*** david-lyle has quit IRC | 00:13 | |
*** edmondsw has quit IRC | 01:12 | |
*** yamahata has joined #openstack-meeting-cp | 01:40 | |
*** david-lyle has joined #openstack-meeting-cp | 01:48 | |
*** david-lyle has quit IRC | 02:00 | |
*** harlowja has quit IRC | 02:22 | |
*** edmondsw has joined #openstack-meeting-cp | 02:33 | |
*** edmondsw has quit IRC | 02:37 | |
*** yamahata has quit IRC | 02:41 | |
*** aselius has quit IRC | 02:52 | |
*** coolsvap has joined #openstack-meeting-cp | 03:13 | |
*** harlowja has joined #openstack-meeting-cp | 04:39 | |
*** nhelgeson has quit IRC | 05:06 | |
*** gouthamr has quit IRC | 05:24 | |
*** harlowja has quit IRC | 05:30 | |
*** brault has quit IRC | 06:54 | |
*** kbyrne has quit IRC | 09:31 | |
*** kbyrne has joined #openstack-meeting-cp | 09:34 | |
*** ccha has quit IRC | 09:39 | |
*** ccha has joined #openstack-meeting-cp | 09:40 | |
*** andreaf has quit IRC | 09:42 | |
*** andreaf has joined #openstack-meeting-cp | 09:42 | |
*** sdague has joined #openstack-meeting-cp | 10:56 | |
*** sdague has quit IRC | 10:57 | |
*** sdague has joined #openstack-meeting-cp | 11:22 | |
*** MarkBaker has joined #openstack-meeting-cp | 12:51 | |
*** brault has joined #openstack-meeting-cp | 13:36 | |
*** brault_ has joined #openstack-meeting-cp | 13:38 | |
*** coolsvap has quit IRC | 13:38 | |
*** brault_ has quit IRC | 13:39 | |
*** brault_ has joined #openstack-meeting-cp | 13:39 | |
*** brault has quit IRC | 13:40 | |
*** MarkBaker has quit IRC | 13:53 | |
*** edmondsw has joined #openstack-meeting-cp | 14:30 | |
*** ttx has quit IRC | 14:42 | |
*** ccha has quit IRC | 14:48 | |
*** kbyrne has quit IRC | 14:48 | |
*** _pewp_ has quit IRC | 14:48 | |
*** lifeless has quit IRC | 14:48 | |
*** breton has quit IRC | 14:48 | |
*** fungi has quit IRC | 14:48 | |
*** ameade has quit IRC | 14:48 | |
*** TheJulia has quit IRC | 14:48 | |
*** wxy has quit IRC | 14:48 | |
*** robcresswell has quit IRC | 14:48 | |
*** DuncanT has quit IRC | 14:48 | |
*** johnthetubaguy has quit IRC | 14:48 | |
*** gnarld_ has quit IRC | 14:48 | |
*** eglute has quit IRC | 14:48 | |
*** sdague has quit IRC | 14:48 | |
*** nguyentrihai has quit IRC | 14:48 | |
*** zigo has quit IRC | 14:48 | |
*** jhesketh has quit IRC | 14:48 | |
*** brault_ has quit IRC | 14:48 | |
*** knikolla has quit IRC | 14:48 | |
*** persia has quit IRC | 14:48 | |
*** cmurphy has quit IRC | 14:48 | |
*** melwitt has quit IRC | 14:48 | |
*** kencjohnston has quit IRC | 14:48 | |
*** benj_ has quit IRC | 14:48 | |
*** notmyname has quit IRC | 14:48 | |
*** hemna has quit IRC | 14:48 | |
*** amrith has quit IRC | 14:48 | |
*** tonyb has quit IRC | 14:48 | |
*** homerp has quit IRC | 14:48 | |
*** SergeyLukjanov has quit IRC | 14:48 | |
*** fungi has joined #openstack-meeting-cp | 14:54 | |
*** ameade has joined #openstack-meeting-cp | 14:54 | |
*** TheJulia has joined #openstack-meeting-cp | 14:54 | |
*** wxy has joined #openstack-meeting-cp | 14:54 | |
*** robcresswell has joined #openstack-meeting-cp | 14:54 | |
*** DuncanT has joined #openstack-meeting-cp | 14:54 | |
*** johnthetubaguy has joined #openstack-meeting-cp | 14:54 | |
*** nug has joined #openstack-meeting-cp | 14:54 | |
*** eglute has joined #openstack-meeting-cp | 14:54 | |
*** ttx has joined #openstack-meeting-cp | 14:54 | |
*** breton has joined #openstack-meeting-cp | 14:54 | |
*** lifeless has joined #openstack-meeting-cp | 14:54 | |
*** _pewp_ has joined #openstack-meeting-cp | 14:54 | |
*** ccha has joined #openstack-meeting-cp | 14:54 | |
*** gouthamr has joined #openstack-meeting-cp | 14:54 | |
*** brault_ has joined #openstack-meeting-cp | 14:54 | |
*** sdague