| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-03 | |||
| 00:16:08 | openstackgerrit | Takashi NATSUME proposed openstack/nova master: Fix a failure to format config sample https://review.openstack.org/597986 | |
| 02:57:35 | openstackgerrit | Brin Zhang proposed openstack/nova master: Need further updates, no need to review https://review.openstack.org/599276 | |
| 03:33:16 | openstackgerrit | Chen proposed openstack/nova master: Fix SOFT_DELETE vm_state string https://review.openstack.org/598482 | |
| 06:29:48 | prometheanfire | https://github.com/openstack/nova/commit/50658eee4fe26a55854642119beeff46c0d0108a seems to be causing problems | |
| 06:30:00 | prometheanfire | 2018-09-03 01:29:14.620 11567 ERROR nova.objects.cell_mapping [req-0b912c05-d2bf-4e68-bcdf-7953c87dcc88 - - - - -] Failed to parse [database]/connection to format cell mapping: ValueError: expected ':' after conversion specifier | |
| 06:30:10 | prometheanfire | tonyb: think I found another one ^ | |
| 06:30:44 | prometheanfire | not sure what's wrong with my db | |
| 06:30:52 | prometheanfire | I'm guessing my password isn't being escaped | |
| 06:32:04 | tonyb | prometheanfire: can you run nova in a venv and import cell_mapping.py and check the parse results with your netloc? | |
| 06:32:23 | prometheanfire | maybe the root? | |
| 06:32:23 | prometheanfire | 2018-09-03 01:29:14.919 11567 ERROR oslo_db.sqlalchemy.exc_filters [req-0b912c05-d2bf-4e68-bcdf-7953c87dcc88 - - - - -] DBAPIError exception wrapped from (psycopg2.ProgrammingError) relation "projects" does not exist | |
| 06:32:36 | prometheanfire | don't have a venv atm | |
| 06:33:02 | tonyb | prometheanfire: venvs are cheap, but if you hav nova installed as a site package you can just use that | |
| 06:33:02 | prometheanfire | another thing to blame not testing on postgres? | |
| 06:33:04 | prometheanfire | ya | |
| 06:33:25 | tonyb | prometheanfire: No I doubt that a postgres thing | |
| 06:34:58 | prometheanfire | my password actually is fine for the one in question | |
| 06:35:04 | prometheanfire | so probably not that | |
| 06:37:37 | tonyb | prometheanfire: :( Well I guess double check you're pointing at the right DB | |
| 06:39:57 | prometheanfire | it worked before the upgrade | |
| 06:43:34 | prometheanfire | not seeing anything in upgrade nodes or deprication notes or https://docs.openstack.org/nova/rocky/user/upgrade.html denoting any change needed | |
| 06:43:36 | tonyb | prometheanfire: ... Okay but that doesn't mean it wasn't using a deprecated feature that has gone between queens and rocky | |
| 06:43:45 | tonyb | prometheanfire: Okay | |
| 06:57:59 | prometheanfire | problem seems to be with this | |
| 06:58:00 | prometheanfire | https://github.com/openstack/nova/commit/50658eee4fe26a55854642119beeff46c0d0108a#diff-61f32a08cd0554ad482db124dcdc546aR128 | |
| 06:58:04 | prometheanfire | the url.format is failing | |
| 06:59:28 | prometheanfire | https://gist.githubusercontent.com/prometheanfire/c98816d477331bcc0a0272adb93cc5e2/raw/c746f1b1780f1202286b9902178ff4e613329f44/gistfile1.txt | |
| 07:25:16 | prometheanfire | tonyb: it IS my password | |
| 07:51:59 | openstackgerrit | Zhenyu Zheng proposed openstack/nova-specs master: Make scheduling weight more granular https://review.openstack.org/599308 | |
| 08:02:27 | openstackgerrit | Zhenyu Zheng proposed openstack/nova-specs master: Make scheduling weight more granular https://review.openstack.org/599308 | |
| 08:14:09 | prometheanfire | ok, the nova_api database has a non-escaped database_connection in the cell_mappings table | |
| 08:15:24 | prometheanfire | which fixed THAT error at least | |
| 08:38:47 | bauzas | good morning stackers | |
| 08:57:42 | openstackgerrit | Matthew Thode proposed openstack/nova stable/rocky: Don't use '_TransactionContextManager._async' https://review.openstack.org/597421 | |
| 09:11:58 | openstackgerrit | Chen proposed openstack/nova master: Fix SOFT_DELETE vm_state string https://review.openstack.org/598482 | |
| 09:23:57 | prometheanfire | this isn't helping, for some reason re-running the service isn't using the file I just changed, wtf | |
| 09:24:36 | prometheanfire | https://gist.githubusercontent.com/prometheanfire/76b31b592b1780a72b32c289ab1bfb06/raw/b58c80c3d22860397781c53915d7350d6dbe0bab/gistfile1.txt | |
