| openstackgerrit | Merged openstack/nova stable/queens: Fix live-migration when glance image deleted https://review.opendev.org/662154 | 00:25 |
|---|---|---|
| *** hamzy has quit IRC | 00:35 | |
| *** gyee has quit IRC | 00:37 | |
| *** ccamacho has quit IRC | 01:00 | |
| *** ccamacho has joined #openstack-nova | 01:02 | |
| *** takashin has joined #openstack-nova | 01:02 | |
| *** lbragstad has quit IRC | 01:08 | |
| *** imacdonn has quit IRC | 01:10 | |
| *** imacdonn has joined #openstack-nova | 01:11 | |
| *** hongbin has joined #openstack-nova | 01:16 | |
| *** redrobot has quit IRC | 01:17 | |
| openstackgerrit | Merged openstack/nova master: Drop pre-cinder 3.44 version compatibility https://review.opendev.org/621061 | 01:20 |
| openstackgerrit | Merged openstack/nova master: Remove mox in virt/test_block_device.py https://review.opendev.org/566153 | 01:20 |
| openstackgerrit | pengyuesheng proposed openstack/python-novaclient master: Add Python 3 Train unit tests https://review.opendev.org/668395 | 01:36 |
| *** ircuser-1 has joined #openstack-nova | 01:43 | |
| openstackgerrit | Brin Zhang proposed openstack/nova master: Specify availability_zone to unshelve https://review.opendev.org/663851 | 01:52 |
| *** ccamacho has quit IRC | 01:57 | |
| *** ccamacho has joined #openstack-nova | 01:58 | |
| *** ccamacho has quit IRC | 01:58 | |
| *** ccamacho has joined #openstack-nova | 01:59 | |
| openstackgerrit | Takashi NATSUME proposed openstack/python-novaclient master: Add a guide to add a new microversion support https://review.opendev.org/667002 | 02:07 |
| openstackgerrit | ya.wang proposed openstack/nova-specs master: Re-propose the spec to allow specifying a list of CPU models https://review.opendev.org/642030 | 02:09 |
| *** ccamacho has quit IRC | 02:21 | |
| *** ccamacho has joined #openstack-nova | 02:22 | |
| *** ccamacho has quit IRC | 02:31 | |
| *** ccamacho has joined #openstack-nova | 02:31 | |
| *** ccamacho has quit IRC | 02:36 | |
| *** ccamacho has joined #openstack-nova | 02:38 | |
| *** ccamacho has quit IRC | 02:48 | |
| *** ccamacho has joined #openstack-nova | 02:51 | |
| *** Kevin_Zheng has joined #openstack-nova | 02:55 | |
| *** ccamacho has quit IRC | 02:55 | |
| *** ccamacho has joined #openstack-nova | 02:56 | |
| openstackgerrit | Merged openstack/nova stable/queens: Move get_pci_mapping_for_migration to MigrationContext https://review.opendev.org/661571 | 03:00 |
| openstackgerrit | Merged openstack/nova stable/queens: Allow driver to properly unplug VIFs on destination on confirm resize https://review.opendev.org/661572 | 03:00 |
| *** ccamacho has quit IRC | 03:06 | |
| *** hamzy has joined #openstack-nova | 03:18 | |
| *** ccamacho has joined #openstack-nova | 03:29 | |
| *** ccamacho has quit IRC | 03:35 | |
| *** psachin has joined #openstack-nova | 03:37 | |
| *** whoami-rajat has joined #openstack-nova | 03:42 | |
| *** igordc has quit IRC | 03:51 | |
| *** bhagyashris_ has joined #openstack-nova | 04:05 | |
| *** udesale has joined #openstack-nova | 04:14 | |
| *** hongbin has quit IRC | 04:21 | |
| *** amodi has quit IRC | 04:22 | |
| *** ricolin has joined #openstack-nova | 04:25 | |
| *** dansmith has quit IRC | 05:04 | |
| *** Luzi has joined #openstack-nova | 05:12 | |
| openstackgerrit | ya.wang proposed openstack/nova-specs master: Re-propose the spec to allow specifying a list of CPU models https://review.opendev.org/642030 | 05:16 |
| *** boxiang has joined #openstack-nova | 05:16 | |
| *** dansmith has joined #openstack-nova | 05:22 | |
| openstackgerrit | Merged openstack/nova-specs master: fix the spelling mistakes https://review.opendev.org/666244 | 05:23 |
| *** yaawang has quit IRC | 05:24 | |
| openstackgerrit | Merged openstack/python-novaclient master: Add Python 3 Train unit tests https://review.opendev.org/668395 | 05:26 |
| *** guozijn has joined #openstack-nova | 05:26 | |
| *** udesale has quit IRC | 05:35 | |
| *** udesale has joined #openstack-nova | 05:36 | |
| *** ratailor has joined #openstack-nova | 05:42 | |
| *** guozijn has quit IRC | 06:01 | |
| *** spatel has joined #openstack-nova | 06:02 | |
| *** yaawang has joined #openstack-nova | 06:04 | |
| *** spatel has quit IRC | 06:06 | |
| *** artom has joined #openstack-nova | 06:16 | |
| *** luksky has joined #openstack-nova | 06:17 | |
| *** artom is now known as artom|gmtplus3 | 06:19 | |
| *** belmoreira has joined #openstack-nova | 06:24 | |
| *** slaweq has joined #openstack-nova | 06:30 | |
| *** yaawang has quit IRC | 06:34 | |
| *** yaawang has joined #openstack-nova | 06:35 | |
| *** dpawlik has joined #openstack-nova | 06:49 | |
| *** ivve has quit IRC | 06:52 | |
| *** cdent has joined #openstack-nova | 06:55 | |
| *** damien_r has joined #openstack-nova | 07:04 | |
| *** damien_r has quit IRC | 07:04 | |
| *** xek has joined #openstack-nova | 07:12 | |
| *** tssurya has joined #openstack-nova | 07:13 | |
| *** tesseract has joined #openstack-nova | 07:15 | |
| *** helenafm has joined #openstack-nova | 07:20 | |
| *** maciejjozefczyk has joined #openstack-nova | 07:27 | |
| openstackgerrit | Yongli He proposed openstack/nova master: Add server sub-resource topology API https://review.opendev.org/621476 | 07:30 |
| *** ricolin_ has joined #openstack-nova | 07:35 | |
| openstackgerrit | Josephine Seifert proposed openstack/nova-specs master: Spec for the Nova part of Image Encryption https://review.opendev.org/608696 | 07:35 |
| *** belmoreira has quit IRC | 07:37 | |
| *** ricolin has quit IRC | 07:37 | |
| *** evrardjp is now known as evrardjp_on_holi | 07:40 | |
| *** ttsiouts has joined #openstack-nova | 07:40 | |
| *** evrardjp_on_holi is now known as evrardjp_away | 07:40 | |
| *** ociuhandu has joined #openstack-nova | 07:42 | |
| *** ivve has joined #openstack-nova | 07:48 | |
| *** ricolin__ has joined #openstack-nova | 07:49 | |
| *** ricolin_ has quit IRC | 07:51 | |
| *** ttsiouts has quit IRC | 07:52 | |
| *** ttsiouts has joined #openstack-nova | 07:53 | |
| *** rpittau|afk is now known as rpittau | 07:54 | |
| *** belmoreira has joined #openstack-nova | 07:56 | |
| *** ttsiouts has quit IRC | 07:57 | |
| *** takashin has left #openstack-nova | 08:00 | |
| *** pcaruana has joined #openstack-nova | 08:01 | |
| *** ralonsoh has joined #openstack-nova | 08:02 | |
| *** luksky has quit IRC | 08:04 | |
| *** udesale has quit IRC | 08:05 | |
| *** udesale has joined #openstack-nova | 08:06 | |
| *** ratailor_ has joined #openstack-nova | 08:08 | |
| *** ratailor has quit IRC | 08:10 | |
| *** trident has quit IRC | 08:10 | |
| *** maciejjozefczyk has quit IRC | 08:12 | |
| *** trident has joined #openstack-nova | 08:13 | |
| *** yasemin has joined #openstack-nova | 08:14 | |
| yasemin | hi | 08:14 |
| yasemin | we cannot start instances after server reboot, and the error is http://paste.openstack.org/show/753740/ | 08:15 |
| yasemin | do you help me ? | 08:15 |
| openstackgerrit | Boxiang Zhu proposed openstack/nova master: Make evacuation respects anti-affinity rule https://review.opendev.org/649963 | 08:15 |
| openstackgerrit | Artom Lifshitz proposed openstack/nova master: Add neutron-tempest-iptables_hybrid job to experimental queue https://review.opendev.org/667154 | 08:17 |
| openstackgerrit | Artom Lifshitz proposed openstack/nova master: Revert resize: wait for events according to hybrid plug https://review.opendev.org/667177 | 08:17 |
| openstackgerrit | Artom Lifshitz proposed openstack/nova master: Remove finish_revert_migration() signature try/catch https://review.opendev.org/668631 | 08:17 |
| *** maciejjozefczyk has joined #openstack-nova | 08:18 | |
| *** ttsiouts has joined #openstack-nova | 08:19 | |
| *** luksky has joined #openstack-nova | 08:19 | |
| *** tkajinam has quit IRC | 08:26 | |
