| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-08-26 | |||
| 11:59:31 | gibi | :D | |
| 11:59:54 | gibi | btw, stephenfin: I've finished reading and commenting the vtpm series | |
| 12:00:12 | sean-k-mooney | it looks like they are all approved | |
| 12:00:33 | sean-k-mooney | at least for spwan | |
| 12:00:40 | sean-k-mooney | the move operation are still pending | |
| 12:01:00 | gibi | yeah, spawn seems pretty solid to me | |
| 12:01:43 | sean-k-mooney | this will make efried happy to see | |
| 12:03:00 | bauzas | I'm just reviewing the rest of the series | |
| 12:03:32 | bauzas | but honestly, mho is that we tried to be gentlemen with vtpm usage, by overcomplicating what we were providing as a feature :) | |
| 12:03:46 | bauzas | trying to have vtpm instances be pets is nice | |
| 12:04:16 | bauzas | but we're pulling swift and trying to do maths to get whether we can still migrate an emulated file device or not, which overcomplicates things | |
| 12:04:30 | bauzas | but this is what it is, the spec is approved | |
| 12:05:14 | sean-k-mooney | well we try to make it behave like a real server | |
| 12:05:53 | bauzas | this is cloud | |
| 12:06:04 | sean-k-mooney | yep | |
| 12:06:09 | bauzas | most of the operations are admin-managed | |
| 12:06:26 | sean-k-mooney | in a cloud that would be atypical | |
| 12:06:30 | bauzas | so in this case, trying to solve all the problems is nice, but this comes with a cost | |
| 12:06:51 | sean-k-mooney | well one of the proposal was no move operations | |
| 12:06:55 | bauzas | but the ship has sailed. | |
| 12:07:04 | sean-k-mooney | which was very non admin frendly | |
| 12:07:22 | bauzas | I'm okay with creating a fresh new tpm device with move operations | |
| 12:07:32 | bauzas | what I'm struggling with is trying to reuse the existing data | |
| 12:07:43 | bauzas | this should be app-managed | |
| 12:07:44 | sean-k-mooney | the check is pretty simple | |
| 12:07:56 | sean-k-mooney | if anything changes version or type then data is not perserved | |
| 12:08:08 | sean-k-mooney | if the version and type do not change we copy it | |
| 12:08:20 | stephenfin | bauzas: well, don't worry about swift. None of that is done | |
| 12:08:24 | sean-k-mooney | the special case is shelve | |
| 12:08:31 | stephenfin | Is we might never do it. For now, shelve is simply blocked | |
| 12:08:36 | sean-k-mooney | where we ahve to store it somewhere which is swift | |
| 12:09:07 | sean-k-mooney | bauzas: the alternitive was to stick it in glance as a second image | |
| 12:09:31 | sean-k-mooney | or not store it at all | |
| 12:11:28 | bauzas | sean-k-mooney: yup, I saw in the series | |
| 12:11:35 | bauzas | the shelve case is the most complicated | |
| 12:11:50 | bauzas | I also have concerns with rebuild | |
| 12:12:18 | bauzas | trying to reuse the existing backup file is nice, but as a user I'd expect a fresh vTPM device if I rebuild | |
| 12:12:21 | sean-k-mooney | rebuild preseves the data if the version/type of tpm does not change | |
| 12:12:39 | sean-k-mooney | bauzas: that fails the do what hardware does guideline | |
| 12:12:46 | bauzas | this data is ephemeral, right? | |
| 12:12:52 | sean-k-mooney | bauzas: if you reinstall the os on your laptop your tpm is not cleared | |
| 12:13:12 | bauzas | ah, you're right, if you wanna mock the baremetal case | |
| 12:13:26 | bauzas | but in this case, all moves are just data loss | |
| 12:13:56 | bauzas | especially when I read https://specs.openstack.org/openstack/nova-specs/specs/victoria/approved/add-emulated-virtual-tpm.html#migrations-and-their-ilk | |
| 12:13:57 | bauzas | brr... | |
| 12:13:58 | sean-k-mooney | bauzas: one of the usecases for this is storing encyrption keys or certs for authentication | |
| 12:14:29 | sean-k-mooney | so if you have data volumes or use the tpm as a cert store and use rebuild to upgrade your application you would not want to loose that data | |
| 12:14:30 | bauzas | gibi: thoughts on keeping a list of CI maintainers somewhere in https://review.opendev.org/#/c/742407/5 | |
| 12:14:40 | bauzas | gibi: if you have remembrance of anything about this... | |
| 12:14:50 | openstackgerrit | Merged openstack/nova master: Fix indentation nits https://review.opendev.org/746765 | |
| 12:14:56 | openstackgerrit | Merged openstack/nova master: Remove deprecated scheduler filters https://review.opendev.org/744800 | |
| 12:15:04 | sean-k-mooney | bauzas: all move operation in the sepc are currently data perserving | |
| 12:15:21 | sean-k-mooney | bauzas: we just copy the tpm data form one host to another | |
| 12:15:21 | bauzas | I do understand the usecase | |
| 12:15:31 | bauzas | I'm just saying we are adding more than necessary | |
| 12:15:42 | bauzas | but again, the ship has sailed | |
