| *** goldyfruit has joined #openstack-glance | 00:59 | |
| *** jv|afk has quit IRC | 01:01 | |
| *** Liang__ has joined #openstack-glance | 01:08 | |
| *** Liang__ is now known as LiangFang | 01:09 | |
| *** goldyfruit has quit IRC | 01:17 | |
| *** gyee has quit IRC | 01:26 | |
| *** rcernin has quit IRC | 01:27 | |
| *** rcernin has joined #openstack-glance | 01:30 | |
| *** rcernin has quit IRC | 02:37 | |
| *** rcernin has joined #openstack-glance | 03:30 | |
| *** rcernin has quit IRC | 03:31 | |
| *** rcernin has joined #openstack-glance | 03:37 | |
| *** LiangFang has quit IRC | 04:04 | |
| *** Liang__ has joined #openstack-glance | 04:05 | |
| *** Liang__ has quit IRC | 04:23 | |
| *** Liang__ has joined #openstack-glance | 04:23 | |
| *** evrardjp has quit IRC | 04:33 | |
| *** evrardjp has joined #openstack-glance | 04:33 | |
| *** ratailor has joined #openstack-glance | 05:06 | |
| *** Liang__ has quit IRC | 05:15 | |
| *** Liang__ has joined #openstack-glance | 05:16 | |
| *** udesale has joined #openstack-glance | 05:36 | |
| *** belmoreira has joined #openstack-glance | 06:12 | |
| *** ratailor has quit IRC | 06:43 | |
| *** ratailor has joined #openstack-glance | 06:44 | |
| *** Liang__ has quit IRC | 07:12 | |
| *** rcernin has quit IRC | 07:15 | |
| *** rcernin has joined #openstack-glance | 07:20 | |
| *** rcernin has quit IRC | 07:21 | |
| *** rcernin has joined #openstack-glance | 07:21 | |
| *** m75abrams has joined #openstack-glance | 07:25 | |
| *** rcernin has quit IRC | 07:41 | |
| *** jawad_axd has joined #openstack-glance | 07:48 | |
| *** jmlowe has quit IRC | 07:54 | |
| *** jmlowe has joined #openstack-glance | 07:56 | |
| *** rcernin has joined #openstack-glance | 08:05 | |
| *** rcernin has quit IRC | 08:09 | |
| *** tkajinam has quit IRC | 08:48 | |
| *** priteau has joined #openstack-glance | 08:57 | |
| *** Liang__ has joined #openstack-glance | 09:25 | |
| *** rcernin has joined #openstack-glance | 09:31 | |
| *** rcernin has quit IRC | 09:36 | |
| *** udesale has quit IRC | 09:39 | |
| *** udesale has joined #openstack-glance | 09:49 | |
| *** Liang__ has quit IRC | 10:31 | |
| *** udesale_ has joined #openstack-glance | 11:08 | |
| *** udesale has quit IRC | 11:11 | |
| *** donnyd_ has quit IRC | 11:33 | |
| *** donnyd_ has joined #openstack-glance | 11:34 | |
| *** donnyd_ has quit IRC | 11:34 | |
| *** donnyd_ has joined #openstack-glance | 11:36 | |
| *** donnyd_ has quit IRC | 11:36 | |
| *** TobbeCN has joined #openstack-glance | 11:37 | |
| *** donnyd_ has joined #openstack-glance | 11:42 | |
| *** donnyd_ is now known as donnyd | 11:44 | |
| *** TobbeCN has quit IRC | 12:07 | |
| *** benj_- has joined #openstack-glance | 12:36 | |
| *** zzzeek has quit IRC | 12:36 | |
| *** abhishekk has quit IRC | 12:36 | |
| *** udesale_ has quit IRC | 12:36 | |
| *** mvkr has quit IRC | 12:36 | |
| *** kukacz_ has quit IRC | 12:36 | |
| *** zigo has quit IRC | 12:36 | |
| *** benj_ has quit IRC | 12:36 | |
| *** tonyb has quit IRC | 12:36 | |
| *** benj_- is now known as benj_ | 12:36 | |
| *** mvkr has joined #openstack-glance | 12:37 | |
| *** zzzeek has joined #openstack-glance | 12:38 | |
| *** zigo_ has joined #openstack-glance | 12:45 | |
| *** m75abrams has quit IRC | 12:47 | |
| *** dosaboy has quit IRC | 12:50 | |
| *** dosaboy has joined #openstack-glance | 12:51 | |
| *** tkajinam has joined #openstack-glance | 13:02 | |
| *** Liang__ has joined #openstack-glance | 13:32 | |
| *** ratailor has quit IRC | 13:58 | |
| *** abhishekk has joined #openstack-glance | 14:11 | |
| *** gyee has joined #openstack-glance | 14:46 | |
| *** jawad_axd has quit IRC | 14:52 | |
| *** jawad_axd has joined #openstack-glance | 14:54 | |
| abhishekk | smcginnis, when you get time, kindly have a look at https://review.opendev.org/733395 | 14:59 |
|---|---|---|
| *** Luzi has joined #openstack-glance | 15:05 | |
| *** Luzi has quit IRC | 15:05 | |
| smcginnis | abhishekk: Will do! | 15:06 |
| abhishekk | smcginnis, thank you | 15:06 |
| *** lpetrut has joined #openstack-glance | 15:48 | |
| *** lpetrut has quit IRC | 16:03 | |
