Earlier  
Later
New Search
Posted Nick Remark
#openstack-nova - 2021-08-25
16:48:18 sean-k-mooney via a dnm patch
16:50:46 artom It should
16:51:23 artom I was thinking the other way around, have an ooo DNM patch depending on the nova one, but whatever works
16:53:11 sean-k-mooney artom: that is what im going to do
17:01:33 lbragstad gmann so - i'm working through a test where a system-admin creates a server in a project (specifically trying to find what needs to change in KSA to make that possible)
17:02:21 lbragstad and it looks like the first failure is https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L265 because neutron is using a novaclient with a project-scoped token (instead of a system-scoped one)
17:03:35 sean-k-mooney that nova client should be using the token set in the neutron.conf
17:03:53 sean-k-mooney which woudl normally be the nova user or a service user
17:03:59 lbragstad yeah - exaclty
17:04:00 lbragstad and it does
17:04:02 lbragstad so - that's good
17:04:28 sean-k-mooney so the nova user would have to be a project member or if it was a system_memeber we need a new parmater to specifcy a project id i ugess
17:04:31 sean-k-mooney *guess
17:04:55 sean-k-mooney the api its calling however is admin only and not really proejct specfic
17:05:15 sean-k-mooney im surpised that is failing
17:05:25 lbragstad in https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L265 specifically - the nova user would need to be a system-admin https://github.com/openstack/nova/blob/master/nova/policies/server_external_events.py#L27
17:05:40 lbragstad iiuc
17:05:41 sean-k-mooney yes
17:06:48 sean-k-mooney so the nova user woul dhave to be a system_admin
17:06:52 lbragstad right
17:07:10 lbragstad so that neutron can use that user with a client to create external events in nova
17:07:38 sean-k-mooney yes
17:07:46 sean-k-mooney its calling this endpoint https://docs.openstack.org/api-ref/compute/?expanded=run-events-detail#run-events
17:08:06 lbragstad in addition to that - we'd need a way to make sure neutron is using the right scope when building the auth request
17:08:24 lbragstad https://github.com/openstack/neutron/blob/master/neutron/notifiers/nova.py#L61
17:09:35 sean-k-mooney yep we woudl need to add a new config parmater ofor the scop to use
17:09:41 sean-k-mooney https://github.com/openstack/nova/blob/master/nova/policies/server_external_events.py#L24-L35
17:09:54 sean-k-mooney in this case system scope
17:10:05 lbragstad and i imagine that's going to be a pattern we need else where?
17:10:43 lbragstad i'm expecting this is just the first time i'm hitting this issue, but there are other layers to the onion
17:11:00 sean-k-mooney well its going to happen but worse for volume resize
17:11:17 lbragstad sure - that makes sense
17:11:17 sean-k-mooney cinder currently has bug where it calls that endpoing with the users token
17:11:24 sean-k-mooney instead of actully using an admin one
17:12:01 sean-k-mooney but yes i expect the pattern to be the same or similar
17:12:23 dansmith sean-k-mooney: is that a bug, or just how it used to work?
17:12:26 sean-k-mooney im surprised that it got that far by the way
17:12:31 sean-k-mooney dansmith: no that is a bug
17:12:45 sean-k-mooney which ooo worked around by hardcodeing cidner to call nova admin api endpoint directly
17:12:57 dansmith is this the swap volume api or something else?
17:13:08 lbragstad fwiw - this is what i'm doing to recreate this https://review.opendev.org/c/openstack/tempest/+/805452
17:13:17 sean-k-mooney i tought it was resize for nfs but ill have to go look it up
17:13:38 sean-k-mooney lbragstad: by the way i was expecting a failure before that when nova called neutron to bind the port
17:13:46 lbragstad yeah - me too
17:13:52 sean-k-mooney we do that as a admin
17:13:58 dansmith okay just saying.. the swap volume api has always been user-visible, but problematic.. people have used it for non-cinder tasks before and we discussed whether or not they should be able to.. but they are (or were)
17:14:36 sean-k-mooney dansmith: im pretty sure the issue i was refering too was for online volume resize whne cinder calls nova back to tell it its done
17:14:41 sean-k-mooney dansmith: ill see if i can find it
17:15:16 dansmith okay, there's some volume op that uses swap_volume for that sort of thing (cinder calling to nova)
17:15:20 dansmith but might be different
17:16:10 sean-k-mooney dansmith: i dont have the ooo one to hand but this is the osa dup https://bugs.launchpad.net/openstack-ansible/+bug/1902914 and redhat kcs...https://access.redhat.com/solutions/3675991
17:17:01 dansmith okay I expect this is different
17:17:33 sean-k-mooney yes lbragstad current issue is different and expected
17:18:23 sean-k-mooney well expected in that each of the serviceis will need to know how to call each of the other services with the correct scopes
17:19:51 sean-k-mooney lbragstad: you could try booting an instance with no network as a simpler starting point
17:20:20 sean-k-mooney lbragstad: that would limit the interaction ot nova, keystone, glance and placment
17:20:47 sean-k-mooney placment would be the only thing that used any admin creds in that flwo also
17:20:59 sean-k-mooney we would use the user token for the glance image
17:22:19 sean-k-mooney im not 100% shoure what you would need to add but i think it would be something like network=none to your self.create_test_server( call
17:22:40 lbragstad yeah - that makes sense
17:24:13 gmann lbragstad: for system scope enabled. tempest does not create network
17:24:41 gmann lbragstad: that is skipped when create network was project scoped in neutron but that is changed i think
17:24:55 lbragstad ah - interesting
17:25:25 gmann lbragstad:
17:25:27 gmann lbragstad: https://review.opendev.org/c/openstack/tempest/+/798130
17:26:21 lbragstad gmann is that still the case with https://review.opendev.org/c/openstack/tempest/+/805452/4/tempest/api/compute/admin/test_servers.py ?
