| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2020-08-26 | |||
| 12:06:09 | bauzas | most of the operations are admin-managed | |
| 12:06:26 | sean-k-mooney | in a cloud that would be atypical | |
| 12:06:30 | bauzas | so in this case, trying to solve all the problems is nice, but this comes with a cost | |
| 12:06:51 | sean-k-mooney | well one of the proposal was no move operations | |
| 12:06:55 | bauzas | but the ship has sailed. | |
| 12:07:04 | sean-k-mooney | which was very non admin frendly | |
| 12:07:22 | bauzas | I'm okay with creating a fresh new tpm device with move operations | |
| 12:07:32 | bauzas | what I'm struggling with is trying to reuse the existing data | |
| 12:07:43 | bauzas | this should be app-managed | |
| 12:07:44 | sean-k-mooney | the check is pretty simple | |
| 12:07:56 | sean-k-mooney | if anything changes version or type then data is not perserved | |
| 12:08:08 | sean-k-mooney | if the version and type do not change we copy it | |
| 12:08:20 | stephenfin | bauzas: well, don't worry about swift. None of that is done | |
| 12:08:24 | sean-k-mooney | the special case is shelve | |
| 12:08:31 | stephenfin | Is we might never do it. For now, shelve is simply blocked | |
| 12:08:36 | sean-k-mooney | where we ahve to store it somewhere which is swift | |
| 12:09:07 | sean-k-mooney | bauzas: the alternitive was to stick it in glance as a second image | |
| 12:09:31 | sean-k-mooney | or not store it at all | |
| 12:11:28 | bauzas | sean-k-mooney: yup, I saw in the series | |
| 12:11:35 | bauzas | the shelve case is the most complicated | |
| 12:11:50 | bauzas | I also have concerns with rebuild | |
| 12:12:18 | bauzas | trying to reuse the existing backup file is nice, but as a user I'd expect a fresh vTPM device if I rebuild | |
| 12:12:21 | sean-k-mooney | rebuild preseves the data if the version/type of tpm does not change | |
| 12:12:39 | sean-k-mooney | bauzas: that fails the do what hardware does guideline | |
| 12:12:46 | bauzas | this data is ephemeral, right? | |
| 12:12:52 | sean-k-mooney | bauzas: if you reinstall the os on your laptop your tpm is not cleared | |
| 12:13:12 | bauzas | ah, you're right, if you wanna mock the baremetal case | |
| 12:13:26 | bauzas | but in this case, all moves are just data loss | |
| 12:13:56 | bauzas | especially when I read https://specs.openstack.org/openstack/nova-specs/specs/victoria/approved/add-emulated-virtual-tpm.html#migrations-and-their-ilk | |
| 12:13:57 | bauzas | brr... | |
| 12:13:58 | sean-k-mooney | bauzas: one of the usecases for this is storing encyrption keys or certs for authentication | |
| 12:14:29 | sean-k-mooney | so if you have data volumes or use the tpm as a cert store and use rebuild to upgrade your application you would not want to loose that data | |
| 12:14:30 | bauzas | gibi: thoughts on keeping a list of CI maintainers somewhere in https://review.opendev.org/#/c/742407/5 | |
| 12:14:40 | bauzas | gibi: if you have remembrance of anything about this... | |
| 12:14:50 | openstackgerrit | Merged openstack/nova master: Fix indentation nits https://review.opendev.org/746765 | |
| 12:14:56 | openstackgerrit | Merged openstack/nova master: Remove deprecated scheduler filters https://review.opendev.org/744800 | |
| 12:15:04 | sean-k-mooney | bauzas: all move operation in the sepc are currently data perserving | |
| 12:15:21 | bauzas | I do understand the usecase | |
| 12:15:21 | sean-k-mooney | bauzas: we just copy the tpm data form one host to another | |
| 12:15:31 | bauzas | I'm just saying we are adding more than necessary | |
| 12:15:42 | bauzas | but again, the ship has sailed | |
| 12:16:01 | sean-k-mooney | bauzas: well it was felt that without perserving the data on move ops we could not resonably support them | |
| 12:16:02 | openstackgerrit | Merged openstack/nova master: tests: Add helpers for rebuild, cold migrate, and shelve/unshelve https://review.opendev.org/747792 | |
| 12:16:46 | sean-k-mooney | bauzas: complexity is a valid concern but i think the current semantics are what i would expect | |
| 12:19:51 | bauzas | sean-k-mooney: yup, and again, I won't bother | |
| 12:20:02 | bauzas | we had a consensus, I do respect it. | |
| 12:20:55 | efried | A lot of blood, sweat, and tears went into getting that spec to where it is. | |
| 12:21:14 | efried | Which involved some very heavy tradeoffs and compromises along the way. | |
| 12:21:33 | efried | There's some saying like, "You know it's a good compromise when nobody is happy." | |
| 12:22:57 | efried | Specifically to address the notion of pets: if you want a TPM, your VM is already a pet. | |
| 12:23:55 | gibi | efried: o/ | |
| 12:23:57 | efried | I will say that I am happy to see things like vTPM and provider config merging now -- two releases after I stopped working on them, which was multiple releases after I (and others) started working on them. | |