| 09:25:00 | prometheanfire | but async_ isn't defined at all on that line anymore, I editited it to be async | |
| 09:25:17 | prometheanfire | anyone have any idea where that's cached? | |
| 09:28:01 | prometheanfire | I've removed any pycache files I could find | |
| 09:30:38 | openstackgerrit | Merged openstack/nova master: libvirt: guest: introduce blockStats instead of domain.blockStats https://review.openstack.org/526833 | |
| 09:55:11 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Making instance listing skipping down cells configurable https://review.openstack.org/592428 | |
| 10:00:15 | openstackgerrit | Sujeet Banerjee proposed openstack/nova master: WIP: Added a periodic task for network management. https://review.openstack.org/599338 | |
| 10:15:14 | prometheanfire | well, it looks like https://review.openstack.org/597421 may not be the right fix | |
| 11:23:28 | gibi | o/ | |
| 11:27:09 | sean-k-mooney | gibi: o/ | |
| 11:30:10 | openstackgerrit | Merged openstack/nova master: hardware: fix memory check usage for small/large pages https://review.openstack.org/532168 | |
| 12:20:40 | amarao | How to access object attributes in policy json? I'd like to forbid some operations based on flavor. Is someone tried that before? | |
| 12:26:29 | sean-k-mooney | amarao: as in based on the flavor of an instance you want to change what api actions are allowable and or by whom? | |
| 12:27:07 | sean-k-mooney | amarao: that sound like a nightmare from an interoperablity stand point so i doubt that has been tried/tested before | |
| 12:30:13 | amarao | Yep, I want to use flavor of the instance (or another instance attribute). | |
| 12:30:42 | amarao | Basically, I want to lock instance. I can use nova lock for this, but user still have access to console, and I want to remove it. | |
| 12:34:57 | moshele | sean-k-mooney: hi | |
| 12:35:47 | moshele | sean-k-mooney: in intel driver if spoofchk is enabled does it allow to set the mac address of the vf to 00:00:00:00:00:00 | |
| 12:58:51 | sean-k-mooney | moshele: i am not sure. if it did i would expect that to mean if the dest/source mac is not 00:00:00:00:00:00 specically drop the packet e.g. only broadcast traffic would be allowed | |
| 13:02:03 | sean-k-mooney | moshele: also at least in niantic (x520/x510) cards i know the mac filter is before the vlan filter so if you had 2 vf with that adress that would cause issues | |
| 13:03:27 | sean-k-mooney | amarao: locking in nova is intended to prevent api acess to an instance not to prevent users form using it | |
| 13:04:27 | sean-k-mooney | amarao: so a user can still poweroff a locked instance by sshing in and executing power off if they choose too. | |
| 13:05:23 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 13:05:41 | sean-k-mooney | amarao: is there a partical usecase you have in mind. perhaps a dedicated feature would be better then a flavor hack. | |
| 13:06:04 | amarao | sean-k-mooney, in our scenario we want to run it with our own key (user have no private key from it). 'Hidden' key plus 'lock' almost lock instance from user. What is left is console: Ctrl-Alt-Del, Sysrq-b, and (most importantly) grub access at boot time. | |
| 13:06:18 | amarao | I'd like to take away console from user as well (for specific instances only). | |
| 13:10:26 | moshele | sean-k-mooney: the reason I am asking is that mellanox driver block this and it can cause issues. So the mac address 00:00:00:00:00:00 is just to allow libvirt to clean vf when the VM with VF is deleted see https://www.redhat.com/archives/libvir-list/2017-March/msg00455.html | |
| 13:11:24 | moshele | sean-k-mooney: but now if spoofchk enabled first nova(libvirt delete the vm) restoring the mac to 00:00:00:00:00:00 and then the sriov agent will disable the spofchk | |
| 13:12:01 | moshele | sean-k-mooney: so the vf mac will not set to 00:00:00:00:00:00 and we can't reuse the mac on the same compute | |
| 13:12:44 | moshele | sean-k-mooney: I wonder how intel driver behavior to undestand were to fix it, in the driver or in openstack ... | |
