| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2023-11-16 | |||
| 12:33:21 | sean-k-mooney | .. extra-specs:: hw | |
| 12:33:37 | sean-k-mooney | is automatically generating all the hw: extra specs including the one your adding | |
| 12:34:36 | sean-k-mooney | we have a sphix extention that does this https://github.com/openstack/nova/blob/e5e5e00579212cf0b3a58cf7248f7e9483c17461/doc/ext/extra_specs.py | |
| 12:35:04 | sean-k-mooney | dvo-plv: it uses the info form the extra spec validators to generate the content | |
| 12:35:17 | sean-k-mooney | so as long as we provide a vlaidator the doc is always up to date | |
| 12:40:42 | dvo-plv | so, with docs all good | |
| 12:40:51 | dvo-plv | i do not update anything else | |
| 12:40:58 | dvo-plv | only fix gibi's comments | |
| 12:41:28 | sean-k-mooney | correct the docs shoudl all be fine | |
| 12:41:36 | sean-k-mooney | but gibis comments in the review are valid | |
| 12:41:45 | sean-k-mooney | sepcialy = false handeling | |
| 12:41:52 | dvo-plv | good that we clarify that, thanks | |
| 13:37:48 | mgariepy | gibi, yes thanks i found it and applied the workarounds stuff. | |
| 13:55:46 | SvenKieske | hi there, can anybody update me on the status of this spec? https://specs.openstack.org/openstack/nova-specs/specs/wallaby/approved/nova-support-webvnc-with-password-authentication.html | |
| 13:56:06 | sean-k-mooney | SvenKieske: it was rejected | |
| 13:56:13 | SvenKieske | I found out that it was not accepted for xena for non stated issues with it's design and then I can't find any updates anymore | |
| 13:56:49 | sean-k-mooney | the issues with the diesign came down ot how insecure the passward based auth is | |
| 13:57:26 | SvenKieske | mhm ok, don't want to argue about that, right now. | |
| 13:57:59 | sean-k-mooney | our recomendation is to use vcrpyt instead | |
| 13:58:02 | SvenKieske | related, I found the docs for the "auth_schemes" variable really lacking, as, there is no description of possible values: https://docs.openstack.org/nova/latest/configuration/config.html#vnc.auth_schemes | |
| 13:58:38 | sean-k-mooney | there are 2 vauels vencrypt and none | |
| 13:59:15 | SvenKieske | yeah, but only "none" is documented, leaving users to reading the source code, as usual in openstack land :) | |
| 13:59:31 | sean-k-mooney | or all the vencrypt values below it | |
| 13:59:45 | sean-k-mooney | which explcitly say "vnc.auth_schemes: must include vencrypt" | |
| 14:00:07 | sean-k-mooney | but that is a small chagne we coudl make we do list the enum values in other config options | |
| 14:00:09 | SvenKieske | regarding vcrypt: isn't that about tranport channel encryption? isn't that totally unrelated to user authentication and authorization? | |
| 14:00:47 | sean-k-mooney | so user auth and autherisation shoudl be done at the OS level | |
| 14:00:49 | SvenKieske | I mean, not totally unrelated, it's also a good security thing to do, but it does address a different problem, doesn't it? | |
| 14:01:11 | sean-k-mooney | there are two seperate thigns here yes | |
| 14:01:40 | SvenKieske | thanks for the information so far, it has been some time since I looked into novnc auth stuff. | |
| 14:01:46 | sean-k-mooney | nova provides a vnc proxy where autherisation is granted to connect via a bearer token that is provided as part of the console show reponce | |
| 14:02:08 | sean-k-mooney | if you enbale vencrypt that enabels cert base auth betwen the proxy and qemu | |
| 14:02:12 | SvenKieske | yeah, that's the mechanism I'm used to, also from other virtualization solutions in the space | |
| 14:02:18 | sean-k-mooney | which prevents direct access to the qemu consoles | |
| 14:02:56 | SvenKieske | I didn't find any information so far though: is the bearer token stuff enabled by default? how to configure it? maybe I was looking at the wrong config values | |
| 14:03:23 | sean-k-mooney | it is we use the token for 2 diffent things | |
| 14:03:48 | sean-k-mooney | first its used for auth as it has an expiry and can only be issues by someone in the same porject | |
| 14:04:06 | sean-k-mooney | second we use it to look up which instance to proxy the websocket conenction too | |
| 14:04:46 | sean-k-mooney | so the porxy checks if the token is still valid and then uses it to lookup what host/tcp port to proxy too | |
