| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-01-27 | |||
| 17:45:31 | sean-k-mooney | but i shoudl not have to add them to my user explictly | |
| 17:46:44 | sean-k-mooney | so im very confused by https://review.opendev.org/c/openstack/placement/+/760240/21/placement/tests/functional/gabbits/resource-provider-legacy-rbac.yaml#9 | |
| 17:47:09 | stephenfin | sean-k-mooney: I'm pretty sure it is implied, and because it's implied both the main role and the implied roles are included in the HTTP_X_ROLES header in CSV form | |
| 17:47:57 | stephenfin | so the implied link is encoded in keystone, and oslo.context and oslo.policy don't need to know about it. They can simply check for the role they care about | |
| 17:48:05 | sean-k-mooney | right i think including them in the x roles header explictly is odd | |
| 17:48:21 | lbragstad | if you have the admin role on a project and you look at the token response, you'll see keystone expands those out for you | |
| 17:48:42 | stephenfin | Yeah, that seems perfectly sensible to me | |
| 17:48:51 | lbragstad | the reason why we set them in the headers explicitly is so you don't have a dependency on keystone via keystonemiddleware | |
| 17:48:58 | sean-k-mooney | lbragstad: ok so the gabit test data is not the input date for the user to create | |
| 17:49:07 | sean-k-mooney | its a mix of both the input and the expect output | |
| 17:49:36 | lbragstad | the header input should represent what keystonemiddleware would translate | |
| 17:49:43 | lbragstad | since we're cutting that out of these tests | |
| 17:49:55 | sean-k-mooney | ah ok | |
| 17:49:58 | sean-k-mooney | can we add that as a note | |
| 17:50:01 | stephenfin | sean-k-mooney: You're simulating the request. In a real-world deployment keystonemiddleware would add those headers for you | |
| 17:50:04 | sean-k-mooney | i was not expect use to cut that out | |
| 17:50:05 | stephenfin | yeah | |
| 17:50:09 | sean-k-mooney | since these are functional tests | |
| 17:50:11 | sean-k-mooney | not unit tests | |
| 17:50:18 | sean-k-mooney | so we normally would not mock that | |
| 17:50:37 | stephenfin | *nova functional tests | |
| 17:50:40 | kashyap | gibi: Also, just to note, chengsheng, the reporter has done real live migration tests w/ the patch. I've discussed with them in December | |
| 17:50:48 | lbragstad | if placement wants to add functional test with keystone - then i'd say just use tempest? | |
| 17:50:57 | lbragstad | functional tests* | |
| 17:50:58 | stephenfin | sean-k-mooney: https://review.opendev.org/c/openstack/placement/+/760240/22/placement/auth.py | |
| 17:51:08 | sean-k-mooney | well im not suggesting keystone i was expecting a test fixture | |
| 17:51:21 | sean-k-mooney | that would do the translation instead of use doing it by hand | |
| 17:51:40 | sean-k-mooney | but if you add a note to the test saying that is what happeing then im ok with it | |
| 17:52:07 | sean-k-mooney | these vars are bing used as the request headers in the test | |
| 17:52:24 | gmann | in nova also we prepared the context like that by adding admin, member, reader in admin or so | |
| 17:52:32 | sean-k-mooney | so i was expecting them to be differnet | |
| 17:52:47 | stephenfin | we could rework that test fixture to associate known usernames with specific roles and set the headers that way, but what lbragstad has done is far more obvious IMO | |
| 17:52:57 | gmann | https://github.com/openstack/nova/blob/master/nova/tests/unit/policies/base.py#L57 | |
| 17:53:23 | sean-k-mooney | stephenfin: the bit i was missing was keystone auto expanding all the roles you have and flatening them | |
| 17:53:45 | openstackgerrit | Lee Yarwood proposed openstack/nova master: WIP zuul: Increase SWIFT_LOOPBACK_DISK_SIZE within nova-lvm job https://review.opendev.org/c/openstack/nova/+/772702 | |
