| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-01-07 | |||
| 06:06:13 | jayashri | join masakari | |
| 07:33:25 | openstackgerrit | Maciej Jozefczyk proposed openstack/nova master: Force refresh instance info_cache during heal https://review.openstack.org/591607 | |
| 07:33:25 | openstackgerrit | Maciej Jozefczyk proposed openstack/nova master: Add fill_virtual_interface_list online_data_migration script https://review.openstack.org/614167 | |
| 08:20:07 | adrianc | melwitt, sean_k_mooney1: Hi, any chance we can approve the following spec before spec freeze ? https://review.openstack.org/#/c/605116/10 I believe most of the issues/comments were dealt with | |
| 08:20:52 | adrianc | sean-k-mooney1 ^ | |
| 09:04:29 | bauzas | good morning Nova | |
| 09:04:39 | sean-k-mooney1 | bauzas: o/ | |
| 09:05:04 | bauzas | :) | |
| 09:29:51 | openstackgerrit | Yikun Jiang proposed openstack/nova master: Per aggregate scheduling weight https://review.openstack.org/628163 | |
| 11:47:52 | openstackgerrit | Maciej Jozefczyk proposed openstack/nova master: Force refresh instance info_cache during heal https://review.openstack.org/591607 | |
| 11:47:52 | openstackgerrit | Maciej Jozefczyk proposed openstack/nova master: Add fill_virtual_interface_list online_data_migration script https://review.openstack.org/614167 | |
| 13:04:25 | openstackgerrit | Daniel Pawlik proposed openstack/nova stable/rocky: Removing pip-missing-reqs from default tox jobs https://review.openstack.org/628952 | |
| 13:05:24 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/pike: Exclude build request marker from server listing https://review.openstack.org/628954 | |
| 13:09:27 | openstackgerrit | Daniel Pawlik proposed openstack/nova stable/queens: Removing pip-missing-reqs from default tox jobs https://review.openstack.org/628956 | |
| 13:12:31 | openstackgerrit | Daniel Pawlik proposed openstack/nova stable/queens: Removing pip-missing-reqs from default tox jobs https://review.openstack.org/628956 | |
| 13:16:37 | kashyap | Anyone else seeing the "tempest.api.network.test_routers_negative" time-out failure, as part of 'tempest-full-py3'? | |
| 13:20:21 | kashyap | Hm, a socket timeout: http://logs.openstack.org/16/625216/2/check/tempest-full-py3/f007612/testr_results.html.gz | |
| 13:43:03 | kashyap | mdbooth_: Random ping, in your "copious free time", mind having a look at this? -- https://review.openstack.org/#/c/625216/ | |
| 13:43:23 | kashyap | (Title of the change: "libvirt: Support native TLS for migration and disks over NBD") | |
| 13:43:32 | kashyap | Or anyone here, not just Matt :D | |
| 13:44:01 | mdbooth_ | kashyap: Looking. | |
| 13:44:24 | kashyap | I'm working out the unit test; so if you don't want to look at it without it, can understand. | |
| 13:44:36 | mdbooth | kashyap: Remind me, do we default to tunnelled? IIRC we don't? | |
| 13:44:58 | kashyap | No, we don't default to tunnelled; but damned if I remember, everytime I have to check | |
| 13:45:27 | kashyap | mdbooth: No we don't -- because live block migration won't work with tunnelled | |
| 13:45:43 | kashyap | I also have a slightly hairy TODO in the commit, if you squint: | |
| 13:45:45 | kashyap | TODO: - Figure out _which_ combination of migration flags are valid. I.e. work out how VIR_MIGRATE_TLS VIR_MIGRATE_NON_SHARED_INC, and VIR_MIGRATE_NON_SHARED_DISK interact together. | |
| 13:46:26 | mdbooth | kashyap: Shiny. Any idea what the performance penalty is for native qemu tls? | |
| 13:46:54 | kashyap | mdbooth: Good news -- there is no nenalty, instead it _removes_ the existing penalty | |
| 13:47:10 | mdbooth | kashyap: I mean over non-tunnelled, non-encrypted. | |
| 13:47:26 | mdbooth | kashyap: I assume it must be at least a bit slower? | |