| *** rcernin has joined #openstack-glance | 16:03 | |
| *** tkajinam has quit IRC | 16:05 | |
| *** rcernin has quit IRC | 16:08 | |
| *** Liang__ has quit IRC | 16:12 | |
| *** jv|afk has joined #openstack-glance | 16:40 | |
| *** priteau has quit IRC | 16:49 | |
| jokke_ | rosmaita: you around? | 17:38 |
| rosmaita | jokke_: what's up? | 17:50 |
| *** jv|afk has quit IRC | 17:51 | |
| jokke_ | The encrypted NFS thingie | 17:52 |
| jokke_ | rosmaita: I just added comment on the review. But quick is that only issue with nfs backend? | 17:52 |
| jokke_ | And how can we figure out if the volume type is going to be encrypted befre we create it? | 17:53 |
| rosmaita | I think you can set the volume_type used when you configure the cinder store | 17:54 |
| rosmaita | so we need to doc that you should never use an encrypted type with cinder store with NFS backend | 17:54 |
| rosmaita | so this fix is to catch something that shouldn't have been allowed, and in a properly configured deployment, will never happen | 17:55 |
| rosmaita | (at least that's my understanding) | 17:55 |
| rosmaita | as far as is that the only issue with nfs backend ... only thing we know of ATM | 17:56 |
| jokke_ | oh, there is indeed volume type in there | 17:56 |
| rosmaita | i should've flagged that on the review | 17:56 |
| jokke_ | rosmaita: so what's the problem there? | 17:56 |
| *** jawad_axd has quit IRC | 17:57 | |
| jokke_ | We can get details of the volume type via cinderclient, right? So we can detect this already at startup and prevent the store even initializing if we know it doesn't work | 17:57 |
| jokke_ | I just want to avoid us a) needing to create dummy test volume on startup to make that happen b) give the user impression the cinder store is available when it's in fact unusable | 17:58 |
| rosmaita | right | 17:58 |
| rosmaita | i think you could do that at startup, but would probably still need the check in this patch | 17:59 |
| jokke_ | we should raise BadStoreConfiguration at startup if it's encrypted nfs volume (or any other volume type we know will cause issues and be unusable) | 17:59 |
| rosmaita | because the volume_type properties could change cinder-side | 18:00 |
| jokke_ | yeah, I see that being possible problem. Just wanted to understand what's going on here as there is no bug and the commit message just says "this should not be done" | 18:01 |
| jokke_ | So trying t understand what's the problem and what all we need to take into consideration | 18:01 |
| rosmaita | yeah, it has something to do with the way NFS encryption is done that i'm not completely clear on | 18:02 |
| rosmaita | let me check with eharney | 18:02 |
| rosmaita | he explained it to me last week, but i am having trouble articulating what exactly the problem is | 18:02 |
| jokke_ | kk | 18:04 |
| jokke_ | It's a good to harden for sure, lets just not do it in a way that gives sucky user experience | 18:05 |
| rosmaita | ok, so as far as the volume-type goes -- you can tell if it's encrypted, but can't tell whether the backend is NFS or not | 18:09 |
| rosmaita | so checking it up front really isn't an option | 18:09 |
| jokke_ | so we need to create dummy volume every time we start to check that | 18:09 |
| rosmaita | but we do need to document a warning, probably | 18:09 |
| jokke_ | Or we can just say encrypted volumes are not supported as glance store | 18:10 |
| whoami-rajat | rosmaita, jokke_ that logic has a problem. if we don't supply the volume type and the default type on cinder end is encrypted then no way on glance store to detect it's encrypted | 18:10 |
| jokke_ | whoami-rajat: so there is no way to get volume type info of default type? | 18:11 |
| whoami-rajat | also what brian said that got me to write the code after the os brick connection to know it's the nfs driver | 18:11 |
| whoami-rajat | hmm. i think we can with a command | 18:12 |
| whoami-rajat | /v3/{project_id}/types/default | 18:13 |
| whoami-rajat | yeah we've an API | 18:13 |
| jokke_ | whoami-rajat: cool so we can get the info | 18:13 |
| whoami-rajat | but again knowing it's an NFS backend problem stays | 18:13 |
