| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-06-11 | |||
| 15:45:15 | dansmith | yeah, sure, and that's legit, but I just wonder if someone would interpret restricting get to mean "they can never see this resource any way at all" which won't be the case | |
| 15:45:43 | gmann | dansmith: other way I think neutron does (need to check again) is check GET policy before PUT and deny if they do not have access to GET. | |
| 15:46:08 | dansmith | meaning require get and put perms to do a PUT, or just check get perms before returning the result? | |
| 15:46:38 | gmann | dansmith: I think yes, let me check. that is what i remember when i discussed it with amotoki in Toyko time. | |
| 15:46:47 | dansmith | the latter may make sense, but is probably not worth it, IMHO.. the former seems wrong | |
| 15:48:04 | dansmith | write-implies-read makes sense, write-requires-read does not, IMHO | |
| 15:56:57 | gmann | dansmith: cannot find that, will check later | |
| 15:57:13 | dansmith | gmann: no worries, not important at the moment, just curious | |
| 15:58:35 | gmann | dansmith: what we can do is restrict the PUT response if GET is not permit. GET-not-permit in this case (where PUT is allowed) means do not show server info instead of no access to server | |
| 15:59:23 | dansmith | gmann: yeah, that's the only thing that makes sense I think.. but I think you can argue that it's not worth that level of granularity | |
| 16:00:28 | dansmith | basically, three options: 1. PUT requires GET to work at all (bad) 2. PUT will show you the result even if you don't have GET (acceptable) 3. PUT will only show you the result if you also have GET (acceptable) | |
| 16:00:54 | dansmith | #2 is easy/default, #3 is doable | |
| 16:01:26 | gmann | yeah, we can do #3 if anyone ask for that and have that requirement of allow-write but no-read | |
| 16:02:05 | dansmith | ++ | |
| 16:14:04 | opendevreview | Balazs Gibizer proposed openstack/nova master: Add debug log for device detach libvirt error https://review.opendev.org/c/openstack/nova/+/796043 | |
| 16:16:27 | gibi | lyarwood: I think I found out that libvirt has an extra way to tell us that a device we try to detach is missing. So our handler in nova does not recognize it as VIR_ERR_DEVICE_MISSING but handles it as unexpected and blows | |
| 16:16:47 | gibi | lyarwood: I pushed a patch that adds a debug log to show what error code libvirt returns in this case | |
| 16:17:06 | gibi | https://bugs.launchpad.net/nova/+bug/1931716 | |
| 16:23:31 | gmann | dansmith: i was wrong on neutron check GET permission to update resource. They check GET permission in PUT/DELETE just to decide whether to return 403 or 404 if PUT is not permitted. - https://github.com/openstack/neutron/blob/master/neutron/api/v2/base.py#L671-L685 | |
| 16:23:52 | dansmith | gmann: ah, another interesting wrinkle | |
| 16:24:08 | gmann | yeah :) | |
| 16:27:03 | opendevreview | Ade Lee proposed openstack/nova master: Add check job for FIPS https://review.opendev.org/c/openstack/nova/+/790519 | |
| 22:06:34 | opendevreview | Ghanshyam proposed openstack/nova stable/train: DNM: testing https://review.opendev.org/c/openstack/nova/+/796070 | |
| #openstack-nova - 2021-06-12 | |||
| 06:24:17 | opendevreview | Balazs Gibizer proposed openstack/nova master: Add debug log for device detach libvirt error https://review.opendev.org/c/openstack/nova/+/796043 | |
| 11:55:12 | opendevreview | Merged openstack/nova master: zuul: Skip block migration with attached volumes tests due to bug #1931702 https://review.opendev.org/c/openstack/nova/+/795992 | |
| 17:27:02 | opendevreview | Merged openstack/nova master: virt: Add destroy_secrets kwarg to destroy and cleanup https://review.opendev.org/c/openstack/nova/+/794252 | |
| 20:55:32 | opendevreview | Merged openstack/nova master: requirements: Add types-paramiko https://review.opendev.org/c/openstack/nova/+/795533 | |
| #openstack-nova - 2021-06-13 | |||
| 01:33:24 | opendevreview | Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from List/Update Servers APIs https://review.opendev.org/c/openstack/nova/+/764292 | |
| 01:34:22 | opendevreview | Wenping Song proposed openstack/nova master: Replace all_tenants with all_projects in List Server APIs https://review.opendev.org/c/openstack/nova/+/765311 | |
