Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2020-05-07
18:19:20 dansmith I'm surprised that nobody thinks that exposing python version, gcc version, distro, version, kernel version, etc to everyone unauthenticated is not a huge problem
18:20:02 dansmith because all those things are included in the healthcheck response without any recourse, as far as I can tell
18:20:18 artom dansmith, only if you configure detailed=True in the paste file
18:20:26 artom Which nobody should ever do
18:20:45 dansmith ah, okay, I thought that was a query param
18:21:03 artom It isn't - at least, based on what I saw
18:22:07 mriedem if your healthcheck api would give me some credentials i could do some health checking of my own, thanks
18:22:10 dansmith so the details of the healthchecks aren't either, other than the reason thing
18:25:41 dansmith okay, so in that case, the config causes us to return different data types
18:25:50 artom My own personal healthcheck api is to down a pint of beer. Still awak = 200 OK, pass out = 503 service unavailable
18:26:04 dansmith which is unfortunate.. if nobody should ever turn on detailed=true, then hopefully nothing will ever see the conflicting structure, but..
18:26:38 artom dansmith, I suppose you could if you're absolutely certain your Nova API endpoints aren't accessible from any unsafe network
18:26:48 artom Like, you trust your firewalls 110%
18:27:04 dansmith hmm, I don't see the if detailed switch in the html version tough
18:28:09 dansmith so the html version is always detailed?
18:28:43 dansmith or maybe the default template doesn't include those things?
18:29:39 dansmith oh I see, conditionals in the template, although I can't eye-parse what that all looks like by default
18:30:30 dansmith ah, I see the if detailed at the top
18:33:24 sean-k-mooney dansmith: so yes detailed is a vaild security consern. im not sure if we are required to exose any of the detailed info you listed
18:33:46 sean-k-mooney dansmith: e.g. if we can retrun different detailed infor per service that is less scare form a security point of view
18:33:56 sean-k-mooney liek the equivalent of a service list
18:34:03 dansmith sean-k-mooney: no, it looks like that's all off unless show_details, but it's one switch to turn on details which then exposes a ton of internals, which may surprise someone
18:35:14 sean-k-mooney ok so other then the last hour or so i have never bother looking at this in detail other then being aware it was configurable via api-paste.ini
18:35:43 sean-k-mooney so im ok with the idea of a healt check api endpoint. but im not sure it we want to use teh default implemantion
18:35:48 dansmith right, well, the fact that it is configurable with api-paste means this is not an emergency :)
18:35:51 sean-k-mooney them more i lean about it the mor ei think no
18:36:02 sean-k-mooney yep
18:36:19 sean-k-mooney operatoer can add it today if they want. if the should is a different matter
18:36:37 dansmith so, it's totally fine to have a spec, get people on the same page here, and make sure we have a plan for how this happens now, soon, and later
18:36:39 sean-k-mooney i thikn with out detailed=true its ok but does not tell you much
18:36:40 dansmith right
18:37:01 dansmith sean-k-mooney: it tells you basically nothing about heath.. other than that, it's great! :)
18:37:08 dansmith *health
18:37:43 sean-k-mooney ya it tells you apache is running or well the wsgi app
18:37:56 sean-k-mooney it does not tell you if nova is working
18:38:15 sean-k-mooney which is where wrighing our own plugin would come in
18:40:51 sean-k-mooney dansmith: since your about can you take a look at https://review.opendev.org/#/c/724188/4 and the follow up
18:41:10 sean-k-mooney its jsut silencing the amqp heartbeat warning
18:43:16 dansmith sean-k-mooney: omg, tell me you were the one that wrote "heartbeart" originally
18:43:34 sean-k-mooney hehe for one i think not
18:43:45 dansmith damn.
18:44:04 sean-k-mooney but i mean i would not put it past me that is a very sean thing to do
18:45:34 dansmith sean-k-mooney: jeez, I missed all the typos in the first commit message
18:46:09 dansmith sean-k-mooney: can we please get those fixed since you'regoing to backport I assume?
