| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-12-20 | |||
| 17:25:30 | gmann | i think i got your point and deprecate to RULE_ADMIN_API | |
| 17:25:37 | johnthetubaguy | yeah | |
| 17:25:58 | johnthetubaguy | so when an operator wants the new world, its only a few rules they change | |
| 17:26:18 | gmann | but what if any API rule changing from RULE_ADMIN_OR_OWNER - > SYSTEM_ADMIN ? i think no.. | |
| 17:27:08 | gmann | it will be -> either PROJECT_MEMBER_OR_SYSTEM_ADMIN or PROJECT_READER_OR_SYSTEM_READER that what we have in table | |
| 17:27:39 | johnthetubaguy | yeah, that is the only option I believe | |
| 17:27:53 | johnthetubaguy | and it should work OK for those two | |
| 17:28:03 | johnthetubaguy | hopefully the unit tests will keep us honest here anyways | |
| 17:28:16 | johnthetubaguy | once we have added them :) | |
| 17:28:21 | gmann | johnthetubaguy: then all case we can do in base rules as per this tabel? -https://github.com/openstack/nova/blob/b953db09e8b9195c6a922c03a57f44cd790adcb6/nova/policies/base.py#L41 | |
| 17:28:36 | johnthetubaguy | yeah, I hope so | |
| 17:29:01 | johnthetubaguy | so if we go through the cases... | |
| 17:29:08 | gmann | until we encounter any such policy conflicting that table but we can check that if we encounter such case | |
| 17:29:25 | johnthetubaguy | 1) no overrides, just use default, they keep working | |
| 17:29:43 | gmann | ahh 1 min | |
| 17:29:52 | gmann | so override would not work in that case | |
| 17:30:02 | johnthetubaguy | ah, why is that? | |
| 17:30:28 | johnthetubaguy | I think if you override, it skips doing an or with the deprecated rule | |
| 17:30:34 | gmann | because override is done with specific policy rules not base rules | |
| 17:30:51 | johnthetubaguy | right, but I think that is OK | |
| 17:31:16 | johnthetubaguy | in the sense that if the override it to something special, that something special stays the same | |
| 17:32:30 | gmann | yeah override rule is first pick in oslo policy. | |
| 17:33:03 | johnthetubaguy | maybe another question... what upgrade check should we when we want to make enforce_scope = true? | |
| 17:33:31 | johnthetubaguy | we could warn if they have any policy rules overriden that they need checking, but not sure what else we can do really | |
| 17:33:51 | gmann | we need deprecation at specific policy level when we do granularity where rule name change like- https://review.opendev.org/#/c/648480/23/nova/policies/services.py | |
| 17:33:53 | johnthetubaguy | this is more for "next" release, after we make the initial backwards compatible change | |
| 17:34:04 | johnthetubaguy | gmann: +1 | |
| 17:34:11 | johnthetubaguy | that case we totally need that | |
| 17:34:58 | johnthetubaguy | but that is a sort of independent issue, its because we added more granularity | |
| 17:35:07 | gmann | yeah | |
| 17:35:11 | johnthetubaguy | and folks make have overriden the old rule | |
| 17:35:28 | johnthetubaguy | cool, does that mean we are all set? | |
| 17:36:33 | gmann | for upgrade check, i was thinking auto correction but it need more thought. | |
| 17:36:59 | johnthetubaguy | yeah, although I don't think it blocks this release's work a such | |
| 17:37:21 | johnthetubaguy | the simplest check is probably to see if the override is the old default | |
| 17:37:37 | johnthetubaguy | in case people haven't deleted their old policy files they always used to deploy | |
| 17:37:58 | johnthetubaguy | there is an ops meetup after christmas, I could ask around there if policy comes up | |
| 17:38:17 | gmann | +1, that will be great. | |
| 17:38:50 | johnthetubaguy | cool, happy holidays when that happens | |
| 17:38:52 | gmann | seems all set for now. thanks for discussion. | |
| 17:39:17 | johnthetubaguy | no problem, thanks for pushing this, so many of our customers are wanting to see this move forward | |
