Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-05-04
16:05:41 efried cfriesen: Wait, "A guest could have support for both versions, but unless they're specifically wanting 2.0 functionality then 1.2 should be fine." <== so it's possible I only care about "give me TIS"?
16:06:25 efried If that's the case, I'd still be in favor of making the trait optional (and set up by the request filter)
16:06:32 openstackgerrit Lee Yarwood proposed openstack/nova master: WIP/DNM objects: Remove get_by_volume_id from BlockDeviceMapping https://review.opendev.org/657127
16:07:14 cfriesen efried: I think the guest support is different for TIS-on-1.2 vs TIS-on-2.0, but let me confirm with sean/kashyap
16:08:01 efried cfriesen: Okay. None of this should be a huge delta in the impl/spec IIUC. If it turns out to be, I can live with it as is.
16:08:04 kashyap cfriesen: Hi, what exactly you want to double-check? You said "support for both" up-thread -- what are you referring to?
16:08:31 efried kashyap: We're talking about the use cases for TPM. What is it that the operator cares about?
16:08:47 efried kashyap: Is "Give me TIS, I don't care if it's 1.2 or 2.0" a possibility?
16:09:25 cfriesen or do they care primarily about 1.2 vs 2.0, and then crb/tis if they're on 2.0
16:09:51 cfriesen (the spec was written assuming the second)
16:09:51 kashyap efried: I don't know the answer to your second question -- need to go do some QEMU sluething for it
16:11:11 kashyap efried: The use cases for TPM, my limited understanding is that: they are a "big deal" recently:
16:11:18 kashyap efried: The idea is that you have a tiny co-processor that can do crypto, but with company-specified policies.
16:12:03 cfriesen kashyap: we can talk to sean-k-mooney, he doesn't seem to be paying attention to IRC. :)
16:13:41 efried he's paying attention to the room, like I should be :P
16:13:47 kashyap efried: The use cases are disk encryption — e.g. MS's BitLocker, and "Clevis" (https://github.com/latchset/clevis), TLS key storage (openssl-engine-tpm), etc.
16:14:25 kashyap efried: But I agree: there should be some clear write-up about "use cases from an OpenStack operator PoV"
16:15:09 efried kashyap: That would be nice, but I don't want to go crazy here, or block the work pending said writeup.
16:15:33 efried kashyap: Really the only thing I care about is whether there exists a use case where the VM doesn't care which version it gets.
16:15:52 rm_work On behalf of Octavia, we're a little confused about the "deleting a bound port" problem. johnsom is responding to the email right now, but I wonder if higher bandwidth discussion while a lot of us are here would make sense? I guess the email thread is fine otherwise
16:16:51 kashyap efried: Yeah, noted. And yes, we should explicitly document the answer to your question.
16:17:10 efried rm_work: We have time on the agenda this afternoon if you'd like to get together
16:17:33 melwitt rm_work: it means if you delete a port via the neutron REST API without first detaching it from the server it's attached to. if you do this and the port had QoS settings on it, nova will leak resources in placement (because there's no way for us to delete them if you didn't go through the detach port API or the delete server API)
16:17:47 rm_work efried: Is this really a nova issue, or is it a neutron issue? Or is it totally cross-project?
16:18:19 efried rm_work: The leaked allocations are an issue in placement, which would affect subsequent nova boots with QoS-enabled neutron ports :)
16:19:14 melwitt rm_work: one of the takeaways from the discussion is that neutron can deprecate the ability to delete ports that are still attached (and avoid the issue). as you similarly can't delete a volume that is still attached in cinder
16:19:56 efried rm_work: It's really "always" been bad that you could do this (delete a port without considering what it's attached to), but it never mattered enough to do anything about. Now that the port is tied to real allocations in placement, it constitutes a leak and that kinda pushes it over the edge to where we should really do something.
16:19:59 rm_work the reason we do this directly is that there are several cases where a port detach in nova will simply fail to complete
16:20:14 rm_work at which point, we can either orphan the entire port, or we can just delete it
16:20:41 melwitt I guess if a port detach in nova fails to complete, there's a bug that needs to be fixed
16:21:11 rm_work example A: nova compute node is down
16:21:11 efried When the detach fails to complete, is the instance still deleted?
16:21:40 efried If the failure path still removes the allocations from placement, then it would be fine for you to force-delete the port.
16:21:54 melwitt if compute is down it would get cleaned up at the next run of the 'reap' periodic task on compute
16:22:03 rm_work but we can't wait that long
16:22:12 rm_work this is usually during time-sensitive failover operations
16:22:18 melwitt but this is another case where it would help to add start_immediately=True to the reap periodic
16:22:27 rm_work i think in all cases that we do a port delete the VM that it was attached to WILL be deleted anyway
16:22:45 efried actually, gibi_cape: doesn't the allocation go away whenever the instance is deleted? So the actual problem scenario is when we're detaching a port without deleting the instance?
16:22:46 melwitt that way the first run would happen when compute first comes up
16:22:49 rm_work because we only delete these ports when we are also deleting a VM
16:23:02 melwitt gotcha
16:23:06 gibi_cape efried, rm_work: the leaked allocation is reclaimed when the instance is deleted
16:23:07 rm_work unless I am missing a flow <_<
16:23:18 efried rm_work: If you're deleting the VM, and that succeeds, then we're good.
