| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2023-11-15 | |||
| 17:47:47 | stephenfin | bauzas: btw, https://review.opendev.org/c/openstack/nova/+/899979 is waiting for your doc eyes when you get a chance. There are references to AZs in there that melwitt thought you might have opinions on | |
| 17:49:01 | bauzas | stephenfin: ack, a bit overloaded as of now, but I'll look at it tomorrow morning | |
| 17:49:10 | stephenfin | nw, thanks (y) | |
| 18:12:21 | admin1 | > i accidentally mapped an IP to a wrong node .. i deleted it from inventory and compute service .. and gave the correct node to the IP .. but when i provision it, it still comes up wiht the old hostname .. which nova/placement table holds this record so that i can map the uuid to the correct hostname | |
| 19:27:33 | opendevreview | Jay Faulkner proposed openstack/nova master: WIP: [ironic] Partition & use cache for list_instance* https://review.opendev.org/c/openstack/nova/+/900831 | |
| 19:58:16 | mgariepy | hmm any pointer on : Migration pre-check error: Unacceptable CPU info: CPU doesn't have compatibility ? | |
| 19:58:29 | mgariepy | same server model cpu memory and all | |
| 19:58:40 | mgariepy | with 2023.1 release. | |
| 20:10:50 | opendevreview | Merged openstack/nova stable/2023.2: Fix rebuild compute RPC API exception for rolling-upgrades https://review.opendev.org/c/openstack/nova/+/900338 | |
| 20:17:07 | mgariepy | hmm like this one : https://bugs.launchpad.net/nova/+bug/2039803 | |
| 20:38:45 | opendevreview | melanie witt proposed openstack/nova master: Support create with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870932 | |
| 21:26:30 | opendevreview | Jay Faulkner proposed openstack/nova master: [ironic] Partition & use cache for list_instance* https://review.opendev.org/c/openstack/nova/+/900831 | |
| #openstack-nova - 2023-11-16 | |||
| 01:01:34 | songwenping | hi, team. nova-conductor services block at starting after the control nodes' network reset(stop and start for 5min), what's the reason and any guys got this? | |
| 08:31:14 | gibi | mgariepy: you might hit by https://bugs.launchpad.net/nova/+bug/2039803 | |
| 09:43:38 | opendevreview | Elod Illes proposed openstack/nova stable/2023.1: add a regression test for all compute RPCAPI 6.x pinnings for rebuild https://review.opendev.org/c/openstack/nova/+/900306 | |
| 09:43:39 | opendevreview | Elod Illes proposed openstack/nova stable/2023.1: Fix rebuild compute RPC API exception for rolling-upgrades https://review.opendev.org/c/openstack/nova/+/900336 | |
| 09:43:40 | opendevreview | Elod Illes proposed openstack/nova stable/2023.1: Adding server actions tests to grenade-multinode https://review.opendev.org/c/openstack/nova/+/900337 | |
| 09:53:33 | bauzas | elodilles: thanks for taking care of the RPC backports | |
| 10:18:14 | elodilles | np :) | |
| 10:19:10 | bauzas | elodilles: as a reminder, we'll need to modify the main change when backporting to Zed since one of the two modifications are related to a new RPC version that was added in Antelope | |
| 10:19:58 | elodilles | bauzas: i had only a quick look at the zed version, but yes, i saw that there should be a conflict | |
| 10:20:44 | elodilles | though as i saw probably it's trivial to resolve (famous last words? :)) | |
| 10:35:36 | bauzas | elodilles: probably, I can take a look when I have time | |
| 11:23:40 | opendevreview | Mark Goddard proposed openstack/nova master: Fix PCI passthrough race on reschedule (refresh) https://review.opendev.org/c/openstack/nova/+/710848 | |
| 11:23:40 | opendevreview | Mark Goddard proposed openstack/nova master: Functional test test_boot_reschedule_with_proper_pci_device_count https://review.opendev.org/c/openstack/nova/+/760354 | |
| 12:03:04 | dvo-plv | sean-k-mooney, I write to you regarding your comment https://review.opendev.org/c/openstack/nova/+/876075/27/nova/api/validation/extra_specs/hw.py#540 | |
| 12:03:27 | dvo-plv | I found this doc https://review.opendev.org/c/openstack/glance/+/882133/3/doc/source/admin/useful-image-properties.rst | |
