| *** nicolasbock has quit IRC | 00:01 | |
| *** frank_wang has quit IRC | 00:08 | |
| *** frankwang has joined #openstack-nova | 00:11 | |
| *** markvoelker has quit IRC | 00:24 | |
| *** takashin has joined #openstack-nova | 00:25 | |
| *** _erlon_ has quit IRC | 00:29 | |
| *** mriedem has quit IRC | 00:44 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Hide hypervisor id on windows guests https://review.opendev.org/579897 | 00:51 |
|---|---|---|
| *** ttsiouts has joined #openstack-nova | 01:00 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/662894 | 01:01 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/rocky: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/662895 | 01:03 |
| *** brinzhang has joined #openstack-nova | 01:05 | |
| *** ttsiouts has quit IRC | 01:06 | |
| *** gyee has quit IRC | 01:19 | |
| openstackgerrit | Brin Zhang proposed openstack/nova master: Replace the invalid index of nova-rocky releasenote https://review.opendev.org/662897 | 01:32 |
| *** brinzhang has quit IRC | 01:39 | |
| *** brinzhang has joined #openstack-nova | 01:39 | |
| *** _hemna has joined #openstack-nova | 01:53 | |
| *** Sundar has quit IRC | 02:08 | |
| openstackgerrit | zhaixiaojun proposed openstack/python-novaclient master: Bump openstackdocstheme to 1.30.0 https://review.opendev.org/662905 | 02:10 |
| *** hongbin has joined #openstack-nova | 02:17 | |
| *** _hemna has quit IRC | 02:17 | |
| *** BjoernT has joined #openstack-nova | 02:25 | |
| *** BjoernT_ has joined #openstack-nova | 02:29 | |
| *** BjoernT has quit IRC | 02:31 | |
| *** minmin has joined #openstack-nova | 02:50 | |
| *** _hemna has joined #openstack-nova | 02:52 | |
| openstackgerrit | zhaixiaojun proposed openstack/python-novaclient master: Blacklist python-cinderclient 4.0.0 https://review.opendev.org/662912 | 02:53 |
| *** whoami-rajat has joined #openstack-nova | 03:14 | |
| *** _hemna has quit IRC | 03:25 | |
| *** Kimmo_ has joined #openstack-nova | 03:35 | |
| *** igordc has quit IRC | 03:39 | |
| openstackgerrit | Artom Lifshitz proposed openstack/nova master: DNM: Run tempest-full-py3 with q35 machine type https://review.opendev.org/662887 | 03:45 |
| *** guozijn has joined #openstack-nova | 03:52 | |
| *** frankwang has quit IRC | 04:02 | |
| *** igordc has joined #openstack-nova | 04:06 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP:Introduce scope_types in os-services https://review.opendev.org/645427 | 04:08 |
| *** hongbin has quit IRC | 04:17 | |
| *** udesale has joined #openstack-nova | 04:25 | |
| *** ivve has quit IRC | 04:36 | |
| *** damien_r has joined #openstack-nova | 04:45 | |
| *** damien_r has quit IRC | 04:46 | |
| *** damien_r has joined #openstack-nova | 04:46 | |
| *** guozijn has quit IRC | 04:51 | |
| *** BjoernT_ has quit IRC | 05:00 | |
| *** lbragstad has quit IRC | 05:09 | |
| *** Sundar has joined #openstack-nova | 05:11 | |
| *** pcaruana has joined #openstack-nova | 05:12 | |
| *** _hemna has joined #openstack-nova | 05:22 | |
| *** pcaruana has quit IRC | 05:23 | |
| *** pcaruana has joined #openstack-nova | 05:28 | |
| *** ccamacho has quit IRC | 05:28 | |
| *** frankwang has joined #openstack-nova | 05:39 | |
| *** ivve has joined #openstack-nova | 05:42 | |
| *** belmoreira has joined #openstack-nova | 05:49 | |
| *** igordc has quit IRC | 05:51 | |
| openstackgerrit | Merged openstack/nova master: Follow up for counting quota usage from placement https://review.opendev.org/662056 | 05:54 |
| *** _hemna has quit IRC | 05:55 | |
| *** guozijn has joined #openstack-nova | 06:03 | |
| *** Sundar has quit IRC | 06:06 | |
| *** damien_r has quit IRC | 06:07 | |
| *** lpetrut has joined #openstack-nova | 06:10 | |
| *** bbowen has joined #openstack-nova | 06:12 | |
| *** slaweq has joined #openstack-nova | 06:13 | |
| *** dpawlik has joined #openstack-nova | 06:13 | |
| *** bbowen_ has quit IRC | 06:14 | |
| *** dtantsur|afk is now known as dtantsur | 06:16 | |
| *** wwriverrat has joined #openstack-nova | 06:17 | |
| *** _hemna has joined #openstack-nova | 06:25 | |
| openstackgerrit | Merged openstack/nova stable/stein: xenapi/agent: Change openssl error handling https://review.opendev.org/656304 | 06:36 |
| *** evrardjp_ is now known as evrardjp | 06:43 | |
| *** belmoreira has quit IRC | 06:43 | |
| *** damien_r has joined #openstack-nova | 06:44 | |
| *** damien_r has quit IRC | 06:44 | |
| *** brinzhang has quit IRC | 06:49 | |
| *** brinzhang has joined #openstack-nova | 06:49 | |
| *** maciejjozefczyk has joined #openstack-nova | 06:53 | |
| *** _hemna has quit IRC | 06:58 | |
| *** ccamacho has joined #openstack-nova | 07:04 | |
| *** ccamacho has quit IRC | 07:04 | |
| *** ccamacho has joined #openstack-nova | 07:04 | |
| *** damien_r has joined #openstack-nova | 07:08 | |
| *** luksky has joined #openstack-nova | 07:08 | |
| *** ttsiouts has joined #openstack-nova | 07:09 | |
| *** _hemna has joined #openstack-nova | 07:11 | |
| *** rpittau|afk is now known as rpittau | 07:15 | |
| *** _hemna has quit IRC | 07:16 | |
| *** slaweq has quit IRC | 07:16 | |
| *** tkajinam has quit IRC | 07:24 | |
| *** tkajinam has joined #openstack-nova | 07:24 | |
| *** zbr has joined #openstack-nova | 07:31 | |
| *** markvoelker has joined #openstack-nova | 07:32 | |
| *** ttsiouts has quit IRC | 07:34 | |
| *** ttsiouts has joined #openstack-nova | 07:35 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: Add new default roles and mapping in policy base class https://review.opendev.org/645452 | 07:35 |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP:Introduce scope_types in os-services https://review.opendev.org/645427 | 07:39 |
| openstackgerrit | Boxiang Zhu proposed openstack/nova master: Validate requested host/node during servers create https://review.opendev.org/661237 | 07:39 |
| *** helenafm has joined #openstack-nova | 07:39 | |
| *** ttsiouts has quit IRC | 07:39 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP: Add new default roles in os-services API policies https://review.opendev.org/648480 | 07:40 |
| *** slaweq has joined #openstack-nova | 07:40 | |
| *** threestrands has joined #openstack-nova | 07:44 | |
| *** tianhui has joined #openstack-nova | 07:45 | |
| *** xek has joined #openstack-nova | 07:52 | |
| *** tianhui has quit IRC | 07:55 | |
| *** boxiang has joined #openstack-nova | 07:56 | |
| *** minmin has quit IRC | 07:56 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP: Add new default roles in os-services API policies https://review.opendev.org/648480 | 07:57 |
| kashyap | efried: Indeed, it was not me (on "live resize"). But I've followed it on-and-off | 07:58 |
| *** ttsiouts has joined #openstack-nova | 08:02 | |
| *** markvoelker has quit IRC | 08:05 | |
| openstackgerrit | Balazs Gibizer proposed openstack/nova stable/stein: Reset the stored logs at each notification test steps https://review.opendev.org/662965 | 08:06 |
| *** tetsuro has joined #openstack-nova | 08:07 | |
| *** brinzhang has quit IRC | 08:07 | |
| *** brinzhang has joined #openstack-nova | 08:07 | |
| *** frankwang has quit IRC | 08:12 | |
| *** frankwang has joined #openstack-nova | 08:12 | |
| *** boxiang has quit IRC | 08:14 | |
| *** boxiang has joined #openstack-nova | 08:14 | |
| *** factor has joined #openstack-nova | 08:18 | |
| *** jaosorior has joined #openstack-nova | 08:21 | |
| *** maciejjozefczyk has quit IRC | 08:21 | |
| *** maciejjozefczyk has joined #openstack-nova | 08:22 | |
| *** priteau has joined #openstack-nova | 08:23 | |
| *** tkajinam has quit IRC | 08:24 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP:Introduce scope_types in servers API https://review.opendev.org/662968 | 08:24 |
| johnthetubaguy | gmann: I couldn't get my unit test to do what I expected with this: https://review.opendev.org/#/c/657823/2 | 08:29 |
| johnthetubaguy | I am probably doing something dumb | 08:29 |
| *** maciejjozefczyk_ has joined #openstack-nova | 08:30 | |
| *** takashin has left #openstack-nova | 08:30 | |
| gmann | johnthetubaguy: ok, i am updating the spec now with more mapping data. I will check your unit test thing after tnat | 08:31 |
| johnthetubaguy | gmann: sweet, lets refresh the spec first for sure | 08:32 |
| johnthetubaguy | this is implementation detail | 08:32 |
| *** maciejjozefczyk has quit IRC | 08:33 | |
| kashyap | johnthetubaguy: In your copious free time, mind having a look at the Secure Boot spec, please? -- https://review.openstack.org/#/c/506720/ | 08:33 |
| johnthetubaguy | its spec review day, so totally will take a look at that | 08:34 |
| kashyap | Before I respin to rephrase some text, just want to check if there's anything else anyone has. Near as I see, I've addressed all the feedback | 08:34 |
| kashyap | johnthetubaguy: Most excellent | 08:34 |
| johnthetubaguy | that and I have customers who will want this | 08:34 |
| kashyap | johnthetubaguy: Cool! | 08:36 |
| *** guozijn has quit IRC | 08:37 | |
| kashyap | johnthetubaguy: A good chunk of stuff is in Work Items | 08:37 |
| kashyap | johnthetubaguy: The thid point, that shows the use 'UefiShell.iso' is info-only; no need for us to run any of that. | 08:38 |
| kashyap | Because, all distributions that matter, ship OVMF "variables" (or "vars") files that have default UEFI keys enrolled. | 08:38 |
| kashyap | Anyway, it's a detail. We'll get to it when you're reviewing. | 08:38 |
| *** janki has joined #openstack-nova | 08:39 | |
| *** maciejjozefczyk has joined #openstack-nova | 08:39 | |
| *** maciejjozefczyk has quit IRC | 08:39 | |
| * kashyap is here to answer any questions | 08:39 | |
| *** tssurya has joined #openstack-nova | 08:40 | |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova master: WIP: Add new default roles in servers API policies https://review.opendev.org/662971 | 08:40 |
| *** guozijn has joined #openstack-nova | 08:41 | |
| openstackgerrit | Balazs Gibizer proposed openstack/nova master: Change the default of notification_format to unversioned https://review.opendev.org/603079 | 08:42 |
| *** derekh has joined #openstack-nova | 08:44 | |
| *** maciejjozefczyk_ is now known as maciejjozefczyk | 08:44 | |
| *** spsurya has joined #openstack-nova | 08:51 | |
| *** tesseract has joined #openstack-nova | 08:56 | |
| johnthetubaguy | kashyap: I see what you mean about the work items thing... its normally like three lines | 08:57 |
| kashyap | :D | 08:57 |
| kashyap | johnthetubaguy: I wanted to remove some of the background stuff, to reduce text. As most of the stuff is automated for us by libvirt's new interface | 08:57 |
| kashyap | And I've working with distributions to ensure they're shipping the variables files | 08:57 |
| *** mvkr has joined #openstack-nova | 08:59 | |
| *** ttsiouts has quit IRC | 09:01 | |
| *** ttsiouts has joined #openstack-nova | 09:02 | |
| johnthetubaguy | kashyap: yeah, I think you could, finding it interesting, but don't feel qualified to review it | 09:05 |
| kashyap | johnthetubaguy: Okido; I'll leave it as is. I made sure to write clear sentences that add some value :D | 09:05 |
