Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2024-07-09
10:14:31 sean-k-mooney so kerbside would call the console show api with the console token using a keyston token with the service role
10:14:47 sean-k-mooney and we would include the host specifc port/ip info in the responce
10:18:29 mikal sean-k-mooney: oh that would be nice if it avoids changing the mysql schema. I will dig into this ASAP.
10:18:30 sean-k-mooney mikal:i was basically hoping that https://docs.openstack.org/api-ref/compute/#show-console-connection-information would work for your usecase.
10:19:38 sean-k-mooney the main proablem i see with that today is 1.) ensuring it has the info you need, 2.) ensuring you can call it for the given teanta/project
10:19:50 sean-k-mooney normaly that api is called with a project scoped token
10:20:37 sean-k-mooney so what we might need is for the use to call kerbside with a project scoped token and for kerbside to call nova with the user provided keystone token + a service token to show the extra info
10:21:37 sean-k-mooney the user token will have the keystone project info allowing the api call to be scope to the correct project/tenant and the service user token (generated by kerbside) will grant access to any required hypervisor specific info
10:22:24 sean-k-mooney the console token(sepreate form the keystone token) acks a the lookup key
10:22:33 sean-k-mooney to pull the infor for the relevent instnace
10:22:58 sean-k-mooney i konw its kind of confusing to have 3 tokens at play but hopefully that makes sense
10:27:59 mikal sean-k-mooney: yeah, I think that makes sense. I don't know how to code it, but I am sure that's a learnable thing.
10:29:19 sean-k-mooney this is not the best example since its using keyston auth not the sdk but https://github.com/openstack/nova/blob/master/nova/service_auth.py
10:29:43 sean-k-mooney the service token is just an addtional header with a second keyston token
10:30:24 sean-k-mooney its orginal use was "trust be bro when the user called me the user token had not expired yet"
10:31:17 sean-k-mooney since then we have now intoduced the service role and a service token with that role denotes a call form a cloud infra level service
10:31:29 sean-k-mooney typeically another openstack service but in this case kerbside
10:33:42 sean-k-mooney so in theory all kerbside has to do is grab and reuse the users keyston token form the reques header, parse the console toke out of the url, generate a new keyston token form config with its own username/password ot use as the service token and call the get console endpoint
10:34:59 sean-k-mooney at which point nova internaly can lookup the hyperviors specific info and return it to kerbside and you can set up the proxy forwardign
10:35:41 sean-k-mooney im not sure that flow will work for your usecase but if it does it woudl be very similar to how the other proxies work
10:35:58 sean-k-mooney they just happen to have direct db access and can bypass the api call to get the hypervior info
10:37:33 opendevreview sean mooney proposed openstack/nova stable/2023.2: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923727
10:37:34 opendevreview sean mooney proposed openstack/nova stable/2023.2: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923728
10:37:35 opendevreview sean mooney proposed openstack/nova stable/2023.2: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923729
10:38:38 opendevreview sean mooney proposed openstack/nova stable/2023.1: port format inspector tests from glance https://review.opendev.org/c/openstack/nova/+/923731
10:38:39 opendevreview sean mooney proposed openstack/nova stable/2023.1: Reproduce iso regression with deep format inspection https://review.opendev.org/c/openstack/nova/+/923732
10:38:40 opendevreview sean mooney proposed openstack/nova stable/2023.1: Add iso file format inspector https://review.opendev.org/c/openstack/nova/+/923733
10:42:11 mikal sean-k-mooney: I think that flow would work. I have to go put a kid to bed though, I will try and get some more done on this tomorrow.
10:44:34 sean-k-mooney mikal:ack hopefuly your feeling better, dont push your self too hard to get back into things o/
10:44:59 mikal sean-k-mooney: although, does kerbside even need the user token? Surely possession of the console token itself is sufficient and then kerbside just uses it to lookup the specific connection details? The advantage of that is that SPICE clients just fetch a URL without understanding openstack at all, and bam they're in a console.
10:45:21 sean-k-mooney the user token is needed by nova to lookup thte console token currently
10:45:28 mikal sean-k-mooney: I am a bit worried about the approval deadline, but such is life.
