Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-11-14
20:19:02 mriedem fwiw we use admin client all over the place for dealing with ports b/c the binding stuff is admin-only by default policy in neutron
20:19:17 dansmith mriedem: I know we do and that was the problem this other bug indicated
20:19:32 mriedem i think the resource_request stuff is the same issue - admin only like port binding details
20:20:27 dansmith I don't understand how we've gotten to this point but it seems kinda wrong
20:21:12 mriedem if it makes you feel better, ports are better protected than volume attachments - those leak host connector details weeeee
20:21:56 mriedem https://bugs.launchpad.net/cinder/+bug/1740950
20:21:56 openstack Launchpad bug 1740950 in Cinder "Volume details shows attached compute host for non-admins" [Undecided,New]
20:22:24 sean-k-mooney the port binding_profile is admin only by default as only nova or ironic e.g. not an end user should ever write to it
20:22:36 sean-k-mooney and the binding_detials are readonly i think
20:23:03 mriedem the volume attachment stuff is admin or owner ever since the nova/cinder split
20:23:20 mriedem because that's how nova gets the connection_info and passes the host connector
20:23:50 mriedem changing that now would break a lot of deployments unless they configured nova with service creds to talk to cinder with an admin role, which is what we've required for working with neutron b/c of port binding details since forever
20:23:54 sean-k-mooney ya whcih is not ideal as that means your ceph mon ips/fqdns are exposed
20:24:02 sean-k-mooney among other things
20:29:35 dansmith mriedem: I hope it's clear that I'm not arguing that this is doing something new, or not consistent with behavior "since forever", just that the other bug made me think about how often we use the neutron admin client to do stuff on behalf of the user and wonder why that's not a problem
20:31:40 mriedem i suspect it's not a problem b/c the non-admin can't GET the port details with the host binding details
20:31:41 sean-k-mooney dansmith: in the port bining case you are not exactly doing it on behalf of the user in all cases. nova is setting admin only filed to comninciate infomation to neutron that the network backend needs to know to wire up the port that the teant should not known
20:31:51 sean-k-mooney mriedem: yep
20:32:16 mriedem unlike that volume attachment bug
20:32:50 dansmith sean-k-mooney: yeah, understand that for the binding case
20:33:32 sean-k-mooney for what its wroth im not realy sure why we chose to make the port resouce requests admin only
20:33:48 sean-k-mooney the allocations sure
20:33:53 mriedem huh, looks like as a non-admin I can also do GET /v3/{project_id}/attachments/{attachment_id} on any volume attached to my server and get the host connection info
20:33:57 mriedem which is great
20:34:12 sean-k-mooney well that is needed for standalone cinder
20:34:20 mriedem heh
20:34:21 mriedem ok
20:34:23 mriedem ..
20:34:30 mriedem there is no policy rule on GET /v3/{project_id}/attachments/{attachment_id}
20:34:33 openstackgerrit Merged openstack/nova master: libvirt: Ignore DiskNotFound during update_available_resource https://review.opendev.org/685391
20:34:37 sean-k-mooney i assume you mean the conintion info
20:34:39 openstackgerrit Merged openstack/nova master: Log reason for remove_host action failing https://review.opendev.org/692833
20:34:45 mriedem i would assume that standalone cinder would be single tenant with admin access to everything
20:34:45 openstackgerrit Merged openstack/nova master: docs: update SUSPENDED server status wrt supported drivers https://review.opendev.org/694329
20:34:49 mriedem sean-k-mooney: yes, connection_info
20:40:50 sean-k-mooney oh i remember why we made port resouce request admin only
20:41:01 sean-k-mooney its so you can request random crap via the port
20:41:49 sean-k-mooney ah the made it readonly https://github.com/openstack/neutron-lib/blob/master/neutron_lib/api/definitions/port_resource_request.py#L31-L34
20:41:52 sean-k-mooney good
20:43:35 mriedem random crap is the best kind of nfv crap
20:44:12 openstackgerrit Archit Modi proposed openstack/nova stable/queens: Revert "openstack server create" to "nova boot" in nova docs https://review.opendev.org/693239
20:45:39 amodi mriedem: https://review.opendev.org/#/c/694357/2 i think this is ready to be merged and then the above ^^ one
20:45:59 openstackgerrit Eric Fried proposed openstack/nova-specs master: Spec: Ussuri: Encrypted Emulated Virtual TPM https://review.opendev.org/686804
20:47:56 efried johnthetubaguy, mriedem (as approvers of the original stein spec), dansmith (because we've been talking about it): This spec ^ is ready for your discerning eyes. Please and thank you.
20:48:24 efried jroll: minor updates, fyi ^
20:48:36 jroll noted
20:51:20 openstackgerrit Matt Riedemann proposed openstack/nova stable/queens: Revert "openstack server create" to "nova boot" in nova docs https://review.opendev.org/693239
20:52:11 mriedem amodi: done
20:52:27 amodi thanks!
20:52:36 mriedem efried: i don't even remember approving those. i think it was someone that hacked my account.
20:53:23 efried mriedem: This ain't discover card. You ARE responsible for charges made on your account.
