| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-18 | |||
| 16:36:20 | cdent | you were missed | |
| 16:37:00 | cburgess | cdent I missed you all. Its weird not attending the summits and PTGs. I've been doing it since 2012 so yeah... makes the whole "I don't work with OpenStack anymore" thing real. | |
| 16:42:01 | openstackgerrit | Vladyslav Drok proposed openstack/nova stable/pike: Fix resize_instance rpcapi call https://review.openstack.org/603439 | |
| 17:38:39 | mriedem | dansmith: would be good to get this into pike before we release https://review.openstack.org/#/c/594184/ | |
| 17:39:36 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Merge extended_volumes extension response into server view builder https://review.openstack.org/596285 | |
| 17:39:37 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 17:41:06 | mriedem | we have a few pike backports with +2s actually https://review.openstack.org/#/q/status:open+project:openstack/nova+branch:stable/pike+label:Code-Review=2 | |
| 17:45:25 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Add get_by_cell_and_project() method to InstanceMappingList https://review.openstack.org/591656 | |
| 17:46:37 | mhen | hello guys, I'm from the same team as Luzi and would like to pick up on her topic regarding the image signature checking again, hoping that some of the core members are present right now. | |
| 17:49:06 | mhen | we created a launchpad entry as advised: https://bugs.launchpad.net/nova/+bug/1793159 | |
| 17:49:06 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 17:49:47 | mriedem | dansmith: actually i'll just push a pike release since we have a lot of stuff unreleased in there http://paste.openstack.org/show/730308/ | |
| 17:52:07 | mhen | so we propose to do an additional image signature verification for signed images after retrieving it from a local compute's cache while spawning an instance. Any opinions on this? | |
| 17:52:18 | mriedem | mhen: i left a question in the bug | |
| 17:52:32 | mriedem | i believe this is also a duplicate of https://bugs.launchpad.net/nova/+bug/1785668 | |
| 17:52:33 | openstack | Launchpad bug 1785668 in OpenStack Compute (nova) "nova-compute doesn't check image signature if imagecache exists" [Undecided,New] | |
| 17:53:08 | mriedem | also, mdbooth is probably the person to talk with about image cache stuff, but he's not around right now | |
| 17:53:16 | mriedem | i'll subscribe him to the bugs | |
| 17:54:21 | mhen | mriedem, thank you for your input! You are right about the duplicate. Should I answer your question in our bug entry or is it gonna be closed as a duplicate now anyway? | |
| 17:56:53 | mriedem | mhen: might as well reply and then we'll duplicate it | |
| 17:57:22 | mhen | mriedem, roger that! | |
| 17:57:22 | mriedem | it wasn't clear to me that the other bug had sufficient recreate details | |
| 17:59:15 | mhen | the other bug actually follows a different reasoning | |
| 18:00:24 | mhen | they are talking about the image signature check should fail in their scenario, since the user in question should not be able to retrieve the corresponding validation certificate from Barbican due to the user's permissions | |
| 18:01:01 | mhen | since a cached image is not checked in Nova, the cert retrieval is not even attempted and the permission problem does not surface | |
| 18:01:50 | mhen | our reasoning is more about the possibility of tampering with the cached image data, but I'll elaborate on that in our bug entry | |
| 18:02:07 | mriedem | dansmith: we should get this into ocata given it's a regression in ocata https://review.openstack.org/#/c/588077/ | |
| 18:02:39 | mriedem | that and the one below it. at this rate, we're going to have to start doing the old "stable core backport proxies as a +2" thing | |
| 18:08:45 | dansmith | mriedem: okay just got back, give me a few and I'll look | |
| 18:23:36 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Return a minimal construct for nova list when a cell is down https://review.openstack.org/567785 | |
| 18:26:47 | openstackgerrit | Surya Seetharaman proposed openstack/nova master: Add scatter-gather-single-cell utility https://review.openstack.org/594947 | |
| 18:30:34 | mhen | mriedem, I replied to your question on https://bugs.launchpad.net/nova/+bug/1793159 - I hope this clarifies our reasoning a bit more | |
| 18:30:34 | openstack | Launchpad bug 1793159 in OpenStack Compute (nova) "no signature check for cached images" [Undecided,New] | |
| 18:37:38 | dansmith | mriedem: were you implying I should slam this? https://review.openstack.org/#/c/588077/2 | |
| 18:38:35 | mriedem | dansmith: yes and the one below it | |
| 18:39:49 | dansmith | are we actually going to release any of this? :) | |
| 19:00:25 | mriedem | oh for ocata... | |
| 19:00:26 | mriedem | good question | |
| 19:00:54 | mriedem | i guess that's something we need to sort out with the STABLE MAINT SIG!!! https://releases.openstack.org/ | |
| 19:01:06 | mriedem | ocata was supposed to go into extended maintenance on aug 27 | |
| 19:03:59 | dansmith | mriedem: I actually meant on any of our branches, re: previous discussion :) | |
| 19:04:32 | mriedem | i have release patches up for rocky and queens | |
| 19:04:35 | mriedem | WIPs while things merge | |
| 19:04:42 | mriedem | and one for pike stacked on top of that | |
| 19:04:55 | mriedem | https://review.openstack.org/#/q/topic:nova-stable-releases-sept-2018+(status:open+OR+status:merged) | |
| 20:13:37 | openstackgerrit | Merged openstack/nova master: libvirt: Use os.stat and os.path.getsize for RAW disk inspection https://review.openstack.org/589567 | |
| 20:13:43 | openstackgerrit | Merged openstack/nova master: Add functional test for live migrate with anti-affinity group https://review.openstack.org/588935 | |
