| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-03-16 | |||
| 12:10:27 | k-s-dean | any reason why you have 15 instances in the placement database and 10 instances on the hypervisor. | |
| 12:10:44 | k-s-dean | can you run virsh list --all on the host ? | |
| 12:28:08 | gibi | kashyap: I guess https://review.opendev.org/c/openstack/nova/+/682627 is not a mandatory part of the secure boot feature for W | |
| 12:28:14 | gibi | am I correct? | |
| 12:28:43 | gibi | the rest of the secure boot series landed | |
| 12:29:19 | kashyap | gibi: Cool; just see it in the scrollback. So that auto-detect can come later -- unfortunately, a bug in libvirt blocking that :-( | |
| 12:29:36 | gibi | kashyap: ack, then marking the bp implemented for W | |
| 12:29:37 | gibi | thanks | |
| 12:30:07 | kashyap | gibi: Thank you. And stephenfin, particularly | |
| 12:33:11 | gibi | stephenfin: will you resolve the merge conflict in the vdpa series? | |
| 12:33:29 | stephenfin | working on it atm | |
| 12:33:39 | gibi | cool | |
| 12:33:43 | gibi | thanks | |
| 12:57:11 | openstackgerrit | Lee Yarwood proposed openstack/nova stable/train: Make _rebase_with_qemu_img() generic https://review.opendev.org/c/openstack/nova/+/780782 | |
| 12:57:12 | openstackgerrit | Lee Yarwood proposed openstack/nova stable/train: Use absolute path during qemu img rebase https://review.opendev.org/c/openstack/nova/+/757084 | |
| 13:38:18 | gibi | is there anything that I should review now? | |
| 13:49:27 | hkominos | k-s-dean virsh list all shows (or did show 10) VMs | |
| 13:49:51 | hkominos | now why placement thought 15 Is because it had some garbage VMs that did not spawn on this node. | |
| 13:50:30 | k-s-dean | Those should have been cleaned up. | |
| 13:51:02 | hkominos | Will do | |
| 13:58:56 | openstackgerrit | Elod Illes proposed openstack/nova stable/pike: [stable-only] gate: Pin CEPH_RELEASE to nautilus in LM hook https://review.opendev.org/c/openstack/nova/+/780852 | |
| 14:10:14 | stephenfin | gibi: I'm reworking Sean's "block unsupported ops with vDPA interface" patch to return HTTP 409 (Conflict) instead of HTTP (Forbidden) since that seems more sensible. It's not a permissions or access issue, IMO. Do you agree? | |
| 14:31:57 | Luzi | hey, is someone around who knows the qemu native tls config options? I think i might have found a bug in the guide: https://docs.openstack.org/nova/latest/admin/secure-live-migration-with-qemu-native-tls.html | |
| 14:34:53 | kashyap | Luzi: Hi, I think I wrote that doc :) | |
| 14:35:05 | kashyap | Luzi: What's the bug? Feel free to amend / send a pull-req :) | |
| 14:35:20 | kashyap | s/pull-req/patch/ | |
| 14:36:20 | kashyap | At the bottom right, there is also "found an error? report a bug" | |
| 14:36:34 | Luzi | i followed that guide but got to a point when openstack did not use the tls path, but kept using the tcp path | |
| 14:36:56 | Luzi | i onlny found out because i used tcpdump on both ports | |
| 14:37:55 | kashyap | Luzi: Hmm, if you followed that guide to the word, then your setup should definitely be using the QEMU-native TLS | |
| 14:38:49 | Luzi | i was looking through code and found out, that the uri used for live migration is different from the connection uri and uses a config option not mentioned in the guide | |
| 14:39:21 | kashyap | Luzi: Hmm, possible the guide got slightly outdated ... as migration-related code got reworked | |
| 14:39:22 | Luzi | only after i set live_migration_scheme = tls | |
| 14:39:32 | Luzi | the traffic was encrypted | |
| 14:39:44 | Luzi | and using the correct port :) | |
| 14:41:06 | kashyap | Luzi: I see. That's correct _scheme is favoured | |
| 14:41:19 | kashyap | And _uri parameter is deprecated in favor of the above | |
| 14:41:41 | Luzi | but when you don't set it, as i had not done it, the code uses the hardcoded tcp parameter | |
| 14:41:44 | fungi | looks like that config option was added by https://review.openstack.org/410817 which merged in early 2017 | |
| 14:42:08 | kashyap | fungi: Heya; yep. That timeframe is right ... /me clicks | |
| 14:42:35 | kashyap | Yep; patch is also correct. | |
| 14:42:43 | Luzi | live_migration_scheme = tls | |
| 14:42:45 | fungi | first appeared in nova 15.0.0, so ocata and later | |
| 14:42:48 | kashyap | Luzi: Also you don't tell what version of OpenStack you were using? | |
| 14:43:13 | kashyap | Yeah, what fungi says. | |
| 14:43:19 | Luzi | https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L1224 | |
| 14:43:23 | openstackgerrit | Stephen Finucane proposed openstack/nova master: pci: Add vDPA vnic to PCI request mapping and filtering https://review.opendev.org/c/openstack/nova/+/778350 | |
| 14:43:24 | openstackgerrit | Stephen Finucane proposed openstack/nova master: tests: Add functional test for vDPA device https://review.opendev.org/c/openstack/nova/+/780112 | |
| 14:43:24 | openstackgerrit | Stephen Finucane proposed openstack/nova master: api: Block unsupported actions with vDPA https://review.opendev.org/c/openstack/nova/+/780333 | |
