| opendevreview | Ghanshyam proposed openstack/nova master: API change to allow project admin to boot server on specific host https://review.opendev.org/c/openstack/nova/+/830543 | 02:14 |
|---|---|---|
| opendevreview | melanie witt proposed openstack/nova master: libvirt: Register defaults for undefined hw image properties https://review.opendev.org/c/openstack/nova/+/800708 | 02:50 |
| opendevreview | melanie witt proposed openstack/nova master: WIP manage: Add image_property commands https://review.opendev.org/c/openstack/nova/+/824392 | 05:09 |
| *** bhagyashris_ is now known as bhagyashris | 06:28 | |
| *** amoralej|off is now known as amoralej | 07:06 | |
| kashyap | gibi: Thank you for looking; just read your messages in the scroll! Yeah, the QEMU error might not correlate with the Tempest failure, but it seems to have uncovered a latent libvirt bug | 09:00 |
| kashyap | Morning, BTW | 09:01 |
| *** bhagyashris_ is now known as bhagyashris | 09:25 | |
| gibi | kashyap: o/ I tried to find the same error in any tempest-integrated-compute-centos-8-stream job but in the last 10 days of run I did not find the same error as reported in https://bugs.launchpad.net/tripleo/+bug/1959014/comments/1 | 09:47 |
| gibi | bauzas: I was about to update the tracking etherpad with the placement feature but I see you updating that in real time :) | 10:02 |
| bauzas | heh | 10:02 |
| bauzas | was about to review the series | 10:03 |
| bauzas | then I saw sean having done it | 10:03 |
| bauzas | gibi: WDYT of https://review.opendev.org/c/openstack/nova/+/808791 ? | 10:03 |
| gibi | bauzas: I'm not worrying about it | 10:04 |
| bauzas | me too | 10:04 |
| gibi | hence my +2 :) | 10:04 |
| bauzas | I'll review it again | 10:04 |
| gibi | ack | 10:05 |
| gibi | I will go back to https://review.opendev.org/q/topic:bp%252Fpick-guest-arch-based-on-host-arch-in-libvirt-driver | 10:05 |
| gibi | I saw chateaulav updated it after my comments | 10:05 |
| bauzas | gibi: well, I'm still torn by https://review.opendev.org/c/openstack/nova/+/808791/7/nova/virt/vmwareapi/constants.py#22 | 10:19 |
| bauzas | I'm a vmware specialist tho but I assume we say the whole driver works with VC 5.1.0 | 10:19 |
| bauzas | I'm not* a vmware specialist, obviously | 10:19 |
| bauzas | can someone know Alban's IRC nick ? | 10:20 |
| opendevreview | melanie witt proposed openstack/nova master: manage: Add image_property commands https://review.opendev.org/c/openstack/nova/+/824392 | 10:29 |
| kashyap | gibi: (Sorry, was out for a run; weather is nice for a change) Hm, I'm feeling like we're 2 steps fwd, 1 step backward | 10:35 |
| gibi | bauzas: Alban responded in review to update the versions so I'm still OK | 10:44 |
| gibi | kashyap: I still in the | 10:44 |
| gibi | kashyap: I'm still in the winter mode an only use the pool | 10:44 |
| gibi | *and | 10:44 |
| kashyap | I can't swim yet, I can do "controlled not drowning" in a calm pool if you know what I mean :D | 10:45 |
| gibi | :) | 10:46 |
| gibi | kashyap: about the bug, I'm not sure how to move forward | 10:46 |
| kashyap | (No worries. I only began after 2 months...but keep walking 8-ish KM each day. But it's no substitue for running) | 10:46 |
| kashyap | gibi: Back to the bug, it looks like it is not reproducible, right? | 10:46 |
| kashyap | gibi: Did you look for this? | 10:47 |
| kashyap | "libvirt.libvirtError: Unable to read from monitor: Connection reset by peer" | 10:47 |
| gibi | I looked for the more specific raise libvirtError..virDomainGetBlockJobInfo.. failed.. regex | 10:48 |
| gibi | but I can check the more generic one | 10:48 |
| kashyap | gibi: Your search makes sense. | 10:50 |
| kashyap | Yeah, what I'm wondering is, we don't see the _crash_ anymore: | 10:50 |
| kashyap | "2022-01-25 13:13:35.058+0000: shutting down, reason=crashed" | 10:50 |
| kashyap | Is that what you found based on your searches? That you can't find the crash anymore? | 10:51 |
| gibi | I did not find the same nova symptom, the libvirtError, in any upstream logs, so I did not look deeper | 10:52 |
| gibi | I can also try to find the same tempest test failure | 10:53 |
| gibi | in upstream jobs | 10:53 |
| gibi | and if I found one then I can refine from there | 10:53 |
| kashyap | gibi: Nod. But you wanted a TripleO job result, right? | 10:54 |
| kashyap | gibi: When you get a minute, can you please add your observation so far? Just so that it gives an insight that several folks are looking at it - https://bugs.launchpad.net/tripleo/+bug/1959014/ | 10:54 |
| gibi | I can look at the original triploo run from ^^ bug but I'm new to tripleo that why I tried to find a repro in a nova run | 10:55 |
| kashyap | Yeah, understood. I'm "perpetually new" to TripleO too. They're seeing this on TripleO, it looks like | 10:56 |
| kashyap | gibi: Good that we (you) ruled it out w/ plain upstream jobs, at least. Thank you for the digging | 10:56 |
| gibi | I will look at the original run, and then update the bug what I see | 10:57 |
| sean-k-mooney | bauzas: i think https://blueprints.launchpad.net/nova/+spec/vmware-fcd is the blueprint for that by the way | 10:59 |
| sean-k-mooney | its approved for the yoga cycle | 10:59 |
| stephenfin | Is it just me, or is anyone else not getting emails from Gerrit at the moment. I haven't seen anything since midday yesterday | 11:00 |
| sean-k-mooney | althouhg they are missing the commit message line for it | 11:00 |
