| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-06-03 | |||
| 09:49:58 | bauzas | and this was on a morning, not during sunset | |
| 09:50:54 | bauzas | imagine a lost skiing resort as the lifts were closed with this sky | |
| 09:51:09 | bauzas | probably a good place and time for a new Hitchcook movie | |
| 09:51:34 | bauzas | I loved the abandoned atmosphere :) | |
| 10:02:15 | sean-k-mooney | its almost mars like | |
| 10:03:35 | sean-k-mooney | how did the first meeting go this morning | |
| 10:08:12 | sean-k-mooney | suzhengwei: we spoke about evacuation for suspended and stopped instace at the ptg. i assume you added that topic but were not able to attend when we discussed it | |
| 10:09:34 | sean-k-mooney | suzhengwei: the feedback at the time was to submit a spec, intoduce a new microversion and have the state transtion as follows | |
| 10:09:36 | sean-k-mooney | Shelved -> Shelved or Shelved_offloaded ? | |
| 10:09:38 | sean-k-mooney | Paused -> Stopped | |
| 10:09:40 | sean-k-mooney | Suspended -> Stopped | |
| 10:09:57 | sean-k-mooney | active -> active | |
| 10:10:44 | sean-k-mooney | actully Shelved -> Shelved or Shelved_offloaded ? is not relevnet | |
| 10:11:03 | sean-k-mooney | well ok it kind of is but in a subtel way | |
| 10:11:30 | sean-k-mooney | shelved instance still have a host but you have a choice of if you will shleve it to a different host or shleve offload it | |
| 10:12:15 | sean-k-mooney | suzhengwei: hence the ? as its an open question which would be the correct behavior but that should be adressed in the spec | |
| 10:13:25 | sean-k-mooney | suzhengwei: im happy to review the sepc if you propose it so feel free to ping me or add me to the review once its pushed. | |
| 10:23:45 | gibi | sean-k-mooney: thanks sean-k-mooney for remembering that we talked about that on the ptg, I already forgot | |
| 10:23:55 | gibi | but we concluded the same thing today :) | |
| 10:24:09 | sean-k-mooney | gibi: well a least we were consitnet in our feedback | |
| 10:24:14 | gibi | yepp | |
| 10:24:15 | sean-k-mooney | so thats a good sign at least | |
| 10:39:30 | sean-k-mooney | lyarwood: by the way since https://review.opendev.org/c/openstack/nova/+/794252 is chanigng the virt dirver interface its nice to email the list about it | |
| 10:39:58 | sean-k-mooney | which is ironic since we dont support out of tree virt drivers | |
| 10:45:59 | lyarwood | sean-k-mooney: ack yeah will do | |
| 11:43:57 | hemanth_n | hi can I get final reviews + workflow on this clean backport patch on queens https://review.opendev.org/c/openstack/nova/+/761825 .. already Elod reviewed and gave +2, thanks elod | |
| 11:50:11 | sean-k-mooney | melwitt: lyarwood can you take a look at ^ | |
| 11:51:34 | sean-k-mooney | granted at this point we likely wont pull this downstream since we wont have any new releases based on 13 at this point but it would still be good to fix for those on queens still | |
| 12:10:25 | jchorin_ | Hi everyone! I am trying to enable TLS on the nova API. Setting `cert` and `key` in nova.conf did not change anything except for the novncproxy. Is there another way to do it? | |
| 12:15:40 | sean-k-mooney | jchorin_: is the nova api using the copy of the nova.conf you updated | |
| 12:15:51 | sean-k-mooney | jchorin_: some installer create mulitple | |
| 12:18:30 | jchorin_ | Yes that is the one installed with the nova package and used by the process when started | |
| 12:19:25 | sean-k-mooney | jchorin_: how are you running nova-api | |
| 12:19:58 | sean-k-mooney | with the eventlet console script or via a wsgi server like appach or uwsgi | |
| 12:20:14 | sean-k-mooney | * apache mod_wsgi | |
