| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-01-07 | |||
| 13:47:58 | kashyap | So, on benchmarks-- | |
| 13:49:15 | kashyap | mdbooth: Some moons ago DanPB did the benchmarks. Looking for the right info | |
| 13:49:56 | mdbooth | kashyap: afk, back shortly. Will read scrollback. | |
| 13:50:24 | cdent | scheduler/placement meeting in #opensack-meeting-alt in 10 minutes | |
| 13:50:33 | cdent | or rather in #openstack-meeting-alt | |
| 13:50:50 | cdent | my opensack back of holding is full | |
| 13:52:03 | sean-k-mooney1 | mdbooth: assuming the tls encryption is use aes for the cyper it should be able to offload to the cpu in hardware so the overhead should be minimal | |
| 13:53:38 | kashyap | mdbooth: When you're back, that's the IRC chat with DanPB on benchmarks: http://paste.openstack.org/show/740443/ | |
| 13:54:11 | kashyap | mdbooth: That said, I don't have the exact overhead over non-tunnelled, non-encrypted, I'm afraid. But that info is something worth having | |
| 13:56:56 | ShilpaSD | gibi: Hi | |
| 13:57:05 | gibi | ShilpaSD: hi | |
| 13:58:51 | ShilpaSD | gibi: Need help in understanding of oslo_versionedobjects, actually TestObjectVersions.test_versions() is failing on my patch https://review.openstack.org/#/c/474423/ | |
| 13:58:58 | sean-k-mooney1 | kashyap: i would be surprised if people are actully migrating over raw tcp in production. even for devstack the recomendation i was given and i give is to use ssh | |
| 13:59:13 | kashyap | Heh, yeah, indeed. | |
| 13:59:37 | gibi | ShilpaSD: give me couple of minutes... I will look at your patch | |
| 14:00:06 | kashyap | sean-k-mooney1: So, I don't know if I should spend time doing the comparison -- as that'll be comparing something not-recommended vs. something highly-recommended | |
| 14:00:11 | ShilpaSD | gibi: yup | |
| 14:01:51 | sean-k-mooney1 | kashyap: i think the security argment shoudl be enough honestly that said its not really much more secure the ssh | |
| 14:02:06 | ShilpaSD | gibi: referred Nova https://github.com/openstack/nova/blob/master/nova/tests/unit/objects/test_objects.py#L1199, and there notification related classes are not counted, similarly removed from my patch, but no sucess | |
| 14:02:25 | sean-k-mooney1 | kashyap: i would suspect over time however the native tls will be more secure and more efficent | |
| 14:02:49 | kashyap | sean-k-mooney1: Not only that, will completely deprecate the 'tunnelled' | |
| 14:03:05 | mdbooth | kashyap: Thanks. | |
| 14:03:20 | kashyap | sean-k-mooney1: See the blueprint, I the deprecation reason there | |
| 14:03:26 | kashyap | s/I the/I mentioned the/ | |
| 14:03:31 | sean-k-mooney1 | kashyap: tls is still more annoying to deploy vs jsut exchaning ssh keys | |
| 14:03:41 | kashyap | sean-k-mooney1: Also your reviewer eyes are welcome, too | |
| 14:03:52 | mdbooth | kashyap: I was just thinking that if, as sean-k-mooney1 suggests, the overhead over the current default is negligible, we should default to it. | |
| 14:04:02 | kashyap | sean-k-mooney1: Tell me all about it :-) Let me show the document I wrote -- see the scrollbar for its setup | |
| 14:04:06 | mdbooth | If they have TLS correctly configured, that is. | |
| 14:04:22 | kashyap | sean-k-mooney1: That's from-scratch setup: https://kashyapc.fedorapeople.org/Native-TLS/Setup-for-NBD-and-migration-streams-over-TLS.rst.txt | |
| 14:04:25 | kashyap | See the side-bar | |
| 14:04:33 | mdbooth | kashyap: And you'd emit a warning if TLS isn't correctly configured. | |
| 14:04:51 | kashyap | mdbooth: We're not touching any defaults at all. | |
