| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-01-26 | |||
| 12:25:08 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for resource classes https://review.opendev.org/c/openstack/placement/+/760239 | |
| 12:25:09 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for traits https://review.opendev.org/c/openstack/placement/+/760241 | |
| 12:25:10 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for usage https://review.opendev.org/c/openstack/placement/+/760242 | |
| 12:25:11 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Allow project readers to see project-specific usages https://review.opendev.org/c/openstack/placement/+/771964 | |
| 12:25:12 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Refactor usage tests to properly test project personas https://review.opendev.org/c/openstack/placement/+/772061 | |
| 12:25:13 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Remove the deprecated 'placement' rule https://review.opendev.org/c/openstack/placement/+/772333 | |
| 12:25:14 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Deprecate 'admin_api' rule https://review.opendev.org/c/openstack/placement/+/772334 | |
| 12:25:15 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Don't persist default rule changes in tests https://review.opendev.org/c/openstack/placement/+/772508 | |
| 12:27:41 | gibi | sean-k-mooney: replied here too https://review.opendev.org/c/openstack/nova/+/769720 | |
| 12:55:20 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for resource providers https://review.opendev.org/c/openstack/placement/+/760240 | |
| 12:55:21 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for aggregates https://review.opendev.org/c/openstack/placement/+/760235 | |
| 12:55:22 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for allocations https://review.opendev.org/c/openstack/placement/+/760236 | |
| 12:55:23 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for allocation candidates https://review.opendev.org/c/openstack/placement/+/760237 | |
| 12:55:24 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for inventories https://review.opendev.org/c/openstack/placement/+/760238 | |
| 12:55:25 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for resource classes https://review.opendev.org/c/openstack/placement/+/760239 | |
| 12:55:26 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for traits https://review.opendev.org/c/openstack/placement/+/760241 | |
| 12:55:27 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Implement secure RBAC for usage https://review.opendev.org/c/openstack/placement/+/760242 | |
| 12:55:28 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Allow project readers to see project-specific usages https://review.opendev.org/c/openstack/placement/+/771964 | |
| 12:55:29 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Refactor usage tests to properly test project personas https://review.opendev.org/c/openstack/placement/+/772061 | |
| 12:55:30 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Remove the deprecated 'placement' rule https://review.opendev.org/c/openstack/placement/+/772333 | |
| 12:55:31 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Deprecate 'admin_api' rule https://review.opendev.org/c/openstack/placement/+/772334 | |
| 12:55:51 | gibi | sean-k-mooney: and here too https://review.opendev.org/c/openstack/nova/+/756530 | |
| 13:02:26 | stephenfin | johnthetubaguy: If you have any time in the next fortnight, your attention would be appreciated on https://review.opendev.org/q/topic:%22secure-rbac%22+project:openstack/placement+is:open | |
| 13:09:33 | sean-k-mooney | gibi: you are right i did miss the retry decorator | |
| 13:11:56 | sean-k-mooney | gibi: and yes i know mypy is smart enough to deduce types when you initalise something directly but i dont think we should actully rely on that in general | |
| 13:12:14 | sean-k-mooney | gibi: that is just a prefernce however not a -1 thing | |
| 13:13:00 | sean-k-mooney | well i dont know i change my mind on that some times | |
| 13:13:28 | sean-k-mooney | i do sometimes use that to say it returns/accpets dict or list | |
| 13:20:53 | gibi | mypy requires you to add typehint for func signature (or it will use Any) but in function body mypy does proper deducing or will raise an error and ask you to add hints | |
