| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2022-06-06 | |||
| 14:38:54 | opendevreview | Artom Lifshitz proposed openstack/nova stable/train: func: Add live migration rollback volume attachment tests https://review.opendev.org/c/openstack/nova/+/844745 | |
| 14:38:55 | opendevreview | Artom Lifshitz proposed openstack/nova stable/train: fup: Assert state of connection_info during LM rollback in func tests https://review.opendev.org/c/openstack/nova/+/844746 | |
| 15:12:40 | kashyap | dansmith: I wonder if that QEMU SIGSEGV was triggerred again w/ your coredump patch in place now | |
| 15:13:00 | dansmith | kashyap: it hasn't landed yet due to other gate fails, | |
| 15:13:15 | dansmith | but so far we haven't seen it occur again on patches that depend on it | |
| 15:13:18 | kashyap | Ah, yeah; saw that this morning. I naively assumed by now it must've merged | |
| 15:13:26 | dansmith | which is weird because it was 100% fail for a few days | |
| 15:13:41 | kashyap | Heh, as you said, Heisenbug from hell | |
| 15:15:49 | dansmith | yeah :/ | |
| 15:33:59 | opendevreview | Takashi Kajinami proposed openstack/placement master: doc: Comment out language option https://review.opendev.org/c/openstack/placement/+/844855 | |
| 20:46:54 | mloza1 | hello, what's the rule in iptables that gets added when allow_same_net_traffic=true in nova.conf ? I tried to look at the src code but I can't seem to find it. | |
| 20:47:35 | sean-k-mooney[m] | nova does not add iptables rules anymore | |
| 20:47:47 | sean-k-mooney[m] | it has not for several years | |
| 20:47:56 | sean-k-mooney[m] | it did when using nova networks but does not when using neutron | |
| 20:48:13 | sean-k-mooney[m] | we removed that support 2 cycles ago maybe a little more | |
| 20:48:27 | sean-k-mooney[m] | so that config option if tis still in the code is unused | |
| 21:32:21 | mloza1 | sean-k-mooney[m]: Thanks for the info. Is there another way to enforce SGs for all connections ? | |
| #openstack-nova - 2022-06-07 | |||
| 09:06:06 | gibi_summit | gmann: we are created the etherpad for the nova feedack session and mentioned SRBAC https://etherpad.opendev.org/p/nova-berlin-meet-and-greet | |
| 09:06:18 | gibi_summit | s/are// | |
| 09:09:50 | gibi_summit | feel free to add to it | |
| 09:10:02 | gibi_summit | actually, anybody, feel free to add to that etherpad ^^ | |
| 09:54:40 | chateaulav | Also see the etherpad for Emulation as well:. https://etherpad.opendev.org/p/Emulation_going_beyond_local_QEMU | |
| 10:07:24 | sean-k-mooney | chateaulav: ^ sound interesting | |
| 16:58:28 | gmann | gibi_summit: thanks. I added few details there but you or bauzas really need to explain what 'scope' means to get the feedback otherwise it might be a very silent topic as hardly anyone from operator understand the 'scope' concept - https://etherpad.opendev.org/p/nova-berlin-meet-and-greet#L52 | |
| 16:59:26 | gmann | gibi_summit: bauzas: main goal is if we can get answer to "is Scope useful for you?" that will be great feedback for us to proceed on community-wide goal. | |
| 17:01:34 | sean-k-mooney | gmann: write now we dont really have any usages of scope | |
| 17:02:02 | sean-k-mooney | well we have system scope and proejct scope | |
| 17:02:16 | sean-k-mooney | but evnthing tha tis system scopd is all one scope | |
| 17:03:15 | gmann | sean-k-mooney: did not get you completely? can you please explain or rephrase | |
| 17:03:52 | sean-k-mooney | we have scope_type system but system_scope:all? or something like that | |
| 17:04:06 | sean-k-mooney | we dont have say system:comptue vs system:networking | |
