| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-04-03 | |||
| 10:28:31 | stephenfin | awalende: It was planned but never implemented | |
| 10:39:21 | openstackgerrit | Kashyap Chamarthy proposed openstack/nova-specs master: Add Secure Boot support for KVM- and QEMU-based guests https://review.openstack.org/506720 | |
| 10:40:56 | sean-k-mooney | yes just remove teh hypens | |
| 10:41:08 | sean-k-mooney | for kvm and qemu based guests | |
| 10:41:26 | sean-k-mooney | you can also remove based | |
| 10:41:49 | NewBruce | howdy sean-k-mooney | |
| 10:42:07 | sean-k-mooney | just looking at your proposea i dont se any reference to the use of the flavor extraspecs for contoling secure boot | |
| 10:42:14 | sean-k-mooney | NewBruce: hi | |
| 10:42:15 | NewBruce | was a bit like christmas last night, waiting to see how the tests would run :) | |
| 10:42:29 | NewBruce | shame it didn’t blow up, huh?! ;) | |
| 10:42:50 | sean-k-mooney | ya i had the tab open for a while but needed to go sleep | |
| 10:43:20 | sean-k-mooney | there are some other thing we could try like forcing different conpute level on either node | |
| 10:43:35 | NewBruce | yep, same - we’re gonna roll out rocky accross the full compute today and see what that does | |
| 10:44:00 | kashyap | sean-k-mooney: But the sentence is syntactically correct. (I read about dangling hyphens enough that the above is correct, but ugly :D) | |
| 10:44:00 | NewBruce | …. well, I was going to, until a net node decided to fall over due to excessive CPU usage in netlink | |
| 10:44:15 | sean-k-mooney | the grenade job should have been testing queens to rocky migration i think | |
| 10:44:19 | NewBruce | ever seen this? | |
| 10:44:20 | NewBruce | 2019-04-03T10:30:28.283Z|2158411|poll_loop(handler44)|INFO|wakeup due to [POLLIN] on fd 33 (unknown anon_inode:[eventpoll]) at ../lib/dpif-netlink.c:2786 (99% CPU usage) | |
| 10:44:20 | NewBruce | 2019-04-03T10:30:28.283Z|2158410|poll_loop(handler44)|INFO|Dropped 3426304 log messages in last 6 seconds (most recently, 0 seconds ago) due to excessive rate | |
| 10:44:23 | sean-k-mooney | actuly no it would have been rocky to master | |
| 10:44:54 | sean-k-mooney | is that form ovs | |
| 10:45:00 | NewBruce | yup | |
| 10:45:11 | NewBruce | Absolutely nothing on the machine; freshly rebooted | |
| 10:45:18 | NewBruce | 1979 root 10 -10 1000172 135296 10912 S 799.3 0.2 1136:19 ovs-vswitchd | |
| 10:45:18 | NewBruce | PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND | |
| 10:45:38 | kashyap | sean-k-mooney: Hmm, I mentioned the metadata property (`os_secure_boot`), but didn't write anything about flavor extra_specs | |
| 10:45:39 | NewBruce | … ouch; seems like a FD leak perhaps | |
| 10:45:50 | kashyap | sean-k-mooney: I'm ill a bit; will be taking the noon off. Will respond to feedback tomm | |
| 10:46:24 | sean-k-mooney | kashyap: take it easy. ill see if i can find the relevent place to add it and do a full review | |
| 10:46:45 | sean-k-mooney | openstack flavor set FLAVOR-NAME \ | |
| 10:46:47 | sean-k-mooney | --property os:secure_boot=SECURE_BOOT_OPTION | |
| 10:47:08 | sean-k-mooney | values are required|optional|disabled | |
| 10:48:34 | sean-k-mooney | NewBruce: perhaps it could be jsut ovs trying franticly to reconnect to all the tap device for the vms or something | |
| 10:49:16 | sean-k-mooney | i have seen that message or one like it when ovs has been under heavy load but i dont recal it on startup | |
| 10:49:20 | kashyap | sean-k-mooney: Yeah, makes sense. Please add your comment on the review. And thanks for the quick feedback | |
