| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-08-26 | |||
| 14:54:08 | openstackgerrit | Alex Xu proposed openstack/nova master: Provider Config File: Enable loading and merging of provider configs https://review.opendev.org/693460 | |
| 14:54:17 | sean-k-mooney | so make all you public flaovr bfv only | |
| 14:54:22 | stephenfin | bauzas: They are identical, but I didn't want to make the two series depend on each other | |
| 14:54:29 | noonedeadpunk | but even with lavor with 0 disk it's possible to create server without cinder volume | |
| 14:54:32 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/ussuri: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748252 | |
| 14:54:32 | stephenfin | bauzas: I'll rebase once one of them lands | |
| 14:54:32 | openstack | bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,Triaged] https://launchpad.net/bugs/1889633 | |
| 14:54:32 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/ussuri: tests: Add reproducer for bug #1889633 https://review.opendev.org/748251 | |
| 14:54:36 | noonedeadpunk | s/lavor/flavor/ | |
| 14:54:42 | sean-k-mooney | then use flavor access to allow access to the other falvors to a specific tenant or set of tenants | |
| 14:54:44 | gmann | sean-k-mooney: noonedeadpunk we can default it to 'os_compute_api:os-flavor-manage:create' rule itself so whatever create policy has in any deployment (default or overridden ) stays the same with new policy check. | |
| 14:54:53 | alex_xu | stephenfin: gibi ^ rebased 693460, the conflict at admin doc | |
| 14:54:55 | bauzas | stephenfin: I'd have appreciated a -2 somewhere :) | |
| 14:55:01 | bauzas | or a DNM | |
| 14:55:06 | sean-k-mooney | gmann: that would not actully address noonedeadpunk usecase | |
| 14:55:12 | sean-k-mooney | it would do what i asked you | |
| 14:55:22 | stephenfin | bauzas: well that would have defeated the purpose, wouldn't it? :P | |
| 14:55:42 | sean-k-mooney | we would need a policy on spwan that blocked ephemeral flavors | |
| 14:55:47 | lyarwood | elod: https://review.opendev.org/#/c/747358/ should also be ready now btw | |
| 14:55:52 | bauzas | stephenfin: one is a bugfix, the other one is a feature that is proritized in a runwayu | |
| 14:55:55 | lyarwood | elod: unless you want me to squash | |
| 14:55:57 | sean-k-mooney | unless you were in a specific group | |
| 14:56:05 | bauzas | stephenfin: so, honestly... :D | |
| 14:56:10 | sean-k-mooney | but i think falvor access and tenants achive a similar result | |
| 14:56:23 | noonedeadpunk | sean-k-mooney: I mean there's no way to create a flavor that prohibit usage of ephemeral/local volumes | |
| 14:56:27 | gmann | sean-k-mooney: yeah | |
| 14:56:45 | sean-k-mooney | noonedeadpunk: well the flavor specifcy the disk usage | |
| 14:57:00 | sean-k-mooney | you cant consme disk based on image metadata | |
| 14:57:04 | stephenfin | Yeah, I wasn't sure how else to do it without ending up with a 15+ patch series :-\ | |
| 14:57:10 | sean-k-mooney | but you can restict who can use that flavor | |
| 14:57:11 | noonedeadpunk | yes, but even with 0 disk and 0 swap - ephemeral will still be created if volume is not provided? | |
| 14:57:27 | stephenfin | especially given I couldn't place it at the bottom of either series | |
| 14:57:31 | sean-k-mooney | noonedeadpunk: if you dont use boot form volume | |
| 14:57:49 | sean-k-mooney | although i argued that its a bug that that is allows | |
| 14:58:12 | noonedeadpunk | Yeah, so what I would be expecting is that nave printed that it's not allowed for instance | |
| 14:58:21 | sean-k-mooney | i wanted 0 disk to mean bfv only | |
| 14:58:30 | sean-k-mooney | other felt that would break some pepole | |
| 14:59:19 | sean-k-mooney | noonedeadpunk: we may or may not beable to contole that by policy dependingo n what info is currenlty passed to server create | |
| 14:59:21 | noonedeadpunk | That why I was talking about policy, which can be configured if just reject users request when he tries to boot server without volume with 0 disk in flavor | |
| 14:59:22 | gmann | flavor creation control is not needed really but booting VM control with new policy | |
| 14:59:43 | sean-k-mooney | gmann: yes it would have to be a check on server create | |
| 14:59:52 | sean-k-mooney | either an api check or policy | |
| 15:00:08 | stephenfin | bauzas: if you can hit https://review.opendev.org/#/c/747744/ then I can drop one of those patches and rebase both series onto one | |
| 15:00:10 | sean-k-mooney | oh donwstream call got to go | |
| 15:00:37 | noonedeadpunk | like the point here is that ppl on public clouds usually not sure what they want, and just go the easiest path, which results in lost data for them... | |
| 15:00:47 | bauzas | stephenfin: yeah, that's possible | |
| 15:01:50 | gmann | sean-k-mooney: noonedeadpunk: in that case we can default the new policy with this https://github.com/openstack/nova/blob/a7735d5e379c20c59cfb639f9f4d339bcffca2f9/nova/policies/servers.py#L167 | |
