| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-04 | |||
| 22:32:32 | lbragstad | or it would require the nova service user to be an administrator | |
| 22:33:20 | lbragstad | but, hopefully that's going to be changing soon with https://bugs.launchpad.net/keystone/+bug/1748027 | |
| 22:33:20 | openstack | Launchpad bug 1748027 in OpenStack Identity (keystone) "The v3 users API should account for different scopes" [High,Triaged] - Assigned to sonu (sonu-bhumca11) | |
| 22:33:20 | melwitt | I see. but the validation of project_id is a non-admin thing? | |
| 22:33:49 | lbragstad | i guess it depends on how you're validating the project id | |
| 22:34:00 | melwitt | I have to check. I don't remember how we're doing it | |
| 22:34:02 | lbragstad | are you calling the GET /v3/projects/{project_id} | |
| 22:34:52 | melwitt | lemme see | |
| 22:35:18 | melwitt | yup, looks like it | |
| 22:35:28 | lbragstad | nice - in that case we do rule:admin_required or project_id:%(target.project.id)s | |
| 22:35:49 | lbragstad | making it accessible to admins and users with a role assignment on the project in the path | |
| 22:37:04 | melwitt | https://github.com/openstack/nova/blob/master/nova/api/openstack/identity.py#L41 | |
| 22:38:13 | lbragstad | if that ksa session is built with the nova service user, then it looks like you're already handling the case where nova doens't have the necessary permissions https://github.com/openstack/nova/blob/master/nova/api/openstack/identity.py#L61-L68 | |
| 22:38:26 | lbragstad | so that's good | |
| 22:39:15 | lbragstad | unless you're hoping to switch that case to false eventually | |
| 22:39:30 | melwitt | trying to see if it's built with the nova service user (sorry, this is new to me) | |
| 22:40:26 | lbragstad | https://github.com/openstack/nova/blob/master/nova/utils.py#L1189-L1191 ? | |
| 22:41:03 | melwitt | yeah, and we're passing ksa_auth=context.get_auth_plugin() | |
| 22:41:13 | lbragstad | looks like it supports being passed a ksa session and building one from config | |
| 22:41:38 | mriedem | yes https://docs.openstack.org/nova/latest/configuration/config.html#keystone | |
| 22:41:41 | mriedem | it's whatever you configure nova with | |
| 22:42:04 | mriedem | if you don't and we can't verify, we would default to our old behavior which is, meh - hope you know what you're doing admin person! | |
| 22:42:26 | melwitt | ah, ok | |
| 22:43:58 | lbragstad | huh - ok | |
| 22:44:33 | melwitt | # we don't have enough permission to verify this, so default | |
| 22:44:33 | melwitt | # to "it's ok". | |
| 22:44:35 | melwitt | haha | |
| 22:44:35 | lbragstad | so - the same creds used by ksm? | |
| 22:44:57 | lbragstad | "move along citizen.. nothing to see here" | |
| 22:45:04 | melwitt | haha | |
| 22:52:39 | melwitt | should be whatever is in the [keystone] section of the nova.conf, though I don't see that configured in the gate nova.conf | |
| 22:53:37 | melwitt | I see only [keystone_authtoken] for example, in here http://logs.openstack.org/99/584999/5/check/tempest-full/29581fd/controller/logs/etc/nova/nova_conf.txt.gz | |
| 22:54:18 | lbragstad | yeah - that's what we look for in ksm for sure | |
| 22:54:29 | melwitt | oh, ok | |
| 22:54:32 | lbragstad | i'm wondering if that gets re-used for nova requests | |
| 22:55:03 | lbragstad | look like it - it should be available to nova via the config object | |
| 22:57:14 | melwitt | maybe this is how it gets re-used? https://github.com/openstack/nova/blob/master/nova/context.py#L59-L64 | |
| 22:58:14 | melwitt | we do that as part of the context.get_auth_plugin() call, if there's no self.user_auth_plugin set https://github.com/openstack/nova/blob/master/nova/context.py#L160 | |
| 23:48:13 | lbragstad | aha - interesting | |
