| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-10-03 | |||
| 20:22:29 | sean-k-mooney | edmondsw: legacy reasons but we treat stop like delete as far as libvirt is concerend but we dont delete the disk obviously | |
| 20:23:29 | sean-k-mooney | we do detach all ports, gpus ectra when we shut down the vm but we still retain owner ship of them in placement/the resouce tracker | |
| 20:24:58 | edmondsw | ok. I'll assume "legacy reasons" means there's no reason for other drivers to consider doing that | |
| 20:26:11 | sean-k-mooney | well there is one but its not a good one. if you are using iscsi volumes by detaching the volume on stop it reduces memory uses on the issci server | |
| 20:27:00 | sean-k-mooney | which if its hardware based also means we can potenailly free up other hardware resouces but that also means the vm can fail to start back up if somting else grabs the last slot | |
| 20:27:31 | sean-k-mooney | that said you would have max out your cloud stroage at that point so you have bigger issue then one vm not starting | |
| 20:28:14 | sean-k-mooney | edmondsw: i dont know if there is a actul usecase where you would want to disconnect today but mayber there is | |
| 20:28:31 | edmondsw | sean-k-mooney tx for the explanation | |
| 20:30:34 | sean-k-mooney | i know some people want to be able to do things with bfv root volumes when the instace is offline too but i kindof zoned out at the ptg for that conversation. | |
| 20:30:48 | mriedem | sean-k-mooney: that is exactly the spec i'm referring to above | |
| 20:30:52 | mriedem | and why i'm asking about this | |
| 20:31:05 | sean-k-mooney | mriedem: ah ok that make more sense. | |
| 20:31:10 | mriedem | because i'm pretty sure swapping the root volume while the instance is stopped was not part of the originally approved spec | |
| 20:31:15 | mriedem | and s10 got Kevin_Zheng to change it | |
| 20:31:22 | mriedem | b/c of how the libvirt driver works | |
| 20:31:31 | mriedem | and i'm asserting that's not a good enough reason... | |
| 20:32:07 | sean-k-mooney | right i think haveing an expcit api to say detach volume for stoped instacnce would be better | |
| 20:32:31 | sean-k-mooney | e.g. not assumeing its implcitly detatched when you stop | |
| 20:32:33 | mriedem | well, the virt driver could just refuse to detach the root volume while the instance is stopped | |
| 20:32:46 | mriedem | if it doens't support it and raise an exception which gets recorded as a fault | |
| 20:32:58 | sean-k-mooney | mriedem: it could but did they not want to allow that? | |
| 20:33:18 | sean-k-mooney | e.g. detaching root volume when its stoped. that would be almost a noop for libvirt | |
| 20:33:23 | mriedem | the spec is proposing that you can swap the root volume while the instance is offloaded or stopped | |
| 20:34:16 | sean-k-mooney | right but you could do that by createing a new volume. stoping the instance. detach the root volmu and attach the volume created in step 1 then start | |
| 20:34:43 | sean-k-mooney | do you need an explcit api to do the swap as an atopmic operation | |
| 20:34:55 | mriedem | no, and that is what the spec is proposing | |
| 20:35:01 | mriedem | "createing a new volume. stoping the instance. detach the root volmu and attach the volume created in step 1 then start" | |
| 20:35:22 | mriedem | my point is, i don't know that all virt drivers could handle that today for the root volume | |
| 20:35:26 | mriedem | while the instance is stopped | |
| 20:35:45 | sean-k-mooney | ha ok am perhaps | |
| 20:36:23 | sean-k-mooney | i cant think why they could not if they support rebuild | |
| 20:36:49 | sean-k-mooney | its basicaly the same thing except we are not chaning host | |
| 20:37:45 | mriedem | rebuild does a driver.destroy and then a driver.spawn | |
| 20:37:51 | mriedem | it assumes destruction | |
| 20:38:01 | mriedem | i can't say that stop/start assume that same thing | |
| 20:38:27 | mriedem | same with shelve/unshelve | |
| 20:38:37 | mriedem | shelve does a driver.destroy and unshelve does a driver.spawn | |
| 20:39:08 | mriedem | sean-k-mooney: haven't you been working for like 20 straight hours at this point or something? | |
| 20:39:17 | mriedem | at what point do you become drunk by exhaustion? | |
| 20:39:46 | sean-k-mooney | mriedem: all of this is true. i would be surprised if this could not be supported on multiple hyperviors but its good to check. | |
| 20:40:14 | sean-k-mooney | haha not quite but if i get tired enough i do find it harder to concentrate. | |
| 20:41:00 | sean-k-mooney | i have been working sine 10:30 + i took an hour for lunch but ya im just finishing up for the day | |
