| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-04-27 | |||
| 06:46:17 | openstackgerrit | Andrey Volkov proposed openstack/nova master: [WIP] Image auto signature https://review.opendev.org/723320 | |
| 07:05:34 | gibi | bauzas: good morning. ACK. | |
| 07:33:31 | zigo | With ussuri, I'm getting: | |
| 07:33:31 | zigo | root@C1-z-controller-1>_ ~ # openstack flavor create --format shell octavia_65 --private --id 65 --ram 2048 --disk 4 --vcpus 1 | |
| 07:33:32 | zigo | Policy doesn't allow os_compute_api:os-flavor-manage:create to be performed. (HTTP 403) (Request-ID: req-30fe38ae-deb9-451f-9234-58edd691696b) | |
| 07:33:56 | zigo | Is there something wrong with the scope enforcement? It's by default to False as it should be ... | |
| 07:36:16 | zigo | When I set rule:admin_api instead, then it works. So something's wrong in oslo.policy or what? | |
| 07:38:19 | gibi | zigo: there was a wide change in the policy handling in Ussuri but the new behavior should be off by default | |
| 07:38:44 | zigo | Which is what I'm saying, it shouldn't be enforced by default, but it looks like it is! | |
| 07:45:29 | gibi | zigo: did you use a admin token in the failed case? | |
| 07:45:48 | zigo | I'm doing this as an admin user indeed. | |
| 07:49:56 | gibi | I have default policy config and it works for me http://paste.openstack.org/show/792738/ | |
| 07:52:09 | zigo | gibi: You can try with the Debian packages, maybe ? :) | |
| 07:52:42 | zigo | For Buster: | |
| 07:52:42 | zigo | deb http://buster-ussuri.debian.net/debian buster-ussuri-backports main | |
| 07:52:42 | zigo | deb http://buster-ussuri.debian.net/debian buster-ussuri-backports-nochange main | |
| 07:52:53 | zigo | Or if you are more adventurous, just from Experimental! :P | |
| 07:56:46 | gibi | zigo: I have to jump on a call for a while, gmann, johnthetubaguy, stephenfin if you can help zigo in the meantime that would be appreciated | |
| 07:57:37 | gibi | zigo: I would check oslo.policy version as there was a late change there as well | |
| 07:57:57 | gibi | zigo: and you can try to rollback https://review.opendev.org/#/c/714822 maybe, but I'm not sure | |
| 07:58:18 | zigo | # dpkg-query -W python3-oslo.policy | |
| 07:58:18 | zigo | python3-oslo.policy 3.1.0-1~bpo10+1 | |
| 07:59:33 | zigo | So that's latest release ... | |
| 07:59:41 | gibi | yepp, that is the last one | |
| 08:09:10 | zigo | Reverting that patch doesn't fix the problem. | |
| 08:09:46 | gibi | zigo: ack, then I'm out of ideas at the moment | |
| 08:10:04 | gibi | and sitting on a call so will be slow responding | |
| 08:20:50 | zigo | I can switch the packaging from rule:system_admin_api to rule:admin_api in the default policy.conf, but obviously, something is wrong that needs to be fixed. | |
| 08:21:33 | zigo | Or is there a way to give the system_scope:all to my admin user? | |
| 08:24:37 | frickler | zigo: you can call for system scoped tokens in the openstack client command | |
| 08:25:03 | zigo | frickler: How? | |
| 08:27:44 | frickler | zigo: in devstack there is a "devstack-system-admin" section in /etc/openstack/config.yaml, let me try to do that manually | |
| 08:29:43 | frickler | openstack --os-auth-url https://192.168.42.13/identity --os-username admin --os-system-scope all --os-user-domain-name default token issue | |
| 08:41:50 | nightmare_unreal | hello what's greynade-py3 error for? my zuul build failed and it shows grenade-py3 FAILURE | |
| 08:47:41 | lyarwood | nightmare_unreal: link? | |
| 08:47:51 | lyarwood | I see https://review.opendev.org/#/c/548936/ landed, hopefully that didn't break the older jobs | |
| 08:48:04 | nightmare_unreal | lyarwood: https://review.opendev.org/#/c/715395/ | |
| 08:48:58 | openstackgerrit | Lee Yarwood proposed openstack/nova master: zuul: Switch to the Zuulv3 grenade job https://review.opendev.org/704364 | |
| 08:53:05 | lyarwood | nightmare_unreal: I'm not, appears a few other runs have hit that as well. It's unrelated to your change so for now feel free to recheck. The above ^ switch to a zuulv3 job might also correct it so feel free to rebase on to that change | |
| 08:53:10 | lyarwood | I'm not sure* | |
| 08:54:05 | nightmare_unreal | lyarwood: okay thanks :) so I can trigger the build again ? | |
| 08:54:19 | lyarwood | nightmare_unreal: yes | |
| 08:54:58 | nightmare_unreal | how can I trigger it ? | |
| 09:03:46 | lyarwood | nightmare_unreal: recheck | |
| 09:04:04 | nightmare_unreal | okay | |
| 09:04:15 | lyarwood | nightmare_unreal: ^ leave a comment with just that and zuul will rerun the jobs | |
| 09:04:30 | nightmare_unreal | thanks :) | |
| 09:04:31 | lyarwood | nightmare_unreal: you can watch them here https://zuul.opendev.org/t/openstack/status | |
| 09:04:43 | lyarwood | nightmare_unreal: just use the 715395 change id | |
| 09:49:31 | gibi | zigo: did you manage to solve the issue with frickler's help? | |
