| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-06-18 | |||
| 19:17:50 | sangeet | differnt pods | |
| 19:18:06 | sangeet | the file exist | |
| 19:18:45 | mordred | hrm. I'm not sure about that one - maybe someone else will know | |
| 19:19:34 | sangeet | sean-k-mooney efried .. please help ^^ | |
| 19:20:31 | efried | I'm no expert here, so this is just a guess: | |
| 19:20:49 | efried | If you put this in [identity], it means all the nova services will try to use it when talking to keystone. | |
| 19:20:50 | sangeet | I am up for trying anything | |
| 19:21:05 | efried | So you need it on every node that's running any nova service (conductor, compute, scheduler, whatever) | |
| 19:21:15 | efried | it == the crt fil. | |
| 19:21:16 | efried | file | |
| 19:21:41 | sangeet | so put cafile=/etc/nova/certs/ca.crt under identity | |
| 19:21:53 | efried | eh? I thought that's what you did, and it didn't work | |
| 19:22:00 | efried | Let's back up. | |
| 19:22:06 | efried | What change did you make that's leading to this error? | |
| 19:22:07 | sangeet | I ut it in compute and not in conductore | |
| 19:22:30 | sangeet | Let me try to put it under identity also | |
| 19:22:39 | efried | waitwait | |
| 19:22:52 | efried | I haven't been following this conversation, so I don't want to lead you down a rabbit hole. | |
| 19:22:59 | efried | What exactly have you changed so far? | |
| 19:25:52 | sangeet | I have Keystone deployed with SSL. In my nova.conf I set cafile=/etc/nova/certs/ca.crt for [neutron], [glance], [keystone_authtoken], [placement] | |
| 19:26:53 | efried | Hm, okay, I'm not sure about [keystone_authtoken] -- that's to set up the server side of the keystone service. | |
| 19:27:29 | efried | But nova talks to some of those services from multiple places -- conductor, scheduler, compute. | |
| 19:27:40 | efried | I don't remember offhand which ones talk to which ones from where. | |
| 19:29:09 | efried | Also note that conductor and compute use different config files by default (unless that's changed, or unless you're on an old release), so if you're running both, you'll want to set up both files. | |
| 19:29:46 | efried | But honestly, beyond that, I'm really out of my depth. sean-k-mooney would probably be a better resource. He is EU, so maybe try again "tomorrow". | |
| 19:30:22 | sangeet | I am using stein and I do have different configs as they are running on a different pods | |
| 19:31:44 | sean-k-mooney | efried: is that a hint i should go get dinner because it should be just cooked :) | |
| 19:32:12 | efried | sean-k-mooney: yes, you should not be working right now. | |
| 19:32:52 | efried | sangeet: TL;DR: I suspect you need the crt file available/accessible on the same file system as the nova.conf file you're editing. | |
| 19:33:03 | efried | same file system in the same container etc. | |
| 19:33:13 | sean-k-mooney | efried: hehe if i had started at 11 like i normally do i would argue but since i started at 8am today, night all o/ | |
| 19:33:32 | efried | But I'm also really not sure what mucking with [keystone_authtoken] did for you. | |
| 20:08:25 | sangeet | efried .. yes cafile needed to be set in identity section on conductor. It works now. | |
| 20:08:36 | efried | \o/ | |
| 20:09:05 | efried | Not to confuse things, but is it possible it's *only* required in [identity]? | |
| 20:10:13 | efried | I don't know whether/where we talk to keystone as an actual client; we may just be using it to set up the connection to the other services. But... I really don't know how that all works. | |
| 20:17:34 | mordred | efried: yeah - I'm gonna try to do an audit through of that | |
| 20:17:47 | efried | cool | |
| 20:17:49 | mordred | efried: cause right now I think it's ... well, if you don't know and I don't know - then likely nobody knows | |
| 20:18:11 | efried | lbragstad might :P | |
| 20:18:26 | efried | or cmurphy. Or other people who are no longer stacking. | |
| 20:24:13 | lbragstad | i actually didn't realize nova had an identity section *and* a keystone_authtoken section | |
| 20:24:58 | efried | IIUC, the former is for talking to keystone as a client, and the latter is for setting nova up as a server. | |
| 20:24:59 | lbragstad | (the keystone_authtoken section comes from keystonemiddleware) | |
| 20:25:50 | efried | tbh, I'm not sure where we're actually using the former from nova. But we must be, or sangeet's change wouldn't have fixed the problem... | |
| 20:27:08 | lbragstad | yeah - iirc (and i'm probably dated here) [keystone_authtoken] is only invoked by keystonemiddleware to fetch information about tokens out of keystone | |
| 20:31:24 | lbragstad | ahh - it looks like the [identity] section is used to validate project IDs | |
| 20:31:39 | efried | "used" -- by nova? | |
| 20:32:07 | efried | or by, like, everyone who has one? | |
| 20:32:20 | lbragstad | https://opendev.org/openstack/nova/src/branch/master/nova/api/openstack/identity.py | |
| 20:33:18 | efried | Interesting. | |
| 20:33:35 | lbragstad | maybe? i might not be following this properly | |
