| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-01-11 | |||
| 17:49:46 | melwitt | obvs everything you need will be in there | |
| 17:50:06 | sean-k-mooney | yep i can figure it out form there | |
| 17:50:31 | melwitt | ok great | |
| 17:50:45 | sean-k-mooney | now that i think about it i should proably clone this vm so i cna also test with rbd | |
| 17:50:55 | sean-k-mooney | ill start with qcow | |
| 17:57:11 | melwitt | sean-k-mooney: something to know is that it's a good idea to include swap or ephemeral or both in flavors you test with bc the code takes a slightly different path for creating swap or ephemeral disks. so including swap and/or ephemeral you will cover those paths as well | |
| 17:57:36 | sean-k-mooney | cool i can add both | |
| 17:57:47 | sean-k-mooney | have you tested with ephpemeral with multiple ephermeral disks | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Support glance's new location API https://review.opendev.org/c/openstack/nova/+/891036 | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Catch ImageNotFound on snapshot failure https://review.opendev.org/c/openstack/nova/+/905316 | |
| 17:58:21 | opendevreview | Dan Smith proposed openstack/nova master: DNM: Test glance new location api https://review.opendev.org/c/openstack/nova/+/891207 | |
| 17:58:47 | sean-k-mooney | i.e. "openstack server create --ephemeral 10 --ephemeral 20 ..." with a flavor with 30 G of ephemeral | |
| 17:59:17 | sean-k-mooney | ill create an etherpad whith what i tested with when i get to that point | |
| 17:59:40 | melwitt | sean-k-mooney: I think I did but it's been awhile. that's a good thing to test. i'm thinking to write tempest tests for cases like that | |
| 18:00:14 | sean-k-mooney | ya we shoudl perhaps as follow ups but it woudl be good to cover that | |
| 18:02:32 | melwitt | yeah. I'm working on the docs now and keeping a list of a few cases that are not currently covered in tempest presently, to write tests for those gaps. I'm thinking maybe we could run the encryption jobs (once cleaned up from DNM) at least as periodic jobs or something | |
| 18:03:10 | sean-k-mooney | other then the fact it needs barbican | |
| 18:03:29 | sean-k-mooney | is there any reason not to perhaps include this in one of our other jobs | |
| 18:03:38 | sean-k-mooney | im fine wiht a perodic job too | |
| 18:03:55 | melwitt | encryption is pretty noticeably slow. so I'm not sure if it'll fly but we can try | |
| 18:04:01 | sean-k-mooney | but would integrating it in the nova-live-migration jobs be an issue | |
| 18:04:46 | melwitt | I'm thinking ahead to if it ends up being too slow, I would at least want periodics | |
| 18:04:55 | sean-k-mooney | yep | |
| 18:05:02 | sean-k-mooney | so what im thinkin is | |
| 18:05:12 | sean-k-mooney | the perodics can do a broader range fo testing | |
| 18:05:45 | sean-k-mooney | but nova-live-migration and nova-live-migration-ceph could perhaps also do some basic testing for us | |
| 18:05:53 | sean-k-mooney | as those are pretty small jobs | |
| 18:06:28 | sean-k-mooney | they just run tempest_test_regex: (^tempest\.api\.compute\.admin\.(test_live_migration|test_migration)) | |
| 18:06:31 | melwitt | initially I was running those jobs with flavor with 1G disk, 1G ephemeral and 512MB swap and I got quite a bit of timed out jobs for raw and rbd | |
| 18:07:09 | melwitt | so I removed the ephemeral disk and left swap, that runs at normal durations | |
| 18:07:41 | sean-k-mooney | ok well we loop back to this then and start with just perodics and experimental | |
| 18:07:48 | melwitt | yeah I think that approach makes sense | |
| 18:08:52 | melwitt | it might be fine, just saying we might need to tweak things if it's too slow | |
| 18:09:01 | sean-k-mooney | yep | |
| 18:09:21 | sean-k-mooney | thats why i was looking for jobs that currently run few tests | |
| 18:10:00 | sean-k-mooney | melwitt: i need to read the spec again | |
| 18:10:16 | sean-k-mooney | but if i recall you request encyption via a flavor/image property right | |
| 18:10:54 | sean-k-mooney | so if we had barbican in a job we could add a single test that boots a vm with a flavor that uses it | |
| 18:11:09 | melwitt | sean-k-mooney: another thing to know is that for rbd I had to do a standard snapshot (not direct/clone snapshot) because the current stable release of ceph (quincy) does not support clone with a child having a different passphrase as the parent | |
| 18:11:09 | sean-k-mooney | instead of confiugring the jobs to use that falvor for evertything | |
| 18:11:30 | melwitt | *than the parent | |
| 18:12:33 | melwitt | sean-k-mooney: right. flavor you use hw:ephemeral_encryption = true and image hw_ephemeral_encryption = true | |
| 18:15:06 | sean-k-mooney | so vtpm need barbican to be tested too | |
| 18:15:16 | melwitt | yes | |