20:58:12 openstackgerrit Matt Riedemann proposed openstack/nova master: Reset vm_state to original value if rebuild claim fails https://review.opendev.org/692185
21:27:24 tonyb mriedem, sean-k-mooney: Not if I do my job right. It'll be everyone's problem
21:28:30 sean-k-mooney power i could live with if they gave me a machine. im not sure i would have room for a mainframe in my hallway
21:29:09 sean-k-mooney so z is not a think i want to deal with
21:29:16 openstackgerrit Eric Fried proposed openstack/nova master: WIP: Add emulated TPM support to Nova https://review.opendev.org/631363
21:29:16 openstackgerrit Eric Fried proposed openstack/nova master: Add support for resize and cold migration of emulated TPM files https://review.opendev.org/639934
21:30:14 tonyb sean-k-mooney: Well I'd hope you have access to some at work, at home you're on your own but https://www.raptorcs.com/TALOSII/ is about the same price I paid for my x86_64 dev box
21:30:55 sean-k-mooney ya i have seen those before
21:36:07 sean-k-mooney tonyb: im sure there is a less painful way to get acesss to hardware at work but i generally do all my deve either my my personal server i bought or on my laptop in a vm where i fake out numa toploiges with libvirt
21:36:36 sean-k-mooney technically i could also just fake a power system that way too i guess i just would be slow without kvm
21:37:22 tonyb sean-k-mooney: Yes it works but is slow
21:38:02 sean-k-mooney ya its just because kvm only supprot acclerate of your native instruction set
21:39:05 tonyb yeah TCG is nice but slow
21:39:38 sean-k-mooney have you played with the multi threaded tcg backend e.g. mttcg
21:39:55 sean-k-mooney thats actully not bad in the little i have used it
21:40:03 tonyb No, I didn't know that existed
21:40:17 sean-k-mooney you need really new qemu
21:40:35 tonyb I have F30, is that new enough?
21:40:35 sean-k-mooney it was added for acclerating other architure mainly arm
21:41:04 sean-k-mooney i can check. it getts enabeld automaticaly if you cpu model is supproted
21:41:19 tonyb I'll go googling ;p
21:41:50 sean-k-mooney oh looks like you can force it too now https://wiki.qemu.org/Features/tcg-multithread
21:43:00 sean-k-mooney looks like aarch64 was in 2.9
21:43:11 sean-k-mooney not sure if power has been added
21:48:42 sean-k-mooney look like mips,arm,aarch64,x86_64 and aplha have support in the latest version but no power supprot at elast form the release notes
21:48:57 tonyb Pfft
21:57:51 openstackgerrit Merged openstack/nova master: Join migration_context and flavor in Migration.instance https://review.opendev.org/689846
21:57:57 openstackgerrit Merged openstack/nova master: Improve metadata server performance with large security groups https://review.opendev.org/656084
22:04:34 sean-k-mooney ...
22:04:51 sean-k-mooney i was just about to push and then call it a day and now i have a merg conflcit
22:06:48 openstackgerrit sean mooney proposed openstack/nova master: support pci numa affinity policies in flavor and image https://review.opendev.org/674072
22:06:54 openstackgerrit Matt Riedemann proposed openstack/nova stable/train: Join migration_context and flavor in Migration.instance https://review.opendev.org/694408
22:07:33 sean-k-mooney ill fix that tomorrow but it now has the func tests and artoms nits adressed
22:07:39 openstackgerrit Matt Riedemann proposed openstack/nova stable/train: Improve metadata server performance with large security groups https://review.opendev.org/694409
22:18:47 sean-k-mooney actully it looks trivial ill fix it now
22:19:37 openstackgerrit sean mooney proposed openstack/nova master: support pci numa affinity policies in flavor and image https://review.opendev.org/674072
23:30:06 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: Store instance action event exc_val fault details https://review.opendev.org/694428
#openstack-nova - 2019-11-15
00:43:13 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: Expose instance action event details out of the API https://review.opendev.org/694430
02:20:29 openstackgerrit Merged openstack/nova master: Move compute_node_to_inventory_dict to test-only code https://review.opendev.org/693438
02:20:35 openstackgerrit Merged openstack/nova master: Remove get_minimum_version mocks from test_resource_tracker https://review.opendev.org/693439
02:20:43 openstackgerrit Merged openstack/nova stable/queens: doc: fix and clarify --block-device usage in user docs https://review.opendev.org/694357
02:59:56 openstackgerrit Merged openstack/nova master: Stop using NoAuthMiddleware in tests https://review.opendev.org/687416
03:10:17 openstackgerrit Merged openstack/nova master: Remove TODO from ComputeTaskManager._live_migrate https://review.opendev.org/693696
04:31:02 openstackgerrit Archit Modi proposed openstack/nova stable/pike: doc: fix and clarify --block-device usage in user docs https://review.opendev.org/694450
05:41:05 openstackgerrit Brin Zhang proposed openstack/nova-specs master: Add resources metadata of instance https://review.opendev.org/663563
06:45:33 openstackgerrit Brin Zhang proposed openstack/nova-specs master: Add resources metadata of instance https://review.opendev.org/663563
07:18:39 openstackgerrit Shilpa Devharakar proposed openstack/nova master: Ignore root_gb if instance is booted from volume https://review.opendev.org/612626
07:18:39 openstackgerrit Shilpa Devharakar proposed openstack/nova master: Handle new is_volume_backend join column query https://review.opendev.org/694462
07:18:40 openstackgerrit Shilpa Devharakar proposed openstack/nova master: Instance object changes for the new 'is_volume_backed' expected_attr https://review.opendev.org/694463

Earlier   Later