Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-04-01
19:47:20 mnaser ugh but even then
19:47:26 mnaser I don't think anything will pass ?token=foo
19:48:08 melwitt mnaser: ok, I was trying to say when you said "give the token back to novnc" I don't think you can do that in lookup()
19:48:51 mnaser oooo
19:48:58 melwitt mnaser: earlier I was saying maybe we could do the entire validation in lookup() and then no longer need the token after that?
19:49:02 mnaser melwitt: https://github.com/novnc/websockify/blob/6e09ec25486f431e2acc463f994c4eb4bebc6ddd/websockify/websocketproxy.py#L164-L175
19:49:16 melwitt yeah
19:49:47 mnaser so we get lookup called with the token, grab the stuff from the db, and return it back, and we can probably drop all that extra code
19:49:59 melwitt what do you mean by return it back?
19:50:23 mnaser so in the token plugin, we check the db, see if the var is still valid, and return (host, port)
19:50:36 mnaser and technically... I think none will just do the rest of the issues
19:50:43 melwitt ok. I thought you meant return the token
19:50:45 melwitt ok. that's what I was trying to say earlier
19:50:53 mnaser ah no I meant return the host/port, sorry distracted
19:51:00 mnaser people keep walking into my office >:(
19:51:09 melwitt how dare they!
19:52:39 mnaser let me try to hack at this
19:54:12 melwitt sounds good. I will review it when it's ready :)
19:54:27 mnaser honestly I think this could completely eliminate the websocketproxy.py
19:54:53 mnaser a lot of that stuff exists in webproxify but I dunno how much of this can be back portable at this point..
19:55:28 melwitt maybe. there is some extra stuff in there though
20:19:18 mnaser melwitt: well, I got a nice refactor out of it, but still I think it expects I to be there
20:21:16 melwitt mnaser: yeah, you'd have to change https://github.com/openstack/nova/blob/master/nova/cmd/baseproxy.py#L68 too
20:23:32 mnaser ok well to get it just to work I found a gross fix.. I think
20:23:38 mnaser let me test it against the original code
20:23:49 mnaser vnc_lite.html?path=?token=<token> seems to be calling my token plugin
20:25:14 mnaser But I think then the original code works
20:25:22 mnaser We would just need to tweak the default value :/
20:25:49 melwitt yeah, shouldn't need path= right
20:25:58 melwitt default value of what?
20:27:45 mnaser The nova configuration value
20:27:51 mnaser The one pointing at vnc_lite or whatever
20:28:19 mnaser To not longer suggest ?token=foo is the way but ?path=?token=foo
20:28:39 melwitt I thought earlier you told me including path= wasn't as clean :P
20:28:51 mnaser Yeah it’s just BLAH
20:28:57 mnaser why people gotta rip code out
20:29:14 melwitt I guess, I thought the token plugin would let us use the old default url
20:29:19 mnaser Same.
20:29:34 mnaser But once it was done I realized the web socket thing was only checking it at the web socket stage
20:29:37 melwitt because if we include path in the default, we could fix this without the token plugin, I think, as I mentioned earlier
20:29:55 mnaser Yeah then we won’t be falling back to cookies every time
20:30:02 melwitt right
20:31:38 mnaser I guess we can propose a revert and then I’ll just pin on the old commit :/
20:31:50 mriedem efried: you're talking about get_or_set_cached_cell_and_set_connections right?
20:32:13 efried mriedem: yeah
20:32:23 efried I didn't go back and look whether that's "normal".
20:32:25 mriedem i think that's nova.compute.api.API being constructed per controller per worker
20:32:30 efried k
20:32:35 mriedem which is a lot since it's not a singleton
20:33:02 efried Last week I noticed pretty frequent failures sprayed across the long-running jobs. Never more than one per patch, and never the same one twice in a row.
20:33:08 efried but I didn't dig into any of them.
20:33:10 mriedem i assume the get_or_set_cached_cell_and_set_connections target_cell is due to a query on the services table when constructing the compute RPCAPI with [upgrade_levels]/compute=auto
20:33:39 mriedem https://bugs.launchpad.net/nova/+bug/1815697
20:33:40 openstack Launchpad bug 1815697 in OpenStack Compute (nova) "[upgrade_levels]compute=auto grinds the API response times when a cell is down" [Medium,Confirmed]
20:33:40 mnaser I honestly don’t have that much time to dig more into this. I can report a bug and add a known issue (if needed) but I don’t have time to deal with getting this merged into novnc :/
20:33:58 mriedem efried: also https://bugs.launchpad.net/nova/+bug/1815692
20:34:00 openstack Launchpad bug 1815692 in OpenStack Compute (nova) "minimum nova-compute service version is not cached in nova-api when running under wsgi" [Low,Triaged]
20:34:58 melwitt mnaser: or we could change our default nova conf value? or do you think asking for a revert is a better route?