| sean-k-mooney | stephenfin: it know that you have abandoned us :P | 11:00 |
| sean-k-mooney | stephenfin: last email was 12:04 yesterday | 11:01 |
| sean-k-mooney | not sure if i should have got anything since then | 11:01 |
| bauzas | sean-k-mooney: yup, we approved it as a specless BP during a meeting, see the whiteboard | 11:01 |
| sean-k-mooney | bauzas: oh i know just wanted to highlight it to you incase you tought it was not approved | 11:02 |
| sean-k-mooney | i noticed both you and gibi are +2 on it | 11:02 |
| bauzas | sean-k-mooney: no, I'm tracking all the approved bps in https://etherpad.opendev.org/p/nova-yoga-blueprint-status | 11:02 |
| sean-k-mooney | but ye have not +w so i was wondering if you were conceren that it was not approved | 11:02 |
| bauzas | sean-k-mooney: and this one was in there so I was looking at it | 11:03 |
| sean-k-mooney | ack | 11:03 |
| bauzas | sean-k-mooney: I eventually +W it 1 min ago | 11:03 |
| bauzas | as alban replied | 11:03 |
| sean-k-mooney | stephenfin: so https://review.opendev.org/c/openstack/placement/+/826719 meged 14 hours ago | 11:03 |
| sean-k-mooney | and i dont have a gerrit email from it | 11:03 |
| sean-k-mooney | so ya i havent got anythin since just after noon yesterday so looks like its not just you | 11:04 |
| stephenfin | sean-k-mooney: I emailed the list and mentioned it on #opendev | 11:29 |
| sean-k-mooney | gibi by the way your placment any triats series is now merged in case you didnt get the gerrit email :) | 11:31 |
| sean-k-mooney | stephenfin: was there anything in particalar you were looking for | 11:31 |
| sean-k-mooney | or just noticed you got no emails form gerrit in a while | 11:31 |
| stephenfin | No, just noticed the lack of emails | 11:32 |
| sean-k-mooney | ack | 11:32 |
| stephenfin | (Usually it's a firehose) | 11:32 |
| sean-k-mooney | lyarwood: sorry to bother you but do you know what i should do with https://review.rdoproject.org/r/c/openstack/placement-distgit/+/39716 the build failed because it coudl not resovle the centos8-stream repos its not related to the patch that merged so do i just abandon that? | 11:35 |
| lyarwood | sean-k-mooney: The RDO folks normally close these out once the outage is over | 11:35 |
| sean-k-mooney | ok it showed up in my email so i was like do i need to do somehting with this | 11:36 |
| sean-k-mooney | Errors during downloading metadata for repository 'Stream-BaseOS': | 11:36 |
| sean-k-mooney | is clearly not related to placement | 11:36 |
| lyarwood | Yeah it's infra 99% of the time | 11:37 |
| sean-k-mooney | 2919c3f393bb2e897cead2e62c598acadeae3b8bd1603ef8e171e4274ff1b2e0-primary.xml.gz is missing form the mirrors | 11:38 |
| sean-k-mooney | so proably a sync issue | 11:38 |
| sean-k-mooney | lyarwood: how is life in openshift land | 11:38 |
| lyarwood | Yeah good, I've somehow ended up helping with the introduction of flavors into KubeVirt ^_^ | 11:39 |
| opendevreview | Rajat Dhasmana proposed openstack/nova master: Add support for volume backed server rebuild https://review.opendev.org/c/openstack/nova/+/820368 | 11:40 |
| sean-k-mooney | ok so pod spec templates or something like that ya | 11:40 |
| sean-k-mooney | the idea of flavors in a k8s env would be somewhat differnt then ours i expect since the intent with k8s is to be much more dynmic in terms of each pod spec is used for that one set of pods but not reused across unrelated pods | 11:43 |
| sean-k-mooney | so unlike openstack if you udated the kubevirt flavor i would expect that to propagate to everything that used it | 11:44 |
| gibi | kashyap: https://bugs.launchpad.net/tripleo/+bug/1959014/comments/15 tldr; I don't think the original problem was reproduced in later runs linked in the bug | 11:59 |
| sean-k-mooney | stephenfin: by the way nova is nolonger installable with -e because pbr cannot figure out the version | 12:00 |
| gibi | sean-k-mooney: thanks for pushing the any-traits through. I will get back to the series to do the small nit followup and the perf measurements / tuning | 12:00 |
| sean-k-mooney | stephenfin: i know there is a bug with the current pbr due to metadata or somehting like that but do you know if the impact on nova is expected | 12:01 |
| sean-k-mooney | gibi: ack | 12:01 |
| stephenfin | sean-k-mooney: There is? I wasn't aware of anything | 12:02 |
| sean-k-mooney | if you install with devstack | 12:02 |
| sean-k-mooney | then clone nova and pip install -e the clone | 12:02 |
| sean-k-mooney | then when you restart the nova compute agent | 12:03 |
| sean-k-mooney | or any of the rest | 12:03 |
| sean-k-mooney | it will fail to run | 12:03 |
| sean-k-mooney | because pbr will not be able to figure out the version | 12:03 |
| sean-k-mooney | so you ahve to do a non -e install currently | 12:03 |
| sean-k-mooney | which is annoying since you have to redo it every time you make a change | 12:04 |
| gibi | hm, I haven't hit that issue yet ^^ | 12:06 |
| gibi | probably my pbr is older | 12:07 |
| sean-k-mooney | https://paste.opendev.org/show/812529/ | 12:09 |
| sean-k-mooney | stephenfin: gibi that is what it looks liek in the journal | 12:09 |
| stephenfin | That's weird. I haven't seen that eithe | 12:10 |
| stephenfin | *either | 12:10 |
| sean-k-mooney | have you done sudo pip install -e | 12:10 |
| sean-k-mooney | of the repo or a differnt copy of the repo | 12:11 |
| stephenfin | I didn't need to. It does an editable install by default | 12:11 |
