Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-10-29
14:31:01 sean-k-mooney efried: dansmith as a compromise assuming moveing to the sdk in ocs contindues wehn the major version bump fo that happens we could drop nova-net support as part of that
14:31:49 dansmith efried: fwiw just the other day I was talking to someone running a very large production mitaka cloud, working to deploy train for their next phase.. it would suck super bad to not have a client be able to talk to both of them
14:31:50 efried for now I don't actually care "when" or even "if"; all I needed to know was "not now".
14:31:59 efried dansmith: ack
14:33:26 efried btw, for what I'm working on now, it's not a question of dropping actual support for nova-net. It's just a question of whether docs.o.o/osc/ussuri{and later}/ will contain the options for nova-net.
14:33:51 efried but the answer is the same.
14:34:01 dansmith well, if it's in the client and not documented (even if not generated) that also kinda sucks, but less so, I'll agree
14:35:43 efried dansmith: the CLI helps only produce the content for one or the other, by detecting whether the 'network' (neutron) endpoint exists.
14:35:56 dansmith ...right
14:36:03 efried but of course we're not in your cloud when we're generating docs
14:36:07 dansmith sure
14:36:26 efried thanks for the talk, all. The path forward is clear, if messy.
14:40:30 dansmith mriedem: are you looking for me to pass all the notification payload things in via init, or only the two things you noted in the review?
14:44:23 openstackgerrit Matt Riedemann proposed openstack/nova master: Remove dead set_admin_password code to generate password https://review.opendev.org/691873
14:51:11 mriedem dansmith: just the few things noted
14:51:17 mriedem the image lists are generated after the fact
14:51:52 dansmith mriedem: okay I'm not sure I see the distinction, but that's fine
14:53:25 mriedem it was a nit, ignore if you want
14:54:28 dansmith it's already done, I just wanted to know the convention for next time, but if it's just "feels right" then that's fine too
15:03:18 mriedem like the spanx i'm wearing right now, it just feels right
15:04:08 openstackgerrit Matt Riedemann proposed openstack/nova master: Remove dead set_admin_password code to generate password https://review.opendev.org/691873
15:04:09 openstackgerrit Matt Riedemann proposed openstack/nova master: Fix changePassword adminPass="" broken schema validation https://review.opendev.org/691880
15:06:30 openstackgerrit Matt Riedemann proposed openstack/nova master: Fix changePassword adminPass="" broken schema validation https://review.opendev.org/691880
15:09:33 mriedem oh god how many duplicates do we have of this bug https://bugs.launchpad.net/nova/+bug/1850153
15:09:33 openstack Launchpad bug 1850153 in OpenStack Compute (nova) "nova resize operation doesn't support disk resize for emphemeral disk and swap disk" [Undecided,New]
15:09:36 efried mriedem: so passing in an empty password does *not* generate?
15:09:42 mriedem efried: nope
15:09:47 mriedem and you can't pass adminPass=None
15:09:50 efried passing in null theoretically would have, but that gets kicked by schema... yeah.
15:10:15 efried adminPass="" will actually set the password to the empty string.
15:10:21 sean-k-mooney yep
15:10:37 sean-k-mooney peopel try to cheat schema validation on the neutron side setting ""
15:10:42 mriedem which is probably a security vulnerability
15:10:59 sean-k-mooney to pass null and end up setting it to the litral empty sting
15:11:17 mriedem as noted in the commit, the changePassword API originally did not allow ""
15:11:25 mriedem it was regressed when jsonschema was applied
15:11:44 mriedem it wasn't caught because there was no test for empty string
15:11:51 sean-k-mooney i suppose it would not be that hard to validate the lenght of the sting
15:13:24 efried isn't there something where setting empty password causes it to prompt you to set a real password the next time you log in?
15:13:32 efried maybe I'm remembering some old shell hack from 20y ago.
15:14:54 sean-k-mooney ya so we should proably update https://github.com/openstack/nova/blob/master/nova/api/validation/parameter_types.py#L364-L371
15:15:42 mriedem sean-k-mooney: do you see the patch i proposed that just scrolled above?
15:15:45 sean-k-mooney e.g. add 'minLenght':1
15:15:56 sean-k-mooney mriedem: nope
15:16:02 efried mriedem: sorry, where in https://review.opendev.org/#/c/35625/ is a nonempty password enforced?