has joined #openstack-meeting-cp | 14:54 | |
*** nguyentrihai has joined #openstack-meeting-cp | 14:54 | |
*** knikolla has joined #openstack-meeting-cp | 14:54 | |
*** zigo has joined #openstack-meeting-cp | 14:54 | |
*** benj_ has joined #openstack-meeting-cp | 14:54 | |
*** tonyb has joined #openstack-meeting-cp | 14:54 | |
*** jhesketh has joined #openstack-meeting-cp | 14:54 | |
*** notmyname has joined #openstack-meeting-cp | 14:54 | |
*** hemna has joined #openstack-meeting-cp | 14:54 | |
*** amrith has joined #openstack-meeting-cp | 14:54 | |
*** persia has joined #openstack-meeting-cp | 14:54 | |
*** homerp has joined #openstack-meeting-cp | 14:54 | |
*** cmurphy has joined #openstack-meeting-cp | 14:54 | |
*** melwitt has joined #openstack-meeting-cp | 14:54 | |
*** kencjohnston has joined #openstack-meeting-cp | 14:54 | |
*** SergeyLukjanov has joined #openstack-meeting-cp | 14:54 | |
*** mtreinish has quit IRC | 14:55 | |
*** yamahata has joined #openstack-meeting-cp | 14:58 | |
*** mtreinish has joined #openstack-meeting-cp | 14:59 | |
*** nug is now known as Guest20148 | 15:20 | |
*** kbyrne has joined #openstack-meeting-cp | 15:20 | |
*** nikhil has joined #openstack-meeting-cp | 15:35 | |
*** yamahata has quit IRC | 15:35 | |
*** mriedem has joined #openstack-meeting-cp | 15:58 | |
ildikov | #startmeeting cinder-nova-api-changes | 16:00 |
---|---|---|
openstack | Meeting started Thu Dec 7 16:00:04 2017 UTC and is due to finish in 60 minutes. The chair is ildikov. Information about MeetBot at http://wiki.debian.org/MeetBot. | 16:00 |
openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 16:00 |
*** openstack changes topic to " (Meeting topic: cinder-nova-api-changes)" | 16:00 | |
openstack | The meeting name has been set to 'cinder_nova_api_changes' | 16:00 |
ildikov | johnthetubaguy jaypipes e0ne jgriffith hemna mriedem patrickeast smcginnis diablo_rojo xyang1 raj_singh lyarwood jungleboyj stvnoyes | 16:00 |
jungleboyj | @! | 16:00 |
_pewp_ | jungleboyj (。・∀・)ノ | 16:00 |
mriedem | o/ | 16:00 |
ildikov | I don't think we can expect too many more for today | 16:01 |
ildikov | so let's do a quick recap | 16:01 |
ildikov | on this week's happenings | 16:01 |
ildikov | we have progress on the new attach patch in Nova, special and many thanks to mriedem | 16:01 |
* jungleboyj claps. | 16:01 | |
ildikov | this is how the field looks like right now: https://review.openstack.org/#/q/topic:bp/multi-attach-volume+(status:open+OR+status:merged) | 16:01 |
ildikov | don't get caught up on the topic | 16:02 |
ildikov | mriedem: so the question on my side now is that what's missing to be able to land the new attach patch and who's gonna do it? | 16:02 |
mriedem | i will approve it once tests all pass | 16:03 |
mriedem | however, | 16:03 |
mriedem | https://bugs.launchpad.net/cinder/+bug/1736773 | 16:03 |
openstack | Launchpad bug 1736773 in Cinder "attachment-show is including `connection_info` for non-admin callers, it shouldn't" [High,Triaged] - Assigned to John Griffith (john-griffith) | 16:03 |
mriedem | concerns me | 16:03 |
ildikov | in the sense of how we use it in the Nova code? | 16:03 |
ildikov | or in general? | 16:03 |
mriedem | depending on if/how that gets fixed, | 16:03 |
mriedem | it could break nova | 16:03 |
mriedem | as far as i know, nova isn't passing an admin token to get the attachment details | 16:04 |
mriedem | it's using the user token | 16:04 |
mriedem | or the nova service user token | 16:04 |
mriedem | so if a policy rule goes into place to only return connection_info for an admin, that will break our existing code because we won't be able to get the connection_info | 16:04 |
