| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-01-05 | |||
| 14:41:02 | sean-k-mooney | oh it is the patch | |
| 14:41:39 | sean-k-mooney | exception.ForbiddenWithAccelerators should not be raised here anymore | |
| 14:42:34 | sean-k-mooney | bauzas: i havent review this in a while | |
| 14:43:03 | bauzas | sean-k-mooney: well, we decorated shelve() a while ago | |
| 14:43:05 | sean-k-mooney | why would self.compute_api.shelve(context, instance) raise that with this chagne? | |
| 14:43:16 | sean-k-mooney | bauzas: yes i know | |
| 14:43:24 | sean-k-mooney | but that decorator should be removed with this patch | |
| 14:43:28 | bauzas | so we were returning ForbiddenWithAccelerators up to the API | |
| 14:43:29 | sean-k-mooney | that was the whole point | |
| 14:43:48 | sean-k-mooney | we were not going to require a new micorverion for unshelve with cyborg | |
| 14:43:49 | bauzas | so in theory we should have managed such exception | |
| 14:44:06 | bauzas | because afaics, we were just passing it thru | |
| 14:44:11 | bauzas | leading to a 500 | |
| 14:44:20 | dansmith | I'm super confused | |
| 14:44:26 | bauzas | now, this patch addes the exception handle | |
| 14:44:41 | dansmith | the point of the decorator was to make the 500 into 403s, acting like "you don't have permission" instead of "this doesn't work" | |
| 14:44:44 | dansmith | so we could enable it later, | |
| 14:44:51 | dansmith | since this was not a new api, just a hole we created | |
| 14:44:56 | sean-k-mooney | so https://review.opendev.org/c/openstack/nova/+/729563/26/nova/compute/api.py#4166 | |
| 14:45:00 | bauzas | dansmith: I totally get it | |
| 14:45:04 | sean-k-mooney | we are doing @block_accelerators(until_service=54) | |
| 14:45:13 | sean-k-mooney | we could also just remove the decorator | |
| 14:45:14 | dansmith | catching the exception now is just to handle walking over the service version right? | |
| 14:45:18 | bauzas | dansmith: but afaics, we were not handling such exception on the API side | |
| 14:45:27 | dansmith | right, exactly, until version 54 | |
| 14:46:29 | sean-k-mooney | i tought we were elsewhwere | |
| 14:47:09 | dansmith | hmm, | |
| 14:47:16 | dansmith | so ForbiddenWithAccelerators has code=403, | |
| 14:47:20 | dansmith | but it doesn't inherit from Forbidden | |
| 14:47:30 | dansmith | so ... maybe we thought we were, but aren't? | |
| 14:47:38 | dansmith | does the API handle anything with code= set and turn that into an http code? | |
| 14:48:17 | sean-k-mooney | i think it does | |
| 14:48:30 | dansmith | if so, then we should be good | |
| 14:48:42 | bauzas | ah-ha ok | |
| 14:48:47 | sean-k-mooney | i think we have a generic handeler for anything that inherits form NovaException | |
| 14:49:02 | dansmith | which also means we probably don't need this special catch | |
| 14:49:06 | bauzas | my only worry is that this handler was returning a 500 | |
| 14:49:15 | bauzas | but given code=403, I guess we're safe | |
| 14:49:16 | dansmith | see, NovaException defaults to code=500, | |
| 14:49:32 | dansmith | so this overrides to 403 which I think is supposed to make us not 500 when this bubbles all the way to the api | |
| 14:49:46 | bauzas | yup, from what I remind | |
| 14:49:58 | dansmith | I'll reply to bauzas | |
| 14:50:02 | bauzas | cool | |
| 14:50:06 | dansmith | as I need a gerrit comment karma in 2021 :P | |
| 14:51:02 | sean-k-mooney | we probaly could extent that api samples to assert the correct behavior | |
| 14:51:24 | dansmith | do we have api samples tests for failures? I didn't think we did | |
| 14:51:48 | sean-k-mooney | not sure but im pretty sure we dont have any api sample tests for cyborg integration | |
| 14:53:14 | sean-k-mooney | i think we just have https://github.com/openstack/nova/blob/261416aeb0187cc7d420bb74d8b330aa66cc37b6/nova/tests/functional/api_sample_tests/test_shelve.py | |
| 14:53:18 | bauzas | oh no, we don't hzve them :) | |
| 14:53:40 | dansmith | man, it's going to take me a while to get used to new gerrit | |
| 14:53:53 | dansmith | it was only released for one day before I disappeared in 2020 and it looks so foreign to me | |
