| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-05-17 | |||
| 17:48:34 | jrosser | and that is sufficient to say that the VM is what it claims to be | |
| 17:49:03 | sean-k-mooney | so keystone i think now support using jwt to auth and get a keystone token | |
| 17:49:24 | sean-k-mooney | so your poc is not tied into that | |
| 17:49:48 | jrosser | right - though i guess the JWT payload can be pretty arbitrary so i'm not sure how much that would intersect | |
| 17:53:58 | jrosser | hmmm hashicorp vault can authenticate with a JWT | |
| 17:54:09 | jrosser | now that would be really interesting to make work | |
| 17:55:47 | sean-k-mooney | jrosser: levy14's usecases is to use something to allow the vm to auth to barbican | |
| 17:56:13 | sean-k-mooney | jrosser: basically so that you dont need to sotre creds in teh applicaitons configs | |
| 17:56:35 | jrosser | right - i believe that such things are very straightforward in aws | |
| 17:56:44 | sean-k-mooney | jrosser: and since keystone now accpets jwt tokes to auth with my theory was | |
| 17:57:05 | sean-k-mooney | if we added a jwt token in the metadta you coudl use that to get a keystone token and then use that to call barbican | |
| 17:57:55 | sean-k-mooney | and sicne jwt tokesn can expire you could allow that only for x mintues after teh server is booted for intial bootstrap | |
| 17:58:59 | sean-k-mooney | anyway its not my usecase so i wont worry about it for now | |
| 17:59:12 | sean-k-mooney | but it could be a ncie feature if openstack could provide a simialr workflow | |
| 17:59:29 | sean-k-mooney | its proably not a nova feature however | |
| 17:59:31 | sean-k-mooney | ot not mainly | |
| 17:59:39 | sean-k-mooney | a nova feature | |
| 18:09:45 | jrosser | seems it is fernet or jws for keystone, not a mixture | |
| 18:10:02 | jrosser | and it does seem more clean to have keystone issue a token then then is in the metadata | |
| 18:10:37 | sean-k-mooney | well for there usecase tehy are tryign to prevent having to put credeitals in the vm to begin with | |
| 18:10:45 | sean-k-mooney | so they need somthign to bootstrap form | |
| 18:11:06 | sean-k-mooney | i think k8s solves this by definign env vars that are only accepable in the container | |
| 18:11:12 | sean-k-mooney | so you can get your pods secret | |
| 18:11:28 | sean-k-mooney | the metadta serivce is the closest thing we have to that | |
| 18:13:21 | jrosser | oh i am confusing the existing jws stuff in keystone with that new jwt auth patch | |
| #openstack-nova - 2022-05-18 | |||
| 00:01:44 | opendevreview | Merged openstack/nova stable/yoga: Adds regression test for bug LP#1944619 https://review.opendev.org/c/openstack/nova/+/838788 | |
| 00:01:52 | opendevreview | Merged openstack/nova stable/yoga: Fix pre_live_migration rollback https://review.opendev.org/c/openstack/nova/+/836014 | |
| 01:10:17 | opendevreview | Merged openstack/nova stable/ussuri: [stable-only] Drop lower-constraints job https://review.opendev.org/c/openstack/nova/+/838033 | |
| 03:18:03 | opendevreview | Brin Zhang proposed openstack/nova master: Replaces tenant_id with project_id from List/Update Servers APIs https://review.opendev.org/c/openstack/nova/+/764292 | |
| 03:18:03 | opendevreview | Brin Zhang proposed openstack/nova master: Replace all_tenants with all_projects in List Server APIs https://review.opendev.org/c/openstack/nova/+/765311 | |
| 03:18:04 | opendevreview | Brin Zhang proposed openstack/nova master: Replaces tenant_id with project_id from Rebuild Server API https://review.opendev.org/c/openstack/nova/+/766380 | |
