| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-11-14 | |||
| 20:17:38 | efried | mmph | |
| 20:17:50 | dansmith | mriedem: I'm not sure what the actual call path on this actual patch is, | |
| 20:17:57 | mriedem | dansmith: provide where? during server create? | |
| 20:17:59 | dansmith | but the move to using an admin client makes me think.. | |
| 20:18:14 | dansmith | mriedem: either there or anything that calls this | |
| 20:18:30 | mriedem | ports are under a project so you'd have to be able to GET the port given your token | |
| 20:19:02 | mriedem | fwiw we use admin client all over the place for dealing with ports b/c the binding stuff is admin-only by default policy in neutron | |
| 20:19:17 | dansmith | mriedem: I know we do and that was the problem this other bug indicated | |
| 20:19:32 | mriedem | i think the resource_request stuff is the same issue - admin only like port binding details | |
| 20:20:27 | dansmith | I don't understand how we've gotten to this point but it seems kinda wrong | |
| 20:21:12 | mriedem | if it makes you feel better, ports are better protected than volume attachments - those leak host connector details weeeee | |
| 20:21:56 | openstack | Launchpad bug 1740950 in Cinder "Volume details shows attached compute host for non-admins" [Undecided,New] | |
| 20:21:56 | mriedem | https://bugs.launchpad.net/cinder/+bug/1740950 | |
| 20:22:24 | sean-k-mooney | the port binding_profile is admin only by default as only nova or ironic e.g. not an end user should ever write to it | |
| 20:22:36 | sean-k-mooney | and the binding_detials are readonly i think | |
| 20:23:03 | mriedem | the volume attachment stuff is admin or owner ever since the nova/cinder split | |
| 20:23:20 | mriedem | because that's how nova gets the connection_info and passes the host connector | |
| 20:23:50 | mriedem | changing that now would break a lot of deployments unless they configured nova with service creds to talk to cinder with an admin role, which is what we've required for working with neutron b/c of port binding details since forever | |
| 20:23:54 | sean-k-mooney | ya whcih is not ideal as that means your ceph mon ips/fqdns are exposed | |
| 20:24:02 | sean-k-mooney | among other things | |
| 20:29:35 | dansmith | mriedem: I hope it's clear that I'm not arguing that this is doing something new, or not consistent with behavior "since forever", just that the other bug made me think about how often we use the neutron admin client to do stuff on behalf of the user and wonder why that's not a problem | |
| 20:31:40 | mriedem | i suspect it's not a problem b/c the non-admin can't GET the port details with the host binding details | |
| 20:31:41 | sean-k-mooney | dansmith: in the port bining case you are not exactly doing it on behalf of the user in all cases. nova is setting admin only filed to comninciate infomation to neutron that the network backend needs to know to wire up the port that the teant should not known | |
| 20:31:51 | sean-k-mooney | mriedem: yep | |
| 20:32:16 | mriedem | unlike that volume attachment bug | |
| 20:32:50 | dansmith | sean-k-mooney: yeah, understand that for the binding case | |
| 20:33:32 | sean-k-mooney | for what its wroth im not realy sure why we chose to make the port resouce requests admin only | |
| 20:33:48 | sean-k-mooney | the allocations sure | |
| 20:33:53 | mriedem | huh, looks like as a non-admin I can also do GET /v3/{project_id}/attachments/{attachment_id} on any volume attached to my server and get the host connection info | |
| 20:33:57 | mriedem | which is great | |
| 20:34:12 | sean-k-mooney | well that is needed for standalone cinder | |
| 20:34:20 | mriedem | heh | |
| 20:34:21 | mriedem | ok | |
| 20:34:23 | mriedem | .. | |
| 20:34:30 | mriedem | there is no policy rule on GET /v3/{project_id}/attachments/{attachment_id} | |
