Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2020-08-26
14:29:23 bauzas lyarwood: ack, will look
14:31:03 openstackgerrit Alexandre Arents proposed openstack/nova master: Add a lock to prevent race during detach/attach of interface https://review.opendev.org/747957
14:36:04 lyarwood bauzas: thanks :)
14:39:32 openstackgerrit Stephen Finucane proposed openstack/nova master: Add type hints to 'nova.virt.libvirt.utils' https://review.opendev.org/742865
14:39:33 openstackgerrit Stephen Finucane proposed openstack/nova master: Add support for resize and cold migration of emulated TPM files https://review.opendev.org/639934
14:44:56 stephenfin gibi: Turns out a more granular mocking of migrate_disk_and_power_off is quite the bit of work. Have pushed up all the other fixes. Will keep working on that to get full coverage
14:50:00 gmann sean-k-mooney: noonedeadpunk: RE on policy for flavor ephemeral storage control. we can add policy rule for that and allow everyone by default so that we do not break existing usage but my concern is, if restricted by policy then it will control all request not specific to host or storage, is that fine?
14:50:22 bauzas stephenfin: https://review.opendev.org/#/c/744958/7 and https://review.opendev.org/#/c/741995/10 look the same, I guess it's PEBKAC ?
14:50:25 sean-k-mooney gmann: flavor creation is admin only by default
14:50:47 sean-k-mooney gmann: so the new policy would also have to be the same
14:50:57 gmann sean-k-mooney: ah yeah with current default.
14:51:09 openstackgerrit Lucian Petrut proposed openstack/nova master: Avoid invalid file name, preventing git clone on win32 https://review.opendev.org/748250
14:51:23 bauzas stephenfin: wow https://review.opendev.org/#/q/owner:stephenfin%2540redhat.com+status:open
14:51:27 bauzas do you sleep overnight?
14:51:32 sean-k-mooney gmann: can we make default dynamic
14:51:37 gmann sean-k-mooney: but i was reading chat, is noonedeadpunk use case for specific host to control such VM creation?
14:51:45 sean-k-mooney gmann: e.g. default it to whatever teh current flavor create policy is
14:51:47 gmann sean-k-mooney: dynamic?
14:51:57 gmann sean-k-mooney: yeah, we can do that
14:52:04 sean-k-mooney gmann: no i dont think so
14:52:26 sean-k-mooney gmann: i think noonedeadpunk wanted to restrct who could create flavors with local storage
14:52:46 sean-k-mooney there are ways to prevent host from booting gues with local sotrage alredy
14:52:48 lpetrut hi, looks like we have an unusual issue on Windows: https://review.opendev.org/#/c/748250/ a release note filename containing pipes prevents Nova from being cloned on Windows :)
14:52:59 gmann sean-k-mooney: i see
14:53:11 sean-k-mooney gmann: either via config or using a trait and isolated aggreates feature
14:53:21 noonedeadpunk to be exact, I wanted to restrict users who can create VMs with ephemeral storages
14:53:26 gmann ok
14:53:37 sean-k-mooney noonedeadpunk: that is slightly different then
14:53:52 noonedeadpunk For example I generally want to prohibit usage of ephemeral/local storages,m but what 1 groups of users to be still able to do that
14:53:55 sean-k-mooney one way to do that is to make the ephemeral flavors private
14:54:08 openstackgerrit Alex Xu proposed openstack/nova master: Provider Config File: Enable loading and merging of provider configs https://review.opendev.org/693460
14:54:17 sean-k-mooney so make all you public flaovr bfv only
14:54:22 stephenfin bauzas: They are identical, but I didn't want to make the two series depend on each other
14:54:29 noonedeadpunk but even with lavor with 0 disk it's possible to create server without cinder volume
14:54:32 openstackgerrit Stephen Finucane proposed openstack/nova stable/ussuri: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748252
14:54:32 stephenfin bauzas: I'll rebase once one of them lands
14:54:32 openstack bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,Triaged] https://launchpad.net/bugs/1889633
14:54:32 openstackgerrit Stephen Finucane proposed openstack/nova stable/ussuri: tests: Add reproducer for bug #1889633 https://review.opendev.org/748251
14:54:36 noonedeadpunk s/lavor/flavor/
14:54:42 sean-k-mooney then use flavor access to allow access to the other falvors to a specific tenant or set of tenants
14:54:44 gmann sean-k-mooney: noonedeadpunk we can default it to 'os_compute_api:os-flavor-manage:create' rule itself so whatever create policy has in any deployment (default or overridden ) stays the same with new policy check.
