Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2017-01-13
22:36:12 dansmith melwitt: when writing that, I started without the args, and had to go look up how we figure out what the values would be
22:36:23 melwitt dansmith: it is. so I'm cool with just notes that they don't have to do that and probably shouldn't in a real scenario
22:37:01 melwitt that it will pull the values from the nova.conf passed to nova-manage --config <nova.conf>
22:42:18 melwitt dansmith: overall looks reasonable to me
22:42:29 mriedem i don't consider those whitespaces as reasonable
22:43:20 melwitt that's true. shame on you dansmith
22:44:02 mriedem gdi where is jay when i need him
22:44:21 melwitt in the air, right? I thought he mentioned he was traveling today
22:44:21 dansmith melwitt: I feel like operators that are sensitive about their creds are also not hand-typing them into a history-preserving bash shell, but.. regardless, I think the changes I just made will appease the concern
22:44:57 mriedem i think i figured it out
22:45:19 melwitt dansmith: what do you mean? i.e. what is the case you're talking about where they type them somewhere but don't put them in the nova-manage command?
22:46:28 openstackgerrit Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198
22:47:47 dansmith melwitt: not sure I grok that.. I'm just saying I think being afraid of creds on on the command line is being overly sensitive, given the lack of security we enforce on the very same systems you'd be running these on
22:47:56 dansmith melwitt: see what you think about that ^
22:51:51 melwitt dansmith: oh. I think at my last company they wouldn't put db/mq creds on the command line at all. but I have also gotten feedback from mwhahaha about the same issue recently. so I think there's enough reason to be really clear about it so people understand what their options are
22:52:28 dansmith yeah, I totally get that people are worried about it, I just think it's silly :)
22:52:33 melwitt heh, okay
22:52:39 mwhahaha well it's information leakage
22:52:53 mwhahaha it's always been a bad idea and continues to be so
22:53:06 mwhahaha even though many newer apps have all their stuff via command line
22:53:34 dansmith it didn't used to be reasonable to use secure throw-away VMs as consoles for this kind of stuff
22:53:49 dansmith and since this should be stuff you run from an administrative console...
22:53:53 dansmith but regardless,
22:54:06 dansmith the visual correlation of which url goes with which thing is what I think is important for the examples
22:54:16 mriedem figleaf: can i not use env vars in a gabbit query string like this?
22:54:17 mriedem PUT: /resource_providers/$ENVIRON['RP_UUID']/aggregates
22:54:17 mwhahaha well it then ends up in scripts and other stuffs
22:54:22 dansmith much easier to map things in your head when you're trying to grok it
22:54:42 figleaf mriedem: yes, that's pretty much how you have to do it
22:55:11 mwhahaha anyway it's something we need to be conscious of especially if we want our apps to be consumed in the finance and government space
22:55:23 mriedem ok i was missing "content-type"
22:55:25 mriedem oops
22:55:30 melwitt dansmith: cool, thanks. I see you kept the trailing whitespace though, mriedem wouldn't approve
22:55:37 mriedem i was missing the content-type: application/json request header
22:55:43 dansmith melwitt: I fixed a few
22:55:50 mwhahaha whether or not it's silly is moot in the eyes of regulations and audits
22:55:51 figleaf mriedem: I go through about 20 oops a day with gabbi
22:55:52 dansmith melwitt: thought I got them all.. my editor's rst mode is working against me
22:55:55 melwitt that's all you're getting mriedem
22:55:57 figleaf the only way to learn!
22:56:07 mriedem figleaf: yeah, copy/paste is about the only way i make this work
22:56:09 mriedem but now i've got it
22:56:25 mriedem ok, RP ?resources= patch update coming
22:56:31 mriedem with a bunch more edge case testing
22:57:39 openstackgerrit Matt Riedemann proposed openstack/nova: Expose a REST API for a specific list of RPs https://review.openstack.org/392569
22:57:40 openstackgerrit Dan Smith proposed openstack/nova: Add some cellsv2 setup docs https://review.openstack.org/420198
22:57:40 mriedem OH F YEAH ^
22:57:49 openstackgerrit Davanum Srinivas (dims) proposed openstack/nova: [WIP] Ignore me - ry py35 functional with a clean slate https://review.openstack.org/419968
22:57:54 mriedem bauzas: i addressed my concerns in https://review.openstack.org/392569
22:57:57 mriedem and added a bunch more testing
22:58:53 mriedem plus more docs about min/max unit and step size consideratoins
22:58:56 mriedem *considerations
23:00:03 mwhahaha dansmith: it should noted that these command in the case of puppet may get logged which is why I asked for using the config and not cmd line params. we have things to hide secrets when they get put into the config files but not so much for command line executions
23:00:39 dansmith mwhahaha: I understand your plight
23:01:02 mriedem does it matter that we leak tokens in the logs all over the place?
