| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-04-14 | |||
| 13:39:56 | sean-k-mooney | that is an issue for a mulit sight multi cell deployment as all nodes need to be upgrade at once | |
| 13:39:56 | sean-k-mooney | that is an issue for a mulit sight multi cell deployment as all nodes need to be upgrade at once | |
| 13:40:47 | gibi | I see | |
| 13:40:51 | sean-k-mooney | so the tension is between custoemr saying we want to do upgrades on a slower cadance and the fact that we can only support n-1 upstream | |
| 13:40:51 | sean-k-mooney | so the tension is between custoemr saying we want to do upgrades on a slower cadance and the fact that we can only support n-1 upstream | |
| 13:41:15 | sean-k-mooney | we have other customer that want new feature faster too so not all are the same obviously | |
| 13:41:15 | sean-k-mooney | we have other customer that want new feature faster too so not all are the same obviously | |
| 14:15:48 | noonedeadpunk | Hi there! Have a question regarding nova-conductor and rabbit... We had a deployment on V with enabled SSL for rabbitmq (but without trusted cert or rootca). And while upgrade to W, we disabled ssl for rabbitmq. However, conductor still tries to reach rabbit via ssl and fails with CERTIFICATE_VERIFY_FAILED (whic was the reason why ssl was disabled at the first place) | |
| 14:15:48 | noonedeadpunk | Hi there! Have a question regarding nova-conductor and rabbit... We had a deployment on V with enabled SSL for rabbitmq (but without trusted cert or rootca). And while upgrade to W, we disabled ssl for rabbitmq. However, conductor still tries to reach rabbit via ssl and fails with CERTIFICATE_VERIFY_FAILED (whic was the reason why ssl was disabled at the first place) | |
| 14:16:28 | noonedeadpunk | Am I missing so nova-manage command to make conductor migrate and re-read config? | |
| 14:16:28 | noonedeadpunk | Am I missing so nova-manage command to make conductor migrate and re-read config? | |
| 14:16:35 | noonedeadpunk | *some | |
| 14:16:35 | noonedeadpunk | *some | |
| 14:17:19 | noonedeadpunk | as with same config code that's deployed just on W works nicely | |
| 14:17:19 | noonedeadpunk | as with same config code that's deployed just on W works nicely | |
| 14:17:59 | gibi | noonedeadpunk: look at the cell_mappings table in your nova api database. I guess it still contains rabbit urls with ssl | |
| 14:17:59 | gibi | noonedeadpunk: look at the cell_mappings table in your nova api database. I guess it still contains rabbit urls with ssl | |
| 14:18:48 | noonedeadpunk | gibi: yep, that's absolutely true | |
| 14:18:48 | noonedeadpunk | gibi: yep, that's absolutely true | |
| 14:19:55 | gibi | noonedeadpunk: you can use nova-manage cell_v2 update_cell to make the adjustments | |
| 14:19:55 | gibi | noonedeadpunk: you can use nova-manage cell_v2 update_cell to make the adjustments | |
| 14:21:22 | sean-k-mooney | unless your useing templated transport urls ya yuou likely need to update them | |
| 14:21:22 | sean-k-mooney | unless your useing templated transport urls ya yuou likely need to update them | |
| 14:23:52 | noonedeadpunk | ok, thanks, that worked! Now I need to review wtf we do in https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_setup.yml and https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_post_setup.yml | |
| 14:23:52 | noonedeadpunk | ok, thanks, that worked! Now I need to review wtf we do in https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_setup.yml and https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_post_setup.yml | |
| 14:24:33 | sean-k-mooney | noonedeadpunk: i can never recall if templated urls is a nova thing or ooo. i think its a nova feature | |
| 14:24:33 | sean-k-mooney | noonedeadpunk: i can never recall if templated urls is a nova thing or ooo. i think its a nova feature | |
| 14:26:02 | noonedeadpunk | * noonedeadpunk no idea what templated urls are | |