| *** factor has quit IRC | 09:06 | |
| *** factor has joined #openstack-nova | 09:06 | |
| *** ttsiouts has quit IRC | 09:06 | |
| *** rcernin has quit IRC | 09:07 | |
| johnthetubaguy | kashyap: I am putting some comments on the bits I would trim, like that list of distro details, I think just two distros to illustrate the complexity would do | 09:07 |
| *** factor has quit IRC | 09:07 | |
| kashyap | johnthetubaguy: Sure. Comment away | 09:07 |
| kashyap | johnthetubaguy: Aside: If you want to try a SecureBoot-enabled guest, here's an automated script I wrote for it: https://kashyapc.fedorapeople.org/Create-a-SecureBoot-enabled-VM.bash | 09:07 |
| *** factor has joined #openstack-nova | 09:07 | |
| johnthetubaguy | the ovmf loader paths in the xml... I thought libvirt did all that for us/ | 09:08 |
| *** factor has quit IRC | 09:08 | |
| kashyap | johnthetubaguy: Are you referring to point-2 in the Work Items section? | 09:08 |
| kashyap | johnthetubaguy: Yes, the new libvirt does handle that for us. | 09:09 |
| *** factor has joined #openstack-nova | 09:09 | |
| johnthetubaguy | yeah, that is the bit | 09:09 |
| kashyap | I have a TODO to trim that second point to reflect that. | 09:09 |
| *** factor has quit IRC | 09:10 | |
| *** factor has joined #openstack-nova | 09:10 | |
| *** factor has quit IRC | 09:11 | |
| *** factor has joined #openstack-nova | 09:12 | |
| *** _hemna has joined #openstack-nova | 09:12 | |
| *** threestrands has quit IRC | 09:14 | |
| *** factor has quit IRC | 09:15 | |
| *** rpittau is now known as rpittau|reboot | 09:17 | |
| johnthetubaguy | kashyap: so this sounds harsh... but I think you need to turn your spec upside down, given the new libvirt version, and I guess that is what you are thinking too | 09:19 |
| kashyap | johnthetubaguy: Sorry, what do you mean upside down? | 09:19 |
| kashyap | johnthetubaguy: You mean, push the content from Work Items a bit above? | 09:19 |
| kashyap | Noting clearly that the new libvirt (and QEMU, OVMF / EDK2) version handles most of the work for us? | 09:20 |
| kashyap | (All harsh feedback is welcome :-) After spending so much time on my text, I need other eyes to help edit it.) | 09:20 |
| kashyap | s/other/others'/ | 09:20 |
| *** rpittau|reboot is now known as rpittau | 09:21 | |
| johnthetubaguy | kashyap: trying to work out how to describe what I am thinking :) | 09:21 |
| kashyap | johnthetubaguy: Sure. Whatever brings clarity. | 09:22 |
| johnthetubaguy | so overall I think we are largely there, libvirt does all the work, it clearly is something useful | 09:22 |
| kashyap | "No mind is ever willingly deprived of the truth" — Plato | 09:22 |
| kashyap | johnthetubaguy: Yeah, indeed. | 09:22 |
| johnthetubaguy | so I think this spec was needed before libvirt did all the hard work | 09:23 |
| johnthetubaguy | and we still need a bunch of the detail for sure | 09:23 |
| johnthetubaguy | just wondering first about what is missing | 09:23 |
| johnthetubaguy | ... so the last two work items | 09:23 |
| johnthetubaguy | actually, that is back to front, maybe I just say what I think I was expecting... which doesn't make it the right or only way, its just a data point | 09:24 |
| *** sapd1_x has joined #openstack-nova | 09:24 | |
| kashyap | Yeah, noted. | 09:25 |
| kashyap | Also, it's not just the last two points, surely? | 09:25 |
| kashyap | Also the point on making Nova use the firmware auto-selection feature? | 09:25 |
| kashyap | <os firmware='efi'> | 09:25 |
| kashyap | <loader secure='yes'/> | 09:25 |
| kashyap | </os> | 09:25 |
| johnthetubaguy | yeah, totally | 09:25 |
| johnthetubaguy | lets go through each bit of the spec quickly, I think its close | 09:26 |
| kashyap | Certainly. | 09:26 |
| johnthetubaguy | so problem and use cases, I think you could simplify it a little bit, line 51-52 and line 42-44 are good | 09:26 |
| kashyap | Right, I'll reword the "or other kernel code ..." thing, if you prefer. | 09:27 |
| johnthetubaguy | well, I mean those lines are vital... i.e. you need this for guests to protect against certain kinds of maleware, and by the way we already added this for hyper-v | 09:28 |
| kashyap | (It's just saying: either guest side malware or malware from kernel modules) | 09:28 |
| johnthetubaguy | the hypervisor kernel modules? | 09:28 |
| kashyap | johnthetubaguy: Added what? (The SecureBoot feature? Sure) | 09:28 |
| kashyap | Yes | 09:28 |
| johnthetubaguy | hmm, OK, I guess it does... :/ not sure | 09:28 |
| johnthetubaguy | anyways, the guest malware seems the key thing for the user | 09:29 |
| * kashyap is taking summary notes based on this chat, so at the end I can work through that list. | 09:29 | |
| johnthetubaguy | sweet | 09:29 |
| johnthetubaguy | the proposed change thing: (1) copy hyper-v interface, (2) libvirt does all the work when we add the above XML, (3) scheduling to make sure we get on a capable host | 09:30 |
| johnthetubaguy | is there anything else from the "changes to nova" sense? | 09:30 |
| kashyap | johnthetubaguy: For the (2) part, we need to expand that: introduce libvirt config classes, etc? | 09:31 |
| kashyap | johnthetubaguy: No, from the list of three, I don't think there's any further, from "changes to Nova" sense. | 09:32 |
| johnthetubaguy | I would do the reverse, this is the magic we put in the XML... PS this is what that really means | 09:32 |
| johnthetubaguy | from the scheduling, I think in the comments it noted that the libvirt driver would add a secure_boot capability style trait if its capable | 09:33 |
| kashyap | Right, noted. | 09:33 |
| johnthetubaguy | I guess we need to ask libvirt if we can do that, once libvirt is the correct version? | 09:33 |
| kashyap | Yes, we need to query via `capabilities` | 09:34 |
| kashyap | To look if it supports the "secure" flag for 'efi' | 09:34 |
| johnthetubaguy | cool | 09:34 |
| johnthetubaguy | so its "a little bit" like this: https://github.com/openstack/nova/blob/2ea6e6f8db9fc6cecf389cacdd0d82d8226b99fb/nova/virt/libvirt/driver.py#L334 | 09:34 |
| kashyap | s/capabilities/getDomainCapabilities/ | 09:35 |
| johnthetubaguy | in that its a conditional capability | 09:35 |
| kashyap | johnthetubaguy: (Aside: While implementing, I could use some help on the scheduling bits, it's my weak area.) | 09:36 |
| * kashyap clicks the URL | 09:36 | |
| johnthetubaguy | so I fear the spec needs to cover the rough details of what is going to happen there | 09:36 |
| johnthetubaguy | https://github.com/openstack/nova/blob/2ea6e6f8db9fc6cecf389cacdd0d82d8226b99fb/nova/virt/libvirt/driver.py#L4959 | 09:36 |
| johnthetubaguy | I guess its an extension of that | 09:36 |
| kashyap | johnthetubaguy: Yeah, indeed: Need to write: _has_uefi_secure_boot_support() | 09:37 |
| johnthetubaguy | how to we schedule for uefi today... I don't rightly remember | 09:37 |
| kashyap | We don't do any scheduling decisions for UEFI, IIRC | 09:37 |
| *** panda is now known as panda|ruck | 09:38 | |
| kashyap | johnthetubaguy: Do you see anything contrary to what I say in the code? | 09:40 |
| *** tesseract has quit IRC | 09:40 | |
| johnthetubaguy | kashyap: not so far... just re-reading the hyper-v spec | 09:41 |
| *** jaosorior has quit IRC | 09:41 | |
| johnthetubaguy | do we not need os_secure_boot_signature? | 09:42 |
| johnthetubaguy | ref: https://specs.openstack.org/openstack/nova-specs/specs/ocata/implemented/hyper-v-uefi-secureboot.html | 09:42 |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova-specs master: Policy Default Refresh spec https://review.opendev.org/547850 | 09:42 |
| kashyap | johnthetubaguy: I _think_ for the first iteration, it should be optional. | 09:44 |
| kashyap | `os_secure_boot_signature` allows specifying bootloader's signature | 09:45 |
| kashyap | I need to play a bit more to see how strongly we need it | 09:45 |
| kashyap | johnthetubaguy: Because, the OVMF maintainer says: if you don't trust the default UEFI keys, then it is almost the same as you're not trusting the filesystem where your Compute node is running | 09:45 |
| johnthetubaguy | so you know... I think this was before the distros shipped trusted default keys | 09:46 |
| kashyap | Yeah, very true. | 09:46 |
| johnthetubaguy | lets just add in the spec that we only support using the default keys in the first implementation? | 09:46 |
| *** _hemna has quit IRC | 09:46 | |
| kashyap | johnthetubaguy: Yes, very much worth it to spell it out | 09:46 |
| *** owalsh_ has joined #openstack-nova | 09:48 | |
| *** owalsh has quit IRC | 09:49 | |
| *** phasespace has joined #openstack-nova | 09:51 | |
| *** mugsie_ is now known as mugsie | 09:52 | |
| johnthetubaguy | kashyap: so I just added an extra note to give a summary of what I was thinking for the proposed changes section | 09:54 |
| johnthetubaguy | I am tempted to say this first version follows UEFI and simple errors out if not supported? | 09:54 |
| *** ociuhandu has joined #openstack-nova | 09:54 | |
| johnthetubaguy | then in the alternatives but that in the future a request spec filter can be added similar to the existing image type filter | 09:55 |
| johnthetubaguy | kashyap, the release note for hyper-v is quite nice: https://github.com/openstack/nova/blob/c6218428e9b29a2c52808ec7d27b4b21aadc0299/releasenotes/notes/hyperv-uefi-secure-boot-a2a617ac2c313afd.yaml | 09:56 |
| kashyap | johnthetubaguy: Looking... | 09:56 |
| kashyap | johnthetubaguy: Meanwhile, just typed this up: http://kashyapc.fedorapeople.org/Feedback-to-address-SecureBoot-spec.txt | 09:57 |
| kashyap | johnthetubaguy: Yes, we should error-out simply if there's no support | 09:57 |
| kashyap | johnthetubaguy: Can you explain a bit more on the request spec filter alternative? | 09:57 |
| johnthetubaguy | yeah | 09:58 |
| kashyap | johnthetubaguy: Yes, we'll write an equally good release note :-) | 09:58 |
| johnthetubaguy | so the code for the image one is here: https://github.com/openstack/nova/blob/0c9c422c878719bae5b97fd07cafe7cd933bf103/nova/scheduler/request_filter.py#L124 | 09:58 |
| johnthetubaguy | for secure boot, I think we look at the flavor and image to work out if secure_boot is required, and if it is we would request the trait the driver capabilties could advertise like SECURE_BOOT_CAPABLE or something like that | 10:00 |
| *** claudiub has joined #openstack-nova | 10:00 | |
| * kashyap clicks | 10:00 | |
| kashyap | Ah-ha, noted. | 10:01 |
| kashyap | johnthetubaguy: Thanks for the explanation. | 10:01 |
| johnthetubaguy | no worries | 10:01 |
| johnthetubaguy | so I attempted a summary comment here: https://review.opendev.org/#/c/506720/11/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.rst@82 | 10:01 |
| kashyap | johnthetubaguy: Excellent, reading it already | 10:02 |
| *** guozijn has quit IRC | 10:02 | |
| *** markvoelker has joined #openstack-nova | 10:02 | |
| kashyap | johnthetubaguy: Can you also compare my notes here, the 2nd point: http://kashyapc.fedorapeople.org/Feedback-to-address-SecureBoot-spec.txt | 10:03 |