| 14:05:07 | SvenKieske | so it seems it's always enabled? at least here is no config toggle documented? https://docs.openstack.org/nova/latest/configuration/config.html#consoleauth | |
| 14:05:17 | sean-k-mooney | combin that with vencrypt and that will mean the only way to conenct to the console is via the proxy | |
| 14:06:06 | sean-k-mooney | SvenKieske: so console auth used to be a speerate service but it was roled into the other nova servies several years ago | |
| 14:06:21 | sean-k-mooney | the token_tll is all that is left | |
| 14:06:55 | sean-k-mooney | so yes will alwasy issue the token when you do openstack console url show <instance> | |
| 14:07:09 | sean-k-mooney | with a default expiry of 10 minutes | |
| 14:07:43 | sean-k-mooney | the current behavior of the proxy is to keep the active session alive after token expiry but we are addign a featue to terminate it this cycle | |
| 14:08:20 | sean-k-mooney | it will be opt in via a config option since most end user will wont the current beahiovor | |
| 14:19:33 | SvenKieske | okay, nice to know, thank you very much for the detailed explanations, as always :) | |
| 14:26:07 | opendevreview | Merged openstack/nova stable/zed: Add debug logging when Instance raises OrphanedObjectError https://review.opendev.org/c/openstack/nova/+/888161 | |
| 14:26:56 | opendevreview | John Garbutt proposed openstack/nova-specs master: Expose PCI device NUMA using PXB https://review.opendev.org/c/openstack/nova-specs/+/869416 | |
| 14:35:00 | SvenKieske | opened a bug for our deployment scenario, as we don't currently seem to lock down the connection between proxy and qemu: https://bugs.launchpad.net/kolla-ansible/+bug/2043709 | |
| 14:35:21 | sean-k-mooney | most installers dont | |
| 14:35:41 | sean-k-mooney | its not even done in tripleo and redhat added the feature in nova :P | |
| 14:35:51 | sean-k-mooney | but it is somethign we are planning to enable soon | |
| 14:36:17 | sean-k-mooney | the main blocker to using this by defualt in installer is the need to do tls cert generation and rotaion | |
| 14:37:33 | sean-k-mooney | we are currently in the process of movign our downstream product to use golang operator to deploy openstack on openshift | |
| 14:37:56 | sean-k-mooney | and we plan ot leverage the fact that we have access to certmanager in that env to handle that for us | |
| 14:40:52 | opendevreview | Pierre Riteau proposed openstack/nova master: Fix a couple of typos https://review.opendev.org/c/openstack/nova/+/892300 | |
| 15:12:13 | opendevreview | Sylvain Bauza proposed openstack/nova-specs master: Proposes mdev live-migration support in libvirt https://review.opendev.org/c/openstack/nova-specs/+/900636 | |
| 16:12:02 | admin1 | i get this "Build of instance 6c7b960d-ede4-4218-99b0-2f9d55f84dab aborted: Volume d53a7298-685a-43cd-89a3-13b9d6207dcd did not finish being created even after we waited 187 seconds or 61 attempts. And its status is creating" -- this is due to a 20gb image which is not present in the hypervisors and they need to be downloaded from glance first to | |
| 16:12:03 | admin1 | use as base image .. which variables in nova.conf do I need to use to fix this ? | |
| 16:20:45 | opendevreview | Sylvain Bauza proposed openstack/nova-specs master: Proposes mdev live-migration support in libvirt https://review.opendev.org/c/openstack/nova-specs/+/900636 | |
| 16:47:49 | opendevreview | Merged openstack/nova stable/yoga: Add debug logging when Instance raises OrphanedObjectError https://review.opendev.org/c/openstack/nova/+/888162 | |
| 17:11:27 | opendevreview | Balazs Gibizer proposed openstack/nova master: Allow enabling cpu_power_management with 0 dedicated CPUs https://review.opendev.org/c/openstack/nova/+/901188 | |
| 17:14:34 | opendevreview | John Garbutt proposed openstack/nova-specs master: Expose PCI device NUMA using PXB https://review.opendev.org/c/openstack/nova-specs/+/869416 | |
| 17:24:57 | Continuity__ | admin1: block_device_allocate_retries and block_device_allocate_retries_interval | |
| 17:25:12 | Continuity | in nova.conf will allow you to adjust those timeouts | |
| 17:39:55 | opendevreview | John Garbutt proposed openstack/nova-specs master: Add spec for PCI Groups https://review.opendev.org/c/openstack/nova-specs/+/899719 | |
