| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-25 | |||
| 13:55:12 | elodilles | bauzas: thx, done | |
| 14:51:41 | sean-k-mooney | bauzas: you were asking previously about adressless port and why nova needs to check the connectivty? | |
| 14:51:49 | sean-k-mooney | did you get an answer | |
| 14:51:52 | sean-k-mooney | its a security issue | |
| 14:52:26 | sean-k-mooney | for backends like calico that provie l3 only connectivity its invlade to use l2 networking and it will not be fucntional | |
| 14:53:13 | sean-k-mooney | in general port with l2 connectivy and no ip will not work with security groups proerly | |
| 14:53:43 | sean-k-mooney | techincally you can magch on thernet type but almost all security group rules assme an ip | |
| 14:54:05 | sean-k-mooney | the check tha tnova needs to is basicaly a simple reasonablness check | |
| 14:54:29 | sean-k-mooney | e.g. is it reasonable given the info provide by neutron that the port would be usable without an addres. | |
| 14:54:36 | sean-k-mooney | if the the connectivy type is l2 then yes | |
| 14:54:40 | sean-k-mooney | if l3 then no | |
| 14:54:42 | sean-k-mooney | simple as that | |
| 14:55:38 | sean-k-mooney | bauzas: ralonsoh the connectivy par to fhte spec shoudl already be implemented in neutron | |
| 14:55:59 | sean-k-mooney | the binding driver info is not implemtned but that is not needed for adress less ports | |
| 14:57:28 | sean-k-mooney | here is where ml2/ovs reports l2 connectivy for example https://github.com/openstack/neutron/blob/master/neutron/plugins/ml2/drivers/openvswitch/mech_driver/mech_openvswitch.py#L59-L61 | |
| 14:58:20 | sean-k-mooney | the main issue we have is this is obviouls a late fail on the compute node when we attpemt to do the port binding | |
| 14:58:53 | sean-k-mooney | but that is better then booting with out any networking | |
| 15:00:13 | sean-k-mooney | all of the in tree drivers supprot this feature as far as i am aware | |
| 15:00:21 | sean-k-mooney | and they all provide l2 connectivity | |
| 15:00:34 | sean-k-mooney | calico is really the only one i know of that is l3 only | |
| 15:07:47 | bauzas | sean-k-mooney: ralonsoh told me that eventually Neutron verified the backend | |
| 15:07:51 | bauzas | (from Train) | |
| 15:08:22 | bauzas | sean-k-mooney: https://review.opendev.org/c/openstack/neutron/+/678027 | |
| 15:08:34 | sean-k-mooney | it may but i think nova should still enforce the connectivy | |
| 15:08:37 | bauzas | folks, nova meeting in 52 mins here at #openstack-nova | |
| 15:08:58 | bauzas | sean-k-mooney: honestly, gibi and me were asking for that | |
| 15:09:14 | bauzas | see the discussion we had this morning | |
| 15:09:30 | sean-k-mooney | asking for nova ot also enforce it or just relay on neutron | |
| 15:10:01 | gibi | if neutron enforces it then I think nova does not need to enforce it | |
| 15:10:25 | ralonsoh | the port connectivity parameter was for Nova | |
| 15:10:36 | sean-k-mooney | i guess im just surpesed because neutron did not want to enfoce it orginally which is why we added the connectivy | |
| 15:10:39 | ralonsoh | in Neutron we check the backend connectivity (doesn't need to be in the port) | |
| 15:10:46 | ralonsoh | and if the port has or not IP addresses | |
| 15:11:23 | ralonsoh | sean-k-mooney, https://review.opendev.org/c/openstack/neutron/+/678027/3/neutron/plugins/ml2/managers.py | |
| 15:11:27 | sean-k-mooney | right but we added the connectivty parmater becasue neuton did not want to do that backend check when we first dicussed this featre | |
| 15:11:28 | ralonsoh | is this what you need? | |
| 15:12:01 | sean-k-mooney | yes but that means we dont need the connectivty parmater in the respocne any more | |
| 15:12:22 | ralonsoh | so we can remove it from the port dict | |
| 15:12:33 | opendevreview | Merged openstack/nova master: libvirt: Create qcow2 disks with the correct size without extending https://review.opendev.org/c/openstack/nova/+/779275 | |
| 15:12:33 | ralonsoh | in any case, the ML2 plugin should keep it | |
| 15:12:41 | sean-k-mooney | am we could although it proably does not hurt to leave it there | |
| 15:12:56 | ralonsoh | perfect, doesn't add any overhead | |
| 15:13:08 | sean-k-mooney | the user might want to check what connectivy is aviaable to them i guess | |
| 15:13:27 | bauzas | sean-k-mooney: ok, so you're OK if we don't verify it in nova ? | |
| 15:13:38 | bauzas | as neutron already does it ? | |
| 15:13:39 | sean-k-mooney | bauzas: ya given that bug fix im ok with it | |
| 15:13:44 | bauzas | ++ | |
