| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-02-03 | |||
| 11:36:08 | openstackgerrit | Lee Yarwood proposed openstack/nova master: fup: Merge duplicate volume attachment checks https://review.opendev.org/c/openstack/nova/+/773380 | |
| 13:45:52 | sean-k-mooney | V comes after U ... | |
| 13:46:11 | sean-k-mooney | meaning i need to backport to Victoria then Ussuri | |
| 13:51:24 | openstackgerrit | sean mooney proposed openstack/nova stable/victoria: only wait for plugtime events in pre-live-migration https://review.opendev.org/c/openstack/nova/+/770744 | |
| 13:56:28 | sean-k-mooney | lyarwood: can you take a look at ^ again | |
| 13:56:37 | sean-k-mooney | now that its in the correct order | |
| 14:01:14 | bauzas | sean-k-mooney: fwiw, I'm splitting my -W change for routed networks | |
| 14:01:27 | bauzas | the functests are saying OK so we know it works | |
| 14:01:42 | bauzas | (for all the move operations) | |
| 14:02:33 | sean-k-mooney | ok | |
| 14:03:06 | sean-k-mooney | i assume your going to either move teh func tests or the unit tests to a second patch? | |
| 14:03:47 | sean-k-mooney | for this type of change i trust the func tests more so would prefer those to stay with the code but ill leave that up to you | |
| 14:03:56 | sean-k-mooney | we will be reviewing the serise as a whole anyway | |
| 14:07:08 | bauzas | no, I'll have the functests in the same change for the filter | |
| 14:08:11 | bauzas | but I'll move the renaming of ensure_network_metadata() in a dependent change | |
| 14:10:02 | sean-k-mooney | cool | |
| 14:48:18 | gibi | fyi cores, I'm +2 on the vnc password patch https://review.opendev.org/c/openstack/nova/+/622336/ but it needs a second set of eyes | |
| 14:56:56 | sean-k-mooney | hum that touches a bunch of files but most are small changes it seams | |
| 14:57:13 | sean-k-mooney | im not a core but ill take a look at it | |
| 14:57:31 | gibi | sean-k-mooney: cool, thanks | |
| 14:57:34 | sean-k-mooney | it dose not look that difficult to reiew | |
| 15:31:54 | sean-k-mooney | gibi: -1 because i have a question on allowing console without a password to be created when the nova config has [vnc]/auth_schemes = none,vnc,vencrypt | |
| 15:32:03 | gibi | sean-k-mooney: thanks | |
| 15:32:07 | sean-k-mooney | gibi: but other then that the code looks ok | |
| 15:33:05 | sean-k-mooney | my comments are on the patch but while i woudl prefer not to save the pasword in plain text in novas db it is out of scope to use barbican so i view that as a future imporvment not a requirement for the feature | |
| 15:41:04 | openstackgerrit | Balazs Gibizer proposed openstack/nova stable/ussuri: Reproduce bug 1907522 in functional test https://review.opendev.org/c/openstack/nova/+/773930 | |
| 15:41:07 | openstack | bug 1907522 in OpenStack Compute (nova) victoria "test_*_with_qos_min_bw_allocation fails in the nova-multi-cell job with: nova.exception.MigrationPreCheckError: Migration pre-check error: Failed to create port bindings for host |
|
| 15:42:27 | openstackgerrit | Balazs Gibizer proposed openstack/nova stable/ussuri: Fallback to same-cell resize with qos ports https://review.opendev.org/c/openstack/nova/+/773932 | |
| 16:08:17 | melwitt | kashyap: took me awhile (sorry) but here's the qemu bug I opened about the block copy taking a long time to end the job after the last block is done https://bugs.launchpad.net/qemu/+bug/1914282 | |
| 16:08:18 | openstack | Launchpad bug 1914282 in QEMU "block copy job sometimes hangs on the last block for minutes" [Undecided,New] | |
| 16:08:34 | kashyap | melwitt: Hello | |
| 16:08:41 | melwitt | hello | |
| 16:09:19 | kashyap | melwitt: Thanks for filing; no need for sorry :-) | |
| 16:09:27 | kashyap | melwitt: Nice write-up | |
| 16:09:37 | kashyap | melwitt: One small comment; do you want to attach the pastebin content as a text file to the bug? | |
| 16:09:43 | kashyap | As pastebins expire | |
| 16:10:04 | melwitt | kashyap: oh, yeah, I will do that | |
| 16:10:10 | kashyap | melwitt: Also, the bug will show up on the main 'qemu-devel' list; so the Block Layer devs should notice it | |
| 16:10:51 | melwitt | I thought pastebin wasn't expiration by default but it's a good idea to attach it even so | |
| 16:10:55 | kashyap | If we don't hear a response in a week, I'll get Eric Blake to have a gander; he knows this inside out, as someone who's worked on QEMU and libvirt | |
| 16:11:39 | melwitt | ok great | |
| 16:13:40 | kashyap | melwitt: Is this affecting the Gate quite often? | |
| 16:14:10 | melwitt | kashyap: I think no but I don't know for sure bc I haven't figured out a unique fingerprint to logstash for it | |
| 16:25:17 | melwitt | lyarwood: I opened this bug yesterday based on a gate failure I saw and was curious if you've ever seen this before? https://bugs.launchpad.net/nova/+bug/1914296 | |
| 16:25:19 | openstack | Launchpad bug 1914296 in OpenStack Compute (nova) "tests involving encrypted volumes sometimes (rarely) fail with libvirtError: [...] Volume is not in LUKS format" [Undecided,New] | |
| 16:26:00 | kashyap | melwitt: Hmm, so I can't see a unique signature either ... as most of the messages are "usual", but they're on loop | |
| 16:26:28 | kashyap | Unless I'm missing something badly, looks like it's tricky to check for its frequency | |