| 20:13:54 | openstackgerrit | Merged openstack/nova master: Explicitly fail if trying to attach SR-IOV port https://review.openstack.org/591898 | |
| 20:15:22 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/rocky: libvirt: Use os.stat and os.path.getsize for RAW disk inspection https://review.openstack.org/603488 | |
| 20:19:26 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/queens: WIP libvirt: Reduce calls to qemu-img during update_available_resource https://review.openstack.org/603358 | |
| 20:46:35 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Merge extended_volumes extension response into server view builder https://review.openstack.org/596285 | |
| 20:46:35 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 20:46:36 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add get_by_cell_and_project() method to InstanceMappingList https://review.openstack.org/591656 | |
| 20:46:36 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Return a minimal construct for nova list when a cell is down https://review.openstack.org/567785 | |
| 20:46:37 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add scatter-gather-single-cell utility https://review.openstack.org/594947 | |
| 20:46:53 | tssurya | mriedem: was just about to change the nits | |
| 20:46:56 | tssurya | thanks | |
| 20:47:31 | mriedem | you're supposed to be sleeping or something | |
| 20:48:49 | tssurya | mriedem: hehe still living in denver TZ | |
| 20:58:09 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Merge extended_volumes extension response into server view builder https://review.openstack.org/596285 | |
| 20:58:10 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Making instance/migration listing skipping down cells configurable https://review.openstack.org/592428 | |
| 20:58:10 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add get_by_cell_and_project() method to InstanceMappingList https://review.openstack.org/591656 | |
| 20:58:11 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Return a minimal construct for nova list when a cell is down https://review.openstack.org/567785 | |
| 20:58:11 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Add scatter-gather-single-cell utility https://review.openstack.org/594947 | |
| 20:58:39 | mriedem | tssurya: can we abandon https://review.openstack.org/#/c/594947/ ? i don't think anything is using it now | |
| 20:59:11 | tssurya | mriedem: originally it was created for https://review.openstack.org/#/c/591658/ | |
| 20:59:21 | tssurya | so let's keep it (see the comments from dan there) | |
| 20:59:27 | mriedem | oh, ok | |
| 20:59:31 | tssurya | I am currently updating the test cases for this one | |
| 20:59:37 | tssurya | it will come on top | |
| 21:15:33 | mriedem | dansmith: so if i want to kick the tires on your db migration script in a devstack env, i should be able to just create an empty placement db (but with schema) and then just create some instances and do the migration? | |
| 21:16:21 | dansmith | mriedem: if you have a devstack, easiest thing is to just create some instances, then create an empty placement db and then point it at the server with root/$pass | |
| 21:16:40 | dansmith | if not, you | |
| 21:16:50 | dansmith | will need a nova db with all the right tables, plus something in inventories | |
| 21:17:51 | mriedem | yeah i was thinking of creating a stable/rocky devstack, creating some instances so there is data (allocations), and then create a placement db and run the script | |
| 21:18:05 | mriedem | essentially what grenade is going to have to do | |
| 21:18:45 | dansmith | yup | |
| 21:19:06 | dansmith | run --mkconfig and then put root and the DATABASE_PASSWORD from your localrc in there | |
| 21:19:53 | dansmith | I should probably have mkconfig assume placement and nova_api as db names.. dunno why I didn't | |
| 21:26:00 | dansmith | done | |
| 21:29:15 | openstackgerrit | Ben Nemec proposed openstack/nova master: WIP: Migrade upgrade checks to oslo.upgradecheck https://review.openstack.org/603499 | |
| 21:34:56 | openstackgerrit | Ben Nemec proposed openstack/nova master: WIP: Migrade upgrade checks to oslo.upgradecheck https://review.openstack.org/603499 | |
| 21:35:55 | mriedem | bnemec: fancy | |
| 21:36:12 | mriedem | is that library in the openstack/requirements repo yet? | |
| 21:36:27 | mriedem | nope https://github.com/openstack/requirements/blob/master/upper-constraints.txt | |
| 21:36:29 | bnemec | No, the repo just got created. | |
| 21:36:41 | bnemec | There is a release on pypi from when I reserved the name though. | |
| 21:37:15 | bnemec | I'm also wondering if we want to rename the UpgradeCheck* classes to just Code and Result for the sake of brevity. | |
| 21:37:30 | bnemec | When used from the lib they'll be upgradecheck.Code and upgradecheck.Result anyway. | |
| 21:37:43 | dansmith | gdi, mriedem already got my -1 | |
| 21:38:05 | bnemec | lol | |
| 21:39:36 | mriedem | i didn't -1 b/c i'm too nice | |
| 21:40:08 | mriedem | bnemec: that works for me - i named them that way in nova b/c we have the whole subcommand thing | |
| 21:40:13 | bnemec | dansmith: If you want, you could -1 for the flagrant pep8 violations. ;-) | |
| 21:40:18 | mriedem | so theoretically we could have nova-status foo bar | |
| 21:40:24 | mriedem | nova-status upgrade baz | |
| 21:40:28 | dansmith | nah, now I'm demotivated | |
| 21:41:35 | bnemec | mriedem: Yeah, makes sense. Since the library is specialized we should be able to use the more generic names. | |
| 21:41:44 | bnemec | I'll get that proposed and update the Nova patch. | |
| 21:56:23 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Resource retrieving: add changes-before filter https://review.openstack.org/599276 | |