| 13:47:36 | kashyap | Don't you want to read the "Why" section of my blueprint? I spent non-trivial amount of time writing it :D -- https://blueprints.launchpad.net/nova/+spec/support-qemu-native-tls-for-live-migration | |
| 13:47:58 | kashyap | So, on benchmarks-- | |
| 13:49:15 | kashyap | mdbooth: Some moons ago DanPB did the benchmarks. Looking for the right info | |
| 13:49:56 | mdbooth | kashyap: afk, back shortly. Will read scrollback. | |
| 13:50:24 | cdent | scheduler/placement meeting in #opensack-meeting-alt in 10 minutes | |
| 13:50:33 | cdent | or rather in #openstack-meeting-alt | |
| 13:50:50 | cdent | my opensack back of holding is full | |
| 13:52:03 | sean-k-mooney1 | mdbooth: assuming the tls encryption is use aes for the cyper it should be able to offload to the cpu in hardware so the overhead should be minimal | |
| 13:53:38 | kashyap | mdbooth: When you're back, that's the IRC chat with DanPB on benchmarks: http://paste.openstack.org/show/740443/ | |
| 13:54:11 | kashyap | mdbooth: That said, I don't have the exact overhead over non-tunnelled, non-encrypted, I'm afraid. But that info is something worth having | |
| 13:56:56 | ShilpaSD | gibi: Hi | |
| 13:57:05 | gibi | ShilpaSD: hi | |
| 13:58:51 | ShilpaSD | gibi: Need help in understanding of oslo_versionedobjects, actually TestObjectVersions.test_versions() is failing on my patch https://review.openstack.org/#/c/474423/ | |
| 13:58:58 | sean-k-mooney1 | kashyap: i would be surprised if people are actully migrating over raw tcp in production. even for devstack the recomendation i was given and i give is to use ssh | |
| 13:59:13 | kashyap | Heh, yeah, indeed. | |
| 13:59:37 | gibi | ShilpaSD: give me couple of minutes... I will look at your patch | |
| 14:00:06 | kashyap | sean-k-mooney1: So, I don't know if I should spend time doing the comparison -- as that'll be comparing something not-recommended vs. something highly-recommended | |
| 14:00:11 | ShilpaSD | gibi: yup | |
| 14:01:51 | sean-k-mooney1 | kashyap: i think the security argment shoudl be enough honestly that said its not really much more secure the ssh | |
| 14:02:06 | ShilpaSD | gibi: referred Nova https://github.com/openstack/nova/blob/master/nova/tests/unit/objects/test_objects.py#L1199, and there notification related classes are not counted, similarly removed from my patch, but no sucess | |
| 14:02:25 | sean-k-mooney1 | kashyap: i would suspect over time however the native tls will be more secure and more efficent | |
| 14:02:49 | kashyap | sean-k-mooney1: Not only that, will completely deprecate the 'tunnelled' | |
| 14:03:05 | mdbooth | kashyap: Thanks. | |
| 14:03:20 | kashyap | sean-k-mooney1: See the blueprint, I the deprecation reason there | |
| 14:03:26 | kashyap | s/I the/I mentioned the/ | |
| 14:03:31 | sean-k-mooney1 | kashyap: tls is still more annoying to deploy vs jsut exchaning ssh keys | |
| 14:03:41 | kashyap | sean-k-mooney1: Also your reviewer eyes are welcome, too | |
| 14:03:52 | mdbooth | kashyap: I was just thinking that if, as sean-k-mooney1 suggests, the overhead over the current default is negligible, we should default to it. | |
| 14:04:02 | kashyap | sean-k-mooney1: Tell me all about it :-) Let me show the document I wrote -- see the scrollbar for its setup | |
| 14:04:06 | mdbooth | If they have TLS correctly configured, that is. | |
| 14:04:22 | kashyap | sean-k-mooney1: That's from-scratch setup: https://kashyapc.fedorapeople.org/Native-TLS/Setup-for-NBD-and-migration-streams-over-TLS.rst.txt | |
| 14:04:25 | kashyap | See the side-bar | |
| 14:04:33 | mdbooth | kashyap: And you'd emit a warning if TLS isn't correctly configured. | |
| 14:04:51 | kashyap | mdbooth: We're not touching any defaults at all. | |
| 14:04:53 | mdbooth | kashyap: With perhaps a config option to turn that warning into an error. | |
