| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-10 | |||
| 19:26:21 | artom | So if Jonathan Race writes an `if` block, is that a race condition? :D | |
| 19:27:20 | chateaulav | -lol, its a fast one for sure | |
| 19:30:36 | kashyap | chateaulav: Hey, I saw your email, but glad you're already here chatting. (I'm just back and catching up with things) | |
| 19:35:34 | opendevreview | Kashyap Chamarthy proposed openstack/nova-specs master: Repropose "CPU selection with guest hypervisor consideration" https://review.opendev.org/c/openstack/nova-specs/+/824053 | |
| 19:36:43 | kashyap | artom: In case you have a bit of time, mind you mind looking at chateaulav (Jonathan Race's) spec/blueprint? He has already been on it before I went on PTO | |
| 19:38:08 | artom | kashyap, wait, can you clarify? That spec is jut for the automatic re-approval paperwork, right? | |
| 19:38:15 | kashyap | artom: Mine, yes | |
| 19:38:26 | kashyap | artom: I was referring to chateaulav's spec - https://review.opendev.org/c/openstack/nova-specs/+/824044 | |
| 19:38:37 | kashyap | "Adds Pick guest CPU architecture based on host arch in libvirt driver support" | |
| 19:38:42 | artom | Ah, sorry, got confused by the "CPU" in both | |
| 19:39:26 | artom | Ack, I can take a look | |
| 19:39:41 | kashyap | chateaulav notes he's got a preview version of the code. | |
| 19:40:16 | kashyap | chateaulav: Also, I must add, upstream has been severely starved of reviewer attention, so don't be dissuaded if you don't see "quick responses". A ping here can help. | |
| 19:40:37 | kashyap | artom: Yeah, not your fault; a quick look at the title can be deceiving :) | |
| 19:40:59 | chateaulav | no worries, i understand. :) | |
| 19:46:34 | sean-k-mooney | kashyap: did you reporpose that based on the xena version | |
| 19:52:04 | sean-k-mooney | dansmith: i havent read your review comments on the health check speck but ill try and rework it tommorw with the other feedback | |
| 19:52:31 | dansmith | sean-k-mooney: cool, looks very comprehensive :) | |
| 19:54:00 | sean-k-mooney | am i was considering punting warn out of the inital scope | |
| 19:54:18 | sean-k-mooney | do you think we shoudl try and keep it intiall or just start with pass/fail | |
| 19:55:00 | dansmith | I think pass/fail for first go seems fine.. we can keep it in the spec as a valid result, but just implement everything as pass/fail initially I think | |
| 19:55:33 | sean-k-mooney | ack. i was conidering moving it to the alternitives section but that works too | |
| 19:56:05 | dansmith | if we're going to have it, it's not really an alternative, so I'd just leave the door open but say initially we'll just target pass/fail for the actual implementaiton | |
| 19:56:19 | sean-k-mooney | ack | |
| 19:57:13 | sean-k-mooney | and yes i speelchecked v2 with gramerly but then i made a lot of changes i will corret that in v4 | |
| 19:57:59 | dansmith | I figured.. seemed like a whole section was affected :D | |
| 19:59:05 | sean-k-mooney | oh i like the idea of makeing devstack use this to see if the service is started | |
| 19:59:16 | dansmith | yeah, dogfood is yummy :) | |
| 19:59:34 | sean-k-mooney | your right we currently hit the service endpoitn and check if its up | |
| 19:59:44 | dansmith | yeah | |
| 20:00:42 | sean-k-mooney | ok its just 8 hear so ill call it a day. hope you enjoyed your PTO talk to you tommorow | |
| 20:00:48 | sean-k-mooney | o/ | |
| 20:01:02 | dansmith | o/ | |
| 21:19:31 | opendevreview | Ade Lee proposed openstack/nova master: Add ecdsa key generation https://review.opendev.org/c/openstack/nova/+/824062 | |
| 21:20:21 | ade_lee | sean-k-mooney, fungi , gmann https://review.opendev.org/c/openstack/nova/+/824062 | |
| 21:21:21 | ade_lee | sean-k-mooney, fungi gmann please take a look and comment. I'm not sure yet if all the tests will pass - but I want to make sure you all agree with the approach before I add more to it. | |
| 21:21:39 | ade_lee | and let me know what else needs to be added | |
| 21:22:08 | fungi | sure | |
| 21:22:20 | ade_lee | thanks! | |
| 21:29:32 | clarkb | my only though is the existing type seems to distinguish the encoding ssh vs x509 not the actual key algorithm. Might want to do ssh_ecdsa instead to keep that axis? | |
| 21:30:30 | ade_lee | clarkb, sure I can do that - thats easy enough | |
| 21:30:56 | ade_lee | clarkb, please add that comment to the review so others can comment on it | |
| 21:31:13 | clarkb | can do | |
| 21:31:17 | ade_lee | thanks | |
| 21:31:23 | clarkb | and ya I'd wait for someone that knows nova better to weigh in on what I say before implementing it | |
| 21:32:23 | fungi | oh, i assumed that was for ssh's x509 auth | |
| 21:34:06 | clarkb | it may be, though I'm not sure how nova would configure the VM to enable that? it would have to add the CA to stuff right? | |
| 21:34:14 | clarkb | in any case ssh vs x509 vs ecdsa is a bit confusing to me | |
| 21:34:20 | clarkb | as they don't seem to align | |
| 21:35:01 | fungi | yeah, agreed | |
| 22:13:59 | opendevreview | Merged openstack/nova stable/xena: [rt] Apply migration context for incoming migrations https://review.opendev.org/c/openstack/nova/+/820553 | |
| 22:24:55 | ade_lee | fungi, you haven't heard anything from canonical re: fips yet , have you? | |
| 22:25:22 | ade_lee | clarkb, ^^ | |
| 22:25:31 | ade_lee | if not, I'll re-ping | |
