| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-01-18 | |||
| 17:22:12 | mriedem | i blame video games and rock music | |
| 17:22:33 | mriedem | and nancy reagan | |
| 17:22:53 | alaski | moving instances and hosts between cells would definitely be great to have, but they need some thought and should happen after cellsv2 is actually used by most/all deployers | |
| 17:22:56 | gabor_antal | mriedem: can you help me? I keep getting "UnableToMigrateToSelf: Unable to migrate instance (1bad3469-0843-4ce4-82b1-321a648415e3) to current host (compute). | |
| 17:22:57 | gabor_antal | " error, while "allow_resize_to_same_host" is set True. It's in a unit test btw. | |
| 17:23:36 | mriedem | gabor_antal: you have self.flags(allow_resize_to_same_host=True) in the unit test? | |
| 17:24:22 | gabor_antal | mriedem: Ofc. Sorry, it's actually a notification-checker functional test. | |
| 17:24:48 | mriedem | gabor_antal: the flag gets set for the test the same way | |
| 17:25:24 | melwitt | just have to make sure it's set before the service that reads it, is started | |
| 17:25:28 | gabor_antal | yeah, I've already set it. But I keep getting that annoying error | |
| 17:28:36 | gabor_antal | mriedem: I tried to set it right after this line, https://github.com/openstack/nova/blob/master/nova/tests/functional/notification_sample_tests/test_instance.py#L32, but keep getting that ugly error :( | |
| 17:29:01 | mriedem | gabor_antal: do you have a stacktrace you can put into a paste and link that here? | |
| 17:29:21 | mriedem | gabor_antal: btw, | |
| 17:29:23 | mriedem | see https://github.com/openstack/nova/blob/master/nova/tests/functional/notification_sample_tests/test_instance.py#L480 | |
| 17:30:53 | gabor_antal | mriedem: I paste it in a second. I already checked those tests, but doing live migration tests still leads me to the same error, I think we have 3 patches which is stuck on this point | |
| 17:31:57 | openstackgerrit | Claudiu Belu proposed openstack/nova: Adds CPUFeaturesField to ImageMetaProps https://review.openstack.org/420960 | |
| 17:32:00 | gabor_antal | mriedem: http://paste.openstack.org/show/595439/ | |
| 17:33:13 | siva_krishnan | tdurakov: This is regarding https://review.openstack.org/#/c/379032/2. I just replied to your comments. Please let me know what I am planning to do looks acceptable | |
| 17:34:06 | mriedem | jroll: i'm having a hard time understanding where this change https://review.openstack.org/#/c/364413/22/nova/virt/ironic/patcher.py is used in the rest of that patch | |
| 17:35:52 | jroll | mriedem: we moved the binding of the neutron port into ironic, since we do weird things with timing on that https://github.com/openstack/ironic/blob/e72e68eb38c4325bb868a504106be097251c3b5e/ironic/drivers/modules/network/flat.py#L68 | |
| 17:36:56 | jroll | mriedem: rather than sometimes passing back the host id to the compute manager (to bind it then), and sometimes passing None back (to bind it later in ironic) | |
| 17:37:05 | jroll | now we just always bind it in ironic | |
| 17:37:22 | jroll | "binding it" meaning give it binding:host_id, which triggers ML2 stuff to actually connect it | |
| 17:37:51 | mriedem | ok so now when creating a node you need to provide the instance.host | |
| 17:37:54 | mriedem | and this patcher thing does that | |
| 17:38:24 | jroll | yeah, that patcher thing passes info we need from nova | |
| 17:38:41 | mriedem | ok https://github.com/openstack/ironic/blob/e72e68eb38c4325bb868a504106be097251c3b5e/ironic/drivers/modules/network/flat.py#L68 clears it up | |
| 17:38:42 | mriedem | thanks | |
| 17:38:44 | jroll | I agree with vasyl we should clean that up later and just use the node uuid | |
| 17:38:46 | jroll | np | |
| 17:40:24 | mriedem | also, docs people want you guys to specifically say 'ironic' instead of 'Ironic'? | |
| 17:40:26 | mriedem | that seems weird | |
| 17:40:49 | mriedem | i'd think that would be confusing to people new to openstack | |
| 17:40:55 | cdent | mriedem: this https://review.openstack.org/#/c/416761/ needs to come before https://review.openstack.org/#/c/416760/ in that stack of fixes | |
| 17:41:17 | mriedem | cdent: ah, well that's easy enough | |
| 17:41:36 | cdent | mriedem: docs people want lower case project names, I've never seen the reason why, but I also though they wanted service names instead of project names in docs? | |
| 17:42:10 | mriedem | yeah the idea is Compute service, Bare Metal service, Networking service, etc | |
| 17:42:19 | mriedem | what happens when they get to Monitoring service :) | |
| 17:42:28 | cdent | everyone runs and hides | |
| 17:42:35 | mriedem | Image Repository Service | |
| 17:43:57 | cdent | mriedem: you want me to reorder that stuff, or you got it? | |
| 17:44:21 | mriedem | cdent: i'll get it, i have to rebase the last 2 in the series anyway now due to merge conflicts | |
| 17:44:29 | cdent | ✔ | |
| 17:46:37 | mriedem | jroll: ok so begins the elusive hunt for that 2nd core https://review.openstack.org/#/c/364413/ | |
| 17:55:28 | gabor_antal | mriedem: Did you have any time to think about my problem or so? If it would be better, I can commit what I've done on the patchset, but it is not mine, just wanted to review. | |
| 18:01:50 | shewless | hello. does anyone know what user the oslo_service.service runs as for nova? | |
| 18:02:24 | shewless | Trying to get SSL to work.. but apparently it can't the key_file.. I think it's because the key file is owned by root | |
| 18:02:41 | mriedem | gabor_antal: you can't live migrate to the same host | |
| 18:02:45 | mriedem | only resize | |
| 18:03:01 | mriedem | gabor_antal: so what i think you're trying to test isn't going to work this way | |