17:26:26 gmann lbragstad: for network created for network, we need to modify that also to pass the project_id in neutron request for system scope
17:26:58 gmann lbragstad: yes. we have not changed that for ^^. and no network for system scoped cred
17:28:45 gmann I can work on that tomorrow to pass projetc_id as slaweq mentioned in that review
17:42:47 lbragstad gmann ok - that sounds good, i'm trying to track all of this stuff as a find it, but it's likely going to be a lot of sprawl
17:43:02 lbragstad stepping out for about 30 minutes
17:45:45 opendevreview melanie witt proposed openstack/placement master: Refactor consumer type methods for readability https://review.opendev.org/c/openstack/placement/+/806035
17:46:35 melwitt sean-k-mooney, lyarwood: fixups for consumer types ^
18:12:46 sean-k-mooney melwitt: im kind of +0.5 https://review.opendev.org/c/openstack/placement/+/806035/1/placement/objects/usage.py#91
18:14:58 melwitt sean-k-mooney: thanks, I will reword it
18:22:45 opendevreview melanie witt proposed openstack/placement master: Refactor consumer type methods for readability https://review.opendev.org/c/openstack/placement/+/806035
18:26:45 sean-k-mooney melwitt: by the way im just looking at the db tests i assume somehting in here https://github.com/openstack/nova/blob/master/nova/tests/unit/db/main/test_migrations.py that uses the OpportunisticDBTestMixin would be what you want for the alembic urls
18:30:34 melwitt sean-k-mooney: ah, cool. I have used that mixin once before I think. fwiw I wasn't clear on whether we need a database to cover some test inputs or if we only need the config parser behind it. whatever works
18:31:18 melwitt want to be able to do at least a couple of cases, one with the encoded chars and one with a password for example with a literal "%" in it
18:31:41 melwitt or I guess that could just be one case by putting both together in one example
18:32:28 sean-k-mooney ok im just going thought the different fixture we have aviable to us
18:32:30 sean-k-mooney https://github.com/openstack/oslo.db/blob/22b44ee18b1585bc2943a29ddaa18051cb1344ed/oslo_db/sqlalchemy/test_fixtures.py#L399
18:32:46 sean-k-mooney we have the fix ture and the mixins
18:32:55 melwitt ah ok
18:33:39 sean-k-mooney the adhock db fixture allows us to pass a url https://github.com/openstack/oslo.db/blob/22b44ee18b1585bc2943a29ddaa18051cb1344ed/oslo_db/sqlalchemy/test_fixtures.py#L273
18:34:30 sean-k-mooney the opertunistic mixin can be combind with any of the fixture i think
18:35:32 sean-k-mooney we need to modify the engin url if we want to test this right before tuning the db sync
18:36:56 melwitt meanwhile, the consumer types patches are failing on that dang server delete fail for AllocationDeleteFailed conflict 😑
18:37:04 sean-k-mooney melwitt: i have updated stephens exisitng test case already just trying to see if theyer is a good way to also add the extra tests you where hoping for
18:37:46 sean-k-mooney if only there was a patch we could merge for that :)
18:37:52 sean-k-mooney thats furstrating
18:38:32 melwitt sean-k-mooney: ok, cool. lmk if you need a hand with it, I can try to help
20:01:31 opendevreview sean mooney proposed openstack/nova master: db: Handle parameters in DB strings https://review.opendev.org/c/openstack/nova/+/805663
20:01:33 sean-k-mooney melwitt: ok that did not work but i found another way to test this
20:02:04 sean-k-mooney i realised after i fot the adhoc fixture working that would not test any of our config loading ectra
20:02:19 sean-k-mooney which is what we actully wanted to test
20:02:47 sean-k-mooney well initalising the alembic config form our config
20:10:26 opendevreview Artom Lifshitz proposed openstack/nova master: WIP: Update PCI requests in request spec on resize https://review.opendev.org/c/openstack/nova/+/806049
20:15:41 melwitt sean-k-mooney: sweet! just added some comments
22:18:12 opendevreview Merged openstack/nova stable/wallaby: Allow X-OpenStack-Nova-API-Version header in CORS https://review.opendev.org/c/openstack/nova/+/796860

Earlier   Later