| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-01-10 | |||
| 15:42:15 | kashyap | (For convenience, here's the review: https://review.openstack.org/#/c/629627/4) | |
| 15:42:31 | dansmith | kashyap: yeah I know, I've gotten the notifications, just have stuff to do this morning before I get to it | |
| 15:42:42 | kashyap | stephenfin: Thanks for the quick turn around | |
| 15:43:13 | kashyap | dansmith: Ah, didn't know you follow those notifications. On IRC, I follow the "explicit is better than implicit" principle :-) | |
| 15:44:40 | kashyap | It can wait until your morning tasks are done, so long as it doesn't miss the BP-Approvals deadline. | |
| 15:51:46 | mnaser | kashyap: that's a pretty sweet doc patch. | |
| 15:51:58 | kashyap | mnaser: Thanks :-) | |
| 15:52:14 | mnaser | i'm going to try and work up some openstack ansible patches which allow setting tls config | |
| 15:52:30 | kashyap | mnaser: Cool; do post a URL here when you get around to it | |
| 15:52:35 | mnaser | we have a full pki so switching this on and replacing it should be straightforward, will do | |
| 15:52:48 | kashyap | mnaser: When I dev-tested it, I painfully configured it by hand! Look at the scrollbar: https://kashyapc.fedorapeople.org/Native-TLS/Setup-for-NBD-and-migration-streams-over-TLS.rst.txt | |
| 15:53:04 | mnaser | OSA doesn't have the PKI, our deployments do, but i'm sure we can figure out a way to make it easily available inside it, somehow | |
| 15:53:10 | kashyap | It's from-scratch, though, set up in virtual environments | |
| 15:53:14 | dansmith | kashyap: I'm fine with approving the blueprint at this point | |
| 15:53:28 | kashyap | mnaser: Do you know about the freeipa.org project? | |
| 15:53:37 | mnaser | kashyap: freeipa is exactly what we run :) | |
| 15:53:48 | kashyap | mnaser: It does all the Cert Lifecycle handling. (In the distant past, /me used to work on one of its PKI components :-)) | |
| 15:53:55 | mnaser | so i was thinking of getting certs and using certmonger to keep em up to date too | |
| 15:53:56 | kashyap | dansmith: Nice, thank you | |
| 15:53:56 | jaypipes | sean-k-mooney: done. | |
| 15:54:00 | jaypipes | adrianc: ^ | |
| 15:54:14 | kashyap | mnaser: Yep; 'certmonger' handles the much-needed renewal aspect | |
| 15:54:37 | sean-k-mooney | jaypipes: cool ill assume i have rework to do so ill respin | |
| 15:54:49 | jaypipes | sean-k-mooney: just typos/grammar nits. | |
| 15:54:51 | mnaser | yep, so i'd probably wire it up to that, somehow | |
| 15:54:55 | jaypipes | sean-k-mooney: fix those up and I'm +2. | |
| 15:55:29 | sean-k-mooney | cool ill do dose now so thanks for reviewing | |
| 15:55:51 | kashyap | mnaser: Sometimes, I just write a no-frills PKI setup with GnuTLS -- that's hacky, but I like the minimalism of it | |
| 15:56:15 | mnaser | kashyap: freeipa has simplified pki so much | |
| 15:56:18 | kashyap | (That's only for dev environments, though. Normally, you'd want an "enterprise PKI" :D) | |
| 15:57:05 | mnaser | and it has a ton of neat things like we're using SSHFP + DNSSEC so for clients that aren't enrolled, they can use SSHFP to verify validity of server when logging in | |
| 15:57:08 | kashyap | mnaser: Yep, recall. Components of FreeIPA were part of my first project at Red Hat 10 years ago :-) | |
| 15:57:11 | mnaser | aka never hitting "yes" blindly anymore | |
| 15:57:15 | kashyap | s/recal/I recall/ | |
| 15:59:06 | kashyap | mnaser: Didn't follow it lately; good to know it also handles DNNSEC | |
| 15:59:42 | mnaser | kashyap: yeah so you can have signed zones, and then freeipa will create SSHFP records on enrollment, ssh clients lookup these records when connecting and make sure the server is who it claims to be :) pretty neat | |
| 16:00:04 | kashyap | Very nifty | |
| 16:17:51 | melwitt | dansmith, gibi, jaypipes: looks like we are a go for approving https://blueprints.launchpad.net/nova/+spec/support-qemu-native-tls-for-live-migration now? | |
| 16:17:59 | dansmith | yup | |
| 16:18:34 | melwitt | I also wanted to get consensus on approving this one too https://blueprints.launchpad.net/nova/+spec/fix-reschedule-up-calls | |
| 16:19:56 | dansmith | is matt really going to work on that? | |
| 16:20:14 | dansmith | if so, I'm fine with it.. looks like it's just a token bp because of the rpc changes or something | |
| 16:21:39 | melwitt | yeah, I'm not sure if he'll have time given cross-cell resize | |
| 16:21:57 | jaypipes | melwitt: sorry, Melanie, I haven't had a chance to look at that. | |
| 16:22:02 | melwitt | but I noticed the bp when I went through the list of things targeted to stein | |
| 16:49:28 | efried | jackding: Hi there. Do you know who is planning to implement https://review.openstack.org/#/c/620959/ and on what kind of timeline? | |
| 16:50:03 | efried | jackding: bp/cpu-model-selection that is | |
| 16:55:01 | jackding | efried: I don't know the timeline but I believe a Intel team is looking into this. | |
