| tbarron | bswartz: xyang: gouthamr: I'm going to put a slot on tomorrow's meeting for "report from kubecon" - it's an opportunity for you folks to share your | 01:24 |
|---|---|---|
| tbarron | thoughts about where cloud storage is going. Is manila still relevant? What should we be paying attention to? etc. etc. | 01:24 |
| openstackgerrit | Tom Barron proposed openstack/manila master: DNM - testing ganesha log collection https://review.openstack.org/626220 | 01:45 |
| openstackgerrit | DingDong proposed openstack/manila master: Manila Unity/VNX] add 'snapshot support' related Doc for Unity/VNX driver https://review.openstack.org/626111 | 02:13 |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: DNM - testing ganesha log collection https://review.openstack.org/626220 | 02:34 |
| openstackgerrit | zhongshengping proposed openstack/puppet-manila master: DNM test lint https://review.openstack.org/626473 | 03:27 |
| openstackgerrit | Merged openstack/manila master: Fix image_name retrieval in custom-image jobs https://review.openstack.org/623551 | 04:20 |
| *** pcaruana has joined #openstack-manila | 07:25 | |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: Deprecate old keystone session config opts https://review.openstack.org/626506 | 07:52 |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: Deprecate old keystone session config opts https://review.openstack.org/626506 | 07:55 |
| *** luizbag has joined #openstack-manila | 09:31 | |
| openstackgerrit | DingDong proposed openstack/manila master: [Manila Unity/VNX] add 'snapshot support' related Doc for Unity/VNX driver https://review.openstack.org/626111 | 09:39 |
| *** e0ne has joined #openstack-manila | 09:53 | |
| *** ganso has joined #openstack-manila | 10:08 | |
| *** e0ne has quit IRC | 10:29 | |
| *** e0ne has joined #openstack-manila | 10:30 | |
| *** arne_wiebalck has quit IRC | 10:58 | |
| *** arne_wiebalck has joined #openstack-manila | 10:59 | |
| openstackgerrit | Merged openstack/manila master: Only run the needed services for CephFS jobs https://review.openstack.org/626021 | 11:52 |
| *** erlon_ has joined #openstack-manila | 11:54 | |
| *** luizbag has quit IRC | 12:29 | |
| *** luizbag has joined #openstack-manila | 12:30 | |
| openstackgerrit | Tom Barron proposed openstack/manila master: DNM - testing ganesha log collection https://review.openstack.org/626220 | 12:53 |
| openstackgerrit | Tom Barron proposed openstack/manila master: speed up GET scheduler-stats/pools/detail https://review.openstack.org/619576 | 13:00 |
| *** e0ne has quit IRC | 13:19 | |
| openstackgerrit | Tom Barron proposed openstack/manila stable/rocky: Only run the needed services for CephFS jobs https://review.openstack.org/626576 | 13:32 |
| *** e0ne has joined #openstack-manila | 13:33 | |
| *** e0ne has quit IRC | 14:11 | |
| *** e0ne_ has joined #openstack-manila | 14:11 | |
| *** baojg has quit IRC | 14:15 | |
| *** baojg has joined #openstack-manila | 14:16 | |
| *** a-pugachev has joined #openstack-manila | 14:16 | |
| *** a-pugachev has quit IRC | 14:23 | |
| *** mmethot has quit IRC | 14:27 | |
| *** mmethot has joined #openstack-manila | 14:29 | |
| openstackgerrit | Tom Barron proposed openstack/manila master: DNM - testing ganesha log collection https://review.openstack.org/626220 | 14:46 |
| *** tpsilva has joined #openstack-manila | 15:26 | |
| tbarron | gouthamr: yes, we should do a bug triage, do you have a time in mind? | 16:00 |
| gouthamr | xyang bswartz ganso: https://review.openstack.org/#/c/609598/ needs your re-reviews | 16:00 |
| gouthamr | tbarron: so last time, we spent a lot of time triaging bugs on the manila bug squash day, maybe we need bug triage day/s? | 16:01 |
