| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-01-13 | |||
| 22:35:36 | melwitt | that will determine where it gets the values from | |
| 22:35:52 | dansmith | melwitt: the thing is, I think the current situation we have with doing everything from the config file is just really obscure | |
| 22:35:54 | openstackgerrit | Scott DAngelo proposed openstack/nova: WIP Do Not Merge https://review.openstack.org/420201 | |
| 22:36:12 | dansmith | melwitt: when writing that, I started without the args, and had to go look up how we figure out what the values would be | |
| 22:36:23 | melwitt | dansmith: it is. so I'm cool with just notes that they don't have to do that and probably shouldn't in a real scenario | |
| 22:37:01 | melwitt | that it will pull the values from the nova.conf passed to nova-manage --config <nova.conf> | |
| 22:42:18 | melwitt | dansmith: overall looks reasonable to me | |
| 22:42:29 | mriedem | i don't consider those whitespaces as reasonable | |
| 22:43:20 | melwitt | that's true. shame on you dansmith | |
| 22:44:02 | mriedem | gdi where is jay when i need him | |
| 22:44:21 | melwitt | in the air, right? I thought he mentioned he was traveling today | |
| 22:44:21 | dansmith | melwitt: I feel like operators that are sensitive about their creds are also not hand-typing them into a history-preserving bash shell, but.. regardless, I think the changes I just made will appease the concern | |
| 22:44:57 | mriedem | i think i figured it out | |
| 22:45:19 | melwitt | dansmith: what do you mean? i.e. what is the case you're talking about where they type them somewhere but don't put them in the nova-manage command? | |
| 22:46:28 | openstackgerrit | Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198 | |
| 22:47:47 | dansmith | melwitt: not sure I grok that.. I'm just saying I think being afraid of creds on on the command line is being overly sensitive, given the lack of security we enforce on the very same systems you'd be running these on | |
| 22:47:56 | dansmith | melwitt: see what you think about that ^ | |
| 22:51:51 | melwitt | dansmith: oh. I think at my last company they wouldn't put db/mq creds on the command line at all. but I have also gotten feedback from mwhahaha about the same issue recently. so I think there's enough reason to be really clear about it so people understand what their options are | |
| 22:52:28 | dansmith | yeah, I totally get that people are worried about it, I just think it's silly :) | |
| 22:52:33 | melwitt | heh, okay | |
| 22:52:39 | mwhahaha | well it's information leakage | |
| 22:52:53 | mwhahaha | it's always been a bad idea and continues to be so | |
| 22:53:06 | mwhahaha | even though many newer apps have all their stuff via command line | |
| 22:53:34 | dansmith | it didn't used to be reasonable to use secure throw-away VMs as consoles for this kind of stuff | |
| 22:53:49 | dansmith | and since this should be stuff you run from an administrative console... | |
| 22:53:53 | dansmith | but regardless, | |
| 22:54:06 | dansmith | the visual correlation of which url goes with which thing is what I think is important for the examples | |
| 22:54:16 | mriedem | figleaf: can i not use env vars in a gabbit query string like this? | |
| 22:54:17 | mriedem | PUT: /resource_providers/$ENVIRON['RP_UUID']/aggregates | |
| 22:54:17 | mwhahaha | well it then ends up in scripts and other stuffs | |
| 22:54:22 | dansmith | much easier to map things in your head when you're trying to grok it | |
| 22:54:42 | figleaf | mriedem: yes, that's pretty much how you have to do it | |
| 22:55:11 | mwhahaha | anyway it's something we need to be conscious of especially if we want our apps to be consumed in the finance and government space | |
| 22:55:23 | mriedem | ok i was missing "content-type" | |
| 22:55:25 | mriedem | oops | |
| 22:55:30 | melwitt | dansmith: cool, thanks. I see you kept the trailing whitespace though, mriedem wouldn't approve | |
| 22:55:37 | mriedem | i was missing the content-type: application/json request header | |
| 22:55:43 | dansmith | melwitt: I fixed a few | |
| 22:55:50 | mwhahaha | whether or not it's silly is moot in the eyes of regulations and audits | |
| 22:55:51 | figleaf | mriedem: I go through about 20 oops a day with gabbi | |
| 22:55:52 | dansmith | melwitt: thought I got them all.. my editor's rst mode is working against me | |
| 22:55:55 | melwitt | that's all you're getting mriedem | |
| 22:55:57 | figleaf | the only way to learn! | |
| 22:56:07 | mriedem | figleaf: yeah, copy/paste is about the only way i make this work | |
| 22:56:09 | mriedem | but now i've got it | |
| 22:56:25 | mriedem | ok, RP ?resources= patch update coming | |
| 22:56:31 | mriedem | with a bunch more edge case testing | |
| 22:57:39 | openstackgerrit | Matt Riedemann proposed openstack/nova: Expose a REST API for a specific list of RPs https://review.openstack.org/392569 | |
