| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-09-15 | |||
| 15:53:24 | sean-k-mooney | all the tooling around upgrades and operation will diverge | |
| 15:53:34 | MarkMielke | yeah, the orchestration around how runc launches will be different | |
| 15:53:42 | MarkMielke | but fundamentally, it'll be the same technology doing the same thing underneath | |
| 15:54:24 | MarkMielke | two groups vehemently disagreeing | |
| 15:54:28 | MarkMielke | but fundamentally agreeing :-) | |
| 15:55:21 | MarkMielke | you can see how I am jaded :-) | |
| 15:56:15 | MarkMielke | i haven't used podman yet much - but the idea that it supports Kubernetes pods, | |
| 15:56:22 | MarkMielke | is interesting | |
| 15:56:34 | sean-k-mooney | well it does and it does not | |
| 15:56:54 | sean-k-mooney | it suport the cncf cri | |
| 15:57:23 | sean-k-mooney | it also provides cli compatiablity with docker | |
| 15:58:02 | sean-k-mooney | so you can use it to interact/manage pods but on its own it would do any of the orchstartion fo the pods that k8s does | |
| 15:58:12 | MarkMielke | probably with some limitations, it still means that something designer for Kubernetes | |
| 15:58:18 | MarkMielke | can almost work in stand-alone capacity | |
| 15:58:26 | sean-k-mooney | for example without the newst version it wont start the contaner after a host reboot | |
| 15:58:44 | MarkMielke | systemd :-) | |
| 15:58:50 | sean-k-mooney | the newest version will creat systemd files for you to implement docker restart policies | |
| 15:58:58 | sean-k-mooney | before that you had to do it by hand | |
| 15:59:07 | MarkMielke | as you mentioned earlier - | |
| 15:59:17 | MarkMielke | i like the systemd model of managing containers | |
| 15:59:22 | MarkMielke | vs the brainless auto-restart | |
| 15:59:35 | sean-k-mooney | where as the k8s kubelet would have done that via the podsepc | |
| 15:59:40 | MarkMielke | dependency management, as well as notification of when an application is up and healthy | |
| 16:00:03 | sean-k-mooney | so its more a tool for defineing pods on a local system without any of the orchetration | |
| 16:00:28 | MarkMielke | primarily for development stand-alone vs running in a production cluster with overhead | |
| 16:00:34 | MarkMielke | right? | |
| 16:00:52 | sean-k-mooney | kind of but it can be used as a building block for you orchelstartion | |
| 16:01:02 | sean-k-mooney | it does support heatbeat continer for examle | |
| 16:01:12 | sean-k-mooney | but no direct graphs fo dependce | |
| 16:01:25 | sean-k-mooney | that said systemd supports that so who know what will happnen | |
| 16:01:35 | MarkMielke | that's what i would mostly use systemd for | |
| 16:01:57 | sean-k-mooney | ya you are just missing the syntax in podman to express the depences | |
| 16:02:12 | sean-k-mooney | then rely on the before/after freatuers in systemd or targets | |
| 16:02:18 | sean-k-mooney | to tie it all toghter | |
| 16:02:29 | MarkMielke | today we cheat a bit... /etc/systemd/system/docker.conf.d/ lists dependencies, but they all dependencies for all contianers | |
| 16:02:47 | MarkMielke | so delay docker start until pre-requisites are met | |
| 16:02:59 | MarkMielke | it's not great for inter-container dependencies | |
| 16:04:05 | MarkMielke | i.e. PostgreSQL should be up before Jira | |
| 16:04:12 | MarkMielke | we mostly rely on PostgreSQL coming up really really fast :-) | |
| 16:04:31 | MarkMielke | and Jira, in Java, coming up slow | |
| 16:04:47 | sean-k-mooney | what i wanted to fix in kolla is that the ovsdb shoudl be up before the ovs-vswtichd starts | |
| 16:05:08 | MarkMielke | do you containerize those too? or you just mean in general | |
| 16:05:33 | sean-k-mooney | no ovs is containerised | |
| 16:05:53 | sean-k-mooney | it runs with net=host | |
| 16:05:57 | MarkMielke | interesting - I guess it's fine since the data plane is in kernel | |
| 16:06:06 | sean-k-mooney | not always | |
| 16:06:14 | sean-k-mooney | that is what i was trying to fix | |
| 16:06:29 | sean-k-mooney | if you are using ovs-dpdk where the dataplane is in userspace | |
| 16:06:34 | sean-k-mooney | the ovsdb need to be started first | |
| 16:06:36 | MarkMielke | ah | |
| 16:06:50 | sean-k-mooney | so that the vswtihcd can detect that dpdk is enabled when it starts up | |
| 16:07:31 | MarkMielke | ovs-dpdk... that's an interesting one for a related subject... | |
| 16:07:56 | MarkMielke | it's presumedly faster than kernel, but I also discovered that the Red Hat builds of Docker use seccomp | |
| 16:08:05 | MarkMielke | and seccomp normally triggers some of the more expensive Spectre mitigations | |
| 16:08:21 | MarkMielke | i think i have that right | |
| 16:08:27 | MarkMielke | do you disable that? | |
| 16:09:58 | sean-k-mooney | by default redhat does not tend to disabel security feature | |
