| Posted | Nick | Remark | |
|---|---|---|---|
| #openstack-nova - 2024-09-04 | |||
| 13:53:14 | jlejeune | https://review.opendev.org/c/openstack/nova/+/927897 | |
| 13:53:57 | dansmith | um, did we backport the ami changes? | |
| 13:54:58 | dansmith | huh, I guess so | |
| 13:56:37 | dansmith | sean-k-mooney: these are not functional changes, which means there's no chance of introducing a regression if we approve these out of order.. any opposition to just approving them all and let the dust settle? | |
| 13:57:10 | sean-k-mooney | you mean approving across all stabel branches | |
| 13:57:36 | sean-k-mooney | it will fail the backport check in gate requiring a recheck | |
| 13:58:01 | sean-k-mooney | unless we workaround it by addding StableOnly | |
| 13:58:21 | sean-k-mooney | or whatever the commit message thing we need to add upstream is | |
| 13:58:58 | vicent | Good morning! I am installing openstack-ansible 29.0.2 on metal. I noticed the nova.conf template doesn't include the rootwrap_config field. | |
| 13:59:00 | sean-k-mooney | dansmith: so no no objection but mechanically it wont work right now | |
| 14:00:14 | dansmith | sean-k-mooney: oh right forgot | |
| 14:00:31 | vicent | I am using nova image_type: lvm. | |
| 14:01:33 | vicent | Because of that nova gives me error: "2024-09-04 17:00:41.313 73654 WARNING oslo.privsep.daemon [-] privsep log: sudo: nova-rootwrap: command not found". Isn't that a bug? | |
| 14:06:52 | jlejeune | dansmith: yes we backported AMI removal commit on all stable branchs | |
| 14:11:07 | sean-k-mooney | ill review those back ports and premetivly +2 but hold +w on the older ones | |
| 14:11:13 | sean-k-mooney | then we can just +w as they merge | |
| 14:11:41 | vicent | ok, adding the rootwrap_config field on nova.conf didn't work. Any idea why nova-rootwrap is not found? It is there on the venv... $ ls /openstack/venvs/nova-29.0.2/bin/nova-rootwrap | |
| 14:11:45 | vicent | /openstack/venvs/nova-29.0.2/bin/nova-rootwrap | |
| 14:29:03 | vicent | I am basically trying this: | |
| 14:29:06 | vicent | https://www.cloudnull.io/2017/12/nova-lvm-an-iop-love-story/ | |
| 14:33:36 | sean-k-mooney | so nova does not use rootwap realy itslef its used by os-brick | |
| 14:33:55 | sean-k-mooney | and its used for spawnign privsep | |
| 14:39:33 | vicent | https://github.com/openstack/nova/blob/master/nova/virt/libvirt/storage/lvm.py#L92 this is where nova calls privsep | |
| 14:48:55 | vicent | If privsev is not used in nova, then this is a problem: "2024-09-04 17:47:01.170 113107 INFO oslo.privsep.daemon [None req-f50b55b0-5b93-4a92-9c95-7d03b61d04b6 - - - - - -] Running privsep helper: ['sudo', 'nova-rootwrap', '/etc/nova/rootwrap.conf', 'privsep-helper', '--config-file', '/etc/nova/nova.conf', '--privsep_context', 'nova.privsep.sys_admin_pctxt', '--privsep_sock_path', | |
| 14:49:01 | vicent | '/tmp/tmpdshabbj0/privsep.sock']" | |
| 15:18:24 | opendevreview | Merged openstack/nova stable/2024.1: Skip snapshot test when missing qemu-img https://review.opendev.org/c/openstack/nova/+/927896 | |
| 15:39:32 | mnaser | dansmith: are you able to merge https://review.opendev.org/c/openstack/os-test-images/+/926942 by any chance? we use github mirrors for running jobs and since the job to mirror that repo was missing, its empty and breaking ci | |
| 15:39:55 | mnaser | https://review.opendev.org/c/openstack/project-config/+/927877 merged now so it will mirror moving forward, but it needs a change merged to push it up | |
| 15:40:49 | dansmith | mnaser: um, maybe because it's marked as usable=false, but I don't understand why you need this specific image | |
| 15:41:29 | mnaser | dansmith: i dont need it at all, but i need _anything_ to merge to make it successfully mirror to github - https://github.com/openstack/os-test-images | |
| 15:41:46 | mnaser | if you dont want to merge that im happy to make a small noop change that we can push through so it mirrors successfully | |
| 15:41:56 | dansmith | I think I'd rather merge something trivial instead of this just because it could cause everything to fail | |
| 15:42:04 | dansmith | yeah, push something up and I'll +W it | |
| 15:42:32 | mnaser | ok thank you | |
| 15:43:41 | mnaser | dansmith: https://review.opendev.org/c/openstack/os-test-images/+/928001 | |
| 15:44:16 | dansmith | done | |
| 16:00:31 | melwitt | sean-k-mooney: hey, I saw your comment on https://review.opendev.org/c/openstack/nova/+/924319 about being in a freeze period. I thought we are frozen for features but not frozen for bug fixes? | |
| 16:11:33 | dansmith | melwitt: no bug reference was the point I think | |
| 16:11:43 | dansmith | looks like a feature without it as it doesn't even say "fix.." or anything | |
| 16:13:31 | melwitt | dansmith: ah, ok. that makes more sense, thanks | |
| 16:19:12 | sean-k-mooney | ya i wanted a bug link for backporting mainly | |
| 16:19:40 | sean-k-mooney | until RC1 we can merge bug afeter RC1 they shoudl only be regression bugs but we will have mater at that point | |
| 16:19:54 | sean-k-mooney | *master at that point reopend for dev | |
| 16:20:08 | dansmith | yeah so between m3 and rc1 being stricter about requiring a bug ref makes sense ot me | |
| 16:20:31 | melwitt | sean-k-mooney: gotcha. thanks | |
| 16:20:41 | sean-k-mooney | that and i asked for a minor release note becasue if operator have doen this already | |
| 16:21:00 | sean-k-mooney | they need to be aware that the changes they made did not propagate to the requst spec | |
| 16:21:17 | melwitt | I saw that but misinterpreted the "freeze" part of your sentence | |
| 16:21:36 | sean-k-mooney | well i wanted to also check with other how we felt about merging it | |
| 16:21:46 | sean-k-mooney | but i saw this as a very low risk | |
| 16:22:29 | melwitt | sure | |
| 16:25:56 | mnaser | https://github.com/openstack/os-test-images -- thanks, i got what i need | |
| 16:26:33 | dansmith | mnaser: cool | |
| 16:36:35 | opendevreview | Lajos Katona proposed openstack/nova master: WIP Use SDK for Neutron https://review.opendev.org/c/openstack/nova/+/928022 | |
| 16:37:26 | sean-k-mooney | lajoskatona: best of luck. you are the third person to start that | |
| 16:38:32 | sean-k-mooney | lajoskatona: with that said we would happliy move to the sdk if you can make it work properly | |
| 16:39:23 | sean-k-mooney | lajoskatona: there are some subtleies in that we need to use both admin and non admin clinets and we need to includ a service token when making request ot nutron too | |
| 16:41:16 | sean-k-mooney | lajoskatona: gibi and Uggla have had expirnce with using service token and the sdk recently with the manila serise so we likely ahve some refernc matiral for that | |
| 16:41:52 | sean-k-mooney | our previous usage of sdk was for ironic and placment both of which were admin only clients | |
| 16:42:20 | sean-k-mooney | so neutron and manila will be the first that need to have a mix of admin and non admin token usage | |
| 17:02:37 | lajoskatona | sean-k-mooney: :-) | |
| 17:04:14 | lajoskatona | sean-k-mooney: thanks, I will check with gibi, this patch now works for basic boot, but to tell the truth I am not sure I have the strength to understand the dirty internals of Nova (not to speak about Neutron API :-)) | |
| 17:09:39 | sean-k-mooney | lajoskatona: i see you are not replacing how we are doing auth which i foudn a little odd | |
| 17:10:25 | sean-k-mooney | have you confirmed that user tokens and not admin tokens are used for thinks liek creating a neuton port when we add a network to the vms | |
| 17:11:18 | sean-k-mooney | not intoducing privadge escaltion but using the admin token is one of the more imporant things we need to watch out for | |
| 17:19:41 | lajoskatona | sean-k-mooney: yes, I made some notes for myself, and that is one of the swampy things as I see (the other is filtering i.e.: networks like shared non-shared admin / non-admin etc) but I am sure there should be more | |
| 17:20:25 | sean-k-mooney | lajoskatona: well the problem with neutrons rbac featues is no one updated nova to supprot any of them | |
| 17:21:01 | sean-k-mooney | lajoskatona: i.e. after many release there are now patches to supprot shared secruity groups for example | |
| 17:21:12 | lajoskatona | sean-k-mooney: any feedback is really useful, I will see if I can work on this (and if I have to patience for this ;)) | |
| 17:21:20 | sean-k-mooney | but as neutron was building out it rbac feature there were no sister propossla filed to nova to use them | |
| 17:21:48 | sean-k-mooney | lajoskatona: nueton has several feature that nova does not officaly supprot | |
| 17:21:55 | sean-k-mooney | like multi provider netwroks | |
| 17:23:51 | sean-k-mooney | the unfortunet pattern is often the neuton extentoin lands and then no one does the nova part to enabel ti properly end ot end | |
| 17:23:52 | lajoskatona | sean-k-mooney: well, we can have a list of these things officially written somewhere where possible brave fresh minded geniuses can select future projects :-) I believe these things should be written somewhere otherwise they are just forgotten | |
| 17:25:35 | sean-k-mooney | funny i was having a paralle conversation about how to document unsupptotred feature a few minutes ago | |
| 17:59:11 | opendevreview | melanie witt proposed openstack/nova master: nova-manage: Add --max_rows option to 'db purge' command https://review.opendev.org/c/openstack/nova/+/927339 | |
| 18:11:43 | opendevreview | Merged openstack/nova stable/2023.2: Skip snapshot test when missing qemu-img https://review.opendev.org/c/openstack/nova/+/927897 | |
| 18:36:44 | opendevreview | melanie witt proposed openstack/nova master: Call volume detach rollback API if detach fails https://review.opendev.org/c/openstack/nova/+/880399 | |
| 21:36:26 | melwitt | dansmith: I was looking through New bugs in launchpad and saw this one that may interest you. online data migration for populate_instance_compute_id failing because of the "fake" instance created by the fill_virtual_interface_list online data migration https://bugs.launchpad.net/nova/+bug/2076614 | |
| 21:59:50 | opendevreview | Merged openstack/nova stable/2023.2: libvirt: call get_capabilities() with all CPUs online https://review.opendev.org/c/openstack/nova/+/927557 | |
| 22:00:00 | opendevreview | Merged openstack/nova stable/2023.1: Skip snapshot test when missing qemu-img https://review.opendev.org/c/openstack/nova/+/927898 | |
| 22:19:03 | dansmith | melwitt: "interest" is a strong word :D | |
| 22:19:18 | dansmith | melwitt: surely the virtual interface migration is crazy old right? | |
| 22:20:07 | sean-k-mooney | its pre trian | |
| 22:20:15 | dansmith | trian? | |
| 22:20:18 | dansmith | oh train | |
| 22:20:38 | sean-k-mooney | porbaly older but its pre pandemic | |
| 22:20:56 | sean-k-mooney | so the before times | |
| 22:20:56 | dansmith | yeah I'm just wondering if we want to maybe also delete that.. we really don't need those to stay around forever since we don't support upgrading from any release to any other, | |
| 22:21:09 | dansmith | although I'm not sure if we (bauzas) added a blocker migration for this or not | |
| 22:21:43 | sean-k-mooney | i kind of forgot it exited so we probably could | |
| 22:22:01 | sean-k-mooney | i had assuemd some of this cleanup was done when stephen did the move to alembic | |
| 22:23:08 | dansmith | "This script should be executed while upgrading to Stein release." | |
| 22:23:16 | dansmith | I thought this was bauzas for sure, but I guess not | |
| 22:24:59 | sean-k-mooney | no this was realted to healing the network info cache | |
| 22:25:00 | sean-k-mooney | https://review.opendev.org/c/openstack/nova/+/614167 | |
| 22:25:13 | melwitt | dansmith: I saw you on the commit for the compute_id migration :) | |
| 22:25:48 | sean-k-mooney | i have unloaded the contex but if i rememebr correctly this was technially optional | |
| 22:26:20 | sean-k-mooney | as in if you didnt run it i just would not populate the table and give you a stabel order | |
| 22:27:17 | sean-k-mooney | so for me this is old enough that we dont even have unmaintianed barnaches that need it | |