| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-10-13 | |||
| 15:30:05 | jrosser | has this sort of thing ever come up for nova? https://cloud.google.com/compute/docs/instances/verifying-instance-identity | |
| 15:31:07 | lyarwood | not that I'm aware of but it sounds like a valid feature for us to look into | |
| 15:31:27 | jrosser | i have messed with a small POC for that today and can share it if there is interest | |
| 15:32:26 | lyarwood | jrosser: I'd think there would be ahead of the PTG | |
| 15:32:57 | lyarwood | jrosser: https://etherpad.opendev.org/p/nova-wallaby-ptg - feel free to add it to the list if you have time to discuss it there in a few weeks | |
| 15:35:15 | sean-k-mooney | jrosser: im not sure if that is realted to what nova-join does | |
| 15:35:24 | sean-k-mooney | nova-join is not part of the nova project | |
| 15:35:34 | jrosser | it's sort of like that | |
| 15:35:46 | sean-k-mooney | https://opendev.org/x/novajoin | |
| 15:36:14 | jrosser | thats quite heavyweight though for something kind of simple | |
| 15:36:41 | sean-k-mooney | the google docs seam quite heavy too | |
| 15:36:50 | sean-k-mooney | do you have a simpel example | |
| 15:37:02 | jrosser | yeah, let me paste something | |
| 15:38:45 | sean-k-mooney | adding some form of identidy verifcaiotn or signigure to the instance metadata for apps to check shoudl be doable im just not sure what woudl be required | |
| 15:38:59 | sean-k-mooney | is the instance uuid enough or does it need to be cyptograpicaly secure | |
| 15:40:32 | sean-k-mooney | actully it sound like adding a signiture to the metadata for an isntace might me enough? | |
| 15:40:54 | sean-k-mooney | " Your applications can verify the signature against Google's public Oauth2 certificates to confirm the identity of the instance with which they have established a connection." | |
| 15:41:12 | openstackgerrit | Ghanshyam Mann proposed openstack/nova master: DNM: testing tempest copy-image test https://review.opendev.org/742547 | |
| 15:41:29 | sean-k-mooney | if we were to sign the metadata for the instance you could retrive it before connecting and validate its correct | |
| 15:41:33 | jrosser | i did this http://paste.openstack.org/show/798996/ | |
| 15:41:54 | jrosser | and i could validate the generated JWT against the public key after retrieving it from the metadata service | |
| 15:42:49 | sean-k-mooney | the publick keey the user provided | |
| 15:42:58 | sean-k-mooney | for the key pair for the instance | |
| 15:43:29 | jrosser | the cloud provider publishes the public key somewhere | |
| 15:43:41 | sean-k-mooney | oh you want to use a common one | |
| 15:43:45 | jrosser | and the private key belongs to the compute service | |
| 15:43:47 | sean-k-mooney | ya | |
| 15:43:50 | sean-k-mooney | that looks resonable | |
| 15:44:10 | sean-k-mooney | its not really intrusive its just anothe pice of metadata | |
| 15:44:20 | sean-k-mooney | and presuably a new config for the key | |
| 15:44:37 | jrosser | i arrived at this looking at automated cert issuance | |
| 15:45:02 | jrosser | there are tools which will cut certs based on validating instance identity documents | |
| 15:45:03 | sean-k-mooney | lets-encrypt-style | |
| 15:45:28 | sean-k-mooney | we have pyjwt in the upper-constriats file too | |
| 15:45:37 | mnaser | sean-k-mooney: hardware offloaded ovs is the goal | |
| 15:45:50 | sean-k-mooney | so while this might be a new reqruirement for nova it not a new one for openstack | |
| 15:46:08 | jrosser | https://smallstep.com/blog/embarrassingly-easy-certificates-on-aws-azure-gcp/ | |