| 17:04:38 | sean-k-mooney | so you cant grant system_admin on nova but nothing on other services | |
| 17:05:24 | sean-k-mooney | im trying to rememebr what thats actully called | |
| 17:05:27 | gmann | sean-k-mooney: ohk, yes. that is why scope has to be explained in a detail to have operator understand what it is like you mentioned | |
| 17:06:12 | gmann | may be showing nova policy doc can help.. | |
| 17:09:35 | sean-k-mooney | im not sure if the system:all thing still extis by the way based on https://governance.openstack.org/tc/goals/selected/consistent-and-secure-rbac.html | |
| 17:09:52 | sean-k-mooney | i think that was form before we did the policy reset | |
| 17:10:11 | sean-k-mooney | https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html#authenticating-for-a-system-scoped-token | |
| 17:10:22 | gmann | sean-k-mooney: it is not a things as per new direction in Yoga ^^. we have isolated the 'scope' from check_str | |
| 17:10:30 | sean-k-mooney | its the "scope": { | |
| 17:10:32 | sean-k-mooney | "system": { | |
| 17:10:34 | sean-k-mooney | "all": true | |
| 17:10:36 | sean-k-mooney | ||
| 17:10:38 | sean-k-mooney | part | |
| 17:10:42 | sean-k-mooney | https://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html#authenticating-for-a-system-scoped-token | |
| 17:10:59 | gmann | yes it was before and that is why it was not useful so we separated that out from check_str | |
| 17:11:10 | sean-k-mooney | ack | |
| 17:11:31 | sean-k-mooney | so i woudl not say its not use to have multiple systems | |
| 17:11:49 | sean-k-mooney | but we might not want to do it via the check sting | |
| 17:12:46 | sean-k-mooney | eventually i think it would to be abel to issue a token that was readonly on say neutron but could do nothing on glance | |
| 17:13:43 | sean-k-mooney | im not sure how to model that but that was the orginal usecase for system:all vs system:compute | |
| 17:14:44 | sean-k-mooney | when i say token i really am thinking of app creditials by the way | |
| 17:15:21 | sean-k-mooney | it woudl be nice ot be abel to generate an app credential that hand much more fine grained scope | |
| 17:15:40 | gmann | yeah, with no scope coupled in check_str we cannot have SYSTEM_READER until we enable scope by default and make it non-configurable | |
| 17:16:20 | sean-k-mooney | any way that proably a differnt topic then you wanted feedback on | |
| 17:17:03 | sean-k-mooney | one day it woudl benice if openstack coudl support the same aplication keys like funcationaltiy you get with github or other modern apis | |
| 17:20:35 | sean-k-mooney | https://docs.github.com/en/rest/overview/permissions-required-for-github-apps | |
| 17:21:01 | sean-k-mooney | they map all api endpoints endpoint to a permssiosn which is like a role | |
| 17:21:36 | sean-k-mooney | and then you create a topen with a set of permmison and either read or write capablity on each | |
| 17:22:10 | sean-k-mooney | some day it woudl benice if you coudl do the same with keystone app credetials or just in gneral | |
| 17:25:52 | gmann | yeah, may be good to have it separate as it can make things more complex to understand | |
| 17:26:29 | gmann | gibi_summit: bauzas I created a central etehrpad to get RBAC feedback from various forum/places. and linked it in nova etherpad also, please use that https://etherpad.opendev.org/p/rbac-operator-feedback | |
| 23:15:07 | opendevreview | Takashi Kajinami proposed openstack/placement master: Update python testing as per zed cycle testing runtime https://review.opendev.org/c/openstack/placement/+/845059 | |
| #openstack-nova - 2022-06-08 | |||
| 01:43:54 | opendevreview | Ghanshyam proposed openstack/placement master: Fix py310 unit test job https://review.opendev.org/c/openstack/placement/+/845074 | |