| 20:34:35 | lbragstad | i think this is what i was looking at https://docs.openstack.org/nova/latest/configuration/config.html#keystone | |
| 20:34:37 | efried | Oh, that's for sure a place where we're using the [identity] section to create a ksa adapter that talks as a client to the keystone service's API. | |
| 20:35:07 | lbragstad | https://docs.openstack.org/nova/latest/configuration/config.html#keystone-authtoken is the keystonemiddleware section | |
| 20:35:11 | efried | Yeah, some layer of this translates $service_name to $project_name or vice versa | |
| 20:35:12 | efried | yes. | |
| 20:35:54 | lbragstad | i don't actually see an [identity] section | |
| 20:35:58 | lbragstad | in the configuration reference | |
| 20:36:06 | lbragstad | i see [keystone] and [keystone_authtoken] | |
| 20:36:19 | efried | I believe you're allowed to use either [identity] or [keystone] for anything we load up via get_{sdk|ksa}_adapter. | |
| 20:36:36 | efried | I mean, [$service] or [$project] | |
| 20:36:37 | lbragstad | oh - so service types and service names are interchangable? | |
| 20:36:48 | lbragstad | interchangeable* | |
| 20:36:54 | efried | only if we're using get_{sdk|ksa}_adapter. | |
| 20:37:02 | efried | Which I think we are for everything except cinder at this point. | |
| 20:37:07 | lbragstad | ok | |
| 20:37:38 | efried | And by "we" I mean "they". I don't work here anymore :P | |
| 20:38:09 | lbragstad | :) | |
| 21:02:16 | mordred | efried: I was about to ask you about cinder | |
| 21:02:22 | mordred | efried: I'm guessing I should put that on my list too | |
| 21:02:37 | efried | I made several attempts at it over the years, but they never quiiite landed. | |
| 21:02:42 | mordred | (mostly noticed that there's a weird os-region-name option) | |
| 21:02:50 | efried | I think there's still an open change under my name | |
| 21:03:09 | mordred | efried: cool. maybe I'll finish that - with your name on it it'll have more credibility | |
| 21:03:12 | efried | There were significant difficulties with the (in)compatibility between ksa and cinderclient. | |
| 21:03:16 | efried | hah! | |
| 21:03:24 | mordred | in fact, I might just push up changes for this forging the author to say they're from you | |
| 21:03:38 | mordred | efried: "surprising" | |
| 21:04:30 | efried | https://review.opendev.org/508345 | |
| 21:04:30 | efried | https://review.opendev.org/655985 | |
| 21:04:30 | efried | (I haven't opened those, they're just the ones on my dashboard with 'cinder' in the title) | |
| 21:26:36 | melwitt | dansmith: left comments on the bottom two rbd multi store patches. bottom one is a docstring update needed, next patch looks to be one small case of missing test coverage and a couple doc-related things | |
| 21:39:41 | dansmith | melwitt: thanks | |
| 21:45:12 | openstackgerrit | Dan Smith proposed openstack/nova master: Plumb image import functionality through our glance module https://review.opendev.org/731550 | |
| 21:45:13 | openstackgerrit | Dan Smith proposed openstack/nova master: Make libvirt able to trigger a backend image copy when needed https://review.opendev.org/656998 | |
| 22:18:18 | openstackgerrit | Marcin Juszkiewicz proposed openstack/nova master: libvirt: check for AMD SEV only on x86-64 https://review.opendev.org/714425 | |
| 22:37:21 | melwitt | gmann: is/was there a change yet to make stable/stein grenade n-v? wondering if it's safe to recheck changes yet | |
| 22:37:39 | melwitt | also note that nova-live-migration is failing on stable/stein too | |
| 22:38:02 | melwitt | saying virtualenv missing | |
| 22:38:20 | gmann | melwitt: i am trying to get working on train with this and tomorrow I am planning for making it n-v on stein - https://review.opendev.org/#/c/736284/9 | |
| 22:38:33 | melwitt | ack | |
| 22:39:11 | gmann | nova-live-migration is difficult one as that is legacy job, on devstack, grenade we fixed that error - https://review.opendev.org/#/c/736750/1 | |
| 22:41:20 | gmann | melwitt: but there are multiple updates happening on devstack/grenade and image side. so let's see how it behaves once we get all those in | |
| 22:41:42 | gmann | clark is updating images also which were not present due to disk full. | |
| #openstack-nova - 2020-06-19 | |||
| 00:29:53 | openstackgerrit | Wenping Song proposed openstack/nova master: delete sub resource provider when delete resource provider https://review.opendev.org/719163 | |
| 03:21:28 | openstackgerrit | Wenping Song proposed openstack/nova master: delete sub resource provider when delete resource provider https://review.opendev.org/719163 | |
| 04:38:05 | arjunbaindur | hey, have a question about configuring PCI passthrough. We have a device that has 2 functions. On the hypervisor, the PCI address has it on same bus and same slot. When it shows up inside the VM, the PCI address has it under different slots | |
| 04:39:01 | arjunbaindur | for example, suppose device has two functions at 83:00.0 and 83:00.1 | |
| 04:40:20 | arjunbaindur | Under the VM, the devices show up under different slots, for example 0:5.0 and 0:6.0 | |