| 05:49:34 | opendevreview | Merged openstack/nova master: libvirt: Do not destroy volume secrets during _hard_reboot https://review.opendev.org/c/openstack/nova/+/793463 | |
| 05:58:02 | opendevreview | Merged openstack/nova master: Remove (almost) all references to 'instance_type' https://review.opendev.org/c/openstack/nova/+/778547 | |
| 08:47:23 | opendevreview | Jorhson Deng proposed openstack/nova master: remove the redundantcode for attach interface https://review.opendev.org/c/openstack/nova/+/796208 | |
| 08:54:13 | opendevreview | Jorhson Deng proposed openstack/nova master: remove the redundant code for attach interface https://review.opendev.org/c/openstack/nova/+/796208 | |
| 08:57:23 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful https://review.opendev.org/c/openstack/nova/+/796209 | |
| 09:05:50 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful https://review.opendev.org/c/openstack/nova/+/796209 | |
| 09:07:05 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful https://review.opendev.org/c/openstack/nova/+/796209 | |
| 09:12:32 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful reference: https://opendev.org/openstack/nova/src/branch/master/nova/compute/manager.py#L2897 https://review.opendev.org/c/openstack/nova/+/796209 | |
| #openstack-nova - 2021-06-14 | |||
| 05:16:49 | gibi | good morning | |
| 05:16:57 | gibi | early cores, can we turn on mypy now https://review.opendev.org/c/openstack/nova/+/795973 ? | |
| 05:17:17 | gibi | the missing requirement for mpyp 0.9 has been merged over the weekend | |
| 07:47:38 | bauzas | gibi: I could do it but... | |
| 07:47:47 | gibi | but? :) | |
| 07:47:52 | gibi | ahh, you are the author | |
| 07:47:55 | bauzas | ;) | |
| 07:48:03 | gibi | you tricked me :) | |
| 07:48:05 | bauzas | gibi: just do a fast approval | |
| 07:48:23 | gibi | I think stephenfin will be up soon | |
| 07:49:52 | bauzas | well ok | |
| 08:37:59 | lyarwood | +W'd | |
| 08:38:18 | lyarwood | looking at https://bugs.launchpad.net/nova/+bug/1931716 now btw | |
| 08:41:59 | opendevreview | Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from Rebuild Server API https://review.opendev.org/c/openstack/nova/+/766380 | |
| 08:42:41 | opendevreview | Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from List SG API https://review.opendev.org/c/openstack/nova/+/766726 | |
| 08:43:32 | opendevreview | Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from Flavor Access APIs https://review.opendev.org/c/openstack/nova/+/767704 | |
| 08:44:18 | opendevreview | Wenping Song proposed openstack/nova master: Replaces tenant_id with project_id from List/Show usage APIs https://review.opendev.org/c/openstack/nova/+/768509 | |
| 08:44:52 | gibi | lyarwood: thanks. I pushed a small patch with debug log to see what is the error code libvirt sends https://review.opendev.org/c/openstack/nova/+/796043 | |
| 08:48:44 | kashyap | Hmm, it's this disk not found thing ... I have a deja vu of this w/ device-detach | |
| 08:49:43 | gibi | kashyap: yes, it is totally deja vus | |
| 08:50:16 | gibi | morning | |
| 08:52:56 | lyarwood | I called out some commits in https://review.opendev.org/c/openstack/nova/+/741561 that seemed to show we were using VIR_ERR_DEVICE_MISSING now so I'm slightly confused by this | |
| 08:53:04 | lyarwood | unless someone reverted some of this in libvirt | |
| 08:53:31 | lyarwood | https://libvirt.org/git/?p=libvirt.git;a=blobdiff;f=src/qemu/qemu_hotplug.c;h=5be3e0659ad749e7e8a3585f6b98e2f218f34059;hp=a62dbe79e5650b051f02bb059afbd251b296b899;hb=126db34a81bc9f9f9710408f88cceaa1e34bbbd7;hpb=bb189c8e8c93f115c13fa3bfffdf64498f3f0ce1 for example | |
| 08:55:07 | gibi | lyarwood: I think we can wait until I can reproduce the problem with the extra debug log to is what is the error code, then after that I can add that code to the handler in nova | |
| 08:55:24 | gibi | s/to is/to see/ | |
| 08:57:12 | lyarwood | ack yeah and I'll have a quick look at the libvirt code to see what's changed if anything | |
| 08:57:22 | gibi | ack, thanks | |
