Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2019-12-03
14:52:45 sean-k-mooney thats more of a british/irish thing that granparents say to little childeren when they got away with something
14:53:19 ygk_12345 is anyone here familiar with the nova spice console ?
14:54:04 sean-k-mooney i think we all have deployed it at different times. are you haveing a specific issue
14:54:26 ygk_12345 sean-k-mooney this one https://bugs.launchpad.net/nova/+bug/1854950
14:54:26 openstack Launchpad bug 1854950 in OpenStack Compute (nova) "VM spice console not clear" [Undecided,New]
14:56:41 sean-k-mooney that is strange i dont think i have ever seen https://launchpadlibrarian.net/454102031/Screenshot%20from%202019-12-03%2020-03-58.png
14:57:20 sean-k-mooney stephenfin: do you recall if we still use websockify with the spice console
14:57:22 ygk_12345 when a use presses even an ENTER key it is splitting into lines and dots
14:57:29 stephenfin we do
14:57:31 ygk_12345 *user
14:58:33 sean-k-mooney ygk_12345: it look like the data is being currpted and the broken pipes would lead me to belive this is why the console is currupted
14:58:58 sean-k-mooney im wondering if the could be a websockify issue
15:00:06 sean-k-mooney we had this bug back in august https://bugs.launchpad.net/nova/+bug/1840788
15:00:07 openstack Launchpad bug 1840788 in OpenStack Compute (nova) "websockify-0.9.0 breaks tempest tests" [Undecided,In progress] - Assigned to melanie witt (melwitt)
15:00:36 sean-k-mooney ygk_12345: what version of websockify do you have installed?
15:00:49 ygk_12345 sean-k-mooney how to check it ?
15:00:58 sean-k-mooney how did you install
15:01:12 ygk_12345 sean-k-mooney openstack ansible rocky 18.1.9 branch
15:01:31 sean-k-mooney ok did you do the package install or the souce install
15:02:04 ygk_12345 sean-k-mooney how do I determine that ? I just ran the playbooks
15:02:30 sean-k-mooney mnaser: what is the default install mode for openstack ansible in rocky?
15:02:32 ygk_12345 followed the deployment guide as usual
15:02:50 mnaser sean-k-mooney: default is source inside containers
15:03:22 sean-k-mooney mnaser: so to check websockify version ygk_12345 would have to ssh into the lxc container then do a pip freeze in the virtual env?
15:04:19 ygk_12345 mnaser exact command please
15:04:55 mnaser right they can hop into the lxc container (using lxc-attach too) and /openstack/venvs/nova-$version/bin/pip freeze
15:05:41 ygk_12345 mnaser ok
15:06:14 sean-k-mooney ygk_12345: that may not be the error but if you are using 0.9.0 then its possibel. resolving the broken pipes will likely fix the issue but first you need to figure out why that happens
15:06:28 sean-k-mooney that is outside the scope of nova
15:07:29 ygk_12345 sean-k-mooney websockify==0.8.0
15:07:55 sean-k-mooney ok so that should hopefully be ok
15:08:18 ygk_12345 sean-k-mooney how to proceed now ?
15:08:41 sean-k-mooney you need to determin what is causing the broken pipies
15:09:05 ygk_12345 any clues ?
15:10:00 sean-k-mooney other then looking at the websockify logs and journalctl not really but perhaps someone else has an idea
15:13:49 mriedem stephenfin: i jumped a bit but there are some nits in https://review.opendev.org/#/c/696511/4 if you want to FUP or if you end up needing to rev the series
15:14:55 openstackgerrit Matt Riedemann proposed openstack/nova master: WIP: log when loading security group driver https://review.opendev.org/652783
15:16:22 stephenfin coolness
15:17:02 ygk_12345 sean-k-mooney we have a another similar setup, there also I observer broke pipe errors but the console is functioning fine there
15:17:58 ygk_12345 sean-k-mooney do u thin k the problem is with the netwrok issues ?
15:19:06 sean-k-mooney dansmith: by the way after our conversation with sundar yesterday i decied to look at option of emulating pci device in the kernel again. we may be able ot use the PCI Endpoint Framework https://www.kernel.org/doc/html/latest/PCI/endpoint/index.html to create device we could use for pci passthough testing and cyborg testing
15:19:28 dansmith sean-k-mooney: sweet
15:20:04 sean-k-mooney i need to play around with it as the test driver is not complied in to the ubunut kernel module extra so il need to see how to compile it but ill let you know how it goes
15:20:29 dansmith cool
15:20:42 sean-k-mooney it should allow use to create pci devices by creating folders with in /sys
15:21:22 sean-k-mooney https://www.kernel.org/doc/html/latest/PCI/endpoint/pci-test-howto.html#creating-pci-epf-test-device
15:22:09 sean-k-mooney if it works we shoudl be able to set the vendor id and prodcut id ot like 1234:42 then assert that a pci deivce with that vendor and prodcit id is availabel and passed to the guest
15:25:30 stephenfin mriedem: Dumb question, but the 'device_id' in a neutron port response will always be the instance's UUID, not the ID, right?
