| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-03-20 | |||
| 18:40:31 | klindgren | Allowing ssh between all compute nodes with an ssh key | |
| 18:40:53 | sean-k-mooney | klindgren: i dont think that is required in all cases | |
| 18:40:53 | klindgren | Gives an easy vector for an attacker to spread across compute nodes | |
| 18:41:22 | klindgren | Its required in the configdrive + iso9960 use case | |
| 18:41:30 | sean-k-mooney | if you are using the ssh migration uri for libvrt then it would be | |
| 18:41:59 | sean-k-mooney | but im not sure if you can tunnel the file data over the libvirt connection when using qemus/libvirst native tls feature | |
| 18:42:00 | klindgren | we are using TLS for libvirt but this code does scp's of the config drive | |
| 18:42:07 | sean-k-mooney | kashyap: ^ any idea? | |
| 18:42:13 | klindgren | Because even libvirt 4.x can't migrate it/won't | |
| 18:42:24 | sean-k-mooney | klindgren: oh ok | |
| 18:42:55 | sean-k-mooney | klindgren: any you need config drive because ye cant use metadata service or just dont want too? | |
| 18:43:37 | klindgren | We only use configdrive vs's running metadata, and we have a bunch of stuff from other teams built onto of configdrive | |
| 18:44:08 | sean-k-mooney | oh wait ye are still support file injection too wich needs config drive | |
| 18:44:56 | klindgren | We don't specifically disable file injection, however in our case - no one uses it. | |
| 18:48:07 | klindgren | Basically In: https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L8196-L8215 | |
| 18:48:08 | _pewp_ | [ nova/driver.py at master · openstack/nova · GitHub ] - github.com | |
| 18:48:41 | sean-k-mooney | klindgren: ok. at first glance it sound like we may be able to just recreate the config drive in your sepcific case when file inject is diabled. | |
| 18:49:00 | klindgren | If we change iso9660 to iso9661, the live migration works. The confgdrive file is created on the destination hv. However, its created as a correctly size, spare file with no data in it | |
| 18:50:22 | klindgren | sean-k-mooney, We would be willing to do the code for this. Just wanted to make sure that their was some reason why we never did this before and wanted to make sure that we would have some level of support for this. | |
| 18:50:54 | klindgren | Assuming the file injection stuff was probably the blocker before hand. | |
| 18:51:43 | mriedem | klindgren: dansmith and/or jaypipes might remember other reasons | |
| 18:52:25 | dansmith | the configdrive being readonly makes it not migrated by libvirt, IIRC | |
| 18:52:41 | mriedem | figuring out if file injection is disabled on both the source and dest and telling hosts on both sides during live migration, hey, file injection is disabled so if there is a config drive on the instance, just rebuild it on the dest, would probably be pretty straight-forward | |
| 18:52:43 | sean-k-mooney | dansmith: i think tha thas been fixed | |
| 18:53:03 | _pewp_ | [ Gerrit Code Review ] - review.openstack.org | |
| 18:53:03 | openstackgerrit | Vladyslav Drok proposed openstack/nova master: libvirt: Do not reraise DiskNotFound exceptions during resize https://review.openstack.org/571410 | |
| 18:53:32 | sean-k-mooney | mriedem: ya that is what i was thinking too but i dont know if im missing an edge case | |
| 18:53:51 | sean-k-mooney | aslo is _pewp_ a new bot? | |
| 18:54:02 | dansmith | sean-k-mooney: I thought it was actually categorically rejected, but I'm sure I'm wrong | |
| 18:54:20 | mriedem | idk wtf _pewp_ is but it looks like it's hemna_'s | |
| 18:55:44 | sean-k-mooney | dansmith: i was jsut taking this config comment on face value https://github.com/openstack/nova/blob/master/nova/conf/configdrive.py#L17-L33 | |
| 18:55:45 | _pewp_ | [ nova/configdrive.py at master · openstack/nova · GitHub ] - github.com | |
| 18:56:36 | sean-k-mooney | i dont know wat "resolved in libvirt v1.2.17" actully means | |
| 18:56:47 | sean-k-mooney | they coudl have document it as wont fix i guess | |
| 18:57:59 | dansmith | well, that was one reason to have it as vfat, IIRC, | |
| 18:58:30 | dansmith | but I thought we actually still need that for other reasons, like being able to host instances with no iso9660 support, and maybe one of the sub-drivers like virtuozzo that needs a regular filesystem or something | |
| 18:58:32 | sean-k-mooney | ya vfat was a woraround for that issue | |
| 18:58:55 | mriedem | sean-k-mooney: stephenfin deprecated the config_drive_format option so you could follow up with him | |
| 18:59:42 | sean-k-mooney | mriedem: ya i was going to check the release notes for libvirt 1.2.17 | |
| 18:59:55 | openstack | bugzilla.redhat.com bug 1203032 in libvirt "Enhancing block/disk migration in libvirt" [Low,Closed: nextrelease] - Assigned to pboldin | |
| 18:59:55 | mriedem | the commit message referenced https://bugzilla.redhat.com/show_bug.cgi?id=1203032 | |
| 18:59:56 | _pewp_ | [ 1203032 – Enhancing block/disk migration in libvirt ] - bugzilla.redhat.com | |
| 19:00:22 | eandersson | sean-k-mooney, I see | |
| 19:00:42 | eandersson | I think this changed somehow during the upgrade which is why it's weird | |
| 19:00:48 | eandersson | I mean we went from.. Mitaka to Rocky :D | |
| 19:01:21 | eandersson | from my perspective it looks like base images are taken into account now, and weren't before. | |
| 19:01:30 | sean-k-mooney | eandersson: do you set allocation raitios in host aggreates? | |