| 17:53:47 | sean-k-mooney | i was expecting that to be a list of your direct roles only | |
| 17:54:33 | sean-k-mooney | lbragstad: if i add a role i dont have to that maully keystone midelware will validate that on the project api side right | |
| 17:54:51 | sean-k-mooney | lbragstad: e.g. it will hit keystone to valideate it | |
| 17:55:01 | sean-k-mooney | as part of normal token validation | |
| 17:55:41 | lbragstad | sean-k-mooney ksm cleans out those headers and repopulates them based on the token validation response | |
| 17:55:42 | sean-k-mooney | assuming yes then i think i understand how the tests are workign now | |
| 17:56:22 | sean-k-mooney | lbragstad: ok so the imporant thin is in the project we can trust the roles in the context because ksm has checked for us | |
| 17:56:31 | lbragstad | https://opendev.org/openstack/keystonemiddleware/src/branch/master/keystonemiddleware/auth_token/_request.py#L75 | |
| 17:56:38 | sean-k-mooney | thats what i was expecting but just wanted to confirm | |
| 17:56:49 | lbragstad | https://opendev.org/openstack/keystonemiddleware/src/branch/master/keystonemiddleware/auth_token/_request.py#L224-L227 | |
| 17:57:29 | openstackgerrit | Stephen Finucane proposed openstack/placement master: policy: Add note about keystone's expansion of roles https://review.opendev.org/c/openstack/placement/+/772752 | |
| 17:57:29 | sean-k-mooney | lbragstad: thanks perfect | |
| 17:57:37 | lbragstad | yep | |
| 17:57:40 | stephenfin | sean-k-mooney: lemme know if that's useful ^ | |
| 17:58:04 | stephenfin | We can refine wording if so | |
| 17:58:20 | sean-k-mooney | stephenfin: yep no that make sense to me | |
| 17:58:41 | sean-k-mooney | im not sure why gerrit thinks you change the last 3 lins | |
| 17:59:04 | sean-k-mooney | i should have a , after yep | |
| 17:59:30 | stephenfin | Oh no, I really did add spacing :) | |
| 17:59:37 | stephenfin | a'ight, and with that | |
| 17:59:56 | stephenfin | kashyap: I'll take a look at that tomorrow | |
| 18:00:13 | kashyap | stephenfin: Thank you; it is fixing some real gnarly problem | |
| 18:35:43 | openstackgerrit | Merged openstack/nova stable/victoria: compute: Don't detach volumes when RescheduledException raised without retry https://review.opendev.org/c/openstack/nova/+/764612 | |
| 19:15:01 | gmann | stephenfin: lbragstad replied on this. as per my finding/run oslo.policy does not change rule's self.check_str even it only change rule's self.check which is internal attribute for oslo policy to play with - https://review.opendev.org/c/openstack/placement/+/772508/1//COMMIT_MSG#13 | |
| 19:15:53 | gmann | I ran few scenario and did not find oslo policy changing defined rule check_str. | |
| 19:18:10 | openstackgerrit | Merged openstack/nova stable/victoria: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761809 | |
| 19:37:40 | openstackgerrit | melanie witt proposed openstack/nova stable/ussuri: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761810 | |
| 20:24:28 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/train: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761811 | |
| 20:31:13 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/train: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761811 | |
| 20:34:14 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/stein: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761812 | |
| 20:35:35 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/rocky: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761813 | |
| 20:37:04 | openstackgerrit | Vlad Gusev proposed openstack/nova stable/queens: Use subqueryload() instead of joinedload() for (system_)metadata https://review.opendev.org/c/openstack/nova/+/761814 | |
| 21:08:17 | openstackgerrit | Merged openstack/nova stable/stein: Update pci stat pools based on PCI device changes https://review.opendev.org/c/openstack/nova/+/761727 | |