14:54:53 alex_xu stephenfin: gibi ^ rebased 693460, the conflict at admin doc
14:54:55 bauzas stephenfin: I'd have appreciated a -2 somewhere :)
14:55:01 bauzas or a DNM
14:55:06 sean-k-mooney gmann: that would not actully address noonedeadpunk usecase
14:55:12 sean-k-mooney it would do what i asked you
14:55:22 stephenfin bauzas: well that would have defeated the purpose, wouldn't it? :P
14:55:42 sean-k-mooney we would need a policy on spwan that blocked ephemeral flavors
14:55:47 lyarwood elod: https://review.opendev.org/#/c/747358/ should also be ready now btw
14:55:52 bauzas stephenfin: one is a bugfix, the other one is a feature that is proritized in a runwayu
14:55:55 lyarwood elod: unless you want me to squash
14:55:57 sean-k-mooney unless you were in a specific group
14:56:05 bauzas stephenfin: so, honestly... :D
14:56:10 sean-k-mooney but i think falvor access and tenants achive a similar result
14:56:23 noonedeadpunk sean-k-mooney: I mean there's no way to create a flavor that prohibit usage of ephemeral/local volumes
14:56:27 gmann sean-k-mooney: yeah
14:56:45 sean-k-mooney noonedeadpunk: well the flavor specifcy the disk usage
14:57:00 sean-k-mooney you cant consme disk based on image metadata
14:57:04 stephenfin Yeah, I wasn't sure how else to do it without ending up with a 15+ patch series :-\
14:57:10 sean-k-mooney but you can restict who can use that flavor
14:57:11 noonedeadpunk yes, but even with 0 disk and 0 swap - ephemeral will still be created if volume is not provided?
14:57:27 stephenfin especially given I couldn't place it at the bottom of either series
14:57:31 sean-k-mooney noonedeadpunk: if you dont use boot form volume
14:57:49 sean-k-mooney although i argued that its a bug that that is allows
14:58:12 noonedeadpunk Yeah, so what I would be expecting is that nave printed that it's not allowed for instance
14:58:21 sean-k-mooney i wanted 0 disk to mean bfv only
14:58:30 sean-k-mooney other felt that would break some pepole
14:59:19 sean-k-mooney noonedeadpunk: we may or may not beable to contole that by policy dependingo n what info is currenlty passed to server create
14:59:21 noonedeadpunk That why I was talking about policy, which can be configured if just reject users request when he tries to boot server without volume with 0 disk in flavor
14:59:22 gmann flavor creation control is not needed really but booting VM control with new policy
14:59:43 sean-k-mooney gmann: yes it would have to be a check on server create
14:59:52 sean-k-mooney either an api check or policy
15:00:08 stephenfin bauzas: if you can hit https://review.opendev.org/#/c/747744/ then I can drop one of those patches and rebase both series onto one
15:00:10 sean-k-mooney oh donwstream call got to go
15:00:37 noonedeadpunk like the point here is that ppl on public clouds usually not sure what they want, and just go the easiest path, which results in lost data for them...
15:00:47 bauzas stephenfin: yeah, that's possible
15:01:50 gmann sean-k-mooney: noonedeadpunk: in that case we can default the new policy with this https://github.com/openstack/nova/blob/a7735d5e379c20c59cfb639f9f4d339bcffca2f9/nova/policies/servers.py#L167
15:04:48 openstackgerrit Stephen Finucane proposed openstack/nova stable/train: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748255
15:04:48 openstack bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,In progress] https://launchpad.net/bugs/1889633 - Assigned to Stephen Finucane (stephenfinucane)
15:04:48 openstackgerrit Stephen Finucane proposed openstack/nova stable/train: tests: Add reproducer for bug #1889633 https://review.opendev.org/748254
15:05:20 noonedeadpunk I mean like `os_compute_api:servers:create:zero_disk_flavor` is already checking the flavor. Maybe somewhere near it's possible to check if flavor has zero size disk, but has no volume attached?
15:05:42 noonedeadpunk I'm not really familiar with nova codebase as it's so huge...
15:06:32 sean-k-mooney you proably need the block device mappings
15:07:17 sean-k-mooney that said i think we have a bfv flag somewhere
15:08:18 noonedeadpunk At least I hope I told userstory I'm trying to implement in an understandable way....
15:08:44 sean-k-mooney you did
15:08:57 sean-k-mooney you want to restict who can boot a vm without bfv
15:09:04 sean-k-mooney using policy and roles
15:09:08 sean-k-mooney right
15:10:14 noonedeadpunk ideally yes. How to restrict it on whole cloud I guess you've already answered and it's with max_local_block_devices
15:10:26 noonedeadpunk eventually that will probably work for me as well
15:11:14 sean-k-mooney yes the config option will also block it much latere on the compute host rather then api
15:12:20 noonedeadpunk (in the worst case scenario would use isolate aggregates which will be also tricky because of the need to separate resources)
15:12:44 noonedeadpunk but yeah, checking that on api level might be more efficient
15:12:55 noonedeadpunk and produce more understandable output
15:14:04 sean-k-mooney an api check woudl allow us to retrun a specific api respoce saying why
15:14:11 sean-k-mooney currently it would jsut get a no valid host
15:14:19 noonedeadpunk yeah
15:14:24 sean-k-mooney which is not a great user experice
15:14:48 gmann zero_disk_flavor policy already control the zero disk boot if it is not bfv

Earlier   Later