| 15:46:19 | sean-k-mooney | jrosser: so ya i hitnk you sould almost do this as a specless blueprint if you bring it up at the ptg with that example | |
| 15:46:40 | jrosser | ok, that would be cool | |
| 15:47:10 | sean-k-mooney | oh what is smallstep | |
| 15:47:15 | jrosser | was wanting to gauge what folk thought, as i could do something similar with the dynamic vendor data but that didnt really feel like the right tool | |
| 15:47:26 | sean-k-mooney | jrosser:we might ask for a spec just an fyi | |
| 15:47:43 | sean-k-mooney | but as presented this look almost trivaial enough to be a specless blueprint | |
| 15:47:54 | jrosser | smallstep is quite neat actually, i use it here for a private ACME pki | |
| 15:48:15 | sean-k-mooney | ill have to look into it | |
| 15:48:22 | sean-k-mooney | certs have always been a pain | |
| 15:48:54 | sean-k-mooney | to the point where i deployed k8s just to act as a cert ahority and allow me to expose things with lets encyrpt certs in the past | |
| 15:49:25 | sean-k-mooney | now im using traefik for that | |
| 15:50:06 | sean-k-mooney | which reminds me i have to update my openstack redirect so that it force http to https | |
| 16:22:30 | stephenfin | lyarwood: done | |
| 16:22:46 | stephenfin | lyarwood: some nits but nothing blocking | |
| 17:31:32 | mnaser | sean-k-mooney: so far i have made it to the conclusion that my issue is that both vfs and pfs are all in the same iommu group, therefore is not possible to attach a single vf.. | |
| 20:46:33 | openstackgerrit | Merged openstack/nova master: Fix a hacking test https://review.opendev.org/754713 | |
| #openstack-nova - 2020-10-14 | |||
| 04:47:08 | openstackgerrit | Hemanth Nakkina proposed openstack/nova master: Update pci stat pools based on PCI device changes https://review.opendev.org/749175 | |
| 08:00:28 | lyarwood | stephenfin: ^ Morning, sorry borked the unit test change with that fix. | |
| 08:00:28 | openstackgerrit | Lee Yarwood proposed openstack/nova master: compute: Don't detach volumes when RescheduledException raised without retry https://review.opendev.org/757894 | |
| 08:00:28 | openstack | bug 1899649 in OpenStack Compute (nova) "Volume marked as available after a failure to build" [Undecided,In progress] https://launchpad.net/bugs/1899649 - Assigned to Lee Yarwood (lyarwood) | |
| 08:00:28 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add regression test for bug #1899649 https://review.opendev.org/757893 | |
| 08:00:49 | lyarwood | stephenfin: would you also mind taking a look at https://review.opendev.org/#/c/754695/ today? Another super trivial change. | |
| 08:55:39 | lyarwood | Does the following trace ring any bells for anyone? | |
| 08:56:18 | lyarwood | 2020-10-08 00:40:06.508 8 ERROR oslo_messaging.rpc.server [req-d1269d5e-18c3-410b-87f1-b36a71ec79b9 c6015c4d46694de2bb99411a5fdb388e 301e3b6a1fc941f2897d00a657a22482 - default default] Exception during message handling: UnexpectedTaskStateError_Remote: Conflict updating instance 558b87b7-dbb4-4a3a-9a63-8d873dc4bf33. Expected: {'task_state': [u'migrating']}. Actual: {'task_state': None} | |
| 08:56:28 | lyarwood | during post_live_migration_at_destination | |
| 08:57:23 | lyarwood | on stable/queens | |
| 08:58:32 | stephenfin | lyarwood: not me, but sounds like a race with something else setting task_state. Possibly multiple instance operations happening at the same time and poor locking in place? | |
| 09:00:28 | lyarwood | stephenfin: yeah there's no overlapping instance actions that I can see, just looks like poor error handling, was hoping someone had seen it | |
| 09:04:20 | tosky | as you are around, may I ask how it's going with the zuul v3 jobs? | |