15:16:04 sean-k-mooney i assume it does that or something similar
15:16:24 sean-k-mooney https://review.opendev.org/#/c/691880/
15:16:25 mriedem efried: https://review.opendev.org/#/c/35625/10/nova/api/openstack/compute/plugins/v3/admin_password.py@61
15:16:45 mriedem efried: oh well i guess that would be True
15:16:48 mriedem "" is a basestring
15:16:49 efried mriedem: that enforces ... yeah
15:17:13 efried so empty string has always been allowed
15:18:42 openstackgerrit Dan Smith proposed openstack/nova master: Log some stats for image pre-cache https://review.opendev.org/688173
15:18:43 openstackgerrit Dan Smith proposed openstack/nova master: Add Aggregate image caching progress notifications https://review.opendev.org/691390
15:18:43 sean-k-mooney the admin password requires the qemu guest agent to work too right.
15:19:05 sean-k-mooney e.g. by defualt it wont work unless you enable it and install it in your guest image at least for libvirt
15:19:16 efried Which is kinda okay imo, I'm not convinced it's always wrong to use "".
15:19:47 mriedem looks like that was originally this https://github.com/openstack/nova/blob/icehouse-eol/nova/api/openstack/compute/servers.py#L1490
15:19:48 dansmith gibi: mriedem: are either of you aware of any example notification-consuming code out there? thinking I might write up an example tool that caches images and watches for completion via notifications
15:19:51 sean-k-mooney efried: well at least on the linux side it can be locked down via ssh/pam setting in the guest
15:20:00 mriedem and this is where the generate password stuff happened https://github.com/openstack/nova/blob/icehouse-eol/nova/api/openstack/compute/servers.py#L1484
15:20:15 gibi dansmith: no I don't know about such tool
15:20:23 mriedem so the regression was actually that you could specify adminPass=None and it would generate a password for you, which is probably how that got down into the compute manager code
15:20:56 dansmith gibi: bummer, okay
15:21:02 mriedem gibi: your versioned notifications talk had a project on github you wip'ed up for consuming notifications didn't you?
15:21:03 mriedem in devstack
15:21:13 gibi mriedem: yeah that was an example tool
15:21:19 gibi mriedem: nothing production ready
15:21:29 dansmith gibi: not looking for production, looking for example :)
15:21:43 gibi https://github.com/gibizer/nova-notification-demo
15:21:51 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Pass RequestContext to oslo_policy https://review.opendev.org/674038
15:22:04 gibi dansmith: sorry I skipped the 'example' word in your question
15:22:12 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing admin_actions policies https://review.opendev.org/657698
15:22:29 dansmith gibi: thanks, I'll see if I can steal enough out of that to get something working
15:23:06 gibi dansmith: I'm happy to help
15:23:41 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Add test coverage of existing os-services policies https://review.opendev.org/669181
15:24:59 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Introduce scope_types in os-services https://review.opendev.org/645427
15:42:17 mriedem is anyone against just putting something in the API reference about https://bugs.launchpad.net/nova/+bug/1558880 being a known limitation? there are at least 3 known duplicates of that bug now and i don't see it being fixed anytime soon.
15:42:17 openstack Launchpad bug 1558880 in OpenStack Compute (nova) "instance can not resize ephemeral from mitaka to stein and master" [Medium,Confirmed]
15:54:35 gibi mriedem: I agree to document it as a known limitation
16:02:32 openstackgerrit Balazs Gibizer proposed openstack/nova master: Use admin neutron client to gather port resource requests https://review.opendev.org/691005
16:04:15 openstackgerrit Balazs Gibizer proposed openstack/nova master: Use admin neutron client to see if instance has qos ports https://review.opendev.org/691900
16:08:18 efried mriedem: This looks weird https://docs.openstack.org/api-ref/compute/?expanded=list-hypervisors-detail#list-hypervisors
16:08:50 mriedem caller, can you be more specific?
16:08:53 efried 'marker' is listed twice, once as integer, once as string. In the former it says it's available until 2.52 and also new in 2.53
16:09:21 mriedem it's because marker and id changed from an int id to a uuid in 2.53
16:09:24 mriedem for multi-cell listing
16:09:38 efried oh, sorry, I misread 2.33 as 2.53.
16:09:40 mriedem iow, the int id is not unique across cells
16:09:40 efried This looks fine.
16:10:28 efried mriedem: but while I have your attention... adding support for new qparams into SDK, who's responsible for that?
16:10:45 efried do we have like a known "we have SDK support up to XXX microversion" somewhere?
16:11:54 mriedem nope
16:11:56 efried e.g. with_servers in that same API doesn't seem to exist in the SDK compute proxy's `hypervisors()` method.
16:11:57 mriedem i did that for osc
16:12:05 mriedem https://etherpad.openstack.org/p/compute-api-microversion-gap-in-osc
16:12:13 efried ack
16:12:28 mriedem getting anyone to care about that is also pretty non-starty
16:12:28 efried but you're not surprised that `with_servers` isn't in the SDK yet?
16:12:33 mriedem hell no

Earlier   Later