| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2021-11-25 | |||
| 08:50:42 | nautik | Hello! I updated a merge request from a few months ago and it seems there is a "DellEMC PowerFlex CI" build failing with a message "EMC_PowerFlex_NOVA [...] : NOT_REGISTERED". Other builds (VMware, IBM...) succeeded. | |
| 08:50:56 | nautik | is that expected or should I do something about it? | |
| 08:50:59 | nautik | the mr is https://review.opendev.org/c/openstack/nova/+/781076 | |
| 08:56:24 | frickler | nautik: that means that this 3rd party CI is offline. not related to your patch, nothing you can do about it | |
| 08:57:26 | frickler | except possibly trying to contact the CI operators, but that task should be on the nova team in general, not on you as patch author | |
| 09:07:01 | nautik | ok cool! thank you for the feedback, then this MR is ready for review | |
| 09:07:42 | nautik | (not sure if I need to add some tags or do anything more to make it visible?) | |
| 09:11:44 | frickler | nautik: just give it a couple of days, this week is also holiday season in some parts of the world. I there is no response after that, you could try pinging folks here again | |
| 09:12:06 | frickler | s/I/If/ | |
| 09:15:39 | nautik | right, forgot that! Thank you and have a good day :) | |
| 12:17:37 | opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | |
| 13:05:57 | opendevreview | Merged openstack/nova master: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/818503 | |
| 13:44:16 | sdmitriev1 | mnaser: good call, will look into that | |
| 13:55:13 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/xena: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819179 | |
| 13:55:27 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/wallaby: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819180 | |
| 13:55:39 | opendevreview | Stanislav Dmitriev proposed openstack/nova stable/victoria: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/819181 | |
| 14:09:24 | lyarwood | gibi: https://review.opendev.org/c/openstack/nova/+/818357 would you mind taking a look at this? | |
| 14:09:29 | gibi | sure | |
| 14:11:51 | gibi | done | |
| 14:11:55 | gibi | thanks for updating our docs | |
| 15:07:11 | opendevreview | Merged openstack/nova stable/xena: Ensure MAC addresses characters are in the same case https://review.opendev.org/c/openstack/nova/+/816882 | |
| 15:52:21 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 15:52:22 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:00:41 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 16:00:41 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:21:43 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 16:21:58 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 16:56:51 | opendevreview | Ghanshyam proposed openstack/nova master: Updating tests with Yoga testing runtime https://review.opendev.org/c/openstack/nova/+/819194 | |
| 17:38:34 | opendevreview | Ghanshyam proposed openstack/nova master: Updating tests with Yoga testing runtime https://review.opendev.org/c/openstack/nova/+/819194 | |
| 17:40:51 | opendevreview | Merged openstack/nova master: docs: Update libvirt distro support matrix for Xena https://review.opendev.org/c/openstack/nova/+/818357 | |
| 17:44:40 | EugenMayer | What are the thoughs about moving secrets into the meta-data service which are shared e.g. by cluster nodes? Is this considered heavily unsecure? AFAIC each instance can only access it's own meta-data and cannot read any other instance meta-data, right? (Is this actually a nova or neutron question?) | |
| 18:16:13 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 18:16:14 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 18:16:34 | sean-k-mooney | EugenMayer: am well you are partly correct | |
| 18:16:49 | sean-k-mooney | EugenMayer: ech isntance is only able to access its onw metadata | |
| 18:16:59 | sean-k-mooney | however the metadata is also avaiable vai the api | |
| 18:17:20 | sean-k-mooney | so anywone in the project can access it via the api | |
| 18:17:30 | EugenMayer | yes sure, every openstack admin cann access it .. but this one can also simply access the storage and read anything. | |
| 18:17:45 | sean-k-mooney | we also do not encypty the metaddat in any way in the nova db or when its sent to the instance | |
| 18:18:11 | EugenMayer | I understand. It is plain text, send plain text | |
| 18:18:21 | sean-k-mooney | yep | |
| 18:18:38 | sean-k-mooney | so as an end user you can do this but you really shoudl use barbican | |
| 18:19:00 | sean-k-mooney | https://docs.openstack.org/barbican/latest/ | |
| 18:19:25 | sean-k-mooney | EugenMayer: it provices and implementation fo a secure key manager which user and openstack can use | |
| 18:19:29 | EugenMayer | interesting - usually i would rather use vault | |
| 18:20:54 | sean-k-mooney | EugenMayer: it has a vault plugin | |
| 18:21:05 | sean-k-mooney | https://docs.openstack.org/barbican/latest/configuration/plugin_backends.html#enabling-multiple-barbican-backends | |
| 18:21:18 | EugenMayer | what is the actually key USP of barbican compared to vault? Is there any auto-scoping of instances into "their namespace" or something like that? If it is just "if you have a speciifc token you can check in a secret KV for values you are interested in" i rather would use vault | |
| 18:21:19 | EugenMayer | i see | |
| 18:23:15 | EugenMayer | sean-k-mooney: i know i repeat myself - but nevertheless, thank you very much! | |
| 18:23:16 | sean-k-mooney | EugenMayer: basically openstack a as a project has decalred that we will not manage securets in each project | |
| 18:23:39 | sean-k-mooney | we use castellan to provide a generic key manager https://github.com/openstack/castellan | |
