| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-01-25 | |||
| 10:16:57 | gibi | that would be a cleaner approach | |
| 10:17:10 | bauzas | gibi: well, I don't know | |
| 10:17:16 | gibi | sean-k-mooney: ^^ ? | |
| 10:17:48 | bauzas | stephenfin: if you're around, I'd like to understand why you wanted to verify the l2 connectivity with https://review.opendev.org/c/openstack/nova/+/669411/2/nova/network/neutron.py | |
| 10:18:09 | bauzas | thanks | |
| 10:18:14 | bauzas | context : unaddressed ports | |
| 10:18:35 | bauzas | we haven't discussed it in the spec | |
| 10:22:31 | stephenfin | Ah, so ralonsoh is really the person to ask. He told me to do that :) If I were to guess, it's because deferred IP allocation obviously only makes sense for L2 ports (you must have an IP to operate at layer 3) but that's a guess | |
| 10:22:49 | bauzas | stephenfin: yeah, I understand why | |
| 10:23:05 | bauzas | I mean the "why we should verify" | |
| 10:23:21 | bauzas | but gibi had concerns with "where we should do it" | |
| 10:23:36 | bauzas | and I'm quite able with him | |
| 10:23:40 | ralonsoh | bauzas, there are some backends that don't allow to have IP-less ports | |
| 10:23:41 | stephenfin | ah, yes, I didn't read all the conversation | |
| 10:23:50 | ralonsoh | this is why we introduced this parameter | |
| 10:24:11 | bauzas | ralonsoh: sure, I understand but why it should be nova which should verify when binding ? | |
| 10:24:20 | bauzas | and why not neutron when creating the port ? | |
| 10:24:36 | ralonsoh | because the port creation is just a DB representation | |
| 10:24:45 | ralonsoh | this is not bound to any backend | |
| 10:24:55 | bauzas | until binding, I guess then ? | |
| 10:25:10 | ralonsoh | yes, that's the point | |
| 10:25:56 | bauzas | ralonsoh: ok, then why it should be nova which would verify it when binding and why not neutron ? | |
| 10:26:36 | ralonsoh | because this is how it was designed | |
| 10:26:43 | ralonsoh | we can change it back again | |
| 10:27:43 | bauzas | gibi: ^ | |
| 10:28:10 | gibi | ack | |
| 10:28:14 | bauzas | ralonsoh: sorry, havn't seen it in https://specs.openstack.org/openstack/nova-specs/specs/yoga/approved/boot-vm-with-unaddressed-port.html | |
| 10:28:31 | gibi | I do belive that if the port binding does not make sense then such bindig should be rejected by neutron | |
| 10:28:42 | gibi | but I don't have deep understanding of the neutron side of this | |
| 10:29:26 | bauzas | oh my bad, this was somehow explained in the spec : | |
| 10:29:29 | bauzas | " The changes introduced as part of the “Port binding event extended information for Nova” 4 spec means neutron will now provide the type of back-end to which the port is bound, with the parameter connectivity, included now in binding:vif_details. Nova can determine whether a given driver back-end has “l2” connectivity and, if so, know that a port without an IP address can be assigned to a virtual machine." | |
| 10:30:25 | bauzas | I guess I'd appreciate sean-k-mooney's thoughts on this one | |
| 10:32:05 | gibi | if this was agreed before then I rest my case | |
| 10:35:07 | bauzas | gibi: well, yes and no | |
| 10:35:12 | bauzas | this was agreed in a neutron spec | |
| 10:35:23 | bauzas | this wasn't really discussed in the nova spec | |
| 10:35:57 | bauzas | except saying "look, we could have neutron backends that'd have problems, we should verify the connectivity" | |
| 10:36:04 | bauzas | but we accepted it as it's phrased | |
| 10:36:29 | ralonsoh | bauzas, this can be changed and we can make Neutron to decide this | |
| 10:36:58 | ralonsoh | if we have the port connectivity value and the backend one too, that's easy | |
| 10:37:08 | bauzas | ralonsoh: I think I'm personnally OK with moving on and doing this check in nova first but I'd somehow appreciate second thoughts for a neutron change too | |
| 10:38:08 | ralonsoh | bauzas, I'll propose this in a drivers meeting | |
| 10:38:19 | ralonsoh | if a new spec is needed, I'll push it | |
| 10:38:34 | bauzas | well, that'd mean a Z change | |
| 10:38:44 | ralonsoh | yes, in Z probably | |
| 10:38:53 | ralonsoh | well, I'm not sure | |
| 10:38:53 | bauzas | that's why I'm saying I'm OK with checking this in nova first if gibi is OK | |
| 10:39:12 | bauzas | (provided I'm able to write such thing :D ) | |
| 10:39:49 | ralonsoh | bauzas, I'll raise this question this friday, at 1400UTC | |
| 10:40:02 | ralonsoh | drivers meeting. The change should be small in Neutron | |
| 10:45:04 | ralonsoh | bauzas, good news | |
