| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-01-18 | |||
| 18:13:50 | shewless | mriedem: no nothing that goes down that low. | |
| 18:13:59 | shewless | mriedem: the error I see is ERROR oslo_service.service RuntimeError: Unable to find key_file : /etc/pki/tls/private/mykey.key | |
| 18:14:44 | shewless | mriedem: if I change the private directory to 777 just to test I get past that error and hit another silly permission error | |
| 18:15:06 | shewless | ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied | |
| 18:15:52 | shewless | I assume this oslo_service is either running as root or nova.. but that doesn't seem to be the case because I've set the "read" permissions on the files so that both nova and root can access them | |
| 18:22:00 | shewless | sigh. I can't get past this error even if I open up the permisions on my certs for everyone: ERROR oslo_service.service self._context.load_cert_chain(certfile, keyfile) ERROR oslo_service.service IOError: [Errno 13] Permission denied | |
| 18:23:02 | mriedem | shewless: clarkb got TLS working in the upstream CI environment, he might be able to help (maybe in #openstack-dev), else i'd probably ask in #openstack-operators or just #openstack | |
| 18:23:37 | shewless | mriedem: thanks. SSL support for nova seems to be pretty dodgy.. | |
| 18:23:47 | mriedem | is this just nova or all of your services though? | |
| 18:23:51 | mriedem | i'd expect this to be universal | |
| 18:23:59 | shewless | mridem: nova so far | |
| 18:24:04 | shewless | I have keystone working perfectly | |
| 18:24:08 | shewless | mind you that's through apache | |
| 18:24:12 | shewless | it just works | |
| 18:24:15 | mriedem | but glance/cinder/neutron too? | |
| 18:24:20 | shewless | nova has been a pain in my side | |
| 18:25:59 | shewless | my current goal is to get SSL to work for horizon (done), keystone (done), nova and spice. I haven't tried glance or neutron. But I'm dealing specifically with nova.conf.. not sure if neutron would have the same options | |
| 18:26:11 | mriedem | well, | |
| 18:26:19 | mriedem | the ssl options come from oslo.service I think | |
| 18:26:29 | mriedem | so that's why i figured it'd be a universal problem, | |
| 18:26:39 | mriedem | having said that, i think nova.conf has several different ssl-related options which gets confusing | |
| 18:26:55 | shewless | it sure does | |
| 18:27:07 | shewless | (get confusing) | |
| 18:27:30 | gabor_antal | mriedem: thanks, I try to do the job. I'll write you, if I have some problem | |
| 18:27:56 | mriedem | shewless: sorry. if you find an answer it'd be great to get that fed back into the docs - not entirely sure which docs those are, since i'm finding several related to security in docs.o.o | |
| 18:28:19 | mriedem | dane-fichter (not in channel atm) would be another good resource | |
| 18:28:52 | mriedem | dane was working on getting a security-specific CI job configured for testing the various security-related features/configurations in openstack, like signed images, using barbican for key mgmt, etc | |
| 18:29:01 | mriedem | so he knows infinitely more about this than i do | |
| 18:29:09 | shewless | okay thanks | |
| 18:29:47 | openstackgerrit | Matt Riedemann proposed openstack/nova: DNM: Test interface attach/detach for Ironic https://review.openstack.org/421638 | |
| 18:31:11 | shewless | ah crap. restarting nova-api seemed to get rid of the error :( now to find out which change I made actually fixed the problem! | |
| 18:31:25 | mriedem | ha | |
| 18:31:34 | mriedem | my guess would be a config change? | |
| 18:31:41 | mriedem | restarting nova-api would pick up a config change | |
| 18:32:04 | mriedem | cdent: got that series all cleaned up now, thanks for helping me out there | |
| 18:32:19 | cdent | you're very welcome | |
| 18:32:23 | shewless | quite possibly.. there are two sets of ssl options advertised in nova.conf.. I removed 1 of them.. it was either that or the file permission changes I made | |
| 18:34:34 | shewless | mriedem you know it seems to be the file permissions.. when I change them I seem to need to restart nova-api for that error to go away | |
| 18:35:57 | shewless | anyways.. thanks.. I'm further on now | |
| 18:53:27 | openstackgerrit | Sivasathurappan Radhakrishnan proposed openstack/nova: Raise general error message when volume attach fails https://review.openstack.org/320163 | |
| 19:00:16 | mriedem | https://review.openstack.org/#/c/398473/ needs another core | |
| 19:00:31 | mriedem | would get us down to 1 remaining change for ironic + resource classes | |
| 19:01:12 | mriedem | jaypipes: john is +2 on the osprofiler change now, which you were +2 on before if you are still https://review.openstack.org/#/c/254703/ | |
| 19:01:18 | mriedem | and when you get a break | |
| 19:03:48 | _gryf | EmilienM, bauzas, cdent, mriedem, doesn't placement API supposed to run on 80 port? if so, than this apache vhost is configured somehow wrong, doesn't it? http://logs.openstack.org/04/419604/1/check/gate-puppet-openstack-integration-4-scenario004-tempest-centos-7/5d95a8c/logs/apache_config/10-placement_wsgi.conf.txt.gz | |
| 19:03:56 | _gryf | or maybe it is not relevant at all? | |
| 19:04:38 | EmilienM | this is not relevant, you can run an API how you like on the port you like | |
| 19:04:48 | cdent | _gryf: how devstack configures things and how puppet configures things is not necessary going to be the same | |
