| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-03-18 | |||
| 16:09:06 | gibi | that feels like cheating for a CI machinery | |
| 16:39:13 | openstackgerrit | Lee Yarwood proposed openstack/nova master: WIP gate: Ensure n-cpu is stopped on the subnode during evacuation https://review.opendev.org/713674 | |
| 16:59:08 | openstackgerrit | Ghanshyam Mann proposed openstack/nova master: Add new default roles in os-flavor-access policies https://review.opendev.org/713697 | |
| 17:05:12 | openstackgerrit | Ghanshyam Mann proposed openstack/nova master: Add new default roles in os-flavor-access policies https://review.opendev.org/713697 | |
| 17:05:24 | gmann | johnthetubaguy: list flavor-access policy is little wired. old defaults are admin-or-owner which i think should be admin as multiple projects can have access to single flavor so owner is not suitable things for flavor. ^^ updating it with more accurate new defaults. you can see details in bug https://bugs.launchpad.net/nova/+bug/1867840 | |
| 17:05:24 | openstack | Launchpad bug 1867840 in OpenStack Compute (nova) "os-flavor-access API policy should be admin only" [Undecided,New] - Assigned to Ghanshyam Mann (ghanshyammann) | |
| 17:06:44 | gmann | i did not fix the old default as bug because that can break existing deployment. so thinking to keep supporting them and cleanup during we move to system scope by default | |
| 17:53:32 | openstackgerrit | Merged openstack/nova master: db: Remove unused ec2 DB APIs https://review.opendev.org/698880 | |
| 18:05:02 | openstackgerrit | Merged openstack/nova master: libvirt: Check the guest support UEFI https://review.opendev.org/685678 | |
| 18:10:51 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Support unshelve with qos ports https://review.opendev.org/704759 | |
| 18:10:51 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Enable unshelve with qos ports https://review.opendev.org/705475 | |
| 18:13:36 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Add service version check for live migrate with qos https://review.opendev.org/713679 | |
| 18:13:52 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Merge qos related renos for Ussuri https://review.opendev.org/706766 | |
| 18:15:02 | openstackgerrit | Balazs Gibizer proposed openstack/nova master: Add service version check for evacuate with qos https://review.opendev.org/713680 | |
| 18:15:25 | gibi | dansmith: updated the whole qos series ^^ | |
| 18:15:32 | dansmith | gibi: sweet | |
| 18:15:41 | gibi | dansmith: thanks for the review | |
| 18:15:52 | dansmith | np, will hit those soon | |
| 18:22:45 | sean-k-mooney | lyarwood: it looks like your evacuate change is hitting some where errors https://zuul.opendev.org/t/openstack/build/daabc75c8992406f8a089a808c2553b9/log/logs/screen-n-cpu.txt#7789 | |
| 18:23:37 | sean-k-mooney | it disconnect an iscsi volume then reports rbd issues and finally fails with a virtual interface createion faild error | |
| 18:23:44 | sean-k-mooney | although i dont know why that is being raided | |
| 19:03:23 | lyarwood | sean-k-mooney: which one was that sorry? | |
| 19:03:49 | lyarwood | sean-k-mooney: oh the evacuation fix | |
| 19:03:58 | lyarwood | sean-k-mooney: it looked like the same issue again in console.log | |
| 19:04:04 | lyarwood | sean-k-mooney: I didn't even think to look at n-cpu sorry | |
| 19:05:15 | sean-k-mooney | the n-cpu logs honestly confuse me | |
| 19:05:35 | sean-k-mooney | i did not look at teh code but i think the virutal interface creation excpetion is a redheiring | |
| 19:07:33 | lyarwood | sean-k-mooney: https://zuul.opendev.org/t/openstack/build/daabc75c8992406f8a089a808c2553b9/log/logs/screen-n-cpu.txt#7760 it's the same issue | |