15:28:11 sean-k-mooney stephenfin: yes it will never be the db short id
15:28:19 stephenfin ta
15:30:55 dansmith stephenfin: if it were the db id we wouldn't be able to distinguish one instance over another across cells
15:31:13 mriedem we also don't expose the server primary key id out of the rest api
15:31:57 sean-k-mooney impliying that if it was teh primary key id that neutron would not be able to use it in api queries
15:32:30 sean-k-mooney we did expose the hypervior primary key although i think that was by mistake.
15:32:43 mriedem it wasn't by mistake for hypervisors,
15:32:51 mriedem they originally didn't have uuids
15:32:57 mriedem same with services and lots of other things
15:32:57 sean-k-mooney ah ok
15:57:23 openstackgerrit Matt Riedemann proposed openstack/nova master: Cache security group driver https://review.opendev.org/697122
16:26:31 dansmith anybody want to +W this so Sundar can just rebase on master? https://review.opendev.org/#/c/695985/
16:26:41 dansmith s/rebase/rebase the cyborg stuff/
16:27:09 mriedem gibi: i replied to your questions in https://review.opendev.org/#/c/637058/, thanks. i'll stack a change on top of the series to see what replacing that setup_networks_on_host hack would look like if we just implement port binding deleting in cleanup_instance_network_on_host
16:28:50 mriedem dansmith: looking
16:30:06 gibi mriedem: ack, thanks
16:46:24 openstackgerrit Thierry Carrez proposed openstack/nova master: Remove unused rootwrap filters https://review.opendev.org/697134
17:36:14 dansmith eandersson: what perf improvements in nova specifically have shifted your scale focus away from nova?
17:40:09 efried dansmith: Would you please have another look at the vTPM spec. I'd like to get your +2 before you bugger off til 2020. https://review.opendev.org/#/c/686804/
17:40:51 dansmith efried: I've skimmed it.. tbh, I'm really like -0.9 on it, so if you want me to review it, it's probably going to be not helpful to your effort
17:41:21 dansmith I'm not sure I see the benefit outweighing the nightmare of users trying to predict the behavior
17:41:46 dansmith I was thinking it was required for secure boot, but talking with folks I realize it's not, so ... it's just hard to justify I think
17:45:09 sean-k-mooney for what its worth the out of tree hyperv driver support vtpm for 3-4 years already
17:45:36 sean-k-mooney its part fo there sheilded vms thing but i have no idea how they solved any of the issues with move operations
17:45:49 efried did they?
17:46:21 sean-k-mooney yep ill get the link. did i not send this to you already
17:46:27 dansmith sean-k-mooney: given how hyperv moves things I expect it's tracked by the hypervisor and so it just works, but I could be wrong
17:46:54 sean-k-mooney https://github.com/openstack/compute-hyperv/commit/f37ce8b6bb0eb88a367239698ba7c3df3b64db38
17:47:01 dansmith the question is more about how things like snapshot works
17:47:10 sean-k-mooney they have an os_vtpm image property
17:50:00 sean-k-mooney they must have patches against nova because the ImageMetaProps object does not accept os_vtpm or os_shielded_vm
17:53:13 dansmith looks like maybe they're doing some mangling of instance.hostname to reference specific keys or something?
17:53:24 dansmith and they're illegally stashing their own stuff in insance.metadata
17:53:35 dansmith so all manner of hacks in that implementation
17:53:43 sean-k-mooney yep
17:53:55 sean-k-mooney and none of this is supported in the in tree one
17:56:42 sean-k-mooney im looking at there snapshot function now https://github.com/openstack/compute-hyperv/blob/cb203978f262f31790592b2a0692fc2acaaef33d/compute_hyperv/nova/snapshotops.py#L66 but i think its just of the image so they dont snapshot the tpm?
17:57:32 dansmith I dunno, but since they've already broken many rules of user interaction, looking further into how they handle it doesn't seem like it would help guide us
17:57:58 sean-k-mooney it proably wont but it looks like they just ignored it
17:58:27 sean-k-mooney so i guess there stance was the tpm state would not be resoreted if you restored form a snapshot
17:58:39 sean-k-mooney the same way non root disks are not restored
17:59:40 dansmith or there is magic in the hostname mangling stuff so that if you recreate an instance with the right magic hostname, it will re-get the tpm stored in the hypervisor?
18:00:39 dansmith given that they basically implement features by bounty in that out of tree driver, I expect they implemented just the part of the solution that would suffice for the one customer asking for it
18:01:26 sean-k-mooney i dont think they are manageling the path in the metatada but yes i would guess the custoemr did not ask for snapshotiing so they did not add it
18:02:54 efried To me, the only severe issue is evacuate. The rest should be easy to understand with proper documentation.
18:02:59 sean-k-mooney i think they were using the vtpm soly for disk encryption
18:03:19 efried "vTPM is tied to your instance. Don't expect to be able to snapshot and clone it."
18:04:13 efried "You can back up and restore as long as you use 'backup'."
18:04:44 sean-k-mooney ? you use backup
18:05:26 sean-k-mooney you mean as long as you rebuild form a snapshot and dont launch an new instance right
18:05:46 efried No. I mean as long as you use rebuild from an image created via the createBackup server action
18:06:07 sean-k-mooney right but does that not just create a shapshot

Earlier   Later