| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-01-11 | |||
| 16:16:50 | sean-k-mooney | bauzas: done | |
| 16:17:03 | bauzas | sean-k-mooney: cool thanks | |
| 16:18:00 | bauzas | fwiw, I have some concerns when some good contributor abandons some change due to some other existing but the other is not revised from 6 months :( | |
| 16:18:32 | noonedeadpunk | bauzas: yeah, that's clear at this point :( | |
| 16:19:19 | noonedeadpunk | But realizing complexity more I'm not that self-confident anyway to pick implementation alone | |
| 16:20:56 | noonedeadpunk | As that sounds slightly like leveraging taskflow | |
| 16:40:32 | pmarsais | Hi nova community, I am looking at enabling TPM for my instances in my openstack cluster. Looking at nova source code, it seems that the shelving/unshelving workflow designed in https://specs.openstack.org/openstack/nova-specs/specs/victoria/implemented/add-emulated-virtual-tpm.html#shelve-offload-and-unshelve is currently not implemented (no references to "tpm_object_id" and "tpm_object_sha256"). Is that correct or am I mi | |
| 16:40:35 | pmarsais | If so, are there plan to get this in, or should I try to take a stab at implementing it ? (I already started the CCLA process internally with my employer) | |
| 17:24:27 | auniyal | hi sean-k-mooney, can you please have another look on this - https://review.opendev.org/c/openstack/nova/+/905134 [Refactor vf profile for PCI device | |
| 17:24:27 | auniyal | ] | |
| 17:28:38 | sean-k-mooney | pmarsais: no there is no plan to proceed with storing the tpm data in swrift for shelve/unshleve | |
| 17:29:22 | sean-k-mooney | if we wanted to od that we woudl have to repropose it as a feature via a new spec. | |
| 17:30:03 | sean-k-mooney | it was not implmented because we felt it was overly complext and we were not sure we wanted to require swift to be present to use it | |
| 17:31:06 | sean-k-mooney | today is the spec freeeze deadline for calacal os this woudl be a topic of next cycle (starting in march) | |
| 17:35:56 | pmarsais | Ok, thanks for the context ! | |
| 17:43:25 | sean-k-mooney | melwitt: im going to set up a devstack vm to test your disk encyprtion series so i can start reviewing it next week | |
| 17:43:36 | sean-k-mooney | melwitt:do you have a local.conf you can share | |
| 17:47:15 | sean-k-mooney | i belive i need barbican correct | |
| 17:48:21 | melwitt | sean-k-mooney: oh, yep. sec | |
| 17:49:26 | melwitt | sean-k-mooney: I set up jobs to test myself, you can use as reference as well https://review.opendev.org/c/openstack/nova/+/862416 | |
| 17:49:31 | sean-k-mooney | im currenly installing ubuntu so no rush | |
| 17:49:40 | sean-k-mooney | ah perfect | |
| 17:49:46 | melwitt | obvs everything you need will be in there | |
| 17:50:06 | sean-k-mooney | yep i can figure it out form there | |
| 17:50:31 | melwitt | ok great | |
| 17:50:45 | sean-k-mooney | now that i think about it i should proably clone this vm so i cna also test with rbd | |
| 17:50:55 | sean-k-mooney | ill start with qcow | |
| 17:57:11 | melwitt | sean-k-mooney: something to know is that it's a good idea to include swap or ephemeral or both in flavors you test with bc the code takes a slightly different path for creating swap or ephemeral disks. so including swap and/or ephemeral you will cover those paths as well | |
| 17:57:36 | sean-k-mooney | cool i can add both | |
| 17:57:47 | sean-k-mooney | have you tested with ephpemeral with multiple ephermeral disks | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Catch ImageNotFound on snapshot failure https://review.opendev.org/c/openstack/nova/+/905316 | |
| 17:58:20 | opendevreview | Dan Smith proposed openstack/nova master: Support glance's new location API https://review.opendev.org/c/openstack/nova/+/891036 | |
| 17:58:21 | opendevreview | Dan Smith proposed openstack/nova master: DNM: Test glance new location api https://review.opendev.org/c/openstack/nova/+/891207 | |
| 17:58:47 | sean-k-mooney | i.e. "openstack server create --ephemeral 10 --ephemeral 20 ..." with a flavor with 30 G of ephemeral | |
| 17:59:17 | sean-k-mooney | ill create an etherpad whith what i tested with when i get to that point | |
| 17:59:40 | melwitt | sean-k-mooney: I think I did but it's been awhile. that's a good thing to test. i'm thinking to write tempest tests for cases like that | |
| 18:00:14 | sean-k-mooney | ya we shoudl perhaps as follow ups but it woudl be good to cover that | |
| 18:02:32 | melwitt | yeah. I'm working on the docs now and keeping a list of a few cases that are not currently covered in tempest presently, to write tests for those gaps. I'm thinking maybe we could run the encryption jobs (once cleaned up from DNM) at least as periodic jobs or something | |
| 18:03:10 | sean-k-mooney | other then the fact it needs barbican | |
| 18:03:29 | sean-k-mooney | is there any reason not to perhaps include this in one of our other jobs | |
| 18:03:38 | sean-k-mooney | im fine wiht a perodic job too | |
| 18:03:55 | melwitt | encryption is pretty noticeably slow. so I'm not sure if it'll fly but we can try | |
| 18:04:01 | sean-k-mooney | but would integrating it in the nova-live-migration jobs be an issue | |
