| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-04-06 | |||
| 14:45:47 | sean-k-mooney | ya the migration of the instance embeded flavor would be a pain although we could do it if neded | |
| 14:46:21 | dansmith | johnthetubaguy: agree, it's not worth it at this point | |
| 14:46:23 | sean-k-mooney | johnthetubaguy: well part of stephens work is to imporve the docs | |
| 14:46:34 | johnthetubaguy | so my proposal earlier was to alias in the new microversion, so you add a prefix for all non-system ones, but its a pain | |
| 14:46:54 | dansmith | so, crazy idea | |
| 14:47:45 | dansmith | what if we add a new namespace prefix that itself implies that the spec is validated.. something like system:numa_nodes, which would require validation, but otherwise be the same as numa_nodes, at least for the foreseeable future? | |
| 14:48:20 | sean-k-mooney | dansmith: i would prefer to define custom: | |
| 14:48:21 | dansmith | that would give us something we could eventually warn people about, deprecate the non-system numa_nodes in the future and then eventually land on anything not in system: becomes the "wild west of custom stuff" | |
| 14:48:23 | sean-k-mooney | to opt out | |
| 14:48:26 | sean-k-mooney | rather then opt in | |
| 14:48:40 | bauzas | sorry, need to drop, urgent kitchen issue | |
| 14:48:40 | sean-k-mooney | and just validate all other namespaced extra specs | |
| 14:48:45 | dansmith | sean-k-mooney: well, the problem is right now the entire non-namespaced space is custom | |
| 14:48:46 | bauzas | (kids at home, lovely) | |
| 14:49:00 | sean-k-mooney | dansmith: actully not quite | |
| 14:49:06 | sean-k-mooney | we messed up one key | |
| 14:49:09 | sean-k-mooney | but more or less | |
| 14:49:27 | dansmith | sean-k-mooney: like bauzas says, I think that throwing the switch to opt-out right now is not great | |
| 14:49:27 | frickler | I'm seeing nova-api lockup when running under apache2 mod-wsgi-py3 on stein with >1 thread enabled, is this a known issue? traceback looks like this and the server stops responding after answering some few requests correctly http://paste.openstack.org/show/PhzU6ZXQnkfrDjyAAAoe/ | |
| 14:49:59 | sean-k-mooney | ya whcih is why the valdiation parma was added | |
| 14:50:04 | sean-k-mooney | or old micorverions | |
| 14:50:10 | dansmith | right, | |
| 14:50:26 | dansmith | but as johnthetubaguy has said, it's hard for people to know what is being checked or not | |
| 14:50:47 | sean-k-mooney | yes that is true | |
| 14:51:03 | johnthetubaguy | a list of validated namespaces is a nice way forward | |
| 14:51:04 | sean-k-mooney | we also will have different behavior between osc and nova client | |
| 14:51:18 | johnthetubaguy | ideally the ones we already use would all fit into that list | |
| 14:51:27 | sean-k-mooney | johnthetubaguy: currently that would be everyting nova knows about in tree | |
| 14:51:29 | stephenfin | I can do permissive for now, then add an API to list all recognized extra specs in a future version with a new microversion. At that point, we could also switch to strict | |
| 14:51:43 | stephenfin | Would that do the trick? | |
| 14:51:47 | johnthetubaguy | the others are just not validated... we land at permissive for everything | |
| 14:51:53 | dansmith | sean-k-mooney: actually, it'd be everything we know how to validate | |
| 14:52:11 | johnthetubaguy | stephenfin: what dansmith is suggesting is a bit nicer, and the reverse of my CUSTOM namespace proposal | |
| 14:52:18 | sean-k-mooney | dansmith: stephenfin added validation for everyting i think | |
| 14:52:35 | sean-k-mooney | dansmith: but yes you are technically correct | |
| 14:52:50 | johnthetubaguy | basically be strict for all the in tree namesapces we use today, permissive for everything else | |
| 14:52:51 | stephenfin | johnthetubaguy: right, but who's going to do that work? | |
| 14:53:10 | sean-k-mooney | i had envisioned that after this if you adde an extra specs you would add a validator or extend the existing ones | |
| 14:53:28 | dansmith | sean-k-mooney: it would be easier to enforce that in code with a namespace | |
| 14:54:21 | sean-k-mooney | yes i just dont want operator to have to updated there exiting instance | |
| 14:54:37 | dansmith | well, they won't for the time being | |
| 14:55:00 | dansmith | we still honor the non-namespaced version, unvalidated for the foreseeable future | |
| 14:55:02 | stephenfin | johnthetubaguy: ah, wait, you mean be strict for e.g. 'hw:' namespaced extra specs, but not 'foo:' ? | |
| 14:55:07 | johnthetubaguy | so possible way forward, maybe... we drop the strict and disabled mode, we merge with permissive as the default, but we redefine the API as what dansmith said (i.e. only a microversion to add a new supported namesapce) | |