| 10:49:26 | kashyap | Appreciate your time | |
| 10:50:40 | sean-k-mooney | kashyap: its just a mirror of the image propery but it is used so that operators can use the aggerate filter to force the only instance with secure boot enabeled can be schduled to a host aggrate for increased security | |
| 10:50:55 | sean-k-mooney | at least in hyperv land where this works today | |
| 10:51:05 | NewBruce | looks like its got itself into a loop waiting for netlink and just stuck there | |
| 10:52:01 | kashyap | sean-k-mooney: I see. Noted. | |
| 10:52:26 | kashyap | sean-k-mooney: The current problem for KVM/QEMU guests, upstream is that it gives a bogus sense of "secure boot" :-( | |
| 10:53:19 | kashyap | Because currently in upstream Nova (a) no way to configure "SMM"; (b) no way to specify NVRAM file with enrolled keys; (c) auto-select the _right_ OVMF binary | |
| 10:53:26 | kashyap | Anyway, more discussion later :-) | |
| 11:30:02 | openstackgerrit | sean mooney proposed openstack/nova stable/ocata: PCI: do not force remove allocated devices https://review.openstack.org/635075 | |
| 11:47:20 | openstackgerrit | Merged openstack/nova master: Docs: emulator threads: clarify expected behavior https://review.openstack.org/649416 | |
| 12:05:30 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: Add node_uuid field to Destination object https://review.openstack.org/649532 | |
| 12:05:31 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: Add in_tree field to RequestGroup object https://review.openstack.org/649534 | |
| 12:05:31 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: Pass node uuid to new Destination.node_uuid https://review.openstack.org/649533 | |
| 12:05:32 | openstackgerrit | Tetsuro Nakamura proposed openstack/nova master: node_uuid from RequestSpec to ResourceRequest https://review.openstack.org/649535 | |
| 12:08:28 | shilpasd | hi: observed that in multinode setup, instance data files created at all nodes (controller + compute in my case) at 'instances_path', why is this so? | |
| 12:09:40 | openstackgerrit | Merged openstack/nova master: Style corrections for privsep usage. https://review.openstack.org/648615 | |
| 12:09:51 | openstackgerrit | Merged openstack/nova master: Remove mox in unit/network/test_neutronv2.py (4) https://review.openstack.org/574106 | |
| 12:10:00 | openstackgerrit | Merged openstack/nova master: Remove mox in unit/network/test_neutronv2.py (5) https://review.openstack.org/574110 | |
| 12:18:24 | sean-k-mooney | o/ | |
| 12:19:00 | sean-k-mooney | are there any known gate issues related to installing hacking package | |
| 12:19:22 | sean-k-mooney | i think the failure im seeing was just an intermitent netowrk issue but | |
| 12:19:41 | sean-k-mooney | before i recheck https://review.openstack.org/#/c/649409/ i just said i would ask | |
| 12:21:06 | sean-k-mooney | ill jsut recheck as everything else passed | |
| 12:22:53 | sean-k-mooney | melwitt: when https://review.openstack.org/#/c/649409/ merges ill cherry pick it back to stable/stein | |
| 12:25:56 | sean-k-mooney | tonyb: speaking of stable backport i fixed the indentation in https://review.openstack.org/#/c/635075/2..3 | |
| 12:38:55 | efried | mriedem: Right (forbidden traits never worked) | |
| 12:39:51 | alex_xu | eandersson: yea, tags is better for just lable instance, and searching http://specs.openstack.org/openstack/nova-specs/specs/newton/implemented/tag-instances.html | |
| 12:43:00 | sean-k-mooney | efried: it worked in a flavor right just not in an image? | |
