Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-06-01
15:16:54 sean-k-mooney but that is weird that sould be correct
15:16:59 stephenfin both
15:17:11 stephenfin the command is correct except I did use the wrong UUID
15:17:19 stephenfin that's my image UUID, not the volume
15:17:30 stephenfin but the server should be handling this and spitting out a better error
15:17:37 sean-k-mooney ya that would make sense
15:17:43 sean-k-mooney it should not be a 500
15:17:47 sean-k-mooney it should be a 400
15:17:47 stephenfin exactly
15:18:25 sean-k-mooney ya so i guess we just need to wrap the volumen not found expciton
15:18:27 sean-k-mooney although
15:18:30 stephenfin I can fix but I'm notifying lyarwood since this seems like something that wouldn't go unnoticed for long, so I suspect it's only broken recently (like, last year)
15:18:34 sean-k-mooney we really should be validating this in the api
15:19:06 sean-k-mooney im not sure about that
15:20:22 sean-k-mooney stephenfin: i would expect most peopple to use "openstack server create --flavor 2 --volume VOLUME_ID myInstanceFromVolume"
15:20:38 stephenfin I'd say that will fail with the same error message
15:20:45 stephenfin since it's doing the same thing under the hood
15:21:00 sean-k-mooney it will but i thik they would be less likely to make the mistake of mixing the uuids
15:22:02 sean-k-mooney am i right that you had just previouly tested "-block-device source_type=image,uuid=44d317a3-6183-4063-868b-aa0728576f5f,destination_type=volume,delete_on_termination=true"
15:22:24 stephenfin nope, I just made a mistake
15:22:32 stephenfin the previous command had been 'openstack image list'
15:22:33 sean-k-mooney and then updated the source_type to volumn with out actully updatign the uuid
15:22:35 sean-k-mooney oh ok
15:22:52 stephenfin so my lazy brain grabbed the first UUID it saw on screen :)
15:23:52 sean-k-mooney stephenfin: well the current error is happing on the compute so this should defintly be caught in the api before we create a server record
15:27:24 sean-k-mooney maybe here https://github.com/openstack/nova/blob/da57eebc9e1ab7e48d4c4ef6ec1eeba80d867d81/nova/api/openstack/compute/servers.py#L470
15:30:09 sean-k-mooney oh in _validate_and_build_base_options https://github.com/openstack/nova/blob/c0c2888acaaccfa4266874523f62039cb9e143e0/nova/compute/api.py#L968
15:45:51 kashyap stephenfin: [Off-topic] I have an inkling you'll like this: https://www.merriam-webster.com/words-at-play/can-a-ship-flounder
15:46:40 kashyap stephenfin: Also did you know both noun and verb usage of 'flounder and 'founder'? (Before reading the article :)
15:46:59 sean-k-mooney they are two differnt things
15:47:41 sean-k-mooney a fish can flounder a ship cannot as far as im aware
15:48:20 stephenfin and vice versa, iirc
15:49:06 sean-k-mooney a wale that is beached on land can flounder, when it tries to get back into the water
15:50:28 gibi nova meeting starts in 10 minutes in #openstack-meeting-3 on OFTC ;)
15:52:55 sean-k-mooney hum i see how it could be used and it makes sense but it a bit arcic to use flounder for an in animiat object even by irish standard even if its technicaly allowable
15:53:37 kashyap sean-k-mooney: Yeah; they are two different things; but using "founder" as a verb for ship (but not "flounder") was a new thing for me
15:54:28 sean-k-mooney both words honestly have little usage day to day
15:55:15 kashyap Yeah; flounder is more often seen in writng, though
15:56:26 opendevreview Elod Illes proposed openstack/nova stable/wallaby: DNM: test ceph checkout with branch https://review.opendev.org/c/openstack/nova/+/794000
15:56:51 gibi lyarwood, melwitt: FYI ^^ with elod we might caught a ceph testing issue
16:41:08 opendevreview Stephen Finucane proposed openstack/nova master: api: Handle invalid volume UUIDs during spawn https://review.opendev.org/c/openstack/nova/+/794006
16:41:08 opendevreview Stephen Finucane proposed openstack/nova master: docs: Replace 'nova boot' with 'openstack server create' https://review.opendev.org/c/openstack/nova/+/794007
16:43:05 stephenfin lyarwood: ^ easy fix. I didn't add unit tests because they seemed silly (see reasoning inline) but I can if people insist
17:14:15 masterpe Hi, I try to extend a in-use volume on Openstack Train. In the logs I get the following "error: Forbidden: Policy doesn't allow os_compute_api:os-server-external-events:create to be performed"
17:14:30 sean-k-mooney gibi: so we did tweak the realtime handeling to allow alll cores to be used but we required the emulator policy to be used
17:14:32 sean-k-mooney https://github.com/openstack/nova/blob/50fdbc752a9ca9c31488140ef2997ed59d861a41/releasenotes/notes/bug-1884231-16acf297d88b122e.yaml
17:15:16 masterpe Is there an article where it explains how to change the policy so that it is allowed? I searched but I was not able to find it.