| 09:51:04 | zigo | gibi: No ... | |
| 09:51:20 | zigo | Scope should not be enforced, but it is. | |
| 09:51:31 | zigo | This breaks all sorts of things, including in my puppet stuff. | |
| 09:54:09 | zigo | Also: | |
| 09:54:09 | zigo | # openstack --os-system-scope all hypervisor list | |
| 09:54:09 | zigo | Policy doesn't allow os_compute_api:os-hypervisors:list-detail to be performed. (HTTP 403) (Request-ID: req-981105e1-a7aa-4fa2-9e52-ee7082ae7165) | |
| 09:54:33 | zigo | policy.conf has rule:system_reader_api | |
| 09:54:46 | zigo | If I switch that to rule:admin_api then it works... | |
| 09:55:21 | gibi | zigo: does it work with the default policy? (without having anything in the policy file) | |
| 09:55:48 | zigo | gibi: As in, "rm /etc/nova/policy.json" ? | |
| 09:56:24 | zigo | root@C1-z-controller-1>_ ~ # rm /etc/nova/policy.json | |
| 09:56:25 | zigo | root@C1-z-controller-1>_ ~ # openstack hypervisor list | |
| 09:56:25 | zigo | The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-ccfb9f31-7cd9-439c-ad02-ae76f7c8c0d5) | |
| 09:56:31 | zigo | Not great ... :( | |
| 10:03:45 | gibi | I don't have any policy.json for nova in devstack | |
| 10:04:35 | gibi | do you have a stacktrace for the above HTTP 500? | |
| 10:21:07 | gibi | lyarwood: thanks for the stable/stein release proposal, I'm +1, when you have time, could you hit https://review.opendev.org/#/q/topic:create-ussuri+(status:open+OR+status:merged)+project:openstack/nova ? | |
| 11:04:40 | frickler | zigo: your command confuses me, do you have other options set via environment? setting some project option will override system-scope without a warning. make sure that with "token issue" you see a system scoped token, not project or domain | |
| 11:04:53 | zigo | Yes I do ! :) | |
| 11:05:17 | zigo | Ok, will try. | |
| 11:05:51 | zigo | I've restarted a cluster deployment from scratch, to see if Ussuri can be setup fully automatically again with my system, so can't try right now... | |
| 11:06:00 | zigo | Later this afternoon. | |
| 11:25:16 | frickler | zigo: fyi, I don't get your error by default in devstack, but I do get it if I add "[oslo_policy] enforce_scope = True" into nova.conf. in that case, creating a flavor only works with system scope | |
| 11:46:06 | gibi | avolkov: hi! I asked for some clarification in https://bugs.launchpad.net/nova/+bug/1875287 | |
| 11:46:06 | openstack | Launchpad bug 1875287 in OpenStack Compute (nova) "VM unshelve failed if verify_glance_signatures enabled" [Undecided,Incomplete] - Assigned to Andrey Volkov (avolkov) | |
| 11:55:12 | AJaeger | stephenfin: is this what you wanted as babel cleanup: https://review.opendev.org/#/c/723206/2 ? | |
| 12:00:14 | gibi | bauzas: triaged the fresh bugs, nothing noteworthy so far. I'm releasing the (silently) held bug lock for the afternoon | |
| 12:05:06 | nightmare_unreal | can someone review this if they grt time : https://review.opendev.org/#/c/715395/ | |
| 12:05:10 | nightmare_unreal | thanks | |
| 12:09:13 | avolkov | gibi: hi, updated. if possible please leave your opinion what should we do with that | |
| 12:11:59 | gibi | avolkov: thanks make more sense now | |
| 12:12:40 | stephenfin | AJaeger: Oh, so we don't need the babel.cfg file either? | |
| 12:16:47 | gibi | avolkov: do you agree that this bug is not a recent regression, it seems that we have the issue at least since rocky | |
| 12:16:53 | gibi | ? | |
| 12:20:56 | gibi | avolkov: in the meantime I confirmed the bug as I was able to reproduce it | |
| 12:31:37 | AJaeger | stephenfin: it's referenced from setup.cfg | |
| 12:31:50 | AJaeger | stephenfin: I don't think we need it, I checked locally with it removed | |
| 12:33:32 | AJaeger | stephenfin: I answered on the review | |
| 12:34:24 | stephenfin | AJaeger: Sweet, thanks | |
| 12:54:22 | avolkov | gibi: seems not a regression, I believe it was introduced with that verify_glance_signatures (mitaka?) or maybe with some refactoring further, it's definitely not urgent | |
| 12:54:40 | gibi | avolkov: thanks. | |
| 12:55:32 | AJaeger | any other nova core for two tiny cleanups, please? https://review.opendev.org/#/c/723206/2 and https://review.opendev.org/#/c/720725/1 ? | |
| 13:00:45 | brinzhang_ | AJeager:is this necessary? https://review.opendev.org/#/c/723295/ | |
| 13:00:54 | brinzhang_ | if not, I will abandon it | |
| 13:08:56 | openstackgerrit | Merged openstack/python-novaclient master: doc: Update Testing document https://review.opendev.org/723078 | |
| 13:18:41 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Use compression by default for 'SshDriver' https://review.opendev.org/684393 | |
| 13:25:24 | stephenfin | sean-k-mooney: can you bump your vote on https://review.opendev.org/#/c/716223/ now? | |
| 13:27:48 | sean-k-mooney | stephenfin: yes i guess so did rc 1 go out on thursday | |
| 13:28:07 | stephenfin | sure did | |
| 13:28:14 | sean-k-mooney | cool +w | |