| 12:04:10 | dvo-plv | but i can not find glance metadada and flavor extra spec which I have to extend | |
| 12:04:17 | sean-k-mooney | ah right you have done this already | |
| 12:04:38 | sean-k-mooney | dvo-plv: you have already done it in https://review.opendev.org/c/openstack/glance/+/882133/3/etc/metadefs/compute-libvirt.json | |
| 12:04:48 | sean-k-mooney | that patch has everything you need to do in glance | |
| 12:05:23 | sean-k-mooney | dvo-plv: all that is missing is the nova doc update to document the extra spec | |
| 12:05:32 | dvo-plv | okay, I will test gibi's comments and update nova patch | |
| 12:05:42 | sean-k-mooney | that is done in the user/flavor.rst doc | |
| 12:06:07 | dvo-plv | soory, i did not get | |
| 12:06:52 | sean-k-mooney | your current nova patch does not update doc/source/user/flavor.rst | |
| 12:07:11 | sean-k-mooney | * doc/source/user/flavors.rst | |
| 12:07:35 | sean-k-mooney | we list all the extra specs there https://github.com/openstack/nova/blob/master/doc/source/user/flavors.rst#extra-specs | |
| 12:07:54 | sean-k-mooney | so you shoudl just add the packed format there in your patch too | |
| 12:08:09 | sean-k-mooney | just as you did in the glance useful-imageproperties.rst | |
| 12:15:30 | dvo-plv | okay, I based on the vif_multiqueue_enabled and it does not present in this doc, so I thought it has other purposes | |
| 12:17:34 | sean-k-mooney | when vif_multiqueue_enabled was first intoduced it was only an image property | |
| 12:17:51 | sean-k-mooney | we added it as a flavor extra spec in a sperate patch a few release later | |
| 12:18:01 | dvo-plv | got it | |
| 12:18:33 | sean-k-mooney | although it looks like we also forgot to update the doc when we added it | |
| 12:18:39 | sean-k-mooney | so we shoudl proably fix that at some point | |
| 12:19:08 | sean-k-mooney | dvo-plv: sorry i think i link the wrong doc | |
| 12:27:12 | sean-k-mooney | dvo-plv: you shoudl update https://docs.openstack.org/nova/latest/configuration/extra-specs.html instead | |
| 12:27:34 | sean-k-mooney | which is here https://github.com/openstack/nova/blob/e5e5e00579212cf0b3a58cf7248f7e9483c17461/doc/source/configuration/extra-specs.rst | |
| 12:29:08 | sean-k-mooney | this doc is auto generated so you shoudl not need to modify it | |
| 12:29:18 | sean-k-mooney | let me confirm on the docs preview job | |
| 12:30:45 | sean-k-mooney | dvo-plv: https://5e2e8f3aeccddec75327-8da05f86af8a44d2353be3e602197c08.ssl.cf1.rackcdn.com/876075/27/check/openstack-tox-docs/8e3d058/docs/configuration/extra-specs.html#hw:virtio_packed_ring | |
| 12:31:01 | sean-k-mooney | dvo-plv: so nova doc genreate is workign fine for your chage | |
| 12:31:32 | dvo-plv | I also found this doc, it has in the web version https://docs.openstack.org/nova/latest/configuration/extra-specs.html, but it does not has so much info in the github https://github.com/openstack/nova/blob/master/doc/source/configuration/extra-specs.rst | |
| 12:32:02 | dvo-plv | So i thought that it generate dynamicly | |
| 12:32:03 | sean-k-mooney | we use sphinx directives to auto generate the contnet of the doc | |
| 12:33:21 | sean-k-mooney | .. extra-specs:: hw | |
| 12:33:37 | sean-k-mooney | is automatically generating all the hw: extra specs including the one your adding | |
| 12:34:36 | sean-k-mooney | we have a sphix extention that does this https://github.com/openstack/nova/blob/e5e5e00579212cf0b3a58cf7248f7e9483c17461/doc/ext/extra_specs.py | |
| 12:35:04 | sean-k-mooney | dvo-plv: it uses the info form the extra spec validators to generate the content | |
| 12:35:17 | sean-k-mooney | so as long as we provide a vlaidator the doc is always up to date | |
| 12:40:42 | dvo-plv | so, with docs all good | |
| 12:40:51 | dvo-plv | i do not update anything else | |
| 12:40:58 | dvo-plv | only fix gibi's comments | |
| 12:41:28 | sean-k-mooney | correct the docs shoudl all be fine | |
| 12:41:36 | sean-k-mooney | but gibis comments in the review are valid | |