| kashyap | This week, I'm going to address that, plus other items you noted in the review. | 10:03 |
| kashyap | Will make it ready by end of this week, to keep the momentum, and not let it languish | 10:03 |
| kashyap | Not least because ... "One who delays his work is always wrestling with ruin." | 10:04 |
| johnthetubaguy | I may have changed my mind on some of the things in your notes... | 10:05 |
| johnthetubaguy | problem description is good | 10:05 |
| johnthetubaguy | use cases, I would just focus on the first one | 10:05 |
| kashyap | Okay, will adjust | 10:05 |
| johnthetubaguy | ... I am tempted to focus only on the guest level protection | 10:05 |
| johnthetubaguy | then reference the other white paper for more details | 10:06 |
| *** luksky has quit IRC | 10:06 | |
| johnthetubaguy | that way its not our job to review it / keep it correct :) | 10:06 |
| kashyap | Yes, indeed | 10:06 |
| johnthetubaguy | that hypervisor kernel protection... surely a bad hypervisor could spoof things to the guest, claiming its really a good little hypervisor? | 10:07 |
| johnthetubaguy | i.e. that is what folks want attestation and secure boot of the hypervisor... which is a different thing, and in some ways, an ironic level feature | 10:07 |
| kashyap | johnthetubaguy: Hm, I'm not really sure, afraid. Can ask Laszlo (OVMF maintainer) to comment | 10:07 |
| johnthetubaguy | so I think we should only claim the guest protection at this point | 10:08 |
| kashyap | johnthetubaguy: BTW, we're only talking here about *guest*-level protection, indeed -- not baremetal, that's out of scope, as we know :-) | 10:08 |
| johnthetubaguy | fairly sure you need hypervisor secure boot for the other thing, along with active atestation | 10:08 |
| johnthetubaguy | cool | 10:08 |
| johnthetubaguy | lets just make that clear | 10:08 |
| johnthetubaguy | one extra comment, the enrolement of keys, and the context so you know what the means seems well worth explaining, probably under "other deployer impact", its kinda like a dependency of the system setup | 10:09 |
| gmann | johnthetubaguy: this is ready for review, i have updated the mapping of new and old roles. - https://review.opendev.org/#/c/547850/ | 10:09 |
| kashyap | We're only concerned about the case of: "If you don't trust what is inside the VM" -- that's what SB protects you from. | 10:09 |
| gmann | also added fallback idea in Alternate section | 10:09 |
| johnthetubaguy | so basically, we need all the details you have put together in the spec, just prehaps they need to move around a little bit. | 10:10 |
| gmann | i will be here for another ~2 hours for updating it. | 10:10 |
| kashyap | johnthetubaguy: Okay, will add a clarifying note that here, Secure Boot is only dealing with guest-level protection. | 10:10 |
| johnthetubaguy | sweet, sounds good | 10:10 |
| kashyap | johnthetubaguy: Yeah, I'll reorganize with a fresh mind early tommorrow. | 10:10 |
| kashyap | I need time to process all of this :-) | 10:10 |
| johnthetubaguy | kashyap: great work on this though, its a nasty can of worms, which thanks to your spec, I think I understand much better now, let's not loose that in the reworking! | 10:11 |
| kashyap | johnthetubaguy: Yeah, won't lose. It's been more than a year ago, when I started this QEMU thread: | 10:11 |
| kashyap | https://lists.nongnu.org/archive/html/qemu-devel/2018-03/msg01978.html -- [RFC] Defining firmware (OVMF, et al) metadata format & file | 10:12 |
| johnthetubaguy | I remember discussion it (and getting confused) when we were snowed in | 10:12 |
| kashyap | johnthetubaguy: Thanks a _ton_ for this focussed review time. I find this approach very effective. | 10:12 |
| johnthetubaguy | kashyap: me too, its much better than three weeks of back and forth | 10:12 |
| johnthetubaguy | gmann: talking a look at yours now | 10:13 |
| kashyap | Right, a lot of complexity is reduced. I'm glad there's someone like you, a "hypervisor person", who can see all the "can of worms" | 10:13 |
| kashyap | Alrightie, I've got enough to chisel away | 10:13 |
| kashyap | johnthetubaguy++ | 10:14 |
| johnthetubaguy | kashyap: cool, looks really promising | 10:14 |
| kashyap | Now only the "small matter of programming" remaining :D | 10:14 |
| *** shilpasd has joined #openstack-nova | 10:17 | |
| johnthetubaguy | gmann: line 90, I think we mean change the DB check from role:admin to scope:system? | 10:17 |
| johnthetubaguy | or rather, change from "role:admin" to "scope:system" when enforce_scope = True ? | 10:18 |
| *** owalsh has joined #openstack-nova | 10:19 | |
| kashyap | johnthetubaguy: A quick typo thing: did you mean Chris, instead of Eric here: https://review.opendev.org/#/c/506720/11/specs/train/approved/allow-secure-boot-for-qemu-kvm-guests.rst@98 | 10:21 |
| kashyap | (Because there was no comment from Eric there :-)) | 10:21 |
| gmann | johnthetubaguy: second one, when enforce_scope is true then we will start checking system scope | 10:21 |
| johnthetubaguy | kashyap: oops yes, I was thinking about the previous one clearly | 10:21 |
| kashyap | Yeah, figured as much. | 10:21 |
| kashyap | Thx. | 10:22 |
| * johnthetubaguy face palm | 10:22 | |
| *** owalsh_ has quit IRC | 10:22 | |
| johnthetubaguy | gmann: yeah, the steps bit is a bit out of date now I think | 10:22 |
| johnthetubaguy | gmann: I just added comments on the first 100 lines, going to keep going now | 10:24 |
| gmann | johnthetubaguy: thanks, checking.. | 10:24 |
| *** damien_r has quit IRC | 10:26 | |
| *** damien_r has joined #openstack-nova | 10:27 | |
| *** cdent has joined #openstack-nova | 10:27 | |
| *** slaweq has quit IRC | 10:30 | |
| yaawang | johnthetubaguy: Hi, could you please taking a look at the auto-converge/post-copy spec? I have replied your commets. https://review.opendev.org/#/c/651681/ | 10:32 |
| johnthetubaguy | yaawang: ah, I meant to follow up with your spec, will have a look | 10:33 |
| yaawang | johnthetubaguy: Great | 10:34 |
| *** markvoelker has quit IRC | 10:36 | |
| johnthetubaguy | yaawang: sorry, I think I miss-understood your use case | 10:36 |
| johnthetubaguy | yaawang: could you describe to me why a workload prefers auto converge vs post copy? | 10:37 |
| johnthetubaguy | is it the slowing down of the guest it wants to avoid? | 10:37 |
| johnthetubaguy | or the pausing of the guest it want's to avoid | 10:37 |
| gmann | johnthetubaguy: to be clear on DB check change. currently we check hard coded is_admin for few place which is going to be change to check if requested token is scoped to system. | 10:38 |
| johnthetubaguy | gmann: but... is_admin is set via policy | 10:38 |
| gmann | johnthetubaguy: yes, by checking is_context_admin which internally check admin role | 10:38 |
| johnthetubaguy | gmann: I think thinking we can hardcode to context.system_scope == "all" for the DB check, probably needs a new name though | 10:39 |
| yaawang | johnthetubaguy: Ok, please wait... | 10:39 |
| *** nicolasbock has joined #openstack-nova | 10:40 | |
| johnthetubaguy | yaawang: no problem | 10:40 |
| * gmann https://github.com/openstack/nova/blob/1d1b0d573671add8630af41754e5521cb2bc5ae1/nova/context.py#L151 | 10:40 | |
| gmann | johnthetubaguy: yeah. something like that and then set is_system or something on context like ^^ | 10:40 |
| gmann | johnthetubaguy: updated my local copy of spec with your comments till L100. waiting for next | 10:41 |
| *** brinzhang has quit IRC | 10:43 | |
| *** brinzhang has joined #openstack-nova | 10:43 | |
| johnthetubaguy | gmann: yeah, I think so... the key bit in the ordering is to allow us to implement the System Reader role, without breaking the project_id protection. i.e. the role:admin no longer works for list servers in all projects | 10:44 |
| johnthetubaguy | really just talking out loud to check my thinking there | 10:44 |
| yaawang | johnthetubaguy: If the compute node enable auto-converge, it will slow down CPU and memory I/O to make it easy to live-migrate to other compute node. | 10:46 |
| yaawang | johnthetubaguy: But it means all vms on the compute node will use auto-converge during live-migration even the vm can live-migrate to other compute node without auto-converge/post-copy. | 10:46 |
| yaawang | johnthetubaguy: For some applications(such as scientific computing applications) is sensitive to performance reduce or memory I/O error, these vms do not want to use auto-converge/post-copy during live-migration. | 10:46 |
| *** nicolasbock has quit IRC | 10:47 | |
| openstackgerrit | Merged openstack/os-traits master: Create trait for NUMA subtree affinity https://review.opendev.org/657898 | 10:47 |
| *** bbowen has quit IRC | 10:49 | |
| *** guozijn has joined #openstack-nova | 10:49 | |
| gmann | johnthetubaguy: if deployment say scope enforcement and token is not scoped to system then yes role:admin will not be able to list all project's servers | 10:49 |
| *** tbachman has quit IRC | 10:50 | |
| johnthetubaguy | yaawang: makes sense to me, but why do you want to use auto-converge for the other workloads? Maybe you just want to disable auto-converge in your cloud? | 10:50 |
| johnthetubaguy | yaawang: also, have you seen this interesting look at live-migration, I am curious if you see the same things: https://www.berrange.com/posts/2016/05/12/analysis-of-techniques-for-ensuring-migration-completion-with-kvm/ | 10:51 |
| gmann | with system reader (because of system_scope:all in check_str) it will keep checking the system scope even enforce_scope if false. so we would not break project_id protection there | 10:51 |
| johnthetubaguy | gmann: true, I might be worrying too much, anyways the role:admin check will break System Reader | 10:54 |
| yaawang | johnthetubaguy: Some vms do not want to use auto-converge/post-copy, but the other can use these feature. Auto-converge/post-copy can help vm live-migrate more faster, it's good to vm which can accept the performance reduce. Disable auto-converge/post-copy means all vms can't use them, it's not a good idea to users. | 10:58 |
| *** slaweq has joined #openstack-nova | 11:01 | |
| *** beagles has quit IRC | 11:03 | |
| johnthetubaguy | yaawang: for the VMs that don't want post copy or auto-converge, what do they want instead? are they OK being paused for longer, so the performance is more predicable during the live-migration? | 11:05 |
| *** jaosorior has joined #openstack-nova | 11:07 | |
| *** spatel has joined #openstack-nova | 11:09 | |
| *** dpawlik has quit IRC | 11:12 | |
| *** guozijn has quit IRC | 11:15 | |
| yaawang | johnthetubaguy: Just normal live-migration without any addition option, the main point is decrease the effort of source vm's performance. If the user call force-complete API, nova will pause the vm, it may not a good idea for now :(. But there are no more good idea. | 11:19 |
| *** ttsiouts has joined #openstack-nova | 11:22 | |
| *** luksky has joined #openstack-nova | 11:25 | |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: DNM: Run tempest-full-py3 with q35 machine type https://review.opendev.org/662887 | 11:27 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: DNM/WIP blockinfo: Use SATA bus for cdrom devices when using q35 https://review.opendev.org/663011 | 11:27 |
