Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-03-11
15:49:28 stephenfin I don't see any href on any of the definitions in the policy doc so I don't think Sphinx does it natively
15:49:32 stephenfin https://docs.openstack.org/nova/latest/configuration/policy.html
15:49:43 sean-k-mooney stephenfin: they should not be hrefs
15:49:55 stephenfin sorry, ids
15:50:09 sean-k-mooney right so nova has one https://docs.openstack.org/nova/latest/configuration/policy.html#nova
15:50:26 sean-k-mooney but none of the other items
15:50:26 stephenfin whereas we do have them for the config doc https://docs.openstack.org/nova/latest/configuration/config.html
15:50:36 sean-k-mooney yep we dont use definition list there i think
15:50:42 stephenfin that's because 'oslo_policy.sphinxext' uses a custom domain, which means you can index them
15:50:45 sean-k-mooney we generate that form code
15:50:52 stephenfin sorry, 'oslo_config.sphinxext'
15:50:59 sean-k-mooney yep
15:51:05 stephenfin whereas 'oslo_policy.sphinxext' is just using definition lits
15:51:07 stephenfin lists
15:51:14 stephenfin we could improve that, of course
15:51:18 stephenfin I just haven't gotten to do it yet
15:51:22 gibi bauzas: ack
15:51:24 gibi bauzas: thanks
15:51:46 sean-k-mooney stephenfin: ya its more of a minor annowyance but it also affect ones we write by hand
15:52:12 sean-k-mooney althoguh when writing them by hand we can just add anchors to fix it
15:52:27 sean-k-mooney which we do in thing like the schduler doc if i remeber correctly
15:53:55 sean-k-mooney oh we dont
15:53:58 sean-k-mooney it has the same issue
15:54:09 stephenfin I have a huge doc rework to fix that
15:54:10 sean-k-mooney anyway not importnat right now just annoying ux
15:54:16 stephenfin I'll get people to take a look after feature freeze
15:54:21 bauzas stephenfin: the os secure boot eventually got my approval till the func test
15:54:32 bauzas stephenfin: waiting for gerrit to tell me about the func test
15:54:46 bauzas stephenfin: but I guess you got no issues locally, right?
15:55:03 stephenfin I tested before I pushed. Works as expected, if that helps
15:55:11 stephenfin and it won't merge if the CI isn't happy even with +W
15:55:18 stephenfin as we're seeing :'(
15:59:35 artom stephenfin, hey, so turns out with sean-k-mooney's port affinity patch on top of mine, we discovered an issue with devices that have parents
15:59:56 artom I was setting pool['socket'], and that cause bad side effects when doing pool comparisons later on
16:00:08 artom So I had to respin and kick it out of the gate
16:01:41 gibi and I'm already +2 :)
16:25:35 bauzas dansmith: I haven't forgotten the rpc changes but reviews day hell here
16:25:44 bauzas tomorrow, that's better.
16:40:47 dansmith bauzas:ack
16:41:04 dansmith sean-k-mooney: you just too good for the nova meeting these days?
16:41:38 sean-k-mooney sorry forgot it was time for it joining
16:42:21 dansmith sean-k-mooney: so I asked a question there expecting maybe a response from you and realized you weren't around
16:42:22 sean-k-mooney dansmith: ah its just over
16:42:31 dansmith sean-k-mooney: related to the glance metadef api,
16:42:40 dansmith you probably saw the OSSN and query about getting ops feedback
16:42:58 dansmith but I (and stephenfin) thought you might be aware of how this is used
16:43:11 sean-k-mooney the metadef api
16:43:14 dansmith I think horizon uses it to present templates of nova metadata you can apply to things in some way
16:43:27 sean-k-mooney its use by heat i belive and yest its used by horizon
16:43:42 dansmith but it's not clear to me if that's like really useful, widely-used, etc
16:43:44 sean-k-mooney to generate the view that is ues to add flaovr extra specs and image poeprtyes
16:44:13 dansmith okay, does it allow you to create those things or just use it to show?
