will store encrypted data. However, we then create a dm-crypt device which we initialise with the key we obtained from Barbican. This presents an unencrypted block device to the host, which we then present to the instance. Any attacker needs only use the dm-crypt device rather than the | |
| 13:31:51 | mdbooth | lyarwood: Native ephemeral encryption would improve ^^^ | |
| 13:32:31 | johnthetubaguy | well, I still think once you have root on the hypervisor its game over, any which way | |
| 13:32:51 | mdbooth | johnthetubaguy: Right. I'm addressing that, too. | |
| 13:33:17 | johnthetubaguy | I think they were thinking about an external storage system being compromised, and providing some protection against that | |
| 13:33:27 | mriedem | dansmith: i'll update the stable release patches once maya gets off to school. everything is merged that was approved except for https://review.openstack.org/#/c/592310/ but that's super latent anyway so i won't hold for it. | |
| 13:33:53 | dansmith | sweet | |
| 13:34:16 | lyarwood | mdbooth: yeah on my list for T overall, might try to get to rbd in S | |
| 13:40:24 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 13:40:24 | mdbooth | johnthetubaguy lyarwood: https://bugs.launchpad.net/nova/+bug/1793159 | |
| 13:40:27 | mdbooth | Commented | |
| 13:46:50 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Consumer gen support for put allocations https://review.openstack.org/591647 | |
| 13:47:31 | mdbooth | johnthetubaguy: So the point about being hosed if you have root on the hypervisor is obviously valid, but there's real-world practical gain to be had by requiring the admin to reconfigure the system first, as you have a chance to put additional controls around that. It'll also stop pretty much all 'innocent curiosity'. | |
| 13:47:57 | openstackgerrit | Mohammed Naser proposed openstack/nova stable/rocky: Filter deleted computes from get_all_by_uuids() https://review.openstack.org/604367 | |
| 13:48:49 | finucannot | giblet: Sweet, cheers | |
| 13:50:35 | mdbooth | SteelyDan: I think DonSmith might be more appropriate :D | |
| 13:50:46 | SteelyDan | eh? | |
| 13:50:51 | SteelyDan | Who is Don Smith? | |
| 13:51:02 | mdbooth | A mafioso, obviously | |
| 13:53:22 | openstackgerrit | Merged openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 13:54:18 | mriedem | nova stable releases https://review.openstack.org/#/q/topic:nova-stable-releases-sept-2018+(status:open+OR+status:merged) | |
| 13:55:50 | SteelyDan | mriedem: thanks for doing that | |
| 13:55:56 | lyarwood | about to jump on a call but I can take a look afterwards, thanks mriedem | |
| 13:58:04 | SteelyDan | mriedem: do we bug dims and smcginnis to look at those? | |
| 13:58:18 | openstackgerrit | Merged openstack/nova master: Add get_by_cell_and_project() method to InstanceMappingList https://review.openstack.org/591656 | |
| 13:58:30 | openstackgerrit | Merged openstack/nova master: Fix missing specifying doctrees directory https://review.openstack.org/604068 | |
| 13:58:39 | smcginnis | I looked at a couple. I can keep going if it helps. | |
| 13:58:50 | openstackgerrit | Merged openstack/nova master: Remove mox in test_compute_api.py (4) https://review.openstack.org/568462 | |
| 13:58:59 | openstackgerrit | Merged openstack/nova master: Remove deprecated hide_server_address_states option https://review.openstack.org/603831 | |
| 13:59:13 | openstackgerrit | Merged openstack/nova master: Remove mox in libvirt/test_driver.py (6) https://review.openstack.org/571330 | |
| 14:01:50 | SteelyDan | smcginnis: we haven't had releases in a while and there are like a hundred important pending fixes | |
| 14:01:56 | SteelyDan | so yeah it would be good if you can | |
| 14:02:09 | smcginnis | SteelyDan: Cool, I can spend a little time this morning going through there then. | |
| 14:02:15 | SteelyDan | thanks | |
| 14:02:50 | smcginnis | No problem | |
| 14:10:55 | mriedem | SteelyDan: i'm confused by tssurya's change here https://review.openstack.org/#/c/567785/ which looks like it adds the new microversion handling, but the microversion isn't actually introduced in that change, it's spread throughout several other patches after that | |
| 14:11:22 | mriedem | is the idea that none of this works until the end of the series? | |
| 14:11:44 | SteelyDan | yeah, that's generally how we do this right? | |
| 14:12:38 | mriedem | well, | |
| 14:12:46 | mriedem | we generally plumb the lower layers with flags and such, | |
| 14:12:59 | mriedem | but that change is actually checking the version the user passed in is 2.66 and if so, does something | |
| 14:13:11 | mriedem | i just don't know if that would actually work yet until the MAX_VERSION is updated later | |
| 14:13:25 | mriedem | the risk is that 2.66 is already approved in another change | |
| 14:13:41 | mriedem | iow, normally the change that introduces the actual microversion is at the end | |
| 14:13:56 | mriedem | i think i'm going to procedurally -2 this until the rest of the series is +W | |
| 14:14:17 | SteelyDan | right, that's what I asked for earlier .. is that no tthis? | |
| 14:16:38 | mriedem | i left comments and a -2, can discuss with tssurya later | |
| 14:18:32 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/rocky: Delete instance_id_mappings record in instance_destroy https://review.openstack.org/604373 | |
