| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-11-25 | |||
| 18:23:39 | sean-k-mooney | we use castellan to provide a generic key manager https://github.com/openstack/castellan | |
| 18:24:06 | sean-k-mooney | and then barbican provides a secrets as a service api that endusers or sevices can use | |
| 18:24:34 | sean-k-mooney | castellan support barbican as a secret store and barbican support several backend to actully store the secrets | |
| 18:25:11 | EugenMayer | I'am yet not sure i will need either of this. all secrets except this one are handled in k8s, this one is just to provision rke2. So i might stick to a chef-databag here since i use it to provision rke2 anyway | |
| 18:25:48 | sean-k-mooney | if you dont need to expose secrets as a service via openstack by the way castalan can also use vault directly | |
| 18:25:55 | sean-k-mooney | https://github.com/openstack/castellan/blob/master/castellan/key_manager/vault_key_manager.py | |
| 18:27:10 | EugenMayer | interesting, simple wrapper to read/write from the KV | |
| 18:27:43 | sean-k-mooney | https://docs.openstack.org/nova/latest/configuration/config.html#key_manager.backend you just ned to set that to valult and populate the related config options that are needed | |
| 18:28:24 | sean-k-mooney | EugenMayer: i dont know how much its used/tested | |
| 18:29:12 | sean-k-mooney | i dont often work on this part of the code but hoefully that helps | |
| 18:29:22 | EugenMayer | I would not go the wrapper, arround the wrapper arround the wrapper way for this. If i need this, i will stick to vault directly IMHO. But it def. is good to know how things are handled and valued in the ecosystem | |
| 18:30:10 | EugenMayer | meta-data is plaintext only, eventhough per instance, can be exploited if having enough API access (obviously). barbican to the rescue, will require a token to read from the storage, so knowledge required | |
| 18:30:34 | sean-k-mooney | EugenMayer: metadata will also show up in your debug logs in some cases | |
| 18:30:47 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 18:30:48 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 18:31:07 | sean-k-mooney | so its really not intended for private stuff | |
| 18:32:01 | sean-k-mooney | EugenMayer: also just so you are aware instance metadta is included in nova notificaitons | |
| 18:33:02 | sean-k-mooney | amqp is ment to be secured because it contains sensitive things but its just more reason not to store passwords/keys in it if you can avoid it | |
| 18:35:50 | EugenMayer | understood, thank you! | |
| 18:50:48 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 18:55:16 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the powervm driver https://review.opendev.org/c/openstack/nova/+/819366 | |
| 18:56:38 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 19:01:12 | artom | Zombie developer removing zombie code | |
| 19:22:45 | stephenfin | mmm, brainz | |
| 19:50:03 | opendevreview | Merged openstack/nova master: db: Don't use legacy 'Row()' methods https://review.opendev.org/c/openstack/nova/+/817746 | |
| #openstack-nova - 2021-11-26 | |||
| 01:15:42 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 01:22:36 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 01:44:25 | opendevreview | Ghanshyam proposed openstack/nova master: Convert aggregate policies to admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | |
| 01:56:38 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 02:00:55 | gmann | dansmith: gibi bauzas I registered the nova BP for the RBAC goal. please let me know if I need to add spec or specless BP (with all direction defined in community wide goal) can be approved https://blueprints.launchpad.net/nova/+spec/policy-defaults-refresh-2 | |
| 02:03:08 | gmann | dansmith: gibi bauzas I mean all the direction are defined in goal itself so we can do audit of nova policy changes in proposed code itself or in wiki page before we code - https://wiki.openstack.org/wiki/Nova/rbac | |
| 02:03:24 | gmann | johnthetubaguy[m]: ^^ | |
| 08:25:11 | lyarwood | gibi / bauzas ; https://review.opendev.org/c/openstack/nova/+/819194 - would be good to get your thoughts on this btw | |
| 08:32:20 | gibi | lyarwood: do we want nova-tox-functional-centos8-py36 to be changed to run on py38? or that would require centos9? | |
| 08:32:56 | lyarwood | gibi: We can drop centos8-stream jobs entirely from master as the supported runtime is moving to 9 | |
| 08:33:24 | lyarwood | gibi: and yeah 9 then brings py39 iirc | |
| 08:34:00 | gibi | lyarwood: so then what I see in that change is consistent with the global testing runtime change | |
| 08:34:12 | gibi | ? | |
| 08:34:12 | gibi | lyarwood: do you have some reservation about this change/ | |
| 08:34:35 | lyarwood | gibi: Nope I'm good with it, gmann just had reservations so I wanted more people to chime in | |
| 08:35:01 | lyarwood | IMHO we should remove as much overhead as possible and that includes support/test runs for older runtimes | |