20:35:25 mnaser melwitt: I think the amount of downstream stuff that will break (because everyone configures this in their compute nodes) is gonna be .. a lot
20:35:37 mnaser cause now tripleo/osa/etc all have to change our paths
20:35:47 mnaser to something sketchy none the less :P
20:35:58 melwitt mnaser: yeah, I see. ok
20:36:06 mnaser I wouldn't revert it all
20:36:11 mnaser maybe just the small part to set the cookie
20:36:12 melwitt yeah
20:41:34 mriedem efried: i guess bug 1815692 won't help because we don't cache the minimum compute service version until we get one, meaning until a nova-compute starts up, which in devstack is after the api
20:41:36 openstack bug 1815692 in OpenStack Compute (nova) "minimum nova-compute service version is not cached in nova-api when running under wsgi" [Low,Triaged] https://launchpad.net/bugs/1815692
20:42:12 efried is making the thing a singleton an option?
20:42:12 mriedem making nova.compute.api.API or nova.compute.rpcapi.ComputeAPI a singleton might help
20:42:27 efried Is there any evidence that that's actually a problem though?
20:42:31 mnaser melwitt: https://bugs.launchpad.net/nova/+bug/1822676
20:42:32 openstack Launchpad bug 1822676 in OpenStack Compute (nova) "novnc no longer sets token inside cookie" [Undecided,New]
20:42:38 melwitt mnaser: you know, while I was looking at the websockify source, I was thinking maybe in code we could append to our self.path earlier in the call path. I can try something out
20:42:42 efried the devstack log just says n-api doesn't start.
20:42:51 efried I guess that means "within a certain amount of time"
20:42:53 melwitt mnaser: thanks for the bug report
20:42:55 mriedem efried: it's a timeout
20:42:58 mnaser melwitt: all yours :) I don't think I can take more time on this :X
20:43:04 mnaser I will "work-around" it in osa
20:43:12 melwitt mnaser: yeah, I'll try this out and let you know
20:43:36 mriedem efried: the non-singleton nature with locks can definitely cause slowness ala https://review.openstack.org/#/c/623246/
20:43:56 melwitt mnaser: if what I'm thinking doesn't end up working, I can ask the novnc folks if they can revert the nova part
21:00:49 openstackgerrit Eric Fried proposed openstack/nova master: Hacking N362: Don't abbrev/alias privsep import https://review.openstack.org/649188
21:02:59 efried this f'in thing is never going to merge. Now it's failed py37
21:15:11 mriedem dansmith: you know how on nova-api startup we check for the minimum nova-compute service version in order to set the rpc pin if [upgrade_levels]/compute=auto https://github.com/openstack/nova/blob/master/nova/compute/rpcapi.py#L408 ?
21:16:09 mriedem the comment above that says we don't cache it because "we will get a better answer next time." - but next time would have to be on restart of the service right? because we only call _determine_version_cap once in order to construct the ClientRouter
21:18:11 openstackgerrit Michael Still proposed openstack/nova master: Style corrections for privsep usage. https://review.openstack.org/648615
21:18:12 openstackgerrit Michael Still proposed openstack/nova master: Improve test coverage of nova.privsep.path. https://review.openstack.org/648601
21:18:12 openstackgerrit Michael Still proposed openstack/nova master: Improve test coverage of nova.privsep.fs. https://review.openstack.org/648602
21:18:13 openstackgerrit Michael Still proposed openstack/nova master: Improve test coverage of nova.privsep.fs, continued. https://review.openstack.org/648603
21:18:13 openstackgerrit Michael Still proposed openstack/nova master: Add test coverage for nova.privsep.libvirt. https://review.openstack.org/648616
21:18:14 openstackgerrit Michael Still proposed openstack/nova master: Privsepify ipv4 forwarding enablement. https://review.openstack.org/635431
21:18:14 openstackgerrit Michael Still proposed openstack/nova master: Remove unused FP device creation and deletion methods. https://review.openstack.org/635433
21:18:15 openstackgerrit Michael Still proposed openstack/nova master: Privsep the ebtables modification code. https://review.openstack.org/635435
21:18:15 openstackgerrit Michael Still proposed openstack/nova master: Move adding vlans to interfaces to privsep. https://review.openstack.org/635436
21:18:16 openstackgerrit Michael Still proposed openstack/nova master: Move iptables rule fetching and setting to privsep. https://review.openstack.org/636508
21:18:16 openstackgerrit Michael Still proposed openstack/nova master: Move dnsmasq restarts to privsep. https://review.openstack.org/639280
21:18:17 openstackgerrit Michael Still proposed openstack/nova master: Move router advertisement daemon restarts to privsep. https://review.openstack.org/639281
21:18:18 openstackgerrit Michael Still proposed openstack/nova master: Move calls to ovs-vsctl to privsep. https://review.openstack.org/639282
21:18:18 openstackgerrit Michael Still proposed openstack/nova master: Move setting of device trust to privsep. https://review.openstack.org/639283

Earlier   Later