Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2017-03-24
18:55:14 jroll all sorts of crime, really
19:02:11 mriedem i've got to say i'm not following the CIS angle to this
19:02:25 mriedem is that some kind of michigander joke?
19:03:56 nkorabli mriedem: I also realized, that I have not attached the whole list of commands I ran. Updated it
19:07:42 openstackgerrit Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779
19:10:36 openstackgerrit Anusha Unnam proposed openstack/nova master: Add description to policies in services.py https://review.openstack.org/449782
19:11:12 openstackgerrit Sujitha proposed openstack/nova master: [WIP] Add BDM to InstancePayload https://review.openstack.org/448779
19:14:09 mriedem it looks like when we create a snapshot image, we set is_public=False, which for glance v2 is visibility=private
19:14:18 mriedem looking at the image api docs, the default visibility is shared
19:14:35 mriedem which means we could add the instance owner to the snapshot as a member
19:15:19 mriedem i start to get totally lost when talking about image membership, and the image.owner value
19:15:31 mriedem because i believe it's all configurable in glance to behave differently
19:15:39 mriedem mordred: ^ i'm sure you've experienced this?
19:16:08 mriedem and the image member has to 'accept' membership before they can see the image
19:17:18 nkorabli but maybe demo user just shouldn't have permission to unshelve it once admin shelved it? I guess it make sense
19:17:38 mriedem the default policy on shelve and unshelve is admin or owner
19:17:50 mriedem so if the admin shelves my instance, i as the owner should still be able to unshelve it
19:18:03 nkorabli when demo user is an operator, for example and admin is aware of the resources and stuff..
19:18:33 mriedem then idk, i guess restrict the policy on unshelve to be admin-only
19:18:43 mriedem but then why shelve at all?
19:20:03 nkorabli well, shelving is a mystery thing for me. As I would say it's kind of a rudiment.. I maybe wrong here :)
19:22:38 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404
19:22:40 nkorabli but basically, it is maybe useful when you need to save resources.. Like - this VM won't be used for next week/month, but then you will need it, so you shelve and unshelve it... But I am not sure about it either.
19:23:58 mriedem well that's the idea yeah
19:24:07 mriedem why the admin would do it though, i'm not sure
19:25:24 mordred mriedem: looking
19:26:08 mordred mriedem: I have not played with shared images yet, no - although I'm starting to feel like maybe I shoud ...
19:26:19 mriedem nkorabli: see if this makes sense https://bugs.launchpad.net/nova/+bug/1675791/comments/10
19:26:19 openstack Launchpad bug 1675791 in OpenStack Compute (nova) "Instance created by demo user(non-admin), shelved by admin and unshelved by demo user --> ends up in error state " [Undecided,Invalid]
19:26:23 mriedem but i think image membership is what we need
19:26:46 mriedem basically, if the admin shelves a user's instance, the admin owns the image, but the instance user owner needs to be a member on the share dimage,
19:26:48 mriedem *shared image
19:26:49 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #3: TaskFlow https://review.openstack.org/438729
19:26:55 mriedem so the instance user can later unshelve the instance,
19:27:13 mriedem the docs say an image member can't see the image when listing images until they accept the membership,
19:27:20 mriedem but they can GET the image if they know the specific ID
19:27:22 mriedem which we do in the unshelve case
19:27:26 mriedem nkorabli: i think that's the fix
19:28:01 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #4: full flavor https://review.openstack.org/391288
19:28:38 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: console https://review.openstack.org/409402
19:29:08 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: SSP emphemeral disk support https://review.openstack.org/443189
19:29:17 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404
19:30:09 efried adreznec esberglu The whole pile is ready for subteam +1s again.
19:30:20 efried Got up to cfg_drv this time.
19:30:25 efried Will update the etherpad accordingly.
19:30:39 esberglu efried: ack
19:30:59 efried (mriedem I'm gonna keep the bottom one in "ready for your review" section - changes trivial since last subteam +1)
19:46:12 openstackgerrit Artom Lifshitz proposed openstack/nova master: API support for tagged device attachment https://review.openstack.org/376021
19:46:33 nkorabli mriedem: alright! I see. Still think that if it's shelved by admin - user shouldn't be able to unshelve it, though :) But it's kind of a bikeshed probablu
19:46:42 nkorabli *probably
19:47:18 nkorabli so should I change the ticket status?