| 09:03:32 | lyarwood | https://github.com/libvirt/libvirt/blob/55ea45acc99c549c7757efe954aacc33ad30a8ef/src/qemu/qemu_hotplug.c#L5324-L5328 yeah it didn't change all the paths | |
| 09:03:35 | lyarwood | gah! | |
| 09:03:43 | lyarwood | that's the one I'm assuming we are hitting here tbh | |
| 09:10:07 | gibi | jepp, that could be the case | |
| 09:10:18 | gibi | then I will prepare a commit adding handler for it | |
| 10:10:46 | opendevreview | Jorhson Deng proposed openstack/nova master: remove the redundant code for attach interface https://review.opendev.org/c/openstack/nova/+/796208 | |
| 10:13:50 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful reference: https://opendev.org/openstack/nova/src/branch/master/nova/compute/manager.py#L2897 https://review.opendev.org/c/openstack/nova/+/796209 | |
| 10:14:54 | opendevreview | Jorhson Deng proposed openstack/nova master: recheck the attachment_id after the reschedule successful https://review.opendev.org/c/openstack/nova/+/796209 | |
| 10:19:41 | lyarwood | gibi: https://listman.redhat.com/archives/libvir-list/2021-June/msg00337.html FWIW | |
| 10:20:30 | gibi | lyarwood: awesome | |
| 10:20:33 | gibi | thanks | |
| 10:20:49 | gibi | I'm just writing the unit test for the nova patch | |
| 10:35:40 | opendevreview | Balazs Gibizer proposed openstack/nova master: Handle OPERATION_FAILED error during detach https://review.opendev.org/c/openstack/nova/+/796255 | |
| 10:41:03 | gibi | lyarwood: ^^ | |
| 10:41:10 | lyarwood | ack looking | |
| 10:45:01 | lyarwood | LGTM | |
| 11:00:16 | opendevreview | Lee Yarwood proposed openstack/nova stable/wallaby: virt: Add destroy_secrets kwarg to destroy and cleanup https://review.opendev.org/c/openstack/nova/+/796257 | |
| 11:00:17 | opendevreview | Lee Yarwood proposed openstack/nova stable/wallaby: libvirt: Do not destroy volume secrets during _hard_reboot https://review.opendev.org/c/openstack/nova/+/796258 | |
| 11:01:01 | opendevreview | Lee Yarwood proposed openstack/nova stable/victoria: virt: Add destroy_secrets kwarg to destroy and cleanup https://review.opendev.org/c/openstack/nova/+/796259 | |
| 11:01:02 | opendevreview | Lee Yarwood proposed openstack/nova stable/victoria: libvirt: Do not destroy volume secrets during _hard_reboot https://review.opendev.org/c/openstack/nova/+/796260 | |
| 11:05:26 | opendevreview | Lee Yarwood proposed openstack/nova stable/ussuri: virt: Add destroy_secrets kwarg to destroy and cleanup https://review.opendev.org/c/openstack/nova/+/796262 | |
| 11:05:27 | opendevreview | Lee Yarwood proposed openstack/nova stable/ussuri: Detach is broken for multi-attached fs-based volumes https://review.opendev.org/c/openstack/nova/+/796263 | |
| 11:05:28 | opendevreview | Lee Yarwood proposed openstack/nova stable/ussuri: libvirt: Do not destroy volume secrets during _hard_reboot https://review.opendev.org/c/openstack/nova/+/796264 | |
| 11:09:39 | stephenfin | lyarwood: elodilles_afk: Could you folks stick https://review.opendev.org/c/openstack/os-vif/+/765967 and its relatives on the stable review list for this week? | |
| 11:09:47 | lyarwood | ack | |
| 11:09:51 | stephenfin | ta | |
| 11:10:16 | lyarwood | didn't we say that the os-vif cores were going to end up as stable cores? | |
| 11:10:31 | lyarwood | ah lunch is ready, I'll get to this afterwards brb | |
| 11:10:37 | stephenfin | I thought we did but we haven't made the change yet | |
| 11:10:40 | stephenfin | nw | |
| 11:18:58 | elodilles | stephenfin: sure, will review as soon as I get there :) | |
| 11:39:01 | opendevreview | Balazs Gibizer proposed openstack/nova master: [func test] create pps resource on OVS agent RP https://review.opendev.org/c/openstack/nova/+/787205 | |
| 11:39:01 | opendevreview | Balazs Gibizer proposed openstack/nova master: [func test] move port creation to the NeutronFixture https://review.opendev.org/c/openstack/nova/+/787206 | |
| 11:39:02 | opendevreview | Balazs Gibizer proposed openstack/nova master: [func test] refactor assertPortMatchesAllocation https://review.opendev.org/c/openstack/nova/+/792458 | |
| 11:39:02 | opendevreview | Balazs Gibizer proposed openstack/nova master: [func test] neutron fixture for extended resource request https://review.opendev.org/c/openstack/nova/+/794306 | |