| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-06-12 | |||
| 14:02:13 | dansmith | sahid: something like this: https://pastebin.com/waWNUM3U | |
| 14:02:27 | dansmith | sahid: (that is in base.NovaObject btw) | |
| 14:03:10 | sahid | dansmith: oh i see | |
| 14:03:38 | sahid | not a big fan :) but yes it's a way to achieve the same thing | |
| 14:04:44 | mriedem | bauzas: relevant parts of the spec https://specs.openstack.org/openstack/nova-specs/specs/rocky/approved/nova-validate-certificates.html#proposed-change | |
| 14:04:51 | mriedem | https://specs.openstack.org/openstack/nova-specs/specs/rocky/approved/nova-validate-certificates.html#other-deployer-impact | |
| 14:05:30 | mriedem | i think it just means, enable_certificate_validation=True means enforce cert validation and default_trusted_certificate_ids is if you enforce and don't want to kill your users if they don't provide trusted certs in the server create/rebuild requests | |
| 14:06:04 | mriedem | both get used in the API changes, and you wouldn't want to set enable_certificate_validation=True UNTIL the api changes are in place to use default_trusted_certificate_ids | |
| 14:06:09 | mriedem | at least as things are written today | |
| 14:07:03 | mriedem | since enable_certificate_validation is deprecated, i'm not sure at what point it is removed, | |
| 14:07:09 | mriedem | nor do i understand how it's a transition to anything | |
| 14:07:41 | mriedem | i guess both options together are meant to enable the transition to cert validation of images | |
| 14:07:48 | mriedem | before forcing it on users | |
| 14:11:38 | bauzas | mriedem: sorry was afk | |
| 14:13:56 | bauzas | mriedem: " all prior usage of the server create/rebuild API when booting signed images will now fail if trusted certificates cannot be located." | |
| 14:15:21 | bauzas | mriedem: okay, so when the API change is merged, I understand that things will continue to work as defaults will be seen as user-provided | |
| 14:15:49 | simondodsley_ | mreidem: referencing the Cinder QoS change... the QoS values you see are the capacity based QoS options. These are for things like Ceph and ScaleIO (I think). The external disk QoS spec is separate to these per_gb values. The spec for external disk QoS is here: https://github.com/openstack/cinder/blob/master/cinder/volume/qos_specs.py. This doesn't appear to have any documentation, so I will create these once the | |
| 14:15:49 | simondodsley_ | Nova piece has been merged there are no Cinder changes required to add new QoS values | |
| 14:15:54 | bauzas | mriedem: later, when they want to drop the defaults and force the user to ask, then it would pop up an exception | |
| 14:16:39 | simondodsley_ | mriedem: ^ | |
| 14:17:33 | bauzas | mriedem: unrelated how can we know that vdi_remote_stream from https://review.openstack.org/#/c/486475/ is going to be CI-tested by Xen ? | |
| 14:17:49 | bauzas | because the 3rd-party CI says cool, but I don't know if it checked it | |
| 14:18:21 | mriedem | bauzas: that patch isn't using vdi_remote_stream | |
| 14:18:26 | mriedem | that's why i have https://review.openstack.org/#/c/574318/ | |
| 14:18:32 | mriedem | which hasn't had xenserver ci run on it | |
| 14:18:54 | mriedem | "Matt, thanks for this DNM patch. But it looks like the Citrix CI is out of service now. Naichuan and Bob will help to fix it." | |
| 14:19:37 | mriedem | looks like https://review.openstack.org/#/c/486446/ does it though... | |
| 14:19:50 | bauzas | mriedem: but AFAICU, your DNM change only checks UTs | |
| 14:19:56 | mriedem | no | |
| 14:20:04 | mriedem | it's meant to trigger the xenserver 3rd party CI | |
| 14:20:06 | bauzas | mriedem: how can we sure that the Xen CI is using those opts ? | |
| 14:20:08 | mriedem | to test this new image handler | |
| 14:20:20 | bauzas | aaaaaah | |
| 14:20:26 | bauzas | I see, hence the default opt value change | |
| 14:20:29 | mriedem | yes | |
| 14:20:43 | bauzas | ok | |
| 14:20:43 | mriedem | how do you ensure we test the libvirt driver with the raw image backend? | |