| tbarron | gouthamr: fine idea, maybe we should target one for the second week of January? | 16:02 |
| tbarron | gouthamr: lots of people are out next week and will be recovering the week after that | 16:03 |
| gouthamr | yep, works for me | 16:03 |
| amito | I thought we had a midcycle on the 16-17? | 16:03 |
| amito | we plan to have* | 16:03 |
| gouthamr | we do? :P | 16:03 |
| amito | It's in my calendar :) | 16:04 |
| tbarron | yep | 16:04 |
| tbarron | so we could do it as part of mid-cycle or separately | 16:04 |
| tbarron | mid-cycle might be a good target for a new design for service vm connectivity | 16:05 |
| tbarron | ganso: bswartz: why don't we already have security issues when we stitch an svm into the integration bridge on the node where manila-share runs? probably I'm missing something. | 16:07 |
| bswartz | tbarron: The thing we worry about is the tenant breaking into the service VM | 16:12 |
| bswartz | If they manage that, then how much damage can they cause? | 16:12 |
| tbarron | bswartz: and what i'm missing is what we have today that keeps the tenant from breaking into the service VM | 16:12 |
| bswartz | With the integration bridge approach, they can attack only m-shr and things that coexist with m-shr | 16:12 |
| bswartz | With a dual-NIC approach, they could attack anything on the other end of that other NIC | 16:13 |
| tbarron | bswartz: even if the SVM is on the tenant net it can have security rules that allow only access to port 2049 on the SVM | 16:13 |
| bswartz | tbarron: that's an exercise left to the deployer | 16:13 |
| bswartz | We've never invested much in hardening the service VM | 16:14 |
| tbarron | bswartz: we can always set up the SVM that way | 16:14 |
| bswartz | In theory it could be quite secure, but since nobody spends time on that, it would be difficult to trust it | 16:14 |
| tbarron | and today they can still send packets to the SVM so it seems there is the same issue | 16:14 |
| bswartz | It's a question of security in layers | 16:15 |
| bswartz | The layer between the tenant and the service VM has always been iffy, but there are ways to make it more secure | 16:16 |
| tbarron | well my main interest actually is in getting a reference driver in gate to work reliably | 16:16 |
| bswartz | I'm talking about the layer of security behind the service VM -- the layer you would rely on after someone compromised the service VM somehow | 16:16 |
| tbarron | if I were to actually try to deploy generic driver in producation I'd use isolated networks, etc. | 16:16 |
| tbarron | which we don't have in devstack | 16:16 |
| bswartz | Yeah I know -- I'm not opposed to using a less secure approach if it solves our problems | 16:16 |
| bswartz | We would just need to document the tradeoffs and try to get people to working on addressing all the new vulnerabilities | 16:17 |
| tbarron | bswartz: +1 | 16:17 |
| bswartz | Earlier I was just explaining why it hasn't been tried before and why it wasn't the default initially | 16:17 |
| tbarron | yup | 16:18 |
| ganso | tbarron: don't you face similar problems with ganesha? | 16:27 |
| tbarron | ganso: we run ganesha to tenant on an isolated network with only port 2049 open | 16:28 |
| tbarron | ganesha to manila-share is on an isolated internal api network | 16:28 |
| tbarron | ganso: and we're looking to scale out ganeshas per tenant and connect their nfs interfaces directly onto the tenant net, with again only 2049 open | 16:29 |
| tbarron | ganso: these won't be service vms but yes the issues are similar | 16:30 |
| tbarron | ganso: they'll be processes in containers so it would be more like a client trying to do 'docker|podman exec <container>' than ssh into vm | 16:32 |
| ganso | tbarron: hmmm | 16:33 |