mriedem | as i said in the bug, | 16:04 |
mriedem | i think this is super latent with the os-initialize_connection volume action api | 16:05 |
mriedem | i'm not sure if there are different policy controls in place for those APIs in cinder, i didn't get that far | 16:05 |
mriedem | or if there are any policy controls in place at all | 16:05 |
ildikov | so should we switch to admin for that call now? | 16:05 |
mriedem | well, it will depend | 16:05 |
mriedem | as noted in the bug, | 16:06 |
mriedem | the connection_info dict in the response contains things like details about the target and credentials | 16:06 |
jungleboyj | *Sigh* | 16:07 |
jungleboyj | Changing that is going to break stuff I am working on as well. | 16:07 |
ildikov | so Nova is not supposed to get it at all? | 16:07 |
mriedem | looks like this is a policy check on updating an attachment https://github.com/openstack/cinder/blob/master/cinder/volume/api.py#L2075 | 16:07 |
mriedem | ildikov: nova must get it | 16:07 |
mriedem | we use it to connect the volume to the host using brick | 16:08 |
mriedem | comparing to os-initialize_connection, there is a policy rule on that too https://github.com/openstack/cinder/blob/master/cinder/volume/api.py#L782 | 16:08 |
ildikov | ok, so what does it depend on whether or not to use admin context to get those details? | 16:08 |
mriedem | https://github.com/openstack/cinder/blob/master/cinder/policies/volume_actions.py#L164 | 16:08 |
mriedem | same as https://github.com/openstack/cinder/blob/master/cinder/policies/attachments.py#L37 | 16:09 |
mriedem | but there isn't a policy rule for listing/showing attachment details | 16:09 |
jungleboyj | Would be good to fix that with a policy setting so if there are people who want that exposed we can still get it. | 16:09 |
ildikov | ah, ok, yeah | 16:10 |
mriedem | ildikov: the issue is that i, as a non-admin user, can create a volume and attach it to an instance, | 16:10 |
mriedem | and then get the details, as a non-admin, about the storage connection | 16:10 |
mriedem | including target IP and credentials | 16:10 |
mriedem | as i said, this has always been a problem with os-initialize_connection as far as i can tell | 16:10 |
mriedem | the main difference is there was never a CLI for initializing a connection to get the connection_info back, but the REST API was always there for anyone that knows how to use curl | 16:11 |
mriedem | there is a CLI for listing and showing volume attachment details | 16:11 |
ildikov | ok, put it together now | 16:12 |
ildikov | however it's a problem in general not just from Nova's perspective | 16:12 |
ildikov | so we need to figure out how to handle this | 16:13 |
ildikov | but do we need to hold the new attach patch on this? | 16:13 |
mriedem | idk | 16:14 |
mriedem | the thing is, | 16:14 |
mriedem | let's say cinder adds a policy rule to not show connection_info unless you're an admin by default | 16:14 |
jungleboyj | mriedem: ++ | 16:14 |
mriedem | that would require nova to add config and code for making sure we get an admin token for anytime we need that information, | 16:14 |
mriedem | since the user token might not cut it | 16:15 |
mriedem | and if you backport that change, | 16:15 |
mriedem | it means breaking all existing deployments | 16:15 |
mriedem | ^ if you also apply that policy change to os-initialize_connection | 16:15 |
ildikov | do you mean that for initialize or the new attach api? | 16:15 |
mriedem | i think if you fix this for the new API you also have to fix it for os-initialize_connection | 16:16 |
mriedem | it's the same issue | 16:16 |
ildikov | ok, but for os-initialize-connection that has nothing to do with what we do with the new flow | 16:16 |