| 19:04:49 | _gryf | okay | |
| 19:08:59 | openstackgerrit | Claudiu Belu proposed openstack/nova: hyper-v: Adds support for VMs with nested virtualization https://review.openstack.org/398509 | |
| 19:09:33 | openstackgerrit | Diana Clarke proposed openstack/nova: Fix map_cell_and_hosts help https://review.openstack.org/422171 | |
| 19:10:38 | openstackgerrit | Vasyl Saienko proposed openstack/nova: Generate necessary network metadata for ironic port groups https://review.openstack.org/388756 | |
| 19:11:43 | openstackgerrit | Dean Troyer proposed openstack/python-novaclient: DNM: another OSC+SDK check https://review.openstack.org/422174 | |
| 19:21:21 | jaypipes | mriedem: done. | |
| 19:37:14 | mriedem | jroll: can you have the same vif id in a list of ports and a list of portgroups? | |
| 19:37:16 | mriedem | for the same node? | |
| 19:53:27 | mriedem | vdrok: i've got some questions in https://review.openstack.org/#/c/388756/ | |
| 19:53:32 | jroll | mriedem: no, a vif id can only be attached to one thing, AIUI | |
| 19:54:21 | mriedem | jroll: question the 2nd: can you have a port in more than one portgroup for the same node? | |
| 19:55:29 | jroll | mriedem: no | |
| 19:55:53 | mriedem | 3rd: who is your daddy and what does he do? | |
| 19:58:39 | jroll | :P | |
| 19:59:18 | vdrok | mriedem: thanks, a bit late now, will post replies tomorrow. Short version - duplicates are not possible because of the way nova generates id ( was asked by rloo in previous PS ) and cloud init does not validate parameters :) | |
| 19:59:46 | mriedem | ok | |
| 20:13:04 | wasmum | instance build from an image - running fine. needed a reboot. The original image is no longer in the image store and thus instance erroring out. Any way to resolve that? | |
| 20:13:38 | mriedem | wasmum: did you snapshot the instance? | |
| 20:13:49 | mriedem | do you have the image in the image cache on the compute host? | |
| 20:14:17 | wasmum | mriedem: image cache, tell me more? | |
| 20:16:20 | mriedem | if you're using the libvirt driver, it will store the base image on the compute host the first time it uses it so it doesn't have to re-download commonly used images that build on the same host | |
| 20:16:47 | mriedem | i believe the image cache will clean after itself after there are no instances using a given image in the cache on that host though after some period of time | |
| 20:17:16 | wasmum | where does it pull that image down too? | |
| 20:17:26 | wasmum | file location? I'll check ? | |
| 20:17:37 | mriedem | should be under the instance state path, so i think /var/lib/instances somewhere | |
| 20:17:46 | openstackgerrit | Sergey Nikitin proposed openstack/nova: Change parent of diagnostics objects to NovaObject class https://review.openstack.org/394480 | |
| 20:17:46 | openstackgerrit | Sergey Nikitin proposed openstack/nova: Standardization of VM diagnostics info API. https://review.openstack.org/355540 | |
| 20:17:47 | openstackgerrit | Sergey Nikitin proposed openstack/nova: Completed implementation of instance diagnostics for Xen https://review.openstack.org/399613 | |
| 20:18:14 | mriedem | see the image_cache_manager_interval config option | |
| 20:18:25 | mriedem | and image_cache_subdirectory_name | |
| 20:18:53 | mriedem | and cache_images | |
| 20:19:54 | mriedem | are you using local disk or shared? | |
| 20:20:07 | cfriesen__ | does the separation of some models out into api_models.py have any implications for upgrades? or are they still the same DB tables, just moving the python code around? | |
| 20:20:15 | mriedem | mdbooth: any idea if we have any decent documentation anywhere about the image cache manager? | |
| 20:20:32 | mriedem | cfriesen__: such as? | |
| 20:20:33 | mriedem | flavors? | |
| 20:20:54 | mriedem | cfriesen__: api_models is the API DB schema | |
| 20:21:07 | mriedem | some tables are the same or similar, like flavors / instance_types | |
| 20:21:27 | mriedem | cfriesen__: the models are not entirely the same though, i.e. the API DB doesn't use the soft delete mixin (the deleted and deleted_at columns are not in the API DB) | |
| 20:21:48 | mriedem | cfriesen__: the nova-manage db online_data_migrations is meant to move the data from the cell db to the api db | |
| 20:21:52 | mriedem | s/cell/nova/ | |
| 20:22:22 | openstackgerrit | Sergey Nikitin proposed openstack/nova: DO NOT MERGE https://review.openstack.org/422221 | |
| 20:22:24 | cfriesen__ | mriedem: I was looking at InstanceGroup in particular | |
| 20:23:53 | cfriesen__ | mriedem: a cursory check didn't see any code to migrate InstanceGroup data from the old model to the new | |
| 20:26:54 | mriedem | cfriesen: https://github.com/openstack/nova/blob/master/nova/objects/instance_group.py#L525 | |
| 20:27:25 | mriedem | cfriesen: called from here https://github.com/openstack/nova/blob/master/nova/cmd/manage.py#L612 | |
| 20:27:47 | mriedem | which is initially called from, let's all say it now, https://github.com/openstack/nova/blob/master/nova/cmd/manage.py#L763 | |
| 20:29:32 | cfriesen | mriedem: much appreciated | |
| 20:29:41 | mriedem | yw | |
| 20:36:14 | wasmum | mriedem: looks like it was built from a snapshot, snapshot was deleted | |
| 20:36:38 | wasmum | learning lessons on why not to build snowflakes | |
| 20:36:56 | mriedem | wasmum: and the image isn't cached on the compute host? | |