| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-08-25 | |||
| 16:53:11 | sean-k-mooney | artom: that is what im going to do | |
| 17:01:33 | lbragstad | gmann so - i'm working through a test where a system-admin creates a server in a project (specifically trying to find what needs to change in KSA to make that possible) | |
| 17:02:21 | lbragstad | and it looks like the first failure is https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L265 because neutron is using a novaclient with a project-scoped token (instead of a system-scoped one) | |
| 17:03:35 | sean-k-mooney | that nova client should be using the token set in the neutron.conf | |
| 17:03:53 | sean-k-mooney | which woudl normally be the nova user or a service user | |
| 17:03:59 | lbragstad | yeah - exaclty | |
| 17:04:00 | lbragstad | and it does | |
| 17:04:02 | lbragstad | so - that's good | |
| 17:04:28 | sean-k-mooney | so the nova user would have to be a project member or if it was a system_memeber we need a new parmater to specifcy a project id i ugess | |
| 17:04:31 | sean-k-mooney | *guess | |
| 17:04:55 | sean-k-mooney | the api its calling however is admin only and not really proejct specfic | |
| 17:05:15 | sean-k-mooney | im surpised that is failing | |
| 17:05:25 | lbragstad | in https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L265 specifically - the nova user would need to be a system-admin https://github.com/openstack/nova/blob/master/nova/policies/server_external_events.py#L27 | |
| 17:05:40 | lbragstad | iiuc | |
| 17:05:41 | sean-k-mooney | yes | |
| 17:06:48 | sean-k-mooney | so the nova user woul dhave to be a system_admin | |
| 17:06:52 | lbragstad | right | |
| 17:07:10 | lbragstad | so that neutron can use that user with a client to create external events in nova | |
| 17:07:38 | sean-k-mooney | yes | |
| 17:07:46 | sean-k-mooney | its calling this endpoint https://docs.openstack.org/api-ref/compute/?expanded=run-events-detail#run-events | |
| 17:08:06 | lbragstad | in addition to that - we'd need a way to make sure neutron is using the right scope when building the auth request | |
| 17:08:24 | lbragstad | https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L61 | |
| 17:09:35 | sean-k-mooney | yep we woudl need to add a new config parmater ofor the scop to use | |
| 17:09:41 | sean-k-mooney | https://github.com/openstack/nova/blob/master/nova/policies/server_external_events.py#L24-L35 | |
| 17:09:54 | sean-k-mooney | in this case system scope | |
| 17:10:05 | lbragstad | and i imagine that's going to be a pattern we need else where? | |
| 17:10:43 | lbragstad | i'm expecting this is just the first time i'm hitting this issue, but there are other layers to the onion | |
| 17:11:00 | sean-k-mooney | well its going to happen but worse for volume resize | |
| 17:11:17 | sean-k-mooney | cinder currently has bug where it calls that endpoing with the users token | |
| 17:11:17 | lbragstad | sure - that makes sense | |
| 17:11:24 | sean-k-mooney | instead of actully using an admin one | |
| 17:12:01 | sean-k-mooney | but yes i expect the pattern to be the same or similar | |
| 17:12:23 | dansmith | sean-k-mooney: is that a bug, or just how it used to work? | |
| 17:12:26 | sean-k-mooney | im surprised that it got that far by the way | |
| 17:12:31 | sean-k-mooney | dansmith: no that is a bug | |
| 17:12:45 | sean-k-mooney | which ooo worked around by hardcodeing cidner to call nova admin api endpoint directly | |
| 17:12:57 | dansmith | is this the swap volume api or something else? | |
| 17:13:08 | lbragstad | fwiw - this is what i'm doing to recreate this https://review.opendev.org/c/openstack/tempest/+/805452 | |
| 17:13:17 | sean-k-mooney | i tought it was resize for nfs but ill have to go look it up | |