23:01:05 dansmith mwhahaha: hopefully you understand my point about illustrative examples with big fat caveats
23:01:10 mriedem and people post the logs to bug reports and kibana
23:01:23 mwhahaha we're not supposed to be leaking tokens anywhere
23:01:27 mriedem if your token expires fast enough it's not an issue
23:01:33 mriedem but...
23:01:40 mwhahaha but yea, i get it but passwords don't change like tokens :D
23:01:55 melwitt mriedem: yeah, it matters. we had some patches to redact tokens in the logs
23:02:04 mriedem i know, but it's whack a mole
23:02:10 melwitt yes. that's true
23:02:12 mwhahaha always is
23:02:51 dansmith these credentials are super easy for you to programmatically rotate too, if you're concerned about it
23:02:51 mwhahaha database passwords are worse because many times the permissions people are setting with the service users are wide open
23:03:37 mwhahaha well they should be, but i've done my fair share of db password rotations and it never goes well
23:03:55 mwhahaha cause someone ultimately uses it for something aren't supposed to and the world falls apart :D
23:04:36 melwitt that depends on your infra whether it's easy to rotate them, but yeah
23:04:38 dansmith well, I see we're far outside the realm of realism here
23:04:52 dansmith melwitt: have you got anything brewing for that create_cell patch?
23:04:55 mriedem sdague: alex_xu: i'm +2 on this now https://review.openstack.org/#/c/392569/
23:05:05 melwitt it was not a picnic when the passwords got compromised and had to be changed, in my recollection
23:05:22 melwitt dansmith: yeah, it's failing py35 test only and I'm trying to fix it
23:05:22 dansmith oh,
23:05:32 dansmith I see you already did
23:06:14 mriedem alright i'm heading out
23:06:19 mriedem will be back on this week i'm sure
23:06:24 mriedem *weekend
23:06:33 melwitt *sad trombone*
23:06:41 mriedem but getting that scheduler RPs query thing +2ed unblocks the scheduler using placement
23:06:49 mriedem so is a high priority to get that patch in
23:07:04 melwitt is that the one you mentioned to me this morning?
23:07:13 mriedem i don't think so?
23:07:34 melwitt okay. nvm then
23:07:38 mriedem if you're looking, https://review.openstack.org/#/c/398472/ and https://review.openstack.org/#/c/417962/ are +2 and need to get in
23:08:19 melwitt okay yeah it was the first one you mentioned
23:08:48 mriedem ok now i'm out - i'm told there is casserole at home dontchaknow
23:11:15 openstackgerrit Anusha Unnam proposed openstack/nova: Add keypairs field to InstancePayload https://review.openstack.org/419730
23:11:44 slaweq mriedem: hello, can You maybe have a look on https://review.openstack.org/#/c/420176/ ? thx in advance
23:24:43 openstackgerrit Davanum Srinivas (dims) proposed openstack/nova: [WIP] Ignore me - Try py35 functional with a clean slate https://review.openstack.org/419968
23:27:51 openstackgerrit Ken'ichi Ohmichi proposed openstack/nova: Add hacking rule to avoid unnecessary space in method https://review.openstack.org/417582
23:28:12 openstackgerrit melanie witt proposed openstack/nova: Add nova-manage cell_v2 create_cell command https://review.openstack.org/332713
23:49:01 dims down to 1 test in py35 functional black list. yay!
#openstack-nova - 2017-01-14
00:04:47 mriedem i'm going to push an infra change to run the placement job on newton only
00:04:57 mriedem since everything unique about the placement job in newton is now on by default in ocata
00:07:32 melwitt I put up the simple_cell_setup backport to newton at https://review.openstack.org/#/c/420226/ assuming the simple_cell_setup command stays relevant
00:19:42 mriedem cool
01:11:01 mriedem melwitt: reviewed the create_cell patch, i'm not crazy about how it creates a new cell mapping each time, even if the input params point to an existing cell mapping

Earlier   Later