| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-04-28 | |||
| 16:31:03 | zigo | Yeah. | |
| 16:31:37 | dansmith | zigo: it was a large number of patches.. reverting it now would be .. huge. | |
| 16:32:31 | zigo | dansmith: I thought it'd be just a simple patch to the oslo-policy-sample-generator ... :P | |
| 16:32:36 | zigo | Maybe I'm being naive. | |
| 16:35:00 | dansmith | zigo: the change in question was on the nova side, not oslo.. we'd need new code on the oslo side to allow generating the policy file with the now-deprecated original defaults | |
| 16:37:01 | zigo | Now I see what you guys were talking about for the yaml thing: it's by default generated with everything commented out ... | |
| 16:37:11 | zigo | (I just tried...) | |
| 16:37:38 | zigo | That's probably nicer indeed, and probably good enough for operators, and also maybe more easy to have a policy.d | |
| 16:37:50 | zigo | Though the last time I tried, it wouldn't load ... :/ | |
| 16:41:16 | zigo | Looks like it works as one would expect... :) | |
| 16:41:45 | jsuchome | dansmith: ok, so it seems it's up to me, so if you could reopen and reassign it ... thanks | |
| 16:42:04 | dansmith | jsuchome: all you need to do is propose the changes yourself | |
| 16:43:00 | jsuchome | so should I just cherry pick to my branch? | |
| 16:44:21 | zigo | All this would be great if the Debian infrastructure wasn't completely down today ... :/ | |
| 16:44:45 | dansmith | jsuchome: just grab the latest version of that patch into your tree, make changes, git review. | |
| 17:33:28 | artom | dansmith, answers provided: https://review.opendev.org/#/c/672595/73 | |
| 17:33:34 | artom | (Hopefully) | |
| 17:33:43 | gmann | zigo: nice. +1 thanks for checking. | |
| 17:43:57 | artom | \o/ | |
| 17:44:14 | artom | I have a 1:1 in 15 minutes, otherwise it'd be beer time | |
| 17:53:28 | gmann | zigo: and you generated with same tool right ? | |
| 17:54:21 | zigo | gmann: Yeah, just --format yaml. Now, I'll have to set policy.yaml as default in nova.conf | |
| 17:54:51 | zigo | Though as I wrote earlier, Debian @UBC is down, so can't do anything right now ... :( | |
| 17:55:12 | zigo | No Git to play with. | |
| 17:55:31 | gmann | +1 | |
| 17:57:15 | zigo | Also, this clashes with puppet-openstack which uses .json. | |
| 17:57:26 | zigo | It's going to be fun time to fix too ... | |
| 18:08:11 | openstackgerrit | Ghanshyam Mann proposed openstack/nova master: Clarify the policy new defaults upgrade notes https://review.opendev.org/723645 | |
| 18:11:12 | openstackgerrit | Merged openstack/nova master: Remove Babel requirement https://review.opendev.org/720725 | |
| 18:11:20 | openstackgerrit | Merged openstack/nova master: Remove translation sections from setup.cfg https://review.opendev.org/723206 | |
| 18:57:05 | openstackgerrit | Artom Lifshitz proposed openstack/nova stable/queens: DNM: Partial cherry-pick of report client changes https://review.opendev.org/723750 | |
| 18:57:06 | openstackgerrit | Artom Lifshitz proposed openstack/nova stable/queens: DNM: Add a placement audit command https://review.opendev.org/723751 | |
| 20:31:32 | melwitt | gmann: I thought you wanted to wait for these first? https://review.opendev.org/#/q/topic:qa-ussuri-release+status:open | |
| 20:32:21 | gmann | melwitt: devstack and grenade setup mainly which are merged. devstack-gate changes is for legacy jobs which this patch replacing | |
| 20:32:33 | melwitt | oh ok | |
| 20:39:07 | openstack | Launchpad bug 1875418 in OpenStack Compute (nova) "Generated policy.json in Ussuri is broken by default" [High,In progress] - Assigned to Ghanshyam Mann (ghanshyammann) | |
| 20:39:07 | sean-k-mooney | am https://bugs.launchpad.net/nova/+bug/1875418 have we ever support a policy.yaml? | |
| 20:39:40 | sean-k-mooney | i tought we only supported policy files in json format | |
| 20:41:18 | sean-k-mooney | i ask because teh " [puppet][packaging] Switching to policy.yaml (over policy.json)" thread seams to imply that is a thing | |
| 20:41:36 | sean-k-mooney | but i did not think we supported a policy.yaml file instead of policy.json | |
| 20:42:47 | sean-k-mooney | huh i guess its a thing https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html | |
| 20:43:52 | bnemec | We've been recommending yaml since policy in code happened. | |
| 20:44:02 | bnemec | Apparently we need to work on our PR though. :-) | |
| 20:45:07 | gmann | yeah, and not much attention on that and this issue came up now | |
| 20:45:08 | sean-k-mooney | ya i mean yaml is probably nice to work with in terms of generating and reading the file and form a python point of view it makes little difference as we will jsut load it into a python dict in etierh case then process it | |
| 20:45:30 | sean-k-mooney | but i never heard that we added supprot for parseing yaml files instead | |
| 20:46:16 | sean-k-mooney | bnemec: it might be something that woudl be worth make a comuntiy goal | |
| 20:46:32 | sean-k-mooney | to get everyone to move to policy.yaml espeically the deployment tools | |
| 20:46:38 | openstackgerrit | Merged openstack/nova master: Functional tests for NUMA live migration https://review.opendev.org/672595 | |