| stephenfin | DevStack that is | 12:11 |
| gibi | yeah I have the editable nova in devstack too | 12:11 |
| gibi | so then that is the difference | 12:11 |
| sean-k-mooney | so ye dont use a second repo for dev | 12:11 |
| sean-k-mooney | with devstafck using reclone=ture i guess | 12:12 |
| gibi | I tend to pull from my dev repo to the devstack nova repo with git | 12:12 |
| stephenfin | Yeah, me too | 12:12 |
| sean-k-mooney | ok you do it that way instead of installign the dev one after the fact | 12:12 |
| stephenfin | Or I push from the local to devstack | 12:12 |
| stephenfin | (that's slower because you've to change branches) | 12:13 |
| sean-k-mooney | i dont like having to commit for it to take effect most of the time | 12:13 |
| sean-k-mooney | and since i have reclone true set its not safe to do dev in the devstack managed one | 12:13 |
| stephenfin | git commit -asm TODO | 12:13 |
| stephenfin | easy as pie | 12:13 |
| sean-k-mooney | ya but that vs save and restart | 12:14 |
| sean-k-mooney | anyway i think this is caused by the other pbr bug | 12:14 |
| sean-k-mooney | but i think that has been fixed recently | 12:14 |
| sean-k-mooney | https://review.opendev.org/c/openstack/pbr/+/662035 i think is realted to it | 12:15 |
| stephenfin | so using pbr 5.8.1, I can use an editable install and still get a valid version for another pbr-based project I have | 12:17 |
| stephenfin | so maybe it's the sudo part of things that's the issue | 12:17 |
| sean-k-mooney | https://review.opendev.org/c/openstack/pbr/+/827977/1/releasenotes/notes/fix-pep517-metadata-regression-bc287e60e45b2732.yaml | 12:18 |
| chateaulav | so i have the `tools/hooks/post_test_hook.sh` file that was an accidental change, but i cant seem to remove that change from the patchset. i have tried reset to its original commit but it doesnt like that and i cant seem to simply discard it. any ideas | 12:20 |
| gibi | have you tried git rm tools/hooks/post_test_hook.sh ? | 12:21 |
| chateaulav | yeah but then that deletes the file itself, and i dont want to commit it as deleted, that is no different then the typechange it is recognizing | 12:21 |
| gibi | ahh so it is a link on mater | 12:23 |
| gibi | master | 12:23 |
| chateaulav | https://usercontent.irccloud-cdn.com/file/zqzGCZdB/image.png | 12:23 |
| chateaulav | added 5 years ago | 12:23 |
| chateaulav | when i try to reset it it does a weird staged and ustaged change at the same time, which wont allow me to commit | 12:24 |
| sean-k-mooney | you can do git checkout -- <file> | 12:24 |
| sean-k-mooney | to rest the file to what was in the parent commit | 12:24 |
| chateaulav | ok, ill try that | 12:24 |
| sean-k-mooney | or do git checkout <branch or commit> -- <file> | 12:24 |
| sean-k-mooney | if you want to restrore it to a specific version | 12:24 |
| gibi | $ git checkout HEAD^ -- tools/hooks/post_test_hook.sh | 12:25 |
| gibi | gibizer@riverbed:~/upstream/git/nova D[eaf971cfda driver/secheduler/docs for Adds Pick guest CPU architecture based on host arch in libvirt driver support] [000] [13:25:23] | 12:25 |
| gibi | $ git status | 12:25 |
| gibi | HEAD detached at FETCH_HEAD | 12:25 |
| gibi | Changes to be committed: | 12:25 |
| gibi | (use "git restore --staged <file>..." to unstage) | 12:25 |
| gibi | ahh sean-k-mooney was faster | 12:25 |
| gibi | typechange: tools/hooks/post_test_hook.sh | 12:25 |
| chateaulav | k | 12:26 |
| opendevreview | Jonathan Race proposed openstack/nova master: driver/secheduler/docs for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/822053 | 12:31 |
| opendevreview | Jonathan Race proposed openstack/nova master: zuul-job for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/828372 | 12:31 |
| chateaulav | perfect, appreciate the tip! | 12:31 |
| sean-k-mooney | git restore i think can do somethign similar but its a much more recent tool in the git suite so not really famialr with how it works | 12:33 |
| chateaulav | yeah, i can definitely say this whole process has thouroughly expanded my understanding of git | 12:34 |
| gibi | git is nice but it has a learning curve | 12:40 |
| sean-k-mooney | having used svn and perforce(breifly) i will take the learning curve over checking out indivugual files anyday | 12:45 |
| sean-k-mooney | i know other tools like mercuiral exist that work in a similar way | 12:46 |
| sean-k-mooney | but with out a distibuted version contol system like git we could not work the way we do today | 12:46 |
| chateaulav | definitely | 12:47 |
| sean-k-mooney | even the kernels email based approch depend on it to generate the patch files that are submitted | 12:47 |
| gibi | agree | 12:48 |
| gibi | I use clearcase and svn before git. git is superior | 12:48 |
| gibi | *used | 12:48 |
| sean-k-mooney | the centralised tools work fine if you can push to master | 12:49 |
| sean-k-mooney | but unless everyone can commit directly they dont scale | 12:49 |
| opendevreview | Merged openstack/nova master: VMware: Support volumes backed by VStorageObject https://review.opendev.org/c/openstack/nova/+/808791 | 12:50 |
| yuval | Hey guys | 12:53 |
| yuval | after elod upload | 12:53 |
| yuval | https://review.opendev.org/c/openstack/nova/+/821606 | 12:53 |
| yuval | I think this is ready | 12:54 |
