| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-06-02 | |||
| 16:02:50 | josephillips | the uuid of the vm doens't exist on nova | |
| 16:06:10 | openstackgerrit | Merged openstack/nova master: Remove unused object_compat decorator https://review.opendev.org/729924 | |
| 16:06:16 | openstackgerrit | Merged openstack/nova master: Remove inject_file from compute manager and virt driver https://review.opendev.org/729934 | |
| 16:07:34 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Use compression by default for 'SshDriver' https://review.opendev.org/684393 | |
| 18:31:48 | openstackgerrit | Hervé Beraud proposed openstack/nova-specs master: Stop to use the __future__ module. https://review.opendev.org/732879 | |
| 18:31:48 | openstackgerrit | Hervé Beraud proposed openstack/nova-specs master: Stop to use the __future__ module. https://review.opendev.org/732879 | |
| 19:50:35 | rouk | sean-k-mooney: been tracing the bug, when i run a compile of the _block_device_mapping_get_query query, i get a query which returns 3 results | |
| 19:50:51 | rouk | but then when i .all() the query, as the code does, it returns... 0 result? | |
| #openstack-nova - 2020-06-03 | |||
| 00:05:13 | rouk | looks like my issue is with kolla mixing up cell0? not sure. | |
| 01:52:50 | openstackgerrit | hulina proposed openstack/nova master: Nova raise exceptions when extending volume fails https://review.opendev.org/680648 | |
| 01:53:54 | openstackgerrit | hulina proposed openstack/nova master: Nova raise exceptions when extending volume fails https://review.opendev.org/680648 | |
| 03:01:11 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.PY2 and six.PY3 https://review.opendev.org/726512 | |
| 03:01:19 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.add_metaclass https://review.opendev.org/726565 | |
| 03:01:29 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.reraise https://review.opendev.org/726898 | |
| 03:09:38 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.moves https://review.opendev.org/727224 | |
| 03:10:24 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.iteritems/itervalues/iterkeys https://review.opendev.org/727757 | |
| 03:10:31 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.byte2int/int2byte https://review.opendev.org/727777 | |
| 03:10:39 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.binary_type/integer_types/string_types https://review.opendev.org/728094 | |
| 03:10:50 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.text_type (1/2) https://review.opendev.org/728109 | |
| 03:11:04 | openstackgerrit | Takashi Natsume proposed openstack/nova master: Remove six.text_type (2/2) https://review.opendev.org/728117 | |
| 06:09:53 | bauzas | good morning Nova | |
| 06:26:05 | alex_xu | gibi: I and luyao huaqiang test the https://meetpad.opendev.org/oslo-victoria-ptg, it doesn't seems work for us, it is no audio. can we switch to zoom for nova ptg? | |
| 08:50:14 | ikla | can I attached an SR-IOV port to an existing instance? | |
| 08:50:19 | ikla | attach* | |
| 08:51:04 | ikla | AttachSRIOVPortNotSupported_Remote | |
| 08:54:00 | stephenfin | ikla: no, that is not supported currently | |
| 08:59:45 | frickler | lyarwood: not sure if you have seen it, devstack on focal is working fine now with these tests blacklisted https://review.opendev.org/#/c/704831/14/.zuul.yaml | |
| 09:00:58 | frickler | lyarwood: incidentally, one of them is also blacklisted on bionic for devstack-ceph-plugin. I'm going to build a ceph-focal job to verify the others, those did work fine in my local setup | |
| 09:01:20 | openstack | Launchpad bug 1876330 in devstack-plugin-ceph "Rescue BFV instances not working with ceph backend, Tempest new test failing" [Undecided,New] - Assigned to Lee Yarwood (lyarwood) | |
| 09:01:20 | frickler | c.f. https://bugs.launchpad.net/devstack-plugin-ceph/+bug/1876330 | |
| 09:06:33 | stephenfin | frickler: lyarwood is on PTO for the next month (new baby) | |
| 09:06:53 | stephenfin | just FYI | |
| 09:10:31 | frickler | stephenfin: yeah, I saw that warning, thx. anyone else wanting to debug failing volume detachments on focal? this might be a blocker for migrating the default jobs unless we accept to permanently blacklist those tests | |
| 09:16:57 | gibi | alex_xu: hi! did you tried zoom? does it work for you? | |
| 09:41:57 | alex_xu | gibi: yes, zoom works for us | |
| 09:42:54 | gibi | alex_xu: OK. I will change the etherpads and drop a mail to ML that we switch. I hope zoom works for everyone | |
| 09:43:07 | alex_xu | gibi: thanks! | |
| 10:03:17 | gibi | alex_xu: Done | |
| 10:05:49 | gibi | alex_xu: liuyulong seemed to participate on the neutron sessions yesterday and I guess he is from PRC too | |
| 10:06:23 | gibi | so if you need to join to other jitsi rooms during the week he might help | |
| 10:15:03 | stephenfin | gmann: Dumb question, but what's the expected behaviour when someone adds e.g. a reader role to a user on a Train-based deployment (i.e. before the policy default refresh) | |
| 10:16:19 | stephenfin | gmann: I would assume it'll be completely ignored and only things like "is this user an admin or owner" would be considered? | |
| 10:23:36 | bauzas | gibi: alex_xu: sorry, just saw your discussions, you want to move from meetpad to zoom ? | |