| *** yasemin has quit IRC | 08:27 | |
| *** yasemin has joined #openstack-nova | 08:28 | |
| yasemin | hi, i cannot start instances after server reboot, and the error is http://paste.openstack.org/show/753740/ do you help me ? | 08:29 |
| lyarwood | yasemin: I've got no idea what `16.0.13` is but make sure you have https://review.opendev.org/#/q/Iae2962bb86100f03fd3ad9aac3767da876291e74 | 08:40 |
| *** boxiang has quit IRC | 08:42 | |
| *** boxiang has joined #openstack-nova | 08:42 | |
| yasemin | <lyarwood> the bug is 2017. does it related to my problem ? | 08:43 |
| *** boxiang has quit IRC | 08:43 | |
| *** boxiang has joined #openstack-nova | 08:44 | |
| *** boxiang_ has joined #openstack-nova | 08:46 | |
| *** boxiang has quit IRC | 08:46 | |
| *** belmoreira has quit IRC | 08:52 | |
| lyarwood | yasemin: if you're using QEMU > 2.10 then maybe | 08:56 |
| lyarwood | yasemin: `16.0.13` isn't a released version of openstack-nova upstream AFAICT, it should contain that patch as it was included in actual early releases but I obviously can't tell | 08:56 |
| lyarwood | yasemin: feel free to open a bug https://launchpad.net/nova/ listing your versions of QEMU, Libvirt and where you got this version of openstack-nova. | 08:57 |
| *** ricolin_ has joined #openstack-nova | 09:04 | |
| *** tetsuro has joined #openstack-nova | 09:04 | |
| *** ricolin__ has quit IRC | 09:07 | |
| *** jaosorior has joined #openstack-nova | 09:13 | |
| *** priteau has joined #openstack-nova | 09:18 | |
| *** belmoreira has joined #openstack-nova | 09:20 | |
| *** ricolin_ is now known as ricolin | 09:33 | |
| *** udesale has quit IRC | 09:35 | |
| jrosser | lyarwood: i think that is the 16.0.13 release of openstack-ansible which pulls in this SHA of nova https://github.com/openstack/openstack-ansible/commit/f678b3d9a237a0cad229cad6cbc5fd9254b5a6f4#diff-78907cb9f0dc957a6642505f5b9c135cR150 | 09:36 |
| *** udesale has joined #openstack-nova | 09:36 | |
| *** ratailor_ has quit IRC | 09:38 | |
| *** ratailor has joined #openstack-nova | 09:40 | |
| *** whoami-rajat has quit IRC | 09:42 | |
| lyarwood | jrosser: ack thanks | 09:43 |
| lyarwood | yasemin: ^ so you should have that fix, 09593628fda7a6cb947fff34c725e3ef29889dc7 includes https://review.opendev.org/#/q/Iae2962bb86100f03fd3ad9aac3767da876291e74 | 09:43 |
| *** ricolin_ has joined #openstack-nova | 09:47 | |
| *** ricolin has quit IRC | 09:49 | |
| *** priteau has quit IRC | 09:57 | |
| *** bhagyashris_ has quit IRC | 09:58 | |
| *** tetsuro has quit IRC | 10:04 | |
| *** priteau has joined #openstack-nova | 10:07 | |
| *** psachin has quit IRC | 10:08 | |
| *** tetsuro has joined #openstack-nova | 10:10 | |
| *** boxiang_ has quit IRC | 10:10 | |
| openstackgerrit | Brin Zhang proposed openstack/nova master: Specify availability_zone to unshelve https://review.opendev.org/663851 | 10:14 |
| yaawang | Hello, could anyone review these spec? It's about expose auto-converge/post-copy and vcpu model selection :) https://review.opendev.org/651681 https://review.opendev.org/642030 | 10:17 |
| kashyap | stephenfin: You back? | 10:18 |
| kashyap | stephenfin: What is the problem in this rST snippet on the said line: http://paste.openstack.org/show/753749/ | 10:18 |
| * stephenfin looks | 10:19 | |
| stephenfin | and yes, back and not _too_ sunburnt | 10:19 |
| kashyap | Hehe | 10:19 |
| kashyap | (Hope you had a good time) | 10:20 |
| kashyap | The literal block, where do I put it on line-306? Why rST, why you do this to me... | 10:20 |
| stephenfin | 306 needs to be indented more | 10:20 |
| stephenfin | and 303 needs to take the form '(a)', I think | 10:20 |
| stephenfin | since it's not smart enough to realize that the '3.' refers to the above point | 10:21 |
| * kashyap curses under his breath | 10:21 | |
| stephenfin | though you can force the HTML to render that way, of course | 10:21 |
| kashyap | It "worked" :-( | 10:21 |
| kashyap | Let me fiddle | 10:21 |
| stephenfin | In general, I'm learning that even if it looks better in raw form with 2 or 3 spaces, you're better off using four spaces for all indentation since it's more predictable | 10:22 |
| kashyap | Yeah, I hear you | 10:23 |
| *** brinzhang has quit IRC | 10:37 | |
| *** udesale has quit IRC | 10:54 | |
| kashyap | stephenfin: Another error I don't understand :-( -- http://paste.openstack.org/show/753750/ | 10:54 |
| kashyap | I compared with another spec, and the indentation and bullets in the "History" section look exactly same | 10:55 |
| kashyap | Oh, I think I'm missing the "Introduced" keyword | 10:56 |
| cdent | efried: can you point me to a quick and dirty example of cleanly retrying a set_inventory_for_provider that's gets a generation conflict and that is being called independently . I'd like to cargo cult^w^wlearn by example if possible. | 10:56 |
| stephenfin | kashyap: Yeah, you're missing the description bullet point for the 'Train' release | 10:57 |
| stephenfin | * - Train | 10:57 |
| stephenfin | - Introduce | 10:57 |
| stephenfin | *d | 10:57 |
| kashyap | stephenfin: Yep, figured as much. Done. | 10:57 |
| kashyap | Thanks, and sorry for bothering with these trivialities. | 10:57 |
| *** udesale has joined #openstack-nova | 11:00 | |
| *** udesale has quit IRC | 11:13 | |
| openstackgerrit | Kashyap Chamarthy proposed openstack/nova-specs master: Add "Secure Boot support for KVM & QEMU guests" spec https://review.opendev.org/506720 | 11:22 |
| openstackgerrit | Huachang Wang proposed openstack/nova-specs master: We'd like to propose a way to create instance to take using of PCPU and VCPU resource in one instance. https://review.opendev.org/668656 | 11:22 |
| kashyap | johnthetubaguy: As promised yesterday, reworked: Add "Secure Boot support for KVM & QEMU guests" spec https://review.opendev.org/506720 | 11:26 |
| *** ratailor has quit IRC | 11:26 | |
| kashyap | johnthetubaguy: I added a short changelog in the Gerrit with what I addressed. | 11:26 |
| kashyap | See if that matches our conversation from our past review. | 11:26 |
| * kashyap bbiab; lunch | 11:27 | |
| openstackgerrit | Huachang Wang proposed openstack/nova-specs master: Use PCPU and VCPU in one instance https://review.opendev.org/668656 | 11:31 |
| *** yasemin has quit IRC | 11:38 | |
| alex_xu | stephenfin: so we won't support to request PCPU for the instance without numa topo in standard cpu resource tracking spec, right? | 11:39 |
| sean-k-mooney | alex_xu: that is the same as it has always been | 11:39 |
| stephenfin | alex_xu: I wasn't planning to uncouple the two features, no | 11:39 |
| alex_xu | thanks, that is what I'm expecting | 11:40 |
| *** psachin has joined #openstack-nova | 11:40 | |
| *** priteau has quit IRC | 11:41 | |
| *** jaosorior has quit IRC | 11:42 | |
| *** sapd1_x has joined #openstack-nova | 11:55 | |
| *** spatel has joined #openstack-nova | 11:58 | |
| *** spatel has quit IRC | 12:03 | |
| openstackgerrit | Martin Midolesov proposed openstack/nova master: Implementing graceful shutdown. https://review.opendev.org/666245 | 12:09 |
| *** maxbahosh3 has joined #openstack-nova | 12:09 | |
| maxbahosh3 | hi there, i have problem with numa and my flavors. | 12:10 |
| maxbahosh3 | i have 2 socket servers and 4 socket servers, and i want to set numa to user all socket for memory | 12:10 |
| maxbahosh3 | i set hw:numa_nodes='2' for 2 socket server and hw:numa_nodes='4' for 4 socket | 12:10 |
| maxbahosh3 | is it any way to configure one flavor to use for both type of servers? | 12:10 |
| *** ganso has quit IRC | 12:15 | |
| *** ganso has joined #openstack-nova | 12:16 | |
| sean-k-mooney | maxbahosh3: no | 12:16 |
| sean-k-mooney | you need two flavors or just use hw:numa_nodes=2 for all of them | 12:16 |
