| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-14 | |||
| 18:43:50 | sean-k-mooney | you likely dont want to use 755 for the mode | |
| 18:43:52 | sean-k-mooney | https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/nova_pre_install.yml#L92 | |
| 18:44:04 | sean-k-mooney | since that is world readable | |
| 18:44:14 | noonedeadpunk | good point | |
| 18:44:15 | sean-k-mooney | say 750 | |
| 18:44:38 | sean-k-mooney | or 650 for files | |
| 18:45:05 | noonedeadpunk | we should totally review that asap... | |
| 18:45:34 | noonedeadpunk | nova.conf is stored 0640 though | |
| 18:45:46 | sean-k-mooney | ack then its likely fin already | |
| 18:45:54 | noonedeadpunk | https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/nova_post_install.yml#L58-L81 | |
| 18:45:54 | sean-k-mooney | nova is part fo the libvirt group https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/drivers/kvm/nova_compute_kvm.yml#L56-L63 | |
| 18:45:57 | sean-k-mooney | which is corrct | |
| 18:46:08 | sean-k-mooney | and i dont see qemu or libvirt beign added to nova | |
| 18:46:18 | sean-k-mooney | so for osa they should not be able to read the nova.conf | |
| 18:47:27 | noonedeadpunk | yep, thanks a lot for checking that! We still should review directory permissions | |
| 18:54:02 | sean-k-mooney | no worries, security is important | |
| 18:54:28 | sean-k-mooney | eventually i hope ooo or some of the installer will start using https://docs.openstack.org/keystone/queens/user/application_credentials.html | |
| 18:54:39 | sean-k-mooney | in the config | |
| 18:58:25 | noonedeadpunk | I wish there was an ansible module ready for that... Shouldn't be that hard to write one though | |
| 19:01:10 | noonedeadpunk | but we have huge backlog of missed features anyway now :( we still haven't managed to implement service_tokens https://docs.openstack.org/keystone/latest/admin/manage-services.html#configuring-service-tokens | |
| 19:04:15 | noonedeadpunk | but the biggest issue I see with application credentials - is how to template config. So they should be stored somewhere after being created and managed... | |
| 19:15:13 | noonedeadpunk | and kind of rotating of regular credentials is not _that_ hard - a matter of re-running playbook with specific tags.... | |
| 19:15:55 | noonedeadpunk | I think the most challendging thing is to get aware that they got compromised | |
| 19:37:33 | opendevreview | Ade Lee proposed openstack/nova master: Add check job for FIPS https://review.opendev.org/c/openstack/nova/+/790519 | |
| 21:02:30 | opendevreview | Merged openstack/nova master: Make API fixture pass roles https://review.opendev.org/c/openstack/nova/+/819907 | |
| 22:27:57 | opendevreview | Merged openstack/nova master: Update Interop doc https://review.opendev.org/c/openstack/nova/+/816980 | |
| 22:28:04 | opendevreview | Merged openstack/nova master: api-ref: Adjust BFV rescue non-support note. https://review.opendev.org/c/openstack/nova/+/818823 | |
| #openstack-nova - 2022-01-15 | |||
| 02:58:47 | gmann | sean-k-mooney: i do not think neutron enforce scope by default. where you have seen that? | |
| 03:36:42 | sean-k-mooney[m] | in the error messageage int the log it was coplaining about token scope | |
| 08:42:26 | gibi | gmann: thanks | |
| 09:07:23 | frickler | maybe you should stop approving things while the gate is known broken. nova is currently holding up the integrated queue big time with their gate resets | |
| 10:54:05 | gibi | frickler: I not expect too much approval during the weekend, I can send a mail on the Monday to the ML if we still need to hold the approvals | |
| #openstack-nova - 2022-01-16 | |||
| 14:33:10 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:34:11 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:45:03 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 14:49:25 | opendevreview | Takashi Kajinami proposed openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 20:56:29 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | |
| 20:56:30 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Include pf mac and vf num in port updates https://review.opendev.org/c/openstack/nova/+/824833 | |
| 20:56:30 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: Filter computes without remote-managed ports early https://review.opendev.org/c/openstack/nova/+/812111 | |
| 20:56:31 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add support for VNIC_TYPE_SMARTNIC https://review.opendev.org/c/openstack/nova/+/824835 | |
| 20:56:31 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Introduce remote_managed tag for PCI devices https://review.opendev.org/c/openstack/nova/+/824834 | |
| #openstack-nova - 2022-01-17 | |||
| 00:52:42 | gmann | sean-k-mooney: no, neutron is not forcing scope. it is only warning in logs when enforce_scope is disabled. if enable the it fail with 403 not warning. that is from oslo side. | |
| 01:33:10 | opendevreview | Ghanshyam proposed openstack/nova master: Test PROJECT_ADMIN APIs with no legacy rule case https://review.opendev.org/c/openstack/nova/+/824845 | |