| 08:40:50 | gibi | lyarwood: OK, I gave +2, I agree with you that we need to force py38+ in the setup.cfg | |
| 08:41:12 | lyarwood | ack thanks, lets see what bauzas says as PTL before we +W | |
| 08:41:25 | gibi | sure | |
| 08:42:21 | gibi | stephenfin: as a fun note there is blue: https://blue.readthedocs.io/en/latest/ it is almost like black :D | |
| 08:42:42 | lyarwood | flol I love that logo | |
| 08:43:01 | gibi | I laught a lot the other day when somebody linked it in twitter | |
| 08:51:00 | gibi | I went and +2d the other yoga testing runtime changes under our jurisdiction | |
| 08:56:25 | kashyap | TIL; "blue" | |
| 08:56:26 | kashyap | :D | |
| 08:57:22 | gibi | somebody should start working on lightblue or even teal | |
| 08:59:10 | kashyap | :) | |
| 09:10:50 | gibi | gmann: re: RBAC: I don't have hard opinion. In one hand I see good dicsussion in https://review.opendev.org/c/openstack/nova-specs/+/793011 about a specific subset of the RBAC change, but on the other hand I don't think we need such discussion for all the policy during our audit. | |
| 09:11:39 | gibi | gmann: so I would be OK with a specles BP and a promise that if we find something non trivial during the audit then we might raise a spec for that | |
| 09:23:26 | bauzas | gibi: gmann: we can quickly discuss this BP for the next nova meeting | |
| 09:23:46 | bauzas | like we do for the others | |
| 09:23:59 | bauzas | lyarwood: looking | |
| 09:33:44 | bauzas | lyarwood: ok, so I'm happy with https://review.opendev.org/c/openstack/nova/+/819194/ but I guess we'll need centos jobs once they run on top of centos9 ? | |
| 09:33:51 | bauzas | I mean, devstack/centos9 | |
| 09:34:04 | bauzas | if you say so, let's +W it | |
| 09:34:09 | bauzas | but I'll add a comment | |
| 09:37:57 | lyarwood | bauzas: ACK yeah it's being worked on https://review.opendev.org/c/openstack/devstack/+/800903 | |
| 09:38:11 | bauzas | OK, I'll mention it then | |
| 09:38:38 | lyarwood | this isn't going to land until we drop the current centos 8 job from the integrated compute template btw | |
| 09:38:48 | lyarwood | so actually hold off on +W | |
| 09:39:15 | lyarwood | I'll throw something up to drop tempest-integrated-compute-centos-8-stream | |
| 09:39:19 | bauzas | I see | |
| 09:40:20 | bauzas | oh, saw the discussion on https://review.opendev.org/c/openstack/nova/+/819194/1/setup.cfg#b13 | |
| 09:40:24 | bauzas | I'll chime into in | |
| 09:40:26 | bauzas | it* | |
| 09:43:33 | lyarwood | oh crap I thought that was updated in this PS | |
| 09:43:43 | lyarwood | okay so -1 until that's actually blocked in setup.cfg | |
| 09:47:00 | bauzas | oh, shit, I just sent it to the gate. | |
| 09:47:32 | bauzas | lyarwood: I thought we had a consensus | |
| 09:47:46 | lyarwood | yeah but setup.cfg hadn't changed to reflect it | |
| 09:48:31 | lyarwood | I missed that earlier | |
| 09:48:53 | lyarwood | I thought the latest PS had changed, we were discussing stuff on an older PS that confused things | |
| 09:50:58 | bauzas | lyarwood: I eventually thought we said "OK but meh" | |
| 09:51:27 | bauzas | lyarwood: what we can is to provide a FUP for modifying setup.cfg, no ? | |
| 09:51:36 | bauzas | gibi: thoughts ? | |
| 09:51:52 | lyarwood | bauzas: yeah sure I can do that now | |
| 09:52:04 | lyarwood | apologies, that was my fault | |
| 09:52:04 | bauzas | lyarwood: cool, appreciated | |
| 09:52:23 | bauzas | lyarwood: no no it's me | |
| 09:52:34 | bauzas | I saw gibi +2ing it | |
| 09:53:05 | bauzas | and I thought the consensus was to say "nice talk, but let's just accept py36 to be unsupported but still used" | |
| 09:53:07 | bauzas | hence my comment | |
| 09:57:17 | opendevreview | Lee Yarwood proposed openstack/nova master: fup: Require python >= 3.8 from Yoga https://review.opendev.org/c/openstack/nova/+/819415 | |
| 09:57:32 | lyarwood | Yeah no issues, there's the fup anyway | |
| 09:57:39 | lyarwood | we can discuss more there | |
| 09:59:38 | lyarwood | tbh thinking about it we might want to broadcast something like this on the ML | |
| 09:59:47 | lyarwood | as it's going to break any centos8 stream jobs people have | |
| 10:01:42 | bauzas | lyarwood: yeah, you're right | |
| 10:13:40 | kashyap | Plug in approximate numbers for the first entries; hit "Start" and watch it roll | |
| 10:14:26 | lyarwood | https://zuul.opendev.org/t/openstack/build/4b3e8872abc54e96b992747b739b7d3b/log/job-output.txt looks like we need to update the LC job as well before this will work | |
| 10:15:40 | gibi | kashyap: 200 hourly rate?! I need to talk to my manager .... | |
| 10:16:15 | kashyap | gibi: It's usually managers and their managers that might have that hourly rate :D | |
| 10:16:39 | stephenfin | gibi: Nice :-D | |
| 10:17:46 | kashyap | gibi: The website is also US-based; as we know, the numbers won't be a 1-1 mapping for EU. | |
| 10:21:09 | gibi | I can imagine it maps to some EU countries but not to where I sit. :D | |