| 17:39:19 | gmann | you too. i will try to make other policy ready once you are back | |
| 17:39:29 | johnthetubaguy | cool | |
| 17:40:21 | gmann | also waiting for stephenfin to reply on this, i could not understand his query (if something interesting to care at initial level)- https://review.opendev.org/#/c/657698/14 | |
| 17:43:30 | johnthetubaguy | gmann: I think stephenfin was meaning we could have left the unit tests where they were, under api, rather than "moving" to policy | |
| 17:44:12 | gmann | ohk | |
| 17:45:13 | johnthetubaguy | personally, I had assumed we were putting the unit tests under api/ before I saw your patches, but I wasn't against moving it | |
| 17:45:14 | gmann | i think doing under separate dir is more explicit and easy to check coverage. inside API it was very hidden kind of testing. but may be it just me ? | |
| 17:45:40 | johnthetubaguy | the other thing, is when you cut and paste all the tests when adding a new API, you might not see the policy tests | |
| 17:45:57 | johnthetubaguy | not that people do that, of course (cough) | |
| 17:45:58 | gmann | i actually went with the code structure. policies is not under API code | |
| 17:46:31 | johnthetubaguy | but we are testing the context.can call, and that is under the API code | |
| 17:46:59 | johnthetubaguy | I should be clear, my +2 stands, I don't mind the idea, for the reasons you just said | |
| 17:47:17 | johnthetubaguy | really just playing devils advocate to make sure we are sure | |
| 17:48:26 | gmann | ok. i can move as its not big deal. may be under ./nova/tests/unit/api or nova/tests/unit/api/openstack/compute ? | |
| 17:49:36 | johnthetubaguy | I think for that patch, basically it goes where those deleted tests are | |
| 17:50:13 | johnthetubaguy | but I would +2 either approach, until I hear a stronger argument for one or the other | |
| 17:50:37 | gmann | i think we should do under separate dir but under API dir or api/openstack/compute | |
| 17:50:53 | johnthetubaguy | oh... in some ways that is worse | |
| 17:51:06 | gmann | inside API test files it is very hidden honestly. | |
| 17:51:15 | johnthetubaguy | lets stick with what you have already, assuming stephenfin is OK with it after we tell him why | |
| 17:51:39 | gmann | in doc we can say 'any API change or policy, review can check the tests under this folder' | |
| 17:51:47 | gmann | ok | |
| 17:52:36 | johnthetubaguy | I think either we consider it testing the policy file or the api file, its basically testing both | |
| 17:53:04 | johnthetubaguy | hence I am OK with either next to all the API unit tests (like the old broken tests we delete) or in the new place you chose | |
| 17:53:50 | johnthetubaguy | its easy enough to move if we decide we made the wrong call | |
| 17:54:03 | johnthetubaguy | cool, I should run, was good to catch up | |
| 17:54:07 | gmann | ok. let's see what stephenfin say. | |
| 17:54:11 | johnthetubaguy | +1 | |
| 17:54:13 | gmann | sure, thanks | |
| 18:49:15 | openstackgerrit | Merged openstack/nova stable/train: Block rebuild when NUMA topology changed https://review.opendev.org/698530 | |
| 19:58:50 | openstackgerrit | Merged openstack/nova stable/stein: Cache security group driver https://review.opendev.org/697480 | |
| 20:10:06 | openstackgerrit | Merged openstack/nova stable/stein: Improve metadata server performance with large security groups https://review.opendev.org/695925 | |
| 21:18:09 | openstackgerrit | Merged openstack/nova master: FakeDriver: adding and removing instances on live migration. https://review.opendev.org/243613 | |
| 21:24:00 | mriedem | stephenfin: some easy things to cleanup in the xvpvncproxy removal change https://review.opendev.org/#/c/687909/ - i'm sure i'll probably be poking around in gerrit next week to avoid my in-laws so if you get that updated i'm +2 | |