| 12:22:16 | sean-k-mooney | jchorin_: i assume you set it in the default section https://docs.openstack.org/nova/latest/configuration/config.html#DEFAULT.cert | |
| 12:22:54 | sean-k-mooney | jchorin_: if its runnign under uwsgi or mod_wsgi you likely need to do the cert configurtion in the wsgi server instead | |
| 12:24:16 | sean-k-mooney | jchorin_: like this https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/nova/templates/nova-api-wsgi.conf.j2#L47-L51 | |
| 12:25:17 | jchorin_ | I added it in the default section yes. | |
| 12:25:18 | jchorin_ | It is started with `python3 /usr/bin/nova-api ...` | |
| 12:25:50 | jchorin_ | But there is no nova file in apache's site-available | |
| 12:26:50 | sean-k-mooney | gibi: dansmith do ye know if we ever supported tls nativly when runing nova-api directly issted of under an external wsgi server | |
| 12:27:27 | sean-k-mooney | jchorin_: yes unless you created one there would not be | |
| 12:28:02 | sean-k-mooney | jchorin_: that is running the api using hte python built in webserver with eventlets handeling multiplexing connections | |
| 12:29:50 | sean-k-mooney | jchorin_: kolla ansible runs it nova-api using apache and mod_wsgi and https://github.com/openstack/kolla-ansible/blob/master/ansible/roles/nova/templates/nova-api-wsgi.conf.j2 is the template they use to render the apache configuration for the site | |
| 12:30:12 | sean-k-mooney | jchorin_: i woudl recommend doing that if you are manually installing instead as it perfroms better | |
| 12:30:28 | sean-k-mooney | well in many cases at least | |
| 12:31:07 | jchorin_ | You mean to use wsgi? Yes it is entirely fine for me to use it. Do I only need to add this file to the site-available? | |
| 12:31:51 | sean-k-mooney | well that s in jinga 2 format so you need to add a rendered equivalent but yes | |
| 12:32:03 | sean-k-mooney | then symlink it to site-enabled | |
| 12:32:25 | jchorin_ | However, the server will still be running right?, So both TLS and non-TLS will be reachable | |
| 12:32:28 | gibi | sean-k-mooney: hm, I'm not expert on the TLS front, what deploymnet I see was basically using a TLS proxy in front of the API servies | |
| 12:33:12 | sean-k-mooney | gibi: yep i think that is what we did before we could run the api with a wsgi server via a web server | |
| 12:34:20 | sean-k-mooney | jchorin_: what os are you on | |
| 12:34:25 | jchorin_ | Ubuntu | |
| 12:34:47 | sean-k-mooney | ok are you following https://docs.openstack.org/nova/wallaby/install/controller-install-ubuntu.html#install-and-configure-components | |
| 12:35:10 | sean-k-mooney | that is indeed mssing a tls section | |
| 12:35:27 | jchorin_ | This one yes | |
| 12:36:18 | sean-k-mooney | its also using sytemd to run nova-api presumable directly as you noted above | |
| 12:44:35 | jchorin_ | Alright, I'll take a look, thanks for your help! | |
| 12:45:36 | sean-k-mooney | i have just been looking and out side of the installer that have implemented support for tls endpoing like kolla-ansible and tripleo i do not see any docs for how to deploy openstack with tls endpoints | |
| 12:46:41 | sean-k-mooney | so this is an operational gap in our docs as a whole | |
| 12:47:38 | jchorin_ | Yes, I could not find any information except for the `cert` and `key` settings in the conf | |
| 12:47:40 | sean-k-mooney | the general approch however seams to be the same across most installer project, use a webserver to handel the tls/ssl laywer and hand off to the openstack service | |
| 13:11:30 | sean-k-mooney | gibi: kashyap fyi i filed the whishlist bug for the realtime emulator threads here https://bugs.launchpad.net/nova/+bug/1930706 | |