| 12:23:58 | elod | lyarwood: btw, should we wait this to merge too? >>> https://review.opendev.org/#/c/744550/ | |
| 12:24:25 | lyarwood | elod: that's less important tbh | |
| 12:24:42 | lyarwood | elod: just a nice to have, the other change fixes an issue introduced by an earlier change | |
| 12:26:01 | sean-k-mooney | efried: yep it will be nice to see them in the victoria project update hopefully as highlights | |
| 12:27:26 | elod | lyarwood: ok, then I've updated the release patch | |
| 12:28:38 | elod | the other patch unfortunately had to recheck anyway, so it would mean at least 3-4 hrs to merge... | |
| 12:32:11 | bauzas | gibi: lyarwood: stephenfin: -1 for relnote on https://review.opendev.org/#/c/631363/61 | |
| 12:33:13 | bauzas | stephenfin: I'm currently digging the long list of https://review.opendev.org/#/q/topic:bp/add-emulated-virtual-tpm+status:merged but I can't find where we defined docs | |
| 12:33:15 | gibi | ack, do we need to pull it out of the gate? | |
| 12:33:28 | gibi | bauzas: doc is in the next patch | |
| 12:33:38 | bauzas | ah right | |
| 12:33:39 | gibi | https://review.opendev.org/#/c/739213/17 | |
| 12:34:02 | bauzas | that's what I just saw | |
| 12:34:34 | bauzas | okay, I think we can leave as it is since lyarwood already approved the above patch but this sucks :( | |
| 12:34:58 | bauzas | and I personally feel we should rewrite the reno file to be more explicit by saying "sorry folks, only spawn as of now" | |
| 12:35:31 | bauzas | given what efried said on the life of pets, once people see TPM devices around in nova, they gonna start using those without knowing they're stukc | |
| 12:35:35 | bauzas | stephenfin: ^ | |
| 12:35:54 | gibi | bauzas: at least the doc is explicit about what does not work with vtpm | |
| 12:35:56 | bauzas | (provided we don't merge the move ops changes in the next 2 weeks obviously) | |
| 12:35:58 | stephenfin | bauzas: I can do a follow-up | |
| 12:36:05 | bauzas | stephenfin: wfm | |
| 12:36:11 | stephenfin | cool. gimme a sec | |
| 12:36:13 | bauzas | and yeah, docs are expicit | |
| 12:36:17 | bauzas | explicit even | |
| 12:36:58 | lyarwood | yeah I was under the impression that things were going to be enabled before GA anyway so it would be a waste of time detailing everything in the releasenote | |
| 12:37:05 | efried | BTW, it'll be a good idea to take your cues from jroll and penick if you have questions about how these are going to be used irl. They're the primary consumer driving this work, at least initially. | |
| 12:37:08 | lyarwood | as opposed to updating the docs | |
| 12:37:10 | bauzas | stephenfin: cool, and then say we support resize, you could then amend your renofile to include "spawn [and resize]" | |
| 12:37:38 | bauzas | lyarwood: I never predict on things being merged | |
| 12:37:45 | openstackgerrit | Lee Yarwood proposed openstack/nova master: rbd: Move rbd_utils out of libvirt driver under nova.storage https://review.opendev.org/746904 | |
| 12:37:46 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Add ability to download Glance images into the libvirt image cache via RBD https://review.opendev.org/574301 | |
| 12:37:46 | openstackgerrit | Lee Yarwood proposed openstack/nova master: Bring back allowed_direct_url_schemes in support of RBD image download https://review.opendev.org/728095 | |
| 12:37:47 | openstackgerrit | Lee Yarwood proposed openstack/nova master: zuul: Add devstack-plugin-ceph-compute-qcow2 to experimental queue https://review.opendev.org/743220 | |
| 12:38:05 | bauzas | lyarwood: and I'm on the likes to consider master as something usable as of now | |
| 12:38:05 | lyarwood | bauzas: right but my point is that it's easier to update the docs than a reno IMHO | |
| 12:38:18 | bauzas | lyarwood: but I know this is an utopia | |
| 12:38:35 | bauzas | lyarwood: well, it's just a file change, but either way | |
| 12:38:42 | bauzas | docs are good for getting all the details | |
| 12:38:49 | bauzas | release notes are good for knowing what's in the release | |
| 12:40:30 | openstackgerrit | Stephen Finucane proposed openstack/nova master: releasenotes: Detail support for server ops with vTPM https://review.opendev.org/748215 | |
| 12:40:44 | stephenfin | bauzas, gibi, lyarwood: nice and generic ^ | |
| 12:40:52 | bauzas | ++ | |
| 12:41:27 | sean-k-mooney | lyarwood: updating a reno is not that hard | |
| 12:41:40 | sean-k-mooney | we can even backport reno updtes it does actully work | |
| 12:41:44 | stephenfin | sean-k-mooney: it is tedious though | |
| 12:41:51 | bauzas | tedious in what ? | |
| 12:41:57 | stephenfin | especially when you've already got detailed info in docs | |
| 12:42:11 | bauzas | stephenfin: well, docs were giving me a 404 | |