| 14:54:35 | sean-k-mooney | ya part of it remind me of really really old gerrit | |
| 14:54:56 | sean-k-mooney | but i keep going to click on things that have moved | |
| 14:55:55 | gibi | stephenfin: lets add uptime to both response | |
| 14:56:04 | bauzas | dansmith: good luck with the new gerrit | |
| 14:56:06 | gibi | dansmith: hey, welcome back! | |
| 14:56:13 | dansmith | gibi: o/ | |
| 14:56:14 | bauzas | but I'm finally used to it | |
| 14:56:44 | bauzas | haven't seen yet any fancy new feature that makes it worth tho | |
| 14:57:37 | dansmith | gotta move everything around in a UI every 18 months to stave off dementia I guess | |
| 14:57:42 | gibi | bauzas: one big plus for me that now gerrit shows diffs due to rebase with a different color that diff due the the patch I'm reviewing | |
| 14:57:54 | bauzas | ah, gtk then | |
| 14:57:54 | dansmith | orly | |
| 14:58:06 | bauzas | haven't seen it yet | |
| 14:58:07 | dansmith | I think they could probably have done that without moving everything | |
| 14:58:53 | sean-k-mooney | gibi: oh i havent noticed that yet | |
| 14:59:03 | gibi | for example there are orange lines here due to six removal https://review.opendev.org/c/openstack/nova/+/764292/6..9/nova/api/openstack/compute/servers.py | |
| 14:59:15 | bauzas | dansmith: fwiw, I'll require your expertise in a few weeks for the compute RPC API version bump, still stuck with damn errors | |
| 14:59:20 | sean-k-mooney | dansmith: well im pretty sure the version we were using was eol | |
| 14:59:43 | bauzas | it was | |
| 14:59:45 | sean-k-mooney | dansmith: so just form a security and manatiance point of view we would have needed to eventually move | |
| 14:59:55 | dansmith | bauzas: roger | |
| 15:00:02 | dansmith | sean-k-mooney: no, I know ;) | |
| 15:00:03 | bauzas | and I've been told intermediate versions were providing both UIs | |
| 15:00:24 | bauzas | but we were so lagging that when we jumped straight, gerrit removed the old UI meanwhile | |
| 15:00:24 | sean-k-mooney | yes | |
| 15:00:30 | sean-k-mooney | they did that for about a year or so | |
| 15:00:34 | bauzas | \o/ | |
| 15:01:13 | sean-k-mooney | yep thats effectivly what happened | |
| 15:09:37 | bauzas | this would make our conversations much simplier | |
| 15:09:55 | stephenfin | or, you know, change your nick :) | |
| 15:10:25 | bauzas | you can't imagine how many colleagues were thinking that my last name was ending with an 's' | |
| 15:10:28 | bauzas | damn IRC | |
| 15:12:36 | bauzas | gosh, the cyborg shelve patch is not exactly hairy, but I'd have preferred it being split between the API change and the RPC changes | |
| 15:13:55 | stephenfin | from my brief look, that's probably wise | |
| 15:14:00 | stephenfin | API last, of course | |
| 15:14:02 | bauzas | gibi: any idea why there are conductor changes with https://review.opendev.org/c/openstack/nova/+/729563/26/nova/conductor/manager.py ? | |
| 15:14:47 | bauzas | stephenfin: from someone who fixed some RPC compat break from the last cyborg patch, please understand my cautiousness | |
| 15:15:32 | gibi | bauzas: unshelve going through the conductor as it needs to call the scheduler | |
| 15:15:35 | gibi | after shelve offload | |
| 15:16:30 | bauzas | gibi: in rebuild_instance() ? | |
| 15:17:07 | bauzas | anyway, taxi time | |
| 15:17:18 | bauzas | will figure this out when I'm back, 15 min-ish | |
| 15:17:19 | sean-k-mooney | rebuild hits the schduler too to assert the new image is valid for the current host so maybe that | |
| 15:17:34 | gibi | bauzas: I have to guess it is historical, this patch went thorough many many revision | |
| 15:17:43 | bauzas | sean-k-mooney: I just honestly feel they added some fix in the same change | |
| 15:17:44 | gibi | I will find the reason | |
| 15:17:49 | bauzas | but that looks extra | |
| 15:18:35 | sean-k-mooney | ill try to take a look eairlier today although i need to start working on something else too | |
| 15:18:43 | gibi | bauzas: one thing that _create_and_bind_arq_for_instance() has been changed and that is called from multiple places | |