19:47:19 mriedem nkorabli: in that case, i'd ask in the dev and operators mailing list since this is a latent issue
19:47:33 mriedem nkorabli: i'm genuinely curious what operators think about this
19:48:27 melwitt if the instance is owned by the user, I don't see why they shouldn't be able to unshelve it, no matter who shelved it
19:48:40 mriedem melwitt: i agree
19:48:49 mriedem nkorabli: do you want to send that email or should i?
19:48:55 nkorabli mriedem: Agree, it make sense
19:49:50 nkorabli mriedem: I can do this, just may need your help if someone won't get the idea..
19:51:28 nkorabli just don't have any experience with mailing lists.. Is there any requirements of how I have to ask questions there?
19:53:37 mriedem no, just state the problem and proposed solution, and see if anyone has a problem with that
19:53:55 mriedem ask in the openstack-dev and openstack-operators mailing lists, and prefix the subject with [nova] so it filters properly
19:55:19 melwitt a use case I can invent for why an admin would shelve something is if they need to free up some resources to do something temporarily and might leave it up to the instance owners to unshelve their stuff later
19:58:00 openstackgerrit John Garbutt proposed openstack/nova-specs master: WIP: Add policy-remove-scope-checks spec https://review.openstack.org/433037
19:58:05 melwitt or maybe if admin notices X instances have been idle for Y days, shelve those instances and users have a grace period to unshelve, else their instances will be deleted by admin. I dunno
19:58:36 mriedem we used to have an auto shutdown thing in our internal dev cloud
19:58:43 mriedem where after 2 weeks your vm was shutdown
19:59:09 mriedem some of that was tied to licenses on the os i think
19:59:21 mriedem if you were using a vm for longer than 2 weeks we had to register it for internal compliance audits and such
19:59:22 nkorabli I guess there is some shelve offload time option? Like it will be automatically destroyed after some period of time, or not?
19:59:35 mriedem nkorabli: yes, by default it offloads immediately
19:59:44 mriedem offload == delete the guest from the hypervisor
20:00:01 mriedem so when you unshelve, we have to build the guest again on another compute
20:00:57 nkorabli Ohh... I see! I wasn't sure what the difference between 'shelved' and 'shelved_offloaded'.
20:01:00 nkorabli Cool
20:01:21 melwitt yeah, but shelved instances still take up quota. so deleting them while they're offloaded would free up quota for others in the tenant
20:03:05 melwitt which reminds me, I need to keep an eye on that for how it works with counting
20:03:42 nkorabli mriedem: Thanks a lot for your attention! :) Will send an e-mail today or tomorrow morning.
20:04:46 mriedem nkorabli: np, thanks for persisting on this one
20:13:10 jroll mriedem: sorry, I was being half serious about the forensics thing - i.e. that behavior being a feature for an admin taking a snapshot for purposes of criminal investigation or whatever
20:18:57 mriedem jroll: ack
20:19:15 mriedem sdague: on a server update, i see we call the server view builder show() method and return that in the response body,
20:19:31 mriedem what i'm unclear of, is does that trigger the server show extensions to add their special bits to the response?
20:22:25 mriedem for example, when i look at https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/extended_volumes.py
20:22:33 mriedem that extends the show and detail methods for the servers resource
20:22:49 mriedem but that will only be called on a GET for servers, right?
20:23:01 mriedem it would have nothing to do with the response for a POST or PUT
20:23:08 mriedem the server view builder just does it's own thing
20:25:05 mriedem reason i ask is we currently list os-extended-volumes:volumes_attached in the response for server create and update, and i think those are wrong
20:29:33 openstackgerrit Matt Riedemann proposed openstack/nova master: api-ref: fix os-extended-volumes:volumes_attached in servers responses https://review.openstack.org/449809
20:37:52 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/delete #1: no-ops https://review.openstack.org/438119
20:39:56 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #2: functional https://review.openstack.org/438598
20:40:14 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: power_on/off and reboot https://review.openstack.org/427380
20:40:40 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #3: TaskFlow https://review.openstack.org/438729
20:40:57 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: spawn/destroy #4: full flavor https://review.openstack.org/391288
20:41:16 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: console https://review.openstack.org/409402
20:42:00 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: SSP emphemeral disk support https://review.openstack.org/443189
20:42:08 openstackgerrit Eric Fried proposed openstack/nova master: PowerVM Driver: config drive https://review.openstack.org/409404
20:43:20 efried adreznec esberglu mriedem ^^ Trivial rebases all the way up, because of a change to exception.py (In case you were in the middle of reviewing previous patch set.)
20:43:48 mriedem i was not
20:44:01 efried But, you know, just in case.

Earlier   Later