| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-03-16 | |||
| 11:17:01 | openstackgerrit | Lee Yarwood proposed openstack/nova stable/queens: Use absolute path during qemu img rebase https://review.opendev.org/c/openstack/nova/+/780790 | |
| 11:21:30 | brinzhang0 | bauzas: if you are free from the rpc version patch, pls review gibi's comments, thanks^ | |
| 11:31:35 | openstackgerrit | Elod Illes proposed openstack/nova stable/pike: Update resources once in update_available_resource https://review.opendev.org/c/openstack/nova/+/612295 | |
| 11:47:20 | openstackgerrit | Merged openstack/nova master: libvirt: Wire up 'os_secure_boot' property https://review.opendev.org/c/openstack/nova/+/776681 | |
| 11:48:02 | openstackgerrit | Merged openstack/nova master: libvirt: Report secure boot support to scheduler https://review.opendev.org/c/openstack/nova/+/775690 | |
| 11:48:52 | openstackgerrit | Merged openstack/nova master: tests: Add functional tests for UEFI, secure boot https://review.opendev.org/c/openstack/nova/+/776682 | |
| 11:49:28 | openstackgerrit | Merged openstack/nova master: tests: Remove duplicated 'start_compute' helper https://review.opendev.org/c/openstack/nova/+/776683 | |
| 11:50:16 | openstackgerrit | Merged openstack/nova master: docs: Document UEFI secure boot feature https://review.opendev.org/c/openstack/nova/+/776684 | |
| 11:51:02 | hkominos | Hi guys. Can i please ask a quick question regarding an exception that I am facing in my deployment? I believe the input from a developer would be more helpful for me than asking in the openstack channel | |
| 11:52:22 | k-s-dean | hkominos, ask away. someone might be see it later. If i can answer you I will. | |
| 11:52:58 | hkominos | k-s-dean Hi!. What do you make of this : https://paste.centos.org/view/741688bb | |
| 11:54:02 | k-s-dean | hkominos, are you running cyborg ? | |
| 11:54:09 | hkominos | no | |
| 11:54:22 | hkominos | This appeared after a host was rebooted with some Vms on it | |
| 11:54:52 | hkominos | which now refuse to come up | |
| 11:55:38 | k-s-dean | whats the underlying hardware | |
| 11:57:58 | k-s-dean | to me that sounds like a hardware issue. | |
| 11:58:19 | k-s-dean | hkominos, have you checked the compute logs on the host | |
| 11:58:20 | k-s-dean | \? | |
| 12:01:28 | hkominos | yes. https://paste.centos.org/view/73064e38. But before I start looking for hardware vendors I want to understand the problem. I think the issues probably more into nova placement but Idk. that is why I asked here. | |
| 12:04:34 | k-s-dean | hkominos, has this machine got a graphics card in it ? | |
| 12:04:44 | hkominos | yes. | |
| 12:04:54 | k-s-dean | Has the graphics card failed ? | |
| 12:05:12 | hkominos | lets double check | |
| 12:08:26 | hkominos | does not look like it. | |
| 12:09:55 | k-s-dean | ok. | |
| 12:10:27 | k-s-dean | any reason why you have 15 instances in the placement database and 10 instances on the hypervisor. | |
| 12:10:44 | k-s-dean | can you run virsh list --all on the host ? | |
| 12:28:08 | gibi | kashyap: I guess https://review.opendev.org/c/openstack/nova/+/682627 is not a mandatory part of the secure boot feature for W | |
| 12:28:14 | gibi | am I correct? | |
| 12:28:43 | gibi | the rest of the secure boot series landed | |
| 12:29:19 | kashyap | gibi: Cool; just see it in the scrollback. So that auto-detect can come later -- unfortunately, a bug in libvirt blocking that :-( | |
| 12:29:36 | gibi | kashyap: ack, then marking the bp implemented for W | |
| 12:29:37 | gibi | thanks | |
| 12:30:07 | kashyap | gibi: Thank you. And stephenfin, particularly | |
| 12:33:11 | gibi | stephenfin: will you resolve the merge conflict in the vdpa series? | |
| 12:33:29 | stephenfin | working on it atm | |
| 12:33:39 | gibi | cool | |
| 12:33:43 | gibi | thanks | |
| 12:57:11 | openstackgerrit | Lee Yarwood proposed openstack/nova stable/train: Make _rebase_with_qemu_img() generic https://review.opendev.org/c/openstack/nova/+/780782 | |
| 12:57:12 | openstackgerrit | Lee Yarwood proposed openstack/nova stable/train: Use absolute path during qemu img rebase https://review.opendev.org/c/openstack/nova/+/757084 | |
| 13:38:18 | gibi | is there anything that I should review now? | |
| 13:49:27 | hkominos | k-s-dean virsh list all shows (or did show 10) VMs | |
| 13:49:51 | hkominos | now why placement thought 15 Is because it had some garbage VMs that did not spawn on this node. | |
| 13:50:30 | k-s-dean | Those should have been cleaned up. | |
| 13:51:02 | hkominos | Will do | |
| 13:58:56 | openstackgerrit | Elod Illes proposed openstack/nova stable/pike: [stable-only] gate: Pin CEPH_RELEASE to nautilus in LM hook https://review.opendev.org/c/openstack/nova/+/780852 | |
| 14:10:14 | stephenfin | gibi: I'm reworking Sean's "block unsupported ops with vDPA interface" patch to return HTTP 409 (Conflict) instead of HTTP (Forbidden) since that seems more sensible. It's not a permissions or access issue, IMO. Do you agree? | |
