| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-02-03 | |||
| 17:50:55 | melwitt | oh :\ | |
| 17:50:57 | sean-k-mooney | so we can use the ssh public key here | |
| 17:51:07 | sean-k-mooney | but we coudl use soemthign else | |
| 17:51:11 | sean-k-mooney | e.g. a keystore | |
| 17:51:31 | sean-k-mooney | or static encyption with a fixed key seeded with the ssk public key or somehtihng | |
| 17:52:22 | melwitt | yeah.. I guess I'm slowly remembering this spec, and this aspect of it is "better than nothing" I guess (comparing with no novnc password at all) | |
| 17:52:45 | sean-k-mooney | is fixed key enabled by default | |
| 17:53:07 | sean-k-mooney | because if it is using castalain with fixed key to store it would be better | |
| 17:53:17 | sean-k-mooney | as that would allowy you to plug in barbican to do it proably too | |
| 17:53:28 | sean-k-mooney | that said as long as we call this out | |
| 17:53:39 | sean-k-mooney | and ensure we dont make the password visable in ways we did not intend | |
| 17:53:52 | sean-k-mooney | then i think its ok to improve it later | |
| 17:53:54 | melwitt | I dunno if it is enabled by default. I don't know how to tell | |
| 17:54:20 | sean-k-mooney | the nova keysotre cofnig? thats a thing i think | |
| 17:54:28 | prometheanfire | any progress on updating mock (nova still holds back the 3.0.5 -> 4.0.3 update)? | |
| 17:54:48 | sean-k-mooney | prometheanfire: we were tryihng to stop using it entirly at one point | |
| 17:54:50 | melwitt | yeah there's a fixed_key conf option but it doesn't have a default value, so that means it's not enabled by default? | |
| 17:55:21 | melwitt | prometheanfire: I have a change to the one test that is failing that I need to upload | |
| 17:55:44 | prometheanfire | sean-k-mooney: iirc it was given up on at some point (using the built in) | |
| 17:56:17 | prometheanfire | melwitt: kk, feel free to add me to the review (or ping me) :D | |
| 17:56:18 | sean-k-mooney | prometheanfire: i am not aware of a reason not tooo | |
| 17:56:34 | sean-k-mooney | prometheanfire: i suspect if it was it was just capasity | |
| 17:56:35 | melwitt | will do prometheanfire | |
| 17:56:59 | sean-k-mooney | melwitt: ya not sure the https://docs.openstack.org/nova/latest/configuration/config.html#key-manager config is what i was thinking | |
| 17:57:21 | sean-k-mooney | i was hoptin we had a default fixed key version that was always there if you dont use a real one | |
| 17:57:52 | prometheanfire | sean-k-mooney: well, using the built-in is always preferred | |
| 17:58:14 | melwitt | sean-k-mooney: oh I see | |
| 17:58:17 | sean-k-mooney | prometheanfire: yep we only used mock the lib for python 2 compatiablity | |
| 17:58:58 | sean-k-mooney | melwitt: anyway i dont think we have a basic intree keymanager that implemnt the castalin api that we can just assume is a thing | |
| 17:59:37 | sean-k-mooney | melwitt: well we have https://github.com/openstack/nova/blob/master/nova/keymgr/conf_key_mgr.py | |
| 18:00:02 | lyarwood | sean-k-mooney: sorry was afk, instance.metadata != instance.system_metadata so I'm not sure if it's going to have any impact | |
| 18:00:39 | sean-k-mooney | lyarwood: right but instace.metadata is the place we store metata we set with --property | |
| 18:01:03 | sean-k-mooney | and i though that was put in the the instace_system_metatadata table | |
| 18:01:12 | sean-k-mooney | although it could be in instance_extra | |
| 18:01:15 | lyarwood | sean-k-mooney: the system_metadata issue I was talking about downstream comes from https://github.com/openstack/nova/blob/fefd984fd1294f23677e3df4390e37c7664883a0/nova/utils.py | |
| 18:01:27 | melwitt | isn't instance.metadata public? | |
| 18:01:34 | sean-k-mooney | melwitt: yes | |
| 18:01:36 | sean-k-mooney | with a nova show | |
| 18:01:42 | sean-k-mooney | i think | |
| 18:01:43 | lyarwood | ops that didnt link correctly | |
| 18:01:50 | melwitt | so the novnc password shouldn't be put in there, right? | |
| 18:01:54 | openstackgerrit | Sylvain Bauza proposed openstack/nova master: Add requested_networks field to RequestSpec object https://review.opendev.org/c/openstack/nova/+/749977 | |
| 18:01:54 | openstackgerrit | Sylvain Bauza proposed openstack/nova master: WIP: Add a routed networks scheduler pre-filter https://review.opendev.org/c/openstack/nova/+/749068 | |
| 18:01:55 | openstackgerrit | Sylvain Bauza proposed openstack/nova master: Rename ensure_network_metadata to amend requested_networks https://review.opendev.org/c/openstack/nova/+/773955 | |
| 18:01:56 | openstackgerrit | Sylvain Bauza proposed openstack/nova master: Add network and utils methods for getting routed networks and segments https://review.opendev.org/c/openstack/nova/+/773976 | |
| 18:02:08 | sean-k-mooney | melwitt: correct | |
| 18:02:12 | lyarwood | https://github.com/openstack/nova/blob/fefd984fd1294f23677e3df4390e37c7664883a0/nova/utils.py#L752-L778 was what I wanted to link to | |
