| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-11-24 | |||
| 14:11:36 | sean-k-mooney | oh i miss read that | |
| 14:11:47 | sean-k-mooney | you ment https://review.opendev.org/c/openstack/neutron/+/818338/3/neutron/agent/linux/interface.py#419 | |
| 14:12:06 | sean-k-mooney | i think that shoudl also work for ovs-dpdk | |
| 14:12:51 | ralonsoh | OK, I'll comment that in the review. Actually this should be present in the namespace | |
| 14:12:52 | sean-k-mooney | addint the device to a network namespace shoudl work fine however it likely shoudl haveppn after the network namespaces is set on the ovs db and that shoudl eb done during prot add | |
| 14:13:29 | sean-k-mooney | if we set the netns namespace option one woudl think so yes | |
| 14:13:59 | ralonsoh | perfect, so first execute "_ovs_add_port" adding the netns and then ensuring the TAP port namespace | |
| 18:08:50 | opendevreview | Julia Kreger proposed openstack/nova master: WIP Ironic - Handle instance/node host on rebalance https://review.opendev.org/c/openstack/nova/+/813897 | |
| 20:02:04 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | |
| 20:02:05 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | |
| 20:03:47 | sdmitriev1 | Hello there! Guys, what has to be done to get this one merged https://review.opendev.org/c/openstack/nova/+/710848/ ? | |
| 20:04:16 | sdmitriev1 | We're suffering from bug https://bugs.launchpad.net/nova/+bug/1860555 and that patch seems to able to resolve it | |
| 20:12:38 | dmitriis | sean-k-mooney: commented on https://review.opendev.org/c/openstack/nova-specs/+/787458/comment/21a5f948_b415eeea/ and added a pre-filter implementation that takes presence of remote_managed device pools into account in patch set 8 https://review.opendev.org/c/openstack/nova/+/812111/8 | |
| 22:51:17 | opendevreview | Ghanshyam proposed openstack/nova master: Updating tests with Yoga testing runtime https://review.opendev.org/c/openstack/nova/+/819194 | |
| #openstack-nova - 2021-11-25 | |||
| 00:08:08 | opendevreview | Ghanshyam proposed openstack/osc-placement master: Updating python testing as per Yoga testing runtime https://review.opendev.org/c/openstack/osc-placement/+/819203 | |
| 00:08:13 | opendevreview | Ghanshyam proposed openstack/os-vif master: Updating python testing as per Yoga testing runtime https://review.opendev.org/c/openstack/os-vif/+/819204 | |
| 00:08:15 | opendevreview | Ghanshyam proposed openstack/os-traits master: Updating python testing as per Yoga testing runtime https://review.opendev.org/c/openstack/os-traits/+/819205 | |
| 00:08:16 | opendevreview | Ghanshyam proposed openstack/placement master: Updating python testing as per Yoga testing runtime https://review.opendev.org/c/openstack/placement/+/819206 | |
| 00:16:29 | opendevreview | Ghanshyam proposed openstack/os-resource-classes master: Test all supported python version https://review.opendev.org/c/openstack/os-resource-classes/+/819207 | |
| 00:16:50 | opendevreview | Ghanshyam proposed openstack/python-novaclient master: Updating python testing as per Yoga testing runtime https://review.opendev.org/c/openstack/python-novaclient/+/819208 | |
| 03:21:22 | mnaser | sdmitriev1: perhaps you can take the time to fix the merge conflict? | |
| 08:50:00 | bauzas | happy turkey day everyone | |
| 08:50:42 | nautik | Hello! I updated a merge request from a few months ago and it seems there is a "DellEMC PowerFlex CI" build failing with a message "EMC_PowerFlex_NOVA [...] : NOT_REGISTERED". Other builds (VMware, IBM...) succeeded. | |
| 08:50:56 | nautik | is that expected or should I do something about it? | |
| 08:50:59 | nautik | the mr is https://review.opendev.org/c/openstack/nova/+/781076 | |
| 08:56:24 | frickler | nautik: that means that this 3rd party CI is offline. not related to your patch, nothing you can do about it | |
| 08:57:26 | frickler | except possibly trying to contact the CI operators, but that task should be on the nova team in general, not on you as patch author | |
| 09:07:01 | nautik | ok cool! thank you for the feedback, then this MR is ready for review | |
| 09:07:42 | nautik | (not sure if I need to add some tags or do anything more to make it visible?) | |
| 09:11:44 | frickler | nautik: just give it a couple of days, this week is also holiday season in some parts of the world. I there is no response after that, you could try pinging folks here again | |
| 09:12:06 | frickler | s/I/If/ | |
| 09:15:39 | nautik | right, forgot that! Thank you and have a good day :) | |
| 12:17:37 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | |
| 13:05:57 | opendevreview | Merged openstack/nova master: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/818503 | |
| 13:44:16 | sdmitriev1 | mnaser: good call, will look into that | |
| 13:55:13 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/xena: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819179 | |
| 13:55:27 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/wallaby: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819180 | |
| 13:55:39 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/victoria: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819181 | |
| 14:09:24 | lyarwood | gibi: https://review.opendev.org/c/openstack/nova/+/818357 would you mind taking a look at this? | |
| 14:09:29 | gibi | sure | |
| 14:11:51 | gibi | done | |
| 14:11:55 | gibi | thanks for updating our docs | |
| 15:07:11 | opendevreview | Merged openstack/nova stable/xena: Ensure MAC addresses characters are in the same case https://review.opendev.org/c/openstack/nova/+/816882 | |
| 15:52:21 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 15:52:22 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:00:41 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:00:41 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 16:21:43 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 16:21:58 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:56:51 | opendevreview | Ghanshyam proposed openstack/nova master: Updating tests with Yoga testing runtime https://review.opendev.org/c/openstack/nova/+/819194 | |
