Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-03-16
15:21:31 gibi stephenfin: ack, I have no problem with 409, and I will review the series soon
15:52:32 openstackgerrit Kashyap Chamarthy proposed openstack/nova master: libvirt: Deprecate `live_migration_tunnelled` https://review.opendev.org/c/openstack/nova/+/780908
15:54:27 kashyap gibi: stephenfin: Would be nice to get it going in Wallaby --^. Will reduce some future "live migration config fatigue"
15:55:23 gibi kashyap: ack, I will check after the vdpa series
15:55:38 kashyap Sure; no prob. It's just a deprecation meta-work; that's all.
15:55:53 kashyap I'll add a code-reference in the change comment
15:58:41 lyarwood kashyap: random question, do we have coverage of live_migration_with_native_tls in the gate somewhere?
15:59:15 lyarwood kashyap: I can't find anything but that smells like something we should enable in nova-next at least
15:59:29 kashyap lyarwood: Good question, I do not know; and near as I know, no. It requires a full TLS env to be setup -- which is what TripleO does
15:59:44 kashyap See my prerequisite here: https://docs.openstack.org/nova/latest/admin/secure-live-migration-with-qemu-native-tls.html#prerequisites
16:00:33 kashyap lyarwood: I swear there is some automated test of this upstream (perhaps the upstream whitebox from OSP QE folks), can't find a link yet
16:01:14 lyarwood kashyap: yeah it's likely on the TripleO side and sorry I thought the virt tools would automate the CA creation etc, if not ignore me as it's going to be too much work to enable in devstack for nova-next etc
16:01:54 kashyap lyarwood: Yeah, it requires good old PKI setup. It _can_ be automated, using GnuTLS
16:02:10 kashyap lyarwood: If you don't mind holding your nose, something like ... https://kashyapc.fedorapeople.org/Auto-Setup-GnuTLS/Setup-GnuTLS-CA-and-ServerCert.bash
16:02:55 lyarwood that said we do have some novnc tls stuff in devstack so...
16:03:12 kashyap I see
16:03:36 kashyap But pretty sure I recall chatting w/ TripleO folks to have an automated test. Once I find a URL, I'll link it in the change or post here
16:30:13 bauzas gibi: others, folks, i'm taking an urgent PTO tomorrow, my wife is turning 40 as well
16:32:31 gibi bauzas: ack, have a nice celebration!
16:33:57 gibi bauzas: will you push a new rev from the rpc bump patch before you leave?
16:34:36 bauzas gibi: not sure :(
16:34:53 bauzas still fixing to not support 5.0
16:36:48 gibi bauzas: no worries just preparing my review queue
16:39:34 Luzi kashyap, are you around?
16:39:45 kashyap Luzi: Hi, yes
16:39:57 kashyap Luzi: So, I wanted to mention one more to thing to you, before you left
16:40:25 kashyap Luzi: If you want to see native TLS is *actually* in effect, you can verify it by a slightly tedious method in logs
16:40:37 kashyap Luzi: Is your env. production? Or do you have a staging setup?
16:40:47 Luzi testing setup
16:41:24 kashyap Luzi: Perfect. So here we go:
16:41:54 kashyap Luzi: What OS do you have? Ubuntu or Fedora? Doesn't matter: install the "libvirt-admin" tool
16:41:59 kashyap s/tool/package/
16:43:03 kashyap To get the 'virt-admin' tool. Note: Ubuntu might name it differently. So "grep" your package repository for the tool. In Fedora, I can do it like this: `dnf whatprovides *virt-admin`
16:43:25 kashyap Luzi: Then follow this to enable the dynamic libvirt log filters on your compute nodes: https://kashyapc.fedorapeople.org/virt/virt-admin.txt
16:45:32 kashyap Once you have that setup; you can migrate a guest, and then you can look for: `grep tls-creds-x509` on your source and destination libvirtd.log.
16:45:53 kashyap Luzi: Did you hav a different question for me? I began talking right after you pinged me :)
16:46:45 Luzi_ here again, needed to change to vpn
16:47:05 Luzi_ i missed the last 6 minutes or so - did you wrote something kashyap ?
16:47:32 kashyap Luzi_: Yes, I did post something. I was talking to myself. Let me post a pastebin
16:48:15 kashyap Luzi_: http://paste.openstack.org/show/803621/
16:50:25 kashyap Luzi_: For comparison, you should see commands like these in your _destination_ libvirt log file: https://kashyapc.fedorapeople.org/Native-TLS/Test-Evidence/DEST-QMP-commands-TLS-over-NBD-guestHyp2.log
16:54:36 kashyap Luzi_: I need to head out shortly. If you have a question, ask now :-) (Assuming you're not disconnected again.)
16:54:47 Luzi_ okay, it seems i adjusted the log level, I will now migrate with and without the config option set
17:02:05 Luzi_ kashyap, it seems the logs collected by the environment are having another log level, may be because of the deployment setting
17:02:09 gibi stephenfin: I'm +2 on the vdpa series, thanks for picking it up. The reno needs a respin as spotted by lyarwood.
17:02:43 Luzi_ i would still open a bug and display the commands i used to catch the traffic with - for both ways
17:05:57 gibi kashyap: Im +2 on the deprecation of the tunneled live migration patch
17:06:51 kashyap Luzi_: Strange, do you already have the config settings manually done in /etc/libvirt/libvirtd.conf?
17:07:01 Luzi_ maybe
17:07:25 kashyap Luzi_: Check if you have these two configs set in your /etc/libvirt/libvirtd.conf:
17:07:30 openstackgerrit Sylvain Bauza proposed openstack/nova master: Bump the Compute RPC API to version 6.0 https://review.opendev.org/c/openstack/nova/+/761452
17:07:30 kashyap - log_filters
17:07:31 kashyap - log_outputs
17:07:35 kashyap gibi: Thank you!