| 19:08:38 | lyarwood | sean-k-mooney: we hit the vif timeout first and call disconnect_volume | |
| 19:08:58 | lyarwood | sean-k-mooney: I think the RBD cleanup failures are due to the domain still being active on the subnode | |
| 19:09:50 | lyarwood | oh right because ceph.sh only sets up ephemeral storage on ceph | |
| 19:09:58 | lyarwood | not c-vol | |
| 19:10:00 | prometheanfire | looks like alembic is still failing for nova / neutron https://review.opendev.org/708706 | |
| 19:10:05 | sean-k-mooney | ah ok | |
| 19:10:29 | sean-k-mooney | the ceph thing was confusing me | |
| 19:10:51 | sean-k-mooney | and ya that kind of makes sense | |
| 19:11:12 | sean-k-mooney | so we not only need to stop the compute agent but the vms on the sub node too | |
| 19:11:37 | sean-k-mooney | which i guess makes sense | |
| 19:12:00 | sean-k-mooney | so we should stop the compute agent. then use libvirt to stop all the vms on the subnode | |
| 19:12:06 | sean-k-mooney | then do an evacuate | |
| 19:16:14 | lyarwood | sean-k-mooney: kk, I'll give that a go. | |
| 19:16:58 | lyarwood | sean-k-mooney: here's a thought, shouldn't all devstack@* services be stopped on the subnode? | |
| 19:17:25 | sean-k-mooney | i was consider doing a power off on the subnode | |
| 19:17:31 | sean-k-mooney | but i think we need logs from it | |
| 19:18:02 | sean-k-mooney | but yes you could do "sudo systemctl stop devstack@*" | |
| 19:18:29 | sean-k-mooney | that would be totally valid to do provide we dont install cpeh there | |
| 19:19:00 | sean-k-mooney | if we are installing ceph in the devstack slice then that woudl be an issue | |
| 19:22:20 | noonedeadpunk | hi! is there any reason (like security or other) why flavor transition from public to private or vice versa is not supported? | |
| 19:22:47 | sean-k-mooney | noonedeadpunk: private flavors was a half impleneted feature that is not commonly used | |
| 19:23:18 | sean-k-mooney | noonedeadpunk: so support was not added. | |
| 19:23:25 | noonedeadpunk | oh really? Like I was using it pretty much in several clouds | |
| 19:23:26 | openstackgerrit | Lee Yarwood proposed openstack/nova master: WIP gate: Ensure n-cpu is stopped on the subnode during evacuation https://review.opendev.org/713674 | |
| 19:23:59 | lyarwood | sean-k-mooney: ^ awful hacks, no idea if that would even work but there we go. This would actually be easier to do if this was a playbook... | |
| 19:24:16 | noonedeadpunk | Ok, I see. Just wondering if it makes sense to look into it to propose a patch | |
| 19:25:47 | noonedeadpunk | As there's no blockers which are aware for everyone, will try that out | |
| 19:26:27 | sean-k-mooney | noonedeadpunk: its an api change which would require a microverion bump and a spec | |
| 19:26:36 | sean-k-mooney | so it cant be done as a bug fix | |
| 19:26:40 | sean-k-mooney | https://docs.openstack.org/api-ref/compute/?expanded=remove-flavor-access-from-tenant-removetenantaccess-action-detail#flavors-access-flavors-os-flavor-access | |
| 19:26:56 | sean-k-mooney | the flavor acess api is what is normally used instead | |
| 19:28:44 | noonedeadpunk | sean-k-mooney: the thing I'm missing is transition from is_public: true to is_public: false.... | |
| 19:29:25 | sean-k-mooney | yep | |
| 19:29:31 | noonedeadpunk | but yeah, it needs api version bump... | |
| 19:30:03 | noonedeadpunk | anyway thanks for answering:) | |
| 19:30:20 | sean-k-mooney | noonedeadpunk: most flavor fileds are imuntable after its created | |
| 19:31:02 | sean-k-mooney | the update endpoint only supports updating the description | |
| 19:31:04 | noonedeadpunk | I can understand about flavor properties, as it will mix up isntances | |