| lyarwood | mdbooth / kashyap ^ q35 hackaround as discussed, tempest is passing locally using q35 again, I'll sort the unit tests out now. | 11:28 |
| sean-k-mooney | lyarwood: isnt that in a docs comment somewhere | 11:28 |
| sean-k-mooney | lyarwood: e.g. you have to use sata | 11:28 |
| sean-k-mooney | because ide is not supported | 11:28 |
| sean-k-mooney | im pretty sure we discussed needing to do that months ago | 11:28 |
| sean-k-mooney | im guessing your just adding it now :) | 11:28 |
| lyarwood | not that I can see | 11:28 |
| lyarwood | it likely came up | 11:29 |
| sean-k-mooney | i remember talking to kasabp about it during the stien cycle | 11:29 |
| sean-k-mooney | i was going to say before chritmas but i think it was early january | 11:29 |
| lyarwood | right, I think the action just slipped through the cracks and we missed the impact on config drive users | 11:29 |
| sean-k-mooney | ah ya makes sense | 11:30 |
| sean-k-mooney | they could se hw_cdrom_bus | 11:30 |
| sean-k-mooney | they could se hw_cdrom_bus=sata | 11:30 |
| sean-k-mooney | as a workaourd | 11:30 |
| sean-k-mooney | but ya | 11:30 |
| *** janki has quit IRC | 11:30 | |
| kashyap | lyarwood: Yeah, will look | 11:31 |
| johnthetubaguy | yaawang: so I want to support your use case, but I am really against "use post copy" and "use auto converge" as things we expose. I really want to have something that doesn't depend on how we implement it, I am adding some ideas / alternatives in the spec comments. | 11:32 |
| kashyap | johnthetubaguy: Yeah, I see what you mean on that; me also needs to look at that spec | 11:32 |
| *** ttsiouts has quit IRC | 11:33 | |
| *** markvoelker has joined #openstack-nova | 11:33 | |
| *** ttsiouts has joined #openstack-nova | 11:34 | |
| yaawang | johnthetubaguy: I've replied your comment about why not only use post-copy. | 11:34 |
| johnthetubaguy | kashyap: yeah, I found something in google's APIs that I think expresses the user intent better | 11:34 |
| kashyap | I see; do provide a URL when you get around to it | 11:34 |
| openstackgerrit | Ghanshyam Mann proposed openstack/nova-specs master: Policy Default Refresh spec https://review.opendev.org/547850 | 11:34 |
| *** cmart has quit IRC | 11:34 | |
| johnthetubaguy | yaawang: ah... thank you, I forgot about the VM needing to reboot if you loose network connectivity with Post Copy | 11:35 |
| gmann | johnthetubaguy: ^^ updated for current comments. i will check other review comments tomorrow. | 11:35 |
| *** ttsiouts_ has joined #openstack-nova | 11:37 | |
| *** dave-mccowan has joined #openstack-nova | 11:37 | |
| johnthetubaguy | gmann: thanks, sorry for the delay, too much multi-tasking... and I need to get some lunch | 11:37 |
| *** ttsiouts has quit IRC | 11:38 | |
| gmann | johnthetubaguy: i know, how many time you need to switch the context :) | 11:38 |
| johnthetubaguy | gmann: I am wondering if we need to split the details into two... | 11:38 |
| johnthetubaguy | gmann: maybe this should be two specs (...ducks) | 11:39 |
| *** tetsuro has quit IRC | 11:39 | |
| johnthetubaguy | gmann: so first bit is admin_only and admin_or_owner with tests and better default check_str and scope_types | 11:40 |
| gmann | johnthetubaguy: hummm you mean separate for scope and default roles ? | 11:40 |
| gmann | ok | 11:40 |
| johnthetubaguy | gmann: second spec is adding the Reader role support? | 11:40 |
| johnthetubaguy | now... I know the reader role support is why we are doing it really | 11:40 |
| johnthetubaguy | I just think we need to separate the two bits of work, as they have two different sets of thinking around how we keep it backwards compatible | 11:41 |
| yaawang | johnthetubaguy: Pleasure, can you remove -1 on the gerrit? :) | 11:41 |
| johnthetubaguy | I think the Reader thing is easy, once you have the other stuff in place | 11:41 |
| johnthetubaguy | yaawang: I am still -1 the current approach though, because it talks about the specific implementation, we need to talk about what the workload needs in a way that is hypervisor agnostic... ideally that is. | 11:42 |
| gmann | johnthetubaguy: so in first bit we will keep all GET with system_admin or project_member etc and in second we change them to reader roles | 11:42 |
| *** _hemna has joined #openstack-nova | 11:42 | |
| johnthetubaguy | yaawang: I will come back with a better suggestion after I have had lunch | 11:42 |
| *** dpawlik has joined #openstack-nova | 11:43 | |
| johnthetubaguy | gmann: yeah, I think that is what we agreed at the PTG in terms of splitting up the patches as we improve the coverage | 11:43 |
| johnthetubaguy | gmann: the second reader roles spec is where we need the extra granular roles too, I guess | 11:43 |
| gmann | yeah, granular rules is needed mainly for reader capability | 11:44 |
| *** frankwang has quit IRC | 11:44 | |
| johnthetubaguy | gmann: do you think that makes sense? I don't want to drag it out too much, but I think we need that split due to all test coverage and the change to the DB level check | 11:44 |
| johnthetubaguy | gmann: so the DB level check would go with the reader change I think | 11:45 |
| *** panda|ruck is now known as panda|ruck|eat | 11:45 | |
| *** ccamacho has quit IRC | 11:45 | |
| johnthetubaguy | now the customers I have really want the reader role, they don't care about the other bits, they are "just a dependency" to make things work :( | 11:46 |
| gmann | but DB check needs to adjust with scope_type right say when we will change current admin to system_admin | 11:46 |
| johnthetubaguy | well the DB check is only needed by the Reader rule | 11:46 |
| johnthetubaguy | I mean... | 11:46 |
| gmann | i am still thinking if split can end up with 2 upgrade impact for operator. | 11:46 |
| gmann | ohk, yeah mostly GET thing | 11:47 |
| johnthetubaguy | so I think the reader role addition has no upgrade impact... unless you happen you use the role "reader" instead of "member" | 11:47 |
| johnthetubaguy | well, there granularity change is an impact I guess, but it only affects folks who have changed those policy rules, which should be quite a smaller number of folks | 11:48 |
| johnthetubaguy | gmann: so maybe the best thing is keep it as one spec, but make that clear split in the spec description? | 11:49 |
| gmann | yeah that looks much better to me. | 11:49 |
| gmann | current spec is split for scope_type and roles. i can make it to 1. admin, admin-or-owner -> system scope, project member 2. reader role and DB checks change | 11:50 |
| *** panda|ruck|eat is now known as panda|ruck | 11:51 | |
| *** udesale has quit IRC | 11:52 | |
| *** bbowen has joined #openstack-nova | 11:52 | |
| gmann | basically first bit goes more for adding scope type only with adjusted check_str and second goes for adopting default roles. hummm | 11:52 |
| *** udesale has joined #openstack-nova | 11:52 | |
| johnthetubaguy | gmann: I think the first does scope_types and check_str optionally checking for Member, and scope:project, etc | 11:53 |
| *** cdent has quit IRC | 11:54 | |
| johnthetubaguy | gmann: I think the first does scope_types and check_str optionally checking for Member, and scope:project, etc | 11:54 |
| johnthetubaguy | hmm, maybe that's not right either | 11:55 |
| johnthetubaguy | so I really should get some food, my brain is failing me | 11:55 |
| gmann | it mainly separate the current admin from project operation. i mean current project admin would not be able to perform new system level admin operation unless token is scoped with system. | 11:58 |
| gmann | if deployment choose to enforce the scope_type | 11:58 |
| gmann | i still feel reader ability makes these changes more useful otherwise operator can still add project member with system scope and lie to nova/oslo. | 12:00 |
| *** jaosorior has quit IRC | 12:00 | |
| *** b3nt_pin has joined #openstack-nova | 12:02 | |
| *** tbachman has joined #openstack-nova | 12:04 | |
| *** markvoelker has quit IRC | 12:05 | |
| johnthetubaguy | gmann: yeah, maybe we just do this in one shot... going to think on that over lunch | 12:06 |
| johnthetubaguy | yaawang: thank you for explaining your use case, I think if we rename the image properties and flavor extra specs slightly, I am happy. | 12:06 |
| johnthetubaguy | yaawang: I have added a suggestion on your spec | 12:07 |
| gmann | johnthetubaguy: ok, will catch with you ( or on gerrit) tomorrow. thanks for review and detail discussion. | 12:07 |
| yaawang | johnthetubaguy: Thanks, will look later... | 12:08 |
| *** tbachman has quit IRC | 12:09 | |
| *** spatel has quit IRC | 12:12 | |
| *** _hemna has quit IRC | 12:17 | |
| *** tbachman has joined #openstack-nova | 12:17 | |
| *** mugsie is now known as mugsie_ | 12:18 | |
| *** mugsie_ is now known as mugsie | 12:18 | |
| *** Sundar has joined #openstack-nova | 12:24 | |
| *** priteau has quit IRC | 12:34 | |
| *** BlackDex_ is now known as BlackDex | 12:35 | |
| *** panda|ruck is now known as panda|ruck|eat | 12:37 | |
| *** spsurya has quit IRC | 12:40 | |
| *** amyltsev has joined #openstack-nova | 12:44 | |
| *** stress_t has joined #openstack-nova | 12:45 | |
| *** cdent has joined #openstack-nova | 12:48 | |
| amyltsev | Hello, could someone advice, can I have name of volumes which were created during creation instances with volume creation, like the instance name? | 12:48 |
| *** davidsha has joined #openstack-nova | 12:48 | |
| *** panda|ruck|eat is now known as panda|ruck | 12:51 | |
| *** priteau has joined #openstack-nova | 12:58 | |
| kashyap | sean-k-mooney: On 'virtio-blk' vs. 'virtio-scsi', I'd say you got it the other way round: 'virtio-scsi' was designed to address the limitations of 'virtio-blk' | 12:59 |
| *** Luzi has joined #openstack-nova | 13:00 | |
| sean-k-mooney | kashyap: virtio-scsi is generally slower as it has to emulate a scsi contoller | 13:01 |
| *** BjoernT has joined #openstack-nova | 13:01 | |
| kashyap | sean-k-mooney: In _some_ workloads 'virtio-scsi' is slower, in others, it outperforms 'virtio-blk' | 13:01 |
| yonglihe | sean-k-mooney: Hi | 13:02 |
| sean-k-mooney | yonglihe: hi | 13:03 |
| sean-k-mooney | kashyap: in anycase we are defaulting to sata so its not really that relevent | 13:03 |
| yonglihe | I'm finding you that NUMA stuff api spec | 13:03 |
| sean-k-mooney | kashyap: i normally only use virtio-scsi when im using ceph | 13:03 |
| kashyap | sean-k-mooney: Sure, but I wanted to point out that correction | 13:03 |
| kashyap | Yep, noted | 13:04 |
| kashyap | sean-k-mooney: Also most new features are implemented on 'virtio-scsi'-only; due to the difficulty to extend 'virtio-blk' | 13:04 |
| *** priteau has quit IRC | 13:04 | |
| yonglihe | sean-k-mooney: Hope you have time ,thanks. https://review.opendev.org/#/c/658716/ spec "show-server-numa-topology" | 13:05 |