| 12:16:01 | sean-k-mooney | bauzas: well it was felt that without perserving the data on move ops we could not resonably support them | |
| 12:16:02 | openstackgerrit | Merged openstack/nova master: tests: Add helpers for rebuild, cold migrate, and shelve/unshelve https://review.opendev.org/747792 | |
| 12:16:46 | sean-k-mooney | bauzas: complexity is a valid concern but i think the current semantics are what i would expect | |
| 12:19:51 | bauzas | sean-k-mooney: yup, and again, I won't bother | |
| 12:20:02 | bauzas | we had a consensus, I do respect it. | |
| 12:20:55 | efried | A lot of blood, sweat, and tears went into getting that spec to where it is. | |
| 12:21:14 | efried | Which involved some very heavy tradeoffs and compromises along the way. | |
| 12:21:33 | efried | There's some saying like, "You know it's a good compromise when nobody is happy." | |
| 12:22:57 | efried | Specifically to address the notion of pets: if you want a TPM, your VM is already a pet. | |
| 12:23:55 | gibi | efried: o/ | |
| 12:23:57 | efried | I will say that I am happy to see things like vTPM and provider config merging now -- two releases after I stopped working on them, which was multiple releases after I (and others) started working on them. | |
| 12:23:58 | elod | lyarwood: btw, should we wait this to merge too? >>> https://review.opendev.org/#/c/744550/ | |
| 12:24:25 | lyarwood | elod: that's less important tbh | |
| 12:24:42 | lyarwood | elod: just a nice to have, the other change fixes an issue introduced by an earlier change | |
| 12:26:01 | sean-k-mooney | efried: yep it will be nice to see them in the victoria project update hopefully as highlights | |
| 12:27:26 | elod | lyarwood: ok, then I've updated the release patch | |
| 12:28:38 | elod | the other patch unfortunately had to recheck anyway, so it would mean at least 3-4 hrs to merge... | |
| 12:32:11 | bauzas | gibi: lyarwood: stephenfin: -1 for relnote on https://review.opendev.org/#/c/631363/61 | |
| 12:33:13 | bauzas | stephenfin: I'm currently digging the long list of https://review.opendev.org/#/q/topic:bp/add-emulated-virtual-tpm+status:merged but I can't find where we defined docs | |
| 12:33:15 | gibi | ack, do we need to pull it out of the gate? | |
| 12:33:28 | gibi | bauzas: doc is in the next patch | |
| 12:33:38 | bauzas | ah right | |
| 12:33:39 | gibi | https://review.opendev.org/#/c/739213/17 | |
| 12:34:02 | bauzas | that's what I just saw | |
| 12:34:34 | bauzas | okay, I think we can leave as it is since lyarwood already approved the above patch but this sucks :( | |
| 12:34:58 | bauzas | and I personally feel we should rewrite the reno file to be more explicit by saying "sorry folks, only spawn as of now" | |
| 12:35:31 | bauzas | given what efried said on the life of pets, once people see TPM devices around in nova, they gonna start using those without knowing they're stukc | |
| 12:35:35 | bauzas | stephenfin: ^ | |
| 12:35:54 | gibi | bauzas: at least the doc is explicit about what does not work with vtpm | |
| 12:35:56 | bauzas | (provided we don't merge the move ops changes in the next 2 weeks obviously) | |
| 12:35:58 | stephenfin | bauzas: I can do a follow-up | |
| 12:36:05 | bauzas | stephenfin: wfm | |
| 12:36:11 | stephenfin | cool. gimme a sec | |
| 12:36:13 | bauzas | and yeah, docs are expicit | |
| 12:36:17 | bauzas | explicit even | |
| 12:36:58 | lyarwood | yeah I was under the impression that things were going to be enabled before GA anyway so it would be a waste of time detailing everything in the releasenote | |
| 12:37:05 | efried | BTW, it'll be a good idea to take your cues from jroll and penick if you have questions about how these are going to be used irl. They're the primary consumer driving this work, at least initially. | |
| 12:37:08 | lyarwood | as opposed to updating the docs | |
| 12:37:10 | bauzas | stephenfin: cool, and then say we support resize, you could then amend your renofile to include "spawn [and resize]" | |
| 12:37:38 | bauzas | lyarwood: I never predict on things being merged | |
| 12:37:45 | openstackgerrit | Lee Yarwood proposed openstack/nova master: rbd: Move rbd_utils out of libvirt driver under nova.storage https://review.opendev.org/746904 | |
| 12:37:46 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Bring back allowed_direct_url_schemes in support of RBD image download https://review.opendev.org/728095 | |
| 12:37:46 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add ability to download Glance images into the libvirt image cache via RBD https://review.opendev.org/574301 | |
| 12:37:47 | openstackgerrit | Lee Yarwood proposed openstack/nova master: zuul: Add devstack-plugin-ceph-compute-qcow2 to experimental queue https://review.opendev.org/743220 | |