| 19:01:42 | eandersson | nothing overcommited on these flavors | |
| 19:01:54 | eandersson | I tried adding disk_all = 1 but did nothing | |
| 19:04:05 | _pewp_ | [ OpenStack Docs: Configuration Options ] - docs.openstack.org | |
| 19:04:05 | sean-k-mooney | by disk_all do you mean https://docs.openstack.org/nova/rocky/configuration/config.html#DEFAULT.disk_allocation_ratio | |
| 19:04:18 | eandersson | sorry yea disk_allocation_ratio | |
| 19:04:38 | eandersson | we don't have it set in the aggregate for non-overprovisioned aggergates | |
| 19:05:33 | sean-k-mooney | eandersson: in ocata? i think we broke setting allocation ratios via host aggregates when we started using placment for cpu ram and disk | |
| 19:06:06 | sean-k-mooney | there is a mail from melwitt about butthis is proably not the issue. | |
| 19:06:39 | sean-k-mooney | http://lists.openstack.org/pipermail/openstack-dev/2018-January/126283.html | |
| 19:07:06 | sean-k-mooney | eandersson: in upgading form mitaka to rocky you went form that working to not | |
| 19:07:22 | eandersson | So I would expect that to break for instances that are over-commited | |
| 19:07:29 | eandersson | not for instances that are not overcommited right? | |
| 19:07:53 | sean-k-mooney | but also you nolonger need the AggregateCoreFilter,AggregateRamFilter,AggregateDiskFilter or the core/ram/disk filters | |
| 19:08:05 | eandersson | I think that would fix it for us | |
| 19:08:47 | eandersson | because placement does that now? | |
| 19:09:03 | sean-k-mooney | eandersson: yes this is handeled by placement now | |
| 19:09:21 | sean-k-mooney | or rather form ocata on | |
| 19:09:31 | _pewp_ | [ Gerrit Code Review ] - review.openstack.org | |
| 19:09:31 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: [WIP] Revert resize: wait for external events in compute manager https://review.openstack.org/644881 | |
| 19:09:50 | artom | _pewp_, what are you? | |
| 19:09:53 | sean-k-mooney | so you can safely disable the disk filter that is preventing the vm form working | |
| 19:10:14 | sean-k-mooney | artom: i think a bot of some kind | |
| 19:10:26 | artom | sean-k-mooney, heh, I got that part :) | |
| 19:10:31 | eandersson | Yea - I enabled debug | |
| 19:10:42 | eandersson | I gotta go, but will be back later. More meeting | |
| 19:13:24 | sean-k-mooney | artom: i think its https://github.com/hemna/sopel-tableflip | |
| 19:20:39 | melwitt | lbragstad, mriedem: well, the parts I thought were relevant to operators/users (and thus forum) are 1) are operators on board with the idea of fixing non-admin policy handling via scope types as a carrot to get operators to adopt different token scopes in their use of nova and 2) if the unified limit migration details in the spec sound OK to operators. 2) is maybe not something operators care too much about | |
| 19:23:13 | _pewp_ | [ Gerrit Code Review ] - review.openstack.org | |
| 19:23:13 | efried | dansmith: Sorry if I'm being a dolt here, but where does the request filter get required=COMPUTE_IMAGE_TYPE_FOO from originally? Is it image_meta? Is it translated from the image type somehow? This is the part I'm still missing in https://review.openstack.org/#/c/644625/ | |
| 19:23:59 | efried | You've mentioned how the compute driver adds COMPUTE_IMAGE_TYPE_FOO into its capabilities | |
| 19:24:12 | dansmith | efried: I haven't worked it all out all the plumbing yet, but we know what image they asked for and we can know what format it's in | |
| 19:25:07 | efried | Okay. So like if there's an image.type field and we can do "COMPUTE_IMAGE_TYPE_SUPPORT_%s" % image.type kind of thing? | |
| 19:25:14 | dansmith | right | |
| 19:25:24 | dansmith | it's called format I think, but yeah | |
| 19:25:38 | efried | image.type.upper().replace("things that aren't legal", "_") | |
| 19:25:52 | efried | os_traits.normalize something | |
| 19:25:56 | efried | okay, cool. Thanks. | |
| 19:26:02 | dansmith | efried: | disk_format | qcow2 | | |
| 19:26:49 | sean-k-mooney | am so dumb question before i read your sepc. could we just tag the compute nodes with traits for the image typs they support and then read the image type form glance and add the trait to the placment request | |
| 19:26:58 | dansmith | efried: https://docs.openstack.org/glance/rocky/user/formats.html | |
| 19:26:59 | _pewp_ | [ OpenStack Docs: Disk and Container Formats ] - docs.openstack.org | |
| 19:27:06 | dansmith | efried: pretty constrained list there | |
| 19:27:15 | sean-k-mooney | im thinking of suppoted image types like compute capablites | |
| 19:27:18 | efried | dansmith: cool. Standard traits to be proposed I assume. | |
| 19:27:25 | efried | sean-k-mooney: That's what he's doing, yes. | |
| 19:27:33 | dansmith | efried: yep | |
| 19:27:41 | sean-k-mooney | efried: ok makes sense | |
| 19:28:09 | dansmith | efried: first item in work item list is "add to os-traits" | |
| 19:28:13 | efried | os_traits.normalize_name is only for custom traits. prolly going to want a map. | |
| 19:28:35 | efried | ++ | |
| 19:28:56 | sean-k-mooney | efried: i was going to say we have some code in nova to normalise traits already but maybe we never merged that.. | |
| 19:29:14 | efried | sean-k-mooney: Yeah, we merged it and then moved it to os.traits, but it's only for custom | |
| 19:29:53 | sean-k-mooney | i was thinking of the traits nomalisation code for the feature based nic schduling that we never finished. | |