18:46:11 sean-k-mooney do you want to comment on them
18:46:17 dansmith lemme just fix inline
18:46:17 sean-k-mooney i can can fix them up with the other one
18:46:46 sean-k-mooney dansmith: ya we have a downstream bug for osp 13 so im going to back prot this upstream as far as people are ok with
18:47:25 sean-k-mooney dansmith: want to remvoe the +w on the first patch and ill fix all typos and resubmit shortly
18:47:36 openstackgerrit Dan Smith proposed openstack/nova master: Silence amqp heartbeat warning https://review.opendev.org/724188
18:47:46 dansmith sean-k-mooney: I just edited the bottom one to kick it out
18:47:53 sean-k-mooney ah ok cool
18:47:54 dansmith sean-k-mooney: I can do the top if you want or you can
18:48:02 dansmith sean-k-mooney: look over that edit I made and then I'll +W
18:48:56 sean-k-mooney damb it i misspelled heartbeats lol
18:49:17 dansmith you also misspelled "damn" :P
18:50:28 dansmith sean-k-mooney: okay re +Wd the bottom one
18:50:45 sean-k-mooney i am honestly surpised i write code that works sometimes. if it wasnt for the fact im consitet in adjcent lines it totally would not work
18:51:05 dansmith I honestly have no idea how you do, so.. there's that at least :)
18:51:20 dansmith keep working on that compiler for English and you'll be set :)
18:51:36 dansmith (and rich)
18:51:44 sean-k-mooney :)
18:56:13 openstackgerrit sean mooney proposed openstack/nova master: remove support of oslo.messaging 9.8.0 warning message https://review.opendev.org/724725
18:56:32 sean-k-mooney dansmith: stephenfin ^ ok that should have the typos fixed
18:56:49 dansmith no need to wake him, I'll get it
18:57:53 sean-k-mooney are we still holding backport to stable/ussuri until the upstream release by the way
18:58:33 sean-k-mooney this obviosly isnt a RC candiate but ill start preparing the backports tomorow and we can merge them whenever
18:59:12 melwitt yeah there shouldn't be non RC related backports to stable/ussuri until after GA IIRC
18:59:21 melwitt merged I mean
18:59:36 sean-k-mooney cool ill mark the backport as workflow -1 untill after then
18:59:59 melwitt +1
19:00:42 sean-k-mooney ok im going to get something to eat ttyl
20:21:29 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Moving functional jobs to Victoria testing runtime https://review.opendev.org/725372
21:50:33 openstackgerrit Merged openstack/nova stable/rocky: Add retry to cinder API calls related to volume detach https://review.opendev.org/725272
21:52:45 zigo sean-k-mooney: It's like this in Neutron because I wrote a wrong patch, that method in api-paste.ini is deprecated in the favor of the app thingy.
21:58:47 zigo dansmith: re [ exposing versions of verything ] what I'd like to see happen, with my operator hat, is having the healthcheck be 1/ unauth 2/ only answering for who I decided, that is only from the haproxy IP, with a check of the X-Forwarded-For header to make sure only who I decide can read the healthcheck (ie: not everyone on the internet, just 10.x.x.x in my case).
22:09:41 sean-k-mooney zigo: well api-paste.ini was the old way to config midileware in general
22:09:49 sean-k-mooney its still what nova uses
22:09:57 zigo sean-k-mooney: What's the new way then?
22:10:05 sean-k-mooney mainly because its not broke
22:10:43 sean-k-mooney well im not sure if it has been replace but i know some service decied to not make it configurable and just hard code the middel ware they support
22:11:05 sean-k-mooney so the remove the api-paste.ini file entirely
#openstack-nova - 2020-05-08
00:59:36 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Moving functional jobs to Victoria testing runtime https://review.opendev.org/725372
01:01:23 gmann stephenfin: melwitt ^^ it need 3.15 version as min to have testenv section expandable. I was about to do PR in tox before i saw it is already fixed and there in 3.15
01:40:27 openstackgerrit Ghanshyam Mann proposed openstack/nova master: Remove the duplicate policy initialization https://review.opendev.org/726272
01:40:55 gmann melwitt: ^^ this will fix the unit tests policy warning you observed. i searched in all unit tests and this is the only test doing the duplicate policy.init() which caused those warnings.
02:32:32 openstackgerrit Merged openstack/nova master: Silence amqp heartbeat warning https://review.opendev.org/724188
02:37:15 openstackgerrit Merged openstack/nova master: remove support of oslo.messaging 9.8.0 warning message https://review.opendev.org/724725
03:34:56 melwitt gmann: cool thanks. warnings down to 64 from 4488. are these warnings left intended then? https://zuul.opendev.org/t/openstack/build/a185bd1d5c0f4d4280a8c1dc35020240/log/job-output.txt#13255
06:12:50 openstackgerrit Jie Li proposed openstack/nova master: replace the "hide_hypervisor_id" to "hw:hide_hypervisor_id" https://review.opendev.org/722187
06:24:21 openstackgerrit Luyao Zhong proposed openstack/nova-specs master: spec update: virtual-persistent-memory https://review.opendev.org/726284
06:54:32 gibi good morning
06:54:40 gibi bauzas: ack have a nice PTO
07:54:28 gibi sean-k-mooney: hi! do you have bandwidth to re-fresh the spec moving patch? https://review.opendev.org/#/c/721278/ I can take over if you are busy with other things
09:11:26 openstackgerrit Merged openstack/nova master: Wait for all servers to be active when testing vGPUs https://review.opendev.org/726087
09:15:33 openstackgerrit Xinran WANG proposed openstack/os-resource-classes master: Add new resource class for QAT card. https://review.opendev.org/726314
09:19:37 openstackgerrit Stephen Finucane proposed openstack/nova master: replace the "hide_hypervisor_id" to "hw:hide_hypervisor_id" https://review.opendev.org/722187
09:19:37 openstackgerrit Stephen Finucane proposed openstack/nova master: docs: Resolve issue with deprecated extra specs https://review.opendev.org/726315
10:26:21 stephenfin gibi: Could you take a look at https://review.opendev.org/#/c/724381/ today?
10:26:43 gibi stephenfin: added to my queue

Earlier   Later