| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-09-04 | |||
| 16:12:34 | kashyap | aspiers: If so, the quickest way to disable it is to just start your guest with a non-enrolled (i.e. not signed by MS) "VARS" file. | |
| 16:12:40 | aspiers | kashyap: right, as per my comment on https://review.opendev.org/#/c/348394/ | |
| 16:13:00 | sean-k-mooney | we need to update osc to better support service deleteion | |
| 16:13:02 | aspiers | kashyap: in that final comment there is a list of all the "code" files | |
| 16:13:10 | aspiers | kashyap: which have corresponding "vars" files | |
| 16:13:15 | aspiers | kashyap: which one looks most promising? | |
| 16:13:23 | kashyap | Looking | |
| 16:13:33 | sean-k-mooney | osc only support the id not the service uuid | |
| 16:13:53 | aspiers | kashyap: currently I'm using ovmf-x86_64-suse-code.bin and ovmf-x86_64-suse-vars.bin | |
| 16:13:53 | mriedem | sean-k-mooney: that's not accurate | |
| 16:14:06 | mriedem | https://docs.openstack.org/python-openstackclient/latest/cli/command-objects/compute-service.html#compute-service-delete | |
| 16:14:06 | aspiers | kashyap: I have no idea what "4m" means | |
| 16:14:22 | kashyap | aspiers: I once did research on that SUSE naming, but totally forgot | |
| 16:14:37 | kashyap | aspiers: Hmm, so you _are_ using a non-MS signed one | |
| 16:14:38 | sean-k-mooney | well the help text in the version i have installed says it thakes the id and the uuid did not work | |
| 16:14:51 | mriedem | sean-k-mooney: you have to specify the microversion with osc | |
| 16:14:53 | mriedem | it defaults to 2.1 | |
| 16:15:07 | mriedem | so: openstack --os-compute-api-version 2.53 compute service delete <service uuid> | |
| 16:15:08 | sean-k-mooney | oh ya that is a thing | |
| 16:15:28 | kashyap | aspiers: Hint: that "4m" will be described in your RPM spec file; but that's not useful for your immediate prob | |
| 16:15:32 | sean-k-mooney | the help text does not methion that | |
| 16:15:42 | kashyap | aspiers: Try this one: ovmf-x86_64.bin (and the corresponding VARS file) | |
| 16:15:53 | mriedem | sean-k-mooney: b/c you have old osc | |
| 16:16:01 | mriedem | i added that recently | |
| 16:16:24 | sean-k-mooney | ah ok im using 3.19.0 | |
| 16:16:44 | sean-k-mooney | its not a big deal anyway | |
| 16:17:03 | aspiers | kashyap: OK but as per my comment on https://review.opendev.org/#/c/348394/ ovmf-x86_64-code.bin did not work, so not confident that ovmf-x86_64.bin will work either | |
| 16:17:20 | kashyap | aspiers: Reading that; I was relying on the file name suggested by Dirk correct :-( | |
| 16:17:47 | kashyap | aspiers: Also, I find it crazy that the SUSE RPM has _so_ many binaries; you need a simple combination: | |
| 16:18:28 | kashyap | aspiers: (a) a non-SB binary and a non-enrolled VARS file; (b) an SB-binary and an enrolled (MS-signed) VARS file | |
| 16:18:39 | aspiers | yeah I have no clue why it's like that | |
| 16:19:23 | kashyap | aspiers: Can you get a link to the RPM spec file, please? That will clarify what they are all. | |
| 16:20:37 | kashyap | aspiers: Incidentally, the "light at the end of the tunnel" is it's going to be much easier, once SUSE ships: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932269 | |
| 16:20:39 | openstack | Debian bug 932269 in ovmf "Ship the firmware "descriptor files" as part of the 'ovmf' package" [Normal,Fixed] | |
| 16:21:04 | kashyap | (Debian and Ubuntu now do. As does Fedora, for a while) | |
| 16:21:58 | sean-k-mooney | hum so i still get the same error after deleting the compute service | |
| 16:23:35 | aspiers | kashyap: https://build.opensuse.org/package/view_file/Virtualization/ovmf/ovmf.spec?expand=1 | |
| 16:23:44 | dansmith | sean-k-mooney: you have to stop them all, delete them all, then start up the old one first | |
| 16:24:17 | sean-k-mooney | oh i have stop and delete the compute service on the "new" node too | |
| 16:24:25 | sean-k-mooney | not just the one im puting ot master | |
| 16:24:27 | sean-k-mooney | ok | |
| 16:24:40 | donnyd | mriedem: is there a way to craft custom requests via the sdk? | |
| 16:25:03 | sean-k-mooney | donnyd: if you mean raw http requests yes | |
| 16:25:07 | aspiers | kashyap: do you really think the exception message should refer to "Q35" when the way to fix the exception is to set hw_machine_type=q35 (lowercase) ? | |
| 16:26:04 | sean-k-mooney | donnyd: you can use the sdk to jsut get a rest client and then perform raw GET|POST|PUT|DELETE|... request with the client with whatever body you want | |
| 16:26:31 | donnyd | So is it possible to craft a raw request that would allow me to ask placement for a node that meets X trait and then tell nova to provision that resource | |
| 16:26:35 | kashyap | aspiers: Thanks for the link; that "4m" corresponds to a 4MB flash image. | |
| 16:26:42 | aspiers | ah interesting | |
| 16:26:58 | kashyap | aspiers: On the exception, ah, lowercase is indeed fine. (Sorry) | |
| 16:27:04 | aspiers | kashyap: np, thanks | |
| 16:27:06 | sean-k-mooney | the first half yes the scond no not direcltly | |
