| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-04-27 | |||
| 08:21:33 | zigo | Or is there a way to give the system_scope:all to my admin user? | |
| 08:24:37 | frickler | zigo: you can call for system scoped tokens in the openstack client command | |
| 08:25:03 | zigo | frickler: How? | |
| 08:27:44 | frickler | zigo: in devstack there is a "devstack-system-admin" section in /etc/openstack/config.yaml, let me try to do that manually | |
| 08:29:43 | frickler | openstack --os-auth-url https://192.168.42.13/identity --os-username admin --os-system-scope all --os-user-domain-name default token issue | |
| 08:41:50 | nightmare_unreal | hello what's greynade-py3 error for? my zuul build failed and it shows grenade-py3 FAILURE | |
| 08:47:41 | lyarwood | nightmare_unreal: link? | |
| 08:47:51 | lyarwood | I see https://review.opendev.org/#/c/548936/ landed, hopefully that didn't break the older jobs | |
| 08:48:04 | nightmare_unreal | lyarwood: https://review.opendev.org/#/c/715395/ | |
| 08:48:58 | openstackgerrit | Lee Yarwood proposed openstack/nova master: zuul: Switch to the Zuulv3 grenade job https://review.opendev.org/704364 | |
| 08:53:05 | lyarwood | nightmare_unreal: I'm not, appears a few other runs have hit that as well. It's unrelated to your change so for now feel free to recheck. The above ^ switch to a zuulv3 job might also correct it so feel free to rebase on to that change | |
| 08:53:10 | lyarwood | I'm not sure* | |
| 08:54:05 | nightmare_unreal | lyarwood: okay thanks :) so I can trigger the build again ? | |
| 08:54:19 | lyarwood | nightmare_unreal: yes | |
| 08:54:58 | nightmare_unreal | how can I trigger it ? | |
| 09:03:46 | lyarwood | nightmare_unreal: recheck | |
| 09:04:04 | nightmare_unreal | okay | |
| 09:04:15 | lyarwood | nightmare_unreal: ^ leave a comment with just that and zuul will rerun the jobs | |
| 09:04:30 | nightmare_unreal | thanks :) | |
| 09:04:31 | lyarwood | nightmare_unreal: you can watch them here https://zuul.opendev.org/t/openstack/status | |
| 09:04:43 | lyarwood | nightmare_unreal: just use the 715395 change id | |
| 09:49:31 | gibi | zigo: did you manage to solve the issue with frickler's help? | |
| 09:51:04 | zigo | gibi: No ... | |
| 09:51:20 | zigo | Scope should not be enforced, but it is. | |
| 09:51:31 | zigo | This breaks all sorts of things, including in my puppet stuff. | |
| 09:54:09 | zigo | Also: | |
| 09:54:09 | zigo | # openstack --os-system-scope all hypervisor list | |
| 09:54:09 | zigo | Policy doesn't allow os_compute_api:os-hypervisors:list-detail to be performed. (HTTP 403) (Request-ID: req-981105e1-a7aa-4fa2-9e52-ee7082ae7165) | |
| 09:54:33 | zigo | policy.conf has rule:system_reader_api | |
| 09:54:46 | zigo | If I switch that to rule:admin_api then it works... | |
| 09:55:21 | gibi | zigo: does it work with the default policy? (without having anything in the policy file) | |
| 09:55:48 | zigo | gibi: As in, "rm /etc/nova/policy.json" ? | |
| 09:56:24 | zigo | root@C1-z-controller-1>_ ~ # rm /etc/nova/policy.json | |
| 09:56:25 | zigo | root@C1-z-controller-1>_ ~ # openstack hypervisor list | |
| 09:56:25 | zigo | The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-ccfb9f31-7cd9-439c-ad02-ae76f7c8c0d5) | |
| 09:56:31 | zigo | Not great ... :( | |
| 10:03:45 | gibi | I don't have any policy.json for nova in devstack | |
| 10:04:35 | gibi | do you have a stacktrace for the above HTTP 500? | |
| 10:21:07 | gibi | lyarwood: thanks for the stable/stein release proposal, I'm +1, when you have time, could you hit https://review.opendev.org/#/q/topic:create-ussuri+(status:open+OR+status:merged)+project:openstack/nova ? | |
| 11:04:40 | frickler | zigo: your command confuses me, do you have other options set via environment? setting some project option will override system-scope without a warning. make sure that with "token issue" you see a system scoped token, not project or domain | |
| 11:04:53 | zigo | Yes I do ! :) | |
| 11:05:17 | zigo | Ok, will try. | |
| 11:05:51 | zigo | I've restarted a cluster deployment from scratch, to see if Ussuri can be setup fully automatically again with my system, so can't try right now... | |
| 11:06:00 | zigo | Later this afternoon. | |
| 11:25:16 | frickler | zigo: fyi, I don't get your error by default in devstack, but I do get it if I add "[oslo_policy] enforce_scope = True" into nova.conf. in that case, creating a flavor only works with system scope | |
| 11:46:06 | gibi | avolkov: hi! I asked for some clarification in https://bugs.launchpad.net/nova/+bug/1875287 | |
| 11:46:06 | openstack | Launchpad bug 1875287 in OpenStack Compute (nova) "VM unshelve failed if verify_glance_signatures enabled" [Undecided,Incomplete] - Assigned to Andrey Volkov (avolkov) | |
| 11:55:12 | AJaeger | stephenfin: is this what you wanted as babel cleanup: https://review.opendev.org/#/c/723206/2 ? | |