| 14:31:57 | Luzi | hey, is someone around who knows the qemu native tls config options? I think i might have found a bug in the guide: https://docs.openstack.org/nova/latest/admin/secure-live-migration-with-qemu-native-tls.html | |
| 14:34:53 | kashyap | Luzi: Hi, I think I wrote that doc :) | |
| 14:35:05 | kashyap | Luzi: What's the bug? Feel free to amend / send a pull-req :) | |
| 14:35:20 | kashyap | s/pull-req/patch/ | |
| 14:36:20 | kashyap | At the bottom right, there is also "found an error? report a bug" | |
| 14:36:34 | Luzi | i followed that guide but got to a point when openstack did not use the tls path, but kept using the tcp path | |
| 14:36:56 | Luzi | i onlny found out because i used tcpdump on both ports | |
| 14:37:55 | kashyap | Luzi: Hmm, if you followed that guide to the word, then your setup should definitely be using the QEMU-native TLS | |
| 14:38:49 | Luzi | i was looking through code and found out, that the uri used for live migration is different from the connection uri and uses a config option not mentioned in the guide | |
| 14:39:21 | kashyap | Luzi: Hmm, possible the guide got slightly outdated ... as migration-related code got reworked | |
| 14:39:22 | Luzi | only after i set live_migration_scheme = tls | |
| 14:39:32 | Luzi | the traffic was encrypted | |
| 14:39:44 | Luzi | and using the correct port :) | |
| 14:41:06 | kashyap | Luzi: I see. That's correct _scheme is favoured | |
| 14:41:19 | kashyap | And _uri parameter is deprecated in favor of the above | |
| 14:41:41 | Luzi | but when you don't set it, as i had not done it, the code uses the hardcoded tcp parameter | |
| 14:41:44 | fungi | looks like that config option was added by https://review.openstack.org/410817 which merged in early 2017 | |
| 14:42:08 | kashyap | fungi: Heya; yep. That timeframe is right ... /me clicks | |
| 14:42:35 | kashyap | Yep; patch is also correct. | |
| 14:42:43 | Luzi | live_migration_scheme = tls | |
| 14:42:45 | fungi | first appeared in nova 15.0.0, so ocata and later | |
| 14:42:48 | kashyap | Luzi: Also you don't tell what version of OpenStack you were using? | |
| 14:43:13 | kashyap | Yeah, what fungi says. | |
| 14:43:19 | Luzi | https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L1224 | |
| 14:43:23 | openstackgerrit | Stephen Finucane proposed openstack/nova master: pci: Add vDPA vnic to PCI request mapping and filtering https://review.opendev.org/c/openstack/nova/+/778350 | |
| 14:43:24 | openstackgerrit | Stephen Finucane proposed openstack/nova master: tests: Add functional test for vDPA device https://review.opendev.org/c/openstack/nova/+/780112 | |
| 14:43:24 | openstackgerrit | Stephen Finucane proposed openstack/nova master: api: Block unsupported actions with vDPA https://review.opendev.org/c/openstack/nova/+/780333 | |
| 14:43:25 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Add release note for vDPA https://review.opendev.org/c/openstack/nova/+/780866 | |
| 14:43:25 | openstackgerrit | Stephen Finucane proposed openstack/nova master: WIP: tests: Make mdev stubs work like vDPA https://review.opendev.org/c/openstack/nova/+/780234 | |
| 14:43:31 | stephenfin | gibi: lyarwood: ^ | |
| 14:43:36 | Luzi | i am working on train and looking to upgrade soon | |
| 14:44:12 | Luzi | i posted the line of code which seems to be still on master | |
| 14:45:06 | fungi | same change deprecated live_migration_uri | |
| 14:45:36 | kashyap | (Yep) | |
| 14:46:22 | Luzi | in the guide the only config option which is mentioned is live_migration_with_native_tls = true | |
| 14:46:36 | Luzi | which is definitely not enough to enable native tls | |
| 14:46:40 | kashyap | Luzi: So, indeed - it checks if the config option is set, then uses the _scheme, if not defaults to TLS | |
| 14:47:20 | fungi | so alternatively, the document could warn that setting the _scheme will prevent a natural fallback to tls | |
| 14:47:21 | Luzi | well i thought it worked, until i started tcpdump | |
| 14:47:37 | Luzi | tcp | |
| 14:47:51 | Luzi | the default in code is tcp | |
| 14:48:10 | kashyap | Luzi: Err, defaults to TCP, I mean, I'm sorry. | |
| 14:48:22 | Luzi | the guid should at least say it is needed to set the _scheme to tls | |
| 14:48:38 | fungi | ayup, i agree it defaults to 'tcp' there | |
| 14:49:10 | kashyap | Luzi: Right; I'll check the installer code to double-confirm; and then can update the doc | |
| 14:49:20 | fungi | okay, so the doc just needs updating to mention setting live_migration_scheme="tls"? | |
| 14:49:37 | Luzi | i'm just worried, that this may also concern some users which did not check their deployment with a tcpdump :D | |
| 14:49:51 | fungi | it got mentioned in the release notes (under features) but yeah that's fairly hidden | |
| 14:50:17 | Luzi | it should be enough, to update the guide, i think | |
| 14:50:37 | fungi | and even the release note doesn't come out and say it's needed for turning on tls | |
| 14:50:58 | Luzi | fungi, yeah thats the point | |
| 14:51:06 | Luzi | i needed a whole day to find out :D | |