| 16:10:10 | sean-k-mooney | im not sure it would impact dpdk performace it might | |
| 16:10:17 | sean-k-mooney | when we mesure something like that as an imparct | |
| 16:10:34 | sean-k-mooney | we usually docmet how to disable it and let it up to the custoemr | |
| 16:10:39 | MarkMielke | it disables indirect branch spectulation for the threads :-( | |
| 16:11:07 | MarkMielke | i started changing them to prctl instead of seccomp | |
| 16:11:15 | sean-k-mooney | if there threat profile allwos it then there is no reas for them to not do it but they need to make that threat assement themselves | |
| 16:11:20 | MarkMielke | but then I found that Red Hat build of OpenJDK also uses prctl :-) | |
| 16:11:59 | MarkMielke | so now we often disable it entirely (shocker!) | |
| 16:12:00 | MarkMielke | hehe | |
| 16:13:07 | sean-k-mooney | my dev machines uses to have almost all the mitgation disabled at one point | |
| 16:13:45 | MarkMielke | i settled on a config which ends up being similar to RHEL 7.7 ended up setting by default | |
| 16:13:52 | MarkMielke | spectre_v2=retpoline | |
| 16:13:54 | sean-k-mooney | it got kind fo annoying to have to keep updating my grub config | |
| 16:15:24 | MarkMielke | ok - well i should get a few other things done. Thanks for the chat. I think I'll open that bug with regard to oslo_utils unit tests being left in nova. | |
| 16:15:42 | sean-k-mooney | o/ | |
| 16:15:58 | MarkMielke | and if it's easy to add test i'll add to oslo_utils, but if too hard, i may add another test or two for nova as separate submission | |
| 16:17:02 | sean-k-mooney | ralonsoh: its a sunday what are you doing on irc | |
| 16:17:15 | ralonsoh | hahahaah and you?? | |
| 16:17:23 | ralonsoh | sean-k-mooney, I'm trying to fix an small problem | |
| 16:17:30 | MarkMielke | it's always a small problem | |
| 16:17:38 | sean-k-mooney | im playing eve online and have it open on another monitor | |
| 16:17:43 | ralonsoh | hahahahhaah | |
| 16:17:51 | MarkMielke | then before you know it | |
| 16:17:58 | MarkMielke | your whole weekend is gone on that small problem :-) | |
| 16:18:18 | ralonsoh | no no, it's going to be just a simple commit | |
| 16:18:23 | MarkMielke | so was mine | |
| 16:18:24 | MarkMielke | haha | |
| 16:18:26 | MarkMielke | two characters | |
| 16:18:37 | sean-k-mooney | ralonsoh: im also watching the gate to make sure everythin merges | |
| 17:49:45 | MarkMielke | Correction for above conversation... oslo_utils does have tests for units. I missed them because I was looking for qemu-info info sample output and "virtual size". This does exist in Nova. However, there is unit tests for parsing the value portion of the qemu-img info output in oslo_utils, and I can easily add tests here for QEMU 4.1. | |
| 20:13:55 | openstackgerrit | Merged openstack/nova master: Claim resources in resource tracker https://review.opendev.org/678452 | |
| 21:22:51 | openstackgerrit | Merged openstack/nova master: libvirt: Enable driver discovering PMEM namespaces https://review.opendev.org/678453 | |
| 21:36:47 | openstackgerrit | Merged openstack/nova master: libvirt: report VPMEM resources by provider tree https://review.opendev.org/678454 | |
| 21:36:55 | openstackgerrit | Merged openstack/nova master: libvirt: Support VM creation with vpmems and vpmems cleanup https://review.opendev.org/678455 | |
| #openstack-nova - 2019-09-16 | |||
| 02:17:53 | openstackgerrit | Merged openstack/nova master: Deprecate CONF.workarounds.enable_numa_live_migration https://review.opendev.org/640021 | |
| 03:06:45 | openstackgerrit | ya.wang proposed openstack/nova master: Fix typor of cpu model when check CPU compatibility https://review.opendev.org/682267 | |
| 03:25:06 | openstackgerrit | Luyao Zhong proposed openstack/nova master: objects: use all_things_equal from objects.base https://review.opendev.org/681397 | |
| 03:56:05 | openstackgerrit | Boxiang Zhu proposed openstack/nova master: Make evacuation respects anti-affinity rule https://review.opendev.org/649963 | |
| 05:46:44 | nnsingh | HI all, i have one doubt, why this file name is .yaml.txt "https://github.com/openstack/placement/blob/master/etc/placement/README-policy.yaml.txt"? what the reason behind this. | |
| 05:56:32 | openstackgerrit | garyk proposed openstack/nova master: Deconstruct the mother of all locks https://review.opendev.org/682242 | |
| 05:59:44 | openstackgerrit | Boxiang Zhu proposed openstack/nova master: Fix live migration break group policy simultaneously https://review.opendev.org/651969 | |
| 07:27:50 | openstackgerrit | Bhagyashri Shewale proposed openstack/nova master: Ignore root_gb for BFV in simple tenant usage API https://review.opendev.org/612626 | |
| 09:12:13 | openstackgerrit | Brin Zhang proposed openstack/nova-specs master: Allow specify user to reset password https://review.opendev.org/682302 | |