| #openstack-nova - 2018-09-05 | |||
| 00:13:14 | openstackgerrit | Elancheran S proposed openstack/nova stable/pike: Add exact match aggregate image properties matcher/filter https://review.openstack.org/599870 | |
| 00:21:46 | openstackgerrit | Elancheran S proposed openstack/nova master: Add exact match aggregate image properties matcher/filter https://review.openstack.org/593167 | |
| 00:59:10 | openstackgerrit | fupingxie proposed openstack/nova master: Delete allocations for instances that have been moved to another node https://review.openstack.org/582899 | |
| 01:00:30 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Fix nova-status "_check_resource_providers" check https://review.openstack.org/599875 | |
| 01:04:48 | openstackgerrit | fupingxie proposed openstack/nova master: Add an example to add more pci devices in nova.conf https://review.openstack.org/592243 | |
| 01:09:28 | openstackgerrit | Sam Morrison proposed openstack/nova master: Fix DB archiver AttributeError due to wrong table name attribute used https://review.openstack.org/599878 | |
| 01:23:57 | openstackgerrit | Sam Morrison proposed openstack/nova stable/rocky: Fix DB archiver AttributeError due to wrong table name attribute used https://review.openstack.org/599881 | |
| 01:24:55 | openstackgerrit | Sam Morrison proposed openstack/nova stable/queens: Fix DB archiver AttributeError due to wrong table name attribute used https://review.openstack.org/599882 | |
| 01:26:17 | openstackgerrit | Sam Morrison proposed openstack/nova stable/pike: Fix DB archiver AttributeError due to wrong table name attribute used https://review.openstack.org/599883 | |
| 01:27:41 | openstackgerrit | Sam Morrison proposed openstack/nova stable/ocata: Fix DB archiver AttributeError due to wrong table name attribute used https://review.openstack.org/599885 | |
| 01:28:34 | prometheanfire | mriedem: :D, not sure I can test it now without a rollback, but that else thing sounds right | |
| 01:30:33 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Configure placement DB context manager for nova-manage/status https://review.openstack.org/599744 | |
| 01:30:35 | mriedem | prometheanfire: here is the 2nd part of that ^ | |
| 01:30:50 | mriedem | that should fix both the nova-status and nova-manage parts that hit the placement tables | |
| 01:31:06 | mriedem | i have my devstack patch updated and should fail, and then i'll apply that patch to show it passing | |
| 01:32:29 | prometheanfire | cool | |
| 01:35:35 | mriedem | and with that i need to get the hell off this computer | |
| 01:41:24 | prometheanfire | cya :D | |
| 01:46:17 | mriedem_afk | prometheanfire: yup devstack failed as expected http://logs.openstack.org/47/599847/2/check/tempest-full/d3ee11e/controller/logs/devstacklog.txt.gz#_2018-09-05_01_24_22_187 | |
| 01:50:03 | prometheanfire | woo | |
| 02:14:11 | openstackgerrit | Merged openstack/nova master: Other host allocs may appear in gafpt during evac https://review.openstack.org/597301 | |
| 02:17:02 | openstackgerrit | Sam Morrison proposed openstack/nova master: Allow ability for non admin users to use all filters on server list. https://review.openstack.org/526558 | |
| 02:43:03 | openstackgerrit | fupingxie proposed openstack/nova master: Delete allocations for instances that have been moved to another node https://review.openstack.org/582899 | |
| 03:09:52 | openstackgerrit | huanhongda proposed openstack/nova-specs master: Return "deleted" and "estimated_reclaim" time of instance for admin https://review.openstack.org/581638 | |
| 04:18:16 | openstackgerrit | huanhongda proposed openstack/nova-specs master: Return "deleted" and "estimated_reclaim" time of instance for admin https://review.openstack.org/581638 | |