| 16:55:45 | efried | jackding: Heh, just so. I guess that's why I'm being asked about it. | |
| 16:56:48 | jackding | efried: yeh I don't think they have sorted out the details | |
| 16:57:33 | openstackgerrit | Jack Ding proposed openstack/nova master: Improve libvirt image and snapshot handling https://review.openstack.org/616692 | |
| 17:02:32 | kashyap | stephenfin: Hope my response answers your question there: https://review.openstack.org/#/c/625216/5/nova/virt/libvirt/driver.py@230 | |
| 17:04:51 | melwitt | dansmith: I'm thinking we can just approve the up calls one and then I'll ask matt next week if he's planning to work on it, if not I'll just defer it back out | |
| 17:05:26 | dansmith | melwitt: okay | |
| 17:09:13 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: Doc: rebuild can result in SHUTOFF VM state https://review.openstack.org/629904 | |
| 17:11:38 | stephenfin | jaypipes: Happy to +2 this assuming sean-k-mooney provides a follow up that handles the outstanding issues? https://review.openstack.org/605116 | |
| 17:11:49 | stephenfin | sean-k-mooney: I assume you're planning doing that :) | |
| 17:11:53 | stephenfin | *to do | |
| 17:12:16 | sean-k-mooney | its half done | |
| 17:12:28 | sean-k-mooney | metting delayed me finishing it | |
| 17:15:49 | sean-k-mooney | stephenfin: jaypipes the only real change to me is do "git commit" or "git commit --amend" when its done which will be later today im just about to have something quick to eat and look at the extra nits from artom. | |
| 17:15:55 | jaypipes | stephenfin: yes, I'm happy to +2 after sean-k-mooney removes the Sean-speak from it :P | |
| 17:16:23 | jaypipes | sean-k-mooney: I'm also grabbing some lunch, no worires :) | |
| 17:16:35 | artom | "worires"? Sean-speak, eh? | |
| 17:16:43 | artom | >;) | |
| 17:22:24 | dansmith | oh gawd, jay caught it | |
| 17:24:15 | sean-k-mooney | yeah im slowly infulencing ye all :) | |
| 17:26:14 | sean-k-mooney | be back in 30 mins or so | |
| 17:29:45 | kashyap | Is Gerrit down? | |
| 17:30:00 | kashyap | "The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later." | |
| 17:30:34 | kashyap | Whoops, this says it's just me: https://downforeveryoneorjustme.com/review.openstack.org | |
| 17:30:43 | cdent | me too | |
| 17:30:49 | melwitt | the infra folks just restarted gerrit | |
| 17:30:53 | melwitt | should be back soon I think | |
| 17:31:23 | kashyap | melwitt: Ah, thanks! | |
| 17:31:29 | kashyap | Yes, it's back now | |
| 17:33:49 | melwitt | dansmith: do you agree that this bp should have a spec at least because it's proposing to add a new flavor extra spec? or do you think it would be ok specless? https://blueprints.launchpad.net/nova/+spec/libvirt-disable-pmu-for-realtime-guests | |
| 17:34:21 | dansmith | will look in a sec | |
| 17:34:41 | melwitt | thanks. just want a sanity check | |
| 17:34:51 | kashyap | stephenfin: Worth respinning for the nit, and losing the +2s? Instead of a follow-up? | |
| 17:34:57 | kashyap | (For this, I mean: https://review.openstack.org/#/c/625216/) | |
| 17:35:18 | stephenfin | kashyap: narp. Follow up | |
| 17:35:26 | stephenfin | +W'd | |
| 17:35:36 | stephenfin | assuming melwitt didn't want to review it? ^ | |
| 17:35:56 | kashyap | Ah, okay, then. Thank you. I do have a follow-up patch in prep for the deprecation notes, etc. | |
| 17:37:42 | kashyap | FWIW, Mel did review the "mini spec" (blueprint), though. So I know she's onboard with the idea :-) | |
| 17:37:51 | kashyap | Alright, I get dinner, then. | |
| 17:39:02 | dansmith | melwitt: I dunno, I have a couple questions about the functionality, which might mean spec. Not sure if we always require a spec for new extra_specs, but generally they mean features which need some discussion | |
| 17:39:17 | dansmith | melwitt: sucks to say that on the spec deadline day, but this was also filed three days ago, so I dunno | |
| 17:40:45 | sean-k-mooney | dansmith: it was a small feature i was just pulling in form work i planned to do in train. i can write a mini spec if people want but i also wont be upset if we defer | |
| 17:40:58 | dansmith | sean-k-mooney: if it's train, then spec and defer | |
| 17:41:01 | dansmith | imho | |
| 17:41:24 | dansmith | oh, this isn't targeted at stein? I figured that's why melwitt was asking | |
| 17:41:39 | sean-k-mooney | it is targeted to stien | |
| 17:42:09 | melwitt | well, sean-k-mooney added it to the etherpad https://etherpad.openstack.org/p/nova-stein-blueprint-spec-freeze near the bottom so I was trying to make sure it got some consideration | |
| 17:42:12 | sean-k-mooney | but down stream it was not planned to be worked on until next cycle | |
| 17:42:24 | sean-k-mooney | i just taugh ti would have time to do it since it is small | |
| 17:42:31 | dansmith | sean-k-mooney: okay I don't see that in lo | |
| 17:42:32 | dansmith | *lp | |
| 17:43:01 | melwitt | yeah, I think only the nova-drivers group can target it | |