| 14:26:49 | noonedeadpunk | https://docs.openstack.org/nova/latest/user/cells.html#template-urls-in-cell-mappings ? | |
| 14:26:49 | noonedeadpunk | https://docs.openstack.org/nova/latest/user/cells.html#template-urls-in-cell-mappings ? | |
| 14:26:57 | sean-k-mooney | noonedeadpunk: yes | |
| 14:26:57 | sean-k-mooney | noonedeadpunk: yes | |
| 14:27:17 | sean-k-mooney | it allows you to not sore passward and logins info in the db for rabbit | |
| 14:27:17 | sean-k-mooney | it allows you to not sore passward and logins info in the db for rabbit | |
| 14:27:47 | sean-k-mooney | nova baisically render teh full url from the template when it tires to connect to rabbit | |
| 14:27:47 | sean-k-mooney | nova baisically render teh full url from the template when it tires to connect to rabbit | |
| 14:27:57 | sean-k-mooney | filling in the placeholder from it nova.conf | |
| 14:27:57 | sean-k-mooney | filling in the placeholder from it nova.conf | |
| 14:28:23 | sean-k-mooney | that way if you cahnge your rabbit password for example you dont need to update the db | |
| 14:28:23 | sean-k-mooney | that way if you cahnge your rabbit password for example you dont need to update the db | |
| 14:28:33 | sean-k-mooney | just the config files on the nodes | |
| 14:28:33 | sean-k-mooney | just the config files on the nodes | |
| 14:28:56 | noonedeadpunk | eventually I think that's what I'm looking for:) | |
| 14:28:56 | noonedeadpunk | eventually I think that's what I'm looking for:) | |
| 14:29:55 | sean-k-mooney | i think the tls options can be set that way too | |
| 14:29:55 | sean-k-mooney | i think the tls options can be set that way too | |
| 14:30:26 | noonedeadpunk | that's kind of `fragment` I guess. | |
| 14:30:26 | noonedeadpunk | that's kind of `fragment` I guess. | |
| 14:30:56 | sean-k-mooney | i think its in query | |
| 14:30:56 | sean-k-mooney | i think its in query | |
| 14:31:04 | sean-k-mooney | but maybe fragment | |
| 14:31:04 | sean-k-mooney | but maybe fragment | |
| 14:31:28 | sean-k-mooney | im trying to find an example transport url with tls enabeld to take a look | |
| 14:31:28 | sean-k-mooney | im trying to find an example transport url with tls enabeld to take a look | |
| 14:31:44 | noonedeadpunk | The only thing I didn't get now - how to define this variable. I mean where? In [DEFAULT] or [database]? | |
| 14:31:44 | noonedeadpunk | The only thing I didn't get now - how to define this variable. I mean where? In [DEFAULT] or [database]? | |
| 14:32:30 | noonedeadpunk | yeah, you're right, it's query | |
| 14:32:30 | noonedeadpunk | yeah, you're right, it's query | |
| 14:32:58 | sean-k-mooney | well by default you are using https://docs.openstack.org/nova/latest/configuration/config.html#DEFAULT.transport_url | |
| 14:32:58 | sean-k-mooney | well by default you are using https://docs.openstack.org/nova/latest/configuration/config.html#DEFAULT.transport_url | |
| 14:33:14 | sean-k-mooney | and just hardcoding eveything which is fine | |
| 14:33:14 | sean-k-mooney | and just hardcoding eveything which is fine | |
| 14:33:37 | sean-k-mooney | i assume the ssl would come from https://docs.openstack.org/nova/latest/configuration/config.html#oslo_messaging_rabbit.ssl | |
| 14:33:37 | sean-k-mooney | i assume the ssl would come from https://docs.openstack.org/nova/latest/configuration/config.html#oslo_messaging_rabbit.ssl | |
| 14:33:39 | noonedeadpunk | that's exactly what I have atm | |
| 14:33:39 | noonedeadpunk | that's exactly what I have atm | |
| 14:35:06 | noonedeadpunk | well, it also comes from query indeed, ie `transport_url = rabbit://nova:pasword@172.29.236.100:5671//nova?ssl=1` | |
| 14:35:06 | noonedeadpunk | well, it also comes from query indeed, ie `transport_url = rabbit://nova:pasword@172.29.236.100:5671//nova?ssl=1` | |
