Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-08-13
21:34:07 sean-k-mooney so i get why she might link those
21:34:12 efried you wouldn't have wanted to get entrenched in that series only to realize it wasn't the one you cared about :P
21:34:18 melwitt because today they have to label all aggregates with something in order to have guests not land on certain aggregates and it's a pain
21:34:37 efried melwitt: you still kinda have to do that.
21:34:57 efried oh, you mean you even have to label the ones you're *not* isolating?
21:35:03 melwitt yes
21:35:05 sean-k-mooney unless you use my/rdolfos out of tree filter...
21:35:07 efried mm
21:35:22 sean-k-mooney well actuly that still neede you to put stuff in aggrate metaddata
21:35:36 melwitt because if something lacks a label, a guest can still land there. if I'm thinking about this right
21:35:45 melwitt lacks a key, I mean
21:36:40 melwitt and what they want is, guests can only land on this host if flavor key=value matches aggregate key=value and aggregates that do not have that key will not match
21:37:07 sean-k-mooney if you want to requrie traits to be request to land on a host. you need either https://github.com/openstack/nfv-filters/blob/master/nfv_filters/nova/scheduler/filters/aggregate_instance_type_filter.py or my reverse required tratis featrue i wand in plamcneet
21:37:19 mriedem melwitt: yes you are correct
21:37:48 melwitt yesss I was right once
21:37:49 mriedem with current in-tree filters you can restrict things to host aggregates but not exclude other unrestricted things from landing on those same hosts
21:38:02 mriedem which is why you have to create aggregates for everything to strictly isolate everything
21:38:06 mriedem which is the mgmt pain in the ass
21:38:16 melwitt yeah exactly
21:38:40 melwitt they've labeled everything like, windows=YES and windows=NO, for example, to get the strict isolation
21:39:10 mriedem https://docs.openstack.org/nova/latest/admin/configuration/schedulers.html#aggregatemultitenancyisolation has an example as well about the exclusion problem
21:39:12 sean-k-mooney yes but we fixed that and the sylvain fast revreted it
21:39:29 efried melwitt: the series is pretty close to landing, just a couple of little tweaks requested by dansmith, so if you want in, now's the time.
21:39:55 melwitt thanks for the pointers. I'll read through that so I can let them know where upstream is at with the feature
21:40:50 melwitt they asked for the feature but I know it's been in the works for a long time and wasn't sure what it was being called now :) thanks all
21:57:04 openstackgerrit Dustin Cowles proposed openstack/nova master: Provider config file schema and loader https://review.opendev.org/673341
21:57:04 openstackgerrit Dustin Cowles proposed openstack/nova master: WIP: Load custom providers to Resource Tracker https://review.opendev.org/676029
21:59:02 openstackgerrit Matt Riedemann proposed openstack/nova stable/queens: Hook resource_tracker to remove stale node information https://review.opendev.org/676282
22:03:12 melwitt oh, the ability to add a suffix to filter_tenant_id is only when filtering with placement
22:08:41 openstackgerrit Merged openstack/nova master: Fix misuse of nova.objects.base.obj_equal_prims https://review.opendev.org/676030
22:16:08 mriedem yup
22:17:09 mriedem https://bugs.launchpad.net/nova/+bug/1802111
22:17:09 openstack Launchpad bug 1802111 in OpenStack Compute (nova) rocky "Unable to assign more than 7 tenants to a filter_tenant_id string" [Low,Fix committed] - Assigned to Matt Riedemann (mriedem)
22:23:20 openstackgerrit Merged openstack/nova master: rt: only map compute node if we created it https://review.opendev.org/675704
22:23:38 openstackgerrit Merged openstack/nova master: Add CrossCellMigrationTask https://review.opendev.org/631581
22:27:52 openstackgerrit sean mooney proposed openstack/nova master: lxc: make use of filter python3 compatible https://review.opendev.org/676263
22:30:00 openstackgerrit Matt Riedemann proposed openstack/nova master: lxc: make use of filter python3 compatible https://review.opendev.org/676263
22:33:56 sean-k-mooney mriedem: i dont know why i even try somtimes. i actully spell checked that in grammerly then copied it and decied to tweak it slightly
22:34:42 sean-k-mooney i should never tweak a commit message out of a tool that fixes spelling because i obviously just cant
22:34:47 openstackgerrit Matt Riedemann proposed openstack/nova master: Add nova-lxc job to the experimental queue https://review.opendev.org/676024
22:34:59 sean-k-mooney thanks for fixing it directly :)
22:36:28 openstackgerrit Matt Riedemann proposed openstack/nova master: Add nova-lxc job to the experimental queue https://review.opendev.org/676024
22:37:24 mriedem you must have run it through the olde englishifier to change behavior to behaviour
22:38:38 sean-k-mooney actully i proably dont have it set to us english
22:38:59 mriedem oooo
22:39:02 mriedem don't tell trump that
22:39:22 sean-k-mooney sorry i belive its called american my bad :P
22:39:28 mriedem 'merican
22:39:29 mriedem please
22:39:34 mriedem pew pew yee hawww
22:41:33 openstackgerrit Matt Riedemann proposed openstack/nova stable/queens: rt: only map compute node if we created it https://review.opendev.org/676285
22:50:28 melwitt argh, I'm too dumb to understand placement_aggregate_required_for_tenants after reading the help
22:51:15 sean-k-mooney what is the help text?