| 18:03:01 | shewless | I guessed nova but I don't think that's right | |
| 18:04:11 | mriedem | gabor_antal: so for testing you'd need 2 fake compute services, boot an instance on one and live migrate it to the other | |
| 18:05:08 | gabor_antal | mriedem: I thought that way also, but in the kilo, there were a conf flag to use the same host to migrate (for testing), http://docs.openstack.org/kilo/config-reference/content/list-of-compute-config-options.html | |
| 18:05:53 | gabor_antal | mriedem: do you know about any examples which works like you mentioned? | |
| 18:06:43 | shewless | if I open up the permissions of my "private" SSL cert directory so that "everyone" has read access then I get past that error.. so that's how I know it's a permission problem | |
| 18:07:12 | mriedem | gabor_antal: not without digging | |
| 18:08:19 | openstackgerrit | Davanum Srinivas (dims) proposed openstack/nova: [WIP] ignore me - trying experimental jobs https://review.openstack.org/421209 | |
| 18:09:30 | shewless | So to summarize I found all the nova.conf settings to enable nova-api to be SSL but I don't know what user/permissions to use for my SSL keys. | |
| 18:09:46 | shewless | I have the users/permissions setup such that they work with apache but nova will have non of it | |
| 18:10:01 | shewless | can anyone point me in the right direction? | |
| 18:10:36 | mriedem | gabor_antal: btw this is the patch that removed the allow_migrate_to_same_host option in liberty https://review.openstack.org/#/c/118604/ - it was never for live migration | |
| 18:11:53 | gabor_antal | mriedem: thanks for the info | |
| 18:12:13 | mriedem | shewless: there is nothing in here http://docs.openstack.org/security-guide/compute.html ? | |
| 18:12:20 | gabor_antal | mriedem: you mean something like this? https://github.com/openstack/nova/blob/master/nova/tests/functional/test_server_group.py | |
| 18:12:47 | mriedem | gabor_antal: yeah something like this https://github.com/openstack/nova/blob/master/nova/tests/functional/test_server_group.py#L114 | |
| 18:13:50 | shewless | mriedem: no nothing that goes down that low. | |
| 18:13:59 | shewless | mriedem: the error I see is ERROR oslo_service.service RuntimeError: Unable to find key_file : /etc/pki/tls/private/mykey.key | |
| 18:14:44 | shewless | mriedem: if I change the private directory to 777 just to test I get past that error and hit another silly permission error | |
| 18:15:06 | shewless | ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied | |
| 18:15:52 | shewless | I assume this oslo_service is either running as root or nova.. but that doesn't seem to be the case because I've set the "read" permissions on the files so that both nova and root can access them | |
| 18:22:00 | shewless | sigh. I can't get past this error even if I open up the permisions on my certs for everyone: ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied | |
| 18:23:02 | mriedem | shewless: clarkb got TLS working in the upstream CI environment, he might be able to help (maybe in #openstack-dev), else i'd probably ask in #openstack-operators or just #openstack | |
| 18:23:37 | shewless | mriedem: thanks. SSL support for nova seems to be pretty dodgy.. | |
| 18:23:47 | mriedem | is this just nova or all of your services though? | |
| 18:23:51 | mriedem | i'd expect this to be universal | |
| 18:23:59 | shewless | mridem: nova so far | |
| 18:24:04 | shewless | I have keystone working perfectly | |
| 18:24:08 | shewless | mind you that's through apache | |
| 18:24:12 | shewless | it just works | |
| 18:24:15 | mriedem | but glance/cinder/neutron too? | |
| 18:24:20 | shewless | nova has been a pain in my side | |
| 18:25:59 | shewless | my current goal is to get SSL to work for horizon (done), keystone (done), nova and spice. I haven't tried glance or neutron. But I'm dealing specifically with nova.conf.. not sure if neutron would have the same options | |
| 18:26:11 | mriedem | well, | |
| 18:26:19 | mriedem | the ssl options come from oslo.service I think | |
| 18:26:29 | mriedem | so that's why i figured it'd be a universal problem, | |
| 18:26:39 | mriedem | having said that, i think nova.conf has several different ssl-related options which gets confusing | |
| 18:26:55 | shewless | it sure does | |
| 18:27:07 | shewless | (get confusing) | |
| 18:27:30 | gabor_antal | mriedem: thanks, I try to do the job. I'll write you, if I have some problem | |
| 18:27:56 | mriedem | shewless: sorry. if you find an answer it'd be great to get that fed back into the docs - not entirely sure which docs those are, since i'm finding several related to security in docs.o.o | |
| 18:28:19 | mriedem | dane-fichter (not in channel atm) would be another good resource | |
| 18:28:52 | mriedem | dane was working on getting a security-specific CI job configured for testing the various security-related features/configurations in openstack, like signed images, using barbican for key mgmt, etc | |
| 18:29:01 | mriedem | so he knows infinitely more about this than i do | |
| 18:29:09 | shewless | okay thanks | |
| 18:29:47 | openstackgerrit | Matt Riedemann proposed openstack/nova: DNM: Test interface attach/detach for Ironic https://review.openstack.org/421638 | |
| 18:31:11 | shewless | ah crap. restarting nova-api seemed to get rid of the error :( now to find out which change I made actually fixed the problem! | |
| 18:31:25 | mriedem | ha | |
| 18:31:34 | mriedem | my guess would be a config change? | |
| 18:31:41 | mriedem | restarting nova-api would pick up a config change | |
| 18:32:04 | mriedem | cdent: got that series all cleaned up now, thanks for helping me out there | |