| 17:13:38 | sean-k-mooney | lbragstad: by the way i was expecting a failure before that when nova called neutron to bind the port | |
| 17:13:46 | lbragstad | yeah - me too | |
| 17:13:52 | sean-k-mooney | we do that as a admin | |
| 17:13:58 | dansmith | okay just saying.. the swap volume api has always been user-visible, but problematic.. people have used it for non-cinder tasks before and we discussed whether or not they should be able to.. but they are (or were) | |
| 17:14:36 | sean-k-mooney | dansmith: im pretty sure the issue i was refering too was for online volume resize whne cinder calls nova back to tell it its done | |
| 17:14:41 | sean-k-mooney | dansmith: ill see if i can find it | |
| 17:15:16 | dansmith | okay, there's some volume op that uses swap_volume for that sort of thing (cinder calling to nova) | |
| 17:15:20 | dansmith | but might be different | |
| 17:16:10 | sean-k-mooney | dansmith: i dont have the ooo one to hand but this is the osa dup https://bugs.launchpad.net/openstack-ansible/+bug/1902914 and redhat kcs...https://access.redhat.com/solutions/3675991 | |
| 17:17:01 | dansmith | okay I expect this is different | |
| 17:17:33 | sean-k-mooney | yes lbragstad current issue is different and expected | |
| 17:18:23 | sean-k-mooney | well expected in that each of the serviceis will need to know how to call each of the other services with the correct scopes | |
| 17:19:51 | sean-k-mooney | lbragstad: you could try booting an instance with no network as a simpler starting point | |
| 17:20:20 | sean-k-mooney | lbragstad: that would limit the interaction ot nova, keystone, glance and placment | |
| 17:20:47 | sean-k-mooney | placment would be the only thing that used any admin creds in that flwo also | |
| 17:20:59 | sean-k-mooney | we would use the user token for the glance image | |
| 17:22:19 | sean-k-mooney | im not 100% shoure what you would need to add but i think it would be something like network=none to your self.create_test_server( call | |
| 17:22:40 | lbragstad | yeah - that makes sense | |
| 17:24:13 | gmann | lbragstad: for system scope enabled. tempest does not create network | |
| 17:24:41 | gmann | lbragstad: that is skipped when create network was project scoped in neutron but that is changed i think | |
| 17:24:55 | lbragstad | ah - interesting | |
| 17:25:25 | gmann | lbragstad: | |
| 17:25:27 | gmann | lbragstad: https://review.opendev.org/c/openstack/tempest/+/798130 | |
| 17:26:21 | lbragstad | gmann is that still the case with https://review.opendev.org/c/openstack/tempest/+/805452/4/tempest/api/compute/admin/test_servers.py ? | |
| 17:26:26 | gmann | lbragstad: for network created for network, we need to modify that also to pass the project_id in neutron request for system scope | |
| 17:26:58 | gmann | lbragstad: yes. we have not changed that for ^^. and no network for system scoped cred | |
| 17:28:45 | gmann | I can work on that tomorrow to pass projetc_id as slaweq mentioned in that review | |
| 17:42:47 | lbragstad | gmann ok - that sounds good, i'm trying to track all of this stuff as a find it, but it's likely going to be a lot of sprawl | |
| 17:43:02 | lbragstad | stepping out for about 30 minutes | |
| 17:45:45 | opendevreview | melanie witt proposed openstack/placement master: Refactor consumer type methods for readability https://review.opendev.org/c/openstack/placement/+/806035 | |
| 17:46:35 | melwitt | sean-k-mooney, lyarwood: fixups for consumer types ^ | |
| 18:12:46 | sean-k-mooney | melwitt: im kind of +0.5 https://review.opendev.org/c/openstack/placement/+/806035/1/placement/objects/usage.py#91 | |
| 18:14:58 | melwitt | sean-k-mooney: thanks, I will reword it | |