| 03:18:04 | opendevreview | Brin Zhang proposed openstack/nova master: Replaces tenant_id with project_id from List SG API https://review.opendev.org/c/openstack/nova/+/766726 | |
| 03:18:05 | opendevreview | Brin Zhang proposed openstack/nova master: Replaces tenant_id with project_id from Flavor Access APIs https://review.opendev.org/c/openstack/nova/+/767704 | |
| 06:53:59 | bauzas | good morning Nova | |
| 07:32:04 | Uggla | bauzas, o/ | |
| 07:32:43 | Uggla | bauzas, did you sleep well after the spicy food ? | |
| 07:34:51 | tobias-urdin | good morning o/ | |
| 07:35:21 | gibi | good morning | |
| 07:37:15 | gibi | hehh my old E/// wifi account still works in the local E/// building | |
| 07:41:59 | tobias-urdin | sean-k-mooney: maybe u could check this libvirt blocker when u are online https://review.opendev.org/c/openstack/nova/+/838976 | |
| 07:53:17 | bauzas | Uggla: yes indeed ;) | |
| 08:04:25 | kashyap | gibi: Good luck with the preso! | |
| 08:05:47 | bauzas | gibi: break a leg ;) | |
| 08:06:37 | bauzas | Free (French operator) <3 you missed me | |
| 08:07:10 | bauzas | (I missed you* actually) | |
| 08:08:46 | opendevreview | Brin Zhang proposed openstack/nova master: Replaces tenant_id with project_id from List/Show usage APIs https://review.opendev.org/c/openstack/nova/+/768509 | |
| 08:08:47 | opendevreview | Brin Zhang proposed openstack/nova master: Replace tenants* with projects* of policies https://review.opendev.org/c/openstack/nova/+/765315 | |
| 08:30:40 | opendevreview | Brin Zhang proposed openstack/nova master: Replace tenant_id with project_id in os-quota-sets path https://review.opendev.org/c/openstack/nova/+/768851 | |
| 08:30:41 | opendevreview | Brin Zhang proposed openstack/nova master: Replace tenant_id with project_id in Limits API https://review.opendev.org/c/openstack/nova/+/768862 | |
| 08:30:41 | opendevreview | Brin Zhang proposed openstack/nova master: Replace tenant* with project* in codes https://review.opendev.org/c/openstack/nova/+/769329 | |
| 08:30:42 | opendevreview | Brin Zhang proposed openstack/nova master: Replace os-simple-tenant-usage with os-simple-project-usage https://review.opendev.org/c/openstack/nova/+/842288 | |
| 08:35:18 | brinzhang0 | bauzas: hi, I would you like to review the remove_tenant series patches https://review.opendev.org/q/topic:bp%252Fremove-tenant-id | |
| 08:35:32 | bauzas | brinzhang0: sure, I'll do | |
| 08:35:41 | brinzhang0 | thx | |
| 09:25:38 | sean-k-mooney | gibi: does https://review.opendev.org/c/openstack/tempest/+/842140/3/tempest/api/compute/base.py#482= make sense | |
| 09:25:56 | sean-k-mooney | the jobs failed on the test we were trying to fix so its obviouly not working in its current form | |
| 09:42:32 | Uggla | sean-k-mooney, can you have a quick look at my comment on https://review.opendev.org/c/openstack/nova-specs/+/831506 and tell me what you think about it ? | |
| 09:45:25 | sean-k-mooney | im just reading a differnt one but suer ill look at it soon | |
| 09:46:09 | Uggla | sean-k-mooney, thx | |
| 09:49:25 | sean-k-mooney | cool one -1 down for the day now for the next :P | |
| 09:50:02 | sean-k-mooney | Uggla: i dont see a new comment form you since the last ones i posted | |
| 09:50:14 | sean-k-mooney | which one specifically did you want me to look at | |
| 09:55:00 | sean-k-mooney | bauzas: before you do | |
| 09:55:10 | sean-k-mooney | bauzas: can you respond to gmann on yoru spec | |
| 09:55:18 | bauzas | sean-k-mooney: sure, will look | |
| 09:55:30 | sean-k-mooney | bauzas: can you pull in the change to allow @ in the keypair name | |
