| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-08-26 | |||
| 11:57:17 | sean-k-mooney | gibi: you proably were reviewing stephens patch before | |
| 11:57:30 | bauzas | (and gosh, this spec is... terrible https://specs.openstack.org/openstack/nova-specs/specs/victoria/approved/add-emulated-virtual-tpm.html ) | |
| 11:57:35 | gibi | sean-k-mooney: could be | |
| 11:58:05 | sean-k-mooney | hehe its a good way to get extra review :P | |
| 11:58:26 | sean-k-mooney | put random patches into a seriese in the runway | |
| 11:58:31 | gibi | lol | |
| 11:58:43 | gibi | I make a mental note to do it more often | |
| 11:58:44 | gibi | :D | |
| 11:59:17 | sean-k-mooney | with the amount of patches in stephens seriese im not even sure he would notice one more when he is rebaseing them all | |
| 11:59:31 | gibi | :D | |
| 11:59:54 | gibi | btw, stephenfin: I've finished reading and commenting the vtpm series | |
| 12:00:12 | sean-k-mooney | it looks like they are all approved | |
| 12:00:33 | sean-k-mooney | at least for spwan | |
| 12:00:40 | sean-k-mooney | the move operation are still pending | |
| 12:01:00 | gibi | yeah, spawn seems pretty solid to me | |
| 12:01:43 | sean-k-mooney | this will make efried happy to see | |
| 12:03:00 | bauzas | I'm just reviewing the rest of the series | |
| 12:03:32 | bauzas | but honestly, mho is that we tried to be gentlemen with vtpm usage, by overcomplicating what we were providing as a feature :) | |
| 12:03:46 | bauzas | trying to have vtpm instances be pets is nice | |
| 12:04:16 | bauzas | but we're pulling swift and trying to do maths to get whether we can still migrate an emulated file device or not, which overcomplicates things | |
| 12:04:30 | bauzas | but this is what it is, the spec is approved | |
| 12:05:14 | sean-k-mooney | well we try to make it behave like a real server | |
| 12:05:53 | bauzas | this is cloud | |
| 12:06:04 | sean-k-mooney | yep | |
| 12:06:09 | bauzas | most of the operations are admin-managed | |
| 12:06:26 | sean-k-mooney | in a cloud that would be atypical | |
| 12:06:30 | bauzas | so in this case, trying to solve all the problems is nice, but this comes with a cost | |
| 12:06:51 | sean-k-mooney | well one of the proposal was no move operations | |
| 12:06:55 | bauzas | but the ship has sailed. | |
| 12:07:04 | sean-k-mooney | which was very non admin frendly | |
| 12:07:22 | bauzas | I'm okay with creating a fresh new tpm device with move operations | |
| 12:07:32 | bauzas | what I'm struggling with is trying to reuse the existing data | |
| 12:07:43 | bauzas | this should be app-managed | |
| 12:07:44 | sean-k-mooney | the check is pretty simple | |
| 12:07:56 | sean-k-mooney | if anything changes version or type then data is not perserved | |
| 12:08:08 | sean-k-mooney | if the version and type do not change we copy it | |
| 12:08:20 | stephenfin | bauzas: well, don't worry about swift. None of that is done | |
| 12:08:24 | sean-k-mooney | the special case is shelve | |
| 12:08:31 | stephenfin | Is we might never do it. For now, shelve is simply blocked | |
| 12:08:36 | sean-k-mooney | where we ahve to store it somewhere which is swift | |
| 12:09:07 | sean-k-mooney | bauzas: the alternitive was to stick it in glance as a second image | |
| 12:09:31 | sean-k-mooney | or not store it at all | |
| 12:11:28 | bauzas | sean-k-mooney: yup, I saw in the series | |
| 12:11:35 | bauzas | the shelve case is the most complicated | |
| 12:11:50 | bauzas | I also have concerns with rebuild | |
| 12:12:18 | bauzas | trying to reuse the existing backup file is nice, but as a user I'd expect a fresh vTPM device if I rebuild | |
| 12:12:21 | sean-k-mooney | rebuild preseves the data if the version/type of tpm does not change | |
| 12:12:39 | sean-k-mooney | bauzas: that fails the do what hardware does guideline | |
| 12:12:46 | bauzas | this data is ephemeral, right? | |
| 12:12:52 | sean-k-mooney | bauzas: if you reinstall the os on your laptop your tpm is not cleared | |
| 12:13:12 | bauzas | ah, you're right, if you wanna mock the baremetal case | |
| 12:13:26 | bauzas | but in this case, all moves are just data loss | |
| 12:13:56 | bauzas | especially when I read https://specs.openstack.org/openstack/nova-specs/specs/victoria/approved/add-emulated-virtual-tpm.html#migrations-and-their-ilk | |
| 12:13:57 | bauzas | brr... | |
| 12:13:58 | sean-k-mooney | bauzas: one of the usecases for this is storing encyrption keys or certs for authentication | |