| 18:22:45 | opendevreview | melanie witt proposed openstack/placement master: Refactor consumer type methods for readability https://review.opendev.org/c/openstack/placement/+/806035 | |
| 18:26:45 | sean-k-mooney | melwitt: by the way im just looking at the db tests i assume somehting in here https://github.com/openstack/nova/blob/master/nova/tests/unit/db/main/test_migrations.py that uses the OpportunisticDBTestMixin would be what you want for the alembic urls | |
| 18:30:34 | melwitt | sean-k-mooney: ah, cool. I have used that mixin once before I think. fwiw I wasn't clear on whether we need a database to cover some test inputs or if we only need the config parser behind it. whatever works | |
| 18:31:18 | melwitt | want to be able to do at least a couple of cases, one with the encoded chars and one with a password for example with a literal "%" in it | |
| 18:31:41 | melwitt | or I guess that could just be one case by putting both together in one example | |
| 18:32:28 | sean-k-mooney | ok im just going thought the different fixture we have aviable to us | |
| 18:32:30 | sean-k-mooney | https://github.com/openstack/oslo.db/blob/22b44ee18b1585bc2943a29ddaa18051cb1344ed/oslo_db/sqlalchemy/test_fixtures.py#L399 | |
| 18:32:46 | sean-k-mooney | we have the fix ture and the mixins | |
| 18:32:55 | melwitt | ah ok | |
| 18:33:39 | sean-k-mooney | the adhock db fixture allows us to pass a url https://github.com/openstack/oslo.db/blob/22b44ee18b1585bc2943a29ddaa18051cb1344ed/oslo_db/sqlalchemy/test_fixtures.py#L273 | |
| 18:34:30 | sean-k-mooney | the opertunistic mixin can be combind with any of the fixture i think | |
| 18:35:32 | sean-k-mooney | we need to modify the engin url if we want to test this right before tuning the db sync | |
| 18:36:56 | melwitt | meanwhile, the consumer types patches are failing on that dang server delete fail for AllocationDeleteFailed conflict 😑 | |
| 18:37:04 | sean-k-mooney | melwitt: i have updated stephens exisitng test case already just trying to see if theyer is a good way to also add the extra tests you where hoping for | |
| 18:37:46 | sean-k-mooney | if only there was a patch we could merge for that :) | |
| 18:37:52 | sean-k-mooney | thats furstrating | |
| 18:38:32 | melwitt | sean-k-mooney: ok, cool. lmk if you need a hand with it, I can try to help | |
| 20:01:31 | opendevreview | sean mooney proposed openstack/nova master: db: Handle parameters in DB strings https://review.opendev.org/c/openstack/nova/+/805663 | |
| 20:01:33 | sean-k-mooney | melwitt: ok that did not work but i found another way to test this | |
| 20:02:04 | sean-k-mooney | i realised after i fot the adhoc fixture working that would not test any of our config loading ectra | |
| 20:02:19 | sean-k-mooney | which is what we actully wanted to test | |
| 20:02:47 | sean-k-mooney | well initalising the alembic config form our config | |
| 20:10:26 | opendevreview | Artom Lifshitz proposed openstack/nova master: WIP: Update PCI requests in request spec on resize https://review.opendev.org/c/openstack/nova/+/806049 | |
| 20:15:41 | melwitt | sean-k-mooney: sweet! just added some comments | |
| 22:18:12 | opendevreview | Merged openstack/nova stable/wallaby: Allow X-OpenStack-Nova-API-Version header in CORS https://review.opendev.org/c/openstack/nova/+/796860 | |
| 22:18:15 | opendevreview | Merged openstack/placement master: Add consumer_types migration, database and object changes https://review.opendev.org/c/openstack/placement/+/669170 | |
| 22:18:30 | opendevreview | Merged openstack/placement master: Microversion 1.38: API support for consumer types https://review.opendev.org/c/openstack/placement/+/679441 | |
| 22:18:38 | opendevreview | Merged openstack/placement master: Switch ConsumerType to use an AttributeCache https://review.opendev.org/c/openstack/placement/+/679486 | |