| sean-k-mooney | maxbahosh3: well that or just dont set hw:numa_nodes at all | 12:17 |
| sean-k-mooney | but that also means you cant use cpu pinning or hugepages | 12:17 |
| maxbahosh3 | if i use numa nodes 2, just use 2 socket and and oom maybe occur | 12:18 |
| maxbahosh3 | if not set, does it use all of socket? | 12:18 |
| sean-k-mooney | if not set it uses all soceckt | 12:19 |
| sean-k-mooney | what oom errors are you seeing | 12:19 |
| sean-k-mooney | you shoudl not see the kernel killing instances | 12:20 |
| sean-k-mooney | you may not be able to fit a vm but that would just be beacuse of the normal ttris problem | 12:20 |
| maxbahosh3 | i see oom kiiler error cause of it use one instance, use one socket | 12:21 |
| maxbahosh3 | so, i use numa node to use two socket | 12:21 |
| sean-k-mooney | that means you have not correctly reserved memoyr per numa node | 12:21 |
| maxbahosh3 | how can i reserved memory? | 12:22 |
| maxbahosh3 | do you mean reserved_host_memory_mb ? | 12:22 |
| sean-k-mooney | the oom killer runs per numa node and will be trigered whenever the kernel needs memroy on a specific numa node even if there is memory free on a different hode | 12:22 |
| sean-k-mooney | *node | 12:22 |
| sean-k-mooney | the best way to avoid this is to use hugepages | 12:23 |
| sean-k-mooney | reserved_host_memory_mb is not enough. you also neeed to use cgroups to limit the memoy available to qemu/libvirt so that it cannot use all memory on each indivigual node | 12:24 |
| maxbahosh3 | mmm, i didnt ahave any configuration for hugepages ... | 12:24 |
| sean-k-mooney | if you use vm with hugepages it will both improve teh performace of the vms and prevent the OOM issues | 12:24 |
| maxbahosh3 | do you have good tuning link for it? (i'm going to search on google) | 12:25 |
| maxbahosh3 | sean-k-mooney | 12:31 |
| maxbahosh3 | https://www.openstack.org/assets/presentation-media/performance-rhosp-summit-rmahroua2.pdf | 12:31 |
| maxbahosh3 | i found this, i think it's a good point to start this tuning. thanks a lot | 12:32 |
| *** jaosorior has joined #openstack-nova | 12:39 | |
| *** eharney has quit IRC | 12:43 | |
| *** udesale has joined #openstack-nova | 12:43 | |
| *** jaypipes has joined #openstack-nova | 12:46 | |
| *** tetsuro has quit IRC | 12:47 | |
| *** ricolin_ is now known as ricolin | 12:56 | |
| *** priteau has joined #openstack-nova | 12:58 | |
| *** luksky has quit IRC | 13:02 | |
| sean-k-mooney | gibi alex_xu just responded to https://review.opendev.org/#/c/662264/5 ill respin in an hour or two and adress the issue you raised, let me know if the repsoces make sense or if you have other question and ill adress them all as part of the respin. thanks for reviewing :) | 13:04 |
| gibi | sean-k-mooney: ack | 13:05 |
| gibi | sean-k-mooney: your responses looks good to me | 13:08 |
| sean-k-mooney | ok ill leave it as is for people to leave more feedback if the chose too and ill resping as i said in an hour or so | 13:08 |
| gibi | sean-k-mooney: cool | 13:09 |
| sean-k-mooney | in general are you ok with the feature? include the seperate RPs to make reshap simpler in the future? | 13:09 |
| openstackgerrit | Balazs Gibizer proposed openstack/nova master: Stabilize unshelve notification sample tests https://review.opendev.org/668675 | 13:10 |
| gibi | efried, mriedem: super simple test only change ^^ | 13:10 |
| *** tbachman has quit IRC | 13:12 | |
| sean-k-mooney | i need to read the commit but how is this sablising the test? | 13:12 |
| openstackgerrit | Kashyap Chamarthy proposed openstack/nova-specs master: Add "Secure Boot support for KVM & QEMU guests" spec https://review.opendev.org/506720 | 13:13 |
| *** priteau has quit IRC | 13:13 | |
| *** ccamacho has joined #openstack-nova | 13:13 | |
| kashyap | lyarwood: Hey, when you get 10-ish minutes, want to have a gander at ⮭ | 13:13 |
| *** priteau has joined #openstack-nova | 13:14 | |
| kashyap | (You looked at it previously.) I've also included a short changelog of all the things I addressed, based on johnthetubaguy's feedforward. | 13:14 |
| *** mriedem has joined #openstack-nova | 13:14 | |
| lyarwood | kashyap: ack will do | 13:16 |
| efried | sean-k-mooney: Thanks for pointing out that MKTME spec. I was expecting it to show up, but didn't see it come in for some reason, possibly because it's proposed to backlog/ and I'm focused on train/. | 13:16 |
| sean-k-mooney | oh i totally missed that | 13:17 |
| sean-k-mooney | i thought it was for train | 13:17 |
| efried | cdent: Unfortunately set_inventory_for_provider retry isn't "clean" because it goes through a dozen layers of the periodic update in the resource tracker | 13:17 |
| efried | gibi: ack | 13:17 |
| sean-k-mooney | in that case im less worried about the scope/alingment with the current sev spec | 13:18 |
| mriedem | lyarwood: melwitt: i replied about the conflicts in this queens backport https://review.opendev.org/#/c/662471/ | 13:18 |
| gibi | sean-k-mooney: yes, those test could fail if the timing is unlucky | 13:18 |
| sean-k-mooney | ya i just figured out how this fixes it | 13:18 |
| efried | cdent: oh, actually, snot so bad. set_inventory_for_provider called by update_from_provider_tree (both in report client) called by _update_to_placement (in resource tracker) | 13:18 |
| efried | cdent: _update_to_placement has the retry decorator on it. | 13:19 |
| sean-k-mooney | gibi: we are setting up the verifies but the test could end before the notificaion is sent | 13:19 |
| efried | cdent: | 13:19 |
| efried | @retrying.retry(stop_max_attempt_number=4, | 13:19 |
| efried | retry_on_exception=lambda e: isinstance( | 13:19 |
| efried | e, exception.ResourceProviderUpdateConflict)) | 13:19 |
| mriedem | lyarwood: sean-k-mooney: is stephenfin around this week? | 13:19 |
| sean-k-mooney | mriedem: he was on eairlier | 13:19 |
| sean-k-mooney | mriedem: and he does not have PTO in our team calander so i think so | 13:20 |
| gibi | sean-k-mooney: yes, to core of the issue is that instance.vm_state is set ACTIVE before the the end notification is emitted but the test only waits for the ACTIVE state | 13:20 |
| sean-k-mooney | he might be at the gym at the moment | 13:20 |
| mriedem | ok looking for answers on this queens numa live migration change https://review.opendev.org/#/c/629597/ | 13:20 |
| sean-k-mooney | mriedem: ya i was planning to bug him about that chagne today too | 13:20 |
| sean-k-mooney | mriedem: your trying to do a queens release soon right | 13:21 |
| stephenfin | mriedem: I'm here, yeah | 13:21 |
| sean-k-mooney | i would like to include that in the next queens release if we can | 13:21 |
| stephenfin | mriedem: Saw comments on a queens backport in the scrollback. I'll get to that once I've finished with this mountain of email :'( | 13:22 |
| efried | yaawang: If you like, I can update the cpu_models spec real quick | 13:23 |
| mriedem | sean-k-mooney: yes i'm flushing for a queens release | 13:24 |
| *** lbragstad has joined #openstack-nova | 13:24 | |
| mriedem | nearly there https://review.opendev.org/#/q/status:open+project:openstack/nova+branch:stable/queens+label:Code-Review=2 | 13:24 |
| *** eharney has joined #openstack-nova | 13:26 | |
| openstackgerrit | ya.wang proposed openstack/nova-specs master: Re-propose the spec to allow specifying a list of CPU models https://review.opendev.org/642030 | 13:27 |
| efried | alex_xu, stephenfin, gibi: I'm +2 on ^ if one of you wants to push it. | 13:31 |
| *** tbachman has joined #openstack-nova | 13:31 | |
| efried | kashyap: Are you convinced enough of the use case to accept this being implemented? ^ | 13:31 |
| stephenfin | efried: The spec? Has kashyap looked through that again? | 13:31 |
| stephenfin | Jinx :) | 13:31 |