17:15:18 sean-k-mooney gibi: so what we allow today is you can use a specific emulator policy which wont have the downstream issue or you can use a realtime mask
17:15:32 gibi seem good
17:15:34 masterpe[m] Hi, I try to extend a in-use volume on Openstack Train. In the logs I get the following "error: Forbidden: Policy doesn't allow os_compute_api:os-server-external-events:create to be performed"
17:15:34 masterpe[m] Is there an article where it explains how to change the policy so that it is allowed? I searched but I was not able to find it.
17:16:18 sean-k-mooney masterpe[m]: i think this is a know cinder bug
17:16:49 sean-k-mooney masterpe[m]: basicaly when cinder calls back the nova api its incorrectly using the user token to call the admin only external events api
17:21:55 masterpe[m] sean-k-mooney do you know if there is a patch for this cinder bug?
17:31:25 sean-k-mooney masterpe[m]: if you try this this as an admin i think it willl work
17:31:31 sean-k-mooney masterpe[m]: but im not sure
17:31:39 sean-k-mooney lyarwood: do you remember ^
17:33:17 sean-k-mooney masterpe[m]: what cinder backend are you using
17:33:32 masterpe[m] End ceph
17:33:58 masterpe[m] I wanted to write rbd but auto correct
17:34:28 sean-k-mooney there was this previous bug for nfs https://bugzilla.redhat.com/show_bug.cgi?id=1640443 https://bugs.launchpad.net/tripleo/+bug/1802347
17:34:28 opendevmeet bugzilla.redhat.com bug 1640443 in openstack-tripleo-heat-templates "volume_extend while attached - Policy doesn't allow os_compute_api:os-server-external-events:create" [High,Closed: errata] - Assigned to abishop
17:34:29 opendevmeet Launchpad bug 1802347 in tripleo "Need ability to configure cinder's settings for nova" [High,Fix released] - Assigned to Alan Bishop (alan-bishop)
17:35:16 dansmith masterpe: this channel has moved to oftc, so you'll need to re-ask there
17:36:03 sean-k-mooney looks like they hacked around it in ooo to use the admin endpoint https://review.opendev.org/c/openstack/tripleo-heat-templates/+/616669/
17:36:12 sean-k-mooney masterpe[m]: instead of actully fixing the cinder bug
17:37:25 masterpe Thanks, after typing I realized that.
17:38:04 sean-k-mooney osa also copied the ooo trick https://bugs.launchpad.net/openstack-ansible/+bug/1902914
17:38:04 opendevmeet Launchpad bug 1902914 in openstack-ansible "cinder extend "Policy doesn't allow os_compute_api:os-server-external-events:create to be performed"" [Medium,Fix released] - Assigned to Dmitriy Rabotyagov (noonedeadpunk)
17:42:00 masterpe[m] We are using osa. I will look into that.
17:42:34 sean-k-mooney masterpe[m]: what release did you say you were using?
