| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-03-20 | |||
| 17:11:03 | lbragstad | mnaser that's why we write the policy like "(role:reader and system_scope:all) or role:admin_or_owner" | |
| 17:11:08 | gmann | no, as lbragstad mentioned we will add a special case of scope_type for that what keystone did - role:reader and system_scope:all | |
| 17:11:29 | mnaser | ok so we would have a policy enforcing both .. until we decide to cut it off | |
| 17:11:38 | gmann | true | |
| 17:11:39 | mnaser | so maybe a train could be a transitionary release i guess | |
| 17:11:43 | mnaser | and then we can flip the switch | |
| 17:12:10 | lbragstad | we need to write slightly more complicated policy check_strs to allow for the migration | |
| 17:12:18 | gmann | I suggest to flip in V to give 1 2 cycle of transition phase as this is huger change in policy | |
| 17:12:34 | mnaser | can you enable enforcement of system_scope? | |
| 17:12:36 | lbragstad | then we can offload more to oslo.policy using enforce_scope=True in the future and simplify the check strings | |
| 17:12:57 | mnaser | could a deployer enable it AND put rule:admin_or_owner set to nothing | |
| 17:13:05 | mnaser | and they'd be using 'the new system' | |
| 17:13:51 | lbragstad | yeah... if a deployer wants to opt into the new system, they just have to maintain a policy file with the *new* defaults, which omits the logical OR with oslo.policy migration | |
| 17:14:07 | lbragstad | it's clunky... but... | |
| 17:16:52 | openstackgerrit | Merged openstack/nova master: Add known issue for minimum bandwidth resource leak https://review.openstack.org/644694 | |
| 17:40:24 | NobodyCam | Good Morning Nova folks | |
| 17:54:00 | jaypipes | NobodyCam: mornin :) | |
| 17:54:08 | jaypipes | or afternoon. | |
| 17:54:31 | NobodyCam | hey hey jaypipes long time! | |
| 17:56:39 | eandersson | jaypipes, do you happen to know the difference between free_disk_gb and disk_available_least? | |
| 17:56:49 | eandersson | I assume disk_available_least takes images etc into account? | |
| 17:57:07 | eandersson | Trying to figure out why a vm that was destroyed and re-created won't fit into the same compute again. | |
| 17:57:25 | eandersson | free_disk_gb is large enough to accommodate the vm | |
| 17:58:47 | eandersson | also, manually creating the vm on that compute worked (free_disk_gb is now 4, and disk_available_least is -33) | |
| 17:59:27 | sean-k-mooney | eandersson: disk_available_lest will sometime be the same but it can be wildly different depending on your storage backend | |
| 18:00:00 | eandersson | so this is probably due to the rocky upgrade | |
| 18:00:45 | eandersson | we don't use a specified storage backend | |
| 18:00:49 | eandersson | so what ever is default | |
| 18:01:10 | eandersson | brb | |
| 18:01:45 | sean-k-mooney | eandersson: google could me this https://gist.github.com/JCallicoat/43505cab0535057ca4fb | |
| 18:02:14 | sean-k-mooney | i wonder if we have that comment in our code | |
| 18:02:33 | NobodyCam | so dumb question, when creating new project / user it's just the _member_ role that is required to launch instances? | |
| 18:02:55 | sean-k-mooney | NobodyCam: by defualt yes | |
| 18:03:11 | NobodyCam | :) | |
| 18:03:21 | sean-k-mooney | although you have to also have a default quota of instnaces greater then 0 | |
| 18:07:32 | sean-k-mooney | eandersson: what i ment by storage spefic backedn is it gets a little broken when using shared storage e.g. nfs or rbd | |
| 18:08:55 | sean-k-mooney | eandersson: if free_gb is positive and disk_available_lest is negitive it means your worst case over commited for the instance that are shduled to the host exceed that allowed by your over commit raitio | |
| 18:10:12 | klindgren | Question re: live migration + configdrive + iso9960. Instead of scping the file between HV's. Can why can't we just recreate the config drive on the destination host? | |
| 18:10:48 | sean-k-mooney | klindgren: i belive there was a libvirt bug that prevented | |
| 18:10:52 | sean-k-mooney | klindgren: but we could | |
| 18:10:54 | klindgren | Are files that re passed in via the a boot command, not started as part of the vm data? So the config drive would be incomplete? | |
| 18:11:53 | sean-k-mooney | klindgren: i think that depends. i think we store user-data in the db in the instance extra table | |
| 18:12:13 | klindgren | Yea, we changed the code (we have a new enough libvirt) on the scp to look for iso9961 vs iso9960. And the migration works, it just creates a sparsely populated file with no data in it on the dst. | |
| 18:12:20 | sean-k-mooney | klindgren: what files are you spscically refering to | |
| 18:13:11 | klindgren | Nova boot --file /seomdest=blah --file /anotherdest=asdf | |
| 18:13:27 | klindgren | Which gets put in to config drive under content/000, content/0001 | |
| 18:14:17 | sean-k-mooney | klindgren: ya so openstack server create --user-data < my data> is stored in the db i dont think we store teh contets of files passed with --file | |
| 18:14:18 | NobodyCam | another dumb question: is there a trick to allowing the admin to launch service instances: I'm seeing Policy check for os_compute_api:os-hide-server-addresses failed with credentials <blah> when attempting to launch Octavia instances | |