| gibi | bauzas, sean-k-mooney, chateaulav: I'm satisfied with the series https://review.opendev.org/q/topic:bp%252Fpick-guest-arch-based-on-host-arch-in-libvirt-driver the last patch adding the tempest test seem to work (nova can boot VMs) but still has some failing test cases. I think we can accept the implementation without the gate job as we know chateaulav is working on it | 12:54 |
| gibi | yuval: you are next :) | 12:54 |
| kashyap | gibi: Ah-ha! Reading. Thanks for the thorough response | 12:54 |
| yuval | gibi: thanks | 12:54 |
| chateaulav | gibi: thanks for the reviews and help! | 12:55 |
| gibi | chateaulav: no problem. thanks for working on this feature | 12:55 |
| opendevreview | Felix Huettner proposed openstack/nova stable/queens: Gracefull recovery when attaching volume fails https://review.opendev.org/c/openstack/nova/+/830602 | 13:04 |
| gibi | yuval: I'm +2 | 13:05 |
| *** amoralej is now known as amoralej|lunch | 13:09 | |
| gibi | sean-k-mooney: I think pedro answered your question here https://review.opendev.org/c/openstack/nova/+/828387 | 13:10 |
| sean-k-mooney | they responded but didnt really adress my concern | 13:26 |
| sean-k-mooney | gibi: we could proceed with this update but i think this has the inverse problem | 13:27 |
| sean-k-mooney | the old doc described live_migration_downtime as the maxium but failed to capture it was best effort | 13:28 |
| sean-k-mooney | the new docs to me at least imples that live_migration_downtime is the minium downtime and it can be larger | 13:28 |
| sean-k-mooney | to me live_migration_downtime is the maxium downtime we have asked libvirt to not exceed but its best effort | 13:29 |
| sean-k-mooney | so it shoudl be less then that but in some case may be larger | 13:30 |
| gibi | I see | 13:30 |
| gibi | you are right | 13:31 |
| sean-k-mooney | gibi: so i doen know if we want to merge the update as is or rephrase | 13:49 |
| kashyap | gibi: Very clear analysis in the bug; nice work! To tie up the loose end, they're temporarily going to skip it - https://review.opendev.org/c/openstack/openstack-tempest-skiplist/+/828243 | 13:49 |
| *** whoami-rajat__ is now known as whoami-rajat | 13:59 | |
| opendevreview | Merged openstack/nova master: VmWare: Remove unused legacy_nodename regex https://review.opendev.org/c/openstack/nova/+/806336 | 14:00 |
| *** amoralej|lunch is now known as amoralej | 14:02 | |
| opendevreview | Rajat Dhasmana proposed openstack/nova master: Add support for volume backed server rebuild https://review.opendev.org/c/openstack/nova/+/820368 | 14:04 |
| pmonteir | pedro ans | 14:12 |
| pmonteir | ops, sry | 14:13 |
| opendevreview | Pedro Monteiro Azevedo de Moura Almeida proposed openstack/nova master: Update live_migration_downtime definition https://review.opendev.org/c/openstack/nova/+/828387 | 14:27 |
| pmonteir | sean-k-mooney: hey, saw u and gibi were talking about the change above today and I agree with the comment u left there, I didn't understand what u meant in the first comment, but got it now! If u can take a look when u have some time, pls do :D | 14:33 |
| gibi | pmonteir: sure, I will check | 14:35 |
| pmonteir | thank you! :) | 14:51 |
| sean-k-mooney | pmonteir: thanks im fine with the new wording so +2 | 14:55 |
| gibi | pmonteir: then it is approved :) | 15:01 |
| mfo | hey folks! i'm looking for patch reviewers/feedback for bug 1960758, if you have a chance :) thanks in advance! | 15:04 |
| mfo | https://bugs.launchpad.net/nova/+bug/1960758 | 15:04 |
| mfo | (UEFI libvirt servers can't boot on Ubuntu 20.04 hypervisors with Ussuri/Victoria) | 15:04 |
| pmonteir | thanks for the answering so quickly, guys! :) | 15:08 |
| opendevreview | Felix Huettner proposed openstack/nova stable/queens: Gracefull recovery when attaching volume fails https://review.opendev.org/c/openstack/nova/+/829861 | 15:09 |
| dansmith | bauzas: do you have opinions on my comment about splitting this up? https://review.opendev.org/c/openstack/nova/+/820368/8 | 15:10 |
| dansmith | bauzas: it's huge right now, in terms of what all it touches | 15:10 |
| bauzas | dansmith: looking | 15:11 |
| dansmith | I can help him split it if you think it's important, but if I'm the only one I'll shut up | 15:11 |
| bauzas | dansmith: nah, I agree with you | 15:12 |
| sean-k-mooney | mfo:i think we alredy fixed this | 15:12 |
| bauzas | adding a microversion plus a new event by the same change is large | 15:12 |
| dansmith | bauzas: okay, can you slap a quick comment on there? I'll work with him to split after the next rev | 15:12 |
| dansmith | bauzas: I assume this is still on the slate for merging yeah? | 15:13 |
| bauzas | dansmith: doing it nbow | 15:13 |
| dansmith | bauzas: <3 | 15:13 |
| sean-k-mooney | mfo: teh secvure boot firemware shoudl not require secure boot to function it just supports it | 15:13 |
| sean-k-mooney | mfo: so nova should not need to have any logic to select the non secure boot version | 15:13 |
| sean-k-mooney | mfo: i aslo done se any fix againt master | 15:14 |
| bauzas | dansmith: done | 15:14 |
| dansmith | thanks | 15:14 |
| bauzas | I explained why it's important to split | 15:15 |
| sean-k-mooney | you seam to have started with a sable only patch https://review.opendev.org/c/openstack/nova/+/828980 | 15:15 |
| sean-k-mooney | which i dont think is correct | 15:15 |
| mfo | sean-k-mooney, thanks for looking. i'll follow up on the sec boot firmware (no) needs that you mentioned. and this is "fixed" on wallaby and later/master w/ the implementation of secboot spec/support, due a refactor (this a bit buried in the commit msg, but the research has been done to go w/ stable-only. :) | 15:18 |