| stephenfin | I'd like to look through that again myself. Can we hold off until tomorrow at least? If I don't get to it by then, carry on | 13:32 |
| efried | kashyap: note that under the latest design proposal, existing confs will continue to work, so the load on the deployer isn't as great. | 13:32 |
| sean-k-mooney | ill quickly re reivew it too now but i was ok with the usecase in the past i think | 13:32 |
| * gibi holds of +2 on cpu_modles till kashyap responds | 13:32 | |
| kashyap | efried: Will look once I address gibi's comments in my own spec | 13:33 |
| kashyap | stephenfin: ^ | 13:33 |
| efried | stephenfin, gibi, sean-k-mooney: ack, no big hurry I guess. Thanks kashyap. | 13:33 |
| sean-k-mooney | efried: its proably one of the spec we should be able to close out on today as part of the review day | 13:34 |
| kashyap | gibi: On the Secure Boot thing, fixing your remarks. My eyes are glazing over from looking at my own text. Note that the "firmware descriptor files" from QEMU are nice-to-have, but doesn't block Train | 13:34 |
| kashyap | I'll add notes there. | 13:34 |
| efried | sean-k-mooney: yeah, that was my hope :) | 13:34 |
| gibi | kashyap: ack | 13:34 |
| sean-k-mooney | efried: by the way do you have the link handy to the dashboard you created | 13:34 |
| kashyap | sean-k-mooney: I was not OK with the spec, and actually abandoned it | 13:34 |
| efried | sean-k-mooney: https://etherpad.openstack.org/p/nova-spec-review-day | 13:34 |
| sean-k-mooney | efried: thanks | 13:34 |
| kashyap | But it was re-opened, and I want to see if I can convince myself again | 13:34 |
| efried | sean-k-mooney: front matter has a couple of gerrit dashboard links. | 13:34 |
| * kashyap is talking about the CPU models thingie | 13:34 | |
| stephenfin | Is today a review day? | 13:35 |
| * stephenfin missed that mail | 13:35 | |
| stephenfin | *spec review day | 13:35 |
| sean-k-mooney | stephenfin: yes | 13:35 |
| sean-k-mooney | i think the final one for train | 13:35 |
| stephenfin | Crap. Ugh. Too much to do | 13:35 |
| efried | stephenfin: http://lists.openstack.org/pipermail/openstack-discuss/2019-June/007381.html | 13:35 |
| efried | I should have sent a reminder last night, mahbad. | 13:35 |
| sean-k-mooney | spec freeze is july 25th i think so thusday 3 weeks | 13:36 |
| stephenfin | I'll try schedule that for this evening so. Feck the emails | 13:36 |
| openstackgerrit | Theodoros Tsioutsias proposed openstack/nova-specs master: Add PENDING vm state https://review.opendev.org/648687 | 13:37 |
| alex_xu | sean-k-mooney: you want to use the min and max of inventory for the fixed size cache,right? | 13:38 |
| sean-k-mooney | sorry yes min max and step size should all be set to the same | 13:39 |
| sean-k-mooney | to prevent the fragmenation | 13:39 |
| sean-k-mooney | not just step size | 13:39 |
| lyarwood | sean-k-mooney: just posted some addition nits in the pqos spec if you're going over it still | 13:40 |
| sean-k-mooney | lyarwood: i was going to leave them build up until 1600 then adress them all | 13:40 |
| alex_xu | cool, sounds cool for me | 13:41 |
| sean-k-mooney | but yes im checking it every so often | 13:41 |
| lyarwood | sean-k-mooney: ack | 13:41 |
| sean-k-mooney | alex_xu: woudl you prefer to manage the min/max/step size via the placmenet api as i was propsoeing or should i update the spec to have a config option | 13:42 |
| kashyap | gibi: I'd need your re-ACK as I'm fixing the two other broken sentences, and add a note on the QEMU dep for nice-to-have. | 13:43 |
| efried | Is /servers/{server_id}/action Create Image (createImage Action) aka "snapshot"? | 13:44 |
| gibi | kashyap: just ping me | 13:44 |
| *** luksky has joined #openstack-nova | 13:44 | |
| gibi | kashyap: when you are ready | 13:45 |
| kashyap | alex_xu: Are you convinced of that CPU models thing? WheN I explained this spec to two QEMU maintainers, they said "don't do that" (the CPU models as list). But rather allow them setting via flavor properties, if you want | 13:45 |
| kashyap | gibi: Yep, juggling multiple things | 13:45 |
| alex_xu | sean-k-mooney: I prefer to have config option. otherwise, I'm thinking how do we deal with the update_provider_tree and the user update | 13:45 |
| *** liuyulong has joined #openstack-nova | 13:45 | |
| *** BjoernT has joined #openstack-nova | 13:45 | |
| kashyap | alex_xu: I'll comment in full, once I flush existing content to my brain's disk | 13:45 |
| sean-k-mooney | efried: the create image action i think is snapshot yes | 13:45 |
| sean-k-mooney | alex_xu: for update provider tree i planned to have nova only set them if it creating the inventory initailly | 13:46 |
| alex_xu | kashyap: as my understand, that spec doesn't helpful for your flaw mitigation case, but that spec aims to live migration case | 13:46 |
| sean-k-mooney | so update provider tree would not modify them but ill add the config option in the next version so since that is simple | 13:46 |
| kashyap | alex_xu: Yeah, I do see the use case, though. Not denying that | 13:46 |
| efried | looks like snapshot may also be used for shelve | 13:47 |
| kashyap | alex_xu: Just weighing the costs, and if it'll come to bite us in a different scenario -- as it's hard to think through _all_ the cases that might be affected here. | 13:47 |
| sean-k-mooney | efried: yes when we shelve we snapshot the root disk | 13:47 |
| sean-k-mooney | but im not sure if we only do that for shelve offload | 13:48 |
| sean-k-mooney | or if it happens on shelve | 13:48 |
| *** Luzi has quit IRC | 13:50 | |
| *** Jeffrey4l_ has joined #openstack-nova | 13:50 | |
| *** BjoernT_ has joined #openstack-nova | 13:52 | |
| openstackgerrit | sean mooney proposed openstack/nova master: [DNM] testing bug/1813789 revert resize events https://review.opendev.org/664442 | 13:53 |
| openstackgerrit | Artom Lifshitz proposed openstack/nova master: [DNM] testing bug/1813789 revert resize events https://review.opendev.org/664442 | 13:53 |
| *** mlavalle has joined #openstack-nova | 13:53 | |
| sean-k-mooney | jinx | 13:54 |
| *** Jeffrey4l has quit IRC | 13:54 | |
| *** BjoernT has quit IRC | 13:55 | |
| *** helenafm has quit IRC | 13:56 | |
| artom|gmtplus3 | Dammit, 11 seconds | 13:57 |
| sean-k-mooney | i did it via the gerrit ui | 14:00 |
| sean-k-mooney | given the gate lag time it makes no difference :) | 14:01 |
| *** maxbahosh3 has quit IRC | 14:05 | |
| gibi | sean-k-mooney: replied in https://review.opendev.org/#/c/668675 | 14:05 |
| kashyap | gibi: A small heads-up: I've also fixed two more small things related to content moving. I'll append a short summary of changes for convenience, once the docs compile locally. | 14:07 |
| gibi | kashyap: OK, I will look at the diff | 14:07 |
| sean-k-mooney | gibi: oh wiat thost are not test they are test helper functions because they are prefixed wtih _ | 14:08 |
| gibi | sean-k-mooney: yeah, they are steps of a biiig test case | 14:08 |
| sean-k-mooney | so _test_shelve_and_shelve_offload_server is beeing invoked elsewhere | 14:08 |
| sean-k-mooney | ah ok in that case your change makes sense i missed that | 14:09 |
| gibi | sean-k-mooney: it is invoked exactly before _test_unshelve_server() | 14:09 |
| sean-k-mooney | i was wondering why you were doing extra work when you did not need too | 14:09 |
| openstackgerrit | Kashyap Chamarthy proposed openstack/nova-specs master: Add "Secure Boot support for KVM & QEMU guests" spec https://review.opendev.org/506720 | 14:09 |
| gibi | sean-k-mooney: this is the test case https://review.opendev.org/#/c/668675/1/nova/tests/functional/notification_sample_tests/test_instance.py@342 | 14:09 |
| sean-k-mooney | well in that case i dont think you need to do the unshelve right? | 14:10 |