| rosmaita | jokke_: the problem isn't encrypted volumes, it's encrypted on nfs -- for fibre/iSCSI, you have dm-crypt as like a transparent layer in front of the block device; with nfs you have to go through qemu | 18:14 |
| abhishekk | so there is no way to know at the glance service start what backend driver cinder is using, right? | 18:16 |
| rosmaita | i think not, a volume_type can be tied to multiple backends | 18:17 |
| jokke_ | ohh christ | 18:17 |
| whoami-rajat | rosmaita, not at one time | 18:17 |
| rosmaita | yep | 18:17 |
| whoami-rajat | IIUC | 18:17 |
| rosmaita | whoami-rajat: i thought the schedule figures it out | 18:17 |
| jokke_ | so we can eiher have qemu running in the conroller, just not accept any encrypted volumes as store or have shitty user experience when someone screws up the config | 18:18 |
| whoami-rajat | rosmaita, we provide volume_backend_name in the volume type to tag it to a backend ? | 18:18 |
| rosmaita | yeah, but that's not required | 18:19 |
| whoami-rajat | jokke_, glance_store creates the volume | 18:19 |
| whoami-rajat | rosmaita, yeah, it will then go to the scheduler if it isn't defined. right | 18:19 |
| rosmaita | ok | 18:19 |
| jokke_ | That's actually even worse than it constantly failing. Tht means it can sporadically fail and you just try again and suddenly it works | 18:20 |
| whoami-rajat | it should work until a volume type is provided | 18:21 |
| whoami-rajat | i think we've gotten off track with the point it can be assigned to any backend | 18:21 |
| whoami-rajat | the backend doesn't make it encrypted | 18:22 |
| whoami-rajat | the volume type does | 18:22 |
| rosmaita | jokke_: you've got to figure that the cinder admin will know how to configure a volume_type properly | 18:22 |
| rosmaita | so the glance admin just needs to ask for an appropriate one | 18:22 |
| rosmaita | or let triple-o set it up correctly :) | 18:22 |
| abhishekk | :D | 18:22 |
| jokke_ | Maybe it's better I just don't say anything | 18:24 |
| jokke_ | So why are we not going through qemu then and just make it work | 18:26 |
| abhishekk | +1 | 18:27 |
| abhishekk | either refuse all the encrypted volumes or make it work for nfs as well | 18:28 |
| jokke_ | Now, i need food before our sessions starts. BBL | 18:29 |
| whoami-rajat | it will be a feature and take time to make it work for consuming APIs to support encrypted volumes. i think if anyone's interested can work on it but until then to avoid unwanted behavior from glance_store it's best to block it. | 18:30 |
| rosmaita | well, you could just not support encrypted volume_types in glance_store ... it doesn't really make sense anyway, i don't think, because what the user gets out of glance is always unencrypted | 18:34 |
| abhishekk | but jokke_ really has a point | 18:37 |
| rosmaita | which one? | 18:38 |
| abhishekk | it will be of no use if NFS used as a cinder backend with encrypted volumes and glance is using cinder | 18:38 |
| abhishekk | then that store is of no use | 18:38 |
| rosmaita | right, so that would be an immediate indicator that something isn't working | 18:39 |
| whoami-rajat | we can create an uncrypted volume type for the nfs backend and set that in glance_store | 18:40 |
| abhishekk | using cinder_volume_type config option? | 18:41 |
| whoami-rajat | yep | 18:41 |
| rosmaita | i think we are overcomplicating things -- this is a special case | 18:42 |
| rosmaita | you'd figure if an operator wants to use the cinder backend for glance_store, they should know a bit about cinder | 18:42 |
| rosmaita | so i think let the operator configure the cinder_volume_type as they see fit | 18:42 |
| whoami-rajat | rosmaita++ and we're just blocking it temporarily to avoid weird behavior until someone dedicately works on it and makes it work | 18:42 |
| abhishekk | whoami-rajat, that someone and sometime never happens :D | 18:43 |
| whoami-rajat | abhishekk, you mean someone working on it? | 18:44 |
| abhishekk | whoami-rajat, nope, I am saying that we choosing this way hoping that someone will fix it with better approach latter | 18:44 |