| 12:00:14 | gibi | bauzas: triaged the fresh bugs, nothing noteworthy so far. I'm releasing the (silently) held bug lock for the afternoon | |
| 12:05:06 | nightmare_unreal | can someone review this if they grt time : https://review.opendev.org/#/c/715395/ | |
| 12:05:10 | nightmare_unreal | thanks | |
| 12:09:13 | avolkov | gibi: hi, updated. if possible please leave your opinion what should we do with that | |
| 12:11:59 | gibi | avolkov: thanks make more sense now | |
| 12:12:40 | stephenfin | AJaeger: Oh, so we don't need the babel.cfg file either? | |
| 12:16:47 | gibi | avolkov: do you agree that this bug is not a recent regression, it seems that we have the issue at least since rocky | |
| 12:16:53 | gibi | ? | |
| 12:20:56 | gibi | avolkov: in the meantime I confirmed the bug as I was able to reproduce it | |
| 12:31:37 | AJaeger | stephenfin: it's referenced from setup.cfg | |
| 12:31:50 | AJaeger | stephenfin: I don't think we need it, I checked locally with it removed | |
| 12:33:32 | AJaeger | stephenfin: I answered on the review | |
| 12:34:24 | stephenfin | AJaeger: Sweet, thanks | |
| 12:54:22 | avolkov | gibi: seems not a regression, I believe it was introduced with that verify_glance_signatures (mitaka?) or maybe with some refactoring further, it's definitely not urgent | |
| 12:54:40 | gibi | avolkov: thanks. | |
| 12:55:32 | AJaeger | any other nova core for two tiny cleanups, please? https://review.opendev.org/#/c/723206/2 and https://review.opendev.org/#/c/720725/1 ? | |
| 13:00:45 | brinzhang_ | AJeager:is this necessary? https://review.opendev.org/#/c/723295/ | |
| 13:00:54 | brinzhang_ | if not, I will abandon it | |
| 13:08:56 | openstackgerrit | Merged openstack/python-novaclient master: doc: Update Testing document https://review.opendev.org/723078 | |
| 13:18:41 | openstackgerrit | Stephen Finucane proposed openstack/nova master: Use compression by default for 'SshDriver' https://review.opendev.org/684393 | |
| 13:25:24 | stephenfin | sean-k-mooney: can you bump your vote on https://review.opendev.org/#/c/716223/ now? | |
| 13:27:48 | sean-k-mooney | stephenfin: yes i guess so did rc 1 go out on thursday | |
| 13:28:07 | stephenfin | sure did | |
| 13:28:14 | sean-k-mooney | cool +w | |
| 13:28:24 | stephenfin | ta | |
| 13:39:46 | gmann | nightmare_unreal: lyarwood yeah there was some window when grenade job merge and one more fix. now it is all green | |
| 13:40:24 | nightmare_unreal | yeah I just did recheck :) thanks | |
| 13:46:37 | gmann | zigo: hi, was that policy overridden ? that mentioned patch fixed the bug of passing the context project_id itself so that it is not allowed for all. | |
| 13:47:35 | zigo | gmann: The /etc/nova/policy.json file is the pristine one generated by the package (well, oslopolicy, this means). | |
| 13:48:16 | gmann | zigo: ok, can you paste that policy line for flavor manage ? | |
| 13:48:34 | AJaeger | brinzhang_: It's not necessary | |
| 13:49:38 | zigo | gmann: "os_compute_api:os-flavor-extra-specs:create": "rule:system_admin_api" | |
| 13:50:08 | zigo | On top of the file, there is: | |
| 13:50:08 | zigo | "system_admin_api": "role:admin and system_scope:all" | |
| 13:50:09 | gmann | zigo: ok, and 'system_admin_api' rule ? | |
| 13:50:56 | gmann | humm there should be deprecated rule of old RULE_ADMIN_API that is what we have as default | |
| 13:51:57 | gmann | but you said you generated the file via oslo policy tool right? it is oslopolicy-sample-generator correct | |
| 13:52:08 | zigo | Right ! | |
| 13:52:55 | zigo | gmann: That's what I did: | |
| 13:52:55 | zigo | https://salsa.debian.org/openstack-team/services/nova/-/blob/debian/ussuri/debian/rules#L64 | |
| 13:53:14 | zigo | (later, the postinst of the package takes that file from nova-common and puts it in /etc/nova) | |
| 13:53:36 | zigo | Hum... not even ... | |
| 13:53:45 | zigo | Directly pacakged into /etc/nova | |
| 13:54:11 | zigo | I should do the former, to have the file owned by root:nova / 640 though ... | |
| 13:56:45 | gmann | zigo: let me check if that tool adding the default rule or not. | |
| 13:59:25 | zigo | gmann: I've sent the generated policy.json file to our swift cluster if you want to look at it: https://www.swisstransfer.com/d/b80904d3-1f15-4f1f-98f0-7e1db308bb53 | |
| 14:13:59 | openstackgerrit | Kevin Zhao proposed openstack/nova master: [WIP] CI: add tempest-integrated-compute-aarch64 job https://review.opendev.org/714439 | |
| 14:14:40 | gmann | zigo: got it. that tool does not add the deprecated rules in sample file. | |
| 14:15:10 | zigo | gmann: And that's the issue ?!? | |
| 14:15:22 | gmann | zigo: expectation is you keep only override rule in the policy file and other rule let it rely on defaults | |
| 14:15:49 | zigo | Right. | |
| 14:15:51 | gmann | zigo: not issue i think. because you are providing the file with rule override with new defaults | |