| 18:04:46 | melwitt | I'm thinking ahead to if it ends up being too slow, I would at least want periodics | |
| 18:04:55 | sean-k-mooney | yep | |
| 18:05:02 | sean-k-mooney | so what im thinkin is | |
| 18:05:12 | sean-k-mooney | the perodics can do a broader range fo testing | |
| 18:05:45 | sean-k-mooney | but nova-live-migration and nova-live-migration-ceph could perhaps also do some basic testing for us | |
| 18:05:53 | sean-k-mooney | as those are pretty small jobs | |
| 18:06:28 | sean-k-mooney | they just run tempest_test_regex: (^tempest\.api\.compute\.admin\.(test_live_migration|test_migration)) | |
| 18:06:31 | melwitt | initially I was running those jobs with flavor with 1G disk, 1G ephemeral and 512MB swap and I got quite a bit of timed out jobs for raw and rbd | |
| 18:07:09 | melwitt | so I removed the ephemeral disk and left swap, that runs at normal durations | |
| 18:07:41 | sean-k-mooney | ok well we loop back to this then and start with just perodics and experimental | |
| 18:07:48 | melwitt | yeah I think that approach makes sense | |
| 18:08:52 | melwitt | it might be fine, just saying we might need to tweak things if it's too slow | |
| 18:09:01 | sean-k-mooney | yep | |
| 18:09:21 | sean-k-mooney | thats why i was looking for jobs that currently run few tests | |
| 18:10:00 | sean-k-mooney | melwitt: i need to read the spec again | |
| 18:10:16 | sean-k-mooney | but if i recall you request encyption via a flavor/image property right | |
| 18:10:54 | sean-k-mooney | so if we had barbican in a job we could add a single test that boots a vm with a flavor that uses it | |
| 18:11:09 | sean-k-mooney | instead of confiugring the jobs to use that falvor for evertything | |
| 18:11:09 | melwitt | sean-k-mooney: another thing to know is that for rbd I had to do a standard snapshot (not direct/clone snapshot) because the current stable release of ceph (quincy) does not support clone with a child having a different passphrase as the parent | |
| 18:11:30 | melwitt | *than the parent | |
| 18:12:33 | melwitt | sean-k-mooney: right. flavor you use hw:ephemeral_encryption = true and image hw_ephemeral_encryption = true | |
| 18:15:06 | sean-k-mooney | so vtpm need barbican to be tested too | |
| 18:15:16 | melwitt | yes | |
| 18:15:45 | sean-k-mooney | so it might be good to add barbican to one of our jobs and do a simpel boot test and also test vtpm in the future | |
| 18:15:56 | sean-k-mooney | we have some whitebox tests to verify vtpm | |
| 18:31:00 | sean-k-mooney | melwitt: why are you using a cutom ploicy file for barbican | |
| 18:31:45 | sean-k-mooney | hum i see | |
| 18:31:59 | sean-k-mooney | you are giving admin extra premisison | |
| 18:32:02 | sean-k-mooney | we likley shoudl fix that | |
| 18:32:13 | sean-k-mooney | either by skiping those tests | |
| 18:32:31 | sean-k-mooney | or by ensuring they are not useing the admin user | |
| 18:32:33 | melwitt | sean-k-mooney: there's at least one tempest test that involves admin doing something on behalf of a user, and by default, admin don't have permission to user's barbican secrets | |
| 18:32:37 | melwitt | yeah. I'm not sure if that's really what we want but I was just looking to see if I could pass all of tempest as-is | |
| 18:32:45 | melwitt | ack | |
| 18:33:05 | sean-k-mooney | right so i would not expect an admin to be able to start a vm with disk encyption | |
| 18:33:18 | sean-k-mooney | if they tweak the policy they could | |
| 18:33:24 | sean-k-mooney | but i dont think we ned to test that | |
| 18:33:26 | melwitt | ok, that makes it easy then | |
| 18:33:46 | sean-k-mooney | im going to skip that locally for now | |
| 18:33:59 | melwitt | sure | |
| 18:34:06 | sean-k-mooney | we could docuemnt this i just dont know if we want to test it as i would generally think its best to test with default policy | |
| 18:35:14 | melwitt | I think that would be fine. I agree it's best to test with default policy | |
| 18:35:46 | sean-k-mooney | ill be around for about another hour | |
| 18:35:53 | sean-k-mooney | im going to kick off https://termbin.com/k0sv | |
| 18:36:07 | sean-k-mooney | and then ill proably start playing with it tomorrow or monday | |
| 18:36:33 | melwitt | the admin test is good to verify that it is _possible_ to let admin do stuff if someone wanted that | |
| 18:36:35 | melwitt | but that's all it's for | |
| 18:37:16 | melwitt | ok cool | |
| 18:37:36 | sean-k-mooney | i need to do some prep on the vm fist like install git and clone devstack | |
| 18:37:49 | sean-k-mooney | but that wont thake that long | |
| 18:47:47 | wncslln | hi o/, anyone can help me to enable boot with uefi mode, please? | |
| 18:48:20 | sean-k-mooney | you just need to set hw_firmware_type=uefi in the glance iamge properties i belive | |
| 18:48:32 | sean-k-mooney | oh an hw_machine_type=q35 | |
| 18:48:57 | wncslln | just set this two properties? | |
| 18:48:59 | sean-k-mooney | assuming you have the correct ovmf firmware installed on all your compute nodes | |
| 18:49:31 | wncslln | hmmm i dont think i have | |
| 18:49:32 | sean-k-mooney | yep if you have install the ovmf package on all your compute nodes then qemu will have access to the uefi firmeware | |