| 14:05:02 | sean-k-mooney1 | kashyap: so as long a libvirt suppors ssh i think we shoudl support it in nova enven if we dont recommend it for new deployments | |
| 14:05:08 | mdbooth | kashyap: ack, understood. | |
| 14:05:41 | kashyap | Just to refresh your memory, today if a Nova user wants any encryption at all, they need to explicitly configure: live_migration_tunnelled | |
| 14:06:07 | kashyap | Instead of that, we're proposing a better and secure alternative that addresses the limitations of '_tunnelled' | |
| 14:06:10 | sean-k-mooney1 | kashyap: no they jsut need to change the migration url | |
| 14:06:29 | sean-k-mooney1 | kashyap: and excanhage ssh keys | |
| 14:06:49 | kashyap | sean-k-mooney1: Oh, true -- that's the other "main way" | |
| 14:07:27 | sean-k-mooney1 | kashyap: thats the one i use as its one line and "just works" | |
| 14:08:35 | kashyap | Yeah; but hypervisor-native mechanism is what the lower layer folks recommend | |
| 14:08:46 | mdbooth | kashyap: Incidentally, why can't we query libvirt for MIN_LIBVIRT_NATIVE_TLS_VERSION and MIN_QEMU_NATIVE_TLS_VERSION? | |
| 14:09:20 | kashyap | sean-k-mooney1: Also, there's work in progress upstream QEMU that will let the native encyrption "crush" the tunnelled perf (see the chat transcript w/ DanPB) | |
| 14:09:47 | kashyap | mdbooth: Hmm ... I don't know if I a definitive answer top off my had | |
| 14:09:53 | kashyap | s/I a/I have a/ | |
| 14:10:19 | sean-k-mooney1 | sure but until devstack has support for deploying native tls ill stick with ssh for my livemigration testing :) | |
| 14:10:56 | sean-k-mooney1 | kashyap: looking at https://libvirt.org/remote.html#Remote_transports the defalt transport is not tls | |
| 14:11:02 | kashyap | mdbooth: I don't think there's a way for that level of granular querying :-( | |
| 14:11:02 | sean-k-mooney1 | *now tls | |
| 14:11:22 | kashyap | mdbooth: Because I had to do 2 hours of Git sluething in libvirt and talking to the upstream libvirt folks to settle on the right version | |
| 14:12:05 | sean-k-mooney1 | mdbooth: where you refering to checking we had the required versions or determining what the required versions were? | |
| 14:13:35 | gibi | ShilpaSD: yes, in nova there are two version checcking unit tests, one for the normal nova ovos, and another for the notification ovos. | |
| 14:14:02 | kashyap | sean-k-mooney1: The native TLS is worth the pain for actual deployers, not DevStack users #yes-offense :D | |
| 14:14:05 | gibi | ShilpaSD: just pulling your patch down to test it | |
| 14:14:12 | kashyap | s/users/users;/ | |
| 14:14:38 | mdbooth | sean-k-mooney1: Checking we have the required *features*. | |
| 14:15:21 | kashyap | mdbooth: Yeah, I see what you mean -- you want a way to check w/ libvirt if it (and the QEMU on the host) has the relevant features | |
| 14:15:30 | kashyap | Instead of us liberally splattering version constants | |
| 14:15:39 | ShilpaSD | gibi:ok | |
| 14:16:02 | kashyap | mdbooth: Okay, just double-confirmed with upstream libvirt dev: | |
| 14:16:22 | kashyap | <mprivozn> I don't think there is currently a way to tell if qemu/libvirt supports TLS migration | |
| 14:16:24 | sean-k-mooney1 | mdbooth: kashyap that would be nice but we have version checks all over the libvirt driver as its not something qemu/libvirt generally supports | |
| 14:16:43 | kashyap | sean-k-mooney1: Yeah, we just have to go that route; there's no other alternative for Nova. | |
| 14:20:28 | openstackgerrit | Maria Luisa Arches proposed openstack/nova master: Skip checking of target_dev for vhostuser https://review.openstack.org/627540 | |
| 14:22:19 | gibi | ShilpaSD: I went back to the previous commit and the test_versions already fails there | |
| 14:22:48 | ShilpaSD | gibi: yes since ps1 its failing | |