| 14:04:53 | mdbooth | kashyap: With perhaps a config option to turn that warning into an error. | |
| 14:05:02 | sean-k-mooney1 | kashyap: so as long a libvirt suppors ssh i think we shoudl support it in nova enven if we dont recommend it for new deployments | |
| 14:05:08 | mdbooth | kashyap: ack, understood. | |
| 14:05:41 | kashyap | Just to refresh your memory, today if a Nova user wants any encryption at all, they need to explicitly configure: live_migration_tunnelled | |
| 14:06:07 | kashyap | Instead of that, we're proposing a better and secure alternative that addresses the limitations of '_tunnelled' | |
| 14:06:10 | sean-k-mooney1 | kashyap: no they jsut need to change the migration url | |
| 14:06:29 | sean-k-mooney1 | kashyap: and excanhage ssh keys | |
| 14:06:49 | kashyap | sean-k-mooney1: Oh, true -- that's the other "main way" | |
| 14:07:27 | sean-k-mooney1 | kashyap: thats the one i use as its one line and "just works" | |
| 14:08:35 | kashyap | Yeah; but hypervisor-native mechanism is what the lower layer folks recommend | |
| 14:08:46 | mdbooth | kashyap: Incidentally, why can't we query libvirt for MIN_LIBVIRT_NATIVE_TLS_VERSION and MIN_QEMU_NATIVE_TLS_VERSION? | |
| 14:09:20 | kashyap | sean-k-mooney1: Also, there's work in progress upstream QEMU that will let the native encyrption "crush" the tunnelled perf (see the chat transcript w/ DanPB) | |
| 14:09:47 | kashyap | mdbooth: Hmm ... I don't know if I a definitive answer top off my had | |
| 14:09:53 | kashyap | s/I a/I have a/ | |
| 14:10:19 | sean-k-mooney1 | sure but until devstack has support for deploying native tls ill stick with ssh for my livemigration testing :) | |
| 14:10:56 | sean-k-mooney1 | kashyap: looking at https://libvirt.org/remote.html#Remote_transports the defalt transport is not tls | |
| 14:11:02 | sean-k-mooney1 | *now tls | |
| 14:11:02 | kashyap | mdbooth: I don't think there's a way for that level of granular querying :-( | |
| 14:11:22 | kashyap | mdbooth: Because I had to do 2 hours of Git sluething in libvirt and talking to the upstream libvirt folks to settle on the right version | |
| 14:12:05 | sean-k-mooney1 | mdbooth: where you refering to checking we had the required versions or determining what the required versions were? | |
| 14:13:35 | gibi | ShilpaSD: yes, in nova there are two version checcking unit tests, one for the normal nova ovos, and another for the notification ovos. | |
| 14:14:02 | kashyap | sean-k-mooney1: The native TLS is worth the pain for actual deployers, not DevStack users #yes-offense :D | |
| 14:14:05 | gibi | ShilpaSD: just pulling your patch down to test it | |
| 14:14:12 | kashyap | s/users/users;/ | |
| 14:14:38 | mdbooth | sean-k-mooney1: Checking we have the required *features*. | |
| 14:15:21 | kashyap | mdbooth: Yeah, I see what you mean -- you want a way to check w/ libvirt if it (and the QEMU on the host) has the relevant features | |
| 14:15:30 | kashyap | Instead of us liberally splattering version constants | |
| 14:15:39 | ShilpaSD | gibi:ok | |
| 14:16:02 | kashyap | mdbooth: Okay, just double-confirmed with upstream libvirt dev: | |
| 14:16:22 | kashyap | <mprivozn> I don't think there is currently a way to tell if qemu/libvirt supports TLS migration | |
| 14:16:24 | sean-k-mooney1 | mdbooth: kashyap that would be nice but we have version checks all over the libvirt driver as its not something qemu/libvirt generally supports | |
| 14:16:43 | kashyap | sean-k-mooney1: Yeah, we just have to go that route; there's no other alternative for Nova. | |
| 14:20:28 | openstackgerrit | Maria Luisa Arches proposed openstack/nova master: Skip checking of target_dev for vhostuser https://review.openstack.org/627540 | |