| 16:27:38 | sean-k-mooney | if you want nova to schduler a vm to a host with a give trait you can add it as a required trait in etiher the flavor or image | |
| 16:27:47 | sean-k-mooney | and then nova will include it in the request to placment | |
| 16:28:12 | sean-k-mooney | you cant however ask placmenet for an allocation caniate for a vm and tell nova to use it | |
| 16:28:26 | donnyd | sean-k-mooney: maybe a little more context would help, this is for baremetal | |
| 16:28:48 | openstackgerrit | Adam Spiers proposed openstack/nova master: Ensure q35 machine type is used when booting with SEV https://review.opendev.org/680065 | |
| 16:28:51 | kashyap | aspiers: Also, can you please confirm from the SUSE OVMF pkg maintainer -- *which* of your biaries are built with SECURE_BOOT_ENABLE flag? | |
| 16:28:58 | sean-k-mooney | you are trying to land a nova instance on a specific ironic host? | |
| 16:29:05 | kashyap | aspiers: Need to dial into a call; back later. | |
| 16:29:06 | donnyd | yes | |
| 16:29:32 | donnyd | without having to create custom flavors... because it would result in a large # of flavors to manage and maintain | |
| 16:30:03 | sean-k-mooney | do you want to be able to do it or do you want non admins to be able to do it | |
| 16:30:29 | donnyd | CI jobs, so non admin | |
| 16:31:27 | donnyd | Maybe have to create some custom policy or something like that | |
| 16:31:30 | sean-k-mooney | am do you need to jsut deferenciate between ironic nodes and vms or do you need to select a specific host | |
| 16:32:08 | donnyd | I need to be able to tell nova to select a specific metal host ( no vm's yet) | |
| 16:32:47 | sean-k-mooney | ok the hacky way to do that is to abuse the availablty zone. but there are other ways | |
| 16:34:23 | openstackgerrit | Adam Spiers proposed openstack/nova master: Ensure q35 machine type is used when booting with SEV https://review.opendev.org/680065 | |
| 16:34:52 | donnyd | so like nova boot --availability-zone ZONE:HOST:NODE | |
| 16:35:01 | sean-k-mooney | yes | |
| 16:35:05 | donnyd | efried: shared that with me a while back | |
| 16:35:14 | sean-k-mooney | im not sure if nodepool supports that | |
| 16:35:18 | sean-k-mooney | i think it might | |
| 16:35:40 | openstackgerrit | Adam Spiers proposed openstack/nova master: Apply SEV-specific guest config when SEV is required https://review.opendev.org/644565 | |
| 16:35:46 | sean-k-mooney | the other way to do it would be a schduler hint | |
| 16:36:00 | openstackgerrit | Adam Spiers proposed openstack/nova master: Enable booting of libvirt guests with AMD SEV memory encryption https://review.opendev.org/666616 | |
| 16:36:15 | sean-k-mooney | i think you could use the json filter to do this | |
| 16:36:22 | donnyd | how do you do it with the scheduler hint? | |
| 16:37:17 | sean-k-mooney | so the hoststate object contains the hostname uuid and nodename | |
| 16:37:19 | sean-k-mooney | https://github.com/openstack/nova/blob/master/nova/scheduler/host_manager.py#L109-L111 | |
| 16:37:34 | sean-k-mooney | the json filter can match on any field in the host state object | |
| 16:38:52 | donnyd | ok cool. Thanks for entertaining my questions :) | |
| 16:39:14 | aspiers | stephenfin, efried: is check_can_live_migrate_destination() the right place to prevent live migration in the SEV case? | |
| 16:40:30 | sean-k-mooney | i think you do openstack server create --hint query="$host==ironic_host_name" | |
| 16:41:13 | sean-k-mooney | again im not sure if the openstack nodepool driver suppots that. or not | |
| 16:41:56 | sean-k-mooney | donnyd: the json filter is also off by defualt as normally we dont want people to be able to pick specific hosts | |
| 16:42:10 | sean-k-mooney | but both the availablity zone and json filters can technically do it | |
| 16:42:25 | aspiers | efried, kashyap: nits with q35 check addressed | |
| 16:42:50 | donnyd | With the json filter, will it fail if it cannot find the specific host? | |
| 16:42:59 | sean-k-mooney | yes | |
| 16:43:14 | donnyd | ok, I think both of those two options will work for this case | |
| 16:43:20 | donnyd | much appreciated sean-k-mooney | |
| 16:44:04 | sean-k-mooney | donnyd: the json filter basicaly allows you to match on anything in this object https://github.com/openstack/nova/blob/master/nova/scheduler/host_manager.py#L109-L159 so you can be very specific | |
| 16:46:49 | sean-k-mooney | donnyd: you might be able to use https://zuul-ci.org/docs/nodepool/configuration.html#attr-providers.[openstack].pools.labels.instance-properties | |
| 16:46:56 | sean-k-mooney | but you defintely can use https://zuul-ci.org/docs/nodepool/configuration.html#attr-providers.[openstack].pools.availability-zones | |
| 16:47:23 | sean-k-mooney | well i have never tired it | |
| 16:52:54 | mriedem | ewww jsonfilter | |
| 16:53:13 | mriedem | i'm not sure how that helps with linking hosts with a given trait | |
| 16:53:40 | sean-k-mooney | mriedem: it does not. donnyd wanted a way per vm to selct a given host | |
| 16:53:43 | mriedem | donnyd: you can use the placement CLI to filter providers with required traits as well https://docs.openstack.org/osc-placement/latest/cli/index.html#resource-provider-list | |