| 09:56:27 | sean-k-mooney | https://review.opendev.org/c/openstack/nova-specs/+/785674 | |
| 09:56:42 | sean-k-mooney | this comment https://review.opendev.org/c/openstack/nova-specs/+/840217/3#message-81ccda58cd8f18ba84569bec794083b5572eb1e0= | |
| 09:57:03 | bauzas | gosh, I got lost with all the back-and-forths | |
| 09:57:11 | bauzas | and I forgot to upload my comments | |
| 09:57:59 | bauzas | oh, merging with another spec, I see | |
| 09:58:12 | sean-k-mooney | its a really trivial spec so if you can merge that into your it woudl be nice to do both in one micro verion | |
| 09:58:19 | sean-k-mooney | ya it just add ing @ and . | |
| 09:58:22 | sean-k-mooney | to the regex | |
| 09:58:38 | sean-k-mooney | so you can name the keypair me@my.domain | |
| 09:59:54 | sean-k-mooney | bauzas: if your ok with that we could also make that update as a FUP | |
| 10:00:04 | sean-k-mooney | assuming that works for gmann | |
| 10:00:10 | bauzas | sean-k-mooney: will add a new revision | |
| 10:00:16 | bauzas | better than a FUP | |
| 10:00:54 | sean-k-mooney | cool ill be AFK for 20 mins or so but ill review it as soon as im back if its up | |
| 10:04:35 | Uggla | sean-k-mooney, bauzas, oops sorry I forget to hit the reply button. | |
| 10:05:15 | Uggla | sean-k-mooney, bauzas, my comment should be available now. | |
| 10:13:35 | opendevreview | Rajat Dhasmana proposed openstack/nova-specs master: Repropose volume backed server rebuild spec https://review.opendev.org/c/openstack/nova-specs/+/840155 | |
| 10:15:31 | opendevreview | Sylvain Bauza proposed openstack/nova-specs master: Proposes to remove keypair generation https://review.opendev.org/c/openstack/nova-specs/+/840217 | |
| 10:22:26 | bauzas | gmann: sean-k-mooney: honestly the xena spec was not explaining how to modify the parameters | |
| 10:22:58 | bauzas | gmann: sean-k-mooney: because we validate the keypair name not by the API but rather by a specific method https://github.com/openstack/nova/blob/4939318649650b60dd07d161b80909e70d0e093e/nova/compute/api.py#L6615 | |
| 10:24:07 | bauzas | so we'll need to either pass a parameter down to the compute api to tell about the microversion, or create a different parameter type for the older microversions (and remove this method) | |
| 10:24:16 | bauzas | not that simple honestly | |
| 10:24:34 | songwenping | Hi team, my env meet the error when boot vm: Failed to create PTY:no such file or dirctory, the qemu version is 2.10.0 and libvirt is 3.9.0, any guys have any solutions? | |
| 10:24:36 | bauzas | the simpliest is passing down some flag to the compute API of course | |
| 10:43:03 | sean-k-mooney | bauzas: honestly my prefence would be to not require a microversion and jsut start accpeting . and @ | |
| 10:44:10 | sean-k-mooney | gmann: is a microverions stictly required here | |
| 10:44:23 | sean-k-mooney | to me the spec was required becauses it is an api change | |
| 10:44:40 | sean-k-mooney | i was not sold on needing to opt into this behavior with a microverion | |
| 10:47:03 | sean-k-mooney | i know we have an exemtimption for 500->200 in this case its 400->200 but this partaclar change seams harmless to me | |
| 10:48:30 | bauzas | sean-k-mooney: I'm going afk for lunch but let's discuss this around 1230UTC if you want with gmann | |
| 10:48:31 | sean-k-mooney | bauzas: by the way this is not actully happenign in the comptue agent is it | |
| 10:48:44 | sean-k-mooney | bauzas: the keyparis are in teh api db | |
| 10:48:58 | sean-k-mooney | and we can crete them without any instnace or host | |
| 10:49:11 | bauzas | yeah, it's just a API DB | |