10:45:29 sean-k-mooney its a project scoped api
10:45:41 sean-k-mooney we might be able to make it work without it
10:45:53 sean-k-mooney i m just not sure what the uniq constrait is on the console token
10:46:07 sean-k-mooney i.e. is it uniquce globaly, per project ectra
10:46:07 mikal sean-k-mooney: oh, that's a bit sad. It would be nice if that could be a token a service account could look up.
10:46:34 sean-k-mooney if its globally uniq we may be abell to just use the service token but im not sure on the exact code paths inovlved
10:46:35 mikal sean-k-mooney: I would hope this tokens are effectively large random numbers, but yeah I see the point.
10:46:47 sean-k-mooney i belive they are uuids
10:47:06 sean-k-mooney but ya we can check that and see what makes sense
10:48:00 mikal Ok, this can be a tomorrow problem but thanks for the chat, its been helpful.
11:03:12 opendevreview Stephen Finucane proposed openstack/nova master: [codespell] Fixes for latest version https://review.opendev.org/c/openstack/nova/+/923738
11:03:13 opendevreview Stephen Finucane proposed openstack/nova master: pre-commit: Bump versions https://review.opendev.org/c/openstack/nova/+/923739
11:16:43 elodilles hi team, just a heads up: nova 29.1.0 (2024.1 Caracal), 28.2.0 (2023.2 Bobcat), 27.4.0 (2023.1 Antelope) stable versions have been released a couple of minutes ago
11:32:09 sean-k-mooney ack we will likely nbeed to do another release of them for the iso format backprots once they land. we fixed up the ami regreession in the upstream backort but we can wait a week or so for thsoe to make there way though the upstream ci without the frantic queue jumping ectra
11:36:59 elodilles sean-k-mooney: ACK, thanks for the info, let me know when i can help with the backports & stable release
14:12:39 opendevreview sean mooney proposed openstack/nova master: fix qemu-img version dependent tests https://review.opendev.org/c/openstack/nova/+/923755
14:41:38 opendevreview Jens Harbott proposed openstack/nova master: DNM: Test devstack change https://review.opendev.org/c/openstack/nova/+/923759
14:48:53 opendevreview Jimmy McCrory proposed openstack/nova-specs master: Re-propose nova-audit spec for 2024.2 https://review.opendev.org/c/openstack/nova-specs/+/923761
15:15:52 sean-k-mooney gibi: stephenfin melwitt can ye review https://review.opendev.org/c/openstack/nova/+/923755 please
15:16:44 sean-k-mooney tl;dr is centos and other rhel derived distros compile out some image formats like QED and other depend on the version
15:17:12 sean-k-mooney so that adds a check to ensure qemu supprot the relevent format otherwise it skips the test
15:20:35 sean-k-mooney elodilles: ^ when it comes to backproting the iso regression support we have a choice to backport that skip patch as is or squash it into the patch that addes the version dependent tests. do you have any preference
15:36:39 stephenfin sean-k-mooney: done. Left a comment. Can bump to +2 if you don't want to rework
15:46:23 sean-k-mooney we are use Exception else where in the file so i would prefer to keep it the same
15:47:39 sean-k-mooney stephenfin: you are correct we likely could be more specific here, this will eventually be moved to oslo too and we are expecting to rework it when we do that
15:48:06 stephenfin ack
15:56:39 JayF sean-k-mooney: what's the ETA on that being oslo'd?
15:58:01 sean-k-mooney JayF: dan is on pto this week so not until we have fully finished all the backports for the iso format regression and he is back
15:58:20 JayF ack ty
15:58:23 sean-k-mooney so this cylce but proably not this week or next
15:59:09 sean-k-mooney if we need to keep it in tree for this cycle its not the end of the world but i think we would like to move it before the non-client lib freeze
15:59:41 sean-k-mooney so we proably need to do it in july
16:07:33 tkajinam Considering how image format handling can be tricky I wonder if we want to keep them in-tree for some time to simplify backports of further regression fixes. ex. keeping these in-tree for 2024.2 and oslo'ing these in 2025.1
16:07:55 tkajinam This is not a very strong opinion though.
16:10:37 tkajinam Is the meeting today canceled, right ? I think bauzas is off this week.