| 22:04:56 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: WIP: extra specs/image pros: add `socket PCI NUMA affinity https://review.opendev.org/c/openstack/nova/+/772748 | |
| 22:04:56 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: WIP: Add `socket` PCI NUMA affinity policy request prefilter https://review.opendev.org/c/openstack/nova/+/772749 | |
| 22:04:57 | openstackgerrit | Artom Lifshitz proposed openstack/nova master: WIP: pci: implement the SOCKET NUMA affinity policy https://review.opendev.org/c/openstack/nova/+/772779 | |
| 22:15:01 | openstackgerrit | Ghanshyam proposed openstack/nova master: DNM:try l-c with direct deps https://review.opendev.org/c/openstack/nova/+/772780 | |
| 22:48:37 | openstackgerrit | Ghanshyam proposed openstack/placement master: Move policy deprecation to base rules https://review.opendev.org/c/openstack/placement/+/772784 | |
| 23:06:56 | gmann | brinzhang_: few comments left to fix in https://review.opendev.org/c/openstack/nova/+/764292 | |
| #openstack-nova - 2021-01-28 | |||
| 00:25:16 | brinzhang_ | gmann: ack, thanks | |
| 00:25:22 | brinzhang_ | gmann: https://review.opendev.org/c/openstack/nova/+/766726/13/nova/api/openstack/compute/views/servers.py | |
| 00:25:41 | brinzhang_ | I was confusing with this comments, what does your mean? | |
| 00:27:03 | gmann | brinzhang_: i commented in this file that we do not need to change get_instance_security_groups method itself https://review.opendev.org/c/openstack/nova/+/766726/11/nova/network/security_group_api.py#279 | |
| 00:27:39 | gmann | we get the sg from neutron and neutron does return tenant_id and project_id in sg response but both are same thing | |
| 00:28:01 | gmann | they kept both for backward compatibility as they do not have microversion concept. | |
| 00:29:19 | brinzhang_ | gmann:in "def _convert_to_nova_security_group_format(" we update the security_group[], does it need to be consider? | |
| 00:29:58 | gmann | brinzhang_: this one right https://review.opendev.org/c/openstack/nova/+/766726/11/nova/network/security_group_api.py#279 | |
| 00:30:35 | gmann | we can just change L275 from 'nova_group['project_id'] = security_group['tenant_id']' -> nova_group['project_id'] = security_group['project_id'] | |
| 00:31:12 | gmann | and without microversion condition. that way we do not need to change the signature of any interface | |
| 00:31:48 | brinzhang_ | I think I get you idea | |
| 00:31:59 | brinzhang_ | s/you/your/ | |
| 00:32:04 | gmann | cool | |
| 00:33:08 | brinzhang_ | in neutron api, we dont need to be consider the nova microversion, we just need to get the sg keep the same way | |
| 00:33:36 | gmann | yeah and fetch project_id from neutron sg instead of tenant_id | |
| 00:34:24 | gmann | because at some point in future neutron also will remove the tenant_id form their API so we can take care of that in advance | |
| 00:34:37 | brinzhang_ | yeah | |
| 00:34:45 | gmann | brinzhang_: and in first commit, we can remove the 2.89 sample. i commented in previous PS also. sorry about asking for that in initial reiview. this one - https://review.opendev.org/c/openstack/nova/+/764292/14/nova/tests/functional/api_sample_tests/test_servers.py#659 | |
| 00:36:05 | brinzhang_ | gmann: np, will update in next patch | |
| 00:36:12 | gmann | brinzhang_: thanks | |
| 00:36:56 | brinzhang_ | gmann: did you review the os-simple-project-suage patch? the router change, and that hit the test issue? | |
| 00:38:01 | gmann | brinzhang_: I did until 766726 but I will check the simple-project-usage tomorrow | |
| 00:38:04 | brinzhang_ | that I requested 2.90, but it always goto <=2.89 index or show APis | |
| 00:38:51 | gmann | humm strange | |
| 00:38:52 | brinzhang_ | gmann: dont worry^, my env has broken yesterday, firstly, I will restore my env | |
| 00:39:11 | gmann | I will debug that tomorrow. dinner time for me | |