| 19:31:27 | sean-k-mooney | https://docs.openstack.org/api-ref/compute/?expanded=update-flavor-description-detail#update-flavor-description | |
| 19:31:45 | noonedeadpunk | but is_public is kinda visability thing, which should be safe to update in that terms | |
| 19:32:03 | sean-k-mooney | in theory yes. | |
| 19:32:38 | sean-k-mooney | although updating it wont change the status of the is_public flag in the embded flavor in an instnace | |
| 19:32:42 | gmann | but it might cause restriction access to few tenants which are not in access list. | |
| 19:33:31 | openstackgerrit | melanie witt proposed openstack/nova master: DNM: try to get some debug info for bug 1844929 https://review.opendev.org/701478 | |
| 19:33:31 | openstack | bug 1844929 in OpenStack Compute (nova) "grenade jobs failing due to "Timed out waiting for response from cell" in scheduler" [High,Confirmed] https://launchpad.net/bugs/1844929 | |
| 19:34:03 | sean-k-mooney | gmann: well this is not using the os-flavor-acces api | |
| 19:34:17 | sean-k-mooney | this is setting the is_public flag in the flavor itself | |
| 19:34:34 | sean-k-mooney | the os-flavor-acces api is normally what peopel shoudl use | |
| 19:34:53 | sean-k-mooney | so to make a flavor private you just add acess to only the admin/service project | |
| 19:35:00 | sean-k-mooney | then no other tenats can see it | |
| 19:35:01 | gmann | yeah but we restrict the public flavor to process in flavor-access api | |
| 19:35:30 | gmann | yeah, removing all other tenants make it private | |
| 19:36:14 | sean-k-mooney | noonedeadpunk: does ^ makes sense | |
| 19:37:00 | sean-k-mooney | noonedeadpunk: is_public on the flavor is a hold over from before we had per tenant contol over flaovr visablity | |
| 19:37:06 | noonedeadpunk | hm, let me check that | |
| 19:38:02 | noonedeadpunk | (actully deploy latest sandbox and test) | |
| 19:38:40 | sean-k-mooney | lyarwood: looking at https://github.com/openstack/devstack-plugin-ceph/blob/master/devstack/lib/ceph#L1213-L1251 it looks like ceph is not in the devstack slice | |
| 19:38:50 | sean-k-mooney | so stop devstack@* should be ok | |
| 19:39:34 | sean-k-mooney | you would still have to do "killall qemu" or use virish stop on all active domains too to stop the rbd device in use error | |
| 19:39:37 | lyarwood | sean-k-mooney: right and I don't think we deploy anything on the subnode in this case anyway | |
| 19:39:46 | gmann | only thing is you would not be able to add projects or list access info on public flavor | |
| 19:40:23 | sean-k-mooney | gmann: you can use the flavor acess api to do that | |
| 19:40:40 | sean-k-mooney | horizon allows you to take a standard public flavor and add tenants too it | |
| 19:41:08 | gmann | sean-k-mooney: no, after 2.7 add project is restricted on non-public and list access is for non-public only from stating | |
| 19:41:19 | sean-k-mooney | gmann: i tought the os-flaovr-acess api basically ignored the is_public atribte | |
| 19:41:29 | gmann | https://github.com/openstack/nova/blob/c9f5b583b6072f542d1757e35fd6305b9698496a/nova/api/openstack/compute/flavor_access.py#L50-L75 | |
| 19:41:44 | sean-k-mooney | gmann: right so if you use an older microversion then what happens | |
| 19:42:13 | gmann | with older than 2.7 yes you can add. | |
| 19:42:39 | sean-k-mooney | i suspect horizon is using older then 2.7 | |
| 19:42:52 | sean-k-mooney | why did we make that change? | |
| 19:43:27 | gmann | well, public means for everyone so we do not really need to add access things right | |
| 19:44:05 | sean-k-mooney | gmann: basicaly i tought we effectivly deprecated is_public and ignored it | |