| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-12-14 | |||
| 16:59:53 | mriedem | there are a couple of other specs that have had lots of review and just need a push over the line | |
| 17:01:17 | kashyap | Heay folks, so I was reading the scrollback here. I have posted a "simple thing" -- https://review.openstack.org/#/c/625216/ (libvirt: Support native TLS for migration and disks over NBD) | |
| 17:01:41 | kashyap | See the commit message (I spent full 2 hours fiddling with it) for the "essay" :D | |
| 17:02:30 | mriedem | doesn't sound simple | |
| 17:02:37 | kashyap | :-) | |
| 17:02:37 | melwitt | that looks like that should be at least a blueprint, if not a spec | |
| 17:02:44 | mriedem | live migration + tls + anything = doom | |
| 17:02:59 | kashyap | Truer words were never said | |
| 17:03:05 | mriedem | "oh you're on/not on shared storage and/or volume-backed? sorry!" | |
| 17:03:25 | kashyap | mriedem: Ha! _That_ is what is fixed | |
| 17:03:40 | kashyap | This whole week I (almost) singuarly focused on it | |
| 17:03:52 | kashyap | Even wrote this detailed doc, with a start, middle, and an end: https://kashyapc.fedorapeople.org/Native-TLS/Setup-for-NBD-and-migration-streams-over-TLS.rst.txt | |
| 17:04:06 | kashyap | You can do a "TLS journey" if you follow that doc with concentration and focus. | |
| 17:04:19 | mriedem | can i do *anything* else? | |
| 17:04:25 | kashyap | What more ... I even have evidence files (yet to upload) that shows precisely what to find :D | |
| 17:04:46 | kashyap | mriedem: You are free to do anything you fancy. You know that | |
| 17:04:47 | kashyap | :D | |
| 17:04:47 | mriedem | i'm just joking of course | |
| 17:05:01 | mriedem | i'm real fucking huggy today | |
| 17:05:10 | kashyap | I see mriedem is giving free hugs all around | |
| 17:05:29 | kashyap | mriedem: See -- you didn't take up my offer to get you that drink (damned if I'll remember the name) you wanted | |
| 17:05:40 | kashyap | But _of course_ ... when you're with SO in Europe | |
| 17:05:44 | mriedem | root beer | |
| 17:05:56 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Migrate upgrade checks to oslo.upgradecheck https://review.openstack.org/603499 | |
| 17:05:59 | kashyap | Not even the last thing you want to do is hang out with me :D | |
| 17:06:01 | mriedem | or "rooted beer" as an EU might call it | |
| 17:06:09 | kashyap | Ah, yes. | |
| 17:06:49 | kashyap | mriedem: So the nice thing is that: now Nova guests can have encryption (*without* the penalty of "libvirtd tunnelling") for all migration streams | |
| 17:07:06 | kashyap | Namely: Instance guest RAM, device state + disks over NDB | |
| 17:07:36 | kashyap | And goes to upload his "evidence files" | |
| 17:08:29 | kashyap | Oh ... the fly in the ointment is I'll be on PTO next week (if I don't take them, they'll disappear). So only be back in 1st week of Jan to come back to write tests | |
| 17:09:03 | kashyap | So ... saying: "No, you wretch, I will not even click on the URL without tests" is perfectly reasonable | |
| 17:09:58 | mriedem | i seem to remember something about nbd + the tunneling thing years ago from danpb | |
| 17:10:01 | mriedem | but it's very hazy now | |
| 17:10:07 | mriedem | or maybe it was markmc | |
| 17:10:08 | mriedem | idk | |
| 17:10:43 | kashyap | mriedem_lunch: When you get back from lunch, as of today: | |
| 17:11:03 | kashyap | - Nova has 'live_migration_tunnelled' -- but if you use that, you can't do "block migration" | |
| 17:11:23 | kashyap | That is one of the major cases we fix. Thus, having encryption for all streams | |
| 17:12:09 | kashyap | (By "streams", migration stream + NBD stream) | |
| 17:13:22 | kashyap | And going forward, we will deprecate the 'live_migration_tunnelled', because it has _awful_ performance impact and latency | |
| 17:13:53 | kashyap | As there'll be no compelling reason to use it. | |
| 17:14:13 | kashyap | melwitt: Hi, forgot to address your comment | |
| 17:14:52 | openstack | Launchpad bug 1798796 in OpenStack Compute (nova) "libvirt: Use VIR_MIGRATE_TLS to get QEMU's native TLS support for migration and NBD" [Medium,In progress] - Assigned to Kashyap Chamarthy (kashyapc) | |
| 17:14:52 | kashyap | melwitt: I _thought_ I posted a spec, but only settled with "bug", as it's technically a "bug": https://bugs.launchpad.net/nova/+bug/1798796 | |
| 17:15:35 | kashyap | But, I know what you mean. | |
| 17:15:54 | melwitt | calling that a bug is a stretch IMO, if you need a commit message that long and at least a certain version of QEMU etc | |
| 17:16:21 | melwitt | but maybe that's just me | |
| 17:16:31 | kashyap | No, you're fully right. Given the length of the commit message | |
| 17:16:38 | kashyap | I might as well just put it in a spec | |