| 18:02:19 | sean-k-mooney | if its there i belive it will be avaiable via the metadata service | |
| 18:02:25 | melwitt | if it goes in system_metadata I guess that's ok, IIUC | |
| 18:02:25 | sean-k-mooney | allowing anyone in the project ot get it | |
| 18:02:45 | melwitt | but not metadata, that will be public to all in the project like you said | |
| 18:02:52 | lyarwood | melwitt: so the issue then is it would show up as an image metadata property | |
| 18:03:05 | sean-k-mooney | yep and the feature is ment to make it so only the user that created the instace can log in | |
| 18:03:14 | sean-k-mooney | via vnc with the password they set | |
| 18:03:15 | melwitt | oh system_meta gets reflected out of metadata? oh, I didn't know that :\ | |
| 18:03:24 | lyarwood | neither did I until a few hours ago | |
| 18:03:34 | sean-k-mooney | or i | |
| 18:03:35 | lyarwood | slightly weird behaviour tbh, I can't think why | |
| 18:03:36 | melwitt | hrm | |
| 18:03:46 | sean-k-mooney | i though it was only stuff with the image_ prefix or img_ | |
| 18:04:04 | sean-k-mooney | not everything becase we store stuff for tpm there too | |
| 18:04:11 | melwitt | yeah I had thought system_meta was like internal system info that wasn't put out there | |
| 18:04:28 | melwitt | ok so you're saying a subset of it is reflected out | |
| 18:04:55 | sean-k-mooney | no i thouhg only a subset shoudl be relected out via the image | |
| 18:05:04 | lyarwood | my reading of https://github.com/openstack/nova/blob/fefd984fd1294f23677e3df4390e37c7664883a0/nova/utils.py#L752-L778 and what I've seen when stashing hw_machine_type in there is that it ends up being reflected in the image metadata properties | |
| 18:05:10 | sean-k-mooney | but lyarwood seams to have found all of it might be in a specific case? | |
| 18:05:29 | melwitt | oh | |
| 18:05:46 | sean-k-mooney | so SM_IMAGE_PROP_PREFIX | |
| 18:05:56 | sean-k-mooney | was ment to be filtering to just the image ones right | |
| 18:06:20 | lyarwood | you would assume so | |
| 18:07:12 | sean-k-mooney | so key = key[len(SM_IMAGE_PROP_PREFIX):] | |
| 18:07:17 | sean-k-mooney | is striping the key | |
| 18:07:21 | sean-k-mooney | i think that is the issue | |
| 18:08:21 | sean-k-mooney | because you have img_hw_machine_type that matches hw_machine_type which you added | |
| 18:08:21 | lyarwood | so in my case I've not even set it in the image metadata | |
| 18:08:21 | lyarwood | I'm only updating it in system_metadata while n-cpu starts | |
| 18:08:21 | lyarwood | and spawns | |
| 18:08:22 | lyarwood | and it's still showing up as an image prop | |
| 18:08:36 | lyarwood | let me write a func test to show this | |
| 18:10:01 | sean-k-mooney | can you include your new key with a prfix too | |
| 18:10:13 | sean-k-mooney | e.g. abi_hw_machine_type | |
| 18:10:27 | sean-k-mooney | i think adding an abi prefix or simialr would stopp it being included | |
| 18:10:57 | lyarwood | it wouldn't, that's just trimming off SM_IMAGE_PROP_PREFIX from any matching keys | |
| 18:11:20 | lyarwood | L771-774 will still include it | |
| 18:12:11 | sean-k-mooney | oh i see | |
| 18:12:27 | sean-k-mooney | we shoudl be looping over the known filed in the image metadata object | |
| 18:12:33 | lyarwood | brb | |
| 18:12:34 | sean-k-mooney | not everything in the dict | |
| 18:12:47 | sean-k-mooney | so for key, value in system_meta.items(): is wrong | |
| 18:13:26 | sean-k-mooney | well that woudl work but we need to check " if key not in imageMeta.fields(): continue | |
| 18:13:28 | sean-k-mooney | or similar | |
| 18:36:06 | openstackgerrit | Merged openstack/placement master: policy: Suppress policy deprecation warnings https://review.opendev.org/c/openstack/placement/+/771852 | |
| 18:36:42 | openstackgerrit | Merged openstack/placement master: policy: Don't persist default rule changes in tests https://review.opendev.org/c/openstack/placement/+/772508 | |
| 18:38:23 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for resource providers https://review.opendev.org/c/openstack/placement/+/760240 | |
| 18:38:56 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for aggregates https://review.opendev.org/c/openstack/placement/+/760235 | |
| 18:39:03 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for allocations https://review.opendev.org/c/openstack/placement/+/760236 | |
| 18:44:27 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for allocation candidates https://review.opendev.org/c/openstack/placement/+/760237 | |
| 18:48:12 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for inventories https://review.opendev.org/c/openstack/placement/+/760238 | |
| 18:48:16 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for resource classes https://review.opendev.org/c/openstack/placement/+/760239 | |
| 18:49:03 | openstackgerrit | Merged openstack/placement master: Implement secure RBAC for traits https://review.opendev.org/c/openstack/placement/+/760241 | |