| 13:21:26 | gibi | if the type is not clear | |
| 13:22:02 | sean-k-mooney | ya | |
| 13:23:56 | openstackgerrit | Merged openstack/nova stable/victoria: compute: Lock by instance.uuid lock during swap_volume https://review.opendev.org/c/openstack/nova/+/758730 | |
| 13:26:25 | sean-k-mooney | gibi: +1 on both of those reviews | |
| 13:28:56 | gibi | thanks | |
| 13:30:17 | sean-k-mooney | lyarwood: bauzas: stephenfin and I are both +2/+1 on gibi's qos seriese https://review.opendev.org/q/topic:%22bp%252Fsupport-interface-attach-with-qos-ports%22+(status:open%20OR%20status:merged) do either of ye have time to review them and be the second +2+w | |
| 13:30:44 | gibi | would be appreciated ^^ | |
| 13:58:45 | gmann | brinzhang: ack, with change in routes.py it should detect the new API. let me check today | |
| 14:11:51 | nightmare_unreal | brinzhang: can you help me with this one ? https://storyboard.openstack.org/#!/story/2008553 | |
| 14:28:56 | bauzas | sean-k-mooney: ack, sorry for the delay, but I'll try to look at it | |
| 14:29:31 | bauzas | I actually promised some time for gibi :D | |
| 14:30:28 | sean-k-mooney | bauzas: :) while the series is longish most patches are small and self contaiend so its quite straight forward to review. | |
| 14:44:38 | openstackgerrit | Merged openstack/nova master: db: Compact Icehouse database migrations https://review.opendev.org/c/openstack/nova/+/758394 | |
| 14:49:35 | openstackgerrit | Lance Bragstad proposed openstack/placement master: trivial: Remove TODO in LegacyRBACPolicyFixture https://review.opendev.org/c/openstack/placement/+/772535 | |
| 15:03:10 | stephenfin | lbragstad: Replied on https://review.opendev.org/c/openstack/placement/+/760238 | |
| 15:03:40 | lyarwood | sean-k-mooney: yup I can try to look today | |
| 15:15:05 | lbragstad | stephenfin ack - thanks | |
| 15:47:33 | lyarwood | gibi / dansmith ; https://review.opendev.org/c/openstack/nova/+/771837 should be ready to go now both of the tests are fixed | |
| 15:48:47 | gibi | lyarwood: ack | |
| 15:58:21 | openstackgerrit | Stephen Finucane proposed openstack/placement master: Expand legacy tests for inventories https://review.opendev.org/c/openstack/placement/+/772567 | |
| 15:58:23 | stephenfin | lbragstad: ^ | |
| 15:58:43 | stephenfin | That's super tedious work. I don't envy you /o\ | |
| 15:58:59 | lbragstad | :) | |
| 15:59:11 | stephenfin | (and won't be pulling my +2s because they're missing, tbh. I can do without them) | |
| 15:59:30 | lbragstad | i'm in the middle of attempting the same for cinder - but thanks for proposing those | |
| 16:00:07 | lbragstad | yeah - i think that series looks good and i can propose the followup with additional coverage | |
| 16:00:15 | stephenfin | agreed | |
| 16:00:25 | stephenfin | we'll see what gmann thinks | |
| 16:05:52 | dansmith | lyarwood: question for you here: https://review.opendev.org/c/openstack/tempest/+/771958 | |
| 16:06:00 | dansmith | not sure I understand what actually changed | |
| 16:07:41 | gmann | stephenfin: lbragstad ack, I will check config things on policy init locally as config setting come into pic when test run and start the policy enforcement instead of policy__init__. but I am ok with the current approach. | |
| 16:07:50 | gmann | will review those today | |
| 16:08:49 | gmann | config things are similar to what we do in nova. init policy first and then switch the config flag for enforce scope | |
| 16:10:47 | ysirndjuro | Is there a way to bake "cpu mode='host-passthrough'" flag inside an image or flavor for nested virt support in an on demand VM, so far the only docs i've found have been from devstack and involve direct virsh edit to an existing VM. | |
| 16:12:46 | ysirndjuro | or do I just slap 'cpu_mode=host-passthrough' in nova.conf and call it a day | |
| 16:13:04 | sean-k-mooney | ysirndjuro:no that is intetniolly not supported | |
| 16:13:22 | lyarwood | dansmith: the tests were just creating a fresh image instead of reusing CONF.compute.image_ref, I assumed that borked caching in the job and resulted in us hitting the never_download_image_if_on_rbd check | |
| 16:13:42 | sean-k-mooney | users cannot set the cpu_mode | |