| mfo | and, seconding pmonteir above, thx for answering so quickly! | 15:19 |
| sean-k-mooney | mfo: the secure booth ovmf image shoudl work without secure boot enabled howevdr | 15:19 |
| sean-k-mooney | we should not need to filter like this form my understandig | 15:19 |
| sean-k-mooney | do you know why this is requried | 15:20 |
| mfo | ack, i'll be following up on that. | 15:20 |
| sean-k-mooney | if we can get a statement as to why this is requried we could proably proceed with the minimal stabel only backport | 15:20 |
| sean-k-mooney | but that obviouly has risk too | 15:21 |
| sean-k-mooney | i agree that backportign the secure boot feature is likely not viable | 15:21 |
| mfo | er, it was my assumption that it didn't work bcz of secboot ovmf image requirements; but per your statement, it might as well be something w/ ubuntu's qemu or ovmf pkgs. which i'll go check/debug further on why secboot.fd isn't booting. | 15:22 |
| sean-k-mooney | but we woudl at least need som unit tests to vover this change | 15:22 |
| mfo | sean-k-mooney, understood. you mean something like just booting VMs in bios and uefi mode, or something more specific like checking the rendered libvirt xml and check for the ovmf image used too? | 15:24 |
| sean-k-mooney | so to test https://review.opendev.org/c/openstack/nova/+/828979/2/nova/virt/libvirt/driver.py#5834 | 15:25 |
| sean-k-mooney | we should ensure in a unit test that we include a ovm path that has .secboot.fd | 15:25 |
| sean-k-mooney | as the first option | 15:25 |
| sean-k-mooney | and that the non secboot.fd path is chosen | 15:25 |
| sean-k-mooney | we should also check what appens if all the path have secboot.fd | 15:25 |
| sean-k-mooney | also i wonder if all distos use the same nameing convention | 15:26 |
| mfo | got it. | 15:27 |
| chateaulav | so i have additional package installs defined in the stack.sh for my proposed CI to ensure devstack has the supported requirements. is that the correct place or is there a better method due to how it builds. these only need installed on the compute | 15:27 |
| opendevreview | Rajat Dhasmana proposed openstack/python-novaclient master: Add parameter to rebuild boot volume https://review.opendev.org/c/openstack/python-novaclient/+/827163 | 15:27 |
| mfo | sean-k-mooney, since we're testing against a limited option set (the hardcoded paths array), there's only that nameing convention to check (if i got your point right :) | 15:29 |
| bauzas | wow, time flies and I'm on the policy changes | 15:29 |
| bauzas | ... | 15:29 |
| sean-k-mooney | mfo: so on centos 9 there is no version aviiable without secureboot form the set | 15:31 |
| sean-k-mooney | '/usr/share/OVMF/OVMF_CODE.secboot.fd' is the only one of the 3 that is present | 15:31 |
| sean-k-mooney | mfo: there is a singel non secureboot capable image at /usr/share/edk2/ovmf/OVMF_CODE.cc.fd | 15:32 |
| sean-k-mooney | but that will not be checked | 15:32 |
| mfo | sean-k-mooney, ok. so, if for some reason that patch is still required, we're better checking if there's another option available before ignoring secboot.fd. | 15:33 |
| sean-k-mooney | yes | 15:33 |
| sean-k-mooney | so redhat will be releaseign osp 17 based on stable wallaby on rhel 9 later this year | 15:33 |
| sean-k-mooney | and the current patch would break uefi i belive in that case | 15:34 |
| sean-k-mooney | however i dont know if we have the same issue where we woudl need to use the '/usr/share/OVMF/OVMF_CODE.fd' image if secure boot is not requested | 15:34 |
| bauzas | gmann: around ? | 15:34 |
| bauzas | or maybe dansmith ? | 15:34 |
| bauzas | context is https://review.opendev.org/c/openstack/nova/+/828670/4/nova/api/openstack/compute/server_groups.py | 15:34 |
| gmann | bauzas: hi | 15:35 |
| bauzas | we'll change the API behaviour | 15:35 |
| bauzas | as you need to be in the right project to getting the server groups | 15:35 |
| bauzas | it's OK for me | 15:35 |
| mfo | hmm, but this isnt an issue in wallaby, right? as it uses a diff method to pick the ovmf files, based on descriptor files from qemu (eg, /usr/share/qemu/firmware/) | 15:35 |
| bauzas | but, | 15:35 |
| mfo | sean-k-mooney, ^ | 15:35 |
| dansmith | bauzas: that's *your* project id | 15:35 |
| bauzas | given it will change the behaviour, do we all agree we don't need a microversion ? | 15:36 |
| dansmith | bauzas: so it should be no different than today | 15:36 |
| bauzas | dansmith: well, | 15:36 |
| sean-k-mooney | mfo: ack ya it might not be an issue there | 15:36 |
| bauzas | previously you were giving none as a value | 15:36 |
| mfo | sean-k-mooney, ok cool. | 15:36 |
| sean-k-mooney | as you said its using a differnt method | 15:36 |
| bauzas | dansmith: tomorrow, you'll get an exception, right? | 15:36 |
| sean-k-mooney | but we need tobe careful not to break other distors is my point | 15:36 |
| sean-k-mooney | mfo: so we might need to sort the options or soemthing instead | 15:37 |
| dansmith | bauzas: this is already limited to admin yeah? | 15:37 |
| mfo | sean-k-mooney, absolutely; thx for your insight on that. | 15:37 |
| bauzas | dansmith: ah i see | 15:37 |
| mfo | sean-k-mooney, i'll go check the secboot ovmf image boot issues, and abandon/update the patches as appropriate. | 15:38 |
| bauzas | dansmith: you'll get all the servergroups for your project id | 15:38 |
