| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2019-10-18 | |||
| 19:04:05 | efried | Are game companies still as crazy as they were in the 90s? That's the last time I paid attention. | |
| 19:05:05 | efried | people living in their office for a month at a time, kind of thing | |
| 19:06:17 | mordred | I live in my office for a month at a time | |
| 19:09:21 | efried | aaand you're crazy, what's your point? | |
| 19:09:51 | efried | oh, that things other than game companies can be crazy, got it. | |
| 19:18:05 | openstackgerrit | Eric Fried proposed openstack/nova master: ItemsMatcher: mock call list arg in any order https://review.opendev.org/689487 | |
| 19:18:06 | openstackgerrit | Eric Fried proposed openstack/nova master: Always trait the compute node RP with COMPUTE_NODE https://review.opendev.org/688979 | |
| 19:23:52 | mordred | efried: yeah. I mostly meant, you know - like, my house, which is also my office | |
| 19:24:04 | mordred | efried: I'm maybe not as funny or cleve as I sometimes think | |
| 19:24:18 | efried | Oh, you are, but probably not for the *reasons* you think. | |
| 19:25:40 | efried | See, my funniness is inversely proportional to how much I'm trying. There's no surprise funny from me. | |
| 20:50:42 | eandersson | efried, yea unfortunately still all about that office | |
| 20:53:34 | eandersson | https://careers.blizzard.com/en-us/openings/o6vmbfwS (Austin) https://careers.blizzard.com/en-us/openings/ohdYafwm (Irvine) | |
| 21:38:07 | mriedem | gmann: remember how we thought host_status would be returned for GET /servers/detail with servers from down cells? i found that won't happen | |
| 21:38:35 | mriedem | because of this filtering https://github.com/openstack/nova/blob/master/nova/api/openstack/compute/views/servers.py#L590 | |
| 21:39:08 | mriedem | efried: sorry about the late reply, i've been not around so much today - i took your comments and threw them into my patch so i can process them on monday | |
| 21:39:23 | efried | saw dat, get some rest and feel better. | |
| 21:53:57 | efried | (How) does nova (via oslo.config?) vet permissions of nova.conf? | |
| 21:54:17 | efried | or is that completely the responsibility of the admin? | |
| 22:00:13 | sean-k-mooney | efried: i think its up to the admin/installer | |
| 22:01:06 | sean-k-mooney | e.g. we dont check that the config is 600 or 660 as far as i am aware | |
| 22:01:22 | efried | so if /etc/nova and contents were 5777 and owned by $random we would truck happily along? | |
| 22:01:31 | mriedem | gmann: melwitt: a couple of questions in the host_status_unknown patch - mostly for gmann about policy rule naming and the docs on the policy rule since 2.75+ https://review.opendev.org/#/c/679181/ | |
| 22:01:48 | sean-k-mooney | efried: i think so | |
| 22:02:09 | efried | o...kay. | |
| 22:02:24 | sean-k-mooney | nova does not create the file and we never write to it | |
| 22:02:45 | mriedem | efried: likely a question for bnemec | |
| 22:02:48 | sean-k-mooney | so its really up to the install to make sure that files with password in them are not world readable | |
| 22:03:29 | mriedem | i thought there was some talk of some how vaultifying that stuff but i might be dreaming that up | |
| 22:03:30 | efried | sean-k-mooney: well, that and if they're writable in any way a malicious user could make nova do horrible things to the system | |
| 22:03:44 | efried | mriedem: I think sdk does something like that. | |
| 22:03:49 | efried | or at least supports it. | |
| 22:03:57 | efried | for clouds.yaml | |
| 22:04:02 | efried | mordred: ^ | |
| 22:04:11 | efried | not that that's relevant here | |
| 22:04:39 | efried | I'll ML this sucker. | |
| 22:04:40 | sean-k-mooney | efried: i mean programs like ssh refuse to work if you dont set the right permisions in your ssh .config or key | |
| 22:04:45 | sean-k-mooney | so its not unresonable | |
| 22:04:59 | mordred | aroo? | |
| 22:05:03 | efried | right, swhat I'm sayin, it wouldn't be unreasonable for oslo and/or nova to enforce something like that. | |
| 22:05:27 | efried | but that doesn't mean we do | |
| 22:05:30 | mordred | oh - yeah - so - sdk supports clouds.yaml being split into clouds.yaml and secure.yaml | |
| 22:05:54 | mordred | we do not enforce that secure.yaml is actually secure - although I agree, it would be a reasonably sane thing to do | |
| 22:06:32 | efried | mordred: before I blast the ML, do you know off the top whether oslo.config does any such validation either? | |
| 22:06:35 | mriedem | https://specs.openstack.org/openstack/oslo-specs/specs/stein/secret-management-store.html ? | |
| 22:07:34 | sean-k-mooney | it looks like kolla atleast makes it 660 https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/nova/tasks/config.yml#L57 | |
| 22:07:49 | mordred | efried: I do not know anything about oslo.config | |
| 22:07:57 | sean-k-mooney | they will be own by the kolla:kolla user and group by default | |