| 10:45:07 | ralonsoh | https://review.opendev.org/c/openstack/neutron/+/678027 | |
| 10:45:51 | ralonsoh | (sorry, I didn't remember that part) | |
| 10:45:51 | ralonsoh | Neutron will reject this port binding | |
| 10:45:51 | ralonsoh | and that was merged in Train | |
| 10:46:03 | bauzas | ralonsoh: ok, so no need for a check in nova | |
| 10:46:04 | bauzas | all good | |
| 10:46:10 | bauzas | I can remove stephenfin's WIP | |
| 10:46:20 | bauzas | and repropose it against Yoga nova | |
| 11:09:40 | gibi | bauzas, ralonsoh: https://review.opendev.org/c/openstack/neutron/+/678027 is the best outcome of this discussion :) | |
| 12:02:05 | chateaulav | sean-k-mooney: appreciate the os-traits review! | |
| 12:55:39 | bkranendonk | hi folks, is there a way to utilize multiple image backends (e.g. rbd for instance X and lvm for instance Y) on the same hypervisor? | |
| 12:55:58 | bkranendonk | cant find info on this | |
| 13:08:24 | lyarwood | bkranendonk: not with the libvirt driver, it's a single static choice in the compute config used by all instances hosted on it | |
| 13:09:08 | lyarwood | bkranendonk: if you want choice use volume types has always been our suggestion | |
| 13:09:40 | bkranendonk | lyrarwood: Boot from volume with a volume_type? | |
| 13:10:07 | sean-k-mooney | bkranendonk: yep | |
| 13:10:16 | bkranendonk | ok, thanks! | |
| 13:10:29 | lyarwood | bkranendonk: I think we proxy the type yeah, otherwise just create the volume directly in cinder with a given type and then use it in nova | |
| 13:10:46 | sean-k-mooney | the images type can be used to set a host wide default stoage backing and then you can suplement that with cinder volumes and volume types to select based on differnt perfromacne requiements | |
| 13:11:25 | lyarwood | yeah block_device_mapping_v2.volume_type is available from 2.67 | |
| 13:30:11 | elodilles | bauzas: i'll add some update to meetings wiki if you are not doing that right now | |
| 13:46:38 | bauzas | elodilles: sure, please do | |
| 13:55:12 | elodilles | bauzas: thx, done | |
| 14:51:41 | sean-k-mooney | bauzas: you were asking previously about adressless port and why nova needs to check the connectivty? | |
| 14:51:49 | sean-k-mooney | did you get an answer | |
| 14:51:52 | sean-k-mooney | its a security issue | |
| 14:52:26 | sean-k-mooney | for backends like calico that provie l3 only connectivity its invlade to use l2 networking and it will not be fucntional | |
| 14:53:13 | sean-k-mooney | in general port with l2 connectivy and no ip will not work with security groups proerly | |
| 14:53:43 | sean-k-mooney | techincally you can magch on thernet type but almost all security group rules assme an ip | |
| 14:54:05 | sean-k-mooney | the check tha tnova needs to is basicaly a simple reasonablness check | |
| 14:54:29 | sean-k-mooney | e.g. is it reasonable given the info provide by neutron that the port would be usable without an addres. | |
| 14:54:36 | sean-k-mooney | if the the connectivy type is l2 then yes | |
| 14:54:40 | sean-k-mooney | if l3 then no | |
| 14:54:42 | sean-k-mooney | simple as that | |
| 14:55:38 | sean-k-mooney | bauzas: ralonsoh the connectivy par to fhte spec shoudl already be implemented in neutron | |
| 14:55:59 | sean-k-mooney | the binding driver info is not implemtned but that is not needed for adress less ports | |
| 14:57:28 | sean-k-mooney | here is where ml2/ovs reports l2 connectivy for example https://github.com/openstack/neutron/blob/master/neutron/plugins/ml2/drivers/openvswitch/mech_driver/mech_openvswitch.py#L59-L61 | |
| 14:58:20 | sean-k-mooney | the main issue we have is this is obviouls a late fail on the compute node when we attpemt to do the port binding | |
| 14:58:53 | sean-k-mooney | but that is better then booting with out any networking | |
| 15:00:13 | sean-k-mooney | all of the in tree drivers supprot this feature as far as i am aware | |
| 15:00:21 | sean-k-mooney | and they all provide l2 connectivity | |
| 15:00:34 | sean-k-mooney | calico is really the only one i know of that is l3 only | |
| 15:07:47 | bauzas | sean-k-mooney: ralonsoh told me that eventually Neutron verified the backend | |
| 15:07:51 | bauzas | (from Train) | |
| 15:08:22 | bauzas | sean-k-mooney: https://review.opendev.org/c/openstack/neutron/+/678027 | |
| 15:08:34 | sean-k-mooney | it may but i think nova should still enforce the connectivy | |
| 15:08:37 | bauzas | folks, nova meeting in 52 mins here at #openstack-nova | |
| 15:08:58 | bauzas | sean-k-mooney: honestly, gibi and me were asking for that | |
| 15:09:14 | bauzas | see the discussion we had this morning | |