| dansmith | bauzas: this is just providing a basically no-op target object so that the check that includes admin and project_id works | 15:38 |
| mfo | sean-k-mooney, thanks again for you help and advice on this. | 15:38 |
| gmann | bauzas: dansmith humm this is "all_projects server group list" which we said to allow all admin from any proejct | 15:38 |
| dansmith | bauzas: wait, are you talking about server groups or all_projects? | 15:38 |
| gmann | bauzas: dansmith if we do not pass project_id then it will fail as PROJECT_ADMIN expect project id | 15:38 |
| bauzas | dansmith: then my only concern is why it's for "all_projects" ? | 15:38 |
| bauzas | dansmith: my question is for https://review.opendev.org/c/openstack/nova/+/828670/4/nova/api/openstack/compute/server_groups.py | 15:39 |
| dansmith | oh, I was looking at the wrong window, not the one from your link sorry | 15:39 |
| bauzas | dansmith: here, we go into all_projects but we restrict to the specific project_id | 15:39 |
| bauzas | I don't see why we need it then | 15:39 |
| gmann | bauzas: it is context_project id so any admin requesting can pass the policy | 15:39 |
| dansmith | bauzas: it's just because the target needs to have the things we're checking | 15:40 |
| gmann | we can see here, legacy admin is allowed https://review.opendev.org/c/openstack/nova/+/828670/4/nova/tests/unit/policies/test_server_groups.py#224 | 15:40 |
| dansmith | it doesn't do any filtering | 15:40 |
| gmann | yeah | 15:40 |
| opendevreview | Alexey Stupnikov proposed openstack/nova master: Add functional tests to reproduce bug #1960412 https://review.opendev.org/c/openstack/nova/+/830010 | 15:40 |
| opendevreview | Alexey Stupnikov proposed openstack/nova master: Run clean up calls when queued live migration is aborted https://review.opendev.org/c/openstack/nova/+/828570 | 15:40 |
| bauzas | gmann: dansmith: this, I understand but why are we targeting the specific project_id ?. | 15:41 |
| bauzas | in the context I mean | 15:41 |
| dansmith | it's *your* project_id, not an instance project_id or a server group project_id | 15:41 |
| dansmith | so it will always match | 15:41 |
| dansmith | because it's in the rule | 15:42 |
| bauzas | dansmith: it's noop, right? | 15:42 |
| gmann | bauzas: that is our default checks as per PROJECT_ADMIN check_str which require project_id to be present | 15:42 |
| dansmith | yes, but since we re-use that rule elsewhere, we need a project_id in there that will match, since we don't care about actual project_id checking for this resource | 15:42 |
| dansmith | it's confusing for sure.. it's one of the reasons I *hate* our policy engine | 15:42 |
| gmann | https://github.com/openstack/nova/blob/master/nova/policies/base.py#L118 | 15:42 |
| dansmith | it's just impossible to look at and understand without study each time | 15:43 |
| bauzas | dansmith: OK, I trust you then | 15:43 |
| gmann | dansmith: at least now it will protect s to dis-allow system admin | 15:43 |
| bauzas | will remove my -1 | 15:43 |
| dansmith | which is also why I think we need to be working towards a future where operators aren't expected to be able to tweak it like they are today | 15:43 |
| gmann | having project_id in check_str is good way to differentiate from system user. once we enable scope as hardcoded then we can remove all these noop checks with context.project_id | 15:44 |
| bauzas | gmann: explain me why we need to touch https://review.opendev.org/c/openstack/nova/+/828670/4/nova/policies/attach_interfaces.py | 15:46 |
| bauzas | and why the role no longer needs admins | 15:46 |
| bauzas | oh, because we want to remove those wrong system-scoped roles | 15:46 |
| gmann | bauzas: yeah, and GET project reader can do and create/delete interface project member | 15:47 |
| bauzas | gmann: but then, if I'm admin of project 10, I can't longer attach interfaces for servers owned by project 2 ? | 15:47 |
| bauzas | or even list them ? | 15:48 |
| bauzas | sorry if those sound silly questions, but I better need to ramp up on the policies things in order to be able to merge this stuff before tomorrow | 15:48 |
| gmann | bauzas: with new policy only yes, that is isolation we are doing. keep project admin restrictive to their project operatrions (except list all project resources if we have in that API) | 15:48 |
| gmann | projectA admin will be restrictive to do projectA things not projectB things. (with all project resource list case) | 15:49 |
| bauzas | gmann: is that a breaking change if we merge this change by now ? | 15:49 |
| bauzas | or can admins use the legacy policies for a while ? | 15:50 |
| gmann | bauzas: we do support legacy policy as deprecated so until we remove them it will keep woprking with old token | 15:50 |
| gmann | bauzas: yes, by default new policy are disabled. scope check as well as new default | 15:50 |
| bauzas | ok | 15:51 |
| bauzas | I better understand :) | 15:51 |
| bauzas | gmann: just tbc, until https://review.opendev.org/c/openstack/nova/+/828670/4/nova/policies/attach_interfaces.py#30 is removed or default changes to new policies, nothing changes ? | 15:51 |
| gmann | bauzas: this is good way to know what all allowed as default with these policy change https://review.opendev.org/c/openstack/nova/+/828670/4/nova/tests/unit/policies/test_attach_interfaces.py#29 | 15:51 |
| opendevreview | Jonathan Race proposed openstack/nova master: driver/secheduler/docs for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/822053 | 15:52 |