17:44:21 sean-k-mooney masterpe[m]: oh and to you orignal question you can change the policy for the endpoint by defining a custom policy nova's policy.json or policy.yaml file
17:44:27 sean-k-mooney masterpe[m]: however you should not do that
17:45:13 sean-k-mooney the external events api is intended for interservice comumnication https://docs.openstack.org/api-ref/compute/#create-external-events-os-server-external-events
17:45:59 sean-k-mooney masterpe[m]: not even normal admin should actully call that manually as its very easy to break things and it might even be a secuirty issue in some cases.
17:46:43 sean-k-mooney so the only way to adress your issue is to ensure that cinder uses an admin token to talk to that endpoint
17:47:00 masterpe[m] My question was directly related to the error. But if there are better solution to the problem then ....
17:47:19 sean-k-mooney masterpe[m]: yes that is a generic policy error message
17:47:34 sean-k-mooney in some case adjusting policy would be valid in this case its not
18:24:49 frickler masterpe[m]: you need to configure cinder to use an admin user acc to talk to nova, see e.g. https://bugs.launchpad.net/openstack-ansible/+bug/1902914
18:24:49 opendevmeet Launchpad bug 1902914 in openstack-ansible "cinder extend "Policy doesn't allow os_compute_api:os-server-external-events:create to be performed"" [Medium,Fix released] - Assigned to Dmitriy Rabotyagov (noonedeadpunk)
18:25:49 frickler oh, that's the same one as cited above
18:26:55 frickler fwiw we also copied that solution into openstack-chef, though
19:06:03 opendevreview Lee Yarwood proposed openstack/nova stable/ussuri: hardware: Use image_meta.id within get_mem_encryption_constraint https://review.opendev.org/c/openstack/nova/+/793958
19:33:50 opendevreview Merged openstack/nova master: Replace getargspec with getfullargspec https://review.opendev.org/c/openstack/nova/+/790405
20:50:34 opendevreview Lee Yarwood proposed openstack/nova stable/train: Replace 'fake' with a real project ID https://review.opendev.org/c/openstack/nova/+/794041
20:50:35 opendevreview Lee Yarwood proposed openstack/nova stable/train: image_meta: Provide image_ref as the id when fetching from instance https://review.opendev.org/c/openstack/nova/+/794042
20:50:36 opendevreview Lee Yarwood proposed openstack/nova stable/train: hardware: Use image_meta.id within get_mem_encryption_constraint https://review.opendev.org/c/openstack/nova/+/794043
22:31:15 opendevreview Artom Lifshitz proposed openstack/nova master: WIP: Test aborting queued live migration https://review.opendev.org/c/openstack/nova/+/776250
22:31:15 opendevreview Artom Lifshitz proposed openstack/nova master: WIP: Rollback live migraiton if cancelled while queued https://review.opendev.org/c/openstack/nova/+/794048
22:31:31 artom That func test ^^ is disgusting h4xx
#openstack-nova - 2021-06-02
00:57:12 melwitt gmann: I added a very late reply on https://review.opendev.org/c/openstack/nova/+/762013 if you could look at your convenience this week
00:58:18 gmann melwitt: sure, will check tomorrow.
00:59:02 melwitt cool thx
01:34:20 opendevreview norman shen proposed openstack/nova master: Saving security group to info_cache https://review.opendev.org/c/openstack/nova/+/786348
06:11:58 opendevreview Yongli He proposed openstack/nova master: Smartnic support - cyborg drive https://review.opendev.org/c/openstack/nova/+/771362
06:11:59 opendevreview Yongli He proposed openstack/nova master: smartnic support - new vnic type https://review.opendev.org/c/openstack/nova/+/771363
06:12:01 opendevreview Yongli He proposed openstack/nova master: smartnic support https://review.opendev.org/c/openstack/nova/+/758944
06:12:02 opendevreview Yongli He proposed openstack/nova master: smartnic support - reject server move and suspend https://review.opendev.org/c/openstack/nova/+/779913
06:12:02 opendevreview Yongli He proposed openstack/nova master: smartnic support - functional tests https://review.opendev.org/c/openstack/nova/+/780147

Earlier   Later