Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2020-01-30
22:55:15 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing attach_interfaces policies https://review.opendev.org/705126
23:14:11 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing attach_interfaces policies https://review.opendev.org/705126
23:40:03 melwitt gmann: question on https://review.opendev.org/701629
23:45:13 gmann melwitt: replied. I am removing user_id from policy target in https://review.opendev.org/#/c/701642/
23:45:49 gmann melwitt: but if we keep this operation restriction at user level then we can keep.
23:46:32 gmann we do not pass user_id for most of the(i think all except user level API like keypair etc) API. it is all enforced at project level
23:46:36 melwitt gmann: ok. I'm thinking from the perspective of us having to keep the legacy policy behavior for some time or some transition period. is my understanding correct?
23:47:22 melwitt because from the look of the old tests, we support letting operators restrict password change to only the user set on the instance
23:48:36 gmann melwitt: yeah, that is good point. We can keep supporting it same way till we completely migrate to new
23:49:06 melwitt I'm happy to be wrong but I thought we were keeping current support as-is for now and if we want to change it, need some signal about deprecation and a transition period before dropping
23:50:17 melwitt I was reading this part of the spec again https://specs.openstack.org/openstack/nova-specs/specs/ussuri/approved/policy-defaults-refresh.html#backward-compatibility-and-migration-plan
23:52:40 gmann yeah. by removing the user_id from target we can break some deployment.
23:52:46 melwitt "Remove any project or user checks from the policy file defaults, as this is now done in code, without breaking user-id-based-policy-enforcement"
23:53:01 melwitt I'm wondering if we removed any in the already merged patches
23:54:30 gmann no, this is first one where user_id is passed and i updated to remove that. in "pass actual target" patches I pass the actual target wherever needed. like owner rule where project_id is needed.
23:55:22 melwitt ok
23:55:48 gmann "pass actual target" patches can tell us if any where we are changing user-level enforcement
23:56:04 melwitt ok, that is good to know
23:57:00 melwitt not directly related to this, I do wonder if operators would be disappointed to lose user-level enforcement in the future on something like a admin password. but that's a separate issue
23:58:15 gmann yeah, i think we need to change that with separate discussion if everyone ok. else keep it as it is.
23:58:15 melwitt I see now in the pass actual target, thanks for the tip https://review.opendev.org/#/c/701642/1/nova/api/openstack/compute/admin_password.py
23:59:25 gmann melwitt: i found one bug in attach_interface policy which is admin_or_owner but it pass for every context because project_id is not passed in policy target
23:59:29 melwitt yeah, agreed. I can't predict what operators would want to see there, would be a good question for the forum and if no one cares about user-level enforcement, we remove it after the transition period
#openstack-nova - 2020-01-31
00:00:20 melwitt gmann: bug in the legacy policy or bug in the more recently policy patches merged?
00:00:20 gmann because our policy doc say it is admin_or_owner but code is buggy so I am thinking whether we can fix this as bug or leave this operation open for everyone
00:00:27 gmann legacy
00:00:58 gmann this one - https://review.opendev.org/#/c/705126/4
00:00:58 melwitt sigh ... I'm not surprised, there's a lot of bugs/quirks there.
00:01:26 gmann i added the test with admin_or_owner context to pass and other proejct to fail. but those tests fail as you can see in gate.
00:01:38 melwitt I guess my instinct would be to fix the bug first and then stack the new stuff on top, but that might be just me
00:02:24 gmann yeah that is what i was thinking. so that we can see the bug and fix first and then start the new policy defaults
00:02:25 melwitt I see. well, that's a good sign for the new test coverage I guess :)
00:02:32 gmann yeah
00:02:36 melwitt it's catching bugs
00:02:55 gmann i will file bug and put fix as separate change.
00:03:09 melwitt sounds great ++
00:03:26 melwitt add me as reviewer when you have it ready
00:03:33 gmann sure, thanks
00:22:33 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Fix os-attach-interfaces policy to be admin_or_owner https://review.opendev.org/705135
02:12:21 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Fix os-attach-interfaces policy to be admin_or_owner https://review.opendev.org/705135
02:31:00 gmann melwitt: ^^
02:34:41 openstackgerrit Merged openstack/nova stable/stein: Block rebuild when NUMA topology changed https://review.opendev.org/702972
02:51:52 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Remove old policy enforcement in attach_interfaces https://review.opendev.org/705127
04:26:53 melwitt gmann: ack thanks, will look tomorrow
09:46:39 gibi dansmith: I've investigated the obj_what_changed() way to detect if the pci requests need s refres during live migraton rollback but this idea fails for mutliple reasons. See my answer in https://review.opendev.org/#/c/702261/4/nova/compute/manager.py@8563
10:17:29 jawad_axd Hi all. M writing once again here. Question is, iperf3 shows 9.89 Gbits/sec between hosts while instances on same network on these two hosts have iperf3 108 MBytes/sec from inside. How come bandwidth is so poor inside instances? I am using centos7.7, stein, linux bridge,vxlan setup. Any suggestions?
10:27:26 gibi jawad_axd: when you measure performance between the two hosts does the packets are going throigh the same linux bridge as the guests uses in the other measurement between guests?
10:32:50 jawad_axd Nope. Performance between physical hosts is using another bridge at physical NIC. Its just for reference point for guest performance. While guests using bridges created by neutron.