| opendevreview | Jonathan Race proposed openstack/nova master: zuul-job for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/828372 | 15:52 |
| bauzas | gmann: heh, the patch is hairy, I'm not yet there | 15:52 |
| bauzas | gosh, we're rushing out of time | 15:52 |
| gmann | bauzas: true, or operator enable it with config option enforce_scope=True, enforce_new_defaults=True | 15:52 |
| bauzas | gmann: ok, perfect and I guess this is correctly documented so I'm not afraid | 15:52 |
| gmann | both config are false (disabled) by default in yoga | 15:53 |
| bauzas | gmann: thanks gmann, continuing to review | 15:53 |
| chateaulav | gibi: added final changes in this last patchset to the driver patch, and the zuul ci should be good this time around (fingers crossed) | 15:53 |
| gibi | chateaulav: ack, I will check it before I leave today | 15:53 |
| chateaulav | ccol | 15:55 |
| bauzas | gibi: fwiw, I'm on the policies series that you +1d, I'm leaving a ton of comments to help you better understandingh | 15:55 |
| gibi | bauzas: thanks that will help if you want to convince me to upgrade my vote | 15:57 |
| gmann | bauzas: gibi thanks for reviews. I need to go away for 20 min (taking breakfast) and then will return if any query while review. | 15:58 |
| *** gmann is now known as gmann_afk | 15:59 | |
| *** gmann_afk is now known as gmann | 16:17 | |
| opendevreview | Stephen Finucane proposed openstack/nova master: libvirt: Ignore LibvirtConfigObject kwargs https://review.opendev.org/c/openstack/nova/+/830644 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: libvirt: Remove unnecessary TODO https://review.opendev.org/c/openstack/nova/+/830645 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: libvirt: Add vIOMMU device to guest https://review.opendev.org/c/openstack/nova/+/830646 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: libvirt: Rename some config objects https://review.opendev.org/c/openstack/nova/+/830647 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: libvirt: Shuffle methods around https://review.opendev.org/c/openstack/nova/+/830648 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: libvirt: Remove handling for older libvirt versions https://review.opendev.org/c/openstack/nova/+/830649 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: libvirt: Return objects from Guest.get_interfaces https://review.opendev.org/c/openstack/nova/+/830650 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: libvirt: Don't fetch guest architecture repeatedly https://review.opendev.org/c/openstack/nova/+/830651 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: libvirt: Prepare for manual PCIe address management https://review.opendev.org/c/openstack/nova/+/830652 | 16:17 |
| opendevreview | Stephen Finucane proposed openstack/nova master: WIP: libvirt: Start managing PCIe address allocation https://review.opendev.org/c/openstack/nova/+/830653 | 16:17 |
| stephenfin | Ignore those. They're nowhere near done. Just pushing so I remember to finish them at some point | 16:18 |
| sean-k-mooney | stephenfin: am... i tought we were not gong to tdo that | 16:19 |
| sean-k-mooney | but ok | 16:19 |
| sean-k-mooney | i mean its been in our downstream backlog for ever | 16:19 |
| opendevreview | Pedro Monteiro Azevedo de Moura Almeida proposed openstack/nova master: Update live_migration_downtime definition https://review.opendev.org/c/openstack/nova/+/828387 | 16:21 |
| opendevreview | Elod Illes proposed openstack/nova stable/wallaby: skip test_tagged_attachment in nova-next https://review.opendev.org/c/openstack/nova/+/830656 | 16:26 |
| bauzas | gmann: once you're back, question in https://review.opendev.org/c/openstack/nova/+/829626/9/nova/api/openstack/compute/views/servers.py#443 | 16:27 |
| gmann | checking | 16:28 |
| bauzas | gibi: other cores : I'm +2 on the whole new-policy-rules series except one patch, reviews welcome | 16:31 |
| bauzas | gmann: can you then please answer my question ? | 16:33 |
| bauzas | I have a hardstop in 30 mins and I want to briefly look at the last unified-limits patch before I go | 16:33 |
| gmann | ok | 16:34 |
| gmann | bauzas: replied, by default if target are not passed in policy it take context'sproject_id itself | 16:39 |
| gmann | and DB query are based on requester project_id so it gets only requesting project instances until all-tenant is requested | 16:39 |
| bauzas | gmann: ok, then I'm confused, why did we need to add the target be explicitely project_id ? | 16:40 |
| gmann | bauzas: same as discussed before. PROJECT_ADMIN|MEMBER|READER has project_id i check_str of rule so we need to pass project_id in target which can pass. it is done to separate out the system user if scope are disabled. otherwise system reader can also pass policy. | 16:41 |
| stephenfin | sean-k-mooney: We're still not necessarily going to do it, but it's come up so often that it seems something we should _eventually_ do | 16:42 |
| gmann | bauzas: once we remove the enforce_scope as configurable (enable it hardcoded) then we can remove those and cleanup | 16:42 |
| stephenfin | Now just to find the time to actually do it, heh | 16:42 |
| gmann | bauzas: passing requester project_id and checking that against requester itself is ally bogus thing we have to do for now. | 16:42 |
| bauzas | ok, it's a bit of a spaghetti code to me but I trust you | 16:43 |
| bauzas | either way, +2d the whole series | 16:43 |
