| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2017-03-24 | |||
| 18:43:06 | nkorabli | nope | |
| 18:43:40 | mriedem | your command screenshot doesn't show the unshelve command you ran | |
| 18:44:01 | nkorabli | take a look at the second screenshot I attached, I do a check after every action - to see what is the state of instance | |
| 18:44:06 | mriedem | oh wait a minute, | |
| 18:44:09 | nkorabli | hmmm | |
| 18:44:10 | mriedem | i bet i know the issue, | |
| 18:44:13 | mriedem | you shelved as one user, | |
| 18:44:23 | mriedem | so the snapshot image only has access from that user, | |
| 18:44:35 | mriedem | so when you go to unshelve, the unshelve user context doesn't have access to the private snapshot image | |
| 18:44:38 | mriedem | and you get a 404 | |
| 18:45:00 | nkorabli | Yeah, I described this in the bug description | |
| 18:45:22 | nkorabli | I mean, that snapshot is stored under admin | |
| 18:45:29 | mriedem | yeah sorry i missed that | |
| 18:45:34 | mriedem | just connected those dots :) | |
| 18:45:59 | nkorabli | no problems :) it's always good to ask questions and double check :) | |
| 18:46:10 | nkorabli | So, I suppose it's a bug | |
| 18:46:16 | mriedem | i believe the admin user can give membership access to the demo user so they can use the image | |
| 18:46:43 | mriedem | it may be a bug in nova that we aren't using the instance owner for the image | |
| 18:47:39 | nkorabli | I just want to find the right workflow - like if it's shelved by admin, than demo user shoudn't be able to unshelve it? or not? | |
| 18:49:25 | mriedem | i'd need to see what we do for snapshot, since it's a similar case, | |
| 18:49:38 | mriedem | if the admin snapshots a demo user's instance, can the demo user access that snapshot image | |
| 18:49:57 | mriedem | it's slightly different though because the demo user doesn't need to really care about that snapshot image, they may never need it, | |
| 18:50:01 | mriedem | but for unshelve, the instance is tied to it | |
| 18:51:09 | nkorabli | yeaaah :) it's confusing a bit | |
| 18:54:45 | jroll | mriedem: I've got $20 on that behavior coming from some forensics use case | |
| 18:55:02 | mriedem | jroll: like, murder? | |
| 18:55:09 | jroll | maybe! | |
| 18:55:14 | jroll | all sorts of crime, really | |
| 19:02:11 | mriedem | i've got to say i'm not following the CIS angle to this | |
| 19:02:25 | mriedem | is that some kind of michigander joke? | |
| 19:03:56 | nkorabli | mriedem: I also realized, that I have not attached the whole list of commands I ran. Updated it | |
| 19:07:42 | openstackgerrit | Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779 | |
| 19:10:36 | openstackgerrit | Anusha Unnam proposed openstack/nova master: Add description to policies in services.py https://review.openstack.org/449782 | |
| 19:11:12 | openstackgerrit | Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779 | |
| 19:14:09 | mriedem | it looks like when we create a snapshot image, we set is_public=False, which for glance v2 is visibility=private | |
| 19:14:18 | mriedem | looking at the image api docs, the default visibility is shared | |
| 19:14:35 | mriedem | which means we could add the instance owner to the snapshot as a member | |
| 19:15:19 | mriedem | i start to get totally lost when talking about image membership, and the image.owner value | |
| 19:15:31 | mriedem | because i believe it's all configurable in glance to behave differently | |
| 19:15:39 | mriedem | mordred: ^ i'm sure you've experienced this? | |
| 19:16:08 | mriedem | and the image member has to 'accept' membership before they can see the image | |
| 19:17:18 | nkorabli | but maybe demo user just shouldn't have permission to unshelve it once admin shelved it? I guess it make sense | |
| 19:17:38 | mriedem | the default policy on shelve and unshelve is admin or owner | |
| 19:17:50 | mriedem | so if the admin shelves my instance, i as the owner should still be able to unshelve it | |
| 19:18:03 | nkorabli | when demo user is an operator, for example and admin is aware of the resources and stuff.. | |
| 19:18:33 | mriedem | then idk, i guess restrict the policy on unshelve to be admin-only | |
| 19:18:43 | mriedem | but then why shelve at all? | |
| 19:20:03 | nkorabli | well, shelving is a mystery thing for me. As I would say it's kind of a rudiment.. I maybe wrong here :) | |
| 19:22:38 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404 | |
| 19:22:40 | nkorabli | but basically, it is maybe useful when you need to save resources.. Like - this VM won't be used for next week/month, but then you will need it, so you shelve and unshelve it... But I am not sure about it either. | |
| 19:23:58 | mriedem | well that's the idea yeah | |
| 19:24:07 | mriedem | why the admin would do it though, i'm not sure | |
| 19:25:24 | mordred | mriedem: looking | |
| 19:26:08 | mordred | mriedem: I have not played with shared images yet, no - although I'm starting to feel like maybe I shoud ... | |