| 14:41:26 | sean-k-mooney | i think you would set somehtin like this "{scheme}://{username}:{password}@{hostname}/{path}?{query}" | |
| 14:41:26 | sean-k-mooney | i think you would set somehtin like this "{scheme}://{username}:{password}@{hostname}/{path}?{query}" | |
| 14:41:36 | sean-k-mooney | in the cell mapping | |
| 14:41:36 | sean-k-mooney | in the cell mapping | |
| 14:42:08 | noonedeadpunk | But um. I mean that in nova.conf I should still have regular transport_url ? | |
| 14:42:08 | noonedeadpunk | But um. I mean that in nova.conf I should still have regular transport_url ? | |
| 14:43:08 | noonedeadpunk | So it's transport_url got splited and auto substituted in case cell mapping contains variables?? | |
| 14:43:08 | noonedeadpunk | So it's transport_url got splited and auto substituted in case cell mapping contains variables?? | |
| 14:43:15 | sean-k-mooney | that im not sure im trying to figure out | |
| 14:43:15 | sean-k-mooney | that im not sure im trying to figure out | |
| 14:43:53 | sean-k-mooney | unfortuetly our downstream sos report replace it with transport_url=********* since it could have password so i dont have an example with tls enable to look at | |
| 14:43:53 | sean-k-mooney | unfortuetly our downstream sos report replace it with transport_url=********* since it could have password so i dont have an example with tls enable to look at | |
| 14:44:12 | noonedeadpunk | as eventually http://paste.openstack.org/show/804476/ is not working in nova.conf... (test env, so I'm not bothered about password there :p) | |
| 14:44:12 | noonedeadpunk | as eventually http://paste.openstack.org/show/804476/ is not working in nova.conf... (test env, so I'm not bothered about password there :p) | |
| 14:46:43 | sean-k-mooney | the unit test seam to be seetting the values in the nova.conf in the tansport url | |
| 14:46:43 | sean-k-mooney | the unit test seam to be seetting the values in the nova.conf in the tansport url | |
| 14:46:45 | sean-k-mooney | https://github.com/openstack/nova/blame/50fdbc752a9ca9c31488140ef2997ed59d861a41/nova/tests/unit/objects/test_cell_mapping.py#L216-L231 | |
| 14:46:45 | sean-k-mooney | https://github.com/openstack/nova/blame/50fdbc752a9ca9c31488140ef2997ed59d861a41/nova/tests/unit/objects/test_cell_mapping.py#L216-L231 | |
| 14:49:46 | noonedeadpunk | yep, looks like this way indeed | |
| 14:49:46 | noonedeadpunk | yep, looks like this way indeed | |
| 14:50:01 | sean-k-mooney | noonedeadpunk: i think ya you shoudl be still setting actula datat in the nova.conf | |
| 14:50:01 | sean-k-mooney | noonedeadpunk: i think ya you shoudl be still setting actula datat in the nova.conf | |
| 14:50:19 | sean-k-mooney | and then we split the url and teake the info in the db and templeate it | |
| 14:50:19 | sean-k-mooney | and then we split the url and teake the info in the db and templeate it | |
| 14:50:33 | noonedeadpunk | So I see literally no point in not using templates under any conditions... | |
| 14:50:33 | noonedeadpunk | So I see literally no point in not using templates under any conditions... | |
| 14:50:57 | noonedeadpunk | sean-k-mooney: thanks a lot! | |
| 14:50:57 | noonedeadpunk | sean-k-mooney: thanks a lot! | |
| 14:51:10 | sean-k-mooney | noonedeadpunk: i think we always use the in ooo/OSP since it was added in rocky | |
| 14:51:10 | sean-k-mooney | noonedeadpunk: i think we always use the in ooo/OSP since it was added in rocky | |
| 14:52:27 | noonedeadpunk | I think for us to migrate to it, we need to replace https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_setup.yml#L62 and add task to nova-manage cell_v2 update_cell during upgrades as far as I got the process? | |
| 14:52:27 | noonedeadpunk | I think for us to migrate to it, we need to replace https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_setup.yml#L62 and add task to nova-manage cell_v2 update_cell during upgrades as far as I got the process? | |