| 17:38:34 | opendevreview | Ghanshyam proposed openstack/nova master: Updating tests with Yoga testing runtime https://review.opendev.org/c/openstack/nova/+/819194 | |
| 17:40:51 | opendevreview | Merged openstack/nova master: docs: Update libvirt distro support matrix for Xena https://review.opendev.org/c/openstack/nova/+/818357 | |
| 17:44:40 | EugenMayer | What are the thoughs about moving secrets into the meta-data service which are shared e.g. by cluster nodes? Is this considered heavily unsecure? AFAIC each instance can only access it's own meta-data and cannot read any other instance meta-data, right? (Is this actually a nova or neutron question?) | |
| 18:16:13 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 18:16:14 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 18:16:34 | sean-k-mooney | EugenMayer: am well you are partly correct | |
| 18:16:49 | sean-k-mooney | EugenMayer: ech isntance is only able to access its onw metadata | |
| 18:16:59 | sean-k-mooney | however the metadata is also avaiable vai the api | |
| 18:17:20 | sean-k-mooney | so anywone in the project can access it via the api | |
| 18:17:30 | EugenMayer | yes sure, every openstack admin cann access it .. but this one can also simply access the storage and read anything. | |
| 18:17:45 | sean-k-mooney | we also do not encypty the metaddat in any way in the nova db or when its sent to the instance | |
| 18:18:11 | EugenMayer | I understand. It is plain text, send plain text | |
| 18:18:21 | sean-k-mooney | yep | |
| 18:18:38 | sean-k-mooney | so as an end user you can do this but you really shoudl use barbican | |
| 18:19:00 | sean-k-mooney | https://docs.openstack.org/barbican/latest/ | |
| 18:19:25 | sean-k-mooney | EugenMayer: it provices and implementation fo a secure key manager which user and openstack can use | |
| 18:19:29 | EugenMayer | interesting - usually i would rather use vault | |
| 18:20:54 | sean-k-mooney | EugenMayer: it has a vault plugin | |
| 18:21:05 | sean-k-mooney | https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html#enabling-multiple-barbican-backends | |
| 18:21:18 | EugenMayer | what is the actually key USP of barbican compared to vault? Is there any auto-scoping of instances into "their namespace" or something like that? If it is just "if you have a speciifc token you can check in a secret KV for values you are interested in" i rather would use vault | |
| 18:21:19 | EugenMayer | i see | |
| 18:23:15 | EugenMayer | sean-k-mooney: i know i repeat myself - but nevertheless, thank you very much! | |
| 18:23:16 | sean-k-mooney | EugenMayer: basically openstack a as a project has decalred that we will not manage securets in each project | |
| 18:23:39 | sean-k-mooney | we use castellan to provide a generic key manager https://github.com/openstack/castellan | |
| 18:24:06 | sean-k-mooney | and then barbican provides a secrets as a service api that endusers or sevices can use | |
| 18:24:34 | sean-k-mooney | castellan support barbican as a secret store and barbican support several backend to actully store the secrets | |
| 18:25:11 | EugenMayer | I'am yet not sure i will need either of this. all secrets except this one are handled in k8s, this one is just to provision rke2. So i might stick to a chef-databag here since i use it to provision rke2 anyway | |
| 18:25:48 | sean-k-mooney | if you dont need to expose secrets as a service via openstack by the way castalan can also use vault directly | |
| 18:25:55 | sean-k-mooney | https://github.com/openstack/castellan/blob/master/castellan/key_manager/vault_key_manager.py | |
| 18:27:10 | EugenMayer | interesting, simple wrapper to read/write from the KV | |
| 18:27:43 | sean-k-mooney | https://docs.openstack.org/nova/latest/configuration/config.html#key_manager.backend you just ned to set that to valult and populate the related config options that are needed | |
| 18:28:24 | sean-k-mooney | EugenMayer: i dont know how much its used/tested | |
| 18:29:12 | sean-k-mooney | i dont often work on this part of the code but hoefully that helps | |
| 18:29:22 | EugenMayer | I would not go the wrapper, arround the wrapper arround the wrapper way for this. If i need this, i will stick to vault directly IMHO. But it def. is good to know how things are handled and valued in the ecosystem | |
| 18:30:10 | EugenMayer | meta-data is plaintext only, eventhough per instance, can be exploited if having enough API access (obviously). barbican to the rescue, will require a token to read from the storage, so knowledge required | |
| 18:30:34 | sean-k-mooney | EugenMayer: metadata will also show up in your debug logs in some cases | |
| 18:30:47 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 18:30:48 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 18:31:07 | sean-k-mooney | so its really not intended for private stuff | |
| 18:32:01 | sean-k-mooney | EugenMayer: also just so you are aware instance metadta is included in nova notificaitons | |
| 18:33:02 | sean-k-mooney | amqp is ment to be secured because it contains sensitive things but its just more reason not to store passwords/keys in it if you can avoid it | |
| 18:35:50 | EugenMayer | understood, thank you! | |
| 18:50:48 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 18:55:16 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the powervm driver https://review.opendev.org/c/openstack/nova/+/819366 | |
| 18:56:38 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 19:01:12 | artom | Zombie developer removing zombie code | |
| 19:22:45 | stephenfin | mmm, brainz | |
| 19:50:03 | opendevreview | Merged openstack/nova master: db: Don't use legacy 'Row()' methods https://review.opendev.org/c/openstack/nova/+/817746 | |
| #openstack-nova - 2021-11-26 | |||
| 01:15:42 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 01:22:36 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |