| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-03-05 | |||
| 17:06:42 | sean-k-mooney | yes but that not enough | |
| 17:07:00 | sean-k-mooney | what we actully need to know is if barbican is using custom policy or not | |
| 17:07:34 | sean-k-mooney | and we need to know that the admin that is making the request is doing so with a token that does not have access | |
| 17:07:44 | dansmith | we can grab the secret uuid and see if we can show it, or we can say "you don't own this and its encrypted so I'm not even going to try" | |
| 17:07:45 | sean-k-mooney | so really we would have to try and get the secret in the api | |
| 17:07:49 | sean-k-mooney | and bail early if that fails | |
| 17:07:57 | sean-k-mooney | ya | |
| 17:08:09 | sean-k-mooney | so if your fine with doing a secret show or simialr in the api | |
| 17:08:14 | sean-k-mooney | then we can rejct it early | |
| 17:08:25 | dansmith | what I'm saying is, we should do that early and not fail deep in nova-compute once we have downloaded the image and discover we can't see the key | |
| 17:08:44 | dansmith | it would be nice to do that from the api I think, and is similar to what we do with neutron ports and things, so I don't think it's a big deal | |
| 17:08:45 | sean-k-mooney | yep thats fair | |
| 17:09:04 | dansmith | especially since unshelve is a very infrequent operation compared to something like boot | |
| 17:09:15 | sean-k-mooney | ya its simialr to the decorators we have for cybrog ectra to check api mivroversion or neutron extentions | |
| 17:10:13 | sean-k-mooney | i dont think there was a check like that in the relevent patch but i dont recall so ya proably good to capture in a comment | |
| 17:11:09 | dansmith | so now that I have that in my config, I see that devstack didn't actually deploy barbican :) | |
| 17:14:22 | dansmith | typo, I guess | |
| 17:16:51 | sean-k-mooney | so on the comptue you do not need the barbica plugin bu ton the contoler you do | |
| 17:17:05 | sean-k-mooney | i can past my contoler local.conf too for reference | |
| 17:17:42 | sean-k-mooney | https://termbin.com/6iyt | |
| 17:18:22 | sean-k-mooney | so all i have is | |
| 17:18:24 | sean-k-mooney | enable_service barbican | |
| 17:18:30 | sean-k-mooney | and | |
| 17:18:33 | sean-k-mooney | LIBS_FROM_GIT=barbican,devstack,glance,keystone,neutron,nova,placement,requirements,tempest | |
| 17:18:35 | sean-k-mooney | enable_plugin barbican https://opendev.org/openstack/barbican | |
| 17:18:51 | sean-k-mooney | + the keymanager thing i mentioned eariler | |
| 17:19:12 | sean-k-mooney | oh | |
| 17:19:23 | sean-k-mooney | i think im useing melwitt's devtack patch | |
| 17:19:47 | dansmith | yeah I typo'd the enable_service | |
| 17:19:58 | sean-k-mooney | oh that just creats flavors https://review.opendev.org/c/openstack/devstack/+/864160/10/lib/nova | |
| 17:20:01 | sean-k-mooney | so you dont need that | |
| 17:47:23 | opendevreview | Pavlo Shchelokovskyy proposed openstack/nova master: Add debug logging to can_fit_pagesize https://review.opendev.org/c/openstack/nova/+/899942 | |
| 18:47:58 | opendevreview | OpenStack Release Bot proposed openstack/nova master: reno: Update master for unmaintained/victoria https://review.opendev.org/c/openstack/nova/+/911270 | |
| 18:48:10 | opendevreview | OpenStack Release Bot proposed openstack/os-vif master: reno: Update master for unmaintained/victoria https://review.opendev.org/c/openstack/os-vif/+/911272 | |
| 18:48:21 | opendevreview | OpenStack Release Bot proposed openstack/osc-placement master: reno: Update master for unmaintained/victoria https://review.opendev.org/c/openstack/osc-placement/+/911274 | |
| 18:48:34 | opendevreview | OpenStack Release Bot proposed openstack/placement master: reno: Update master for unmaintained/victoria https://review.opendev.org/c/openstack/placement/+/911276 | |
| 18:48:47 | opendevreview | OpenStack Release Bot proposed openstack/python-novaclient master: reno: Update master for unmaintained/victoria https://review.opendev.org/c/openstack/python-novaclient/+/911278 | |
| 18:49:55 | opendevreview | OpenStack Release Bot proposed openstack/nova master: reno: Update master for unmaintained/wallaby https://review.opendev.org/c/openstack/nova/+/911280 | |
| 18:50:07 | opendevreview | OpenStack Release Bot proposed openstack/os-vif master: reno: Update master for unmaintained/wallaby https://review.opendev.org/c/openstack/os-vif/+/911282 | |
| 18:50:19 | opendevreview | OpenStack Release Bot proposed openstack/osc-placement master: reno: Update master for unmaintained/wallaby https://review.opendev.org/c/openstack/osc-placement/+/911284 | |
| 18:50:31 | opendevreview | OpenStack Release Bot proposed openstack/placement master: reno: Update master for unmaintained/wallaby https://review.opendev.org/c/openstack/placement/+/911286 | |
| 18:50:45 | opendevreview | OpenStack Release Bot proposed openstack/python-novaclient master: reno: Update master for unmaintained/wallaby https://review.opendev.org/c/openstack/python-novaclient/+/911288 | |
| 18:51:32 | opendevreview | OpenStack Release Bot proposed openstack/nova master: reno: Update master for unmaintained/xena https://review.opendev.org/c/openstack/nova/+/911290 | |
| 18:51:44 | opendevreview | OpenStack Release Bot proposed openstack/os-vif master: reno: Update master for unmaintained/xena https://review.opendev.org/c/openstack/os-vif/+/911292 | |
| 18:51:55 | opendevreview | OpenStack Release Bot proposed openstack/osc-placement master: reno: Update master for unmaintained/xena https://review.opendev.org/c/openstack/osc-placement/+/911294 | |
| 18:52:08 | opendevreview | OpenStack Release Bot proposed openstack/placement master: reno: Update master for unmaintained/xena https://review.opendev.org/c/openstack/placement/+/911296 | |
| 18:52:21 | opendevreview | OpenStack Release Bot proposed openstack/python-novaclient master: reno: Update master for unmaintained/xena https://review.opendev.org/c/openstack/python-novaclient/+/911298 | |
| 19:27:04 | melwitt | dansmith, sean-k-mooney: are things working ok by now or are you still having issues? | |
| 19:27:40 | sean-k-mooney | i havent update my devstack in a week or two but it was workign fine for me | |
| 19:28:10 | sean-k-mooney | melwitt: i think dansmith just had a typo so i assume its working ok now or htey havent gotten aroudn to restacking | |
| 19:28:47 | melwitt | thanks sean-k-mooney | |
| 19:30:09 | melwitt | also, regarding the policy changes in the DNM tempest jobs patch, I did that to cover as many tests as possible, so that _if_ someone had their policy set that way, to verify whether it works | |
| 19:30:09 | stblatzheim | sean-k-mooney: Can you give a W vote for https://review.opendev.org/c/openstack/nova/+/910616 ? It's stuck before gate tests :) | |
| 19:30:39 | melwitt | it's not a statement about it being the right thing to do | |
| 19:31:02 | sean-k-mooney | stblatzheim: it need another stabel core to reveiw | |
| 19:31:46 | stblatzheim | Who could I ping for this? :) | |
| 19:31:57 | sean-k-mooney | melwitt: would you have 5 mins for ^ | |
| 19:31:58 | dansmith | melwitt: yeah I had a typo, not sure if it finished re-stacking or not | |
| 19:32:24 | melwitt | sean-k-mooney: sure, will look | |
| 19:32:39 | melwitt | dansmith: ack | |
| 19:33:39 | dansmith | sean-k-mooney: I looked at that yesterday and wanted to hear your take on your change of opinion | |
| 19:33:53 | dansmith | I read the bug and see neutron people saying it was wrong and implying the patch is correct, | |
| 19:34:17 | dansmith | but I didn't see any indication of "and yes this should be backported" since it presumably depends on what version(s) of neutron are in use in an older release | |
| 19:34:59 | sean-k-mooney | so the orginal patch tried to fix it by lookging for additon aports with a diffent device owner string | |
| 19:35:17 | sean-k-mooney | and i did not like that approch because it was wack a mole for every backend | |
| 19:35:31 | sean-k-mooney | the current patch checks if the subnet has dhcp enabled | |
| 19:35:41 | dansmith | oh I didn't see that it was a different approach earlier | |
| 19:35:49 | sean-k-mooney | and then use the enable_dhcp option to tell cloud init to use dhcp | |
| 19:36:42 | opendevreview | Merged openstack/nova master: Disconnecting volume from the compute host https://review.opendev.org/c/openstack/nova/+/877446 | |
| 19:37:21 | dansmith | sean-k-mooney: yeah but it changes what it's looking at from neutron, but the assertion is the thing it's looking for (the dhcp flag I guess) is nowhere near new enough to be a problem for a backport? | |
| 19:37:27 | sean-k-mooney | dansmith: os thats why i changed my mind. im fine with looking at the dhcp_enabled field on the subnet to determin if we configure cloud init for static ips or dhcp | |
| 19:38:07 | sean-k-mooney | dansmith: let me read the bug i didnt see them respond | |
| 19:39:14 | sean-k-mooney | ok so quickly readin gthey change this bevhiro in vitoria | |
| 19:39:31 | sean-k-mooney | https://review.opendev.org/c/openstack/neutron/+/732364 | |
| 19:39:32 | stblatzheim | enable_dhcp flag is there at least for 5 years (there was a try to fix this but not very well) | |
| 19:39:40 | sean-k-mooney | so that change broke the nova intengration | |
| 19:40:02 | sean-k-mooney | but i belive dhcp_enabled is much much older then that | |
| 19:40:44 | dansmith | sean-k-mooney: the patch description sort of sounds like this fixes it for OVN instead of OVS, so it just kinda seemed like this might be a "make it work for my situation" sort of thing | |
| 19:40:48 | sean-k-mooney | its part of the core subnet resouce https://github.com/openstack/neutron-lib/blob/master/neutron_lib/api/definitions/subnet.py#L109 | |
| 19:41:04 | stblatzheim | https://github.com/openstack/nova/commit/c7f572d65b57e034c1391ed49d84f6e5f1d672ad | |
| 19:41:39 | dansmith | sean-k-mooney: cool, fair enough, just wanted to confirm.. I saw you were "hell no" and then suddenly +2 so just wanted to make sure I understood :) | |
| 19:41:43 | sean-k-mooney | dansmith: the pach makes use not use "does the a subnet has a dhcp port" be how we determin if the subnet has dhcp enabled | |
| 19:41:55 | sean-k-mooney | instead we directly read the enable_dhcp field | |
| 19:42:09 | sean-k-mooney | so we have test coverage for ml2/ovs in the ci as well | |
| 19:42:24 | sean-k-mooney | with the ovs_hybrid_plug job | |
| 19:44:17 | sean-k-mooney | from what i can tell enable_dhcp has been a vaild field since the creation of the api defintion in neutron-lib in 2017 and if im being honestly i think this was in quantum | |
| 19:44:21 | sean-k-mooney | so ya i think we are good | |
| 19:44:44 | sean-k-mooney | dansmith: thanks for follwoing up your right that i orgignally marked this as invalid | |
| 19:45:10 | sean-k-mooney | because i do think neutron broke there api contract when they change the poer owner but it was reasonable for use to fix in nova | |
| 19:45:20 | dansmith | yeah exactly :) | |
| 19:49:48 | dansmith | sean-k-mooney: stblatzheim: got it | |
| 19:50:07 | stblatzheim | :) | |
| 20:08:09 | melwitt | dansmith: the only other thing you will need to do is make sure that whatever user you want to work with encrypted local disks has the "creator" role assigned to them. the barbican devstack plugin adds it to some users it creates https://github.com/openstack/barbican/blob/master/devstack/lib/barbican#L278 but if you use a different user you will need to add the role to that user | |
| 20:13:41 | dansmith | oh interesting okay | |
| 20:17:01 | melwitt | the "creator" role is what barbican uses to allow creation of secrets | |
| 20:17:49 | dansmith | yeah I gathered :) | |
| 20:17:54 | dansmith | quite the intuitive name ;P | |
| 20:23:28 | opendevreview | melanie witt proposed openstack/nova master: docs: Remove warning about quota driver default change https://review.opendev.org/c/openstack/nova/+/911374 | |
| 22:29:16 | opendevreview | Merged openstack/nova stable/2023.2: Fix nova-metadata-api for ovn dhcp native networks https://review.opendev.org/c/openstack/nova/+/910616 | |
| 22:54:39 | opendevreview | Steven Blatzheim proposed openstack/nova stable/2023.1: Fix nova-metadata-api for ovn dhcp native networks https://review.opendev.org/c/openstack/nova/+/911070 | |