| 18:15:45 | sean-k-mooney | so it might be good to add barbican to one of our jobs and do a simpel boot test and also test vtpm in the future | |
| 18:15:56 | sean-k-mooney | we have some whitebox tests to verify vtpm | |
| 18:31:00 | sean-k-mooney | melwitt: why are you using a cutom ploicy file for barbican | |
| 18:31:45 | sean-k-mooney | hum i see | |
| 18:31:59 | sean-k-mooney | you are giving admin extra premisison | |
| 18:32:02 | sean-k-mooney | we likley shoudl fix that | |
| 18:32:13 | sean-k-mooney | either by skiping those tests | |
| 18:32:31 | sean-k-mooney | or by ensuring they are not useing the admin user | |
| 18:32:33 | melwitt | sean-k-mooney: there's at least one tempest test that involves admin doing something on behalf of a user, and by default, admin don't have permission to user's barbican secrets | |
| 18:32:37 | melwitt | yeah. I'm not sure if that's really what we want but I was just looking to see if I could pass all of tempest as-is | |
| 18:32:45 | melwitt | ack | |
| 18:33:05 | sean-k-mooney | right so i would not expect an admin to be able to start a vm with disk encyption | |
| 18:33:18 | sean-k-mooney | if they tweak the policy they could | |
| 18:33:24 | sean-k-mooney | but i dont think we ned to test that | |
| 18:33:26 | melwitt | ok, that makes it easy then | |
| 18:33:46 | sean-k-mooney | im going to skip that locally for now | |
| 18:33:59 | melwitt | sure | |
| 18:34:06 | sean-k-mooney | we could docuemnt this i just dont know if we want to test it as i would generally think its best to test with default policy | |
| 18:35:14 | melwitt | I think that would be fine. I agree it's best to test with default policy | |
| 18:35:46 | sean-k-mooney | ill be around for about another hour | |
| 18:35:53 | sean-k-mooney | im going to kick off https://termbin.com/k0sv | |
| 18:36:07 | sean-k-mooney | and then ill proably start playing with it tomorrow or monday | |
| 18:36:33 | melwitt | the admin test is good to verify that it is _possible_ to let admin do stuff if someone wanted that | |
| 18:36:35 | melwitt | but that's all it's for | |
| 18:37:16 | melwitt | ok cool | |
| 18:37:36 | sean-k-mooney | i need to do some prep on the vm fist like install git and clone devstack | |
| 18:37:49 | sean-k-mooney | but that wont thake that long | |
| 18:47:47 | wncslln | hi o/, anyone can help me to enable boot with uefi mode, please? | |
| 18:48:20 | sean-k-mooney | you just need to set hw_firmware_type=uefi in the glance iamge properties i belive | |
| 18:48:32 | sean-k-mooney | oh an hw_machine_type=q35 | |
| 18:48:57 | wncslln | just set this two properties? | |
| 18:48:59 | sean-k-mooney | assuming you have the correct ovmf firmware installed on all your compute nodes | |
| 18:49:31 | wncslln | hmmm i dont think i have | |
| 18:49:32 | sean-k-mooney | yep if you have install the ovmf package on all your compute nodes then qemu will have access to the uefi firmeware | |
| 18:49:57 | sean-k-mooney | https://docs.openstack.org/nova/yoga/admin/uefi.html | |
| 18:51:13 | sean-k-mooney | hw_machine_type=q35 is semi optional | |
| 18:51:40 | sean-k-mooney | qemu considers uefi with the the pc machine type to be experimantal and not recommended | |
| 18:52:05 | sean-k-mooney | most distos dont ship a ovmf fireware that properly supprots it | |
| 18:52:06 | wncslln | i have deployed with kolla-ansible so nova agents are containers. this is a problem? | |
| 18:52:10 | sean-k-mooney | so q35 should be used | |
| 18:52:22 | sean-k-mooney | no i have kolla-ansible at home | |
| 18:52:33 | sean-k-mooney | i am pretty sure there contienres have to correct pakcages already | |
| 18:52:53 | sean-k-mooney | so you just need ot set those tow imagea proepries in glance on the image and it should work | |
| 18:53:03 | sean-k-mooney | assuming the glance iamge supprot uefi | |
| 18:53:14 | sean-k-mooney | the image need to have a gpt partion table and an efi partion | |
| 18:53:24 | sean-k-mooney | same as real hardware | |
| 19:02:26 | wncslln | i setted the properties but the vm wont boot. could be a problem in the image | |
| 19:02:57 | sean-k-mooney | i would try somethign like the latest ubuntu cloud image | |
| 19:03:11 | sean-k-mooney | i think that support uefi boot but its been a while since i tried it | |
| 19:03:16 | wncslln | there is a way to know if the image have a gpt and efi partion? | |
| 19:03:40 | sean-k-mooney | you can download it and inspect it in a vm or with tools like libguestfs | |
| 19:05:30 | wncslln | ok, i'll make some tests here | |
| 19:05:40 | wncslln | sean-k-mooney: thanks for the help | |
| 19:38:46 | wncslln | sean-k-mooney: i found the problem xD probably the image that im using has no uefi/gpt. i downloaded the ubuntu cloud image with support to uefi and worked fine | |
| 19:44:37 | sean-k-mooney | cool | |
| 19:44:54 | sean-k-mooney | ya that make sense a lot of older images wont | |