| 20:34:33 | openstackgerrit | Merged openstack/nova master: libvirt: Ignore DiskNotFound during update_available_resource https://review.opendev.org/685391 | |
| 20:34:37 | sean-k-mooney | i assume you mean the conintion info | |
| 20:34:39 | openstackgerrit | Merged openstack/nova master: Log reason for remove_host action failing https://review.opendev.org/692833 | |
| 20:34:45 | openstackgerrit | Merged openstack/nova master: docs: update SUSPENDED server status wrt supported drivers https://review.opendev.org/694329 | |
| 20:34:45 | mriedem | i would assume that standalone cinder would be single tenant with admin access to everything | |
| 20:34:49 | mriedem | sean-k-mooney: yes, connection_info | |
| 20:40:50 | sean-k-mooney | oh i remember why we made port resouce request admin only | |
| 20:41:01 | sean-k-mooney | its so you can request random crap via the port | |
| 20:41:49 | sean-k-mooney | ah the made it readonly https://github.com/openstack/neutron-lib/blob/master/neutron_lib/api/definitions/port_resource_request.py#L31-L34 | |
| 20:41:52 | sean-k-mooney | good | |
| 20:43:35 | mriedem | random crap is the best kind of nfv crap | |
| 20:44:12 | openstackgerrit | Archit Modi proposed openstack/nova stable/queens: Revert "openstack server create" to "nova boot" in nova docs https://review.opendev.org/693239 | |
| 20:45:39 | amodi | mriedem: https://review.opendev.org/#/c/694357/2 i think this is ready to be merged and then the above ^^ one | |
| 20:45:59 | openstackgerrit | Eric Fried proposed openstack/nova-specs master: Spec: Ussuri: Encrypted Emulated Virtual TPM https://review.opendev.org/686804 | |
| 20:47:56 | efried | johnthetubaguy, mriedem (as approvers of the original stein spec), dansmith (because we've been talking about it): This spec ^ is ready for your discerning eyes. Please and thank you. | |
| 20:48:24 | efried | jroll: minor updates, fyi ^ | |
| 20:48:36 | jroll | noted | |
| 20:51:20 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/queens: Revert "openstack server create" to "nova boot" in nova docs https://review.opendev.org/693239 | |
| 20:52:11 | mriedem | amodi: done | |
| 20:52:27 | amodi | thanks! | |
| 20:52:36 | mriedem | efried: i don't even remember approving those. i think it was someone that hacked my account. | |
| 20:53:23 | efried | mriedem: This ain't discover card. You ARE responsible for charges made on your account. | |
| 20:58:12 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Reset vm_state to original value if rebuild claim fails https://review.opendev.org/692185 | |
| 21:27:24 | tonyb | mriedem, sean-k-mooney: Not if I do my job right. It'll be everyone's problem | |
| 21:28:30 | sean-k-mooney | power i could live with if they gave me a machine. im not sure i would have room for a mainframe in my hallway | |
| 21:29:09 | sean-k-mooney | so z is not a think i want to deal with | |
| 21:29:16 | openstackgerrit | Eric Fried proposed openstack/nova master: Add support for resize and cold migration of emulated TPM files https://review.opendev.org/639934 | |
| 21:29:16 | openstackgerrit | Eric Fried proposed openstack/nova master: WIP: Add emulated TPM support to Nova https://review.opendev.org/631363 | |
| 21:30:14 | tonyb | sean-k-mooney: Well I'd hope you have access to some at work, at home you're on your own but https://www.raptorcs.com/TALOSII/ is about the same price I paid for my x86_64 dev box | |
| 21:30:55 | sean-k-mooney | ya i have seen those before | |
| 21:36:07 | sean-k-mooney | tonyb: im sure there is a less painful way to get acesss to hardware at work but i generally do all my deve either my my personal server i bought or on my laptop in a vm where i fake out numa toploiges with libvirt | |