| sean-k-mooney | kashyap: yes i know. i do follow the qemu/kvm development too not quite as closely as you but enought to know where to look this up when i need too | 13:05 |
| kashyap | (Nod) | 13:06 |
| sean-k-mooney | the storage subsystem in qemu/kvm is one i have looked into a few times but its also the first thing i swap out of memory :) | 13:09 |
| kashyap | sean-k-mooney: Hehe, I spent far too much time following and playing with the Block Layer | 13:10 |
| kashyap | And _still_ I swap out routinely | 13:10 |
| *** ttsiouts_ has quit IRC | 13:10 | |
| *** ttsiouts has joined #openstack-nova | 13:11 | |
| yonglihe | Paste "clean up orphan instances" here, need review : https://review.opendev.org/#/c/627765/ | 13:11 |
| sean-k-mooney | yonglihe: i just responded to your question on v2 and ill review v4 after i grab a cup of coffee. | 13:12 |
| lyarwood | kashyap: https://github.com/openstack/nova/blob/2ea6e6f8db9fc6cecf389cacdd0d82d8226b99fb/nova/conf/libvirt.py#L714 - Any idea why we don't set defaults for hw_machine_type? | 13:13 |
| *** Luzi has quit IRC | 13:13 | |
| kashyap | lyarwood: We set for AArch64 and s390x; but not for x86_64 | 13:13 |
| * kashyap clicks | 13:13 | |
| sean-k-mooney | yonglihe: claning up instance not listed in the db can be dangous in some cases | 13:13 |
| sean-k-mooney | ill try to review that also but how are you validiating that openstack created the instnce | 13:14 |
| sean-k-mooney | are you checking for the metadata we add in the domian xml? | 13:14 |
| yonglihe | I create a out of band vm | 13:14 |
| kashyap | lyarwood: We don't set for x86_64, because we don't have enough information for that. | 13:14 |
| kashyap | lyarwood: That's what this spec is supposed to handle: https://review.openstack.org/#/c/631154/ ("WIP: Gracefully handle QEMU machine types for guests") | 13:15 |
| lyarwood | kashyap: I don't even see a default listed in that section | 13:15 |
| sean-k-mooney | yonglihe: to be clear my concern is we allow people to run non openstack manged vms on openstack compute nodes. so your orpahn patch should not break that usecase | 13:15 |
| lyarwood | kashyap: ah right | 13:15 |
| kashyap | lyarwood: We choose the defaults for non-x86_64 in the method you just moved: get_machine_type() | 13:15 |
| *** ttsiouts has quit IRC | 13:15 | |
| kashyap | I even added a NOTE there :-) | 13:15 |
| kashyap | if caps.host.cpu.arch in (obj_fields.Architecture.ARMV7, | 13:15 |
| kashyap | obj_fields.Architecture.AARCH64): | 13:15 |
| kashyap | mach_type = "virt" | 13:15 |
| kashyap | Likewise, for s390x | 13:15 |
| yonglihe | sean-k-mooney: if it's dangers in any way, we should address that. for the none OS vms, some ones need this to clean up and some one does not. the default action now is noop. | 13:16 |
| lyarwood | kashyap: right sorry I'm specifically talking about the hw_machine_type option itself | 13:17 |
| *** mriedem has joined #openstack-nova | 13:17 | |
| lyarwood | kashyap: and the fact that option doesn't actually have a default | 13:17 |
| sean-k-mooney | yonglihe: right but what im suggesting is we shoudl chacke the domain xml to confim if it contains the metadata we add with the instacne uuid/flavor/image and other info were we say this vm was created by nova | 13:17 |
| lyarwood | kashyap: I assumed it did and that caused loads of tests to fail as the final lookup would use that config option and return None | 13:17 |
| sean-k-mooney | yonglihe: if that info is not present then we should not reap the vm as it was not create by nova | 13:18 |
| kashyap | lyarwood: Even for the config option *itself*, we don't set default as we don't have enough information about the guest OS | 13:18 |
| yonglihe | sean-k-mooney: seems like a good point and we need that. | 13:18 |
| *** b3nt_pin is now known as beagles | 13:19 | |
| lyarwood | kashyap: ack understood | 13:19 |
| kashyap | lyarwood: That's why we delegate setting default machine type to orchestrators. | 13:19 |
| yonglihe | sean-k-mooney: you may want to comment this to the patch and i gonna address that. -:) | 13:19 |
| sean-k-mooney | yonglihe: that will driver dependent but i think it makes sense to have a call to the driver to retrun the set of possible ophean instances and then for the compute manager to ask the driver to reap them. | 13:20 |
| sean-k-mooney | sure ill add it to the review | 13:20 |
| mriedem | lyarwood: bauzas: dansmith: can we get these stein backports in so i can do a release? https://review.opendev.org/#/q/topic:bug/1830747+status:open+branch:stable/stein | 13:22 |
| bauzas | mriedem: ack I can take a look | 13:23 |
| yonglihe | sean-k-mooney: driver specific is spitted out, there is 2 patches on set. find the orphan seems like logic belong to compute but checking the metadata is definitely driver's scope. | 13:23 |
| sean-k-mooney | yonglihe: well i woudl expect the driver to be the thing that check what intances are running on the host and provide a kwarg to allow filtering to just vms it created. | 13:25 |
| *** ttsiouts has joined #openstack-nova | 13:26 | |
| sean-k-mooney | but i wouuld expect the compute manager to be the thinkg that calls that and descided if it should reap or not based on the policy set in the config | 13:26 |
| sean-k-mooney | well i guess its a periodic task but the point is i would expect the fucntion exectued by the periodic task to be driver independent | 13:27 |
| dansmith | mriedem: yes | 13:27 |
| lyarwood | thanks dansmith | 13:29 |
| *** brinzhang has quit IRC | 13:30 | |
| *** lbragstad has joined #openstack-nova | 13:32 | |
| *** spatel has joined #openstack-nova | 13:32 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/stein: Noop CantStartEngineError in targets_cell if API DB not configured https://review.opendev.org/663030 | 13:32 |
| yonglihe | sean-k-mooney: anyway there is a new API need added to driver layer. and i agree it should decouple with driver in some way. now it's not the way you prefer. but it's driver's choice to implement or not. | 13:34 |
| *** spatel has quit IRC | 13:36 | |
| *** cdent has quit IRC | 13:38 | |
| *** luksky has quit IRC | 13:41 | |
| yaawang | johnthetubaguy: Hi, I've replied your suggestion, is it correct? https://review.opendev.org/#/c/651681 | 13:41 |
| *** cmart has joined #openstack-nova | 13:42 | |
| *** lpetrut has quit IRC | 13:43 | |
| openstackgerrit | Dan Smith proposed openstack/nova master: Make nova-next archive using --before https://review.opendev.org/661002 | 13:45 |
| openstackgerrit | Merged openstack/nova-specs master: Amend count-quota-usage-from-placement to reflect implementation https://review.opendev.org/662130 | 13:47 |
| johnthetubaguy | yaawang: opps, your question points out I explained my idea badly, I will reply in the review soon | 13:47 |
| *** boxiang has quit IRC | 13:49 | |
| *** boxiang has joined #openstack-nova | 13:52 | |
| *** mlavalle has joined #openstack-nova | 13:53 | |
| *** liuyulong has joined #openstack-nova | 13:53 | |
| *** boxiang has quit IRC | 13:55 | |
| *** boxiang has joined #openstack-nova | 13:55 | |
| *** luksky has joined #openstack-nova | 14:00 | |
| *** eharney has joined #openstack-nova | 14:00 | |
| *** amorin has joined #openstack-nova | 14:01 | |
| *** cdent has joined #openstack-nova | 14:02 | |
| yaawang | johnthetubaguy: Thanks, I'll look it tomorrow because my timezone is UCT+8 :) | 14:03 |
| johnthetubaguy | yaawang: no problem, have a good evening/night! | 14:04 |
| *** munimeha1 has joined #openstack-nova | 14:04 | |
| *** rpittau is now known as rpittau|afk | 14:05 | |
| sean-k-mooney | gibi: mriedem forgot to push my comments but the reason the vgpu spec only provides soft affitnity curenly is that dansmith ask to reduce the scope to that case so yes part of it need to be updated but in v1 and v2 it proposed multiple affintiy polices | 14:07 |
| sean-k-mooney | gibi: mriedem which is why the oringal use case refer to enforcing numa affinity | 14:07 |
| *** spatel has joined #openstack-nova | 14:08 | |
| mriedem | sean-k-mooney: ok -1 to clean that up then to avoid confusion | 14:12 |
| *** _hemna has joined #openstack-nova | 14:13 | |
| *** ivve has quit IRC | 14:13 | |
| * mriedem goes to the dentist, back in about 90 minutes | 14:14 | |
| *** mriedem is now known as mriedem_away | 14:14 | |
| *** amyltsev_ has joined #openstack-nova | 14:17 | |
| *** ivve has joined #openstack-nova | 14:19 | |
| *** amyltsev has quit IRC | 14:20 | |
| *** zbr has quit IRC | 14:21 | |
| *** amyltsev has joined #openstack-nova | 14:22 | |
| *** zbr has joined #openstack-nova | 14:23 | |
| *** BjoernT has quit IRC | 14:25 | |
| *** amyltsev_ has quit IRC | 14:26 | |
| *** amyltsev has quit IRC | 14:28 | |
| *** BjoernT has joined #openstack-nova | 14:41 | |
| openstackgerrit | Merged openstack/nova stable/stein: Add regression recreate test for bug 1830747 https://review.opendev.org/662574 | 14:47 |
| openstack | bug 1830747 in OpenStack Compute (nova) stein "Error 500 trying to migrate an instance after wrong request_spec" [High,In progress] https://launchpad.net/bugs/1830747 - Assigned to Matt Riedemann (mriedem) | 14:47 |
| *** aarents__ has quit IRC | 14:48 | |
| *** abhishekk has joined #openstack-nova | 14:49 | |
| *** owalsh has quit IRC | 14:49 | |
| openstackgerrit | Merged openstack/python-novaclient master: Bump openstackdocstheme to 1.30.0 https://review.opendev.org/662905 | 14:52 |
| *** BjoernT_ has joined #openstack-nova | 14:53 | |
| *** BjoernT has quit IRC | 14:56 | |
| *** owalsh has joined #openstack-nova | 14:56 | |
| *** lpetrut has joined #openstack-nova | 14:57 | |
| *** shilpasd has quit IRC | 14:58 | |
| *** itlinux has quit IRC | 14:58 | |
| *** cfriesen has joined #openstack-nova | 15:01 | |
| *** luksky has quit IRC | 15:04 | |
| *** ttsiouts has quit IRC | 15:04 | |
| *** ttsiouts has joined #openstack-nova | 15:05 | |
| *** dpawlik has quit IRC | 15:05 | |
| *** cfriesen has quit IRC | 15:06 | |
| *** ttsiouts has quit IRC | 15:09 | |
| *** cfriesen has joined #openstack-nova | 15:17 | |
| *** dpawlik has joined #openstack-nova | 15:18 | |
| *** _hemna has quit IRC | 15:18 | |
| *** dpawlik has quit IRC | 15:22 | |
| *** damien_r has quit IRC | 15:29 | |
| *** lpetrut has quit IRC | 15:29 | |
| *** gyee has joined #openstack-nova | 15:35 | |
| *** helenafm has quit IRC | 15:38 | |
| *** spsurya has joined #openstack-nova | 15:39 | |
| *** bnemec has quit IRC | 15:44 | |
| *** jistr is now known as jistr|call | 15:45 | |
| *** jistr|call is now known as jistr | 15:45 | |
| *** bnemec has joined #openstack-nova | 15:46 | |
| *** hamzy_ has quit IRC | 15:48 | |
| *** itlinux has joined #openstack-nova | 15:54 | |
| *** Sundar has quit IRC | 15:57 | |
| *** ccamacho has joined #openstack-nova | 15:57 | |
| *** itlinux has quit IRC | 15:59 | |
| *** damien_r has joined #openstack-nova | 16:02 | |
| *** davidsha has quit IRC | 16:02 | |
| *** abhishekk has quit IRC | 16:08 | |
| *** ivve has quit IRC | 16:08 | |
| yaawang | johnthetubaguy: Thanks for your commet. | 16:09 |