| 19:26:19 | mriedem | nkorabli: see if this makes sense https://bugs.launchpad.net/nova/+bug/1675791/comments/10 | |
| 19:26:19 | openstack | Launchpad bug 1675791 in OpenStack Compute (nova) "Instance created by demo user(non-admin), shelved by admin and unshelved by demo user --> ends up in error state " [Undecided,Invalid] | |
| 19:26:23 | mriedem | but i think image membership is what we need | |
| 19:26:46 | mriedem | basically, if the admin shelves a user's instance, the admin owns the image, but the instance user owner needs to be a member on the share dimage, | |
| 19:26:48 | mriedem | *shared image | |
| 19:26:49 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #3: TaskFlow https://review.openstack.org/438729 | |
| 19:26:55 | mriedem | so the instance user can later unshelve the instance, | |
| 19:27:13 | mriedem | the docs say an image member can't see the image when listing images until they accept the membership, | |
| 19:27:20 | mriedem | but they can GET the image if they know the specific ID | |
| 19:27:22 | mriedem | which we do in the unshelve case | |
| 19:27:26 | mriedem | nkorabli: i think that's the fix | |
| 19:28:01 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #4: full flavor https://review.openstack.org/391288 | |
| 19:28:38 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: console https://review.openstack.org/409402 | |
| 19:29:08 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: SSP emphemeral disk support https://review.openstack.org/443189 | |
| 19:29:17 | openstackgerrit | Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404 | |
| 19:30:09 | efried | adreznec esberglu The whole pile is ready for subteam +1s again. | |
| 19:30:20 | efried | Got up to cfg_drv this time. | |
| 19:30:25 | efried | Will update the etherpad accordingly. | |
| 19:30:39 | esberglu | efried: ack | |
| 19:30:59 | efried | (mriedem I'm gonna keep the bottom one in "ready for your review" section - changes trivial since last subteam +1) | |
| 19:46:12 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: API support for tagged device attachment https://review.openstack.org/376021 | |
| 19:46:33 | nkorabli | mriedem: alright! I see. Still think that if it's shelved by admin - user shouldn't be able to unshelve it, though :) But it's kind of a bikeshed probablu | |
| 19:46:42 | nkorabli | *probably | |
| 19:47:18 | nkorabli | so should I change the ticket status? | |
| 19:47:19 | mriedem | nkorabli: in that case, i'd ask in the dev and operators mailing list since this is a latent issue | |
| 19:47:33 | mriedem | nkorabli: i'm genuinely curious what operators think about this | |
| 19:48:27 | melwitt | if the instance is owned by the user, I don't see why they shouldn't be able to unshelve it, no matter who shelved it | |
| 19:48:40 | mriedem | melwitt: i agree | |
| 19:48:49 | mriedem | nkorabli: do you want to send that email or should i? | |
| 19:48:55 | nkorabli | mriedem: Agree, it make sense | |
| 19:49:50 | nkorabli | mriedem: I can do this, just may need your help if someone won't get the idea.. | |
| 19:51:28 | nkorabli | just don't have any experience with mailing lists.. Is there any requirements of how I have to ask questions there? | |
| 19:53:37 | mriedem | no, just state the problem and proposed solution, and see if anyone has a problem with that | |
| 19:53:55 | mriedem | ask in the openstack-dev and openstack-operators mailing lists, and prefix the subject with [nova] so it filters properly | |
| 19:55:19 | melwitt | a use case I can invent for why an admin would shelve something is if they need to free up some resources to do something temporarily and might leave it up to the instance owners to unshelve their stuff later | |
| 19:58:00 | openstackgerrit | John Garbutt proposed openstack/nova-specs master: WIP: Add policy-remove-scope-checks spec https://review.openstack.org/433037 | |
| 19:58:05 | melwitt | or maybe if admin notices X instances have been idle for Y days, shelve those instances and users have a grace period to unshelve, else their instances will be deleted by admin. I dunno | |
| 19:58:36 | mriedem | we used to have an auto shutdown thing in our internal dev cloud | |
| 19:58:43 | mriedem | where after 2 weeks your vm was shutdown | |
| 19:59:09 | mriedem | some of that was tied to licenses on the os i think | |
| 19:59:21 | mriedem | if you were using a vm for longer than 2 weeks we had to register it for internal compliance audits and such | |
| 19:59:22 | nkorabli | I guess there is some shelve offload time option? Like it will be automatically destroyed after some period of time, or not? | |
| 19:59:35 | mriedem | nkorabli: yes, by default it offloads immediately | |
| 19:59:44 | mriedem | offload == delete the guest from the hypervisor | |
| 20:00:01 | mriedem | so when you unshelve, we have to build the guest again on another compute | |
| 20:00:57 | nkorabli | Ohh... I see! I wasn't sure what the difference between 'shelved' and 'shelved_offloaded'. | |