| 21:36:36 | sean-k-mooney | technically i could also just fake a power system that way too i guess i just would be slow without kvm | |
| 21:37:22 | tonyb | sean-k-mooney: Yes it works but is slow | |
| 21:38:02 | sean-k-mooney | ya its just because kvm only supprot acclerate of your native instruction set | |
| 21:39:05 | tonyb | yeah TCG is nice but slow | |
| 21:39:38 | sean-k-mooney | have you played with the multi threaded tcg backend e.g. mttcg | |
| 21:39:55 | sean-k-mooney | thats actully not bad in the little i have used it | |
| 21:40:03 | tonyb | No, I didn't know that existed | |
| 21:40:17 | sean-k-mooney | you need really new qemu | |
| 21:40:35 | sean-k-mooney | it was added for acclerating other architure mainly arm | |
| 21:40:35 | tonyb | I have F30, is that new enough? | |
| 21:41:04 | sean-k-mooney | i can check. it getts enabeld automaticaly if you cpu model is supproted | |
| 21:41:19 | tonyb | I'll go googling ;p | |
| 21:41:50 | sean-k-mooney | oh looks like you can force it too now https://wiki.qemu.org/Features/tcg-multithread | |
| 21:43:00 | sean-k-mooney | looks like aarch64 was in 2.9 | |
| 21:43:11 | sean-k-mooney | not sure if power has been added | |
| 21:48:42 | sean-k-mooney | look like mips,arm,aarch64,x86_64 and aplha have support in the latest version but no power supprot at elast form the release notes | |
| 21:48:57 | tonyb | Pfft | |
| 21:57:51 | openstackgerrit | Merged openstack/nova master: Join migration_context and flavor in Migration.instance https://review.opendev.org/689846 | |
| 21:57:57 | openstackgerrit | Merged openstack/nova master: Improve metadata server performance with large security groups https://review.opendev.org/656084 | |
| 22:04:34 | sean-k-mooney | ... | |
| 22:04:51 | sean-k-mooney | i was just about to push and then call it a day and now i have a merg conflcit | |
| 22:06:48 | openstackgerrit | sean mooney proposed openstack/nova master: support pci numa affinity policies in flavor and image https://review.opendev.org/674072 | |
| 22:06:54 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/train: Join migration_context and flavor in Migration.instance https://review.opendev.org/694408 | |
| 22:07:33 | sean-k-mooney | ill fix that tomorrow but it now has the func tests and artoms nits adressed | |
| 22:07:39 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/train: Improve metadata server performance with large security groups https://review.opendev.org/694409 | |
| 22:18:47 | sean-k-mooney | actully it looks trivial ill fix it now | |
| 22:19:37 | openstackgerrit | sean mooney proposed openstack/nova master: support pci numa affinity policies in flavor and image https://review.opendev.org/674072 | |
| 23:30:06 | openstackgerrit | Matt Riedemann proposed openstack/nova master: WIP: Store instance action event exc_val fault details https://review.opendev.org/694428 | |
| #openstack-nova - 2019-11-15 | |||
| 00:43:13 | openstackgerrit | Matt Riedemann proposed openstack/nova master: WIP: Expose instance action event details out of the API https://review.opendev.org/694430 | |
| 02:20:29 | openstackgerrit | Merged openstack/nova master: Move compute_node_to_inventory_dict to test-only code https://review.opendev.org/693438 | |
| 02:20:35 | openstackgerrit | Merged openstack/nova master: Remove get_minimum_version mocks from test_resource_tracker https://review.opendev.org/693439 | |
| 02:20:43 | openstackgerrit | Merged openstack/nova stable/queens: doc: fix and clarify --block-device usage in user docs https://review.opendev.org/694357 | |
| 02:59:56 | openstackgerrit | Merged openstack/nova master: Stop using NoAuthMiddleware in tests https://review.opendev.org/687416 | |
| 03:10:17 | openstackgerrit | Merged openstack/nova master: Remove TODO from ComputeTaskManager._live_migrate https://review.opendev.org/693696 | |