| efried | kashyap: you and yaawang have been talking about cpu model list. Would you be okay if we restored the spec and let yaawang take over convincing the world it has legs? | 16:10 |
| yaawang | mriedem_away: Could you take a look at this spec, please. https://review.opendev.org/#/c/651681 | 16:10 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Use SATA bus for cdrom devices when using q35 machine type https://review.opendev.org/663011 | 16:10 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: DNM: Run tempest-full-py3 with q35 machine type https://review.opendev.org/662887 | 16:10 |
| lyarwood | mdbooth / kashyap / artom ; ^ finally got through all of the tests, it's pretty horrific so if someone has a better way I'm all ears :) | 16:10 |
| *** dtantsur is now known as dtantsur|afk | 16:11 | |
| *** itlinux has joined #openstack-nova | 16:11 | |
| *** spatel has quit IRC | 16:11 | |
| mdbooth | lyarwood: Looking now. | 16:11 |
| mdbooth | Ouch, test_driver.py! | 16:12 |
| artom | lyarwood, we'd want to backport this, right? | 16:13 |
| *** damien_r has quit IRC | 16:13 | |
| lyarwood | yup | 16:13 |
| artom | The thing is, it's hard to know if another approach would have less collateral damage without actually trying it | 16:14 |
| artom | Because backporting this in its current form will be a pain, I suspect | 16:14 |
| mdbooth | artom: I don't think we need to backport further than Stein though, right? | 16:14 |
| artom | mdbooth, true | 16:14 |
| lyarwood | it's actually clean at the moment | 16:14 |
| lyarwood | to stable/stein | 16:14 |
| * mdbooth would hope Stein isn't too hard right now | 16:14 | |
| artom | Whoa... | 16:14 |
| lyarwood | somehow | 16:15 |
| mdbooth | Quick, land it! | 16:15 |
| lyarwood | haha | 16:15 |
| artom | My brain's kinda foggy, but yeah, if it backports clean, I suppose it's OK | 16:18 |
| artom | Don't really see a way around it | 16:18 |
| lyarwood | kk, I'll sort out the missing tests now | 16:18 |
| *** wwriverrat has quit IRC | 16:19 | |
| *** mriedem_away is now known as mriedem | 16:20 | |
| *** xek has quit IRC | 16:20 | |
| *** xek_ has joined #openstack-nova | 16:20 | |
| mriedem | yaawang: you said you had to go to bed :) | 16:21 |
| mriedem | efried: sean-k-mooney: dansmith: gibi: more replies in the nova/cinder spec https://review.opendev.org/#/c/603955/ with my top two concerns listed when i left my latest comment (the latter is an implementation detail so not a huge deal), | 16:22 |
| yaawang | mriedem: haha :) | 16:22 |
| sean-k-mooney | mriedem: *nova/cyborg | 16:22 |
| mriedem | but in general how much debate has already happened about the API change to *always* have nova manage ARQ creation/lifecycle management vs just having the API accept a pre-created ARQ id like SR-IOV ports? | 16:22 |
| mriedem | sean-k-mooney: heh yeah | 16:22 |
| mriedem | my ideal would be to have version 1 only accept pre-created ARQ ids and attach them rather than version 1 be nova as sole orchestrator | 16:23 |
| mriedem | but if this has already been debated for 2 years i don't want to wade into that pool | 16:23 |
| sean-k-mooney | mriedem: i dont know how much that has been debated in the current iteration. at present the spec has nova always create the ARQ | 16:23 |
| sean-k-mooney | because the request it via the flavor | 16:23 |
| sean-k-mooney | but treating it like a netorn port also makes sense to me | 16:24 |
| mriedem | the user wouldn't have to request it via the flavor if they just passed an ARQ id right? | 16:24 |
| sean-k-mooney | eventrually i think we will want somethign like "openstack server create --device ..." | 16:24 |
| kashyap | efried: Hi, I'm okay restoring. But maybe at this point, a small PoC would already be better, if yaawang wants to tackle. | 16:24 |
| dansmith | mriedem: pretty sure every discussion we've had I've argued for the "make them be pre-created first" | 16:24 |
| efried | kashyap: Okay, let's do that. <== yaawang | 16:25 |
| mriedem | dansmith: yeah...because over the years we've pushed back on nova orchestrating external resources, but this starts out with the total opposite end | 16:25 |
| kashyap | lyarwood: That diffstat... | 16:25 |
| dansmith | mriedem: I haven't really tracked the spec of late, but we had a three phase approach at the previous denver ptg, to not have nova do the creation in the first pass | 16:25 |
| dansmith | mriedem: yeah, well, that definitely sounds like not what I had suggested | 16:25 |
| sean-k-mooney | mriedem: well that is because in the second denver ptg we layed out a 3 phase aproch | 16:25 |
| sean-k-mooney | first staticaly request via flavor | 16:26 |
| mriedem | the thing that really concerns me is there is talk about hot plug support in the future where the compute API would grow support for passing the device profile directly which i'm against, | 16:26 |
| *** damien_r has joined #openstack-nova | 16:26 | |
| mriedem | rather than just pre-create the ARQ and hand it to nova to attach | 16:26 |
| *** damien_r has quit IRC | 16:26 | |
| sean-k-mooney | seacond extend nova api to support precreated ports third i forget | 16:26 |
| mriedem | sean-k-mooney: so the opposite of what dansmith just said :) | 16:26 |
| sean-k-mooney | or third was suppoort hot attach/detach | 16:26 |
| kashyap | efried: FWIW, I'd strongly prefer if they write a _clear_ functional test (even if manual) to clearly show the truth. | 16:26 |
| sean-k-mooney | mriedem: yes the opisite fo what dan just sain | 16:27 |
| kashyap | Because ... "to show truth is to automatically persuade." | 16:27 |
| dansmith | sean-k-mooney: well, maybe we're confusing things | 16:27 |
| dansmith | mriedem: ^ | 16:27 |
| mriedem | sean-k-mooney: do we know why that changed? | 16:27 |
| *** lpetrut has joined #openstack-nova | 16:27 | |
| kashyap | (s/write/wrote/) | 16:27 |
| dansmith | because the thing sean-k-mooney is describing is what I'm talking about | 16:27 |
| *** jangutter has quit IRC | 16:27 | |
| sean-k-mooney | perhaps the reason its this way si to not require modificaiton of the nova api | 16:27 |
| mriedem | sean-k-mooney: that's what Sundar said in the spec as well, | 16:27 |
| mriedem | it's still a compute API change, | 16:27 |
| mriedem | it's just not a schema change | 16:27 |
| mriedem | trojan horsing the device profile through the flavor is still an api change | 16:28 |
| sean-k-mooney | well its actully jsut a flavor extraspec | 16:28 |
| mriedem | yeah i know | 16:28 |
| sean-k-mooney | but ya technically | 16:28 |
| bauzas | folks, fwiw I wasn't able to do spec reviews today, but I'll do it tomorrow | 16:28 |
| mriedem | but there is still a lot of stuff in the api/conductor that needs to change to create the arq | 16:28 |
| mriedem | and wire the request spec up for scheduling | 16:28 |
| *** itlinux has quit IRC | 16:29 | |
| sean-k-mooney | mriedem: yes alot of that would be reused in precreated case | 16:29 |
| sean-k-mooney | at least passing it to the schduler | 16:29 |
| dansmith | mriedem: yeah reading your comments, I think what's being described _is_ what we discussed at the previous denver ptg | 16:29 |
| *** cdent has quit IRC | 16:29 | |
| dansmith | which *was* to have nova do the creation, but just based on some static profile listed in the flavor, | 16:29 |
| dansmith | taking the nova api interaction part out | 16:30 |
| dansmith | but that's akin to an attachment for cinder, which I think makes sense here | 16:30 |
| dansmith | or a binding for neutron | 16:30 |
| mriedem | well, you mean nova creating a volume or a port right? | 16:30 |
| *** itlinux has joined #openstack-nova | 16:30 | |
| mriedem | on behalf of the user | 16:31 |
| dansmith | no | 16:31 |
| dansmith | because the complex configuration bits are wrapped up in the profile, right? | 16:31 |
| sean-k-mooney | kind of | 16:31 |
| dansmith | it's not a direct correlation, but nova currently does its own attaching of ports and volumes to a host once it knows where it's going, even if the complex volume or port was created, configured, etc by the user | 16:32 |
| dansmith | that's the analog I think I'm making here | 16:32 |
| sean-k-mooney | the profile is just a string in the nova flavor extra spec and wehn we ask cyborg for the detail of the profile it gives us back a set of resource requests and traits | 16:32 |
| dansmith | right | 16:32 |
| sean-k-mooney | and later when we bind the arq to a specifc host cyborge say "heres a pci device" | 16:32 |
| sean-k-mooney | and we generagte the correct xml to pass it to the guest | 16:33 |
| dansmith | right, which to me is equivalent to a host binding or cinder attachment | 16:33 |
| mriedem | sure i get that, | 16:34 |
| dansmith | I really haven't read the spec in a while so I should probably keep my mouth shut, | 16:34 |
| mriedem | it's not really what i'm talking about though | 16:34 |
| mriedem | nova has to do the binding either way, | 16:34 |
| sean-k-mooney | yes but the profile is more like a neutron network in that we told you i want an arq of this type "or a port on this network" and nova is creating an new arq instance like it create a neutron port | 16:34 |
| openstackgerrit | Sylvain Bauza proposed openstack/nova master: Pass allocations to virt drivers when resizing https://review.opendev.org/589085 | 16:34 |
| mriedem | i was just concerned about nova being responsible for creating the arq resource always rather than passing a pre-created arq id and just using that (which is already linked to a device profile) | 16:34 |
| sean-k-mooney | i then binds that arq the same way it bind the prot | 16:34 |
| mriedem | sean-k-mooney: right that's what i'm getting at, | 16:35 |
| mriedem | and i worry that will get more complicated down the road (like SR-IOV ports) which requires the compute API to grow complexity to handle new types of devices | 16:35 |
| dansmith | I think the benefit of not letting them pass an ARQ in first is that it delays our commitment to the api user until after this kinda actually works | 16:35 |
| sean-k-mooney | mriedem: so in a way yes we are proxing the creation of the arq but we chose to do that to reduce the change in the api. | 16:35 |
| mriedem | whereas for sriov ports we just said, nope, use the neutron api first if you want those | 16:36 |
| openstackgerrit | John Garbutt proposed openstack/nova master: Add functional test for admin_actions https://review.opendev.org/657698 | 16:36 |
| openstackgerrit | John Garbutt proposed openstack/nova master: WIP: add scope check, see tests catch the change https://review.opendev.org/657823 | 16:36 |
| openstackgerrit | John Garbutt proposed openstack/nova master: Ensure we pass a target in admin actions https://review.opendev.org/663095 | 16:36 |
| sean-k-mooney | dansmith: ya i think that was the basis of your original argument for this approch in the ptg session | 16:36 |
| mriedem | sean-k-mooney: dansmith: ok, ack, i'll yield on that, and had said in my review that i'm sure this has been debated and discussed before and i'm just catching up on that, so don't want to block on it | 16:37 |