| 05:40:18 | pvc | hi guys | |
| 06:00:31 | gmann | alex_xu: ping | |
| 06:02:47 | gmann | alex_xu: i am back from PTO on monday. do not have much to discuss for API office hour. do you have anything or we start it after PTG when we have exact priority items for stein ? | |
| 07:10:20 | tssurya | gmann: sorry for the rebases of https://review.openstack.org/#/c/585475 and https://review.openstack.org/#/c/592092, it was because I wanted the whole series to be on top of some latest commits that got merged, | |
| 07:15:08 | gmann | tssurya: no issue, anyways i will continue work on those from tomorrow. | |
| 07:18:32 | openstackgerrit | Brin Zhang proposed openstack/nova master: Resource retrieving: add changes-before filter https://review.openstack.org/599276 | |
| 07:51:28 | alex_xu | gmann: sorry, too busy this afternoon, forget to online | |
| 07:56:21 | gmann | alex_xu: np | |
| 08:01:38 | openstackgerrit | Tushar Patil proposed openstack/nova-specs master: Allow overcommit of dedicated CPU https://review.openstack.org/599957 | |
| 08:18:12 | tssurya | gmann: thanks, | |
| 08:56:23 | stephenfin | kashyap: Sorry about the delay - not sure how I missed your ping yesterday. This is the output requested http://paste.openstack.org/show/729478/ | |
| 08:56:58 | pvc | hi | |
| 08:57:03 | pvc | can anyone help me | |
| 08:57:21 | pvc | it seems my server doesnt get the ip address from the metadata so icant ping it | |
| 08:57:38 | stephenfin | kashyap: That's with 'hw_machine_type = x86_64=q35' and 'num_pcie_ports = 8' in '[libvirt]' | |
| 08:57:38 | kashyap | stephenfin: No worries about the delay at all. Was just refrehsing my DevStack env (after the goddamned dentist visit) | |
| 08:57:49 | pvc | hi anyone can help ? | |
| 08:57:58 | pvc | Calling 'http://169.254.169.254/2009-04-04/meta-data/instance-id' failed [119/120s]: request error [HTTPConnectionPool(host='169.254.169.254', port=80): Max retries exceeded with url: /2009-04-04/meta-data/instance-id (Caused by NewConnectionError(' |
|
| 08:57:59 | kashyap | stephenfin: BTW, does the spacing affect at all? | |
| 08:58:12 | stephenfin | kashyap: Spacing? | |
| 08:58:27 | stephenfin | pvc: You'd have much better luck asking this on #openstack | |
| 08:58:28 | kashyap | stephenfin: I mean, extra space between the config attribute values | |
| 08:58:41 | stephenfin | kashyap: It shouldn't, no | |
| 08:59:30 | kashyap | stephenfin: Excellent. So why I asked for '8' was: | |
| 08:59:37 | stephenfin | kashyap: Well, between the key and value. I wouldn't be so sure about spaces between the stuff on the value side (i.e. x86_64=q35) because that's not handled by oslo.config | |
| 09:00:05 | kashyap | stephenfin: libvirt will ignore '2', because it will anyway give four PCIe ports: one for disk, n/w interface, memory balloon and RNG device | |
| 09:00:26 | kashyap | stephenfin: So setting '8' should give us a few extra ports for hot-plugging, etc. | |
| 09:00:41 | kashyap | stephenfin: I see, noted | |
| 09:00:48 | kashyap | Thanks for the quick test; great timing! | |
| 09:01:29 | stephenfin | kashyap: Yup, I was thinking there was a lower bound on what you could set. I wonder if we should note that in the docs? | |
| 09:01:40 | stephenfin | kashyap: though I guess it doesn't really matter, if we're being honest | |
| 09:03:14 | kashyap | Noting in the docs will certainly be clearer | |
| 09:03:38 | kashyap | (For the rare species that _do_ go and read the docs.) | |
| 10:02:17 | zigo | I got new unit test failures when building Nova in Sid: http://paste.openstack.org/show/729497/ | |
| 10:13:04 | cdent | zigo: not surprised to see those, people have been slow to get on 3.6, let alone 3.7 | |
| 10:18:02 | gibi | fyi, I'm going offline soon and travelling to Denver tomorrow. | |