| sean-k-mooney | you are doing an extra unchelve and shelve that are not needed | 14:10 |
| kashyap | gibi: When you can: done. Posted the shortlog as well. | 14:10 |
| openstackgerrit | Stephen Finucane proposed openstack/nova stable/stein: Ignore hw_vif_type for direct, direct-physical vNIC types https://review.opendev.org/667354 | 14:10 |
| openstackgerrit | Stephen Finucane proposed openstack/nova stable/rocky: Ignore hw_vif_type for direct, direct-physical vNIC types https://review.opendev.org/667355 | 14:11 |
| openstackgerrit | Stephen Finucane proposed openstack/nova stable/rocky: Ignore hw_vif_type for direct, direct-physical vNIC types https://review.opendev.org/667355 | 14:11 |
| sean-k-mooney | gibi: if _test_shelve_and_shelve_offload_server left it shelved and _test_unshelve_server required a shelved server it would speed up the test case | 14:11 |
| gibi | sean-k-mooney: I could skip that but then instance would be in SHELVED case between the steps and that would ruin the generic pre-condition of the test steps enforced in https://review.opendev.org/#/c/668675/1/nova/tests/functional/notification_sample_tests/test_instance.py@384 | 14:12 |
| *** _alastor_ has joined #openstack-nova | 14:12 | |
| gibi | sean-k-mooney: I could combine the two test step | 14:13 |
| sean-k-mooney | i see | 14:13 |
| gibi | kashyap: ack | 14:13 |
| kashyap | Thanks a ton. | 14:13 |
| * kashyap now looks at the CPU model spec | 14:13 | |
| sean-k-mooney | into a _test_shelve_shelve_offload_unshelve_server | 14:13 |
| sean-k-mooney | ya that would be more efficent | 14:14 |
| *** helenafm has joined #openstack-nova | 14:14 | |
| sean-k-mooney | and it would not violate the pre/post condition that the server is active between all steps | 14:15 |
| sean-k-mooney | gibi: that said, these are fucntional tests | 14:16 |
| sean-k-mooney | so we are not actully snapshoting the server and uploading it to glance and then restoring it | 14:16 |
| gibi | kashyap: I'm +2 on the secure boot | 14:16 |
| sean-k-mooney | so what you have is proably fine for the fake driver/fake libvirt whichever we are actully using | 14:16 |
| kashyap | gibi: Thank you. And FWIW, I'm giving a "semi-strong +1" to to the CPU models thing, with a note. | 14:16 |
| gibi | kashyap: thanks | 14:17 |
| kashyap | As I don't want to block it any further, and we can hash out the details in the implementation. | 14:17 |
| gibi | kashyap: ack | 14:18 |
| *** maxbahosh has joined #openstack-nova | 14:21 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/queens: Fail to live migration if instance has a NUMA topology https://review.opendev.org/629597 | 14:25 |
| openstackgerrit | Matt Riedemann proposed openstack/nova stable/queens: fix up numa-topology live migration hypervisor check https://review.opendev.org/648939 | 14:25 |
| mriedem | lyarwood: can you hit https://review.opendev.org/#/c/629597/ ? | 14:26 |
| *** maxbahosh has quit IRC | 14:29 | |
| mriedem | coreycb: can you ack this? https://review.opendev.org/#/c/668680/ | 14:30 |
| *** redrobot has joined #openstack-nova | 14:33 | |
| efried | kashyap: Did you forget to hit save or are you still composing? | 14:41 |
| kashyap | efried: Forgot to hit save, bad me. A sec | 14:42 |
| kashyap | Oh, I went noting some grammar nit, and then two other people pinged and got distracted | 14:42 |
| kashyap | efried: Done. | 14:43 |
| efried | thanks kashyap | 14:43 |
| kashyap | We can hash out the technical details (and surely we'd want to do some some robust functional testing _and_ post the results in the review for posterity/record) | 14:43 |
| kashyap | ... in the implementation. | 14:44 |
| kashyap | It's a +0.8. | 14:44 |
| kashyap | efried: If you feel like fixing the grammar edit & re-ACK it; if you don't want to bother, also fine. | 14:46 |
| efried | kashyap: I'm not being that picky anymore. | 14:47 |
| kashyap | Can fully understand. It's just my OCD. | 14:48 |
| kashyap | That's why I never -1 such things (unless it hampers reading, or is too sloppy). | 14:48 |
| *** _alastor_ has quit IRC | 14:52 | |
| *** zbr has quit IRC | 14:53 | |
| efried | kashyap: I've started blithely posting patch sets on other people's changes to correct grammar before I review for content. | 14:53 |
| kashyap | efried: So you wanted to amend that behaviour? :-) | 14:54 |
| kashyap | Can understand | 14:54 |
| efried | alex_xu: if you're around, would you like the +W on https://review.opendev.org/#/c/642030/ ? Else I'll push it in a bit. | 14:54 |
| *** zbr has joined #openstack-nova | 14:54 | |
| *** _alastor_ has joined #openstack-nova | 14:55 | |
| kashyap | yaawang: Hi, please copy me on the impl of that 'cpu_models' thing. Happy to work out the details. | 14:55 |
| * kashyap might miss it in the sea of notifications | 14:55 | |
| * gibi has a notification for the word notification :D | 14:55 | |
| kashyap | LOL | 14:57 |
| kashyap | (Sorry) | 14:57 |
| *** evrardjp_away has quit IRC | 14:58 | |
| *** evrardjp has joined #openstack-nova | 14:59 | |
| *** edmondsw_ has joined #openstack-nova | 15:04 | |
| *** spatel has joined #openstack-nova | 15:04 | |
| spatel | sean-k-mooney: morning | 15:04 |
| sean-k-mooney | spatel: o/ | 15:04 |
| *** gyee has joined #openstack-nova | 15:04 | |
| spatel | I have testing my new openstack cloud, i have spun vm-1 but i am not seeing any live migration option in drop down menu | 15:05 |
| gibi | kashyap: it is the remains of time I worked on versioned notifications a lot | 15:05 |
| sean-k-mooney | spatel: that sound like a horizon issue | 15:05 |
| spatel | hmm! | 15:06 |
| sean-k-mooney | im not sure how that is displayed but i would not expect horizon to be able to tell if live migration is uspported | 15:06 |
| sean-k-mooney | we do not have a api you can query to discover that | 15:06 |
| kashyap | gibi: Yeah, guessed as much :-) | 15:07 |
| sean-k-mooney | we just have teh endpoint to do a migration which can succeed or fail wehn you call it | 15:07 |
| kashyap | sylvainb: Quite active discussion on that 'mdevctl' thread on libvirt upstream thread | 15:07 |
| kashyap | Err, bauzas: | 15:07 |
| kashyap | (I see that you wanted to try it, 'mdevctl' in Nova. Haven't caught up with the rest of the KM-long thread there, though.) | 15:08 |
| spatel | sean-k-mooney: oh wait, when i logged in as admin i can see live migration | 15:09 |
| sean-k-mooney | spatel: yes live migration is admin only | 15:09 |
| spatel | its not available for end-user | 15:09 |
| sean-k-mooney | spatel: yep the only action an endupser can do that might casue a migration to happen is resize | 15:10 |
| spatel | yes they do have re-size option but not live, i think this is good because we don't want end user do live migration without understanding | 15:11 |
| sean-k-mooney | yep | 15:11 |
| spatel | sean-k-mooney: how do i evacuate single VM? is it something only available in command line? | 15:12 |
| sean-k-mooney | proably. yes | 15:13 |
| sean-k-mooney | you have to use the nova cli instead of opentasck one | 15:13 |
| openstackgerrit | Balazs Gibizer proposed openstack/nova master: Stabilize unshelve notification sample tests https://review.opendev.org/668675 | 15:13 |
| gibi | efried, mriedem: reported bug and fixed up the commit message ^^ | 15:15 |
| efried | gibi: +2, thanks. | 15:15 |
| gibi | efried: thank you | 15:15 |
| efried | yahyoubetcha | 15:15 |
| *** tbachman has quit IRC | 15:16 | |
| *** ivve has quit IRC | 15:17 | |
| *** liuyulong has quit IRC | 15:22 | |
| spatel | sean-k-mooney: let me try and see.. i am running test on cpu-pining live migration using evacuate | 15:23 |
| *** cdent has quit IRC | 15:24 | |
| *** sapd1_x has quit IRC | 15:28 | |
| *** ttsiouts has quit IRC | 15:31 | |