| 20:41:27 | mriedem | pretty sure you said you were finishing for the day about 4 hours ago | |
| 20:41:56 | sean-k-mooney | i did finish rather late last night. ya got distracted with a few things | |
| 20:44:24 | sean-k-mooney | i really need to file my ptg expensice tomrrow... i started twice today but then got pull into email threads + code. | |
| 20:44:56 | sean-k-mooney | thats what i was trying to figure out for the last 30 mins but it can wait | |
| 20:45:11 | sean-k-mooney | talk to you tommorw | |
| 20:46:46 | melwitt | mriedem, tssurya: I told dansmith we're skipping the meeting based on the earlier convo | |
| 20:47:07 | tssurya | melwitt: ack, thanks for the info :) | |
| 20:47:09 | melwitt | he's not going to be back in time anyway | |
| 20:47:42 | mriedem | he said he would be back in time | |
| 20:47:45 | tssurya | wfm, Its too late here anyways, you guys have a good day | |
| 20:47:59 | mriedem | <3 broken | |
| 20:48:06 | melwitt | heh | |
| 20:48:19 | tssurya | :) | |
| 20:49:38 | openstack | Launchpad bug 1795966 in OpenStack Compute (nova) "<class 'oslo_db.exception.DBNonExistentTable'> (HTTP 500)" [Undecided,Invalid] | |
| 20:49:38 | mriedem | https://bugs.launchpad.net/nova/+bug/1795966 | |
| 20:50:15 | melwitt | meanwhile, gd consoleauth. we have an API where you can 'show' your console auth token. and that is making the deprecation nightmare worse. have to figure out if/how to adjust this for the database backend | |
| 20:50:51 | melwitt | mriedem: that must be the shortest bug report ever | |
| 20:50:56 | mriedem | https://developer.openstack.org/api-ref/compute/#create-remote-console ? | |
| 20:51:11 | melwitt | https://developer.openstack.org/api-ref/compute/#show-console-connection-information | |
| 20:51:31 | mriedem | ah heh | |
| 20:51:36 | melwitt | FML | |
| 20:51:56 | mriedem | well, | |
| 20:52:18 | mriedem | oh heh you can't know which cell to route it to right | |
| 20:52:23 | mriedem | b/c the token isn't mapped in the api | |
| 20:52:36 | mriedem | you'll have to iterate the cell dbs looking for that token id | |
| 20:53:05 | melwitt | no... which I'm trying to remember, what did I find last time I looked at this. arrrrgghh | |
| 20:55:03 | mriedem | hmm, we only store the hashed token in the db right | |
| 20:55:14 | mriedem | and that's not what the API would have in it? | |
| 20:55:47 | melwitt | yeah only the hashed token. and I think the API takes the unhashed token from the user | |
| 20:56:22 | mriedem | ha, cool | |
| 20:56:58 | mriedem | for cell in all_cells(): for console_auth_token in all_console_auth_tokens_in_this_cell(): if console_auth_token == req_id: do that thing() | |
| 20:58:27 | mriedem | i bet we log that unhashed token in the nova-api logs too... | |
| 20:58:31 | mriedem | since it's on the path | |
| 20:59:09 | mriedem | https://github.com/openstack/nova/blob/master/nova/api/openstack/requestlog.py#L41 | |
| 20:59:30 | melwitt | indeed, I can see it in the func test output | |
| 20:59:43 | mriedem | ha, cool | |
| 20:59:52 | melwitt | 2018-10-03 20:37:40,870 INFO [nova.api.openstack.requestlog] 127.0.0.1 "GET /v2.1/os-console-auth-tokens/714a26ff-d7e6-4698-bc30-9934ebf38807" | |
| 21:00:17 | mriedem | well luckily logging credentials isn't a CVE | |
| 21:01:44 | melwitt | ... | |
| 21:02:27 | melwitt | I guess people aren't paying too much attention to this API, myself included | |
| 21:02:34 | mriedem | it's admin-only by default | |
| 21:02:49 | melwitt | I see, ok | |
| 21:03:11 | melwitt | Note "This is only used in Xenserver VNC Proxy." | |
| 21:03:21 | melwitt | really? I wonder how | |
| 21:03:35 | mriedem | that's for the other 4 | |
| 21:03:37 | mriedem | i saw that as well | |
| 21:03:52 | mriedem | os-console-auth-tokens was added specifically for rdp consoles for hyperv | |
| 21:04:42 | melwitt | O.o | |
| 21:09:15 | melwitt | yeah, so we could scatter-gather a ConsoleAuthToken.validate(context, token) call and only one will return token object, the others will raise exceptions. that method takes an unhashed token and will hash it before looking for it in the db | |
| 21:10:53 | mriedem | sure | |
| 21:11:05 | mriedem | shitty performance but whatareyougonnado | |
| 21:11:13 | melwitt | yeah, exactly | |
| 21:11:13 | mriedem | plus it's admin-only and no one knew it existed | |
| 21:11:21 | melwitt | haha, right. we have that going for us | |
| 21:11:45 | mriedem | is there a bug for this? | |
| 21:11:46 | melwitt | I'll add it to the pile o poopatches | |
| 21:11:51 | melwitt | no | |
| 21:11:57 | melwitt | I'll open one | |