10:34:41 gibi jawad_axd: what I would do is to add layers from the guest-guest test to the host-host test one by one to see which layer causes the degradation
10:36:13 stephenfin bauzas: Could you take a look at these today? https://review.opendev.org/#/q/status:open+project:openstack/nova+branch:master+topic:bp/remove-nova-network-ussuri
10:36:20 bauzas sure
10:36:31 bauzas I need to go to the gym but I can do it later
10:36:36 stephenfin ta
10:42:07 gibi bauzas: I'm +2 again on the placmenet audit patch https://review.opendev.org/#/c/670112/
10:42:16 bauzas cool thanks !
10:44:13 gibi stephenfin: I'm +2 on https://review.opendev.org/#/c/662522/16 but it need another rebase
12:58:14 openstackgerrit Lee Yarwood proposed openstack/nova master: virt: Provide block_device_info during rescue https://review.opendev.org/700811
12:58:15 openstackgerrit Lee Yarwood proposed openstack/nova master: compute: Report COMPUTE_RESCUE_BFV and check during rescue https://review.opendev.org/701429
12:58:15 openstackgerrit Lee Yarwood proposed openstack/nova master: libvirt: Add support for stable device rescue https://review.opendev.org/700812
12:58:16 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP libvirt: Support boot from volume instance rescue https://review.opendev.org/701431
12:58:16 openstackgerrit Lee Yarwood proposed openstack/nova master: api: Introduce microverion 2.82 allowing boot from volume rescue https://review.opendev.org/701430
12:58:17 openstackgerrit Lee Yarwood proposed openstack/nova master: compute: Extract _get_bdm_image_metadata into nova.utils https://review.opendev.org/705212
14:17:02 openstackgerrit Balazs Gibizer proposed openstack/nova master: Reduce gen conflict in COMPUTE_STATUS_DISABLED handling https://review.opendev.org/704866
14:17:04 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Deprecate base rules in favor of new rules https://review.opendev.org/701624
14:22:22 openstackgerrit Balazs Gibizer proposed openstack/nova master: Reduce gen conflict in COMPUTE_STATUS_DISABLED handling https://review.opendev.org/704866
14:23:12 gmann cmurphy: updated the deprecation warning text. also replied on admin acrtion policy patch.
15:05:08 dansmith gibi: I replied just now
15:05:38 dansmith gibi: I think my original concerns are all still in place and "it's not as easy to check because of other bugs" doesn't really change my feeling on what is right
15:06:41 dansmith I shan't block on it, but I'm not loving it, nor really sure what the right thing to do is (other than fix those other things)
15:07:51 dansmith also, a decorator causing an instance lazy load is pretty gross :/
15:11:17 dansmith and I'm not sure why flavor is being marked as dirty, because it seems like it shouldn't be from what I'm seeing... hmm..
15:16:12 openstackgerrit Merged openstack/nova stable/stein: Disable NUMATopologyFilter on rebuild https://review.opendev.org/702973
15:29:09 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing admin_password policies https://review.opendev.org/701629
15:31:59 gmann melwitt: ^^ updated the admin password for user level enforcement tests.
15:32:21 melwitt gmann: cool thanks
15:33:51 gmann and i abandon this which were removing the user_id from policy target. test in 70629 should keep working for user enforcement through out the policy changes - https://review.opendev.org/#/c/701642/1
15:34:27 melwitt k makes sense
15:43:28 openstackgerrit Merged openstack/nova stable/stein: FUP for in-place numa rebuild https://review.opendev.org/702974
15:46:13 openstackgerrit Stephen Finucane proposed openstack/nova master: Recalculate 'RequestSpec.numa_topology' on resize https://review.opendev.org/662522
15:46:23 melwitt gmann: reviewing https://review.opendev.org/705135 I'm wondering if we should add a policy test for "fails with other project" (the testing that was originally missing the bug)
15:48:05 gmann melwitt: I am adding those in this where tests failing now and with this fix it should pass - https://review.opendev.org/#/c/705126/
15:48:24 gmann i need to rebase that on top of fix to show the test passing. is that fine ?
15:48:37 melwitt yeah, was just about to ask that
15:49:00 gmann ok
15:49:41 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Fix os-attach-interfaces policy to be admin_or_owner https://review.opendev.org/705135
15:49:52 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Remove old policy enforcement in attach_interfaces https://review.opendev.org/705127
15:50:08 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing attach_interfaces policies https://review.opendev.org/705126
15:50:17 gmann done.
15:50:40 melwitt thanks!
15:52:18 efried sean-k-mooney: if you're about, would you please confirm that https://review.opendev.org/#/c/702981/ is correct, and I'll send it
15:52:56 sean-k-mooney ill take a look now
15:56:28 sean-k-mooney efried: so an exception will be raised if the pagesize is not supported. so if we get to that line i think it means we dont have enough left of that size based on https://github.com/openstack/nova/blob/master/nova/virt/hardware.py#L660 im just reading futher
15:59:03 efried It's a debug log, so I'm not going to make a big deal out of it. I'll fast approve if it's correct. If it's an improvement, that'd be even better :)
15:59:28 cmurphy gmann: thanks, will review again today
15:59:40 gmann cmurphy: thanks
15:59:59 sean-k-mooney well it depens on how you interpert support. it cant suport the request. because its out of space. that is how that was intended to be interpreted
16:00:18 sean-k-mooney efried: im leaving a comment now but i think we can just change the message to
16:00:53 sean-k-mooney remove the or
16:01:40 sean-k-mooney e.g. "Host does not support requested memory pagesize as there are not enough free pages."
16:02:47 efried ack, thanks sean-k-mooney

Earlier   Later