| 14:20:55 | mriedem | jroll: we should probably make this VirtDriverNotReady thing for ironic a warning yeah? http://logs.openstack.org/27/602127/2/check/ironic-tempest-dsvm-ipa-wholedisk-bios-agent_ipmitool-tinyipa/4238d0f/controller/logs/screen-n-cpu.txt.gz?level=TRACE#_Sep_20_21_52_03_587436 | |
| 14:20:56 | mriedem | or info? | |
| 14:21:04 | mriedem | it's just a case of n-cpu starting up before ironic api right? | |
| 14:21:11 | mriedem | and it's self-healing? | |
| 14:23:20 | mriedem | gmann: i'm going to pull https://blueprints.launchpad.net/nova/+spec/api-extensions-merge-stein out of the runway slot since there are no open changes | |
| 14:36:24 | openstackgerrit | Merged openstack/nova-specs master: Placement: any traits in allocation_candidate query https://review.openstack.org/565730 | |
| 14:38:10 | openstackgerrit | Merged openstack/nova-specs master: Placement: support mixing required traits with any traits https://review.openstack.org/565741 | |
| 14:39:59 | openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/os-vif master: Add abstract OVSDB API https://review.openstack.org/476612 | |
| 14:47:08 | cdent | How disabled is a compute node that's been administratively disabled (compute service disable...)? Can an admin stil force a migration there? | |
| 14:47:26 | cdent | SteelyDan, mriedem ^ ? | |
| 14:47:48 | mriedem | i think they can | |
| 14:47:54 | mriedem | b/c a force would bypass the ComputeFilter | |
| 14:49:18 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Ignore VirtDriverNotReady in _sync_power_states periodic task https://review.openstack.org/604376 | |
| 14:49:22 | mriedem | jroll: ^ | |
| 14:49:42 | cdent | mriedem: is my understanding correct that there are two different kinds of force? one checks that the destination has the required resourcdes (and thus uses the sheduler/placement) and the other does not? | |
| 14:49:54 | mriedem | well, | |
| 14:50:00 | mriedem | there are a few ways to confuse 'force' here, | |
| 14:50:16 | mriedem | depends on the microversion used in the live migration api | |
| 14:50:28 | mriedem | https://developer.openstack.org/api-ref/compute/#live-migrate-server-os-migratelive-action | |
| 14:50:42 | cdent | anytime someone says "well" i want to run and hide | |
| 14:50:56 | mriedem | so before microversion 2.30, specifying the host bypasses the scheduler and forces it, | |
| 14:51:10 | mriedem | after microversion 2.30, if you specify a host but not force=true, the scheduler validates the host, | |
| 14:51:27 | mriedem | >=2.30 + host + force=true means bypass the scheduler | |
| 14:51:40 | mriedem | yes, it's terrible; mordred can attest when i explained this when he fixed it in the sdk | |
| 14:51:50 | mriedem | and it's also the reason i was -5 on adding force to cold migration | |
| 14:51:58 | mriedem | among other reasons | |
| 14:52:31 | mriedem | if it doesn't matter, always pass host=None | |
| 14:52:35 | mriedem | so the scheduler always picks | |
| 14:52:54 | mriedem | otheriwse use microversion >=2.30 so the scheduler validates the specified host | |
| 14:53:05 | mordred | yeah. I really didn't enjoy this one | |
| 14:53:06 | cdent | so: in >= 2.30 if i want to target a disabled compute node I can host + force = true and really truly force. That's the thing I'm after in this case. | |
| 14:53:16 | mriedem | yes i think so | |
| 14:53:34 | mriedem | there are big red warnings in the api ref about it too | |
| 14:54:05 | cdent | cool, thank you very much. I think I've just learned a lot in a very short space of time, which is pleasing. | |
| 14:54:11 | mordred | cdent: http://git.openstack.org/cgit/openstack/openstacksdk/tree/openstack/compute/v2/server.py#n366 if you want to see it all in python | |
| 14:55:39 | mriedem | ghostbusters? | |
| 14:55:56 | mriedem | i guess that would actually be bad for their business | |
| 14:57:33 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/rocky: Optimize AZ lookup during schedule_and_build_instances https://review.openstack.org/604378 | |
| 14:58:46 | mriedem | SteelyDan: lyarwood: when you get a chance, could use reviews on these simple backports to run tempest-slow in queens and pike https://review.openstack.org/#/q/topic:nova-slow+(status:open+OR+status:merged) | |
| 14:59:06 | mriedem | b/c we merged a change in tempest to move several tests from tempest-full to tempest-slow so we should make sure we still have the test coverage on stable | |
| 15:04:05 | lyarwood | mriedem: ack looking now | |
| 15:07:38 | mriedem | alex_xu: have you talked with the cyborg devs at all about your nvdimm stuff to see if that could work with cyborg as a generic way to model those devices and integrate with nova for the plug/unplug that's needed via the os-acc library? | |
| 15:08:20 | mriedem | alex_xu: in general, i think we could really use someone that knows how nova works helping the cyborg team directly; fried_rice has been doing that but is also really busy with other stuff too. | |
| 15:09:03 | lyarwood | mriedem: remind me, nova-next is the cellsv2 job right? | |
| 15:09:22 | mriedem | lyarwood: in the olden times nova-next was cells v2 and placement while those were optional (in newton yeah) | |
| 15:09:43 | SteelyDan | all jobs should be cellsv2 with superconductor these days no? | |
| 15:09:46 | mriedem | yes | |