| 15:13:54 | bauzas | simplier for me then | |
| 15:14:01 | bauzas | I just need to rebase the change from stephenfin | |
| 15:14:03 | sean-k-mooney | bauzas: as i said im just surprised that was done since it was orginaly rejected. | |
| 15:14:16 | sean-k-mooney | yep | |
| 15:14:17 | bauzas | and I'll just provide a Tempest test | |
| 15:14:46 | sean-k-mooney | ralonsoh: qq while your here | |
| 15:15:03 | sean-k-mooney | ralonsoh: did you recently add the binding driver to the port details as part of the recent ovn work you were doing | |
| 15:15:14 | ralonsoh | yes | |
| 15:15:21 | ralonsoh | let me find the patch | |
| 15:15:36 | sean-k-mooney | it was part of https://specs.openstack.org/openstack/neutron-specs/specs/xena/ovn-auxiliary-port-bridge-live-migration.html right | |
| 15:15:57 | sean-k-mooney | is "backend" now populated for all ml2 drivers | |
| 15:16:00 | ralonsoh | https://review.opendev.org/c/openstack/neutron/+/814143 | |
| 15:16:21 | ralonsoh | "connectivity" you mean | |
| 15:16:24 | opendevreview | Sylvain Bauza proposed openstack/nova master: WIP neutron: Allow to spawn VMs with port without IP address https://review.opendev.org/c/openstack/nova/+/669411 | |
| 15:16:27 | ralonsoh | yes for all in-tree drivers | |
| 15:16:29 | bauzas | there it goes ^ | |
| 15:16:40 | ralonsoh | the default value is "legacy" | |
| 15:16:43 | sean-k-mooney | ralonsoh: no i mean backend | |
| 15:16:53 | sean-k-mooney | ralonsoh: https://specs.openstack.org/openstack/neutron-specs/specs/xena/ovn-auxiliary-port-bridge-live-migration.html#nova-neutron-events | |
| 15:17:03 | sean-k-mooney | this is unrelated to the connectivy question | |
| 15:17:13 | bauzas | holy shit, we actually don't need to have it WIP | |
| 15:17:48 | ralonsoh | sean-k-mooney, TBH, I don't remember now, let me check | |
| 15:17:50 | sean-k-mooney | bauzas: stephens patch? im pretty sure it worked in the past | |
| 15:18:58 | sean-k-mooney | ralonsoh: i dont see the constant defiend in neutron-lib | |
| 15:19:06 | sean-k-mooney | so i think this is missing again | |
| 15:19:24 | ralonsoh | sean-k-mooney, this is part of VIF_DETAILS | |
| 15:19:32 | ralonsoh | we don't need to add it to the API | |
| 15:19:33 | opendevreview | Sylvain Bauza proposed openstack/nova master: neutron: Allow to spawn VMs with port without IP address https://review.opendev.org/c/openstack/nova/+/669411 | |
| 15:19:39 | sean-k-mooney | ralonsoh: yes you do | |
| 15:19:43 | bauzas | sean-k-mooney: stephenfin's rebased patch without WIP | |
| 15:19:54 | sean-k-mooney | the keys in VIF_DETAILS are part of the prot binding extenion | |
| 15:20:04 | ralonsoh | sean-k-mooney, yes, but not the content | |
| 15:21:06 | sean-k-mooney | we normaly defien the keys of vif_details here https://github.com/openstack/neutron-lib/blob/master/neutron_lib/api/definitions/portbindings.py#L76 | |
| 15:21:19 | sean-k-mooney | https://github.com/openstack/neutron-lib/blob/master/neutron_lib/api/definitions/portbindings.py#L49-L76 | |
| 15:21:32 | sean-k-mooney | so if you have not defiend the key there its a bug IMO | |
| 15:21:52 | ralonsoh | sean-k-mooney, I didn't add anything to the vif details yet | |
| 15:21:56 | ralonsoh | I missed that part | |
| 15:22:08 | sean-k-mooney | ack so the backend is not specifed ok | |
| 15:22:24 | sean-k-mooney | so nova still cannot make decsion based on if its ovn | |
| 15:22:38 | sean-k-mooney | vs ml2/ovs | |
| 15:23:37 | ralonsoh | yeah sorry, I really missed that part | |
| 15:23:46 | ralonsoh | it will be this release for sure | |
| 15:24:27 | sean-k-mooney | ack no worries. i dont have time to start usign it this cycle anyway | |
| 15:24:50 | sean-k-mooney | but when its there we might be able to adress some of the livmigratio/move op issue we have with ovn | |
| 15:25:08 | sean-k-mooney | ralonsoh: on a related note we have merged the self-annouch change so that should help with ovn migration downtime | |
| 15:25:17 | sean-k-mooney | ralonsoh:i have started the backports too | |
| 15:25:36 | ralonsoh | sean-k-mooney, perfect | |
| 15:53:00 | bauzas | last reminder : nova meeting in 8 mins here | |
| 15:53:05 | bauzas | s/8/7 | |
| 16:00:10 | opendevmeet | The meeting name has been set to 'nova' | |
| 16:00:10 | opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | |
| 16:00:10 | opendevmeet | Meeting started Tue Jan 25 16:00:10 2022 UTC and is due to finish in 60 minutes. The chair is bauzas. Information about MeetBot at http://wiki.debian.org/MeetBot. | |
| 16:00:10 | bauzas | #startmeeting nova | |