| bswartz | tbarron: does nova support vsock yet? | 16:35 |
| tbarron | bswartz: the libvirt part of vsock is there, dunno if nova knows about it yet, but | 16:36 |
| bswartz | tbarron: that's the place we want to get to eventually | 16:37 |
| tbarron | the hitch on vsock is NFS-over-vsock, which isn't | 16:37 |
| tbarron | making IETF progress | 16:37 |
| bswartz | tbarron: no I'm thinking of SSH-over-vsock | 16:37 |
| bswartz | If we can talk to the service VMs over vsock then they need no second NIC, no horrible back doors | 16:38 |
| tbarron | bswartz: I see | 16:38 |
| tbarron | bswartz: you need to run the SVM on the same node as the tenant VM though don't you? | 16:38 |
| bswartz | tbarron: nope, not at all | 16:38 |
| tbarron | ad tenant VMs for the same tenant could be spread over multiple nodes | 16:39 |
| bswartz | If I had a whiteboard I'd draw it out | 16:39 |
| tbarron | so it's manila-share doing the ssh to the SVM | 16:39 |
| tbarron | if over vsock it will be to a CID or whatever on the node manila-share is on | 16:40 |
| bswartz | Yeah that's my thinking | 16:40 |
| bswartz | That or something like that | 16:40 |
| tbarron | so SVMs would be bound to the node manila-share runs on | 16:40 |
| bswartz | Anything to close off the network path on the backend side of the service VM | 16:40 |
| bswartz | No no | 16:40 |
| bswartz | M-shr can reach out and talk to any nova node because it's an openstack service | 16:41 |
| bswartz | Nova just needs to provide a way to access this hypothetical service | 16:41 |
| bswartz | tbarron: you could prototype with something like this: https://gist.github.com/mcastelino/9a57d00ccf245b98de2129f0efe39857 | 16:50 |
| *** erlon_ has quit IRC | 16:55 | |
| *** erlon has joined #openstack-manila | 16:55 | |
| *** e0ne_ has quit IRC | 16:59 | |
| *** gouthamr has quit IRC | 17:31 | |
| *** gouthamr has joined #openstack-manila | 17:40 | |
| *** luizbag has quit IRC | 17:57 | |
| *** luizbag has joined #openstack-manila | 17:58 | |
| tbarron | bswartz: will look, meetings ... | 18:12 |
| *** luizbag has quit IRC | 18:13 | |
| *** luizbag has joined #openstack-manila | 18:13 | |
| *** ianychoi has quit IRC | 18:22 | |
| *** luizbag has quit IRC | 18:25 | |
| *** gouthamr_ has joined #openstack-manila | 18:37 | |
| *** gouthamr has quit IRC | 18:37 | |
| *** e0ne has joined #openstack-manila | 18:49 | |
| *** e0ne_ has joined #openstack-manila | 19:25 | |
| *** e0ne has quit IRC | 19:25 | |
| bswartz | tbarron: the basic idea works fine | 19:57 |
| bswartz | The big thing that's missing is nova code to add vsock support and expose tunnels | 19:57 |
| *** pcaruana has quit IRC | 19:57 | |
| bswartz | Probably the nova folks will never be motivated to do that work | 19:57 |
| bswartz | But the basic kernel, userspace, qemu/kvm, and libvirt bits are all in place | 19:58 |
| bswartz | The missing piece is just something in nova, and support inside the guest VM for listening on a vsock (but that part is trivial to do with a socat proxy like the one on that gist) | 19:59 |
| *** erlon has quit IRC | 20:05 | |
| *** gouthamr_ is now known as gouthamr | 20:13 | |
| *** e0ne_ has quit IRC | 21:21 | |
| gouthamr | tbarron | 21:55 |
| gouthamr | tbarron: ping | 21:55 |
| gouthamr | re: config file generatio | 21:56 |
| tbarron | gouthamr: pong | 21:56 |
| gouthamr | n* | 21:56 |
| tbarron | gouthamr: yup, we're broken | 21:56 |
| gouthamr | tbarron: hey Tom, do you really want me to hand-change the stuff with my patch? i ought to fix it for teh last few releases, no? :) | 21:56 |
| tbarron | gouthamr: just your little piece of the world | 21:56 |
| tbarron | gouthamr: we fix one thing at a time | 21:57 |