| 09:05:15 | lyarwood | tosky: I've not made any progress with https://review.opendev.org/#/c/711625/ | |
| 09:05:24 | lyarwood | tosky: slightly slammed downstream this week | |
| 09:05:49 | tosky | you tell me | |
| 09:09:59 | aarents | lyarwood: I know that nova-compute restart on source host with live-migration will reset task_state, no other idea.. | |
| 09:13:06 | lyarwood | ouch | |
| 09:13:08 | lyarwood | TIL | |
| 09:14:21 | hemanth_n | stephenfin: thanks for your review on https://review.opendev.org/#/c/749175/, i left a comment can you please check when you get sometime | |
| 09:26:29 | songwenping_ | stephenfin: hi, this patch https://review.opendev.org/#/c/569386/27 has completed set/unset tag for server, so my patch https://review.opendev.org/#/c/756664/3 isnot need anymore. | |
| 09:28:06 | stephenfin | songwenping_: indeed; I can abandon that for you now so :) | |
| 09:28:57 | lyarwood | hmm do ~./ | |
| 09:29:08 | lyarwood | gah weechat-- | |
| 09:31:19 | songwenping_ | stephenfin: thanks, but seems it lack 'server-tag-delete-all' and 'server-tag-list', should we supply? | |
| 09:32:26 | stephenfin | songwenping_: I would expect the output of 'nova server-tag-list' to be included in 'openstack server show', no? I'm not sure if 'server-tag-delete-all' is all that useful either | |
| 09:35:28 | songwenping_ | right, maybe it's `openstack server show --tag`, i'll verify if merged once, and not to consider `server-tag-delete-all` temporary. :) | |
| 09:41:41 | stephenfin | songwenping_: If you really wanted to add an equivalent to the 'server-tag-delete-all' command, you could copy what we do in 'openstack flavor set' and add a '--no-property' flag | |
| 09:42:52 | songwenping_ | stephenfin: ok, cool. | |
| 09:48:37 | lyarwood | huh fun | |
| 09:49:57 | lyarwood | stephenfin: so the task_state thing from earlier, something called stop_instance during the live migration, this failed as libvirt had locked the domain and as it's wrapped with reverts_task_state moved the state to None | |
| 09:50:24 | lyarwood | but the request-id doesn't map to an instance action | |
| 09:50:26 | lyarwood | /o\ | |
| 12:52:03 | openstackgerrit | Mamduh proposed openstack/os-vif master: Fix - os-vif fails to get the correct UpLink Representor https://review.opendev.org/745895 | |
| 12:57:06 | openstackgerrit | Takashi Natsume proposed openstack/nova stable/victoria: Fix a hacking test https://review.opendev.org/758112 | |
| 13:16:10 | lyarwood | stephenfin: any idea why my test would end up using the nova.virt.fake.SmallFakeDriver when I've used nova.tests.functional.libvirt.base.ServersTestBase ? | |
| 13:16:27 | stephenfin | are you using a mixin? | |
| 13:17:39 | lyarwood | stephenfin: nope, just nova.tests.functional.libvirt.base.ServersTestBase | |
| 13:17:57 | lyarwood | ah wait | |
| 13:18:03 | lyarwood | I used _start_compute | |
| 13:18:06 | lyarwood | *facepalm* | |
| 13:20:46 | lyarwood | cool that's working now | |
| 13:21:04 | lyarwood | might want to stub out _start_compute in ServersTestBase to avoid confusion tbh | |
| 14:08:04 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Set instance host and drop migration under lock https://review.opendev.org/754815 | |
| 14:08:04 | openstack | bug 1896463 in OpenStack Compute (nova) rocky "evacuation failed: Port update failed : Unable to correlate PCI slot " [Low,In progress] https://launchpad.net/bugs/1896463 | |
| 14:08:04 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Reproduce bug 1896463 in func env https://review.opendev.org/754100 | |
| 14:09:16 | gibi | stephenfin: fixed and replied in these ^^ | |