| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-01-11 | |||
| 10:05:57 | noonedeadpunk | I assumed, that using placement isolation together with AggregateMultitenancyIsolation will do that, but seems it's not... | |
| 10:06:31 | noonedeadpunk | Or well, maybe I have to add all other computes to different aggregate.... | |
| 10:08:00 | noonedeadpunk | So I have this: enable_isolated_aggregate_filtering = True, limit_tenants_to_placement_aggregate = True, placement_aggregate_required_for_tenants = False | |
| 10:12:12 | opendevreview | Rajesh Tailor proposed openstack/nova-specs master: List requested availability zones https://review.opendev.org/c/openstack/nova-specs/+/904368 | |
| 10:13:59 | bauzas | sahid: unfortunately, we haven't yet accepted https://blueprints.launchpad.net/nova/+spec/aggregatemultitenancyisolation-to-support-unlimited-tenant as a specless bp | |
| 10:14:13 | bauzas | sean-k-mooney was having some concern when we discussed it on a team meeting | |
| 10:14:25 | bauzas | for me I'm OK but we don't have consensus | |
| 10:15:39 | noonedeadpunk | So my assumption was, that if request comes from a tenant that is not in filter_tenant_id, AggregateMultiTenancyIsolation will filter out all hosts that belong to aggregates with filter_tenant_id defined. And if request comes from tenant with filter_tenant_id - placement will return only hosts that have this metadata | |
| 10:15:58 | noonedeadpunk | But in fact, aggregate is not restricted for "outsiders" | |
| 10:17:41 | noonedeadpunk | oh, I see now..... | |
| 10:18:37 | noonedeadpunk | https://opendev.org/openstack/nova/src/branch/master/nova/scheduler/filters/aggregate_multitenancy_isolation.py#L47 | |
| 10:19:53 | noonedeadpunk | suffix is only applicable for placement isolation: https://opendev.org/openstack/nova/src/branch/master/nova/scheduler/request_filter.py#L115 | |
| 10:21:02 | noonedeadpunk | So kinda.... I can't define even 2 tenants to be working both for placement and filter? | |
| 10:24:57 | noonedeadpunk | as placement is not trying to split on comas, and filter not trying to search for suffixes :( | |
| 10:26:02 | noonedeadpunk | ok, so I'm actually facing exact same usecase that sahid patch covers.... | |
| 10:26:59 | bauzas | I think we could approve sahid's blueprint today and then we could discuss on his change then with sean-k-mooney | |
| 10:27:05 | bauzas | sean-k-mooney: are you okay then ? | |
| 10:34:29 | noonedeadpunk | ugh, I for some reason thought that this flow is already working though and was counting for it ;( | |
| 11:46:11 | noonedeadpunk | I still have a feeling I'm missing smth in tenant isolation topic though... | |
| 11:48:34 | noonedeadpunk | oh, maybe I can have both pre and post enabled indeed, huh | |
| 12:02:16 | noonedeadpunk | In terms - define list of tenants for post filter in `filter_tenant_id` through comma, and then have `filter_tenant_id_suffix` for pre-filter. While `filter_tenant_id` will be invalid for pre-filter, rest should work... | |
| 12:02:41 | noonedeadpunk | Slightly nasty, but looks like working at scratch... | |
| 12:02:52 | noonedeadpunk | *at a glance | |
| 12:07:16 | ratailor | bauzas, noonedeadpunk could you please review https://review.opendev.org/c/openstack/nova-specs/+/904368 spec, I have updated it as per yesterday's discussion. | |
| 12:08:15 | ratailor | sean-k-mooney, gibi_off please review ^^ | |
| 13:53:34 | dvo-plv | sean-k-mooney, Thank you. I will try to finc some examples | |
| 14:19:35 | bauzas | sean-k-mooney: gibi_off: we missed to ask auniyal to provide a blueprint for https://specs.openstack.org/openstack/nova-specs/specs/2024.1/approved/enforce-remote-console-session-timeout.html | |
| 14:19:47 | bauzas | I'll be creating the blueprint | |
| 14:31:00 | sean-k-mooney | ack | |
| 15:16:51 | opendevreview | Takashi Kajinami proposed openstack/nova master: Fix test failures with oslo.limit 2.3.0 https://review.opendev.org/c/openstack/nova/+/905314 | |
| 15:29:29 | opendevreview | Dan Smith proposed openstack/nova master: Support glance's new location API https://review.opendev.org/c/openstack/nova/+/891036 | |
