| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2018-12-05 | |||
| 15:17:23 | mriedem | yan0s: well, it doesn't need to be in nova.conf if you're not changing defaults | |
| 15:17:30 | mriedem | if the defaults are what you need anyway, it should just work | |
| 15:17:33 | yan0s | adding policy_file = policy.json under it fixed it | |
| 15:17:47 | mriedem | hmm, that shouldn't matter, that's already the default in code... | |
| 15:17:52 | mriedem | lbragstad: ^ | |
| 15:17:53 | yan0s | no I need a specific configuration | |
| 15:18:01 | mriedem | yan0s: why? | |
| 15:18:57 | yan0s | I need user roles with different access rights | |
| 15:19:14 | mriedem | sure, that's in policy.json though, | |
| 15:19:22 | mriedem | nova.conf is already pointing at policy_file=policy.json by default | |
| 15:19:27 | yan0s | is there a better way of doing this? | |
| 15:19:27 | mriedem | because of defaults in the code | |
| 15:19:41 | mriedem | https://docs.openstack.org/nova/latest/configuration/config.html#oslo_policy.policy_file Default:policy.json | |
| 15:20:08 | mriedem | overriding policy rules is fine and expected, i just wonder why the config defaults weren't working | |
| 15:20:16 | mriedem | because someone was having a similar issue last week | |
| 15:20:25 | yan0s | could it be a juju charm specific issue? | |
| 15:20:37 | mriedem | i think the person last week was using kolla but it's hard to remember | |
| 15:21:18 | mriedem | lbragstad: apparently [oslo_policy]/policy_file default not being read for some reason in some deployments | |
| 15:21:37 | mriedem | explicitly putting policy_file=policy.json in nova.conf fixed it, but that shouldn't be necessary given it's already the default value | |
| 15:21:43 | lbragstad | as far as the logging goes (which doesn't seem to be the root issue) we did just release a new version of oslo.policy that allows for better logging | |
| 15:22:13 | lbragstad | https://review.openstack.org/#/c/619260/ | |
| 15:22:39 | lbragstad | and the default from policy.json isn't changing for what's documented in code? | |
| 15:23:07 | mriedem | no they are using /etc/nova/policy.json | |
| 15:23:22 | mriedem | "adding policy_file = policy.json under it fixed it" | |
| 15:25:44 | mriedem | we don't test policy overrides in tempest/dsvm jobs, but patrole should, i should find one of those jobs and see if they have to explicitly configure this in nova.conf | |
| 15:25:59 | kashyap | If anyone has a few spare minutes, this already has a +2: https://review.openstack.org/#/c/620327/ -- "libvirt: Refactor handling of PCIe root ports" | |
| 15:26:28 | stephenfin | mriedem: Would you mind taking a look at this when you have time? https://review.openstack.org/#/c/554523/ | |
| 15:26:38 | stephenfin | kashyap: on it | |
| 15:27:25 | kashyap | stephenfin: Thanks! The more important bit I need to work out is a clean solution for long "TODO" in the code... | |
| 15:27:35 | stephenfin | just reading that atm | |
| 15:28:30 | dansmith | mriedem: when you get a sec, check my comment on the initial ratio migration patch | |
| 15:28:32 | dansmith | (please) | |
| 15:29:15 | stephenfin | kashyap: I think you've already stated the fix, no? (third paragraph of that TODO) | |
| 15:30:16 | kashyap | stephenfin: Yep, so you actually read it, then :D | |
| 15:30:42 | stephenfin | I'm 100% for detailed code comments ;) | |
| 15:30:49 | stephenfin | ...so long as they're kept up-to-date | |
| 15:31:30 | kashyap | Thanks! I spent unjustifiable time to write that comment :D | |
| 15:31:34 | stephenfin | kashyap: In any case, that's a future problem. +Wd | |
| 15:31:39 | kashyap | stephenfin: The "hidden" bit is to workout XML wrangling to get the machine type from the right XML bit | |
| 15:31:43 | kashyap | Thanks! | |
| 15:31:46 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Remove port allocation during detach https://review.openstack.org/622421 | |
| 15:33:09 | kashyap | stephenfin: Thanks! That's a near-term problem, as "certain Linux distributions" might / will change default machine types | |
| 15:33:22 | yan0s | also, does any service neds to be restarted for updates in policy.json to take effect? | |
| 15:33:31 | mriedem | dansmith: replied | |
| 15:33:57 | mriedem | just tell me what you want me to do and i'll make the change | |
| 15:35:09 | mriedem | yikun: fyi, https://blueprints.launchpad.net/nova/+spec/live-migration-force-after-timeout is now in a runway slot until dec 19 | |
| 15:35:38 | dansmith | mriedem: well, I was going to volunteer to fix it since it's my complaint, but I think I'd rather it not tweak updated_at unless it's going to do a full refresh so it's consistent | |