| 13:11:30 | opendevmeet | Launchpad bug 1930706 in OpenStack Compute (nova) "nova allows suboptimal emulator tread pinning for realtime guests" [Wishlist,Triaged] | |
| 13:11:47 | sean-k-mooney | just closing out that ar form the last meeting | |
| 13:12:19 | sean-k-mooney | speaking of which i think the new review priortiy docs have merged? im going to go update the patch to project config | |
| 13:12:58 | jchorin | sean-k-mooney : Unfortunately I got "could not bind to address 0.0.0.0:8774", as the serverlet is still running and I do not use kolla. Is there a configuration setting for changing the port or should I do it differently? | |
| 13:14:40 | sean-k-mooney | you should stop the serverlet | |
| 13:14:56 | sean-k-mooney | so stop the nova-api systemd service and disable it | |
| 13:15:05 | sean-k-mooney | then run it only under apache | |
| 13:15:44 | kashyap | sean-k-mooney: Thanks for writing it up; it might be worth it to explicilty flag the workaround for operators who're not well-versed in this area | |
| 13:16:18 | sean-k-mooney | kashyap: i think i said that in the comment i left | |
| 13:16:28 | sean-k-mooney | e.g. use emulator thread policy | |
| 13:16:31 | kashyap | sean-k-mooney: Ah, the second comment, yes | |
| 13:17:02 | sean-k-mooney | i realised i did not add it orginally | |
| 13:17:10 | kashyap | sean-k-mooney: The "not" at the start confused me; I know you meant it as "note" | |
| 13:17:12 | sean-k-mooney | i think the bug desciription can be updated if you want to add it | |
| 13:17:35 | sean-k-mooney | kashyap: ya i did | |
| 13:17:55 | sean-k-mooney | i just fixed that | |
| 13:18:09 | kashyap | Ah, cool. | |
| 13:18:14 | sean-k-mooney | but if you want ot update the description please feel free too | |
| 13:18:27 | kashyap | sean-k-mooney: Yeah, good idea to update the description; /me goes to do it :) | |
| 13:19:04 | kashyap | sean-k-mooney: Mind if I also touch up a few typos? | |
| 13:19:44 | sean-k-mooney | go for it | |
| 13:20:42 | kashyap | sean-k-mooney: One clarif: | |
| 13:20:46 | kashyap | In this bit: "When the emulator thread is spawned on core 1 since it has less priority then the vcpu thread it will only run if the guest vcpu idels resulting in the iablity for qemu to process device attach" | |
| 13:21:08 | kashyap | sean-k-mooney: Can you pleease rephrase the last part? The "idels and "iability" are ambigious to parse for me | |
| 13:29:02 | kashyap | sean-k-mooney: Added the "Workaround" section at the end of the description; please double-check. | |
| 13:32:18 | dansmith | sean-k-mooney: no I don't know | |
| 13:41:10 | ozzzo | Sean has helped me a lot so I've gotten pretty good at translating Seanglish: "guest vcpu idles resulting in the inability" | |
| 13:42:30 | kashyap | ozzzo: Ah, thanks. I'm mostly pretty good at parsing him, sometimes I miss the mark :) | |
| 13:46:13 | kashyap | sean-k-mooney: Disregard my above question (thx to ozzzo); updated the bug. | |
| 13:47:53 | sean-k-mooney | ozzzo: hehe seanspeak is a select dialect :) | |
| 14:00:55 | opendevreview | Merged openstack/nova stable/queens: Update pci stat pools based on PCI device changes https://review.opendev.org/c/openstack/nova/+/761825 | |
| 14:32:47 | gmann | melwitt: no, it was by mistake. thanks for catching it. fixing it now | |
| 14:46:39 | opendevreview | Ghanshyam proposed openstack/nova master: Improve policy doc for supported scope info https://review.opendev.org/c/openstack/nova/+/762013 | |
| 14:47:15 | gmann | melwitt: stephenfin updated ^^ | |
| 14:59:42 | gmann | we move the IRC channel to OFTC network, please join there https://docs.openstack.org/contributors/common/irc.html | |