Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-11-11
22:27:15 sean-k-mooney efried: is this in relattion to the config options or something else?
22:27:22 sean-k-mooney *relation
22:28:05 efried yeah, I was trying to figure out a way not to need the config options.
22:28:12 efried because they suck.
22:28:23 sean-k-mooney well why do we need them?
22:28:40 sean-k-mooney nova is not startign the swtpm binary
22:28:46 sean-k-mooney right?
22:28:51 sean-k-mooney that is handeled by libvirt
22:28:52 efried the tpm data file needs to be owned by the uid/gid of the swtpm server process
22:29:08 sean-k-mooney will libvirt create that for us?
22:29:21 efried It creates the process
22:29:39 efried it doesn't help us for it to create the file, cause it ain't the right one.
22:31:28 sean-k-mooney im not really a fan of nova having to manage those file permissions
22:31:40 sean-k-mooney espcially if the file is not own by the nova user
22:31:58 efried I agree. Summed up above as "suck".
22:32:36 sean-k-mooney could we make the files be owned by nova?
22:32:54 sean-k-mooney i have not really looked at how this works at a lowerer level
22:34:03 sean-k-mooney also we really should not have a generic recursive_chown function in nova.
22:34:14 sean-k-mooney *need to have
22:35:57 sean-k-mooney i dont nessisarly know of a better way but from a privsep point of view it sucks to have generic functions like that that take a path user and group
22:39:41 sean-k-mooney efried: is this just needed for the save_and_migrate_vtpm_dir and restore_vtpm_dir functions
22:39:57 efried yes
22:41:06 sean-k-mooney your kind of assuming that nova will have read acess to those folders in places
22:41:18 sean-k-mooney although you might be using privladged functions
22:42:10 efried I haven't really looked at that patch yet (I didn't write it) but I would assume I would need to use privileged operations on both sides.
22:42:42 sean-k-mooney i gues when you do fileutils.ensure_tree(swtpm_dir) to create the folder its in the libvirt instance dir and nova should have write acess to that
22:43:01 sean-k-mooney no all operations would need to be privaladged
22:45:22 sean-k-mooney so that patch is mainly for resize since cold migrate wont work and normal users cant call it
22:46:01 efried On the source, moving the data from its normal location to within the instance dir needs to be privileged to get at the data in its original location
22:46:01 efried Conversely on the dest, creating the real location needs to be privileged; and we should really make sure it's already owned by the right user before moving the contents back out.
22:46:12 efried so I don't see which operations there wouldn't need to be privileged.
22:47:05 sean-k-mooney the ensure_tree function call here https://review.opendev.org/#/c/639934/15/nova/virt/libvirt/utils.py@654
22:47:56 efried cool, looks like that's the case, no?
22:48:17 sean-k-mooney it is i was just wondering if that need privlages and it was missing or not
22:49:57 sean-k-mooney i would not consider it that unusaly to assume nova can read and write to the virt driver instance folder without needing to elevate privaldges
22:51:19 efried yeah, that's a fair point.
22:51:32 sean-k-mooney its proably fine i was just trying to figure out in what context the config parmanter were used and the surronding context
22:52:32 sean-k-mooney in this case the reason nova has to hanel this is that in the cold migrate case libvirt wont copy these files for us. at least not by default
22:52:55 efried in the live migrate case it won't copy these files either.
22:53:37 sean-k-mooney the commit does not suggest that this is need for live migration
22:54:05 efried what's a "resize between nodes"?
22:54:18 sean-k-mooney your chageing the flavor
22:54:25 sean-k-mooney resize is generally between hosts
22:54:42 sean-k-mooney cold migrate is a special calse fo resize where the flaovr remains the same
22:54:49 sean-k-mooney at least in the libvirt driver
22:55:54 dansmith mriedem: if you're going to flip that to an cast always, I can +W what you have and you can do the error handling cleanup and cast in a change after this but before we turn it on
22:55:58 dansmith mriedem: if you're cool with that
22:56:37 dansmith mriedem: also, I think you'd've needed a reno to explain how migrate _can_ be different sometimes for invisible reasons anyway, so doing one to explain that it's always a little different now is equivalent/better
22:58:36 mriedem ok, i can build that into the series before the policy change at the end. as for docs, it would have been part of the cross-cell docs patch that i haven't fleshed out yet, but yeah it's easier to just say generically 'resize / cold migrate is now a cast all the time'
22:59:23 mriedem sean-k-mooney: the flavor always remains the same for cold migrate
22:59:25 dansmith mriedem: I'd prefer it go early in the series the next time you rebase, just so it merges closer to this conversation for context, but.. ack
22:59:29 mriedem the song....that's a different story