17:08:01 bauzas gibi: I eventually gave up given the time, and I just fixed dansmith's nits
17:08:36 bauzas dansmith: gibiI'll try to still work on no longer supporting 5.0 on Thursday
17:08:47 kashyap Luzi_: I need to head out for a walk, but feel free to gather your thoughts in a file.
17:10:11 kashyap (And email here, or post them in a non-expiring pastebin somewhere. I'll come back and check.)
17:13:48 kashyap Luzi_: In short, use either manual approach or the dynamic filters. See the "Gathering libvirt logs..." section here: https://kashyapc.fedorapeople.org/virt/openstack/request-nova-libvirt-qemu-debug-logs.txt
17:15:27 Luzi_ I need to head out too, so I just complete the bug report and maybe add some more tomorrow
17:20:22 gibi bauzas: ack, I will review what you pushed
17:20:28 gibi bauzas: have a nice PTO tomorrow
17:20:33 bauzas thanks
17:33:55 openstackgerrit Merged openstack/nova master: Remove VFSLocalFS https://review.opendev.org/c/openstack/nova/+/778506
19:41:53 openstackgerrit Stephen Finucane proposed openstack/nova master: libvirt: Delegate OVS plug to os-vif https://review.opendev.org/c/openstack/nova/+/602432
19:55:17 melwitt gmann: hey, wondering if you have seen this tempest-slow-py3 gate failure before ""tempest.scenario.test_network_v6.TestGettingAddress Bad router request: Cidr 2001:db8::/64 of subnet f3908f8d-a960-444f-9708-78ae906fbd63 overlaps with cidr 2001:db8::/64 of subnet d8fe1d15-5cdd-40e1-96e5-d1ac105253c3" I only see it on stable/stein in nova
19:55:37 melwitt https://zuul.opendev.org/t/openstack/build/0d21e41fc0294f1d891c484dea84adb6/logs
20:19:14 frickler melwitt: this looks related https://review.opendev.org/c/openstack/neutron/+/777389
20:20:28 melwitt frickler: that does look like it, thank you!
20:39:48 openstackgerrit Stephen Finucane proposed openstack/nova master: api: Block unsupported actions with vDPA https://review.opendev.org/c/openstack/nova/+/780333
20:39:48 openstackgerrit Stephen Finucane proposed openstack/nova master: pci: Add vDPA vnic to PCI request mapping and filtering https://review.opendev.org/c/openstack/nova/+/778350
20:39:49 openstackgerrit Stephen Finucane proposed openstack/nova master: Add release note for vDPA https://review.opendev.org/c/openstack/nova/+/780866
20:39:49 openstackgerrit Stephen Finucane proposed openstack/nova master: tests: Add functional test for vDPA device https://review.opendev.org/c/openstack/nova/+/780112
21:13:07 openstackgerrit Merged openstack/nova master: libvirt: Deprecate `live_migration_tunnelled` https://review.opendev.org/c/openstack/nova/+/780908
22:21:01 spotz Is there a maximum number of security groups you cane have? Not talking about quota restricted
22:37:02 melwitt spotz: security groups will be a question for the neutron team, nova hasn't done them since the olden days of nova-network
22:37:29 spotz haha thanks melwitt!
22:37:40 melwitt yw
22:47:21 openstackgerrit melanie witt proposed openstack/nova stable/stein: [stable-only] Specify IPv6 CIDR in tempest-slow-py3 https://review.opendev.org/c/openstack/nova/+/780991
#openstack-nova - 2021-03-17
00:57:12 melwitt lyarwood, elod: fix for tempest-slow-py3 on stable/stein for your consideration pls ^
07:24:30 openstackgerrit Josephine Seifert proposed openstack/nova master: Add config parameter 'live_migration_scheme' to live migration with tls guide https://review.opendev.org/c/openstack/nova/+/781030
07:31:42 Luzi kashyap, fungi i added a patch ^ for the documentation
08:21:41 gibi Luzi: thanks for that ^^
08:22:15 gibi stephenfin: an important doc fix ^^
08:23:46 gibi Luzi: will you propose the backports of that doc fix to stable branches?
08:23:55 gibi (after it merges to master?)
08:25:31 Luzi gibi, uh i've never done this, but i can try
08:26:14 gibi Luzi: cool, so when the fix merged to master, you can click cherry-pick on the gerrit web interface and select stable/victoria as target
08:26:27 Luzi okay thank you for the info :)
08:26:42 gibi just ping me if you get stuck
08:27:02 gibi we do the backport one stable branch at a time going backward in time so first we merge it to stable/victoria
08:27:29 gibi as far as I see the fix is applicable back until stable/stein
08:27:38 Luzi okay, i know we have to go back to at least train
08:28:12 Luzi yeah i will have a look into the code, when the change for the config option took place
08:35:54 gibi gmann: hi do I understand correctly that https://bugs.launchpad.net/nova/+bug/1918945 is not a regression so we don't need to mark it wallaby-rc-potential ?
08:35:56 openstack Launchpad bug 1918945 in OpenStack Compute (nova) "Nova API fails with 500s when called with non-project-scoped keystone tokens" [Undecided,New]
09:09:26 kashyap Luzi: Mornin; looking
09:09:41 kashyap Nit: The commit message's formatting is completely off
09:14:08 openstackgerrit Brin Zhang proposed openstack/nova master: Add missed accel_uuids for _poll_shelved_instances https://review.opendev.org/c/openstack/nova/+/778440
09:20:57 kashyap And yes, as Gibi says, backports are worth it.

Earlier   Later