| bauzas | you need to find someone next to jab it | 16:43 |
| gmann | bauzas: this is TODO to cleanup once scope are enabled https://github.com/openstack/nova/blob/134c4791ff8233264b7862db692e058f60ae2f80/nova/policy.py#L180 | 16:43 |
| gmann | bauzas: thanks a lot. | 16:44 |
| bauzas | gmann: ok, I see | 16:44 |
| bauzas | thanks for the explanations | 16:44 |
| gmann | bauzas: and other key bit we need to improve after secure rbac is to remove the admin checks from DB which will make it more cleaner | 16:44 |
| gmann | but those are things to do after we ship secure rbac as default | 16:45 |
| sean-k-mooney | stephenfin: ack | 17:01 |
| bauzas | also +2d the whole unified-limits series, melwitt | 17:03 |
| * bauzas disappears now and will do one last round of review tomorrow | 17:04 | |
| bauzas | don't be afraid folks, if you get +2/+W before Friday, you're all good | 17:04 |
| * bauzas disappears by now | 17:04 | |
| melwitt | thank you bauzas! | 17:08 |
| gibi | bauzas: ack, I will look first thing in the morning tomorrow | 17:32 |
| whoami-rajat | dansmith, bauzas hey, just to clear my understanding regarding your comments on change https://review.opendev.org/c/openstack/nova/+/820368 | 18:07 |
| whoami-rajat | the ask is to divide the patch into two parts, one adding new event (requires MV bump) and other adding rebuild support (requires yet another MV bump) | 18:07 |
| whoami-rajat | so the two patches will be 2.91 and 2.92 | 18:07 |
| *** amoralej is now known as amoralej|off | 18:07 | |
| dansmith | no, | 18:07 |
| dansmith | the event doesn't need a version bump, just your api change | 18:08 |
| dansmith | event first, then api change | 18:08 |
| dansmith | I would put the cinder volume change and test in a separate early patch too and we can sink that quickly, IMHO | 18:08 |
| whoami-rajat | hmm, I'm still slightly confused, the addition of a new event has required an MV bump, so you're saying don't do the bump at all or use 2.91 for it as well ? https://review.opendev.org/c/openstack/nova/+/820368/8/nova/api/openstack/compute/schemas/server_external_events.py | 18:10 |
| dansmith | uh | 18:11 |
| dansmith | okay I didn't realize we started adding microversions for new event names | 18:12 |
| dansmith | pretty sure that didn't happen in the earlier days (was never my intent) but clearly has been happening since v51 or so | 18:13 |
| dansmith | so yeah maybe not worth splitting in that case, I guess | 18:13 |
| dansmith | I'd update with the other comments and then we can see what bauzas thinks | 18:13 |
| dansmith | it's just such a large cut of things all over the API | 18:13 |
| whoami-rajat | I can understand it's a burden to review it but having no prior experience working in nova, I also don't have much ideas to do it in a better way | 18:15 |
| whoami-rajat | I will update with the given tests (and continue work on the tempest test) until then | 18:15 |
| whoami-rajat | s/tests/comments | 18:16 |
| dansmith | yep, sounds good | 18:16 |
| whoami-rajat | cool, thanks! | 18:16 |
| whoami-rajat | dansmith, i think we also have novaclient release this week right? | 18:17 |
| dansmith | I dunno, but seems likely | 18:17 |
| whoami-rajat | So i also have a novaclient patch modifying the rebuild command https://review.opendev.org/c/openstack/python-novaclient/+/827163 | 18:18 |
| whoami-rajat | it's currently failing on docs since it can't find MV 2.91 in docs (will be available after API patch merges) | 18:18 |
| opendevreview | Jonathan Race proposed openstack/nova master: driver/secheduler/docs for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/822053 | 18:19 |
| opendevreview | Jonathan Race proposed openstack/nova master: zuul-job for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/828372 | 18:19 |
| dansmith | whoami-rajat: okay I would have thought depends-on would take care of that, but yeah if it's just the doc failure that's easy to overlook | 18:19 |
| whoami-rajat | I had the same thought and I'm not sure how this has worked in the past since every client change (having MV bump) requires API change to merge first | 18:20 |
| dansmith | yeah | 18:22 |
| opendevreview | Jonathan Race proposed openstack/nova master: zuul-job for Adds Pick guest CPU architecture based on host arch in libvirt driver support https://review.opendev.org/c/openstack/nova/+/828372 | 18:22 |
| chateaulav | have a good day everyone, I have the emulation ci running now to see if it corrects the IDE error, and will have that finished tomorrow | 18:25 |
| opendevreview | Merged openstack/nova master: Update live_migration_downtime definition https://review.opendev.org/c/openstack/nova/+/828387 | 20:12 |
| opendevreview | Rajat Dhasmana proposed openstack/nova master: Add support for volume backed server rebuild https://review.opendev.org/c/openstack/nova/+/820368 | 20:38 |
| opendevreview | sean mooney proposed openstack/nova master: add healthcheck endpoint to proxy commands https://review.opendev.org/c/openstack/nova/+/830703 | 23:42 |
| sean-k-mooney[m] | depends-on does not work for tox but it can work for devstack based test if the project is listed in the jobs required_projects | 23:45 |
| sean-k-mooney[m] | so yes if you are working on a client change the api change need to merge first if you are dont test that alls the api or otherwise depend on the microversion unless you have mocked the nova api | 23:47 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!