| tbarron | gouthamr: if you want to fix config file generation, sure, fine, but not as a part of *this* patch | 21:57 |
| gouthamr | tbarron: okay... i remember we took an AI from the PTG based on sfinucan's work | 21:57 |
| tbarron | just what you touch | 21:57 |
| tbarron | gouthamr: we have many AIs and that one isn't our highest prio | 21:57 |
| gouthamr | tbarron: ack, works for me.. i'll just toggle those couple of opts | 21:58 |
| tbarron | gouthamr: right, I know it feels bad not to fix the *real* issue but it's a different real issue than what your patch addresses | 21:58 |
| gouthamr | tbarron: true, but customers and downstream folks were looking at those files as source of truth for a bug and that got me nervous... i thought people just ran `tox -egenconfig` to get those deets | 21:59 |
| tbarron | gouthamr: we have to keep scope creep in control or we start putting spackling on a wall and pretty soon we're looking at bare studs and all the plaster is gone | 21:59 |
| gouthamr | tbarron: you're the boss :D | 21:59 |
| tbarron | gouthamr: it doesn't and that's broken for a lot of projects | 21:59 |
| tbarron | gouthamr: maybe nova has fixed it since sfinacun works there | 22:00 |
| tbarron | I'm not in any way discouraging fixing, i'm decoupling that fix from your *current* patch | 22:00 |
| gouthamr | yep, probably.. that and the config file changes from release to release | 22:00 |
| gouthamr | ack, thank you for clarifying.. we must still have a bug, maybe we can find a volunteer | 22:01 |
| * gouthamr looks for bug | 22:01 | |
| gouthamr | tbarron: this one: https://bugs.launchpad.net/manila/+bug/1713062 | 22:01 |
| openstack | Launchpad bug 1713062 in Manila "Missing ability to automatically build configuration reference artifacts" [High,Triaged] | 22:01 |
| tbarron | gouthamr: yup | 22:01 |
| gouthamr | sheesh, pike :( | 22:02 |
| tbarron | gouthamr: feel free to argue that it should be higher in our backlog and take it to our next meeting, right now we don't have someone to work on it | 22:03 |
| gouthamr | tbarron: ack, will add it to the etherpad cc: jgrosso | 22:04 |
| gouthamr | who ain't here, but will let him know | 22:04 |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: Deprecate old keystone session config opts https://review.openstack.org/626506 | 22:15 |
| gouthamr | tbarron: i had to delete those lines because the opts that i "added" were already there ^ | 22:16 |
| tbarron | gouthamr: yup | 22:19 |
| tbarron | gouthamr: if that works, cool | 22:20 |
| gouthamr | tbarron: actually, on a deeper thought - i would like to backport that fix so it lines up with puppet changes that vkmc's making | 22:23 |
| gouthamr | tbarron: these options were already shadowing other options since a long time, so is it okay to backport this deprecation? | 22:25 |
| gouthamr | the problem arises because of api_insecure which has a default value :( | 22:26 |
| tbarron | yes | 22:26 |
| gouthamr | and it overrides whatever people provide with "insecure" | 22:26 |
| tbarron | gouthamr: ^^ | 22:26 |
| tbarron | gouthamr: we need to make things work even in stable branches so don't get hung up about chasnging config options that don't work | 22:27 |
| tbarron | gouthamr: need appropriate release notes of course, 'splainin | 22:28 |
| gouthamr | tbarron: okay, i'll clarify further | 22:29 |
| *** ganso has quit IRC | 22:51 | |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: Deprecate old keystone session config opts https://review.openstack.org/626506 | 23:04 |
| openstackgerrit | Goutham Pacha Ravi proposed openstack/manila master: Deprecate old keystone session config opts https://review.openstack.org/626506 | 23:11 |
| *** tpsilva has quit IRC | 23:16 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!