| 16:13:49 | sean-k-mooney | so we dont support it in the image | |
| 16:13:51 | dansmith | lyarwood: I don't think so | |
| 16:14:20 | dansmith | lyarwood: in that job, we upload the image initially to the file backend in glance, and make nova auto copy it to ceph on the first boot | |
| 16:14:37 | dansmith | lyarwood: so just creating another image in the file repo should do the same thing | |
| 16:14:42 | sean-k-mooney | and we dont support setting the mode in the flavor since its specific to libvirt and we dont want to encurage a different flavor per cpu model | |
| 16:15:31 | sean-k-mooney | ysirndjuro: so either set it in your nova.conf via your local.conf | |
| 16:15:40 | dansmith | lyarwood: I'm thinking there's some cinder interaction that tries to do something with that image before it has been moved to ceph, but then your change won't actually make any difference if that test happens to run before any other job that just boots an instance from the normal image | |
| 16:15:46 | sean-k-mooney | or modify it and restart n-cpu | |
| 16:15:56 | ysirndjuro | sean-k-mooney: thx, yeah figured as much there, was leaning towards a flavor config, feelsbad | |
| 16:16:55 | sean-k-mooney | ysirndjuro: this is more or less my default local.conf http://paste.openstack.org/show/801996/ | |
| 16:16:59 | lyarwood | dansmith: pretty sure the volume is empty | |
| 16:17:02 | lyarwood | dansmith: let me check | |
| 16:17:19 | sean-k-mooney | ysirndjuro: it has it set so you can copy that | |
| 16:17:57 | lyarwood | dansmith: yeah the volume shouldn't reference any image ref | |
| 16:18:33 | dansmith | lyarwood: okay well then I don't see what your change would actually do differently (in the case where that test happens to run first | |
| 16:18:33 | lyarwood | 49942 Jan 20 22:28:53.068420 ubuntu-focal-rax-iad-0022637570 nova-compute[94729]: WARNING nova.virt.libvirt.driver [None req-3a8ebd8e-b22a-446f-ad35-16b12e7a1182 tempest-TestEncryptedCinderVolumes-88193216 tempest-TestEncryptedCinderVolumes-88193216] Image 0d4ef007-9ffd-4b8f-9bd2-1d9e3fca5f1b is not on my ceph and [workarounds]/never_download_image_if_on_rbd=True; refusing to fetch and | |
| 16:18:34 | lyarwood | upload.: nova.exception.ImageUnaccep table: Image 0d4ef007-9ffd-4b8f-9bd2-1d9e3fca5f1b is unacceptable: Image is not raw format | |
| 16:18:48 | lyarwood | ^ that's the error with the original image | |
| 16:18:53 | dansmith | yeah | |
| 16:19:23 | dansmith | is that in a boot or something else? | |
| 16:19:46 | lyarwood | that's on boot | |
| 16:20:10 | ysirndjuro | sean-k-mooney: thx for the sample, i've seen that config option already, but was looking to avoid enabling it on every vm on that node, just specific use case where it's needed for CI/CD to run packer builds, but with on-demand capability versus having an openstack admin configure every vm CI spins up | |
| 16:20:12 | sean-k-mooney | dansmith: by the way i havent forgoten about testing your devstack patch. im going to test it slightly differently then the gate would in that i did a stack on the node, now im going to unstack and stack again use that as my base time and then unstace and stack with your patch | |
| 16:20:15 | dansmith | lyarwood: so nova should ask glance to copy that to the ceph store first, just like it initially did for the image_ref one | |
| 16:20:22 | dansmith | sean-k-mooney: thanks | |
| 16:20:26 | sean-k-mooney | dansmith: that should elimiate any network overhead | |
| 16:21:43 | lyarwood | dansmith: would that be rejected if the disk format isn't RAW? | |
| 16:21:50 | dansmith | lyarwood: ...if it's a normal boot all the same as the original.. that's why I'm wondering what else might be different | |
| 16:21:52 | sean-k-mooney | ysirndjuro: you can kind fo do what you want if you define your own cpu model in the libvirt directorys | |
| 16:22:07 | dansmith | lyarwood: mmmmaybe, what format is the image they created? | |
| 16:22:43 | dansmith | lemme look at the conditions for that again | |
| 16:22:48 | sean-k-mooney | ysirndjuro: if you use cpu_mode=custom then cpu_model=<default model you want>,<nested-virt-modele> then have a special flavor that request vmx i belive that willl work | |
| 16:23:08 | lyarwood | dansmith: I see qcow2 in the request to glance | |