| 10:24:17 | bauzas | it's a bit unfortunate :( | |
| 10:24:25 | bauzas | but okay | |
| 10:31:02 | sean-k-mooney | alex_xu: have you tried useing meetpad wtih chrome by the way | |
| 10:31:24 | sean-k-mooney | it is not too hapy with firefox but chrome works fine for me | |
| 10:31:54 | sean-k-mooney | i have used both an while i kind of prefer meetpad i think both work resonably well | |
| 10:35:18 | gibi | bauzas: yeah, the tool is secondary for me the primary goal is to allow everyone to join | |
| 10:40:13 | luyao | sean-k-mooney: I used chrome but didn't work for me. :( | |
| 12:31:34 | johnthetubaguy | stephenfin: if you add a reader role, they will have access to start instances | |
| 12:32:12 | stephenfin | It also seems they also have access to delete other users instances | |
| 12:32:22 | johnthetubaguy | correct | |
| 12:32:30 | johnthetubaguy | they have full access, as any user would | |
| 12:32:35 | johnthetubaguy | that is the point of the work, to fix that problem | |
| 12:32:49 | johnthetubaguy | but you have to opt into the new behviour | |
| 12:33:28 | johnthetubaguy | admin_or_owner meant, admin or anyone with any role in a project | |
| 12:33:41 | stephenfin | I was about to ask | |
| 12:33:55 | stephenfin | admin_or_owner suggested admin or owner of resource (i.e. user that created server) | |
| 12:34:13 | stephenfin | but that's not the case, fun :) | |
| 12:34:19 | johnthetubaguy | yeah, that is why I was so keen to get this done, the policy checks are basically non-sense by default | |
| 12:34:26 | johnthetubaguy | to be clear, owner is the project | |
| 12:34:30 | johnthetubaguy | the user only owns keypairs | |
| 12:34:40 | johnthetubaguy | we have not changed that at all | |
| 12:35:18 | johnthetubaguy | (there is a way to break your API and make the user sort of own things, but it was a compromise while we don't have hierarchical quotas) | |
| 12:35:26 | stephenfin | Okay, I don't know how I never got that nuance reading the specs | |
| 12:35:48 | johnthetubaguy | that is more the history of the API, project owns things, not users | |
| 12:36:02 | johnthetubaguy | (expect keypairs) | |
| 12:36:15 | stephenfin | so for everything != keypairs, admin_or_owner is really admin_or_project_member? | |
| 12:36:27 | johnthetubaguy | if it worked properly, yes | |
| 12:36:43 | johnthetubaguy | right now its admin_or_anyone_in_the_project | |
| 12:37:01 | johnthetubaguy | hopefully by V or W we can make it admin_or_project_memeber | |
| 12:37:08 | stephenfin | sorry, yeah, by project_member I was talking in general, not in terms of keystone roles | |
| 12:37:27 | stephenfin | admin_or_is_in_project | |
| 12:37:29 | johnthetubaguy | i.e. the role reader can delete any instance in a project, right now | |
| 12:37:35 | johnthetubaguy | ack | |
| 12:37:42 | stephenfin | okay, cool | |
| 12:37:52 | sean-k-mooney | johnthetubaguy: ya that is a bug | |
| 12:37:57 | stephenfin | johnthetubaguy++ thanks for the clarification. I'll try find somewhere to slot that into the docs | |
| 12:38:03 | sean-k-mooney | isnt there a patch to fix that | |
| 12:38:31 | johnthetubaguy | sean-k-mooney: which bit? the policy work last cycle was all to try and make this sane... eventually, after a transition period | |
| 12:38:48 | stephenfin | sean-k-mooney: We have proper role-based policy support integrated now, if that's what you mean | |
| 12:39:02 | sean-k-mooney | johnthetubaguy: there is a patch to make ti so that the reader role can not delete instances | |
| 12:39:04 | stephenfin | the work gmann and others did last cycle | |
| 12:39:52 | sean-k-mooney | i was looking at it last week i think it came up downstream and we were debaing if we caould backport it or not | |
| 12:40:09 | stephenfin | sean-k-mooney: we're talking about the same thing here, I suspect | |
| 12:40:21 | stephenfin | sean-k-mooney: read the scrollback | |
| 12:40:59 | stephenfin | tl;dr: the reader role is completely ignored until Ussuri and is then opt-in in Ussuri | |
| 12:41:09 | sean-k-mooney | yes | |
| 12:41:28 | stephenfin | all that matters is whether the user is an admin or a member of the project that the instance is part of | |
| 12:41:37 | sean-k-mooney | be consulting worte kcs articles of how to hack one in and our customer always mess it up | |
| 12:41:58 | sean-k-mooney | so it will be nice when we can jsut use the reader role in osp | |
| 12:42:07 | stephenfin | so a user that is a member of project foo will be able to delete any instance in project foo, even if they only have the reader role | |
| 12:42:21 | sean-k-mooney | stephenfin: well that is a bug | |
| 12:42:51 | sean-k-mooney | if a user is part of a project but only has the reader role they should not be able to delete the instnace | |
| 12:43:02 | sean-k-mooney | if the have teh member and reader role then the can | |
| 12:43:14 | sean-k-mooney | but if they only have the reader role they should not be able to do the delete | |
| 12:43:27 | sean-k-mooney | that was fixed by adding an new policy defintion | |
| 12:43:30 | sean-k-mooney | for server delete | |
| 12:44:10 | sean-k-mooney | this one i think https://github.com/openstack/nova/blob/master/nova/policies/servers.py#L319-L328 | |