mriedem | i realize that | 16:16 |
mriedem | but it doesn't make sense to say, "you can only get connection_info if you're an admin with this one API but not this other API" | 16:16 |
mriedem | e.g., | 16:16 |
mriedem | i could attach a volume with the new flow, | 16:17 |
mriedem | and then curl to os-initialize_connection to get those details | 16:17 |
ildikov | yeah, I got the point | 16:17 |
ildikov | so the question now whether or not to fix it? | 16:17 |
ildikov | or whether or not fix and backport it? | 16:17 |
mriedem | yeah | 16:18 |
mriedem | if nova.conf is always configured to talk to cinder with a user that has the admin role, then it might be ok | 16:18 |
mriedem | but i don't think we say anywhere that has to be the case | 16:19 |
ildikov | yeah, that would solve the issue | 16:19 |
jungleboyj | mriedem: That seems like a reasonable limitation to set. | 16:19 |
mriedem | the only other service i know of that nova talks to with an admin token at times is neutron | 16:20 |
mriedem | and that's to do things with the port binding profile | 16:20 |
mriedem | which is like a connection_info for a volume | 16:20 |
ildikov | well, if the issue is that we basically don't want users to access the connection_info just haven't fixed that for whatever reason till now, then I guess that's ok if Cinder becomes another service like Neutron | 16:21 |
jungleboyj | ildikov: ++ | 16:21 |
ildikov | it seems that it would be nice to get this fixed at a certain point | 16:21 |
jungleboyj | And if we can fix the connection_info with a policy then it gives users who don't want to use an admin user an option. | 16:21 |
mriedem | devstack sets up the neutron creds in nova.conf with an admin user https://github.com/openstack-dev/devstack/blob/master/lib/neutron-legacy#L372 | 16:22 |
ildikov | and I feel the pain, but at least good things come out of implementing the new flow if we fix for instance this one | 16:22 |
*** aselius has joined #openstack-meeting-cp | 16:23 | |
mriedem | we don't set credentials in [cinder] in nova.conf in devstack at all | 16:23 |
mriedem | so everything we test against today in CI is using the user token | 16:23 |
ildikov | so it's Cinder code change, Nova code change plus devstack fix | 16:23 |
ildikov | also I need to run in 10 minutes :/ | 16:24 |
jungleboyj | Bummer. More moving pieces. | 16:24 |
ildikov | so questions | 16:24 |
mriedem | well, it requires some thought on how you roll something like this out | 16:25 |
mriedem | if you're going to backport it | 16:25 |
mriedem | i think if you add a policy control for both cinder APIs, | 16:25 |
*** MarkBaker has joined #openstack-meeting-cp | 16:25 | |
mriedem | it has to default to admin_or_owner to not break existing code | 16:25 |
mriedem | with clear documentation that if you change that to admin-only, then the [cinder] creds in nova.conf must be an admin user | 16:25 |
jungleboyj | mriedem: That sounds good. | 16:26 |
ildikov | agreed | 16:27 |
ildikov | so would this all happen before thinking about landing the new attach code? | 16:27 |
mriedem | if the fix in cinder is backward compatible, then no | 16:28 |
jungleboyj | mriedem: Why is that? | 16:28 |
ildikov | so I guess we need to chat with jgriffith to ensure it is backward compatible | 16:28 |
mriedem | because i would prefer to not merge code that is immediately broken | 16:29 |
mriedem | the release note on the new flow attach code in nova says that this is all basically internal plumbing changes, no impacts to existing stuff, | 16:29 |
mriedem | and should work as long as computes are upgraded and cinder 3.44 is available | 16:29 |