23:00:31 mriedem dansmith: ack, i likely need to rebase soonish anyway so i'll push it toward the bottom when i do
23:00:38 dansmith k
23:01:08 sean-k-mooney mriedem: yes that is what i intened to say
23:03:32 sean-k-mooney i was just trying to indicate that when a commit say "When doing a resize or a cold migration between nodes, this data needs to be copied ..." its not refering to live migration
23:08:28 sean-k-mooney efried: this is the qemu docs on the migration process https://github.com/qemu/qemu/blob/9f2ce35dfa4ea4a31dbb765dd02bed2500891887/docs/specs/tpm.txt#L324-L384
23:09:35 efried IIUC all of that is handled under the covers
23:10:22 sean-k-mooney yes
23:10:42 sean-k-mooney but looking at it i am not sure they every transfer the tpm state independetly
23:11:29 sean-k-mooney it seams to be contained in the testvm.bin create by the migrate command
23:14:28 openstackgerrit Dustin Cowles proposed openstack/nova master: WIP: Provider Config File: Enable loading and merging of provider configs https://review.opendev.org/693460
23:16:06 sean-k-mooney this would also seam to mesh with our assumtion of automatic stat transfer for the live migration case https://github.com/stefanberger/libvirt-tpm/commit/72299db63690aa4b74131f54398a665a51e3592f
23:41:44 openstackgerrit Eric Fried proposed openstack/nova-specs master: Spec: Ussuri: Encrypted Emulated Virtual TPM https://review.opendev.org/686804
23:42:03 efried jroll, dansmith, sean-k-mooney: I think that's ready for review now ^
23:42:40 sean-k-mooney ack. ill review it tomorrow
23:51:35 openstackgerrit Eric Fried proposed openstack/nova-specs master: Spec: Ussuri: Encrypted Emulated Virtual TPM https://review.opendev.org/686804
#openstack-nova - 2019-11-12
02:42:46 openstackgerrit Merged openstack/nova master: Plumb allow_cross_cell_resize into compute API resize() https://review.opendev.org/635684
07:48:13 openstackgerrit Luyao Zhong proposed openstack/nova master: support live migration with vpmems https://review.opendev.org/687856
08:02:42 bauzas good morning Nova
08:27:55 gibi bauzas: good morning
08:28:01 gibi bauzas: how is your jetlag?
08:35:54 bauzas gibi: quite good, just woke up today at 6.30am :)
08:35:58 bauzas gibi: and you ?
09:22:42 kashyap lyarwood: efried: Back today. I haven't read the KM-long scrollback, afraid (buried under several things).
10:07:30 openstackgerrit Liang Fang proposed openstack/nova-specs master: Support volume local cache https://review.opendev.org/689070
10:48:43 kashyap Does anyone recall top off their head, AMD SEV support in Nova doesn't support live migration yet, does it?
10:48:53 kashyap (I vaguely recall it doesn't.)
10:49:02 kashyap I'm sure it's somewhere in the spec
10:51:58 kashyap (Yep, my guess is correct - checked in the spec. Also needs support for LM-with-SEV from lower layers.)
11:03:24 gibi bauzas: today was OK for me, yesterday I start my day at 4:45
11:17:24 openstackgerrit Merged openstack/nova master: Pass RequestContext to oslo_policy https://review.opendev.org/674038
11:17:32 openstackgerrit Merged openstack/nova master: Add func test for 'required' PCI NUMA policy https://review.opendev.org/682941
11:21:37 openstackgerrit Merged openstack/nova master: Resolve TODO in _remove_host_allocations https://review.opendev.org/693636
11:29:58 openstackgerrit Balazs Gibizer proposed openstack/nova stable/pike: Functional reproduce for bug 1852207 https://review.opendev.org/693817
11:29:58 openstack bug 1852207 in OpenStack Compute (nova) pike "reschedule ignores that requested availability zone" [Medium,Triaged] https://launchpad.net/bugs/1852207 - Assigned to Balazs Gibizer (balazs-gibizer)
11:30:15 gibi elod: ^^
12:10:09 openstackgerrit Brin Zhang proposed openstack/nova master: WIP: Support re-configure the delete_on_termination in server https://review.opendev.org/693828
13:04:18 jroll efried: thanks, will hit it today
13:36:41 kashyap git fetch gerrit
13:37:08 kashyap Err
13:37:22 openstackgerrit Kashyap Chamarthy proposed openstack/nova-specs master: Re-propose "Secure Boot support for KVM & QEMU guests" spec https://review.opendev.org/693844
13:38:28 openstackgerrit Kashyap Chamarthy proposed openstack/nova-specs master: Re-propose "Secure Boot support for KVM & QEMU guests" for Ussuri https://review.opendev.org/693844
13:49:31 mriedem gibi: before i get started on rebasing the cross cell resize series and adding a change to just cast from api to conductor always ( https://review.opendev.org/#/c/635684/53/nova/compute/api.py@3852 ) i wanted to see if you're ok with that plan?
13:50:49 efried Fun morning. About every 15 minutes, the power goes out for a half second. Just long enough to kill my router.
13:51:40 efried Texas: "Ohh, noooo, it's three degrees below freezing, I'm dyyyyyying!"
13:52:23 mriedem thoughts and prayers
13:52:41 efried kashyap: Let me tldr it for you: what's the minimum qemu needed for *encrypted* emulated TPM?
13:52:59 kashyap efried: Hiya; need to do some sleuthing. Let me do that...
13:53:02 efried unencrypted was 2.11 (according to cfriesen)

Earlier   Later