| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-13 | |||
| 17:03:28 | gibi | ceilometer is one I'm sure | |
| 17:03:31 | sean-k-mooney | i support cilometer, cloud kitty, heat or masikari are the only ones that might be impacted | |
| 17:03:39 | sean-k-mooney | maybe watcher | |
| 17:04:25 | sean-k-mooney | as long as we are not adding any new unversion notification i guess it does not hurt use too much | |
| 17:04:51 | gibi | I agree, it does not hurt | |
| 17:05:02 | gibi | and we have a test in place to forbid new unversioned notifications | |
| 17:10:38 | bauzas | yuval: around ? I don't see a blueprint filed for https://review.opendev.org/c/openstack/nova-specs/+/824191 | |
| 17:10:57 | yuval | I am here | |
| 17:11:03 | bauzas | yuval: could you please create one using the link you gave, ie. https://blueprints.launchpad.net/nova/spec/nova-support-lightos-driver | |
| 17:11:05 | yuval | yes I created blueprint | |
| 17:11:06 | bauzas | ? | |
| 17:11:10 | yuval | just a second | |
| 17:11:16 | bauzas | ok, then the URL is wrong | |
| 17:11:35 | bauzas | we can change it | |
| 17:12:12 | bauzas | yuval: found it https://blueprints.launchpad.net/nova/+spec/nova-support-lightos-driver | |
| 17:12:39 | bauzas | oh, yeah, I see | |
| 17:12:46 | bauzas | s/spec/+spec | |
| 17:12:50 | yuval | https://blueprints.launchpad.net/nova/+spec/nova-support-lightos-driver | |
| 17:13:23 | bauzas | yuval: could you create a change fixing the URL in https://review.opendev.org/c/openstack/nova-specs/+/824191/6/specs/yoga/approved/lightos_volume_driver.rst#11 ? | |
| 17:13:28 | bauzas | yuval: I'll fast approve it | |
| 17:13:38 | yuval | https://blueprints.launchpad.net/nova/spec/nova-support-lightos-driver | |
| 17:13:45 | yuval | this is currently in the spec | |
| 17:13:50 | sean-k-mooney | yep | |
| 17:13:51 | yuval | its missing the "+" | |
| 17:13:53 | sean-k-mooney | its missing the + | |
| 17:13:55 | sean-k-mooney | yep | |
| 17:13:55 | yuval | before the spec | |
| 17:13:57 | bauzas | yup, please update the link in the spec | |
| 17:14:02 | yuval | just a sec | |
| 17:14:10 | bauzas | (18:12:46) bauzas: s/spec/+spec | |
| 17:14:15 | bauzas | in the rst file | |
| 17:34:21 | opendevreview | yuval proposed openstack/nova-specs master: lightos- fix blueprint url https://review.opendev.org/c/openstack/nova-specs/+/824633 | |
| 17:34:34 | yuval | sorry for the wait | |
| 17:34:39 | yuval | had some git issues | |
| 17:35:22 | bauzas | yuval: thanks and no worries | |
| 18:06:21 | opendevreview | Ghanshyam proposed openstack/nova master: Update centos 8 py36 functional job nodeset to centos stream 8 https://review.opendev.org/c/openstack/nova/+/824637 | |
| 18:17:27 | opendevreview | Rajat Dhasmana proposed openstack/nova master: WIP: Add support for volume backed server rebuild https://review.opendev.org/c/openstack/nova/+/820368 | |
| 18:20:36 | opendevreview | Merged openstack/nova-specs master: lightos- fix blueprint url https://review.opendev.org/c/openstack/nova-specs/+/824633 | |
| 19:22:30 | opendevreview | melanie witt proposed openstack/nova master: Remove deprecated opts from VNC conf https://review.opendev.org/c/openstack/nova/+/824478 | |
| #openstack-nova - 2022-01-14 | |||
| 00:54:39 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 01:50:16 | gmann | seems like tempest-integrated-compute-centos-8-stream is failing consistently https://zuul.openstack.org/builds?job_name=tempest-integrated-compute-centos-8-stream | |
| 02:04:04 | opendevreview | Ghanshyam proposed openstack/nova master: Server actions APIs scoped to project scope https://review.opendev.org/c/openstack/nova/+/824358 | |
| 02:04:07 | melwitt | gmann: :( thanks, I wondered about it | |
| 02:08:45 | gmann | melwitt: I am seeing this traceback in logs, not sure about root cause https://zuul.opendev.org/t/openstack/build/e0db6a9a7ba04e66b0781ba7d259357d/log/controller/logs/screen-q-svc.txt#32875 | |
| 02:10:36 | gmann | pinged neutron folks about it in case they are aware or can find the rootcause | |
| 02:12:12 | melwitt | ack, that's not something I've seen before | |
| 02:14:50 | gmann | it seems it started failing since ~1.5 hrs https://zuul.openstack.org/builds?job_name=tempest-integrated-compute-centos-8-stream | |
| 02:16:07 | melwitt | that's consistent with what I observed. I had been following that change and rechecking it and it had been working until not too long ago | |
| 08:57:15 | bauzas | good morning Nova | |
| 08:57:31 | gibi | good morning Nova | |
| 08:57:51 | gibi | I have a full day workshop downstream so I my presence will be spotty | |