mriedem | i don't want to add a "oh btw you need to run with an admin user now for cinder too btw for this new code to work" | 16:29 |
ildikov | which should still be true with admin_or_owner, right? | 16:30 |
mriedem | "even though this was always a problem" | 16:30 |
mriedem | ildikov: yes admin_or_owner is fine | 16:30 |
ildikov | well, we said we would fix both | 16:30 |
mriedem | the user token is the owner of the instance and volume | 16:30 |
jungleboyj | mriedem: Fair enough. | 16:30 |
ildikov | so if we break one we break the other one too | 16:30 |
mriedem | otherwise you can't GET the volume | 16:30 |
ildikov | yeah, that's what I meant | 16:30 |
ildikov | just stopped to be sure at anything recently | 16:30 |
mriedem | so i'll update the bug with notes | 16:32 |
mriedem | and thoughts | 16:32 |
mriedem | john is at kubecon? | 16:32 |
ildikov | yes, he is | 16:32 |
mriedem | ok | 16:32 |
ildikov | he's occasionally available, he has a talk I don't know when | 16:32 |
ildikov | so let's hold the code until we had a chat with him about this | 16:33 |
ildikov | we might have a cinderclient soon with the shared_targets microversion | 16:33 |
jungleboyj | ildikov: Yes, I would like to get that through today. | 16:33 |
ildikov | mriedem: should I bump the microversion in the new attach patch if that gets out in the meantime? | 16:33 |
jungleboyj | I guess I could ninja merge the 3.48 patch. | 16:33 |
ildikov | jungleboyj: nice, thanks! | 16:33 |
ildikov | jungleboyj: yeah, that's just a version bump, nothing else if everything else is in place | 16:34 |
jungleboyj | Would kind-of like jgriffith 's sign off though. | 16:34 |
mriedem | what is 3.48 | 16:34 |
mriedem | ? | 16:34 |
mriedem | shared_targets? | 16:34 |
ildikov | yes | 16:34 |
jungleboyj | mriedem: Yep. | 16:34 |
mriedem | meh - at this point i think what we have is ok based on our discussion yesterday | 16:34 |
mriedem | the multiattach code in nova can always check that cinder has 3.48 | 16:35 |
mriedem | before it allows attaching a multiattach volume to >1 instance | 16:35 |
ildikov | we just didn't have some previous microversion changes implemented in the client | 16:35 |
mriedem | i would say don't rush the cinder side | 16:35 |
mriedem | we're not blocked | 16:35 |
ildikov | well, it's almost done | 16:35 |
mriedem | except for all the client stuff it sounds like, plus a release, etc | 16:35 |
ildikov | and then we have one less thing to keep in mind, which might be nice every now and then | 16:35 |
ildikov | the stuff is mainly on the gate now | 16:36 |
ildikov | and the client side changes need to land anyway otherwise we mess up like the last time... | 16:36 |
ildikov | ok, let's talk to jgriffith and then we will see where things are and move forward | 16:36 |
jungleboyj | :-) I will see if jgriffith pops on later. If he doesn't I will just merge it and propose the release. | 16:36 |
mriedem | don't you guys have other cores? | 16:37 |
mriedem | i know sean is gone too | 16:37 |
mriedem | but | 16:37 |
jungleboyj | Yep .... | 16:37 |
jungleboyj | mriedem: Don | 16:37 |
jungleboyj | 't get me started . | 16:37 |
mriedem | i'd just rather not rush things | 16:37 |
mriedem | you want to make me core? | 16:37 |
mriedem | joking | 16:38 |
ildikov | ok, we can skip the version bump and just get things tidy in the cinderclient for it's own sake | 16:38 |
mriedem | but i can hear your gears grinding from here | 16:38 |
jungleboyj | mriedem: That could be arranged. | 16:38 |
ildikov | ok guys, I need to run | 16:38 |
jungleboyj | I wish I could remove some of the other cores to more realistically show the state of things. | 16:38 |