16:44:24 sean-k-mooney you can create them too
16:44:35 sean-k-mooney i belive that is admin only
16:44:39 dansmith it's not
16:44:43 dansmith at least on the glance side
16:44:46 sean-k-mooney really
16:44:58 dansmith it's also not properly isolated,
16:45:09 sean-k-mooney well its not ment ot be per tenant
16:45:20 sean-k-mooney its ment to be a global registry
16:45:22 dansmith which means you can use (apparently horizon) to poke and see if other tenants have things defined
16:45:47 sean-k-mooney right but this was not ment to be per tenant
16:45:49 dansmith sean-k-mooney: it's completely wide open by default
16:46:05 sean-k-mooney ok so the issue there is that writing to it is allowd
16:46:14 sean-k-mooney reading form it by default is fien for everyone
16:46:16 dansmith sean-k-mooney: also, it is clearly tenantified a little bit, just not well
16:46:41 sean-k-mooney is see i was not aware of that
16:46:45 dansmith sean-k-mooney: so tenants can create things that aren't shown to other tenants, but if you know the name, you can see it
16:46:56 sean-k-mooney ah i see
16:47:09 sean-k-mooney i did not see the OSSN for this by the way
16:47:17 sean-k-mooney so didnt know that context
16:47:24 dansmith it seems to be that namespace is the thing that is tied to the tenant,
16:47:51 dansmith and you create things tied to that namespace that are private to you, but if someone knows the name (or happens to pick the same one you did) then ... oopsie, here's their data
16:48:14 dansmith exposure seems limited to just names, which may be harmless, but may have customer names or infrastructure details of course
16:48:53 dansmith and the other issue is that open by default, with no creation controls, you can fill the database for fun and profit :)
16:49:31 sean-k-mooney ya so what the api was intended for was to provide a central regeistry for all falovr extra specs, image proertes, host aggreate and volumen metadata key and the allows values
16:50:24 dansmith seems odd to put that in glance, but I understand now that's the goal, at least
16:50:36 sean-k-mooney basically it was created as a programatic way to document and encode the value values for all the tunables user and operations might use when creating image/flavor/aggreates and volumnes
16:51:03 sean-k-mooney well it was adding very early on
16:51:16 dansmith yeah, so there have been contributions to the metadefs since the original thing, presumably because someone wants something to show up in horizon
16:51:55 sean-k-mooney well before we added stephenfin flavor validation stuff i was pushing for use to keep it in sysnc to defien the falvor extra specs
16:59:32 gibi stephenfin: will you look at the two artom's and sean-k-mooney's numa policy patches as second core?
16:59:41 stephenfin yup, on it
17:00:14 gibi thanks
17:24:37 stephenfin gibi: done on both
17:24:44 gibi stephenfin: any issue?
17:24:58 stephenfin Nope. Good catch on the socket policy though
17:25:23 gibi reno fix can land after FF so I'm not worrying about it
17:25:30 stephenfin yup, agreed
17:26:02 gibi lyarwood, bauzas, dansmith: we need a second core for an easy refactor patch https://review.opendev.org/c/openstack/nova/+/779851 the rest of the series is reviewd by stephen but his patch is stephen's so we need somebody else to get vdpa to land
17:26:26 gibi stephenfin: thanks
17:26:52 lyarwood looking
17:27:01 gibi lyarwood: thanks
17:31:58 lyarwood gibi: done
17:33:24 gibi lyarwood: thanks
17:48:09 gibi lyarwood: o/
19:00:57 openstackgerrit sean mooney proposed openstack/nova master: block vm boot with vdpa ports https://review.opendev.org/c/openstack/nova/+/780065
19:03:57 sean-k-mooney FYI that is only needed if we dont merge the VDPA inital boot support to ensure that even though neutron support the vdpa type we do not try to boot with it until we do
19:04:21 gibi sean-k-mooney: I'm reading vdpa right now
19:04:32 gibi sean-k-mooney: I have a question

Earlier   Later