| 08:59:39 | bauzas | gibi: spotty ? fine | |
| 08:59:49 | bauzas | use a headset to listen to it | |
| 08:59:54 | gibi | yeah | |
| 09:00:04 | bauzas | ok, my pun is terrible | |
| 09:00:09 | gibi | video is mandatoryt | |
| 09:01:47 | bauzas | http://www.reactiongifs.com/r/weeds.gif | |
| 09:02:32 | gibi | sorry I'm distracted | |
| 09:05:49 | gibi | kashyap: o/ | |
| 09:06:34 | kashyap | [Off-topic] If any of you use fancy ergonomic mechanical keyboards | |
| 09:12:29 | bauzas | hmmm, I forgot about this spec https://review.opendev.org/c/openstack/nova-specs/+/819510 | |
| 09:12:36 | bauzas | sad it got a -2 | |
| 11:50:01 | opendevreview | Federico Ressi proposed openstack/nova master: Debug Nova APIs call failures https://review.opendev.org/c/openstack/nova/+/806683 | |
| 16:51:01 | opendevreview | Balazs Gibizer proposed openstack/nova master: Reject AZ changes during aggregate add / remove host https://review.opendev.org/c/openstack/nova/+/821423 | |
| 16:58:24 | opendevreview | Balazs Gibizer proposed openstack/nova master: DNM: trigger nova-next with new tempest test https://review.opendev.org/c/openstack/nova/+/824607 | |
| 17:12:10 | gmann | melwitt: bauzas gibi for centos8 stream job failing, I have filed the bug https://bugs.launchpad.net/neutron/+bug/1957941 | |
| 17:12:26 | gmann | and making job as non voting to unblock the nova and tempest gate https://review.opendev.org/c/openstack/tempest/+/824740 | |
| 17:30:45 | sean-k-mooney | gmann: oh i see the binding detail are failing a scope check | |
| 17:31:07 | sean-k-mooney | and other fileds | |
| 17:31:41 | sean-k-mooney | with the new deftionsing some of those shoudl be project_admin and the rest project member | |
| 17:31:56 | sean-k-mooney | i.e. host_id woudl be project_admin | |
| 17:32:29 | sean-k-mooney | as would the physical_network and segmentation_id i belive | |
| 17:33:10 | sean-k-mooney | have neutron acidentlly started enforcing scope by default? | |
| 18:20:30 | noonedeadpunk | hey! I was wondering - does keystone_authtoken/neutron sections should be defined for nova-compute? | |
| 18:20:53 | noonedeadpunk | eventually does it needs interaction with keystone? I bet no as it only talk to conductor? | |
| 18:22:45 | noonedeadpunk | likely only key_manager is required though | |
| 18:25:09 | sean-k-mooney | nova-compute directly calls neutron | |
| 18:25:30 | noonedeadpunk | aha | |
| 18:25:31 | sean-k-mooney | nova-compute directly talks to most other services rest apis | |
| 18:25:57 | sean-k-mooney | it only uses the condutor to talk to the scheduler, db and conductor itslef | |
| 18:26:38 | noonedeadpunk | We in #openstack-ansible were just asked what can be done http://seclab.cs.sunysb.edu/seclab/pubs/asiaccs16.pdf and it feels what they write about RPC is a bit stupid since you have keystone admin credentials stored on each compute... | |
| 18:27:11 | sean-k-mooney | you dont nessisarly have keystone admin creds | |
| 18:27:31 | sean-k-mooney | in fact you shoudl not have keystone admin creds | |
| 18:27:32 | noonedeadpunk | well, ok, service creds | |
| 18:27:45 | noonedeadpunk | but it would still have kind of admin privileges? | |
| 18:27:45 | sean-k-mooney | ok yes | |
| 18:27:57 | sean-k-mooney | iddeally you woudl use application credentils | |
| 18:28:22 | sean-k-mooney | am yes nova need to all some other services as admin | |
| 18:28:24 | noonedeadpunk | so the idea there was - how much you fucked if one compute node is hacked :) | |
| 18:28:35 | sean-k-mooney | but those service creditely shoudl only give admin on those spercices | |
| 18:29:09 | sean-k-mooney | it depend on what you put there | |
| 18:29:30 | sean-k-mooney | if you use app creds you can avoid using a password in your config | |
| 18:29:37 | noonedeadpunk | I don't think it's still smth that keystone has out of the box? I mean even with all these scoped tokens you would still need to mess up with policies to get yourself covered? | |
| 18:29:37 | sean-k-mooney | which makes revocation simpler | |
| 18:30:02 | noonedeadpunk | like credential per compute... hm... | |
| 18:30:10 | noonedeadpunk | that's interesting idea | |
| 18:30:23 | sean-k-mooney | yep you can do cred per service per compute today | |
| 18:30:29 | sean-k-mooney | if you really want too | |
| 18:31:02 | sean-k-mooney | also if you are deploying in contiaenr you dont need the nova.conf to be visable to the nova_libvirt container | |
| 18:31:33 | sean-k-mooney | so even if you break out of the vm you then have to also escap the container and selix and the file permisions to read the config file | |