| 15:29:29 | opendevreview | Dan Smith proposed openstack/nova master: DNM: Test glance new location api https://review.opendev.org/c/openstack/nova/+/891207 | |
| 15:29:30 | opendevreview | Dan Smith proposed openstack/nova master: WIP: Catch ImageNotFound on snapshot failure https://review.opendev.org/c/openstack/nova/+/905316 | |
| 16:10:52 | opendevreview | Sylvain Bauza proposed openstack/nova-specs master: add the blueprint link to the spec https://review.opendev.org/c/openstack/nova-specs/+/905342 | |
| 16:11:10 | bauzas | sean-k-mooney: could you quickly +2 this ^ | |
| 16:13:54 | bauzas | noonedeadpunk: fwiw looks like we gonna miss https://review.opendev.org/c/openstack/nova-specs/+/890779 for Caracal due to the spec approval freeze | |
| 16:14:29 | opendevreview | Takashi Kajinami proposed openstack/nova master: Fix test failures with oslo.limit 2.3.0 https://review.opendev.org/c/openstack/nova/+/905314 | |
| 16:15:17 | bauzas | noonedeadpunk: so that's cool you abandoned your spec proposal but fwiw I don't see any new revision for the other spec since 6 months :( | |
| 16:16:50 | sean-k-mooney | bauzas: done | |
| 16:17:03 | bauzas | sean-k-mooney: cool thanks | |
| 16:18:00 | bauzas | fwiw, I have some concerns when some good contributor abandons some change due to some other existing but the other is not revised from 6 months :( | |
| 16:18:32 | noonedeadpunk | bauzas: yeah, that's clear at this point :( | |
| 16:19:19 | noonedeadpunk | But realizing complexity more I'm not that self-confident anyway to pick implementation alone | |
| 16:20:56 | noonedeadpunk | As that sounds slightly like leveraging taskflow | |
| 16:40:32 | pmarsais | Hi nova community, I am looking at enabling TPM for my instances in my openstack cluster. Looking at nova source code, it seems that the shelving/unshelving workflow designed in https://specs.openstack.org/openstack/nova-specs/specs/victoria/implemented/add-emulated-virtual-tpm.html#shelve-offload-and-unshelve is currently not implemented (no references to "tpm_object_id" and "tpm_object_sha256"). Is that correct or am I mi | |
| 16:40:35 | pmarsais | If so, are there plan to get this in, or should I try to take a stab at implementing it ? (I already started the CCLA process internally with my employer) | |
| 17:24:27 | auniyal | hi sean-k-mooney, can you please have another look on this - https://review.opendev.org/c/openstack/nova/+/905134 [Refactor vf profile for PCI device | |
| 17:24:27 | auniyal | ] | |
| 17:28:38 | sean-k-mooney | pmarsais: no there is no plan to proceed with storing the tpm data in swrift for shelve/unshleve | |
| 17:29:22 | sean-k-mooney | if we wanted to od that we woudl have to repropose it as a feature via a new spec. | |
| 17:30:03 | sean-k-mooney | it was not implmented because we felt it was overly complext and we were not sure we wanted to require swift to be present to use it | |
| 17:31:06 | sean-k-mooney | today is the spec freeeze deadline for calacal os this woudl be a topic of next cycle (starting in march) | |
| 17:35:56 | pmarsais | Ok, thanks for the context ! | |
| 17:43:25 | sean-k-mooney | melwitt: im going to set up a devstack vm to test your disk encyprtion series so i can start reviewing it next week | |
| 17:43:36 | sean-k-mooney | melwitt:do you have a local.conf you can share | |
| 17:47:15 | sean-k-mooney | i belive i need barbican correct | |
| 17:48:21 | melwitt | sean-k-mooney: oh, yep. sec | |
| 17:49:26 | melwitt | sean-k-mooney: I set up jobs to test myself, you can use as reference as well https://review.opendev.org/c/openstack/nova/+/862416 | |
| 17:49:31 | sean-k-mooney | im currenly installing ubuntu so no rush | |
| 17:49:40 | sean-k-mooney | ah perfect | |
| 17:49:46 | melwitt | obvs everything you need will be in there | |
| 17:50:06 | sean-k-mooney | yep i can figure it out form there | |
| 17:50:31 | melwitt | ok great | |
| 17:50:45 | sean-k-mooney | now that i think about it i should proably clone this vm so i cna also test with rbd | |
| 17:50:55 | sean-k-mooney | ill start with qcow | |