| 22:57:40 | openstackgerrit | Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198 | |
| 22:57:40 | mriedem | OH F YEAH ^ | |
| 22:57:49 | openstackgerrit | Davanum Srinivas (dims) proposed openstack/nova: [WIP] Ignore me - ry py35 functional with a clean slate https://review.openstack.org/419968 | |
| 22:57:54 | mriedem | bauzas: i addressed my concerns in https://review.openstack.org/392569 | |
| 22:57:57 | mriedem | and added a bunch more testing | |
| 22:58:53 | mriedem | plus more docs about min/max unit and step size consideratoins | |
| 22:58:56 | mriedem | *considerations | |
| 23:00:03 | mwhahaha | dansmith: it should noted that these command in the case of puppet may get logged which is why I asked for using the config and not cmd line params. we have things to hide secrets when they get put into the config files but not so much for command line executions | |
| 23:00:39 | dansmith | mwhahaha: I understand your plight | |
| 23:01:02 | mriedem | does it matter that we leak tokens in the logs all over the place? | |
| 23:01:05 | dansmith | mwhahaha: hopefully you understand my point about illustrative examples with big fat caveats | |
| 23:01:10 | mriedem | and people post the logs to bug reports and kibana | |
| 23:01:23 | mwhahaha | we're not supposed to be leaking tokens anywhere | |
| 23:01:27 | mriedem | if your token expires fast enough it's not an issue | |
| 23:01:33 | mriedem | but... | |
| 23:01:40 | mwhahaha | but yea, i get it but passwords don't change like tokens :D | |
| 23:01:55 | melwitt | mriedem: yeah, it matters. we had some patches to redact tokens in the logs | |
| 23:02:04 | mriedem | i know, but it's whack a mole | |
| 23:02:10 | melwitt | yes. that's true | |
| 23:02:12 | mwhahaha | always is | |
| 23:02:51 | dansmith | these credentials are super easy for you to programmatically rotate too, if you're concerned about it | |
| 23:02:51 | mwhahaha | database passwords are worse because many times the permissions people are setting with the service users are wide open | |
| 23:03:37 | mwhahaha | well they should be, but i've done my fair share of db password rotations and it never goes well | |
| 23:03:55 | mwhahaha | cause someone ultimately uses it for something aren't supposed to and the world falls apart :D | |
| 23:04:36 | melwitt | that depends on your infra whether it's easy to rotate them, but yeah | |
| 23:04:38 | dansmith | well, I see we're far outside the realm of realism here | |
| 23:04:52 | dansmith | melwitt: have you got anything brewing for that create_cell patch? | |
| 23:04:55 | mriedem | sdague: alex_xu: i'm +2 on this now https://review.openstack.org/#/c/392569/ | |
| 23:05:05 | melwitt | it was not a picnic when the passwords got compromised and had to be changed, in my recollection | |
| 23:05:22 | melwitt | dansmith: yeah, it's failing py35 test only and I'm trying to fix it | |
| 23:05:22 | dansmith | oh, | |
| 23:05:32 | dansmith | I see you already did | |
| 23:06:14 | mriedem | alright i'm heading out | |
| 23:06:19 | mriedem | will be back on this week i'm sure | |
| 23:06:24 | mriedem | *weekend | |
| 23:06:33 | melwitt | *sad trombone* | |
| 23:06:41 | mriedem | but getting that scheduler RPs query thing +2ed unblocks the scheduler using placement | |
| 23:06:49 | mriedem | so is a high priority to get that patch in | |
| 23:07:04 | melwitt | is that the one you mentioned to me this morning? | |
| 23:07:13 | mriedem | i don't think so? | |
| 23:07:34 | melwitt | okay. nvm then | |
| 23:07:38 | mriedem | if you're looking, https://review.openstack.org/#/c/398472/ and https://review.openstack.org/#/c/417962/ are +2 and need to get in | |
| 23:08:19 | melwitt | okay yeah it was the first one you mentioned | |
| 23:08:48 | mriedem | ok now i'm out - i'm told there is casserole at home dontchaknow | |
| 23:11:15 | openstackgerrit | Anusha Unnam proposed openstack/nova: Add keypairs field to InstancePayload https://review.openstack.org/419730 | |
| 23:11:44 | slaweq | mriedem: hello, can You maybe have a look on https://review.openstack.org/#/c/420176/ ? thx in advance | |
| 23:24:43 | openstackgerrit | Davanum Srinivas (dims) proposed openstack/nova: [WIP] Ignore me - Try py35 functional with a clean slate https://review.openstack.org/419968 | |
| 23:27:51 | openstackgerrit | Ken'ichi Ohmichi proposed openstack/nova: Add hacking rule to avoid unnecessary space in method https://review.openstack.org/417582 | |
| 23:28:12 | openstackgerrit | melanie witt proposed openstack/nova: Add nova-manage cell_v2 create_cell command https://review.openstack.org/332713 | |
| 23:49:01 | dims | down to 1 test in py35 functional black list. yay! | |
| #openstack-nova - 2017-01-14 | |||
| 00:04:47 | mriedem | i'm going to push an infra change to run the placement job on newton only | |
| 00:04:57 | mriedem | since everything unique about the placement job in newton is now on by default in ocata | |