| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-11-25 | |||
| 14:59:56 | sean-k-mooney | with both a cache of the iamge and a backing file in the qcow case | |
| 15:00:03 | fungi | so what does that have to do with the ephemeral disk feature? | |
| 15:00:04 | mriedem | stephenfin: on https://review.opendev.org/#/c/686814/ i tend to think you should just leave the server-side manager stuff alone and leave that for some change at the end of that series where you delete it in a single change | |
| 15:00:12 | mriedem | stephenfin: everything else is just deleting client-side code | |
| 15:00:21 | mriedem | not sure how dansmith feels about that strategy or if it's worthwhiel | |
| 15:00:23 | mriedem | *worthwhile | |
| 15:00:41 | sean-k-mooney | fungi: well qemu cannot execute from a gpg encryped imagae as far as i am aware | |
| 15:00:44 | dansmith | mriedem: ++ | |
| 15:00:57 | sean-k-mooney | fungi: so you would have to decrypt it on the host to be able to boot the vm | |
| 15:01:17 | fungi | sean-k-mooney: got it, so the idea was to decrypt into an encrypted ephemeral disk and then boot that? | |
| 15:01:40 | stephenfin | mriedem, dansmith: what about other changes where there's call to things like virt driver methods? | |
| 15:01:43 | sean-k-mooney | fungi: yes using qemus nataive luks support | |
| 15:02:02 | dansmith | stephenfin: those would be from server methods, so during/after those are removed? | |
| 15:02:30 | sean-k-mooney | fungi: so that you dont have to us dmcrype or something lease hat would mount the disk and decypte it via the kernel | |
| 15:02:48 | stephenfin | um, can you say that again but differently? | |
| 15:02:51 | fungi | sean-k-mooney: so just to make sure i understand the interrelationship, nova boots images from ephemeral disks? or the plan would be to add booting from ephemeral disk? | |
| 15:03:44 | mriedem | fungi: if luks is involved i'd ask lyarwood | |
| 15:03:50 | sean-k-mooney | fungi: by defualt with libvirt nova boots all image from epheral root disk in qcow or raw format | |
| 15:04:17 | fungi | mriedem: well, sounds like luks isn't involved today with ephemeral disks, and that's apparently the objection/prerequisite which was raised | |
| 15:04:17 | sean-k-mooney | unless you are using boot form cinder volume or confire a different iamge backend like ceph | |
| 15:04:56 | sean-k-mooney | fungi: right today we dont support booting with encryped root disk excpu vai that lvm driver i belvie | |
| 15:05:01 | sean-k-mooney | and that has other issues | |
| 15:06:12 | fungi | sean-k-mooney: got it, thanks, so the idea is that for non-boot-from-volume scenarios, to make sure we don't store the retrieved image unencrypted, the ephemeral disk mechanism needs to support an encryption container format which qemu can boot directly | |
| 15:06:31 | sean-k-mooney | fungi: yep | |
| 15:06:43 | fungi | perfect, that was the missing connection for me. thanks!!! | |
| 15:06:51 | sean-k-mooney | the current encyped image support declared that out of scope | |
| 15:07:19 | sean-k-mooney | but mdbooth and lyarwood wanted to make it a prerequsite even though its another feature | |
| 15:07:32 | fungi | right, unfortunately i think due to their limited bandwidth they're going to focus on boot-from-volume for now and revisit support in nova later | |
| 15:07:43 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Improve metadata server performance with large security groups https://review.opendev.org/695925 | |
| 15:08:09 | sean-k-mooney | fungi: my understading is cidner does not currently support booting form an encyped volume either | |
| 15:08:34 | fungi | right, but they're up for moving forward on the spec to add that | |
| 15:08:36 | sean-k-mooney | fungi: mdbooth mentioned somting about that being inded for cinder backups but nova vms | |