| 15:04:48 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/train: hardware: Reject requests for no hyperthreads on hosts with HT https://review.opendev.org/748255 | |
| 15:04:48 | openstack | bug 1889633 in OpenStack Compute (nova) ussuri "Pinned instance with thread policy can consume VCPU" [High,In progress] https://launchpad.net/bugs/1889633 - Assigned to Stephen Finucane (stephenfinucane) | |
| 15:04:48 | openstackgerrit | Stephen Finucane proposed openstack/nova stable/train: tests: Add reproducer for bug #1889633 https://review.opendev.org/748254 | |
| 15:05:20 | noonedeadpunk | I mean like `os_compute_api:servers:create:zero_disk_flavor` is already checking the flavor. Maybe somewhere near it's possible to check if flavor has zero size disk, but has no volume attached? | |
| 15:05:42 | noonedeadpunk | I'm not really familiar with nova codebase as it's so huge... | |
| 15:06:32 | sean-k-mooney | you proably need the block device mappings | |
| 15:07:17 | sean-k-mooney | that said i think we have a bfv flag somewhere | |
| 15:08:18 | noonedeadpunk | At least I hope I told userstory I'm trying to implement in an understandable way.... | |
| 15:08:44 | sean-k-mooney | you did | |
| 15:08:57 | sean-k-mooney | you want to restict who can boot a vm without bfv | |
| 15:09:04 | sean-k-mooney | using policy and roles | |
| 15:09:08 | sean-k-mooney | right | |
| 15:10:14 | noonedeadpunk | ideally yes. How to restrict it on whole cloud I guess you've already answered and it's with max_local_block_devices | |
| 15:10:26 | noonedeadpunk | eventually that will probably work for me as well | |
| 15:11:14 | sean-k-mooney | yes the config option will also block it much latere on the compute host rather then api | |
| 15:12:20 | noonedeadpunk | (in the worst case scenario would use isolate aggregates which will be also tricky because of the need to separate resources) | |
| 15:12:44 | noonedeadpunk | but yeah, checking that on api level might be more efficient | |
| 15:12:55 | noonedeadpunk | and produce more understandable output | |
| 15:14:04 | sean-k-mooney | an api check woudl allow us to retrun a specific api respoce saying why | |
| 15:14:11 | sean-k-mooney | currently it would jsut get a no valid host | |
| 15:14:19 | noonedeadpunk | yeah | |
| 15:14:24 | sean-k-mooney | which is not a great user experice | |
| 15:14:48 | gmann | zero_disk_flavor policy already control the zero disk boot if it is not bfv | |
| 15:15:28 | noonedeadpunk | zero_disk_flavor eventually can only prohibit spawning a VM when it's created with flavor with 0 disk | |
| 15:15:29 | sean-k-mooney | oh so the edgecase it did not fix was allowing bfz when disk >0 | |
| 15:15:46 | sean-k-mooney | there is an edgecase that it breaks | |
| 15:15:47 | noonedeadpunk | even if its bfv | |
| 15:17:12 | gmann | https://github.com/openstack/nova/blob/eef4b5435e7cdfe53ee9d9265d96c7dd278d9e93/nova/compute/api.py#L730 | |
| 15:17:51 | sean-k-mooney | ya htat is blocking using 0 disk flavor without bfv | |
| 15:17:58 | noonedeadpunk | I think it's pretty different | |
| 15:18:00 | noonedeadpunk | yeah | |
| 15:18:09 | sean-k-mooney | it does not prevent createing vms with non 0 disk flavors | |
| 15:18:25 | noonedeadpunk | eventually... it blocks 0 disk flavor with bfv as well. At least blocked on train for me... | |
| 15:18:44 | sean-k-mooney | it should not | |
| 15:19:03 | gmann | yeah, it should not block that | |
| 15:19:04 | sean-k-mooney | that check should only block non bfv vms with 0 disk flavors | |
| 15:19:24 | noonedeadpunk | oh, yeah, maybe you're right | |
| 15:19:27 | noonedeadpunk | sorry | |
| 15:20:07 | noonedeadpunk | actually, even when instance has 0 disk flavor it can be still created without bfv | |
| 15:20:19 | noonedeadpunk | which also can't be covered with that policy | |
| 15:20:19 | sean-k-mooney | not with that policy | |
| 15:20:32 | sean-k-mooney | that is what it block | |
| 15:20:41 | sean-k-mooney | but on train it might now be enabeld by default | |
| 15:20:57 | noonedeadpunk | oh, indeed, yeah, you're right | |
| 15:21:08 | sean-k-mooney | its relitivly new | |
| 15:21:16 | noonedeadpunk | so yeah, edgecase when flavor >0 | |
| 15:21:41 | noonedeadpunk | I just got it overriden after upgrade to train, so mixing a bit, sorry | |
| 15:21:49 | gmann | it is there before train and with admin only. before stein it was default with admin-or-owner | |
| 15:22:57 | noonedeadpunk | so like another option is to drop all non-0 flavors and use that policy | |
| 15:22:59 | gmann | ok so the case left here is to allow flavor.disk>0 in bfv case ? | |
| 15:23:17 | sean-k-mooney | noonedeadpunk: yes | |
| 15:23:38 | sean-k-mooney | noonedeadpunk: and create private flavor with disk if you need that and only give access to sepcific tenants | |
| 15:23:42 | gmann | or instead of drop, control the flavor access | |