Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2020-04-28
16:44:45 dansmith jsuchome: just grab the latest version of that patch into your tree, make changes, git review.
17:33:28 artom dansmith, answers provided: https://review.opendev.org/#/c/672595/73
17:33:34 artom (Hopefully)
17:33:43 gmann zigo: nice. +1 thanks for checking.
17:43:57 artom \o/
17:44:14 artom I have a 1:1 in 15 minutes, otherwise it'd be beer time
17:53:28 gmann zigo: and you generated with same tool right ?
17:54:21 zigo gmann: Yeah, just --format yaml. Now, I'll have to set policy.yaml as default in nova.conf
17:54:51 zigo Though as I wrote earlier, Debian @UBC is down, so can't do anything right now ... :(
17:55:12 zigo No Git to play with.
17:55:31 gmann +1
17:57:15 zigo Also, this clashes with puppet-openstack which uses .json.
17:57:26 zigo It's going to be fun time to fix too ...
18:08:11 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Clarify the policy new defaults upgrade notes https://review.opendev.org/723645
18:11:12 openstackgerrit Merged openstack/nova master: Remove Babel requirement https://review.opendev.org/720725
18:11:20 openstackgerrit Merged openstack/nova master: Remove translation sections from setup.cfg https://review.opendev.org/723206
18:57:05 openstackgerrit Artom Lifshitz proposed openstack/nova stable/queens: DNM: Partial cherry-pick of report client changes https://review.opendev.org/723750
18:57:06 openstackgerrit Artom Lifshitz proposed openstack/nova stable/queens: DNM: Add a placement audit command https://review.opendev.org/723751
20:31:32 melwitt gmann: I thought you wanted to wait for these first? https://review.opendev.org/#/q/topic:qa-ussuri-release+status:open
20:32:21 gmann melwitt: devstack and grenade setup mainly which are merged. devstack-gate changes is for legacy jobs which this patch replacing
20:32:33 melwitt oh ok
20:39:07 openstack Launchpad bug 1875418 in OpenStack Compute (nova) "Generated policy.json in Ussuri is broken by default" [High,In progress] - Assigned to Ghanshyam Mann (ghanshyammann)
20:39:07 sean-k-mooney am https://bugs.launchpad.net/nova/+bug/1875418 have we ever support a policy.yaml?
20:39:40 sean-k-mooney i tought we only supported policy files in json format
20:41:18 sean-k-mooney i ask because teh " [puppet][packaging] Switching to policy.yaml (over policy.json)" thread seams to imply that is a thing
20:41:36 sean-k-mooney but i did not think we supported a policy.yaml file instead of policy.json
20:42:47 sean-k-mooney huh i guess its a thing https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html
20:43:52 bnemec We've been recommending yaml since policy in code happened.
20:44:02 bnemec Apparently we need to work on our PR though. :-)
20:45:07 gmann yeah, and not much attention on that and this issue came up now
20:45:08 sean-k-mooney ya i mean yaml is probably nice to work with in terms of generating and reading the file and form a python point of view it makes little difference as we will jsut load it into a python dict in etierh case then process it
20:45:30 sean-k-mooney but i never heard that we added supprot for parseing yaml files instead
20:46:16 sean-k-mooney bnemec: it might be something that woudl be worth make a comuntiy goal
20:46:32 sean-k-mooney to get everyone to move to policy.yaml espeically the deployment tools
20:46:38 openstackgerrit Merged openstack/nova master: Functional tests for NUMA live migration https://review.opendev.org/672595
20:46:39 gmann it is supported in oslo side right
20:46:47 bnemec sean-k-mooney: It was: https://governance.openstack.org/tc/goals/selected/queens/policy-in-code.html
20:46:48 sean-k-mooney although i guest they should not be setting one by default
20:46:59 bnemec Oh, deployment tools.
20:47:01 sean-k-mooney bnemec: well plocy in code was
20:47:44 sean-k-mooney bnemec: i was more thinking of makeing sure our docs advise to use policy.yaml files
20:48:12 sean-k-mooney and any deployment tools that currently supprot customising policy.json use policy.yaml
20:48:13 bnemec They do: https://docs.openstack.org/oslo.policy/latest/admin/policy-json-file.html ;-)
20:48:23 bnemec But yeah, clearly we need to push it harder.
20:48:32 sean-k-mooney bnemec: do the nova docs?
20:49:13 gmann bnemec: and that happen when things get broken otherwise its less chance people read doc or be in sync on new things
20:49:25 bnemec That I don't know. The only in-project policy doc I'm aware of is the policy sphinx plugin.
20:49:33 sean-k-mooney https://docs.openstack.org/nova/rocky/configuration/policy.html i gues it just list the polices
20:49:55 sean-k-mooney and the sample kind of looks like yaml https://docs.openstack.org/nova/rocky/configuration/sample-policy.html
20:50:15 gmann sean-k-mooney: the file form mentioned is yaml one -https://docs.openstack.org/nova/latest/configuration/sample-policy.html
20:50:19 sean-k-mooney ok it is a yaml file
20:50:34 sean-k-mooney ya you can download it https://docs.openstack.org/nova/rocky/_downloads/nova.policy.yaml.sample
20:50:34 bnemec Yep, that's the yaml sample policy output.