| 18:20:31 | sean-k-mooney | NobodyCam: am the amdin account i think need but admin and _member_ roles | |
| 18:20:43 | sean-k-mooney | but the admin account still had a quota | |
| 18:21:14 | sean-k-mooney | in the case of octavir the octavia service account allso has a quota typeiclay it will be set to -1 to have no limit however | |
| 18:30:47 | openstackgerrit | Merged openstack/nova master: docs: Misc cleanups https://review.openstack.org/644616 | |
| 18:32:21 | mriedem | klindgren: correct personality files (file injection) are not stored in the db so if they are only in the config drive and you rebuild the config drive on the dest, those will be gone | |
| 18:32:37 | mriedem | same issue for shelve/unshelve with a config drive + personality files | |
| 18:33:15 | sean-k-mooney | mriedem: personality files are also deprecated for removal for 2 release or more right? | |
| 18:33:32 | mriedem | correct https://specs.openstack.org/openstack/nova-specs/specs/queens/implemented/deprecate-file-injection.html | |
| 18:33:37 | mriedem | but it's an API so they aren't going to be removed | |
| 18:33:41 | mriedem | just strongly discouraged | |
| 18:34:08 | sean-k-mooney | mriedem: not even with a microverion? | |
| 18:34:17 | mriedem | although, a deployment can simply disable file injection (and that's the default for libvirt) today | |
| 18:34:28 | mriedem | sean-k-mooney: yes we deprecated them by removing them from the API | |
| 18:34:33 | mriedem | but if you use 2.1 then that doesn't matter | |
| 18:35:03 | sean-k-mooney | ah that makes sense. that is what i had assed we would do | |
| 18:35:17 | mriedem | when you assed you make an ass of u and me | |
| 18:35:46 | sean-k-mooney | typos all the typos :) | |
| 18:35:50 | mriedem | this is the libvirt thing https://docs.openstack.org/nova/latest/configuration/config.html#libvirt.inject_partition | |
| 18:35:51 | _pewp_ | [ OpenStack Docs: Configuration Options ] - docs.openstack.org | |
| 18:35:55 | mriedem | disabled by default forever | |
| 18:36:26 | sean-k-mooney | mriedem: i think we reinable it in some of the tempest jobs | |
| 18:36:40 | sean-k-mooney | but i dont rememebr which one | |
| 18:36:44 | sean-k-mooney | anyway its not important | |
| 18:38:20 | mriedem | yes it's the ENABLE_FILE_INJECTION var in devstack | |
| 18:38:25 | mriedem | it's in the base tempest job to test personality files | |
| 18:38:46 | gmann | it is enable in tempest-full | |
| 18:38:58 | sean-k-mooney | mriedem: so related to klindgren's question if we have disabled file injection is there any reason we cant just recreate the config dirve in that case | |
| 18:39:35 | mriedem | idk, not my area of expertise | |
| 18:39:38 | mriedem | mikal could maybe help | |
| 18:39:41 | sean-k-mooney | mriedem: i mean they are not big so im not sure that is really a big issue anyway | |
| 18:39:57 | mriedem | klindgren: what is the problem with transferring the config drive during live migration? | |
| 18:40:10 | mriedem | it becomes read-only or what? | |
| 18:40:31 | klindgren | Allowing ssh between all compute nodes with an ssh key | |
| 18:40:53 | klindgren | Gives an easy vector for an attacker to spread across compute nodes | |
| 18:40:53 | sean-k-mooney | klindgren: i dont think that is required in all cases | |
| 18:41:22 | klindgren | Its required in the configdrive + iso9960 use case | |
| 18:41:30 | sean-k-mooney | if you are using the ssh migration uri for libvrt then it would be | |
| 18:41:59 | sean-k-mooney | but im not sure if you can tunnel the file data over the libvirt connection when using qemus/libvirst native tls feature | |
| 18:42:00 | klindgren | we are using TLS for libvirt but this code does scp's of the config drive | |
| 18:42:07 | sean-k-mooney | kashyap: ^ any idea? | |
| 18:42:13 | klindgren | Because even libvirt 4.x can't migrate it/won't | |
| 18:42:24 | sean-k-mooney | klindgren: oh ok | |
| 18:42:55 | sean-k-mooney | klindgren: any you need config drive because ye cant use metadata service or just dont want too? | |
| 18:43:37 | klindgren | We only use configdrive vs's running metadata, and we have a bunch of stuff from other teams built onto of configdrive | |
| 18:44:08 | sean-k-mooney | oh wait ye are still support file injection too wich needs config drive | |
| 18:44:56 | klindgren | We don't specifically disable file injection, however in our case - no one uses it. | |
| 18:48:07 | klindgren | Basically In: https://github.com/openstack/nova/blob/master/nova/virt/libvirt/driver.py#L8196-L8215 | |
| 18:48:08 | _pewp_ | [ nova/driver.py at master · openstack/nova · GitHub ] - github.com | |
| 18:48:41 | sean-k-mooney | klindgren: ok. at first glance it sound like we may be able to just recreate the config drive in your sepcific case when file inject is diabled. | |
| 18:49:00 | klindgren | If we change iso9660 to iso9661, the live migration works. The confgdrive file is created on the destination hv. However, its created as a correctly size, spare file with no data in it | |
| 18:50:22 | klindgren | sean-k-mooney, We would be willing to do the code for this. Just wanted to make sure that their was some reason why we never did this before and wanted to make sure that we would have some level of support for this. | |
| 18:50:54 | klindgren | Assuming the file injection stuff was probably the blocker before hand. | |