| 12:14:29 | sean-k-mooney | so if you have data volumes or use the tpm as a cert store and use rebuild to upgrade your application you would not want to loose that data | |
| 12:14:30 | bauzas | gibi: thoughts on keeping a list of CI maintainers somewhere in https://review.opendev.org/#/c/742407/5 | |
| 12:14:40 | bauzas | gibi: if you have remembrance of anything about this... | |
| 12:14:50 | openstackgerrit | Merged openstack/nova master: Fix indentation nits https://review.opendev.org/746765 | |
| 12:14:56 | openstackgerrit | Merged openstack/nova master: Remove deprecated scheduler filters https://review.opendev.org/744800 | |
| 12:15:04 | sean-k-mooney | bauzas: all move operation in the sepc are currently data perserving | |
| 12:15:21 | sean-k-mooney | bauzas: we just copy the tpm data form one host to another | |
| 12:15:21 | bauzas | I do understand the usecase | |
| 12:15:31 | bauzas | I'm just saying we are adding more than necessary | |
| 12:15:42 | bauzas | but again, the ship has sailed | |
| 12:16:01 | sean-k-mooney | bauzas: well it was felt that without perserving the data on move ops we could not resonably support them | |
| 12:16:02 | openstackgerrit | Merged openstack/nova master: tests: Add helpers for rebuild, cold migrate, and shelve/unshelve https://review.opendev.org/747792 | |
| 12:16:46 | sean-k-mooney | bauzas: complexity is a valid concern but i think the current semantics are what i would expect | |
| 12:19:51 | bauzas | sean-k-mooney: yup, and again, I won't bother | |
| 12:20:02 | bauzas | we had a consensus, I do respect it. | |
| 12:20:55 | efried | A lot of blood, sweat, and tears went into getting that spec to where it is. | |
| 12:21:14 | efried | Which involved some very heavy tradeoffs and compromises along the way. | |
| 12:21:33 | efried | There's some saying like, "You know it's a good compromise when nobody is happy." | |
| 12:22:57 | efried | Specifically to address the notion of pets: if you want a TPM, your VM is already a pet. | |
| 12:23:55 | gibi | efried: o/ | |
| 12:23:57 | efried | I will say that I am happy to see things like vTPM and provider config merging now -- two releases after I stopped working on them, which was multiple releases after I (and others) started working on them. | |
| 12:23:58 | elod | lyarwood: btw, should we wait this to merge too? >>> https://review.opendev.org/#/c/744550/ | |
| 12:24:25 | lyarwood | elod: that's less important tbh | |
| 12:24:42 | lyarwood | elod: just a nice to have, the other change fixes an issue introduced by an earlier change | |
| 12:26:01 | sean-k-mooney | efried: yep it will be nice to see them in the victoria project update hopefully as highlights | |
| 12:27:26 | elod | lyarwood: ok, then I've updated the release patch | |
| 12:28:38 | elod | the other patch unfortunately had to recheck anyway, so it would mean at least 3-4 hrs to merge... | |
| 12:32:11 | bauzas | gibi: lyarwood: stephenfin: -1 for relnote on https://review.opendev.org/#/c/631363/61 | |
| 12:33:13 | bauzas | stephenfin: I'm currently digging the long list of https://review.opendev.org/#/q/topic:bp/add-emulated-virtual-tpm+status:merged but I can't find where we defined docs | |
| 12:33:15 | gibi | ack, do we need to pull it out of the gate? | |
| 12:33:28 | gibi | bauzas: doc is in the next patch | |
| 12:33:38 | bauzas | ah right | |
| 12:33:39 | gibi | https://review.opendev.org/#/c/739213/17 | |
| 12:34:02 | bauzas | that's what I just saw | |
| 12:34:34 | bauzas | okay, I think we can leave as it is since lyarwood already approved the above patch but this sucks :( | |
| 12:34:58 | bauzas | and I personally feel we should rewrite the reno file to be more explicit by saying "sorry folks, only spawn as of now" | |
| 12:35:31 | bauzas | given what efried said on the life of pets, once people see TPM devices around in nova, they gonna start using those without knowing they're stukc | |
| 12:35:35 | bauzas | stephenfin: ^ | |
| 12:35:54 | gibi | bauzas: at least the doc is explicit about what does not work with vtpm | |
| 12:35:56 | bauzas | (provided we don't merge the move ops changes in the next 2 weeks obviously) | |
| 12:35:58 | stephenfin | bauzas: I can do a follow-up | |
| 12:36:05 | bauzas | stephenfin: wfm | |
| 12:36:11 | stephenfin | cool. gimme a sec | |
| 12:36:13 | bauzas | and yeah, docs are expicit | |
| 12:36:17 | bauzas | explicit even | |