20:50:59 sean-k-mooney ok im just used to people saying policy.json the whole time
20:52:03 sean-k-mooney we still refer to it as policy.json here https://docs.openstack.org/nova/rocky/configuration/
20:54:48 bnemec Yeah, and unfortunately policy.json is still the default name in oslo.policy. We've had discussions about making it look for both json and yaml, but it has security implications if we guess wrong.
20:55:48 sean-k-mooney so does it only look for one of them
20:56:11 gmann first it look for json and then yaml, if i am not wrong
20:56:23 sean-k-mooney ok so if you have both it will use the json file
20:56:50 sean-k-mooney or will it load the default form code then load the json then the yaml
20:57:14 sean-k-mooney both would be vaild but im not really sure which would be more suprising
20:57:46 sean-k-mooney i kind of would expect the second option with an error if there was a conflit between the json and yaml file
20:57:53 sean-k-mooney our just error if both were there
20:58:10 sean-k-mooney that will be less surprising i guess
20:58:41 sean-k-mooney having multiple souces of policy is a beacon for bugs
20:59:20 bnemec It only looks for policy.json. It will parse files in either format in the order gmann said.
20:59:40 bnemec So if you say policy_file=policy.something it will first attempt to parse it as json, and if that fails try again as yaml.
21:00:20 sean-k-mooney ok so to use https://docs.openstack.org/oslo.policy/latest/admin/policy-yaml-file.html you need to chagne the policy_file in the main config file to point to policy.yaml
21:00:27 gmann yeah and default are loaded only if the registered rule is not in file
21:00:28 bnemec Right
21:01:07 sean-k-mooney ok that is not obvious form the docs but i can see why you might have chosen that design
21:01:18 sean-k-mooney well good to know
21:01:19 gmann bnemec: i think we can change the default value to policy.yaml and start error if not present and no fallback to policy.json ?
21:01:28 gmann i mean in Victoria
21:01:29 bnemec Worth noting that it can be overridden by individual projects. I believe cinder has done that.
21:01:53 bnemec I don't know how much pain it caused their users when they switched, or if they were lucky enough to start out with it that way.
21:01:58 sean-k-mooney bnemec: right oslo.config support progomatic overrides
21:02:24 sean-k-mooney so we could do set_default in nova to point it to a different default for nova
21:02:28 bnemec gmann: But we can't error on a missing policy file because that's perfectly valid.
21:03:20 gmann bnemec: ah, that's right.
21:03:21 sean-k-mooney like this right https://docs.openstack.org/oslo.config/4.0.0/faq.html#why-are-configuration-options-not-part-of-a-library-s-api
21:03:31 bnemec sean-k-mooney: There's an api provided for it: https://github.com/openstack/oslo.policy/blob/master/oslo_policy/opts.py#L121
21:03:40 bnemec Generally speaking, consumers shouldn't mess with library opts directly.
21:03:56 sean-k-mooney yep i just linked to the docs for it
21:04:03 bnemec Yes, exactly.
21:04:09 bnemec async communication. :-)
21:04:14 sean-k-mooney and ya i agree because it make debuging it a pain for the lib maintainer
21:04:28 bnemec And it will break if we ever rename the opt, even with deprecation.
21:04:45 bnemec Because the in-code references don't have deprecation logic.
21:05:26 sean-k-mooney you could proably make that work bust defineing an atribute that was initalsed to the other one
21:05:35 sean-k-mooney but also good to know
21:05:54 sean-k-mooney im not sure we actully ever do this in nova
21:06:01 sean-k-mooney or in any other code i have looked at
21:09:50 sean-k-mooney hum actully we are for things in our own config.... im going to pretend i didnt see that and move on
22:08:14 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add nova-status upgrade check and reno for policy new defaults https://review.opendev.org/723645
22:20:21 openstackgerrit Merged openstack/nova master: zuul: Switch to the Zuulv3 grenade job https://review.opendev.org/704364
22:28:13 openstackgerrit sean mooney proposed openstack/nova master: silence amqp heartbeat warning https://review.opendev.org/724188
22:29:10 openstackgerrit Ghanshyam Mann proposed openstack/nova stable/ussuri: zuul: Switch to the Zuulv3 grenade job https://review.opendev.org/724189
22:30:03 gmann lyarwood: melwitt backported to ussuri ^^ to have single grenade job running in ussuri as grenade zuulv3 job merged in ussuri
22:31:27 sean-k-mooney melwitt: im not sure if https://review.opendev.org/#/c/724188/1/nova/config.py will work but assuming it does it would be good to get your input on if we should drop that log message as the patch currently does or just reduce the log level to debug

Earlier   Later