| 14:22:19 | gibi | ShilpaSD: I went back to the previous commit and the test_versions already fails there | |
| 14:22:48 | ShilpaSD | gibi: yes since ps1 its failing | |
| 14:23:02 | gibi | ShilpaSD: not the previous PS but the previous commit | |
| 14:23:15 | ShilpaSD | gibi:ohhh | |
| 14:24:15 | gibi | ShilpaSD: http://paste.openstack.org/show/740448/ | |
| 14:26:57 | openstackgerrit | Yongli He proposed openstack/nova-specs master: add spec "show-server-numa-topology" https://review.openstack.org/612256 | |
| 14:28:08 | ShilpaSD | gibi: referred https://review.openstack.org/#/q/status:open+project:openstack/masakari, there are patches after my patches with Zuul +1, eg. https://review.openstack.org/#/c/585592/ | |
| 14:45:03 | openstackgerrit | Jan Gutter proposed openstack/nova-specs master: Spec to implement vRouter HW offloads https://review.openstack.org/567148 | |
| 14:45:55 | yonglihe | Jay, Matt please take a look this spec, thanks. https://review.openstack.org/#/c/612256/18 | |
| 14:51:09 | yonglihe | call for review this simple "server-group" spec: https://review.openstack.org/#/c/612255/ | |
| 14:57:35 | gibi | ShilpaSD: https://review.openstack.org/#/c/470847/8 this patch fails the test_versions locally | |
| 14:57:46 | gibi | ShilpaSD: but it passes on the gate | |
| 14:58:08 | gibi | ShilpaSD: so someting is wrong with the version test even without the notification patch | |
| 15:03:05 | openstackgerrit | Yongli He proposed openstack/nova-specs master: add spec "show-server-numa-topology" https://review.openstack.org/612256 | |
| 15:09:18 | ShilpaSD | gibi: ya, just checked, its failing locally, how to resolve this, any pointers? | |
| 15:09:46 | gibi | I guess you see some kind of race condition or test case interference | |
| 15:10:20 | gibi | ShilpaSD: try to figure out why MyObj is sometimes in the object registry but other times not in the object registry | |
| 15:11:14 | ShilpaSD | gibi: observed that sometimes notification classes are in the object registry but other times not in the object registry, reason will figure out | |
| 15:11:36 | ShilpaSD | gibi: will look into this tomorrow, and get back to you, leaving for now | |
| 15:11:46 | ShilpaSD | gibi: thanks for discussion | |
| 15:12:02 | gibi | ShilpaSD: @register decorator puts the class to the registry so the registry's content depends on which files are imported | |
| 15:13:02 | gibi | ShilpaSD: good luck | |
| 15:13:02 | gibi | :) | |
| 15:13:44 | ShilpaSD | gibi: thats there, except for MyObj and MyOwnedObject, and for notification we have @, yes will check tomorrow, thanks for wishesregister_notification | |
| 15:14:14 | ShilpaSD | gibi: thats there, except for MyObj and MyOwnedObject, and for notification we have @register_notification, yes will check tomorrow, thanks for wishes | |
| 15:17:51 | dansmith | bauzas: replied to your naming comment on the cross-cell-resize spec, if you could take a look | |
| 15:18:04 | bauzas | dansmith: sure ok | |
| 15:18:30 | bauzas | oh, mriedem is s/French/on PTO/ this week, right | |
| 15:19:27 | dansmith | bauzas: yes, and the deadline is next week | |
| 15:19:34 | dansmith | so we basically need to get this merged before he gets back | |
| 15:19:41 | bauzas | yup | |
| 15:19:57 | dansmith | he's had it up for a long time | |
| 15:20:06 | bauzas | that's even this Thursday, right? | |
| 15:20:36 | dansmith | so given that (a) it's complex and we'll have to figure out some stuff during implementation, (b) those of you that haven't reviewed until now will have to be a little less picky :) | |