| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-09-24 | |||
| 15:49:45 | belmoreira | efried: our main issue is that our compute nodes may be very overcommited (CPU) and for now is saffer to stop scheduling these large flavors | |
| 15:50:04 | openstackgerrit | Rodolfo Alonso Hernandez proposed openstack/os-vif master: Add native implementation OVSDB API https://review.openstack.org/482226 | |
| 15:52:40 | belmoreira | efried: last week I was debugging and we just realised the issue in the channel... I believe that letting the operator decide is a good practice. In my specific use case this is not a priority. If we allow these flavors again this is small downstream patch | |
| 15:53:02 | efried | roger that. Thanks for the update. | |
| 15:53:20 | mriedem | dansmith: so circling back on https://review.openstack.org/#/c/604687/3/nova/db/sqlalchemy/migrate_repo/versions/391_add_volume_type_to_bdm.py - you're cool with the compute API taking volume type name or ID yes? | |
| 15:54:24 | dansmith | mriedem: yes, but I'm not sure what that has to do with that migration.. it already has char(255) right? | |
| 15:54:34 | mriedem | yes | |
| 15:54:40 | mriedem | that's just what initiated the question | |
| 15:54:45 | belmoreira | efried cdent also was testing if there's any limitation creating VMs with more vcpus than cpus available in the node and can't find any issue | |
| 15:55:11 | efried | good to know. | |
| 16:02:42 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Consumer gen support for delete instance allocations https://review.openstack.org/591597 | |
| 16:13:15 | bauzas | gibi: I'll start review your series tomorrow morning, can I ? | |
| 16:13:55 | gibi | bauzas: sure. There are comment already that I need to fix through the series but the content of the patches are ready for review | |
| 16:14:08 | bauzas | all cool then ++ | |
| 16:14:15 | bauzas | aaaand then, calling it a day ! | |
| 16:16:19 | gibi | bauzas: have a nice evening | |
| 16:18:41 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Consumer gen support for delete instance allocations https://review.openstack.org/591597 | |
| 16:45:14 | melwitt | o/ | |
| 16:45:54 | sean-k-mooney | o/ | |
| 16:48:43 | s10 | https://bugs.launchpad.net/nova/+bug/1209101 - please, reopen this bug | |
| 16:48:43 | openstack | Launchpad bug 1209101 in OpenStack Compute (nova) "Non-public flavor cannot be used in created tenant" [High,Fix released] - Assigned to Sumanth Nagadavalli (sumanth-nagadavalli) | |
| 17:02:42 | cfriesen | mriedem: stephenfin: any chance you could take a look at a robustness fix around port binding in rebuild/reboot? https://review.openstack.org/603844 | |
| 17:06:40 | openstackgerrit | Merged openstack/nova stable/pike: Fix message for unexpected external event https://review.openstack.org/589503 | |
| 17:06:47 | openstackgerrit | Merged openstack/nova master: Rename "polling_changes-since_parameter.rst" https://review.openstack.org/604606 | |
| 17:42:59 | openstackgerrit | Matthew Booth proposed openstack/nova master: Always check return of wait_for_versioned_notifications https://review.openstack.org/604859 | |
| 17:43:20 | mdbooth | ^^^ took me all day :/ | |
| 17:43:40 | mdbooth | The failure in my test, that is. I haven't actually checked locally if the above patch works. | |
| 17:45:03 | mdbooth | I wonder if it should just raise an exception instead, tbh. Would make it harder to misuse. | |
| 18:10:05 | efried | mdbooth: "it" the fixture or "it" the original method? | |
| 18:12:40 | efried | oh. it's only in the fixture | |
| 18:18:07 | efried | makes sense for it to raise on None, I reckon. But if you're going that far, you may as well make _Sub.wait_n raise on timeout too. | |