| 22:08:04 | sean-k-mooney | well on the host | |
| 22:08:11 | sean-k-mooney | they will be own by nova in the containers | |
| 22:08:15 | mriedem | efried: that spec looks pretty close but i don't see any code ever showed up for it | |
| 22:09:15 | efried | even if it was coded per the spec, though, it would only mean that you *could* secure your configs; it'd still be n/a for anyone using nova.conf | |
| 22:09:16 | sean-k-mooney | mriedem: i do think your recalection is right we did talk about vaultifing this at some point | |
| 22:10:03 | sean-k-mooney | im not sure it was that oslo spec specificaly but seam likely that was related | |
| 22:13:17 | mriedem | anywho, i'm going to drop now, have a good weekend o/ | |
| 22:13:22 | efried | o/ | |
| 22:13:31 | efried | drink lots of fluids. Suck on zinc. | |
| 22:13:46 | sean-k-mooney | o/ | |
| 22:14:05 | sean-k-mooney | efried: looks like kolla locks it down to 600 in the containers https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/nova-cell/templates/nova-compute.json.j2#L8 | |
| 22:14:38 | efried | gtk | |
| 22:15:05 | sean-k-mooney | yep it means that at least implcitly there is nothing that requires the group to be able to read nova.conf | |
| 22:15:38 | sean-k-mooney | that makes sense however nothing out side of nova should read nova's config | |
| 22:17:33 | sean-k-mooney | mordred: by the way is there any reason not to use the cloud.yml vs the old rc files | |
| 22:17:58 | sean-k-mooney | i assume no but just said i woudl ask | |
| 22:18:00 | efried | you mean in nova? | |
| 22:18:01 | mordred | sean-k-mooney: you should never use old rc files they are evil and horrible | |
| 22:18:02 | efried | or in sdk? | |
| 22:18:13 | efried | oh, I don't know what an "old rc file" is, /me stfu | |
| 22:18:19 | sean-k-mooney | i mean when im runing the openstack cli | |
| 22:18:32 | mordred | efried: the files with env vars set in them | |
| 22:18:40 | sean-k-mooney | ya those | |
| 22:18:48 | sean-k-mooney | the openrc file that devstack has | |
| 22:18:55 | mordred | sean-k-mooney: yeah - definitely not - clouds.yaml is much betterer than env var files | |
| 22:19:07 | mordred | the only reason to keep those openrc files around are the legacy cli clients | |
| 22:19:30 | sean-k-mooney | right which im trying not to use anymore | |
| 22:19:52 | sean-k-mooney | we should file a bug with horizon to not default to the RC files | |
| 22:20:13 | mordred | ++ | |
| 22:20:17 | sean-k-mooney | you can download the cloud.yaml too but its not the default | |
| 22:21:01 | mordred | sean-k-mooney: I've also been meaning to write something like "openstack login" or similar that would let you slurp in a clouds.yaml you downloaded and maybe prompt you for your password and write it to secure.yaml or something like that | |
| 22:21:06 | mordred | but - you know - ENOTIME | |
| 22:21:38 | sean-k-mooney | i totaly dont just edit to add my password... | |
| 22:21:47 | sean-k-mooney | you know what i would love | |
| 22:21:56 | sean-k-mooney | a way to use keystoen with an ssh key | |
| 22:22:54 | sean-k-mooney | just let me upload my public key as an alternitive to a password then never ask me again. | |
| 22:23:47 | mordred | sean-k-mooney: ++ | |
| 22:24:11 | mordred | sean-k-mooney: I truly do not understand why this is not an actual option | |
| 22:24:23 | sean-k-mooney | time | |
| 22:24:42 | sean-k-mooney | also i dont think we ever asked the keystone folks | |
| 22:25:38 | mordred | I guess that's our fault | |
| 22:26:55 | sean-k-mooney | that would also be a way to secure the secure.yml i guess | |
| 22:27:56 | sean-k-mooney | anyway i shoudl actully finish up. enjoy the weekend o/ | |
| 22:29:35 | mordred | you too! | |
| 23:01:14 | efried | I'm outta here as well o/ | |
| #openstack-nova - 2019-10-19 | |||
| 01:18:11 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: YAML file loading and schema validation https://review.opendev.org/673341 | |
| 01:18:11 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: Function to further validate and retrieve configs https://review.opendev.org/676029 | |
| 01:18:12 | openstackgerrit | Dustin Cowles proposed openstack/nova master: Provider Config File: Merge provider configs to provider tree https://review.opendev.org/676522 | |
| 03:00:16 | openstackgerrit | wangfaxin proposed openstack/nova master: Fix review link. https://review.opendev.org/689612 | |
| 11:44:34 | openstackgerrit | Matthew Booth proposed openstack/nova master: Functional test for UnexpectedDeletingTaskStateError https://review.opendev.org/689278 | |
| 11:44:35 | openstackgerrit | Matthew Booth proposed openstack/nova master: Fix incorrect vm and task state after build failure race https://review.opendev.org/689388 | |
| 11:44:35 | openstackgerrit | Matthew Booth proposed openstack/nova master: Unplug VIFs as part of cleanup of networks https://review.opendev.org/663382 | |