| 13:14:26 | sean-k-mooney | moshele: i really need to get a redhat account at somepoint.. i cant read that linke but anyway. i dont think setting 00:00:00:00:00:00 is a good idea on intel cards either | |
| 13:14:52 | sean-k-mooney | moshele: i belive that the intel driver generates unique macs automaticaly for the pfs | |
| 13:14:57 | sean-k-mooney | * vfs | |
| 13:16:17 | sean-k-mooney | personally the fact that libvirt is seting 00:00:00:00:00:00 on deleteing the vm sound like a libvirt bug to me | |
| 13:16:40 | sean-k-mooney | or a nova bug if we are doing that in the libvirt vir driver | |
| 13:18:30 | moshele | sean-k-mooney: basically it set the restore the previously used mac so if you auto generate it. it will restore the auto generate one. in mellanox case the vf is start with 00:00:00:00:00:00 so we allowed to restore to 00:00:00:00:00:00 | |
| 13:18:37 | sean-k-mooney | amarao: well would a flavor extra-spec for disableing the console on an instace work? | |
| 13:19:53 | amarao | sean-k-mooney are there such property for extra-spec? | |
| 13:19:55 | sean-k-mooney | moshele: right in anycase when the vf is detached from a instance its linkstate should be down so no trafic will travers it so does it matter if spoof checking is disabled | |
| 13:20:37 | sean-k-mooney | amarao: ill check you can chages several aspecs of the vm like this via extra-sepcs and or image metadata. | |
| 13:22:46 | amarao | If I could disable console via flavor specs, it would be cool. | |
| 13:23:03 | sean-k-mooney | amarao: you can change the type of gpu in the guest and ram https://github.com/openstack/glance/blob/master/etc/metadefs/compute-libvirt-image.json#L45-L62 | |
| 13:23:14 | moshele | sean-k-mooney: right, but I think the default links state is auto, (at least for Mellanox) | |
| 13:23:15 | sean-k-mooney | you can also set the serial port count https://github.com/openstack/glance/blob/master/etc/metadefs/compute-libvirt.json#L18-L23 | |
| 13:23:34 | sean-k-mooney | amarao: we could add a display count extra spec | |
| 13:24:04 | sean-k-mooney | amarao: or extend hw_video_model to allow none to signel no display | |
| 13:24:52 | amarao | Nodisplay wouldn't work with many OSes. | |
| 13:25:06 | amarao | But disable_vnc (or disable_access) will be cool. | |
| 13:25:40 | sean-k-mooney | amarao: hum the perhaps we should leave the display and allow disabling of the vnc/spice console that is attached to it instead? | |
| 13:27:11 | sean-k-mooney | amarao: atleast in terms of libvirt/kvm the vnc/spice console is a sperate device form the gpu/display so we could disable it speraate ly or leave it here but limit its acess to local scope so you cannot connect to it via the novnc_proxy | |
| 13:28:05 | amarao | For the best user expirience it's better to return error on get-vnc-console, saying 'VNC console is disabled for this instance'. | |
| 13:28:45 | amarao | ... And admins will love that they still can connect to VNC through local IP on libvirt host. | |
| 13:29:20 | amarao | Should I report wishbug into launchpad? | |
| 13:29:25 | sean-k-mooney | amarao: we could proably do that based on the extraspec via an api check. amarao this would be a good topic for a blueprint care to write one | |
| 13:29:45 | sean-k-mooney | amarao: yes. a bug or sepcless blueprint. | |
| 13:30:19 | amarao | I'll start from a bug. I never created a blueprint, so I'll write down a bug and then will try with blueprint. | |
| 13:31:53 | sean-k-mooney | amarao: ok sound good. feel free to add me to the bug if you like. am will you be attending the PTG next week. if not i can highlight this as an RFE | |
| 13:34:31 | amarao | Should I put it into 'hw' namespace? | |
| 13:35:07 | sean-k-mooney | am you dont have to detail the impmentation in the bug but yes i would think so | |
| 13:35:15 | amarao | I thought about something like 'hw:disable_consoles: vnc,spice,serial' | |
| 13:36:41 | amarao | Oh, it's simpler than I thought. https://blueprints.launchpad.net/nova/+spec/flavor-based-access-to-console | |
| 13:37:45 | sean-k-mooney | amarao: perhapes invert that to hw:consoles=<one of vnc|spice|serial|None> | |
| 13:38:13 | amarao | .. and if this field is absent, everything is permitted. ack. | |
| 13:38:14 | sean-k-mooney | amarao: yes blueprints are baseicelay jsut what is the problem you would like to fix | |