| 20:46:39 | gmann | it is supported in oslo side right | |
| 20:46:47 | bnemec | sean-k-mooney: It was: https://governance.openstack.org/tc/goals/selected/queens/policy-in-code.html | |
| 20:46:48 | sean-k-mooney | although i guest they should not be setting one by default | |
| 20:46:59 | bnemec | Oh, deployment tools. | |
| 20:47:01 | sean-k-mooney | bnemec: well plocy in code was | |
| 20:47:44 | sean-k-mooney | bnemec: i was more thinking of makeing sure our docs advise to use policy.yaml files | |
| 20:48:12 | sean-k-mooney | and any deployment tools that currently supprot customising policy.json use policy.yaml | |
| 20:48:13 | bnemec | They do: https://docs.openstack.org/oslo.policy/latest/admin/policy-json-file.html ;-) | |
| 20:48:23 | bnemec | But yeah, clearly we need to push it harder. | |
| 20:48:32 | sean-k-mooney | bnemec: do the nova docs? | |
| 20:49:13 | gmann | bnemec: and that happen when things get broken otherwise its less chance people read doc or be in sync on new things | |
| 20:49:25 | bnemec | That I don't know. The only in-project policy doc I'm aware of is the policy sphinx plugin. | |
| 20:49:33 | sean-k-mooney | https://docs.openstack.org/nova/rocky/configuration/policy.html i gues it just list the polices | |
| 20:49:55 | sean-k-mooney | and the sample kind of looks like yaml https://docs.openstack.org/nova/rocky/configuration/sample-policy.html | |
| 20:50:15 | gmann | sean-k-mooney: the file form mentioned is yaml one -https://docs.openstack.org/nova/latest/configuration/sample-policy.html | |
| 20:50:19 | sean-k-mooney | ok it is a yaml file | |
| 20:50:34 | sean-k-mooney | ya you can download it https://docs.openstack.org/nova/rocky/_downloads/nova.policy.yaml.sample | |
| 20:50:34 | bnemec | Yep, that's the yaml sample policy output. | |
| 20:50:59 | sean-k-mooney | ok im just used to people saying policy.json the whole time | |
| 20:52:03 | sean-k-mooney | we still refer to it as policy.json here https://docs.openstack.org/nova/rocky/configuration/ | |
| 20:54:48 | bnemec | Yeah, and unfortunately policy.json is still the default name in oslo.policy. We've had discussions about making it look for both json and yaml, but it has security implications if we guess wrong. | |
| 20:55:48 | sean-k-mooney | so does it only look for one of them | |
| 20:56:11 | gmann | first it look for json and then yaml, if i am not wrong | |
| 20:56:23 | sean-k-mooney | ok so if you have both it will use the json file | |
| 20:56:50 | sean-k-mooney | or will it load the default form code then load the json then the yaml | |
| 20:57:14 | sean-k-mooney | both would be vaild but im not really sure which would be more suprising | |
| 20:57:46 | sean-k-mooney | i kind of would expect the second option with an error if there was a conflit between the json and yaml file | |
| 20:57:53 | sean-k-mooney | our just error if both were there | |
| 20:58:10 | sean-k-mooney | that will be less surprising i guess | |
| 20:58:41 | sean-k-mooney | having multiple souces of policy is a beacon for bugs | |
| 20:59:20 | bnemec | It only looks for policy.json. It will parse files in either format in the order gmann said. | |
| 20:59:40 | bnemec | So if you say policy_file=policy.something it will first attempt to parse it as json, and if that fails try again as yaml. | |
| 21:00:20 | sean-k-mooney | ok so to use https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html you need to chagne the policy_file in the main config file to point to policy.yaml | |
| 21:00:27 | gmann | yeah and default are loaded only if the registered rule is not in file | |
| 21:00:28 | bnemec | Right | |
| 21:01:07 | sean-k-mooney | ok that is not obvious form the docs but i can see why you might have chosen that design | |
| 21:01:18 | sean-k-mooney | well good to know | |
| 21:01:19 | gmann | bnemec: i think we can change the default value to policy.yaml and start error if not present and no fallback to policy.json ? | |
| 21:01:28 | gmann | i mean in Victoria | |
| 21:01:29 | bnemec | Worth noting that it can be overridden by individual projects. I believe cinder has done that. | |
| 21:01:53 | bnemec | I don't know how much pain it caused their users when they switched, or if they were lucky enough to start out with it that way. | |
| 21:01:58 | sean-k-mooney | bnemec: right oslo.config support progomatic overrides | |
| 21:02:24 | sean-k-mooney | so we could do set_default in nova to point it to a different default for nova | |
| 21:02:28 | bnemec | gmann: But we can't error on a missing policy file because that's perfectly valid. | |
| 21:03:20 | gmann | bnemec: ah, that's right. | |
| 21:03:21 | sean-k-mooney | like this right https://docs.openstack.org/oslo.config/4.0.0/faq.html#why-are-configuration-options-not-part-of-a-library-s-api | |
| 21:03:31 | bnemec | sean-k-mooney: There's an api provided for it: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/opts.py#L121 | |
| 21:03:40 | bnemec | Generally speaking, consumers shouldn't mess with library opts directly. | |
| 21:03:56 | sean-k-mooney | yep i just linked to the docs for it | |
| 21:04:03 | bnemec | Yes, exactly. | |
| 21:04:09 | bnemec | async communication. :-) | |