| 15:36:04 | mriedem | i'll do it, i've got the series local already - i've been tweaking it along the way for my minor stuff | |
| 15:36:13 | mriedem | can you take a look at the next in line before i do? | |
| 15:36:18 | mriedem | the one that adds the cli hook | |
| 15:36:28 | dansmith | okay, other than that I'm good with it | |
| 15:36:29 | dansmith | okay | |
| 15:37:21 | dansmith | mriedem: that migration is going to do deleted records too, is that the intent? | |
| 15:39:29 | dansmith | mriedem: two comments on there | |
| 15:40:27 | mriedem | ew, no i dont think we want that | |
| 15:40:30 | openstackgerrit | Takashi NATSUME proposed openstack/nova master: api-ref: Body verification for the lock action https://review.openstack.org/622835 | |
| 15:41:31 | mriedem | i'll address those as well | |
| 15:41:39 | mriedem | stephenfin: done | |
| 15:41:47 | stephenfin | Thank you | |
| 15:41:51 | mriedem | stephenfin: note that the pike backport hasn't been released yet | |
| 15:42:06 | mriedem | even though it was done on august | |
| 15:42:10 | mriedem | *merged | |
| 15:42:31 | mriedem | so....probably time to think about doing an os-vif pike release | |
| 15:42:40 | mriedem | stephenfin: do you want to queue that up? | |
| 15:43:14 | stephenfin | mriedem: Sure thing | |
| 15:47:35 | openstackgerrit | Matt Riedemann proposed openstack/nova master: Use tempest [compute]/build_timeout in evacuate tests https://review.openstack.org/623011 | |
| 15:54:50 | stephenfin | mriedem: https://review.openstack.org/623016 | |
| 15:54:57 | openstackgerrit | Merged openstack/os-vif stable/ocata: Check if interface belongs to a Linux Bridge before removing https://review.openstack.org/554523 | |
| 15:55:12 | mriedem | woohoo, summit and ptg are separate, $700 summit only with no lunch, ptg is $400 w/ lunch (oh thank you), and $1200 for both | |
| 15:55:28 | mriedem | so longer week, more expensive, no lunch, what's not to love?! | |
| 15:55:48 | tbachman | do they have gift-bags? | |
| 15:56:01 | mriedem | byogb | |
| 15:56:06 | dansmith | come on, even for atcs? | |
| 15:56:06 | tbachman | darn | |
| 15:56:13 | mriedem | no idea about atcs | |
| 15:56:41 | stephenfin | mriedem: Oh, I wonder if we should include this too, if we're doing a release? https://review.openstack.org/#/c/505731/ | |
| 15:56:54 | stephenfin | I'll prepare an ocata release too. Nothing else on the backlog | |
| 15:58:01 | cdent | efried: is https://review.openstack.org/#/c/613613/ still alive (kill safe connect) | |
| 15:58:50 | efried | cdent: I think so. Just needs core reviews. | |
| 16:00:40 | cdent | roger, just doing a to do list review, and it came round | |
| 16:04:05 | mriedem | stephenfin: question in https://review.openstack.org/#/c/505731/4 | |
| 16:04:28 | stephenfin | looking | |
| 16:06:02 | melwitt | o/ | |
| 16:08:55 | mriedem | stephenfin: i guess it's always been there? https://kernel.googlesource.com/pub/scm/linux/kernel/git/shemminger/bridge-utils/+/38837a8e19540690c80f5a3b0971e0e1495a4a3e/brctl/brctl_cmd.c#124 | |
| 16:09:29 | stephenfin | mriedem: :D I was looking at the exact same thing | |
| 16:09:55 | lbragstad | yan0s i think it depends on how the service init's the oslo.policy enforcer object | |
| 16:10:01 | openstackgerrit | Chris Dent proposed openstack/nova master: Correct lower-constraints.txt and the related tox job https://review.openstack.org/622972 | |
| 16:10:09 | lbragstad | yan0s there is a configuration option to reload policy rules when they change on disk, i believe | |
| 16:10:29 | lbragstad | s/configuration option/option parameter to the enforcer/ | |
| 16:10:36 | mriedem | lbragstad: that would be here https://github.com/openstack/nova/blob/master/nova/policy.py#L68 | |
| 16:11:15 | stephenfin | mriedem: It's in Ubuntu 16.04 http://manpages.ubuntu.com/manpages/xenial/man8/brctl.8.html and there's no changelog section, so I assume it's always been there too | |
| 16:11:56 | lbragstad | mriedem yeah - some documentation on it here https://docs.openstack.org/oslo.policy/latest/reference/api/oslo_policy.policy.html#oslo_policy.policy.Enforcer | |
| 16:13:09 | mriedem | hmm, so nova-api isn't dynamically reloading rules? | |
| 16:13:30 | mriedem | i only see ENFORCER.load_rules() called when we initialize it | |
| 16:14:24 | mriedem | yan0s: did you restart nova-api when you changed nova.conf to set the policy_file option? | |
| 16:14:40 | sean-k-mooney | o/ | |
| 16:15:52 | gibi | mdbooth: I run ~30 consecutive full nova functional tests with random test case order to reproduce the test failure but I failed | |
| 16:16:47 | gibi | mdbooth: so I think it is more likely a timing issue as the gate runs the test slower than I | |
| 16:16:51 | sean-k-mooney | stephenfin: brctl? | |
| 16:16:56 | stephenfin | yes | |