| 12:43:28 | sean-k-mooney | efried: or is it just totally borked for everything on the nova sise | |
| 12:43:32 | sean-k-mooney | side | |
| 12:43:57 | efried | sean-k-mooney: it didn't work in flavor, but it was supposed to. | |
| 12:44:12 | efried | sean-k-mooney: it doesn't work in image, but we never implemented that, so that part's not surprising. | |
| 12:44:14 | sean-k-mooney | oh ok so it only works at the placement api level | |
| 12:44:19 | efried | right | |
| 12:44:26 | efried | well, now it works from flavor too. | |
| 12:44:33 | sean-k-mooney | ah ok | |
| 12:44:34 | efried | because fixed | |
| 12:44:39 | sean-k-mooney | :) | |
| 12:44:42 | efried | probably stein backport-worthy. | |
| 12:44:53 | efried | but probably not RC-worthy | |
| 12:45:05 | efried | not sure | |
| 12:45:13 | sean-k-mooney | it was "intoduced" in rocky right? | |
| 12:45:55 | sean-k-mooney | yep https://github.com/openstack/nova-specs/blob/master/specs/rocky/implemented/placement-forbidden-traits.rst | |
| 12:45:58 | efried | sean-k-mooney: The placement side was a year ago. | |
| 12:46:30 | efried | trying to find the nova side | |
| 12:47:36 | sean-k-mooney | i think it was all covered by the same spec for rocky | |
| 12:47:43 | shilpasd | efried: observed that in multinode setup, instance data files created at all nodes (controller + compute in my case) at 'instances_path', is it correct behavior? | |
| 12:49:12 | efried | sean-k-mooney: https://blueprints.launchpad.net/nova/+spec/forbidden-traits-in-nova different spec | |
| 12:49:50 | efried | shilpasd: sounds like a libvirt question. sean-k-mooney or stephenfin, y'all have that answer off the top? | |
| 12:50:00 | sean-k-mooney | efried: assuming this was added in rocky then its not an rc candiate since the regession was not in stien but i would agrue the fix should be backported to both stable/stien and stable/rocky as it was just a bug in the original implemenation and not a new feature | |
| 12:50:24 | sean-k-mooney | efried: shilpasd i did not anser because i did not know. | |
| 12:50:59 | sean-k-mooney | if by instance data path you mean under /var/lib/libvirt* then yes | |
| 12:51:02 | efried | sean-k-mooney: https://review.openstack.org/#/c/561677/ <== rocky. So yeah. | |
| 12:51:05 | sean-k-mooney | i think that is correct | |
| 12:51:24 | shilpasd | efried: sean-k-mooney: okay, will check with stephenfin, 'instances_path = /opt/stack/data/nova/instances' | |
| 12:51:49 | openstackgerrit | Matthew Booth proposed openstack/nova master: systemd detection result caching nit fixes https://review.openstack.org/649229 | |
| 12:51:50 | sean-k-mooney | efried: so ya not an RC candiate but assuming the fix is non invasive it should be a backprot candiate | |
| 12:52:09 | sean-k-mooney | shilpasd: is this a devstack setup | |
| 12:53:33 | shilpasd | sean-k-mooney: yes | |
| 12:53:43 | sean-k-mooney | if so the /opt/stack/data directory is where we sotre image and cinder voluems and other perstnet data form the openstack services | |
| 12:53:56 | sean-k-mooney | so i would not be surpiesd if the instacne root disk is also stored there | |
| 12:54:20 | sean-k-mooney | i have never really checked however. | |
| 12:54:41 | shilpasd | sean-k-mooney: but in multinode case, it was stored at both node in my case, at controller side and at compute side | |
| 12:55:08 | sean-k-mooney | shilpasd: it wont be sotre in both localtions it will be copied if you do a migration | |
| 12:55:42 | sean-k-mooney | e.g. we wont create the isntace root disk on all nodes in the multinode devstack cloud | |