| 14:20:52 | mriedem | since qcow2 is the default | |
| 14:21:07 | bauzas | lemme be political | |
| 14:21:16 | bauzas | that's an excellent question, I'll come to it later | |
| 14:21:18 | mriedem | so the xen image handler defaults to direct_vhd, so that's what was getting tested, but it looks like they have changed the xenserver CI to use vdi_remote_stream https://review.openstack.org/#/c/486446/ | |
| 14:21:38 | mriedem | so now the 3rd party CI is testing the non-default image handler....which seems not great | |
| 14:21:51 | garyk | johnthetubaguy: mriedem: can you please remove the -2 on https://review.openstack.org/#/c/270116/. the spec has been approved | |
| 14:22:02 | garyk | we are still working on some kinks with the CI | |
| 14:22:20 | bauzas | mriedem: I see, thanks for the heads up | |
| 14:23:07 | kashyap | Some of you here might be interested in this 'fun' info: upstream QEMU there is "fierce" and KM-long discussion whether to put some configuration info directly into qcow2 image format (e.g. the min amount of RAM, and importantly the machine type of 'pc' vs. the more advanced 'q35'). | |
| 14:23:24 | openstackgerrit | Merged openstack/nova master: Move db using provider unit tests to functional https://review.openstack.org/572280 | |
| 14:23:24 | kashyap | But no one has seriously committed to it, though. | |
| 14:23:32 | openstackgerrit | Merged openstack/nova master: Adjust db using allocation unit tests https://review.openstack.org/572281 | |
| 14:23:40 | openstackgerrit | Merged openstack/nova master: Remove nova dependencies from test_resource_provider https://review.openstack.org/572282 | |
| 14:23:58 | mriedem | garyk: i can't remove johnthetubaguy's -2 | |
| 14:24:02 | mriedem | i asked him last week to drop it | |
| 14:24:13 | garyk | mriedem: thanks! | |
| 14:24:21 | garyk | johnthetubaguy: ^ | |
| 14:25:16 | kashyap | (It's primarily because, disk images are shipped as qcow2 images. And QEMU folks don't want to break Nova et al, if they switch the default machine type) | |
| 14:25:47 | kashyap | Nova-related discussion: https://bugzilla.redhat.com/show_bug.cgi?id=1581414 | |
| 14:25:48 | openstack | bugzilla.redhat.com bug 1581414 in openstack-nova "OpenStack shouldn't break if the default machine-type in QEMU is "q35"" [Medium,New] - Assigned to kchamart | |
| 14:26:17 | mriedem | simondodsley_: i'm not sure why the cinder documentation for the new qos specs needs to wait for the nova change to merge, | |
| 14:26:29 | mriedem | simondodsley_: as i said in the nova patch, i won't merge the nova change until i at least see the cinder docs change for those new qos specs | |
| 14:26:38 | mriedem | otherwise you have no incentive to actually write the docs | |
| 14:27:42 | mriedem | dansmith: is there anything logged from oslo.messaging when it does a heartbeat while we're running pre_live_migration with the long timeout? | |
| 14:27:54 | mriedem | i was looking for something in the n-cpu logs from this https://review.openstack.org/#/c/574482/ | |
| 14:28:07 | dansmith | mriedem: at debug, I said on your patch | |
| 14:28:23 | dansmith | but that causes a bunch of noise if enabled | |
| 14:28:39 | simondodsley_ | mreidem: I'm actually writing the docs now. If I say I will do something then I will do it... As there is no documentation for these external disk QoS parameters including the originals, that would mean adding a page without the new parameters, and then updating it once the Nova patch merged. | |
| 14:29:04 | mriedem | on *your* patch https://review.openstack.org/#/c/566696/9/nova/compute/rpcapi.py@699 | |
| 14:29:18 | mriedem | but ok, i can make that happen too | |
| 14:31:06 | dansmith | mriedem: oh right I thought it was on one of yours above, but whatever :) | |
| 14:33:20 | mriedem | simondodsley_: replies inline https://review.openstack.org/#/c/558530/3 | |
| 14:34:10 | mriedem | bauzas: yeah, once they remove that stuff it becomes an error - i don't think anyone should probably do that, though, until we have the compute capabilities traits filtering during scheduling | |