| 17:43:58 | opendevreview | John Garbutt proposed openstack/nova-specs master: Add spec for PCI Groups https://review.opendev.org/c/openstack/nova-specs/+/899719 | |
| 17:44:06 | opendevreview | John Garbutt proposed openstack/nova-specs master: Add spec for PCI Groups https://review.opendev.org/c/openstack/nova-specs/+/899719 | |
| 17:45:17 | opendevreview | Jing Geng proposed openstack/nova-specs master: APIImpact https://review.opendev.org/c/openstack/nova-specs/+/901145 | |
| 18:03:33 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Debug log if host state not updated from compute https://review.opendev.org/c/openstack/nova/+/901196 | |
| 18:10:24 | admin1 | Continuity, thanks .. is block_device_allocate_retries: 600 and block_device_allocate_retries_interval: 5 an accpetable value ? | |
| 19:02:49 | opendevreview | Merged openstack/nova master: Fix python shebang https://review.opendev.org/c/openstack/nova/+/898594 | |
| 20:24:28 | Continuity | admin1: yeah that should be fine | |
| 20:24:35 | Continuity | it means it will wait 5 seconds and try 600 times | |
| 20:50:16 | opendevreview | Merged openstack/nova master: Drop remaining deprecated upgrade_levels option for nova-cert https://review.opendev.org/c/openstack/nova/+/898613 | |
| 20:53:09 | opendevreview | Merged openstack/nova stable/xena: Add debug logging when Instance raises OrphanedObjectError https://review.opendev.org/c/openstack/nova/+/888163 | |
| 23:19:50 | opendevreview | melanie witt proposed openstack/nova master: imagebackend: Add support to libvirt_info for LUKS based encryption https://review.opendev.org/c/openstack/nova/+/826755 | |
| 23:19:50 | opendevreview | melanie witt proposed openstack/nova master: libvirt: Configure and teardown ephemeral encryption secrets https://review.opendev.org/c/openstack/nova/+/826754 | |
| 23:19:51 | opendevreview | melanie witt proposed openstack/nova master: Support create with ephemeral encryption for qcow2 https://review.opendev.org/c/openstack/nova/+/870932 | |
| 23:19:51 | opendevreview | melanie witt proposed openstack/nova master: Add encryption support to convert_image https://review.opendev.org/c/openstack/nova/+/870934 | |
| #openstack-nova - 2023-11-17 | |||
| 07:01:45 | opendevreview | Rajesh Tailor proposed openstack/nova master: Fix KeyError on assisted snapshot call https://review.opendev.org/c/openstack/nova/+/900783 | |
| 07:38:35 | tkajinam | https://zuul.opendev.org/t/openstack/builds?job_name=grenade-skip-level-always&project=openstack/nova | |
| 07:39:03 | tkajinam | I'm afraid grenade-skip-level-always might be broken. I've not yet looked into it though. | |
| 07:46:41 | frickler | ERROR cinder etcd3gw.exceptions.Etcd3Exception: Not Found | |
| 07:59:12 | tkajinam | frickler, ah, thanks for that info. I saw the same error in a few run so there may be something wrong with cinder | |
| 07:59:20 | tkajinam | it seems cinder is deployed with etcd3gw tooz driver. | |
| 08:03:01 | tkajinam | I vaguely guess the issue was caused by the new tooz release and https://review.opendev.org/c/openstack/tooz/+/891355 might be the cause | |
| 08:06:28 | tkajinam | hmm. do we really need that job in master ? I see the job test upgrade from zed to 2023.2 | |
| 08:06:48 | tkajinam | and does not look appropriate for master | |
| 08:08:36 | tkajinam | ignore above. I noticed I was looking at a wrong branch of grenade... | |
| 09:30:58 | bauzas | tkajinam: looking | |
| 09:31:35 | bauzas | yeah this is failing when upgrading cinder | |
| 09:32:53 | bauzas | we're on Caracal, so it's upgrading from Antelope | |
| 09:33:23 | bauzas | https://github.com/openstack/grenade/commit/159054a9274f984d8e53e5e5bd9e7ab0fb29708b | |
| 09:33:30 | bauzas | (C is a SLURP release) | |
| 09:36:17 | bauzas | heh, fun, we got a GMR report in https://storage.gra.cloud.ovh.net/v1/AUTH_dcaab5e32b234d56b626f72581e3644c/zuul_opendev_logs_73a/900783/2/check/grenade-skip-level-always/73acbef/controller/logs/screen-c-vol.txt | |
| 09:39:31 | bauzas | 2023-11-17 06:30:28.118 | ++ /opt/stack/new/grenade/projects/70_cinder/resources.sh:verify:220 : openstack volume show cinder_grenade_vol2 -f shell -c status 2023-11-17 06:30:29.692 | Internal Server Error (HTTP 500) | |
| 09:39:41 | bauzas | yeah, something got wrong on the cinder side | |