22:51:18 melwitt ok, the reno helps
22:51:37 sean-k-mooney that praobly means we need better help test in the config option
22:51:54 melwitt "This setting, when limit_tenants_to_placement_aggregate=True, will control whether or not a tenant with no aggregate affinity will be allowed to schedule to any available node. If aggregates are used to limit some tenants but not all, then this should be False. If all tenants should be confined via aggregate, then this should be True to prevent them from receiving unrestricted scheduling to any available node."
22:52:23 mriedem there is a doc on it
22:52:43 melwitt I'm looking at it now
22:53:08 melwitt the conf option help was like.... not understandable by me
22:53:19 sean-k-mooney it could be worded clearer but tl;dr is if you want to require all tenants be mapped to placmenet aggrates then set it to true
22:53:24 sean-k-mooney otherwise set it to false
22:54:57 mriedem "Multiple tenants may be added to a single aggregate by appending a serial number to the key, such as filter_tenant_id:123." is lacking a big
22:54:58 mriedem *bit
22:55:00 sean-k-mooney melwitt: i would have to read that twice or tree times to parse it if had not seen it before
22:55:58 sean-k-mooney serial number is kind of cryptic
22:56:18 mriedem the doc is more clear IMO,
22:56:20 mriedem "Note that the filter_tenant_id metadata key can be optionally suffixed with any string for multiple tenants, such as filter_tenant_id3=$tenantid."
22:56:53 melwitt yeah, that makes sense to me. placement_aggregate_required_for_tenants is actually not mentioned in the doc though
22:57:02 sean-k-mooney oh that what they ment i though serial number was referint to the 123 e.g. a different name for the teanant id
22:57:10 melwitt heh
22:57:26 mriedem melwitt: yeah i noticed that too
22:58:32 melwitt I think the reason this isn't clear to me is because I know that strict isolation isn't possible, yet "placement_aggregate_required_for_tenants" makes it sound like it is
23:00:40 melwitt ok, looking at the code, I see that placement_aggregate_required_for_tenants means that it will warn and fail if no aggregate has a match for filter_tenant_id
23:01:31 melwitt does that mean strict tenant isolation *is* possible already? sounds like it
23:01:40 sean-k-mooney melwitt: i think you can build stict isolation with that if you manually map each tenant to a different aggretate
23:02:31 melwitt yeah... because if you turn this on, it will not let you land on filter_tenant_id-less hosts
23:02:34 sean-k-mooney then you can set the correct conf options to for the scheduler/plamcent to reject request that are not mapped to an aggregate
23:02:40 sean-k-mooney yep
23:03:08 sean-k-mooney but its just as much a pain in the ass as doing it with host aggrates and the old tenabt isolation filter
23:03:22 melwitt yeah, true
23:03:23 sean-k-mooney i proably performs better
23:03:49 openstackgerrit Dustin Cowles proposed openstack/nova master: WIP: Load custom providers to Resource Tracker https://review.opendev.org/676029
23:04:03 melwitt yeah ok, this isn't actually different, just the mechanism is different (better) and then you can get it to warn you if you didn't set the tenant keys on all your aggregates
23:05:14 sean-k-mooney yeah so its the waring/force fail behavior is slightly better but not a lot
23:06:30 mriedem the tenant to aggregate stuff was for cern i think, to model tenant-to-cell with azs / aggregates for a cell
23:06:35 mriedem since cern maps tenants to specific cells
23:08:07 mriedem and with that i'm out
23:08:55 melwitt yeah, I was thinking this was for CERN. the customer case I'm writing this up for is also dividing up the cluster per tenant
23:11:02 sean-k-mooney cern used to use the tenat isoaltion filter to do that tenat to cell mapping with cells v1 when they had two levels of scheduler
23:11:19 sean-k-mooney so ya this was a partity thing for them to be able to move to cells v2
23:15:41 melwitt ah, thanks
23:16:20 melwitt I knew the basics of that but a lot of these scheduler things confuse me, so here I am :P
23:20:13 sean-k-mooney ya cern is an edge case as they have so many host they needed to use the limit parmater on the placmenet api and and if they did that without the aggrate feature placmenet could return only host that did not map to the correct cell
23:20:38 sean-k-mooney and when it hit the tenat isolation filter it would eliminate all hosts
23:20:44 melwitt ah right
23:21:39 sean-k-mooney so now they use this pluse a limit of like 15 host or something similarly tiny
23:21:49 sean-k-mooney the default limit being 1000
23:47:02 melwitt sean-k-mooney: with forbidden aggregates, do you know off the top of your head what happens with aggregate-less hosts? will they still come back as eligible to be scheduled upon or no?
23:48:27 sean-k-mooney i belive the intent is the prefilter will append a forbidine aggreate requrest based on info in the the request spec to the placment query
23:48:56 sean-k-mooney so i guess they would be allowed

Earlier   Later