| 15:08:58 | sean-k-mooney | *intended | |
| 15:09:15 | fungi | ahh, i'll take a closer look at the cinder spec to confirm | |
| 15:09:16 | sean-k-mooney | *not for nova vms | |
| 15:09:26 | fungi | thanks again | |
| 15:09:35 | lyarwood | sean-k-mooney: we can boot from an encrypted volume | |
| 15:10:21 | sean-k-mooney | lyarwood: ok but is that only with ceph | |
| 15:10:34 | lyarwood | and yeah, we need to kill off the existing ephemeral disk encryption support in the Libvirt driver before we reintroduce a sane version tbh | |
| 15:10:36 | sean-k-mooney | with isci the volume wouls be mounted on the host | |
| 15:10:40 | lyarwood | sean-k-mooney: nope, that's pretty much any backend | |
| 15:10:47 | lyarwood | sean-k-mooney: nope, that's native | |
| 15:11:02 | lyarwood | sean-k-mooney: native allowed us to support rbd encrypted volumes for the first time | |
| 15:11:19 | lyarwood | sean-k-mooney: everything else was already supported and just switched to being native within QEMU in Queens | |
| 15:11:32 | sean-k-mooney | lyarwood: ok | |
| 15:12:07 | aarents | mriedem: hi, can you confirm that commit message is ok like tht https://review.opendev.org/#/c/670000/ it was the last blocking point. | |
| 15:12:20 | sean-k-mooney | but we do still mont the voluems on the host via the kernel right they are just but encypeted? | |
| 15:12:29 | sean-k-mooney | lyarwood: im asking because fo the local caching spec | |
| 15:13:31 | sean-k-mooney | that was implying that iscsi based volumes are mounted on the host and passed to qemu as a block deice wo they could add a caching layer | |
| 15:13:55 | lyarwood | sean-k-mooney: yeah so for iSCSI/LVM etc we still end up with host devices but these are never decrypted on the host now | |
| 15:14:04 | sean-k-mooney | i assume we use qemus native encryption support to use the encyped volumes form teh host | |
| 15:14:13 | sean-k-mooney | cool | |
| 15:14:46 | sean-k-mooney | fungi: so basicly we would like to get to the same state for non boot form volume guests | |
| 15:18:38 | mriedem | lyarwood: do we even have *any* in-tree docs about encryption features in nova today? | |
| 15:18:56 | mriedem | would probably be good to level set from there | |
| 15:19:23 | lyarwood | mriedem: do releasenotes count /s | |
| 15:19:27 | mriedem | no | |
| 15:19:33 | lyarwood | aww, okay then no | |
| 15:19:40 | lyarwood | mriedem: and yeah that's a valid point | |
| 15:19:45 | mriedem | i hope you already knew the answer to that | |
| 15:20:38 | lyarwood | mriedem: https://www.urbandictionary.com/define.php?term=%2Fs yarp I did sorry | |
| 15:21:14 | mriedem | you should have jk lol'ed me with a winking smiley | |
| 15:21:18 | mriedem | that's more my speed | |
| 15:21:50 | fungi | lyarwood: sean-k-mooney: mriedem: thanks a bunch, that's all very useful info | |
| 15:22:22 | lyarwood | I'll fire a few roflcopters next time mriedem :) | |
| 15:22:46 | fungi | and a lolercoaster for good measure? | |
| 15:23:06 | lyarwood | rude not to | |
| 15:24:14 | mriedem | lol ;P | |
| 15:34:44 | mriedem | aarents: dansmith: +2 https://review.opendev.org/#/c/670000/ | |
| 15:41:27 | openstack | bug 1829479 in OpenStack Compute (nova) "The allocation table has residual records when instance is evacuated and the source physical node is removed" [Medium,In progress] https://launchpad.net/bugs/1829479 - Assigned to Matt Riedemann (mriedem) | |
| 15:41:27 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Add functional recreate test for bug 1829479 and bug 1817833 https://review.opendev.org/695932 | |
| 15:41:28 | openstack | bug 1817833 in OpenStack Compute (nova) "Check compute_id existence when nova-compute reports info to placement" [Medium,In progress] https://launchpad.net/bugs/1817833 - Assigned to Matt Riedemann (mriedem) | |