| 14:43:25 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Add release note for vDPA https://review.opendev.org/c/openstack/nova/+/780866 | |
| 14:43:25 | openstackgerrit | Stephen Finucane proposed openstack/nova master: WIP: tests: Make mdev stubs work like vDPA https://review.opendev.org/c/openstack/nova/+/780234 | |
| 14:43:31 | stephenfin | gibi: lyarwood: ^ | |
| 14:43:36 | Luzi | i am working on train and looking to upgrade soon | |
| 14:44:12 | Luzi | i posted the line of code which seems to be still on master | |
| 14:45:06 | fungi | same change deprecated live_migration_uri | |
| 14:45:36 | kashyap | (Yep) | |
| 14:46:22 | Luzi | in the guide the only config option which is mentioned is live_migration_with_native_tls = true | |
| 14:46:36 | Luzi | which is definitely not enough to enable native tls | |
| 14:46:40 | kashyap | Luzi: So, indeed - it checks if the config option is set, then uses the _scheme, if not defaults to TLS | |
| 14:47:20 | fungi | so alternatively, the document could warn that setting the _scheme will prevent a natural fallback to tls | |
| 14:47:21 | Luzi | well i thought it worked, until i started tcpdump | |
| 14:47:37 | Luzi | tcp | |
| 14:47:51 | Luzi | the default in code is tcp | |
| 14:48:10 | kashyap | Luzi: Err, defaults to TCP, I mean, I'm sorry. | |
| 14:48:22 | Luzi | the guid should at least say it is needed to set the _scheme to tls | |
| 14:48:38 | fungi | ayup, i agree it defaults to 'tcp' there | |
| 14:49:10 | kashyap | Luzi: Right; I'll check the installer code to double-confirm; and then can update the doc | |
| 14:49:20 | fungi | okay, so the doc just needs updating to mention setting live_migration_scheme="tls"? | |
| 14:49:37 | Luzi | i'm just worried, that this may also concern some users which did not check their deployment with a tcpdump :D | |
| 14:49:51 | fungi | it got mentioned in the release notes (under features) but yeah that's fairly hidden | |
| 14:50:17 | Luzi | it should be enough, to update the guide, i think | |
| 14:50:37 | fungi | and even the release note doesn't come out and say it's needed for turning on tls | |
| 14:50:58 | Luzi | fungi, yeah thats the point | |
| 14:51:06 | Luzi | i needed a whole day to find out :D | |
| 14:51:22 | kashyap | fungi: Yep - on the doc needs updating. Luzi: Good catch! | |
| 14:51:46 | fungi | Luzi: if you're worried that we need to do some outreach, the typical process for that is an openstack security note: https://wiki.openstack.org/wiki/Security/Security_Note_Process | |
| 14:52:00 | Luzi | i need to go off now, thank you for replying so quickly kashyap and fungi :) | |
| 14:52:03 | kashyap | Luzi: So you need _both_: | |
| 14:52:06 | kashyap | - live_migration_scheme | |
| 14:52:14 | fungi | once published, we can send a copy to the openstack-announce and openstack-discuss mailing lists | |
| 14:52:16 | kashyap | - live_migration_with_native_tls | |
| 14:52:44 | Luzi | fungi, i will do that when i'm at home :) | |
| 14:52:47 | Luzi | kashyap, yes | |
| 14:54:57 | kashyap | (Ah, Luzi is gone before I wanted to mention a way to actually verify how to check native TLS is in effect for disks during migration w/ low-level logs.) | |
| 15:03:54 | lyarwood | stephenfin: https://review.opendev.org/c/openstack/nova/+/780333 - quick commit message nit in there but otherwise LGTM | |
| 15:07:19 | openstackgerrit | Stephen Finucane proposed openstack/nova master: tests: Add functional test for vDPA device https://review.opendev.org/c/openstack/nova/+/780112 | |
| 15:07:19 | openstackgerrit | Stephen Finucane proposed openstack/nova master: api: Block unsupported actions with vDPA https://review.opendev.org/c/openstack/nova/+/780333 | |
| 15:07:20 | openstackgerrit | Stephen Finucane proposed openstack/nova master: WIP: tests: Make mdev stubs work like vDPA https://review.opendev.org/c/openstack/nova/+/780234 | |
| 15:07:20 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Add release note for vDPA https://review.opendev.org/c/openstack/nova/+/780866 | |
| 15:08:10 | lyarwood | ta | |
| 15:17:37 | lyarwood | stephenfin: https://review.opendev.org/c/openstack/nova/+/780866 - same in the releasenote btw | |
| 15:17:49 | stephenfin | gdi :) | |
| 15:17:59 | stephenfin | will fix | |
| 15:18:36 | lyarwood | np my review ratio thanks you ;) | |
| 15:18:56 | lyarwood | joys of being a stable core | |
| 15:21:31 | gibi | stephenfin: ack, I have no problem with 409, and I will review the series soon | |
| 15:52:32 | openstackgerrit | Kashyap Chamarthy proposed openstack/nova master: libvirt: Deprecate `live_migration_tunnelled` https://review.opendev.org/c/openstack/nova/+/780908 | |
| 15:54:27 | kashyap | gibi: stephenfin: Would be nice to get it going in Wallaby --^. Will reduce some future "live migration config fatigue" | |
| 15:55:23 | gibi | kashyap: ack, I will check after the vdpa series | |
| 15:55:38 | kashyap | Sure; no prob. It's just a deprecation meta-work; that's all. | |