| 17:17:04 | kashyap | What do you suggest: a spec-less Blueprint, or a spec? | |
| 17:17:37 | melwitt | I usually say, start with a specless blueprint (you need a blueprint either way) and then usually we discuss in the nova meeting and decide whether a spec is needed | |
| 17:17:41 | dansmith | I agree with melwitt, and I think it's a spec given the commit message is already nearly a spec | |
| 17:17:55 | dansmith | well, I agree with melwitt as of 30s ago :P | |
| 17:17:59 | openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Add workaround to cleanup instance dir when using rbd https://review.openstack.org/618478 | |
| 17:18:20 | kashyap | dansmith: Okido. As you know, I'm not averse to (efficient and useful!) words | |
| 17:18:31 | kashyap | Sorry for being a lazy pig and not writing it until the last moment | |
| 17:18:37 | dansmith | in said meeting, I would just say "if you need a spec in the commit message it should probably be a spec" :) | |
| 17:18:38 | kashyap | I accept any penalty you may incur on me. | |
| 17:18:53 | kashyap | dansmith: No...that's too quippy | |
| 17:19:45 | kashyap | Okay, before the my brain cache gets flushed, might as well just do it. Here we go. | |
| 17:19:56 | melwitt | heh. well, true if it were specless it would have to be like, literally the commit message was enough to explain it and no one had further questions and no additional details were needed | |
| 17:20:09 | melwitt | which is unlikely | |
| 17:20:24 | dansmith | the code is really simple, | |
| 17:20:24 | kashyap | melwitt: Did you read the commit message? :-) | |
| 17:20:54 | dansmith | so it seems overkill for a spec, but the commit message is long, and there's apparently another tome of reference material from kashyap | |
| 17:20:56 | dansmith | so I dunno | |
| 17:20:57 | kashyap | Yeah, except the part about _which_ of the 4 flags go together, and _which_ I shold not mix | |
| 17:21:24 | melwitt | kashyap: yes :) it is a mini spec | |
| 17:21:29 | kashyap | dansmith: From enabling point of view, it's straight-forward | |
| 17:21:31 | kashyap | melwitt: LOL | |
| 17:21:59 | kashyap | Yeah, I spent a whole 2 hours to write. I'm a slow-as-molasses with writing down thoghts | |
| 17:22:06 | dansmith | so i could be maybe persuaded that it should just be a BP, if the commit message was trimmed down to non-kashyap standards and the patch included docs changes to explain what the commit message is | |
| 17:22:12 | melwitt | another advantage of the spec is it goes into our docs as nice reference place | |
| 17:22:40 | dansmith | yes, the commit message is documenting usage, which isn't right, IMHO | |
| 17:22:43 | kashyap | dansmith: The TODO will be gone from the commit. Isn' it quite trimmed? | |
| 17:22:59 | kashyap | Yeah, I agree with both of you | |
| 17:23:06 | dansmith | kashyap: no | |
| 17:23:20 | kashyap | This is so frelling fiddly because it took me the whole dammed WEEK to set it up! | |
| 17:23:24 | dansmith | kashyap: if you need rst formatting and section headers in your commit message, you're doing it wrong | |
| 17:23:38 | melwitt | haha | |
| 17:23:44 | kashyap | dansmith: I dare you: | |
| 17:23:48 | dansmith | melwitt: amirite? :) | |
| 17:23:55 | kashyap | No | |
| 17:24:16 | melwitt | dansmith: yup | |
| 17:24:17 | kashyap | dansmith: So long as the commit message is _useful_, readable, conveys meaningful information, the format doesn't matter | |
| 17:24:30 | kashyap | You've seen kernel commit messages, they go longer :D | |
| 17:24:37 | kashyap | News at 11: "This is not the kernel" | |
| 17:24:43 | dansmith | kashyap: they use them for a totally different purpose | |
| 17:25:20 | kashyap | dansmith: All the while I was writing that commit, I thought: "A cover letter would be nice" ... which is the "spec" :-) | |
| 17:26:52 | kashyap | dansmith: And yes: as you asked earlier: I of course want to write docs with the patch. | |
| 17:27:09 | melwitt | kashyap: yeah, I think you have great info there, just better in a design doc rather than commit message, IMHO | |
| 17:27:23 | kashyap | Yeah, agreed. I just wrote that to not lose the context in the head. | |
| 17:27:29 | kashyap | Will move it around. | |
| 17:27:34 | melwitt | and commit message refers to that design doc (blueprint) so we can get to it | |
| 17:27:46 | melwitt | yeah, I understand | |
| 17:28:27 | kashyap | At the risk of being banned from the channel, if I might say ... I'm a bit old-fashioned in the sense that: A commit should explain without requiring network access :-) | |
| 17:28:45 | melwitt | heh | |
| 17:29:10 | kashyap | Sorry, it's a habit I learnt from the "mailing list" folks. | |
| 17:29:17 | melwitt | these days it feels like there's nothing you can do without network access | |