| 16:26:33 | melwitt | kashyap: yeah exactly. the only place where I think we have a chance is in the job-output.txt but IIRC that text is also quite generic | |
| 16:26:57 | melwitt | I will take another look to see if anything jumps out | |
| 16:27:36 | kashyap | melwitt: Thank you. I hope this won't come back to bite us - as we can't (yet) see how often we're hitting it | |
| 16:28:46 | lyarwood | melwitt: can't say I have, *clicks* | |
| 16:29:32 | lyarwood | melwitt: if it's a block device n-cpu should format it with LUKS before using it | |
| 16:30:03 | melwitt | lyarwood: it seems weird bc the error message says both format=luks and then "Volume not in LUKS format", like how is that possible? | |
| 16:31:12 | lyarwood | melwitt: urgh that chrome tab just died, I'll pull down the log after the call if that's okay | |
| 16:31:32 | melwitt | sure np, just wanted to link you before I forgot | |
| 16:31:42 | melwitt | it's not urgent | |
| 17:13:58 | kashyap | melwitt: I have attached the QEMU <-> libvirt exchange from the dest-host in the bug. | |
| 17:14:22 | melwitt | kashyap: thanks! | |
| 17:15:12 | kashyap | NP. Thx, you too | |
| 17:44:48 | sean-k-mooney | lyarwood: can you reveiw https://review.opendev.org/c/openstack/nova/+/622336/29/nova/api/openstack/compute/remote_consoles.py#183 and confirm if you expect that to have teh same effect as the issue we discussed downstream | |
| 17:45:21 | sean-k-mooney | we do not want the password to end up in the image data or in config_dirver/metadata api | |
| 17:45:49 | sean-k-mooney | but here it may end up in both correct | |
| 17:49:38 | melwitt | sean-k-mooney: hm, I'd have thought that should be stored encrypted, same as we do for admin password | |
| 17:49:57 | sean-k-mooney | melwitt: ya i mentioned that | |
| 17:50:08 | sean-k-mooney | although i dont think it can be | |
| 17:50:16 | sean-k-mooney | the admin password is not in the libvirt xml | |
| 17:50:24 | sean-k-mooney | we use the ssh public key to encypt it yes | |
| 17:50:31 | melwitt | yes | |
| 17:50:43 | sean-k-mooney | in this case we wont have the private key to decyprti it ot stick it in the libvirt xml | |
| 17:50:55 | melwitt | oh :\ | |
| 17:50:57 | sean-k-mooney | so we can use the ssh public key here | |
| 17:51:07 | sean-k-mooney | but we coudl use soemthign else | |
| 17:51:11 | sean-k-mooney | e.g. a keystore | |
| 17:51:31 | sean-k-mooney | or static encyption with a fixed key seeded with the ssk public key or somehtihng | |
| 17:52:22 | melwitt | yeah.. I guess I'm slowly remembering this spec, and this aspect of it is "better than nothing" I guess (comparing with no novnc password at all) | |
| 17:52:45 | sean-k-mooney | is fixed key enabled by default | |
| 17:53:07 | sean-k-mooney | because if it is using castalain with fixed key to store it would be better | |
| 17:53:17 | sean-k-mooney | as that would allowy you to plug in barbican to do it proably too | |
| 17:53:28 | sean-k-mooney | that said as long as we call this out | |
| 17:53:39 | sean-k-mooney | and ensure we dont make the password visable in ways we did not intend | |
| 17:53:52 | sean-k-mooney | then i think its ok to improve it later | |
| 17:53:54 | melwitt | I dunno if it is enabled by default. I don't know how to tell | |
| 17:54:20 | sean-k-mooney | the nova keysotre cofnig? thats a thing i think | |
| 17:54:28 | prometheanfire | any progress on updating mock (nova still holds back the 3.0.5 -> 4.0.3 update)? | |
| 17:54:48 | sean-k-mooney | prometheanfire: we were tryihng to stop using it entirly at one point | |
| 17:54:50 | melwitt | yeah there's a fixed_key conf option but it doesn't have a default value, so that means it's not enabled by default? | |
| 17:55:21 | melwitt | prometheanfire: I have a change to the one test that is failing that I need to upload | |
| 17:55:44 | prometheanfire | sean-k-mooney: iirc it was given up on at some point (using the built in) | |
| 17:56:17 | prometheanfire | melwitt: kk, feel free to add me to the review (or ping me) :D | |
| 17:56:18 | sean-k-mooney | prometheanfire: i am not aware of a reason not tooo | |
| 17:56:34 | sean-k-mooney | prometheanfire: i suspect if it was it was just capasity | |
| 17:56:35 | melwitt | will do prometheanfire | |
| 17:56:59 | sean-k-mooney | melwitt: ya not sure the https://docs.openstack.org/nova/latest/configuration/config.html#key-manager config is what i was thinking | |
| 17:57:21 | sean-k-mooney | i was hoptin we had a default fixed key version that was always there if you dont use a real one | |
| 17:57:52 | prometheanfire | sean-k-mooney: well, using the built-in is always preferred | |
| 17:58:14 | melwitt | sean-k-mooney: oh I see | |
| 17:58:17 | sean-k-mooney | prometheanfire: yep we only used mock the lib for python 2 compatiablity | |
| 17:58:58 | sean-k-mooney | melwitt: anyway i dont think we have a basic intree keymanager that implemnt the castalin api that we can just assume is a thing | |
| 17:59:37 | sean-k-mooney | melwitt: well we have https://github.com/openstack/nova/blob/master/nova/keymgr/conf_key_mgr.py | |
| 18:00:02 | lyarwood | sean-k-mooney: sorry was afk, instance.metadata != instance.system_metadata so I'm not sure if it's going to have any impact | |