16:23:31 rm_work ok then so long as that is our workflow, we should not be hard-prevented from doing the port deletion
16:23:34 efried rm_work: So the way the proposed change would affect you is you would have to change the way you do that port detach.
16:23:37 rm_work it comes down to a timing issue
16:24:04 rm_work on our side, we're not going to wait for the detach to succeed in nova before we delete the port
16:24:10 rm_work we're going to move on with our cleanup
16:24:28 rm_work waiting would be problematic when we're in the middle of a time sensitive flow
16:24:30 efried rm_work: "not be hard-prevented" - right; but in order to do it after this change, you would have to change either code or policy (depending on how it's decided to implement)
16:24:38 rm_work yeah, if it's policy, fine
16:24:48 rm_work that's doable (we're already a service admin account)
16:25:08 rm_work if it's a code change, what does that mean -- changing to doing a detach first? because that's unlikely to happen
16:25:18 openstackgerrit garyk proposed openstack/nova master: VMware: populate datastore refs at init https://review.opendev.org/574688
16:25:40 efried Changing code to do two calls: 1) null the "owner" field, 2) delete op as you have it today
16:25:42 rm_work especially if you're telling us that it's really not a problem anyway given what we're doing in the big picture
16:26:10 rm_work ok, so just an owner null -- assuming there's no real delay in that, then that seems doable, one extra call isn't the end of the world
16:26:49 efried If code change is the direction we go, nova will have to do the same thing. mriedem expressed not feeling great about that. If it's possible to do this with policy, I'm guessing that will be preferred all around.
16:27:45 gibi_cape do we want to fix this-> < rm_work> the reason we do this directly is that there are several cases where a port detach in
16:27:48 gibi_cape nova will simply fail to complete
16:28:05 gibi_cape do we have some way to reproduce that?
16:28:06 rm_work see johnsom's just-sent email for a more complete example
16:28:12 rm_work i believe it's reproducable yes
16:28:14 gibi_cape rm_work: looking
16:30:58 rm_work the biggest one we can definitively reproduce would be a powered off compute host
16:31:17 rm_work this is a problem whether we are about to delete the port post-detach, or if we are going to re-use it
16:31:27 rm_work (it's ESPECIALLY a problem if we want to re-use it)
16:31:39 rm_work we've seen scenarios where a compute host was powered off for 12-24 hours
16:31:56 rm_work it's theoretically possible that it might NEVER come up -- and what would happen to our port in that case?
16:32:19 efried rm_work: Does the instance get deleted from the database?
16:32:39 openstackgerrit melanie witt proposed openstack/nova master: Use run_immediately=True for _cleanup_running_deleted_instances https://review.opendev.org/657132
16:32:57 rm_work it sticks in "deleting" vm state
16:33:55 efried rm_work: But if the point is that this whole thing is centered around you wanting to delete the VM, and you're going to delete it as soon as that's possible, then you're fine.
16:34:13 efried The proc/mem/disk resources are just as leaked as the bandwidth resources in this case where the VM is undeletable.
16:34:25 rm_work though what happens if we *do* need to delete the port?
16:34:35 rm_work err sorry, if we do need to re-use the port?
16:34:44 rm_work it's the same bug, just unrelated to the placement-leakage issue
16:34:57 gibi_cape rm_work: how do you re-use the port when the compute is down?
16:34:59 rm_work (since you were asking about the specific nova bug)
16:35:07 rm_work move it to another compute
16:35:25 rm_work so the case would be if we are using one port as our main ingress (instead of AAP)
16:35:42 rm_work so if a compute host is powered off, we need to move that port over to another working VM
16:35:53 efried gibi_cape: Do we reclaim the allocations when a port is detached?
16:35:55 gibi_cape rm_work: if nova is not involved in this move then nova cannot make sure that the resource needs of the port also moved
16:35:56 rm_work but a detach will just fail to complete
16:36:14 gibi_cape efried: if the port is detached in nova then yes we delete the port allocation in placement
16:36:18 rm_work so we can't reattach the port to a different VM
16:36:26 efried rm_work: Right, it sounds like this scenario is not possible.
16:36:33 efried You can't detach it if you can't talk to the compute
16:36:38 efried did I understand correcctly?
16:36:46 rm_work ok, so that's not a solvable issue in nova?
16:37:24 rm_work what if that compute host never comes back up? in case of hardware failure, this is possible
16:37:28 rm_work is that port gone forever?
16:38:15 gibi_cape rm_work: if the compute never comes up then the resoruce leak in placement is not relevant as nobody else could you the leaked resource
16:38:17 mriedem zzzeek: sort of a random mysql uniqueness / primary key question for you when you have a sec
16:38:20 cfriesen new etherpad: https://etherpad.openstack.org/p/nova-ptg-train-2
16:38:27 rm_work right, not really talking about the placement-specific issue anymore
16:38:34 rm_work this is about the bug that was behind our reasoning

Earlier   Later