jungleboyj | ildikov: Ok, thank you. | 16:38 |
ildikov | is there anything else we need to chat/could decide about here? | 16:38 |
mriedem | nope | 16:39 |
jungleboyj | I will continue to curate the client patches. | 16:39 |
ildikov | ok, cool, thank you both | 16:39 |
ildikov | let's keep in touch on the channels | 16:39 |
jungleboyj | ildikov: Will do. | 16:39 |
ildikov | jungleboyj: thank you | 16:39 |
ildikov | jungleboyj: and you're the PTL, you can do whatever you want ;) | 16:39 |
ildikov | chat later guys! | 16:39 |
ildikov | #endmeeting | 16:39 |
*** openstack changes topic to "OpenStack Meetings || https://wiki.openstack.org/wiki/Meetings" | 16:39 | |
openstack | Meeting ended Thu Dec 7 16:39:53 2017 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:39 |
openstack | Minutes: http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-12-07-16.00.html | 16:39 |
openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-12-07-16.00.txt | 16:39 |
openstack | Log: http://eavesdrop.openstack.org/meetings/cinder_nova_api_changes/2017/cinder_nova_api_changes.2017-12-07-16.00.log.html | 16:39 |
*** mriedem has left #openstack-meeting-cp | 16:40 | |
*** yamahata has joined #openstack-meeting-cp | 16:58 | |
*** felipemonteiro_ has joined #openstack-meeting-cp | 17:06 | |
*** yamahata has quit IRC | 17:06 | |
*** harlowja has joined #openstack-meeting-cp | 17:08 | |
*** nhelgeson has joined #openstack-meeting-cp | 17:28 | |
*** brault_ has quit IRC | 17:39 | |
*** brault has joined #openstack-meeting-cp | 17:40 | |
*** brault has quit IRC | 17:45 | |
*** felipemonteiro_ has quit IRC | 18:22 | |
*** nikhil has quit IRC | 18:34 | |
*** edmondsw has quit IRC | 19:00 | |
*** felipemonteiro_ has joined #openstack-meeting-cp | 19:10 | |
*** felipemonteiro__ has joined #openstack-meeting-cp | 19:11 | |
*** felipemonteiro_ has quit IRC | 19:15 | |
*** harlowja has quit IRC | 19:21 | |
*** edmondsw has joined #openstack-meeting-cp | 19:35 | |
*** edmondsw has quit IRC | 19:39 | |
*** edmondsw has joined #openstack-meeting-cp | 19:41 | |
*** edmondsw has quit IRC | 19:45 | |
*** edmondsw has joined #openstack-meeting-cp | 19:52 | |
*** edmondsw has quit IRC | 19:56 | |
*** edmondsw has joined #openstack-meeting-cp | 19:58 | |
*** edmondsw has quit IRC | 19:58 | |
*** edmondsw has joined #openstack-meeting-cp | 19:58 | |
*** brault has joined #openstack-meeting-cp | 19:58 | |
*** edmondsw has quit IRC | 20:02 | |
*** edmondsw has joined #openstack-meeting-cp | 20:07 | |
*** edmondsw has quit IRC | 20:12 | |
*** nguyentrihai has quit IRC | 21:29 | |
*** Guest20148 has quit IRC | 21:43 | |
*** eglute has quit IRC | 21:43 | |
*** MarkBaker has quit IRC | 21:45 | |
*** Guest20148 has joined #openstack-meeting-cp | 21:48 | |
*** eglute has joined #openstack-meeting-cp | 21:48 | |
*** felipemonteiro__ has quit IRC | 21:57 | |
*** Guest20148 has quit IRC | 22:36 | |
*** eglute has quit IRC | 22:36 | |
*** Guest20148 has joined #openstack-meeting-cp | 22:42 | |
*** eglute has joined #openstack-meeting-cp | 22:42 | |
*** yamahata has joined #openstack-meeting-cp | 22:44 | |
*** felipemonteiro_ has joined #openstack-meeting-cp | 22:57 | |
*** gouthamr has quit IRC | 22:59 | |
*** markvoelker has quit IRC | 23:03 | |
*** markvoelker has joined #openstack-meeting-cp | 23:04 | |
*** MarkBaker has joined #openstack-meeting-cp | 23:05 | |
*** MarkBaker has quit IRC | 23:05 | |
*** harlowja has joined #openstack-meeting-cp | 23:07 | |
*** felipemonteiro_ has quit IRC | 23:22 | |
*** yamahata has quit IRC | 23:29 | |
*** gouthamr has joined #openstack-meeting-cp | 23:41 |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!