| 18:25:59 | AJaeger | mriedem, bauzas, melwitt , lyarwood, could you help reviewing the stable python3-first changes, please? https://review.openstack.org/#/q/topic:python3-first+status:open+(openstack/nova+OR+project:openstack/nova-specs+OR+openstack/os-traits+OR+openstack/os-vif+OR+openstack/osc-placement+OR+openstack/python-novaclient) gives list of open changes | |
| 18:27:05 | sean-k-mooney | AJaeger: looking at the list everything that is left is for stable branches | |
| 18:27:25 | sean-k-mooney | AJaeger: the trove change is likely the wrong channel | |
| 18:27:48 | AJaeger | sean-k-mooney: yeah, don't know why the query includes that one ;( Adn yes, it's all stable changes... | |
| 18:27:53 | lyarwood | AJaeger: ack will do | |
| 18:28:06 | AJaeger | thanks, lyarwood. If you have questions, feel free to ask ... | |
| 18:28:21 | AJaeger | lyarwood: and ignore the trove one, please | |
| 18:28:58 | lyarwood | AJaeger: ack, I can't +2 that anyway :) | |
| 18:29:39 | openstackgerrit | Alessandro Pilotti proposed openstack/python-novaclient master: Fixes Python3 issue in decoding password https://review.openstack.org/604870 | |
| 18:31:41 | melwitt | AJaeger: thanks for the heads up | |
| 18:32:36 | AJaeger | melwitt: once those 15 changes are in, the python3-first goal is done for nova ;) | |
| 18:33:10 | AJaeger | Only 13, I miscounted | |
| 18:33:14 | melwitt | coolness, I'll make sure we get those in | |
| 18:33:37 | AJaeger | great | |
| 18:33:55 | AJaeger | you have at least changes that pass everywhere - compared to other projects ;/ | |
| 18:34:29 | melwitt | that's fortunate :) | |
| 18:35:34 | AJaeger | indeed | |
| 18:38:13 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add regression for bug 1787606 https://review.openstack.org/593073 | |
| 18:38:13 | openstack | bug 1787606 in OpenStack Compute (nova) "Multi instance creation rescheduling fails due to a lack of alternates" [Medium,In progress] https://launchpad.net/bugs/1787606 - Assigned to Lee Yarwood (lyarwood) | |
| 18:38:13 | openstackgerrit | Lee Yarwood proposed openstack/nova master: scheduler: Increase alternate count in smaller environments https://review.openstack.org/593074 | |
| 18:45:56 | openstackgerrit | Lee Yarwood proposed openstack/nova master: fixtures: Track volume attachments within CinderFixtureNewAttachFlow https://review.openstack.org/587013 | |
| 18:45:56 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add regression test for bug#1784353 https://review.openstack.org/587014 | |
| 18:45:57 | openstackgerrit | Lee Yarwood proposed openstack/nova master: conductor: Recreate volume attachments during a reschedule https://review.openstack.org/587071 | |
| 18:54:57 | AJaeger | all approved - thanks, mriedem and lyarwood ! | |
| 19:11:10 | openstackgerrit | Merged openstack/os-traits stable/rocky: import zuul job settings from project-config https://review.openstack.org/601403 | |
| 19:11:12 | openstackgerrit | Merged openstack/os-traits stable/queens: import zuul job settings from project-config https://review.openstack.org/601398 | |
| 19:11:17 | openstackgerrit | Merged openstack/os-traits stable/pike: import zuul job settings from project-config https://review.openstack.org/601393 | |
| 19:13:51 | karimull | mreidem : thanks for the info..will look into hooks. | |
| 19:14:26 | openstackgerrit | Matt Riedemann proposed openstack/python-novaclient master: Add support changes-before for microversion 2.66 https://review.openstack.org/603549 | |
| 19:19:14 | karimull | mreidem : efried: is there a way in nova I can branch out of normal processing of instance launch and try to work on the image before libvirt is called or with in libvirt is also fine | |
| 19:20:51 | karimull | mreidem:efried : basically I'm looking to decrypt an image before it is launched... | |
| 19:22:17 | efried | karimull: I have way more questions than answers. | |
| 19:22:24 | efried | Are you the only one who has ever wanted to work with encrypted images? | |