| sean-k-mooney | spatel: it should just be "nova evacuate <server>" and optioncally you can also proved a host as teh last postional arg. | 15:32 |
| sean-k-mooney | since you are on shared stoarge however you need to ensure the vm is stoped and the compute service is disabled before you do the evacuate | 15:33 |
| spatel | oh wait compute service disabled? | 15:37 |
| *** tbachman has joined #openstack-nova | 15:38 | |
| sean-k-mooney | you cant evacuate form a host where the compute service is enabled | 15:38 |
| sean-k-mooney | spatel: if the compute node is healty then you should jsut do a cold migration | 15:38 |
| sean-k-mooney | cold migration wtih cpu pinning works as intended | 15:39 |
| spatel | and cold migration support CPU-pining and hugepage | 15:39 |
| sean-k-mooney | yep | 15:39 |
| sean-k-mooney | for cold migration we generate a new xml on the destintion node so it works correctly | 15:39 |
| *** tssurya has quit IRC | 15:40 | |
| sean-k-mooney | the bug for livemigration is while we caulate a new toplogy for the destination node we dont regenerate teh xml so we move teh vm bug still pin it as if it was on the souce node as we are using the xml form the source node instead of generating a new one for the destination node | 15:41 |
| *** helenafm has quit IRC | 15:52 | |
| *** cdent has joined #openstack-nova | 15:54 | |
| *** artom|gmtplus3 has quit IRC | 15:56 | |
| *** wwriverrat has quit IRC | 16:09 | |
| *** gyee has quit IRC | 16:12 | |
| *** BjoernT_ is now known as BjoernT | 16:16 | |
| *** rpittau is now known as rpittau|afk | 16:21 | |
| *** gyee has joined #openstack-nova | 16:25 | |
| adrianc | Hi, any chance I can bother one of the fine cores here for a review for a FUP https://review.opendev.org/#/c/659101/ , already has a +2 from stephenfin :) | 16:35 |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Clean up test_virtapi https://review.opendev.org/667419 | 16:36 |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Add VirtAPI.update_compute_provider_status https://review.opendev.org/668706 | 16:36 |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: libvirt: manage COMPUTE_STATUS_DISABLED for hypervisor connection https://review.opendev.org/668707 | 16:36 |
| *** spatel has quit IRC | 16:45 | |
| efried | adrianc: done | 16:45 |
| efried | except for the "fine" part | 16:45 |
| openstackgerrit | Merged openstack/nova-specs master: Re-propose the spec to allow specifying a list of CPU models https://review.opendev.org/642030 | 16:47 |
| *** priteau has quit IRC | 16:48 | |
| *** udesale has quit IRC | 16:49 | |
| sean-k-mooney | jaypipes: hehe that was an old pull request :) | 16:51 |
| *** luksky has quit IRC | 16:53 | |
| jaypipes | sean-k-mooney: lol, doing some housecleaning :) | 16:56 |
| *** tesseract has quit IRC | 17:01 | |
| efried | jroll: you back today? | 17:02 |
| *** ricolin_ has joined #openstack-nova | 17:05 | |
| *** ricolin has quit IRC | 17:07 | |
| openstackgerrit | sean mooney proposed openstack/nova-specs master: add libvirt pqos spec https://review.opendev.org/662264 | 17:08 |
| sean-k-mooney | lyarwood: ^ is the updated versions | 17:08 |
| *** belmoreira has quit IRC | 17:09 | |
| sean-k-mooney | hum looks like i need to fix the diagram | 17:13 |
| jroll | efried: yep, hi! | 17:14 |
| efried | jroll: Wanna talk TPM? | 17:14 |
| jroll | efried: gimme 15, in a meeting atm | 17:14 |
| *** ricolin_ has quit IRC | 17:14 | |
| efried | sho | 17:14 |
| openstackgerrit | Balazs Gibizer proposed openstack/nova master: nova-manage: heal port allocations https://review.opendev.org/637955 | 17:14 |
| efried | I await thy ping | 17:14 |
| *** ociuhandu_ has joined #openstack-nova | 17:14 | |
| *** ociuhandu_ has quit IRC | 17:15 | |
| *** ociuhandu has quit IRC | 17:18 | |
| gibi | efried, mriedem: I think I'm done with the heal port allocation rework based on your comments. (except two change in a followup) | 17:20 |
| efried | ack | 17:20 |
| * gibi has left the building | 17:21 | |
| openstackgerrit | sean mooney proposed openstack/nova-specs master: add libvirt pqos spec https://review.opendev.org/662264 | 17:24 |
| sean-k-mooney | ok fixed the ascii diagram | 17:24 |
| openstackgerrit | Merged openstack/nova master: Un-safe_connect and publicize get_providers_in_tree https://review.opendev.org/668062 | 17:28 |
| jroll | efried: am free now | 17:30 |
| efried | o/ | 17:31 |
| efried | So what do you know about this "reboot required" business? I was able to confirm that from several sources. | 17:31 |
| sean-k-mooney | im going to go have food so ill be away for the next hour or so. ill be back later | 17:31 |
| sean-k-mooney | efried: reboot requried? | 17:31 |
| efried | And are you caught up with what penick was saying about "oh, just leave it to us to manage the state of the TPM" | 17:31 |
| efried | sean-k-mooney: talking to jroll about TPM stuff. Go do your food thing :) | 17:32 |
| jroll | efried: I wasn't aware a hypervisor reboot was required until you were. and I think I'm caught up with penick? | 17:33 |
| sean-k-mooney | oh im guessing after a guest has finished using a tpm and we delete teh guest the TPM is unaviaoble until after a reboot? and yep its time for breakfest/lunch/dinner brb | 17:33 |
| *** ociuhandu has joined #openstack-nova | 17:33 | |
| efried | correct sean-k-mooney. Either unavailable, or still has the old VM's secrets in it. | 17:33 |
| efried | jroll: So what penick is saying, IIUC, is that we should blindly pass the TPM through, and worry about the orchestration layer to know what's on it at any given time. I.e. nova doesn't do any prep or checking or clearing or ownership assigning. | 17:34 |
| efried | That sounds like a pretty big security risk to me. Kind of doubt it's going to fly, design-wise, with the Nova maintainers. | 17:35 |
| dansmith | how is that not a terrible idea? | 17:35 |
| efried | yeah | 17:35 |
| dansmith | I mean, I get that it's the minimum required effort to get what you want, but... | 17:35 |
| dansmith | doesn't seem like a smart decision at all | 17:35 |
| jroll | right, it seems like our use case would be long-running VMs | 17:36 |
| sean-k-mooney | efried: that is not too unsuerpising. older gpus had the same issue. unless the uefi firmware is specificlay coded to handel it pci passthou deveice can become unusable until they are reset ususally that reuires a host reboot. | 17:36 |
| jroll | and/or these hosts would only be accessible by this tenant | 17:36 |
| sean-k-mooney | and now that i have my phone back to cooking | 17:36 |
| jroll | I'm not sure I agree that we should just let nova blindly land stuff on a TPM without checking it, fwiw | 17:37 |
| *** ociuhandu has quit IRC | 17:38 | |
| jroll | I haven't thought through what it would take to have nova track if a TPM is 'usable' or not | 17:38 |
| efried | Right. That's Nova abdicating a pretty serious burden of responsibility to the unknown upper layer. I mean, we have trust models in place that are a certain shape and this really seems to be breaking outside of that shape. | 17:38 |
| efried | so given that that approach is likely to be -many, unless there's some other place we can go with this, we're probably going to have to declare it dead in the water. (aka "downstream it if you really need it") | 17:38 |
| dansmith | I'd like to see more uses for it | 17:39 |
| jroll | I assume assigning some sort of TPM_DIRTY trait isn't going to fly, right? | 17:39 |
| dansmith | while I feel for the situation of trying to push people to vms by providing things that look like hardware, the "single long-lived vm per host" use case doesn't hold much weight for me | 17:40 |
| efried | jroll: If we were going to remove it from service via placement-ism, we would probably use the reserved=total trick. | 17:40 |