| 02:32:59 | opendevreview | Merged openstack/placement master: Update python testing as per zed cycle testing runtime https://review.opendev.org/c/openstack/placement/+/845059 | |
| 13:04:36 | opendevreview | ribaudr proposed openstack/nova master: Allow unshelve to a specific host (compute_api part) https://review.opendev.org/c/openstack/nova/+/831507 | |
| 13:04:37 | opendevreview | ribaudr proposed openstack/nova master: Allow unshelve to a specific host (REST API part) https://review.opendev.org/c/openstack/nova/+/845129 | |
| 13:44:54 | Uggla | sean-k-mooney, if you can find time to review ^ patches, it would be cool. | |
| 14:03:19 | artom | sean-k-mooney, instance.pcpuset is the *host* CPU IDs for that instance? | |
| 14:13:02 | sean-k-mooney | i think so i woudl have too double check | |
| 14:13:36 | sean-k-mooney | for a pinned instance that is | |
| 14:14:04 | sean-k-mooney | and it would be in the instance numa toploloy object | |
| 14:14:31 | sean-k-mooney | here https://github.com/openstack/nova/blob/master/nova/objects/instance_numa.py#L75= | |
| 14:14:37 | sean-k-mooney | not directly on the instance object | |
| 14:15:39 | sean-k-mooney | cpu_pinning_raw i think is the dict that map logicl to host cpu | |
| 14:16:03 | sean-k-mooney | https://github.com/openstack/nova/commit/867d4471013bf6a70cd3e9e809daf80ea358df92 | |
| 14:16:46 | sean-k-mooney | so ya this is related to mixed cpus | |
| 14:16:59 | sean-k-mooney | so i think this is actully the logical guest cpus | |
| 14:17:04 | sean-k-mooney | not the host ones | |
| 14:17:15 | sean-k-mooney | its tracking which cpus are pinned | |
| 14:17:27 | artom | Weird, because looking at the libvirt driver code... | |
| 14:18:19 | artom | https://opendev.org/openstack/nova/src/branch/master/nova/virt/libvirt/driver.py#L8429 | |
| 14:18:19 | sean-k-mooney | it might be the host ones i just have not looke at this lately so dont have the context loaded right now | |
| 14:18:35 | artom | That looks like it's binary-AND'ig with the host available dedicated CPUs | |
| 14:20:14 | sean-k-mooney | this is in _get_host_numa_topology | |
| 14:20:27 | sean-k-mooney | so this is not using the instance numa toplogy | |
| 14:20:49 | sean-k-mooney | we are just using the same variable name i thikn | |
| 14:21:11 | artom | Ah right | |
| 14:22:52 | artom | OK, I guess the spec lays that to rest: Add the ``pcpuset`` field in ``InstanceNUMACell`` object to track the dedicated | |
| 14:22:52 | artom | vCPUs of the instance NUMA cell, and the original ``InstanceNUMACell.cpuset`` | |
| 14:22:52 | artom | is special for shared vCPU then. | |
| 14:23:21 | sean-k-mooney | yes | |
| 14:23:38 | sean-k-mooney | so this is trackign the bitmas of pinned vs floating cpus in the mixed case | |
| 14:24:03 | sean-k-mooney | if cpu policy = shared or dediceted only one of them wil have data | |
| 14:24:08 | sean-k-mooney | for mixed both do | |
| 14:24:19 | sean-k-mooney | and then the cpu_pinning_raw dict | |
| 14:24:27 | sean-k-mooney | maps the locgical cpu to a host cpu | |
| 16:44:12 | opendevreview | Sven Kieske proposed openstack/nova stable/yoga: libvirt: Add a workaround to skip compareCPU() on destination https://review.opendev.org/c/openstack/nova/+/845045 | |
| 16:53:53 | opendevreview | ribaudr proposed openstack/nova master: Allow unshelve to a specific host https://review.opendev.org/c/openstack/nova/+/831507 | |
| 18:57:41 | opendevreview | Balazs Gibizer proposed openstack/nova stable/ussuri: DNM: Reproduction trial for bug 1975490 https://review.opendev.org/c/openstack/nova/+/845168 | |