| 19:22:53 | efried | Is the image encrypted in glance, and then you want to decrypt it while/after you copy it to the instance's boot disk? | |
| 19:23:18 | karimull | may be :) | |
| 19:23:52 | karimull | efried : exactly | |
| 19:23:53 | efried | I guess what I'm getting at is, either what you're doing is wild and crazy and you shouldn't be doing it - upstream or down - or it's something that more people want to do and is either already supported or should be proposed formally upstream. | |
| 19:24:26 | efried | Me, I don't know anything about it, I'm afraid. | |
| 19:25:13 | efried | seems weird that you're maintaining the image encrypted in glance, but want it decrypted *before* you boot the instance. | |
| 19:25:24 | efried | It's as if you trust glance less than you trust instances | |
| 19:25:40 | karimull | efried :I could see volume encryption blue but nothing on image | |
| 19:28:51 | karimull | efried : I'm making sure if this is feasible before proposing a formal blue print | |
| 19:29:14 | efried | karimull: Okay, so you do intend to propose it upstream? | |
| 19:29:41 | karimull | efried : yes | |
| 19:29:51 | efried | I see. Have you talked to the glance folks about it? | |
| 19:30:50 | karimull | efried : not yet | |
| 19:31:19 | melwitt | we added support for trusted image certificate validation in rocky https://specs.openstack.org/openstack/nova-specs/specs/rocky/implemented/nova-validate-certificates.html | |
| 19:31:45 | dansmith | presumably they want encryption | |
| 19:31:49 | dansmith | but that came before, AFAIK | |
| 19:32:01 | melwitt | but I don't know of any support for encrypted images in glance | |
| 19:32:34 | melwitt | yeah, was just mentioning it in case it might be useful | |
| 19:33:12 | melwitt | that's the extent of the handling of "untrusted glance" that I know about | |
| 19:33:16 | dansmith | oh I thought the encryption support was already there | |
| 19:33:36 | dansmith | maybe I'm thinking of encrypted block | |
| 19:34:46 | melwitt | I'm not sure, it might be there. trying to find out. an earlier iteration of the trusted certs stuff mentioned image encryption | |
| 19:35:02 | dansmith | yeah | |
| 19:35:24 | dansmith | looks like just signatures though in the tree | |
| 19:35:26 | karimull | I have not seen any support for encrypted image in glance.. | |
| 19:35:26 | efried | assuming the decrypt would happen chunk-wise, it's not in the nova glance code. | |
| 19:36:15 | karimull | wanted to support user defined encryption of image at nova compute for more flexibility | |
| 19:36:44 | efried | karimull: Point is, assuming it's not already there, you would likely be looking to make your changes in a lot of the same places as the bp melwitt mentioned ( https://review.openstack.org/#/q/topic:bp/nova-validate-certificates+(status:open+OR+status:merged) ) | |
| 19:39:12 | karimull | by using Castellan which support key manager interface and by having a plugin in nova to perform user defined decryption process it will be more transparent..just a thought still framing on all possibilities | |
| 19:39:53 | karimull | efried: will look into that blueprint.. | |
| 19:39:58 | melwitt | karimull: are you thinking this would be transparent to glance? like you would encrypt the image before uploading to glance using your nova keypair, for example, and then you'd like nova to decrypt it? we would need the private key for that though and we don't store them | |
| 19:40:16 | karimull | yes | |
| 19:40:47 | dansmith | that's where castellan or barbican comes in | |
| 19:41:04 | dansmith | nova gets a key the user provides there to decrypt | |
| 19:41:25 | melwitt | right.. ok | |
| 19:41:34 | dansmith | AFAIK, glance needs to look at the image when you upload it so it's not like you can do this without glance at all I think | |