| efried | rather than a trait | 17:40 |
| jroll | dansmith: that's fair. the reason we would do this on a VM instead of bare metal is for neutron security groups, boot from volume, etc | 17:41 |
| efried | (and btw, implied in your question and my response is: one RP per TPM) | 17:41 |
| dansmith | but we also need to know how to clean it and I think that depending on placement as a persistence mechanism for something like this is an abuse.. it'd be too easy for an operator to just delete that allocation not knowing why it's there, only to have us hand the tpm to something else | 17:41 |
| jroll | or rather, that's why the "single long-lived vm per host" is a somewhat valid use case for us | 17:42 |
| *** ralonsoh has quit IRC | 17:42 | |
| *** bbowen has quit IRC | 17:42 | |
| jroll | efried: I guess I'm not deep enough in nova to offer suggestions on how to manage this, I'll have to dig around some and maybe come back and talk about it | 17:45 |
| jroll | unless "tracking the state of the hyp" is 100% not going to happen for something like this | 17:45 |
| efried | jroll: We would have to do it with an external file of some kind. | 17:46 |
| efried | unless there's a way to know by querying the device | 17:46 |
| efried | or sysfs or whatever | 17:46 |
| jroll | hmm ok | 17:46 |
| efried | but sysfs is unlikely to track instance UUID for us | 17:47 |
| dansmith | efried: I think you mean the database | 17:47 |
| dansmith | efried: we don't need to introduce a new persistence mechanism on the host for this as a one-off thing | 17:47 |
| efried | dansmith: Yeah, that would work :) | 17:47 |
| dansmith | sysfs is ephemeral, so it's definitely not going to help us here :) | 17:48 |
| efried | there would have to be some kind of db manage command to manually clear the state | 17:48 |
| efried | because, like, we can't assume it's clear on a reboot or a compute service startup or whatever. | 17:48 |
| dansmith | it's specifically not supposed to be clear on reboot | 17:49 |
| efried | it's supposed to be: purge, reboot, now it's clear so manually say it's clear. | 17:49 |
| dansmith | and if you're suggesting that we hand out tpms to an instance, and then when that instance is deleted, we're stuck until the operator manually clears the tpm and then frees it up with a manage command, | 17:49 |
| dansmith | that's crazypants | 17:49 |
| efried | yup, it would have to be that. | 17:49 |
| efried | And I agree. | 17:49 |
| dansmith | that's implementing half a feature because some guy asked for it and is fine with the manual cleanup | 17:49 |
| dansmith | I'm -5 on that | 17:49 |
| efried | (my earlier estimate of -many wasn't too far off then) | 17:50 |
| efried | yeah, the right way to do this is vTPM | 17:50 |
| efried | but as currently implemented that's not secure because the Master Key is stored on the hypervisor's disk. | 17:50 |
| dansmith | yeah, solving it properly is making that more reasonable I think | 17:51 |
| dansmith | which seems quite doable | 17:51 |
| efried | They're figuring out some way around that in qemu, but it hasn't happened yet, so this was an attempt to work around it until that's available. | 17:51 |
| dansmith | mmhmm | 17:51 |
| *** gyee has quit IRC | 17:52 | |
| efried | So jroll, it's really looking like this isn't going to happen, upstream, in this way. If there's enough $motivation$ to make it happen downstream anyway, let me know and I can advise a bit on the nova-isms and placement-isms that would need to be hacked together. | 17:53 |
| jroll | efried: thanks | 17:54 |
| *** amodi has joined #openstack-nova | 17:55 | |
| efried | adrianc: whoops, https://review.opendev.org/#/c/659101/ is in merge conflict now. Since you're going to need a new PS anyway, want to take care of those couple of nits? | 17:56 |
| *** gyee has joined #openstack-nova | 18:06 | |
| *** luksky has joined #openstack-nova | 18:08 | |
| openstackgerrit | Stephen Finucane proposed openstack/nova-specs master: Add 'flavor-extra-spec-image-property-validation-extended' spec https://review.opendev.org/638734 | 18:09 |
| * cdent giggles every time he sees "Master Key" | 18:09 | |
| stephenfin | efried: Tackled those comments on the extra spec validation spec. Lemme know if what I want to do wrt key validation is not clearer now | 18:13 |
| *** igordc has joined #openstack-nova | 18:13 | |
| * stephenfin -> 🏉 | 18:14 | |
| efried | ack | 18:14 |
| *** cdent has quit IRC | 18:17 | |
| *** markguz_ has joined #openstack-nova | 18:22 | |
| markguz_ | hi all. Anyone out there got any experience with using NPIV and pci passthrough for share Fiber Channel HBAs amongst vms? | 18:22 |
| markguz_ | i want to share the VFs but am not really clear on how it might be done. | 18:23 |
| markguz_ | most if not all of the docs seem to focus on networking virtual functions | 18:23 |
| markguz_ | there is a type=VF but i'm not clear how to share the vport | 18:28 |
| openstackgerrit | Eric Fried proposed openstack/nova-specs master: Add PENDING vm state https://review.opendev.org/648687 | 18:34 |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Add a rbd_connect_timeout configurable https://review.opendev.org/667421 | 18:38 |
| *** hongbin has joined #openstack-nova | 18:44 | |
| openstackgerrit | Eric Fried proposed openstack/nova master: [FUP] Follow-up patch for SR-IOV live migration https://review.opendev.org/659101 | 18:52 |
| efried | adrianc: ftfy ^ | 18:54 |
| efried | stephenfin: if you're still around, trivial re+A ^ | 18:54 |
| *** xek has quit IRC | 19:08 | |
| openstackgerrit | Merged openstack/nova-specs master: Add PENDING vm state https://review.opendev.org/648687 | 19:09 |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Update COMPUTE_STATUS_DISABLED from set_host_enabled compute call https://review.opendev.org/668743 | 19:14 |
| mriedem | dansmith: could use another opinion here https://review.opendev.org/#/c/668743/1/nova/compute/manager.py@5047 | 19:20 |
| dansmith | mriedem: do I need to read it or can I just give you an opinion? | 19:23 |
| mriedem | like, cats > dogs? | 19:23 |
| mriedem | sure | 19:23 |
| dansmith | pizza > cookies | 19:24 |
| mriedem | i'd agree with that | 19:24 |
| mriedem | https://sallysbakingaddiction.com/chocolate-chip-cookie-pizza/ | 19:24 |
| mriedem | a love child | 19:24 |
| *** panda has quit IRC | 19:27 | |
| dansmith | mriedem: okay I'm not sure I get it | 19:28 |
| dansmith | we have this set_host_enabled call already yeah? | 19:28 |
| dansmith | and the base virt driver does what when you call it? raise not implemented? | 19:29 |
| mriedem | yes, only used by the os-hosts api which was deprecated in 2.43 and only implemented by the xenapi driver | 19:29 |
| mriedem | yes | 19:29 |
| *** maciejjozefczyk has quit IRC | 19:29 | |
| dansmith | oh, I see, different from service disable yeah? | 19:29 |
| mriedem | yes, | 19:29 |
| dansmith | right right, okay | 19:29 |
| mriedem | but i'm going to use it for service disable/enable in the api change | 19:29 |
| dansmith | yeah | 19:29 |
| dansmith | so, | 19:29 |
| *** panda has joined #openstack-nova | 19:30 | |
| dansmith | the thing you're concerned about is replicating the 501 "this thing doesn't support that" case for libvirt and v2.1? | 19:30 |
| mriedem | it's a minor concern, but yeah | 19:30 |
| dansmith | I guess I'm not sure why that matters.. the fact that libvirt does or doesn't support the thing has nothing to do with microversion 2.1 (or any version) | 19:30 |
| mriedem | the version really only matters b/c the api no longer works with 2.43+ | 19:31 |
| mriedem | for any driver | 19:31 |
| dansmith | okay but.. why does it matter if someone calls it with v2.1 on libvirt and it works? | 19:31 |
| mriedem | because it's a behavior change... | 19:31 |