| 18:24:06 | sean-k-mooney | and then barbican provides a secrets as a service api that endusers or sevices can use | |
| 18:24:34 | sean-k-mooney | castellan support barbican as a secret store and barbican support several backend to actully store the secrets | |
| 18:25:11 | EugenMayer | I'am yet not sure i will need either of this. all secrets except this one are handled in k8s, this one is just to provision rke2. So i might stick to a chef-databag here since i use it to provision rke2 anyway | |
| 18:25:48 | sean-k-mooney | if you dont need to expose secrets as a service via openstack by the way castalan can also use vault directly | |
| 18:25:55 | sean-k-mooney | https://github.com/openstack/castellan/blob/master/castellan/key_manager/vault_key_manager.py | |
| 18:27:10 | EugenMayer | interesting, simple wrapper to read/write from the KV | |
| 18:27:43 | sean-k-mooney | https://docs.openstack.org/nova/latest/configuration/config.html#key_manager.backend you just ned to set that to valult and populate the related config options that are needed | |
| 18:28:24 | sean-k-mooney | EugenMayer: i dont know how much its used/tested | |
| 18:29:12 | sean-k-mooney | i dont often work on this part of the code but hoefully that helps | |
| 18:29:22 | EugenMayer | I would not go the wrapper, arround the wrapper arround the wrapper way for this. If i need this, i will stick to vault directly IMHO. But it def. is good to know how things are handled and valued in the ecosystem | |
| 18:30:10 | EugenMayer | meta-data is plaintext only, eventhough per instance, can be exploited if having enough API access (obviously). barbican to the rescue, will require a token to read from the storage, so knowledge required | |
| 18:30:34 | sean-k-mooney | EugenMayer: metadata will also show up in your debug logs in some cases | |
| 18:30:47 | opendevreview | Artom Lifshitz proposed openstack/nova master: Add nova-ovs-hybrid-plug job https://review.opendev.org/c/openstack/nova/+/817303 | |
| 18:30:48 | opendevreview | Artom Lifshitz proposed openstack/nova master: DNM: Try disabling bind-time events https://review.opendev.org/c/openstack/nova/+/819349 | |
| 18:31:07 | sean-k-mooney | so its really not intended for private stuff | |
| 18:32:01 | sean-k-mooney | EugenMayer: also just so you are aware instance metadta is included in nova notificaitons | |
| 18:33:02 | sean-k-mooney | amqp is ment to be secured because it contains sensitive things but its just more reason not to store passwords/keys in it if you can avoid it | |
| 18:35:50 | EugenMayer | understood, thank you! | |
| 18:50:48 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 18:55:16 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the powervm driver https://review.opendev.org/c/openstack/nova/+/819366 | |
| 18:56:38 | opendevreview | Stephen Finucane proposed openstack/nova master: Deprecate the zvm driver https://review.opendev.org/c/openstack/nova/+/819365 | |
| 19:01:12 | artom | Zombie developer removing zombie code | |
| 19:22:45 | stephenfin | mmm, brainz | |
| 19:50:03 | opendevreview | Merged openstack/nova master: db: Don't use legacy 'Row()' methods https://review.opendev.org/c/openstack/nova/+/817746 | |
| #openstack-nova - 2021-11-26 | |||
| 01:15:42 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 01:22:36 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 01:44:25 | opendevreview | Ghanshyam proposed openstack/nova master: Convert aggregate policies to admin and system scope https://review.opendev.org/c/openstack/nova/+/819390 | |
| 01:56:38 | opendevreview | Ghanshyam proposed openstack/nova master: Introduce 'admin' policy base rule https://review.opendev.org/c/openstack/nova/+/819389 | |
| 02:00:55 | gmann | dansmith: gibi bauzas I registered the nova BP for the RBAC goal. please let me know if I need to add spec or specless BP (with all direction defined in community wide goal) can be approved https://blueprints.launchpad.net/nova/+spec/policy-defaults-refresh-2 | |
| 02:03:08 | gmann | dansmith: gibi bauzas I mean all the direction are defined in goal itself so we can do audit of nova policy changes in proposed code itself or in wiki page before we code - https://wiki.openstack.org/wiki/Nova/rbac | |
| 02:03:24 | gmann | johnthetubaguy[m]: ^^ | |
| 08:25:11 | lyarwood | gibi / bauzas ; https://review.opendev.org/c/openstack/nova/+/819194 - would be good to get your thoughts on this btw | |
| 08:32:20 | gibi | lyarwood: do we want nova-tox-functional-centos8-py36 to be changed to run on py38? or that would require centos9? | |
| 08:32:56 | lyarwood | gibi: We can drop centos8-stream jobs entirely from master as the supported runtime is moving to 9 | |
| 08:33:24 | lyarwood | gibi: and yeah 9 then brings py39 iirc | |
| 08:34:00 | gibi | lyarwood: so then what I see in that change is consistent with the global testing runtime change | |
| 08:34:12 | gibi | lyarwood: do you have some reservation about this change/ | |
| 08:34:12 | gibi | ? | |
| 08:34:35 | lyarwood | gibi: Nope I'm good with it, gmann just had reservations so I wanted more people to chime in | |
| 08:35:01 | lyarwood | IMHO we should remove as much overhead as possible and that includes support/test runs for older runtimes | |
| 08:40:50 | gibi | lyarwood: OK, I gave +2, I agree with you that we need to force py38+ in the setup.cfg | |
| 08:41:12 | lyarwood | ack thanks, lets see what bauzas says as PTL before we +W | |
| 08:41:25 | gibi | sure | |
| 08:42:21 | gibi | stephenfin: as a fun note there is blue: https://blue.readthedocs.io/en/latest/ it is almost like black :D | |
| 08:42:42 | lyarwood | flol I love that logo | |
| 08:43:01 | gibi | I laught a lot the other day when somebody linked it in twitter | |
| 08:51:00 | gibi | I went and +2d the other yoga testing runtime changes under our jurisdiction | |
| 08:56:25 | kashyap | TIL; "blue" | |