16:10:45 clarkb separately having them in a central lib that can be bumped easily to affect all related services at once may be easier than managing in separaet trees and backporting separateyl
16:11:10 tkajinam yeah. it makes maintenance of future branches much easier
16:11:48 tkajinam we may probably be able to do "psudo-"backport even after we oslo-nize the code
16:13:04 tkajinam I was wondering how I can move https://review.opendev.org/c/openstack/nova-specs/+/907702 forward but I guess people have been busy with CVE fix. I'd bring maybe this next week. I saw SEV-SNP support was finally merged into kernel/QEMU/libvirt so I would work on SNP support in 2025.1 hopefully.
17:44:50 sean-k-mooney as i siad for dalmation we can likely live with it in tree if we have too
17:45:05 sean-k-mooney i am hoping the detection code will stay pretty stable at this point
17:45:31 sean-k-mooney but we may need to be reactive to any future issue that people find as this start perculating into production
17:45:58 sean-k-mooney long term however we dont want ot have to port things like iso supprot to glance and cinder ectra
17:46:09 sean-k-mooney if we can jsut have it in a shared lib
17:51:21 opendevreview Jay Faulkner proposed openstack/nova master: [ironic] Ensure we test iterators when needed https://review.opendev.org/c/openstack/nova/+/923781
17:52:47 JayF ^ is literally a one line, 6 character unit test change if someone wants an easy review (we only had one place that we were mis-testing against a list)
17:53:18 sean-k-mooney is that related to the sdk thing
17:53:22 sean-k-mooney oh yep
17:53:41 JayF Just fulfilling my promise to circle back after that bug was filed and ensure we didn't have any others in that shape
17:56:45 sean-k-mooney JayF: i have directly approved it
17:57:02 JayF nice, thanks
17:57:12 JayF I'm about to open up your metadata patch series after lunch :D
18:52:39 opendevreview Merged openstack/nova master: fix qemu-img version dependent tests https://review.opendev.org/c/openstack/nova/+/923755
19:11:50 opendevreview Merged openstack/nova master: [ironic] Ensure we test iterators when needed https://review.opendev.org/c/openstack/nova/+/923781
22:59:54 opendevreview Jay Faulkner proposed openstack/nova master: WIP: [ironic] Send additional metadata for ironic https://review.opendev.org/c/openstack/nova/+/923797
23:00:23 JayF sean-k-mooney: ^ I wouldn't mind collapsing 923797 with yours, I don't see why they have to be separate, but wanted your $.02 before I did it
#openstack-nova - 2024-07-10
03:38:53 opendevreview melanie witt proposed openstack/nova-specs master: Propose config option for unified limits of zero https://review.opendev.org/c/openstack/nova-specs/+/923807
05:55:01 opendevreview melanie witt proposed openstack/nova master: Config option to treat unified limit of zero as unlimited https://review.opendev.org/c/openstack/nova/+/923813
05:57:40 opendevreview melanie witt proposed openstack/nova master: Config option to treat unified limit of zero as unlimited https://review.opendev.org/c/openstack/nova/+/923813
06:56:29 opendevreview Robert Hoffmann proposed openstack/nova master: Fix: clean up volume attachments https://review.opendev.org/c/openstack/nova/+/923646
08:43:57 opendevreview Abhishek Kekane proposed openstack/nova master: DNM: Test glance new location api https://review.opendev.org/c/openstack/nova/+/891207
08:59:01 frickler sean-k-mooney: did you have a chance to look at the failures on the iso stable backports yet? the grenade failure seems unrelated, I'm more worried about the barbican one
08:59:38 sean-k-mooney frickler: not yet but ill do that shortly, thanks for the heads up
09:00:13 sean-k-mooney frickler: im not really sure how any fo this could be related to barbican given we do not currently have any encyped local storage support in nova
09:00:28 sean-k-mooney at least not in the context of barbican
09:01:50 sean-k-mooney JayF: they do not need to be seperate i just dont blan to work on the metadta feature this cycle. so if its ok with you can you squash your changes into min and take over that patch?
09:03:37 sean-k-mooney frickler: oh interesting i wonder if that was failing in the backport of the orginal cve fix
09:03:44 frickler sean-k-mooney: well this does sound somehow related to me, maybe not your patch but one of the other cve fixes? though not sure why it would only be failing sometimes? "Image ... is unacceptable: Image content does not match disk_format"

Earlier   Later