| 15:45:39 | openstackgerrit | Eric Fried proposed openstack/nova master: DNM: Test openstacksdk weakrefs https://review.opendev.org/695934 | |
| 15:48:57 | openstack | bug 1852610 in OpenStack Compute (nova) stein "API allows source compute service/node deletion while instances are pending a resize confirm/revert" [Undecided,New] https://launchpad.net/bugs/1852610 | |
| 15:48:57 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Add functional recreate test for bug 1852610 https://review.opendev.org/695935 | |
| 15:53:03 | openstack | bug 1852610 in OpenStack Compute (nova) stein "API allows source compute service/node deletion while instances are pending a resize confirm/revert" [Undecided,New] https://launchpad.net/bugs/1852610 | |
| 15:53:03 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Add functional recreate revert resize test for bug 1852610 https://review.opendev.org/695938 | |
| 16:14:07 | openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Block deleting compute services with in-progress migrations https://review.opendev.org/695940 | |
| 16:21:55 | openstackgerrit | Kashyap Chamarthy proposed openstack/nova master: libvirt: Remove MIN_{LIBVIRT,QEMU}_FILE_BACKED_VERSION https://review.opendev.org/695942 | |
| 16:30:09 | aarents | mriedem: thanks | |
| 16:38:05 | mriedem | could i get a couple of stable cores to look at these https://review.opendev.org/#/q/topic:bug/1849409+branch:stable/rocky ? | |
| 16:40:54 | lyarwood | mriedem: ack looking | |
| 16:43:58 | openstackgerrit | Stephen Finucane proposed openstack/nova master: nova-net: Remove 'nova-network' binary https://review.opendev.org/686816 | |
| 16:43:58 | openstackgerrit | Stephen Finucane proposed openstack/nova master: nova-net: Remove 'nova-dhcpbridge' binary https://review.opendev.org/686815 | |
| 16:43:59 | openstackgerrit | Stephen Finucane proposed openstack/nova master: nova-net: Remove associate, disassociate network APIs https://review.opendev.org/686814 | |
| 16:43:59 | openstackgerrit | Stephen Finucane proposed openstack/nova master: docs: Blast most references to nova-network https://review.opendev.org/686817 | |
| 16:44:00 | openstackgerrit | Stephen Finucane proposed openstack/nova master: WIP https://review.opendev.org/686818 | |
| 16:48:12 | gibi | sean-k-mooney: heads up, as the neutron meeting is at the US slot this week I won't be awake | |
| 16:51:48 | lyarwood | stephenfin: https://review.opendev.org/#/q/topic:bug/1853495 - would you mind taking a look at this today if you have time? | |
| 16:52:48 | stephenfin | yup, burning through some reviews atm | |
| 16:54:38 | mriedem | lyarwood: questoin in that nova change | |
| 16:55:39 | lyarwood | mriedem: I think the ref is wrong or cinderclient changes it, let me grep around and confirm. | |
| 16:58:08 | lyarwood | mriedem: https://github.com/openstack/nova/blob/6fea2682364cddf66c499936a8c66895ef94dd5b/nova/volume/cinder.py#L313 - my bad, it's us. | |
| 16:58:09 | mriedem | https://github.com/openstack/cinder/blob/62b69b51aab32500d3aa76677011f9db4bf4c14c/cinder/api/v2/views/volumes.py#L81 | |
| 16:58:17 | stephenfin | lyarwood, mriedem: looks like we do funky stuff in nova/volume/cinder.py via '_untranslate_volume_summary_view' | |
| 16:58:19 | mriedem | ah | |
| 16:58:20 | stephenfin | nice | |
| 17:05:13 | openstackgerrit | Merged openstack/nova master: api-guide: flesh out flavor extra specs and image properties https://review.opendev.org/695776 | |
| 17:05:19 | openstackgerrit | Merged openstack/nova master: api-guide: flesh out networking concepts https://review.opendev.org/695777 | |
| 17:05:25 | openstackgerrit | Merged openstack/nova master: api-guide: flesh out todos in user doc https://review.opendev.org/695778 | |