| 22:26:05 | clarkb | I haven't seen anything | |
| 22:26:15 | clarkb | there was an initial response and then fungi jumped in with more info iirc | |
| 22:27:24 | ade_lee | clarkb, ack thats the last I saw too -- I'll re-ping them | |
| 22:58:20 | fungi | ade_lee: clarkb: while i'm trying not to be pessimistic, we're really no good at running things which are locked up by commercial registration (cf a decade of failing to find a legal solution to testing on rhel) | |
| 22:59:10 | fungi | the easiest solution to it, from our perspective, is if ubuntu made their fips compliance solutions free for everyone | |
| 22:59:42 | clarkb | ya I suspect the easiset thing is for specific jobs to have access to a secret thta they use the enroll | |
| 22:59:49 | fungi | but that's a business decision involving the parts of canonical we rarely have the pleasure of interacting with | |
| 22:59:51 | clarkb | and then run that post merge or something | |
| 23:00:08 | clarkb | assuming their license system is ok with changing IPs and maybe even duplicate IPs over time | |
| 23:21:51 | gmann | ade_lee: ack, will check | |
| 23:37:14 | sean-k-mooney[m] | ade_lee you willl need a spec to change the api to allow ssh key gen with the ec algorithim | |
| 23:37:55 | sean-k-mooney[m] | nova currently allows you to import ecdsa keys | |
| 23:38:23 | sean-k-mooney[m] | but it cant generate them | |
| 23:39:02 | sean-k-mooney[m] | ade_lee if you want to start using them in tempest you should not relay on nova generating them | |
| 23:39:25 | sean-k-mooney[m] | at least not if you want to do it this cycle given spec freeze is thursday | |
| 23:44:31 | sean-k-mooney[m] | clarkb fungi gmann is there a reason for trying to do this in nova andn not in tempest | |
| 23:44:42 | sean-k-mooney[m] | i dont think the current approch is the correct one | |
| 23:45:13 | clarkb | sean-k-mooney[m]: well Ithink if nova generates keys it is reasonable to generate different key types. As a nova user I have never once relied on a key generated by nova for me though so I can see both sides | |
| 23:45:30 | sean-k-mooney[m] | ecdsa is not a differnt key type | |
| 23:45:45 | sean-k-mooney[m] | its a diffent algortiom for ssh key generation | |
| 23:45:54 | sean-k-mooney[m] | so the existing key-type fileid is not valid to extend | |
| 23:46:08 | sean-k-mooney[m] | and if we wer to expose this implentation detail we also should be exposing the key lenght | |
| 23:46:28 | gmann | sean-k-mooney[m]: there are two things here 1. add support and tests in tempest for ecdsa which is this (I have given comment to add tests for that) https://review.opendev.org/c/openstack/tempest/+/807465 2. add support in nova to autogenerate the ecdsa key this is what can be proposed in spec | |
| 23:47:09 | sean-k-mooney[m] | which spec? | |
| 23:47:11 | gmann | and in nova spec we can discuss about autogenerating the ecdsa key in nova. this nova change is not only because of tempest test but a new feature | |
| 23:47:28 | gmann | sean-k-mooney[m]: it is not yet proposed. but as you mentioned this is API change and need spec | |
| 23:48:10 | sean-k-mooney[m] | right so if we want to extend this feature we really shoudl add 2 knew parmaters 1 key size and 2 key algorthim or key cypher | |
| 23:49:03 | fungi | alternatively, consider that nova api deprecated and, as you say, have tempest generate and upload ecdsa keypairs instead | |
| 23:49:28 | sean-k-mooney[m] | ya | |
| 23:49:51 | fungi | i agree i've never used this nova "feature" either, so it does seem like maybe it's a vestige of a bygone era | |
| 23:49:54 | sean-k-mooney[m] | personally i would prefer to consider the generation part deprecated | |
| 23:50:28 | sean-k-mooney[m] | same i have always uses ssh-keygen or simialr espically when scpriting in ansible or similr | |
| 23:51:03 | fungi | the classical way to handle asymmetric keys is to generate the pairs client-side and only communicate the public part | |
| 23:51:29 | fungi | so having nova supply both halves is not great from a security perspective | |
| 23:51:44 | sean-k-mooney[m] | yep espically since using this api means if the rest api is not protected with ssl the private key is sent to you in the clear | |
| 23:52:33 | sean-k-mooney[m] | meaning it can be intercepted and while we dont log or store this key anywere as a user you dont know that | |
| 23:53:16 | sean-k-mooney[m] | the other benifit of the client generating it is they can generate it with any secuirty requirements they like | |
| 23:53:52 | gmann | yeah that seems more reasonable and secure. | |
| 23:53:57 | sean-k-mooney[m] | fungi this is being motivated by limiations in the cirros image ssh server right | |
| 23:54:28 | fungi | yes | |
| 23:54:28 | gmann | sean-k-mooney[m]: that is from proposed goal https://review.opendev.org/c/openstack/governance/+/816587 | |
| 23:54:46 | gmann | part of that | |
| 23:54:49 | sean-k-mooney[m] | do we need to revisit using alpine or an alternitive guest image at somepoint or do we think cirros will continue to be upddated | |
| 23:55:22 | sean-k-mooney[m] | gmann ack ya the fips goal | |
| 23:56:21 | fungi | in short, the sshd in the cirros images lacks support for rsa with any signarture hash other than sha-1, and fips mode won't let tempest's ssh client use that, so ecdsa (which works on both ends) is an afreeable alternative | |
| 23:56:44 | fungi | agreeable | |