| 21:48:15 | openstackgerrit | Merged openstack/nova master: Add new default roles in os-services API policies https://review.opendev.org/648480 | |
| 21:55:50 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: Function to further validate and retrieve configs https://review.opendev.org/676029 | |
| 21:55:50 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: YAML file loading and schema validation https://review.opendev.org/673341 | |
| 21:55:51 | openstackgerrit | Dustin Cowles proposed openstack/nova master: WIP: Provider Config File: Enable loading and merging of provider configs https://review.opendev.org/693460 | |
| 21:55:51 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: Functions to merge provider configs to provider tree https://review.opendev.org/676522 | |
| 22:38:03 | mriedem | gmann: nova.tests.unit.test_policy.RealRolePolicyTestCase.test_all_rules_in_sample_file is dumping a lot to the console log | |
| 22:38:35 | mriedem | https://zuul.opendev.org/t/openstack/build/3a837b550b2344aca69eaf747dc5a0c2/log/job-output.txt#20581 | |
| #openstack-nova - 2019-12-21 | |||
| 05:47:31 | openstackgerrit | Merged openstack/nova master: Confirm cross-cell resize while deleting a server https://review.opendev.org/638268 | |
| 06:24:25 | openstackgerrit | Merged openstack/nova stable/rocky: Zuul v3: use devstack-plugin-nfs-tempest-full https://review.opendev.org/700121 | |
| 21:33:42 | openstackgerrit | Merged openstack/nova master: Add archive_deleted_rows wrinkle to cross-cell functional test https://review.opendev.org/651650 | |
| #openstack-nova - 2019-12-22 | |||
| 21:26:29 | openstackgerrit | Merged openstack/nova master: Add CrossCellWeigher https://review.opendev.org/614353 | |
| 23:17:46 | openstackgerrit | Luigi Toscano proposed openstack/nova stable/queens: Remove exp legacy-tempest-dsvm-full-devstack-plugin-nfs https://review.opendev.org/700359 | |
| 23:38:28 | openstackgerrit | Merged openstack/nova master: Add test_resize_cross_cell_weigher_filtered_to_target_cell_by_spec https://review.opendev.org/695336 | |
| #openstack-nova - 2019-12-23 | |||
| 02:27:16 | openstackgerrit | Chason Chan proposed openstack/nova master: [api-ref] Fix the incorrect link https://review.opendev.org/700362 | |
| 05:45:18 | openstackgerrit | Merged openstack/nova master: Add functional test for anti-affinity cross-cell migration https://review.opendev.org/661859 | |
| 07:28:12 | openstackgerrit | chenker proposed openstack/nova master: Add Cyborg device profile groups to request spec. https://review.opendev.org/631243 | |
| 09:24:40 | ruffian_sheep | Hi,does anyone know how can i change the api version of the compute? | |
| 09:26:04 | ruffian_sheep | I want to test the multiattach in the tempest.But It always show me that Multiattach volumes are only supported starting with compute API version 2.60.I dont know how to change it ,can anyone help me? | |
| 09:59:19 | openstackgerrit | Merged openstack/nova master: Support cross-cell moves in external_instance_event https://review.opendev.org/658478 | |
| 11:32:13 | openstackgerrit | chenker proposed openstack/nova master: Add Cyborg device profile groups to request spec. https://review.opendev.org/631243 | |
| 11:54:16 | openstackgerrit | Qiu Fossen proposed openstack/nova-specs master: specify mac for creating instance https://review.opendev.org/700429 | |
| 12:07:45 | brinzhang_ | ruffian_sheep: you can specify "X-OpenStack-Nova-API-Version: <version>" to set the nova api to microversion 2.60. | |
| 12:08:06 | brinzhang_ | ruffian_sheep: https://docs.openstack.org/nova/latest/reference/api-microversion-history.html#id1 | |
| 12:53:37 | openstackgerrit | Merged openstack/nova master: Add test coverage of existing admin_actions policies https://review.opendev.org/657698 | |
| 14:21:31 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Remove 'nova-xvpvncproxy' https://review.opendev.org/687909 | |