| *** damien_r has joined #openstack-nova | 16:37 | |
| sean-k-mooney | e.g. to defer the api change until this actully works | 16:37 |
| dansmith | sean-k-mooney: yep | 16:37 |
| mriedem | based on all that the spec is probably mostly ready to go after Sundar cleans it up a bit | 16:37 |
| *** itlinux has quit IRC | 16:37 | |
| *** xek_ has quit IRC | 16:37 | |
| sean-k-mooney | long term i think have a --device option on the server create commandline and the appropriate api change makes the most sense and allow the precreation of ports | 16:38 |
| mdbooth | lyarwood: Done. | 16:40 |
| mriedem | ok thanks, linked to this discussion for Sundar and once he cleans up i'll probably +2 the spec | 16:40 |
| *** itlinux has joined #openstack-nova | 16:42 | |
| mriedem | dansmith: if there is one spec you review on this, the 3rd formal spec review sprint of the train release, it should be *my* spec for pre-filtering disabled computes https://review.opendev.org/#/c/657884/ :) | 16:49 |
| dansmith | orly? | 16:49 |
| mriedem | mostly b/c i have a quandary in there | 16:50 |
| *** maciejjozefczyk has quit IRC | 16:51 | |
| *** sapd1_x has quit IRC | 16:53 | |
| openstackgerrit | Merged openstack/nova stable/stein: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/662894 | 16:53 |
| *** sapd1_x has joined #openstack-nova | 16:53 | |
| sean-k-mooney | mriedem: oh i thought your disabled nodes prefilter spec was already merged | 16:54 |
| *** lpetrut has quit IRC | 16:55 | |
| *** damien_r has quit IRC | 17:01 | |
| *** derekh has quit IRC | 17:06 | |
| *** luksky has joined #openstack-nova | 17:08 | |
| *** hamzy has joined #openstack-nova | 17:10 | |
| openstackgerrit | John Garbutt proposed openstack/nova master: WIP: add scope check, see tests catch the change https://review.opendev.org/657823 | 17:11 |
| dansmith | mriedem: I'm super confused about this | 17:14 |
| dansmith | this spec seems to confuse disabledness and down-ness | 17:14 |
| dansmith | I'm commenting | 17:14 |
| *** _hemna has joined #openstack-nova | 17:14 | |
| *** sapd1_x has quit IRC | 17:17 | |
| openstackgerrit | Stephen Finucane proposed openstack/nova master: Recalculate 'RequestSpec.numa_topology' on resize https://review.opendev.org/662522 | 17:17 |
| openstackgerrit | Stephen Finucane proposed openstack/nova master: tests: Add '_setup_compute_services' helper https://review.opendev.org/663102 | 17:18 |
| *** tbachman has quit IRC | 17:21 | |
| *** spatel has joined #openstack-nova | 17:21 | |
| spatel | Folks, i am getting this error qemu-kvm: -object memory-backend-ram,id=ram-node0,size=12884901888,host-nodes=0,policy=bind: cannot set up guest memory 'ram-node0': Cannot allocate memory | 17:21 |
| spatel | I have 32G memory and hugemem is 25G | 17:21 |
| spatel | i am trying to build VM with 24G and its throwing this error | 17:22 |
| sean-k-mooney | spatel: do you have 24G of hugepages on a single numa node | 17:23 |
| *** itlinux has quit IRC | 17:23 | |
| spatel | no | 17:23 |
| sean-k-mooney | by default the kernel will split it across all numa nodes if you allcoate the hugepages on teh kernel commandline | 17:23 |
| spatel | How do i tell my flavor to use both side of NUMA ? | 17:24 |
| *** itlinux has joined #openstack-nova | 17:24 | |
| *** whoami-rajat has quit IRC | 17:24 | |
| sean-k-mooney | am you have to create a guest with multiple numa nodes which is done by setting hw:numa_nodes=2 | 17:24 |
| *** luksky has quit IRC | 17:24 | |
| sean-k-mooney | in the flavor | 17:24 |
| spatel | I have that option already in flavor | 17:25 |
| sean-k-mooney | or hw_numa_nodes=2 in the image metadat | 17:25 |
| sean-k-mooney | well yes it requesting 12 Gof hugepages on numa 0 | 17:25 |
| sean-k-mooney | but you may not have 12G free | 17:25 |
| *** luksky has joined #openstack-nova | 17:26 | |
| spatel | This is i have currently hw:cpu_policy='dedicated', hw:mem_page_sizee='large', hw:numa_nodes='2' | 17:26 |
| sean-k-mooney | yes so that will use hugepage,cpu pinning and create a vm with 2 numa nodes | 17:27 |
| spatel | I have 32G memory total ( 16G per numa) | 17:27 |
| sean-k-mooney | if you check cat /sys/devices/system/node/node*/meminfo | 17:27 |
| sean-k-mooney | do you have 12G of free hugepages per node | 17:28 |
| *** ociuhandu has quit IRC | 17:28 | |
| stephenfin | sean-k-mooney: Now with functional tests https://review.opendev.org/#/c/662522/ | 17:29 |
| spatel | This is i have in my grub hugepagesz=2M hugepages=12288 | 17:29 |
| stephenfin | Still need to figure out how I can rollback the changes to the field in the event that the resize fails but that's tomorrow's problem | 17:29 |
| sean-k-mooney | stephenfin: cool i take it we never save the modifed request_spec? | 17:29 |
| sean-k-mooney | stephenfin: well first confirm ^ | 17:30 |
| sean-k-mooney | if we dont save it then your good | 17:30 |
| stephenfin | not sure yet. I'll check that out first, yup | 17:30 |
| *** tbachman has joined #openstack-nova | 17:30 | |
| spatel | sean-k-mooney: 25723 MB total huge page | 17:30 |
| spatel | should i assume its divided between two numa node (25/2 = 12.4G) | 17:31 |
| sean-k-mooney | spatel: ya that should give you ~ 12.5G per numa node but what does "cat /sys/devices/system/node/node*/meminfo | grep HugePages" show | 17:32 |
| -spatel- [root@ostack-compute-sriov-196 ~]# cat /sys/devices/system/node/node*/meminfo | grep -i hugepage | 17:33 | |
| -spatel- Node 0 AnonHugePages: 0 kB | 17:33 | |
| -spatel- Node 0 HugePages_Total: 6144 | 17:33 | |
| -spatel- Node 0 HugePages_Free: 6144 | 17:34 | |
| -spatel- Node 0 HugePages_Surp: 0 | 17:34 | |
| -spatel- Node 1 AnonHugePages: 0 kB | 17:34 | |
| -spatel- Node 1 HugePages_Total: 6144 | 17:34 | |
| -spatel- Node 1 HugePages_Free: 6144 | 17:34 | |
| -spatel- Node 1 HugePages_Surp: 0 | 17:34 | |
| spatel | oh!!! | 17:34 |
| spatel | 6G free | 17:34 |
| sean-k-mooney | no | 17:34 |
| sean-k-mooney | you default hugepage size it 2m | 17:34 |
| sean-k-mooney | that is reported in pages not MBs | 17:35 |
| spatel | oh, ok | 17:35 |
| sean-k-mooney | so you have exactly 12G of hugepage per numanode | 17:35 |
| spatel | should i create flavor with 23G? | 17:35 |
| sean-k-mooney | i susspect that that would work yes | 17:35 |
| spatel | let me try.. hold tight | 17:35 |
| sean-k-mooney | i think we have an off by 1 issue when we woudl use it exactly | 17:36 |
| sean-k-mooney | i know i have had issue wiht that in the past so i usally round up my allocation on the kernel slightly | 17:36 |
| sean-k-mooney | so hugepagesz=2M hugepages=12300 in your case instead of hugepagesz=2M hugepages=12288 | 17:37 |
| *** tssurya has quit IRC | 17:38 | |
| *** ricolin has joined #openstack-nova | 17:38 | |
| *** ivve has joined #openstack-nova | 17:39 | |
| *** gyee has quit IRC | 17:41 | |
| sean-k-mooney | spatel: if 23G works then then you are likely hitting the isssue were we cant consume every hugepage page which has been a thing forever. i thought that was fixed litrally years ago but we could have regressed. | 17:42 |
| spatel | sean-k-mooney: it works!! instance is Up and running, I am in :) | 17:45 |
| -spatel- total used free shared buff/cache available | 17:45 | |
| -spatel- Mem: 22394 526 21268 16 599 21495 | 17:45 | |
| -spatel- Swap: 4095 0 4095 | 17:45 | |
| *** udesale has quit IRC | 17:46 | |
| sean-k-mooney | spatel: as a workaround i would just increase your group settings 12300 instead of 12288 | 17:46 |
| sean-k-mooney | 12288 is exactly 24G of hugepages | 17:46 |
| spatel | hmm! | 17:47 |
| sean-k-mooney | can you file a bug so we have something to track fixing the case where we use every single page in 1 vm | 17:47 |
| *** luksky has quit IRC | 17:48 | |
| spatel | can you explain me what went wrong in my case so it would be easy for me to open bug | 17:48 |
| *** _hemna has quit IRC | 17:48 | |
| sean-k-mooney | so you had allocated 12288 2MB hugepages which is 24G exactly | 17:49 |
| sean-k-mooney | and then you created a flavor that requested all 24G | 17:49 |
| sean-k-mooney | e.g. 12288 hugpages | 17:49 |
| sean-k-mooney | in this case i belive we have an off by 1 error where we say it can't fit when it can fit exactly | 17:49 |
| sean-k-mooney | basically i think we are doign a < so where where it shoudl be <= | 17:50 |
| spatel | opening bug now | 17:50 |
| sean-k-mooney | i know this used to be a bug when we first intoduced hugepages back in like 2014 but its totally posibel that that bug has been reinotduce or that we just never got aroud to fixing it | 17:51 |
| *** jdillaman has quit IRC | 17:55 | |
| sean-k-mooney | this should be correct https://github.com/openstack/nova/blob/master/nova/objects/numa.py#L140-L157 but that said the error came from qemu so perhaps this is a qemu issue | 17:55 |
| *** luksky has joined #openstack-nova | 18:00 | |
| openstackgerrit | Merged openstack/nova master: db: Remove cell APIs https://review.opendev.org/651309 | 18:02 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/queens: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/663110 | 18:04 |
| *** brault has joined #openstack-nova | 18:05 | |
| spatel | sean-k-mooney: https://bugs.launchpad.net/nova/+bug/1831652 | 18:06 |
| openstack | Launchpad bug 1831652 in OpenStack Compute (nova) "fixing the case where we use every single page in 1 vm" [Undecided,New] | 18:06 |
| spatel | sean-k-mooney: Thank you for help :) | 18:06 |
| sean-k-mooney | spatel: no worries as i said the error seams to be coming form qemu so its likely that we fixed the nova issue already and qemu also has a bug but at least we have something to track figuring that out | 18:08 |
| *** brault has quit IRC | 18:09 | |
| *** luksky has quit IRC | 18:17 | |
| *** amodi has quit IRC | 18:23 | |
| *** spsurya has quit IRC | 18:24 | |
| *** whoami-rajat has joined #openstack-nova | 18:26 | |
| *** spatel has quit IRC | 18:29 | |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Use SATA bus for cdrom devices when using q35 machine type https://review.opendev.org/663011 | 18:30 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: DNM: Run tempest-full-py3 with q35 machine type https://review.opendev.org/662887 | 18:30 |
| *** tbachman has quit IRC | 18:30 | |
| *** itlinux has quit IRC | 18:30 | |
| *** itlinux has joined #openstack-nova | 18:31 | |
| *** spatel has joined #openstack-nova | 18:32 | |
| *** Sundar has joined #openstack-nova | 18:33 | |
| *** ociuhandu has joined #openstack-nova | 18:34 | |
| *** BjoernT_ has quit IRC | 18:38 | |
| *** itlinux has quit IRC | 18:39 | |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Use SATA bus for cdrom devices when using q35 machine type https://review.opendev.org/663011 | 18:40 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: DNM: Run tempest-full-py3 with q35 machine type https://review.opendev.org/662887 | 18:40 |
| *** itlinux has joined #openstack-nova | 18:43 | |
| *** burt has quit IRC | 18:43 | |
| *** ociuhandu has quit IRC | 18:43 | |
| *** burt has joined #openstack-nova | 18:45 | |