| 14:55:10 | sean-k-mooney | the other downside to a new name spaces if if we only have one the we have to put everyhtin into it | |
| 14:55:11 | johnthetubaguy | stephenfin: yeah | |
| 14:55:49 | dansmith | johnthetubaguy: what does permissive mean? just log errors? | |
| 14:55:49 | johnthetubaguy | while its not what your code currently does... its actually an API definition / docs change. | |
| 14:55:57 | sean-k-mooney | dansmith: yep | |
| 14:56:02 | stephenfin | nope | |
| 14:56:04 | johnthetubaguy | dansmith: it means only validate known keys, | |
| 14:56:05 | dansmith | sean-k-mooney: I was expecting we'd namespace everything, so things would become system:hw:thing | |
| 14:56:20 | stephenfin | permissive means 'hw:numa_nodes=asdassdf' is rejected, but 'sdfsdfsd:sdfsdf' isn't | |
| 14:56:21 | sean-k-mooney | stephenfin: it logs unknone keys | |
| 14:56:31 | sean-k-mooney | or did you not do that in the end | |
| 14:56:33 | stephenfin | and rejects them with a 4xx error | |
| 14:56:40 | stephenfin | oh,sorry | |
| 14:56:43 | dansmith | that's not permissive | |
| 14:56:43 | johnthetubaguy | I didn't see a log in the code, thankfully | |
| 14:56:45 | stephenfin | logs the unknown keys, yes | |
| 14:56:49 | stephenfin | or does it | |
| 14:57:01 | stephenfin | I'm not sure if I bothered included a log | |
| 14:57:04 | stephenfin | *including | |
| 14:57:10 | bauzas | you didn't | |
| 14:57:15 | stephenfin | ETOOMUCHNOISE | |
| 14:57:19 | sean-k-mooney | dansmith: strict rejects unkown keys with an error | |
| 14:57:34 | sean-k-mooney | permisive allows them and validates the values of keys it know about | |
| 14:57:40 | bauzas | honestly, that's why I want to move on | |
| 14:57:42 | dansmith | sean-k-mooney: unknown keys in namespaces like hw: I assume? | |
| 14:57:42 | sean-k-mooney | and disabled is a noop | |
| 14:57:51 | bauzas | we need to enable something and then discuss on a separate change | |
| 14:57:58 | stephenfin | any unknown keys | |
| 14:58:07 | stephenfin | e.g. hw:cpu_policyyy | |
| 14:58:13 | stephenfin | which is why I wanted strict | |
| 14:58:30 | dansmith | but people can use their own custom keys for scheduler behavior yeah? so we can't reject *everything* | |
| 14:58:35 | bauzas | stephenfin: it can still be a recommended choice | |
| 14:58:37 | johnthetubaguy | yeah, I think if we are strict for all known namespaces, it would be much better | |
| 14:58:43 | bauzas | stephenfin: but this would only be a doc thing | |
| 14:59:00 | bauzas | johnthetubaguy: we had this discussion 3 years ago | |
| 14:59:19 | johnthetubaguy | bauzas: we probably did, I might have been wrong then too | |
| 14:59:20 | stephenfin | dansmith: yes, and I've documented how they can add their own validators for whatever extra specs they want | |
| 14:59:27 | bauzas | johnthetubaguy: and we said we had to be accepting *any* key because we can't assume whether it's a typo or a custom key | |
| 14:59:28 | dansmith | wait, | |
| 14:59:32 | stephenfin | assuming they don't want to simply opt of validation | |
| 14:59:35 | sean-k-mooney | dansmith: right hence the idea of having "custom:" namespace where you can add stuff we woudl never validate | |
| 14:59:38 | dansmith | so in strict mode they have to write code in order to be able to use things like the json filter? | |
| 15:00:04 | bauzas | the 'custom:' namespace is good but this requires some proper signaling (and at least one cycle of deprecation) | |
| 15:00:15 | sean-k-mooney | dansmith: json filter uses shcduler hint | |
| 15:00:28 | bauzas | ie. we say "okay, look, custom filters will continue to work without any change in U and V" | |
| 15:00:41 | dansmith | there's some filter we can hit custom fields on the flavor isn't there? | |
| 15:00:53 | bauzas | "but starting from W, you will need to change your flavors to use a custom: prefix" | |
| 15:01:09 | sean-k-mooney | dansmith: yes compute capablity filter and the aggartioninstnaceType filter | |
| 15:01:14 | stephenfin | yes, 'CapabilitiesFilter' and 'AggregateInstanceExtraSpecsFilter' filters | |
| 15:01:17 | sean-k-mooney | dansmith: both are supproted | |
| 15:01:22 | stephenfin | and I've enumerated the known values for both | |
| 15:01:23 | sean-k-mooney | it jsut allows any key | |
| 15:01:31 | sean-k-mooney | if you use there namespaces | |
| 15:01:34 | stephenfin | *known keys | |
| 15:01:50 | stephenfin | the values are basically wildcards because of how flexible thoseare | |
| 15:01:51 | openstackgerrit | Lee Yarwood proposed openstack/nova master: workarounds: Add option to disable native LUKSv1 decryption by QEMU https://review.opendev.org/708030 | |