| 17:57:11 | melwitt | sean-k-mooney: something to know is that it's a good idea to include swap or ephemeral or both in flavors you test with bc the code takes a slightly different path for creating swap or ephemeral disks. so including swap and/or ephemeral you will cover those paths as well | |
| 17:57:36 | sean-k-mooney | cool i can add both | |
| 17:57:47 | sean-k-mooney | have you tested with ephpemeral with multiple ephermeral disks | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Catch ImageNotFound on snapshot failure https://review.opendev.org/c/openstack/nova/+/905316 | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Support glance's new location API https://review.opendev.org/c/openstack/nova/+/891036 | |
| 17:58:21 | opendevreview | Dan Smith proposed openstack/nova master: DNM: Test glance new location api https://review.opendev.org/c/openstack/nova/+/891207 | |
| 17:58:47 | sean-k-mooney | i.e. "openstack server create --ephemeral 10 --ephemeral 20 ..." with a flavor with 30 G of ephemeral | |
| 17:59:17 | sean-k-mooney | ill create an etherpad whith what i tested with when i get to that point | |
| 17:59:40 | melwitt | sean-k-mooney: I think I did but it's been awhile. that's a good thing to test. i'm thinking to write tempest tests for cases like that | |
| 18:00:14 | sean-k-mooney | ya we shoudl perhaps as follow ups but it woudl be good to cover that | |
| 18:02:32 | melwitt | yeah. I'm working on the docs now and keeping a list of a few cases that are not currently covered in tempest presently, to write tests for those gaps. I'm thinking maybe we could run the encryption jobs (once cleaned up from DNM) at least as periodic jobs or something | |
| 18:03:10 | sean-k-mooney | other then the fact it needs barbican | |
| 18:03:29 | sean-k-mooney | is there any reason not to perhaps include this in one of our other jobs | |
| 18:03:38 | sean-k-mooney | im fine wiht a perodic job too | |
| 18:03:55 | melwitt | encryption is pretty noticeably slow. so I'm not sure if it'll fly but we can try | |
| 18:04:01 | sean-k-mooney | but would integrating it in the nova-live-migration jobs be an issue | |
| 18:04:46 | melwitt | I'm thinking ahead to if it ends up being too slow, I would at least want periodics | |
| 18:04:55 | sean-k-mooney | yep | |
| 18:05:02 | sean-k-mooney | so what im thinkin is | |
| 18:05:12 | sean-k-mooney | the perodics can do a broader range fo testing | |
| 18:05:45 | sean-k-mooney | but nova-live-migration and nova-live-migration-ceph could perhaps also do some basic testing for us | |
| 18:05:53 | sean-k-mooney | as those are pretty small jobs | |
| 18:06:28 | sean-k-mooney | they just run tempest_test_regex: (^tempest\.api\.compute\.admin\.(test_live_migration|test_migration)) | |
| 18:06:31 | melwitt | initially I was running those jobs with flavor with 1G disk, 1G ephemeral and 512MB swap and I got quite a bit of timed out jobs for raw and rbd | |
| 18:07:09 | melwitt | so I removed the ephemeral disk and left swap, that runs at normal durations | |
| 18:07:41 | sean-k-mooney | ok well we loop back to this then and start with just perodics and experimental | |
| 18:07:48 | melwitt | yeah I think that approach makes sense | |
| 18:08:52 | melwitt | it might be fine, just saying we might need to tweak things if it's too slow | |
| 18:09:01 | sean-k-mooney | yep | |
| 18:09:21 | sean-k-mooney | thats why i was looking for jobs that currently run few tests | |
| 18:10:00 | sean-k-mooney | melwitt: i need to read the spec again | |
| 18:10:16 | sean-k-mooney | but if i recall you request encyption via a flavor/image property right | |
| 18:10:54 | sean-k-mooney | so if we had barbican in a job we could add a single test that boots a vm with a flavor that uses it | |
| 18:11:09 | sean-k-mooney | instead of confiugring the jobs to use that falvor for evertything | |
| 18:11:09 | melwitt | sean-k-mooney: another thing to know is that for rbd I had to do a standard snapshot (not direct/clone snapshot) because the current stable release of ceph (quincy) does not support clone with a child having a different passphrase as the parent | |