| 12:41:45 | sean-k-mooney | sepcialy = false handeling | |
| 12:41:52 | dvo-plv | good that we clarify that, thanks | |
| 13:37:48 | mgariepy | gibi, yes thanks i found it and applied the workarounds stuff. | |
| 13:55:46 | SvenKieske | hi there, can anybody update me on the status of this spec? https://specs.openstack.org/openstack/nova-specs/specs/wallaby/approved/nova-support-webvnc-with-password-authentication.html | |
| 13:56:06 | sean-k-mooney | SvenKieske: it was rejected | |
| 13:56:13 | SvenKieske | I found out that it was not accepted for xena for non stated issues with it's design and then I can't find any updates anymore | |
| 13:56:49 | sean-k-mooney | the issues with the diesign came down ot how insecure the passward based auth is | |
| 13:57:26 | SvenKieske | mhm ok, don't want to argue about that, right now. | |
| 13:57:59 | sean-k-mooney | our recomendation is to use vcrpyt instead | |
| 13:58:02 | SvenKieske | related, I found the docs for the "auth_schemes" variable really lacking, as, there is no description of possible values: https://docs.openstack.org/nova/latest/configuration/config.html#vnc.auth_schemes | |
| 13:58:38 | sean-k-mooney | there are 2 vauels vencrypt and none | |
| 13:59:15 | SvenKieske | yeah, but only "none" is documented, leaving users to reading the source code, as usual in openstack land :) | |
| 13:59:31 | sean-k-mooney | or all the vencrypt values below it | |
| 13:59:45 | sean-k-mooney | which explcitly say "vnc.auth_schemes: must include vencrypt" | |
| 14:00:07 | sean-k-mooney | but that is a small chagne we coudl make we do list the enum values in other config options | |
| 14:00:09 | SvenKieske | regarding vcrypt: isn't that about tranport channel encryption? isn't that totally unrelated to user authentication and authorization? | |
| 14:00:47 | sean-k-mooney | so user auth and autherisation shoudl be done at the OS level | |
| 14:00:49 | SvenKieske | I mean, not totally unrelated, it's also a good security thing to do, but it does address a different problem, doesn't it? | |
| 14:01:11 | sean-k-mooney | there are two seperate thigns here yes | |
| 14:01:40 | SvenKieske | thanks for the information so far, it has been some time since I looked into novnc auth stuff. | |
| 14:01:46 | sean-k-mooney | nova provides a vnc proxy where autherisation is granted to connect via a bearer token that is provided as part of the console show reponce | |
| 14:02:08 | sean-k-mooney | if you enbale vencrypt that enabels cert base auth betwen the proxy and qemu | |
| 14:02:12 | SvenKieske | yeah, that's the mechanism I'm used to, also from other virtualization solutions in the space | |
| 14:02:18 | sean-k-mooney | which prevents direct access to the qemu consoles | |
| 14:02:56 | SvenKieske | I didn't find any information so far though: is the bearer token stuff enabled by default? how to configure it? maybe I was looking at the wrong config values | |
| 14:03:23 | sean-k-mooney | it is we use the token for 2 diffent things | |
| 14:03:48 | sean-k-mooney | first its used for auth as it has an expiry and can only be issues by someone in the same porject | |
| 14:04:06 | sean-k-mooney | second we use it to look up which instance to proxy the websocket conenction too | |
| 14:04:46 | sean-k-mooney | so the porxy checks if the token is still valid and then uses it to lookup what host/tcp port to proxy too | |
| 14:05:07 | SvenKieske | so it seems it's always enabled? at least here is no config toggle documented? https://docs.openstack.org/nova/latest/configuration/config.html#consoleauth | |
| 14:05:17 | sean-k-mooney | combin that with vencrypt and that will mean the only way to conenct to the console is via the proxy | |
| 14:06:06 | sean-k-mooney | SvenKieske: so console auth used to be a speerate service but it was roled into the other nova servies several years ago | |
| 14:06:21 | sean-k-mooney | the token_tll is all that is left | |
| 14:06:55 | sean-k-mooney | so yes will alwasy issue the token when you do openstack console url show <instance> | |