| 14:34:25 | mriedem | so at least scheduling of new instances is smarter wrt where trusted certs instances can be built | |
| 14:42:20 | jmccarthy | Anyone have a min to look at this request req-2d031a52-360a-4425-bdf9-1d7630833b43 in nova-api.log https://paste.fedoraproject.org/paste/mUjA9N7upfW0gqmeXjgRMw ? It's a deadlock timeout that seems to be happening fairly often (kolla queens, mysqlcluster database) | |
| 14:49:33 | openstackgerrit | Merged openstack/nova master: Transform instance.exists notification https://review.openstack.org/403660 | |
| 14:54:35 | openstackgerrit | Merged openstack/nova master: Do not use nova.test in placement.test_util https://review.openstack.org/574403 | |
| 14:55:18 | jmccarthy | Seems possibly similar to this bug, https://bugs.launchpad.net/nova/+bug/1642537 although mine is Error: 1205 SQLSTATE: HY000 (ER_LOCK_WAIT_TIMEOUT) not Error: 1213 SQLSTATE: 40001 (ER_LOCK_DEADLOCK) | |
| 14:55:19 | openstack | Launchpad bug 1642537 in OpenStack Compute (nova) "finish_resize fails with DBDeadlock on migrations table" [Undecided,Confirmed] | |
| 14:55:21 | openstackgerrit | Matt Riedemann proposed openstack/nova master: DNM: test heartbeat code in pre_live_migration https://review.openstack.org/574482 | |
| 14:57:31 | mriedem | bpoulos: thanks for replying to the ML thread, | |
| 14:57:59 | mriedem | bpoulos: i think my only remaining question on this change then is https://review.openstack.org/#/c/479949/76/nova/image/glance.py@385 | |
| 14:58:22 | mriedem | if trusted_certs is None and enable_certificate_validation is True, why don't we use default_trusted_certificate_ids? | |
| 14:58:43 | mriedem | in download() i mean | |
| 14:59:41 | bpoulos | mriedem: I think the default_trusted_certificate_ids are pulled if both config options are set to True (which would lead trusted_certs to be not None) | |
| 14:59:46 | bpoulos | but I will confirm | |
| 14:59:56 | mriedem | in the api yes i'm aware of that | |
| 15:00:16 | mriedem | i'm just thinking, if i upgrade to rocky and upgrade my computes before the api, | |
| 15:00:20 | mriedem | we could have a gap here | |
| 15:00:54 | mriedem | maybe all that's needed is a release note saying don't set enable_certificate_validation=True in your computes until the API is upgraded to rocky | |
| 15:02:10 | bpoulos | yeah, I can add that release note. It also wouldn't hurt to check for the default ids at that point, since there wouldn't be a risk of overriding the user-provided certs | |
| 15:02:59 | mriedem | we don't need a reno if the download() code condition where trusted_certs is None and enable_certificate_validation=True uses the default certs | |
| 15:03:39 | bpoulos | ok, I'll just make the change then (along with addressing the other comments) | |
| 15:03:55 | mriedem | ok thanks | |
| 15:03:59 | bpoulos | thank you for your feedback! I appreciate you taking a detailed look at the implementation | |
| 15:04:31 | mriedem | np, i want to go through this series in detail again today, and i'll probably address any minor issues myself if i come across them to keep things going, just fyi | |
| 15:05:12 | bpoulos | ok, great, thanks for the heads up | |
| 15:07:33 | edleafe | Question for all you boot-from-volume experts. Can a running VM that is booted from a volume resize that volume? Or must it be taken offline first? | |
| 15:09:41 | openstackgerrit | Merged openstack/nova master: Do not use nova.test in placement.handlers.test_aggregate https://review.openstack.org/574404 | |
| 15:09:47 | openstackgerrit | Merged openstack/nova master: Do not use nova.test in placement.test_requestlog https://review.openstack.org/574405 | |
| 15:09:54 | openstackgerrit | Merged openstack/nova master: Do not use nova.test in placement.test_fault_wrap https://review.openstack.org/574406 | |
| 15:10:01 | openstackgerrit | Merged openstack/nova master: Do not use nova.test in placement.test_handler https://review.openstack.org/574407 | |
| 15:11:19 | lyarwood | edleafe: that depends on the volume and virt drivers being used | |