| 02:06:08 | opendevreview | Ghanshyam proposed openstack/nova master: Move rule_if_system() method to base test class https://review.opendev.org/c/openstack/nova/+/824475 | |
| 02:06:25 | opendevreview | Ghanshyam proposed openstack/nova master: Convert SYSTEM_ADMIN|READER to Admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | |
| 02:06:45 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 02:09:53 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 04:25:53 | opendevreview | Merged openstack/nova master: Fill the AcceleratorRequestBindingFailed exception msg info https://review.opendev.org/c/openstack/nova/+/817326 | |
| 07:49:13 | tkajinam | hello. I'd appreciate your attention to https://review.opendev.org/c/openstack/nova/+/824830 . we need this to fix package dependency in rdo, which is currently blocking CI jobs in some puppet module repos | |
| 08:03:10 | bauzas | tkajinam: ack, will look | |
| 08:06:02 | tkajinam | bauzas, thank you ! | |
| 08:51:42 | bauzas | gibi: other cores, 'd appreciate a quick +W on https://review.opendev.org/c/openstack/nova/+/824830 which fixes a critical bug | |
| 08:52:00 | bauzas | stephenfin: also, if you have time | |
| 08:52:20 | bauzas | melwitt: stephenfin: looks like we had a regression with https://review.opendev.org/c/openstack/nova/+/824280 | |
| 09:26:57 | gibi | bauzas: I've approved | |
| 09:27:03 | bauzas | ta | |
| 09:27:07 | bauzas | tkajinam: ^ | |
| 09:27:08 | gibi | bauzas: but I would like to do a follow up to clean things up | |
| 09:27:17 | gibi | as the dependency should be really just in the test | |
| 09:27:28 | bauzas | gibi: I have zero context about the original patch | |
| 09:27:43 | bauzas | but I saw we add fixtures for monkeypatching eventlet, right? | |
| 09:27:57 | gibi | right | |
| 09:28:11 | bauzas | as we pull nova.utils now, we also pull fixtures | |
| 09:28:14 | gibi | it is used for the fasteners rw lock | |
| 09:28:19 | bauzas | that's what I saw | |
| 09:28:23 | gibi | but that is only used in test | |
| 09:29:22 | gibi | so the rw lock wrapper can be moved back to the test code tree | |
| 09:29:54 | gibi | or at least that is my working assumption now | |
| 09:32:14 | tkajinam | bauzas, gibi hmmm... sorry do you mind blocking https://review.opendev.org/c/openstack/nova/+/824830 by -2 or -Workflow ? | |
| 09:32:52 | tkajinam | I'll look into that cleaner approach. we need to update requirements in rdo but it doesn't make much sense if we revert it very soon | |
| 09:32:57 | bauzas | tkajinam: no I guess we can move on | |
| 09:33:08 | bauzas | or revert if needed | |
| 09:33:24 | tkajinam | ok | |
| 09:33:48 | bauzas | gibi: do you think you could do something before we merge https://review.opendev.org/c/openstack/nova/+/824830 ? | |
| 09:34:05 | bauzas | I'd personnally let the fix be merged | |
| 09:34:17 | bauzas | I've tagged the bug as critical as it's holding other projects | |
| 09:34:47 | bauzas | and once the gate is back happy, we can sort the things up and revert what we need | |
| 09:34:56 | bauzas | but without any rush | |
| 09:35:02 | bauzas | agreed ? | |
| 09:35:12 | gibi | let land the fix | |
| 09:36:16 | tkajinam | ack. thank you for your time and thoughts, bauzas and gibi ! | |
| 09:40:25 | gibi | tkajinam: thank you for proposing the fix | |
| 10:31:23 | opendevreview | Merged openstack/nova master: Close Glance image if downloading failed. https://review.opendev.org/c/openstack/nova/+/815347 | |
| 11:14:54 | opendevreview | Merged openstack/nova master: Add fixtures to requirements https://review.opendev.org/c/openstack/nova/+/824830 | |
| 11:35:05 | sean-k-mooney | fixtures should be in test-requirements not requirements but otherwise adding it makes sense | |
| 11:35:25 | sean-k-mooney | oh it was moved that is not correct | |
| 11:36:55 | sean-k-mooney | is see how its used https://review.opendev.org/c/openstack/nova/+/824280/1/nova/utils.py and where the dep comes form | |
| 11:37:04 | sean-k-mooney | btu we should not use fixtures for that | |
| 11:40:42 | sean-k-mooney | is there a patch up to remove fixutres form nova.utils. you can do exactly the same with unittest.mock | |
| 11:40:52 | gibi | sean-k-mooney: the RW lock is only used in our test code so we move the RW wrapper in our test path and move back the fixtures deps to test-reqs | |
| 11:40:58 | gibi | I'm about to push a patch for it | |
| 11:41:10 | sean-k-mooney | ok | |
| 11:41:29 | sean-k-mooney | is this a differnt RWlock then the tempest one | |
| 11:41:37 | sean-k-mooney | im not sure why we woudl need it in nova code | |
| 11:42:09 | sean-k-mooney | as in i dont think we need the interprocess one | |
| 11:42:10 | gibi | sean-k-mooney: hehe, it is the same RW lock | |
| 11:42:50 | gibi | hm, no it is not inter process | |
| 11:43:04 | sean-k-mooney | ok just a normal rwlock | |
| 11:43:27 | gibi | yepp | |
| 11:44:02 | sean-k-mooney | ok that makes more sense to me i was like why have we suddenly got multiple processes in our func/unit tests :) | |