| abhishekk | that someone never finds time to fix these kind of things | 18:45 |
| rosmaita | well, it would be an added feature | 18:45 |
| rosmaita | if someone really wants it they can implement it | 18:45 |
| rosmaita | this check is there just in case | 18:46 |
| whoami-rajat | if we don't want this check then it's fine by me but if someone ends up getting weirdly behaving image-volumes then cinder isn't to blame, we tried :P | 18:47 |
| abhishekk | Ok | 18:48 |
| *** goldyfruit has joined #openstack-glance | 18:50 | |
| *** m75abrams has joined #openstack-glance | 19:04 | |
| *** goldyfruit has quit IRC | 19:05 | |
| openstackgerrit | Merged openstack/glance master: Exclude http store if --all-stores specified for import/copy operation https://review.opendev.org/733395 | 19:10 |
| openstackgerrit | Abhishek Kekane proposed openstack/glance stable/ussuri: Exclude http store if --all-stores specified for import/copy operation https://review.opendev.org/733683 | 19:12 |
| *** belmoreira has quit IRC | 19:12 | |
| *** jv|afk has joined #openstack-glance | 20:01 | |
| *** rcernin has joined #openstack-glance | 20:05 | |
| whoami-rajat | abhishekk, around? | 20:08 |
| abhishekk | whoami-rajat, yes | 20:08 |
| openstackgerrit | Rajat Dhasmana proposed openstack/glance_store master: Don't allow image creation with encrypted nfs volumes https://review.opendev.org/732506 | 20:08 |
| whoami-rajat | abhishekk, ^ updated with test | 20:08 |
| abhishekk | whoami-rajat, thanks | 20:08 |
| whoami-rajat | np | 20:09 |
| whoami-rajat | will finally go to sleep now :P goodnight! | 20:09 |
| *** rcernin has quit IRC | 20:10 | |
| abhishekk | good night whoami-rajat | 20:10 |
| abhishekk | sleep well :d | 20:10 |
| whoami-rajat | abhishekk, also JFYI try catch is used because testtools (our base class) doesn't support self.assertRaises with context manager (like unittest does), also i saw it used in swift store tests so i don't think it's a problem | 20:11 |
| whoami-rajat | abhishekk, thanks! | 20:11 |
| abhishekk | whoami-rajat, ack | 20:11 |
| *** jv|afk has quit IRC | 20:25 | |
| *** jv|afk has joined #openstack-glance | 20:48 | |
| abhishekk | https://meetpad.opendev.org/glance-victoria-ptg | 20:52 |
| abhishekk | we will be starting today's discussion in 10 minutes | 20:52 |
| *** gyee has quit IRC | 20:55 | |
| *** gyee has joined #openstack-glance | 20:57 | |
| *** rcernin has joined #openstack-glance | 22:06 | |
| *** rcernin has quit IRC | 22:11 | |
| *** rajinir has quit IRC | 22:35 | |
| *** CeeMac has quit IRC | 22:35 | |
| *** nicolasbock has quit IRC | 22:36 | |
| *** vkmc has quit IRC | 22:36 | |
| *** rajivmucheli has quit IRC | 22:36 | |
| *** mnaser has quit IRC | 22:36 | |
| *** donnyd has quit IRC | 22:36 | |
| *** NobodyCam has quit IRC | 22:36 | |
| *** gregwork has quit IRC | 22:36 | |
| *** mnasiadka has quit IRC | 22:37 | |
| *** gagehugo has quit IRC | 22:37 | |
| *** TheJulia has quit IRC | 22:37 | |
| *** NobodyCam has joined #openstack-glance | 22:37 | |
| *** gagehugo has joined #openstack-glance | 22:37 | |
| *** gmann has quit IRC | 22:37 | |
| *** wxy has quit IRC | 22:37 | |
| *** CeeMac has joined #openstack-glance | 22:37 | |
| *** rm_work has quit IRC | 22:38 | |
| *** rajinir has joined #openstack-glance | 22:38 | |
| *** wxy has joined #openstack-glance | 22:38 | |
| *** vkmc has joined #openstack-glance | 22:38 | |
| *** gregwork has joined #openstack-glance | 22:39 | |
| *** gmann has joined #openstack-glance | 22:39 | |
| *** mnasiadka has joined #openstack-glance | 22:40 | |
| *** mnaser has joined #openstack-glance | 22:41 | |
| *** donnyd has joined #openstack-glance | 22:41 | |
| *** TheJulia has joined #openstack-glance | 22:42 | |
| *** nicolasbock has joined #openstack-glance | 22:42 | |
| *** rcernin has joined #openstack-glance | 22:47 | |
| *** rm_work has joined #openstack-glance | 22:51 | |
| *** m75abrams has quit IRC | 22:53 | |
| *** tkajinam has joined #openstack-glance | 22:56 | |
| *** gyee has quit IRC | 23:46 | |
| *** rcernin has quit IRC | 23:49 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!