| mriedem | dansmith: thanks replied on that pre-filter for disabled computes spec | 18:50 |
| mriedem | tl;dr it sounds like don't worry about down services | 18:51 |
| *** maciejjozefczyk has joined #openstack-nova | 18:58 | |
| *** maciejjozefczyk has quit IRC | 19:03 | |
| dansmith | mriedem: ack, replied, but yeah, that's MHO | 19:05 |
| mriedem | regarding old computes that won't be reporting the trait but they get disabled in the api, what are your thoughts on that? the api manages the trait until the compute is upgraded, or just ignore it until upgraded, or add a sync CLI? | 19:06 |
| mriedem | if we do'nt add a sync CLI for old computes that are already disabled, then i'd just ignore those requests in the API | 19:07 |
| dansmith | neither | 19:10 |
| dansmith | ignore until upgrade | 19:10 |
| dansmith | we set disabled=true on the compute record, let the computefilter continue to exclude those at great expense | 19:10 |
| *** ricolin has quit IRC | 19:10 | |
| dansmith | when the compute is upgraded and restarted, the u-p-t sync will update placement | 19:10 |
| mriedem | upt won't set this trait | 19:11 |
| dansmith | why? | 19:11 |
| mriedem | well, i hadn't planned on adding that - it was an alternative but not one i'd baked into the proposed change | 19:11 |
| dansmith | but why not? it solves a lot right? | 19:11 |
| mriedem | solves as in upgrades, dropped calls, out of sync, etc? | 19:12 |
| dansmith | it's kindof our "heal placement" loop as it is, so I don't see why we wouldn't | 19:12 |
| dansmith | yeah | 19:12 |
| mriedem | ok. in my reply i said we could build that in, so i might as well i guess, i'll move that out of alternatives. | 19:13 |
| *** cdent has joined #openstack-nova | 19:20 | |
| *** Sundar has quit IRC | 19:23 | |
| *** BjoernT has joined #openstack-nova | 19:26 | |
| *** tbachman has joined #openstack-nova | 19:28 | |
| efried | melwitt: Is there a reason you're holding back from approving https://review.opendev.org/#/c/579897/ ? | 19:31 |
| melwitt | efried: yeah, I hadn't reviewed deep into the change previously and don't know much about the context (the original feature). but since I had expressed a reno would be helpful, I reviewed the change and acked on that basis | 19:34 |
| efried | okay, thanks. | 19:34 |
| mriedem | efried: dustinc: i'm marking https://review.opendev.org/#/c/662881/ as a WIP since it's clearly a WIP | 19:34 |
| efried | Not sure who we're looking for to send it | 19:34 |
| efried | ack mriedem | 19:34 |
| mriedem | efried: just spin the roulette wheel of nova cores | 19:35 |
| efried | mriedem: Tempted to send it myself, adding my almost+2 to the testament of people who tested it live | 19:36 |
| mriedem | probably shouldn't, | 19:36 |
| mriedem | just wait for stephenfin or johnthetubaguy to take a look i'd say | 19:36 |
| efried | I didn't touch much of it. But yeah. | 19:36 |
| mriedem | https://www.youtube.com/watch?v=JGftIcp2SC0 ? | 19:37 |
| dansmith | rock on | 19:37 |
| melwitt | lol, a song for every occasion | 19:37 |
| *** bbowen has quit IRC | 19:38 | |
| *** imacdonn has quit IRC | 19:38 | |
| mriedem | bon was ahead of his time when it came to collaborative software development | 19:38 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/pike: Add regression recreate test for bug 1830747 https://review.opendev.org/663124 | 19:39 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/pike: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/663125 | 19:39 |
| openstack | bug 1830747 in OpenStack Compute (nova) rocky "Error 500 trying to migrate an instance after wrong request_spec" [High,In progress] https://launchpad.net/bugs/1830747 - Assigned to Matt Riedemann (mriedem) | 19:39 |
| sean-k-mooney | efried: for what its worth i think the hypervior hiding chance makes sense the only reservation i have is nvida or other may work around this in the future so i tond want us to have to keep addign these workaround but for this specific case i think it makes sense | 19:40 |
| *** altlogbot_2 has joined #openstack-nova | 19:40 | |
| *** slaweq has quit IRC | 19:43 | |
| dustinc | mriedem: thanks, I meant to put WIP in the title | 19:44 |
| *** _hemna has joined #openstack-nova | 19:45 | |
| *** slaweq has joined #openstack-nova | 19:45 | |
| *** Sundar has joined #openstack-nova | 19:50 | |
| *** itlinux has quit IRC | 19:50 | |
| *** imacdonn has joined #openstack-nova | 19:53 | |
| *** itlinux has joined #openstack-nova | 19:54 | |
| *** dave-mccowan has quit IRC | 19:55 | |
| efried | dustinc: In case it's not clear, if it looks like I'm answering questions in the sdk spec, me (or anyone) answering in comments isn't the end of the road - the salient points should be included in the document itself. | 20:13 |
| *** BjoernT has quit IRC | 20:17 | |
| *** _hemna has quit IRC | 20:19 | |
| dustinc | efried: very clear, thanks | 20:27 |
| *** itlinux has quit IRC | 20:30 | |
| *** luksky has joined #openstack-nova | 20:31 | |
| *** hamzy has quit IRC | 20:31 | |
| *** itlinux has joined #openstack-nova | 20:32 | |
| mriedem | i'm assuming i'm not alone in saying if we add support to pass an az to the unshelve api https://review.opendev.org/#/c/624689/ we should/would not support the zone:host:node format like on server create which bypasses the scheduler and forces the server onto the specified host and/or node | 20:40 |
| mriedem | from earlier review on the spec i think at least alex_xu agrees with me on ^ | 20:41 |
| *** eharney has quit IRC | 20:41 | |
| *** hoonetorg has quit IRC | 20:42 | |
| *** _hemna has joined #openstack-nova | 20:43 | |
| efried | mriedem: You appear to be alone in saying that, at least right now. But I wouldn't take that as dissent. | 20:44 |
| mriedem | https://review.opendev.org/#/c/624689/7/specs/train/approved/support-specifying-az-when-restore-shelved-server.rst@49 | 20:44 |
| melwitt | if it's "obvious" that the only utility for zone:host:node was getting a server into a specific az, then I would agree, but I don't feel sure that's the only reason people were using it | 20:46 |
| melwitt | *for unshelve | 20:46 |
| *** dklyle has quit IRC | 20:49 | |
| *** dklyle has joined #openstack-nova | 20:49 | |
| *** bbowen has joined #openstack-nova | 20:52 | |
| *** whoami-rajat has quit IRC | 20:54 | |
| *** hoonetorg has joined #openstack-nova | 20:55 | |
| *** cdent has quit IRC | 20:55 | |
| mriedem | i'm not sure what that means | 20:59 |
| mriedem | zone:host:node is used during server create to force the server on a specific host and/or node if you're an admin | 20:59 |
| *** tbachman has quit IRC | 21:00 | |
| mriedem | if you're non-admin you can only specify zone | 21:00 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/ocata: Add regression recreate test for bug 1830747 https://review.opendev.org/663143 | 21:05 |
| openstack | bug 1830747 in OpenStack Compute (nova) rocky "Error 500 trying to migrate an instance after wrong request_spec" [High,In progress] https://launchpad.net/bugs/1830747 - Assigned to Matt Riedemann (mriedem) | 21:05 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/ocata: Workaround missing RequestSpec.instance_group.uuid https://review.opendev.org/663144 | 21:05 |
| melwitt | oh, sorry, I misunderstood what was happening in the spec. I thought that today zone:host:node is supported and that they wish to add specifying az (for non-admins) and that they were proposing removing zone:host:node as part of the change | 21:05 |
| mriedem | nope, just wanting to add az to unshelve | 21:06 |
| melwitt | I see now that today there is no zone:host:node support and they want to add specification of az and they're proposing doing it via zone:host:node. I agree it should not be done that way because that's more than only adding the az, that's adding scheduler bypass, as you said | 21:06 |
| mriedem | yar | 21:06 |
| * melwitt comments | 21:07 | |
| *** pcaruana has quit IRC | 21:07 | |
| mriedem | thanks | 21:15 |
| *** itlinux has quit IRC | 21:16 | |
| *** ivve has quit IRC | 21:16 | |
| *** ivve has joined #openstack-nova | 21:20 | |
| *** mriedem is now known as mriedem_away | 21:22 | |
| *** _hemna has quit IRC | 21:23 | |
| openstackgerrit | Dustin Cowles proposed openstack/nova-specs master: WIP: Spec: Use OpenStack SDK in Nova https://review.opendev.org/662881 | 21:25 |
| *** munimeha1 has quit IRC | 21:39 | |
| *** luksky has quit IRC | 21:41 | |
| *** spatel has quit IRC | 21:41 | |
| *** tbachman has joined #openstack-nova | 21:47 | |
| cfriesen | when a nova-compute service is deleted in nova, is that supposed to also remove the relevent row in the resource_providers table? | 22:06 |
| efried | cfriesen: If it's deleted through proper channels, I think so? | 22:07 |
| efried | that would seem to be a pretty obvious miss if not | 22:07 |
| *** slaweq has quit IRC | 22:07 | |
| efried | You're supposed to stop the service before you delete it | 22:08 |
| efried | otherwise the compute will reassert its RP the next time periodics run. | 22:09 |
| cfriesen | I'm debugging a situation with Pike where deleting nova-compute and then adding it back with the same name ends up not updating the resource_providers row so it points at the deleted entry in compute_nodes. | 22:09 |
| efried | oh, yeah, pretty sure there's been a bug or three about that. | 22:09 |
| efried | mriedem_away would be able to recite the number off the top of his head. | 22:09 |
| efried | Fraid I gotta run. Good luck :) | 22:10 |
| cfriesen | thanks. :) | 22:10 |
| *** cmart has quit IRC | 22:10 | |
| *** slaweq has joined #openstack-nova | 22:11 | |
| openstackgerrit | sean mooney proposed openstack/nova-specs master: add libvirt pqos spec https://review.opendev.org/662264 | 22:12 |
| *** slaweq has quit IRC | 22:24 | |
| *** slaweq has joined #openstack-nova | 22:34 | |
| cfriesen | efried: FYI, pretty sure I found the missing commits. seems we weren't up-to-date with upstream stable/pike | 22:41 |
| *** dave-mccowan has joined #openstack-nova | 22:44 | |
| *** slaweq has quit IRC | 22:47 | |
| *** artom has quit IRC | 22:50 | |
| *** tkajinam has joined #openstack-nova | 22:51 | |
| *** cmart has joined #openstack-nova | 22:53 | |
| *** dave-mccowan has quit IRC | 22:56 | |
| *** slaweq has joined #openstack-nova | 23:04 | |
| openstackgerrit | Dustin Cowles proposed openstack/nova-specs master: WIP: Spec: Use OpenStack SDK in Nova https://review.opendev.org/662881 | 23:16 |
| *** slaweq has quit IRC | 23:17 | |
| *** rcernin has joined #openstack-nova | 23:20 | |
| *** gyee has joined #openstack-nova | 23:29 | |
| *** mlavalle has quit IRC | 23:34 | |
| *** itlinux has joined #openstack-nova | 23:37 | |
| *** itlinux has quit IRC | 23:38 | |
| *** itlinux has joined #openstack-nova | 23:42 | |
| *** itlinux_ has joined #openstack-nova | 23:45 | |
| *** itlinux has quit IRC | 23:47 | |
| *** tbachman has quit IRC | 23:49 | |
| *** slaweq has joined #openstack-nova | 23:50 | |
| *** takashin has joined #openstack-nova | 23:54 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!