| dansmith | it's not | 19:31 |
| dansmith | it's an implementation detail | 19:31 |
| dansmith | if the thing (which the user can't see) supports it, it works, and if not it's 501 | 19:32 |
| mriedem | or 400 if i just return None | 19:32 |
| dansmith | they can't see that libvirt didn't support it before, got a 501, and that either now it does support it, or some other driver is being used | 19:32 |
| mriedem | in this case the user == admin anyway, | 19:33 |
| mriedem | so another reason why it's a minor concern for me | 19:33 |
| dansmith | right, but this is not necessarily an admin user that has visibility into the hypervisor details | 19:33 |
| *** _mlavalle_1 has joined #openstack-nova | 19:33 | |
| dansmith | this could be a level-1 lab monkey that needs to disable a host to go blow dust out of the fans or something | 19:34 |
| dansmith | anyway, just saying I don't think we should tie behavior of a microversion to a version of the implementation underneath when the behavior and semantics haven't changed | 19:34 |
| mriedem | sure. if you don't think anything needs to change that's fine with me. would appreciate a comment in the review for if/when someone comes along saying it's a change. | 19:35 |
| mriedem | also note the api ref is pretty clear to not use that api https://developer.openstack.org/api-ref/compute/?expanded=update-host-status-detail#update-host-status | 19:35 |
| dansmith | will | 19:35 |
| *** mlavalle has quit IRC | 19:37 | |
| *** ivve has joined #openstack-nova | 19:40 | |
| openstackgerrit | Lee Yarwood proposed openstack/nova master: libvirt: Remove unreachable native QEMU iSCSI initiator config code https://review.opendev.org/668750 | 19:46 |
| *** factor__ has joined #openstack-nova | 19:54 | |
| *** bnemec has quit IRC | 19:54 | |
| *** icarusfactor has quit IRC | 19:56 | |
| *** mmethot has quit IRC | 20:04 | |
| *** mmethot has joined #openstack-nova | 20:05 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Add placement request pre-filter compute_status_filter https://review.opendev.org/668752 | 20:07 |
| *** bnemec has joined #openstack-nova | 20:07 | |
| *** factor__ has quit IRC | 20:14 | |
| *** eharney has quit IRC | 20:15 | |
| *** factor has joined #openstack-nova | 20:16 | |
| *** factor has quit IRC | 20:18 | |
| *** factor has joined #openstack-nova | 20:24 | |
| *** tssurya has joined #openstack-nova | 20:37 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Refactor HostAPI.service_update https://review.opendev.org/668756 | 20:42 |
| *** psachin has quit IRC | 20:42 | |
| melwitt | efried, jroll, dansmith: fwiw, an idea we had when I chatted with penick about the TPM thing was tracking the "TPM availability" outside of placement using a scheduler filter and a new compute stat. the compute stat would be something like 'tpm_project_id' and defaults to None. and the scheduler filter passes a host only if 'tpm_project_id' is None or matches project_id [if a tpm is requested]. and then in nova-compute, set | 20:50 |
| melwitt | 'tpm_project_id' compute stat to the project_id when a tpm request lands on the host. and the 'tpm_project_id' stat gets cleared during init_host | 20:50 |
| *** evrardjp has quit IRC | 20:51 | |
| efried | melwitt: Except for that last bit. Having restarted the compute service does *not* mean the TPM is clear and ready for use by someone else. The only way we can know that bit is if the admin tells us so. | 20:51 |
| melwitt | the only caveat I was thinking here is that init_host doesn't guarantee a reboot happened | 20:52 |
| efried | just so | 20:52 |
| melwitt | yeah | 20:52 |
| efried | and a reboot doesn't guarantee the TPM was cleared. | 20:52 |
| *** evrardjp has joined #openstack-nova | 20:52 | |
| melwitt | oh, ok, I didn't know that or misunderstood | 20:52 |
| sean-k-mooney | is there any reason we cant wipe the tpm directly when we delete a vm that is using it | 20:52 |
| efried | a reboot is required, but not sufficient. You had to have done some kind of purgey command prior | 20:53 |
| melwitt | sean-k-mooney: from what penick said, that is not possible | 20:53 |
| melwitt | efried: I see | 20:53 |
| sean-k-mooney | efried: is a reboot requried or can we do a device reset | 20:53 |
| sean-k-mooney | i have not looked into it but i know fo bios based gpus a reboot was required | 20:53 |
| efried | I don't know whether "purgey command" is "device reset" or what, but you have to reboot the host for it to be reusable. | 20:54 |
| sean-k-mooney | for uefi based gpus a deivce reset was enough | 20:54 |
| sean-k-mooney | it could depend on the type of tpm you have | 20:54 |
| sean-k-mooney | there are several diffeerent tpm types | 20:54 |
| efried | how would we know? | 20:54 |
| sean-k-mooney | that are connect over different buses | 20:54 |
| *** ttsiouts has joined #openstack-nova | 20:55 | |
| mriedem | sure sounds like hardware management that nova shouldn't be doing... | 20:56 |
| sean-k-mooney | im not sure https://en.wikipedia.org/wiki/Trusted_Platform_Module#TPM_implementations | 20:56 |
| sean-k-mooney | i think descret tp0ms and maybe the integrated tpm in the intel chips set can be passthed through | 20:57 |
| sean-k-mooney | the firware and software one obviosly cant be | 20:57 |
| efried | mriedem, melwitt: in case y'all weren't silently following along, here's the earlier conversation with jroll and dansmith: http://eavesdrop.openstack.org/irclogs/%23openstack-nova/%23openstack-nova.2019-07-02.log.html#t2019-07-02T17:30:56 | 20:57 |
| mriedem | efried: i saw it | 20:57 |
| mriedem | and agreed with the -5 comment | 20:58 |
| efried | k | 20:58 |
| *** mmethot has quit IRC | 20:58 | |
| melwitt | efried: yeah, I mentioned what I did bc I read it | 20:58 |
| efried | k | 20:58 |
| efried | thanks for the followup | 20:58 |
| melwitt | at the very least for any potential downstream-only endeavor | 20:58 |
| *** pcaruana has quit IRC | 20:58 | |
| *** mmethot has joined #openstack-nova | 20:58 | |
| *** eharney has joined #openstack-nova | 20:59 | |
| sean-k-mooney | i takeign booting windows to run the clear-tpm powershell commadn is not a thing we cand do :) https://docs.microsoft.com/en-us/powershell/module/trustedplatformmodule/clear-tpm?view=win10-ps | 20:59 |
| sean-k-mooney | its rare that all the hits i get in google are for windows | 21:00 |
| melwitt | if there were a way we could query the tpm device to know whether it's clear/ready, then IMO it seems similar enough to pci passthrough and not so bad | 21:00 |
| melwitt | but since there's not, then I agree it doesn't fit | 21:00 |
| sean-k-mooney | apparent there is a tpm_clear command | 21:01 |
| mriedem | we have also done a poor job at times of tracking allocated pci devices | 21:01 |
| sean-k-mooney | just reading https://resources.infosecinstitute.com/linux-tpm-encryption-initializing-and-using-the-tpm/#gref | 21:02 |
| openstackgerrit | Merged openstack/nova stable/rocky: libvirt: Rework 'EBUSY' (SIGKILL) error handling code path https://review.opendev.org/667436 | 21:02 |
| mriedem | e.g. https://review.opendev.org/#/q/I6e871311a0fa10beaf601ca6912b4a33ba4094e0 | 21:02 |
| melwitt | aye | 21:02 |
| sean-k-mooney | it looks like clearing the tpm makes it unowned and disablses it which requries a reboot to fix | 21:03 |
| melwitt | yeah, that's what efried was saying earlier. it's a two-step deal | 21:03 |
| sean-k-mooney | ya diging a bit deeper it looks like linux cant actully clear teh tpm its self for security reason and its actully the uefi on reboot that is clearing it | 21:06 |
| *** rdopiera has quit IRC | 21:06 | |
| sean-k-mooney | so ya based on that i think this is a non starter | 21:06 |
| sean-k-mooney | we we need to do is impove qemu to make vTPM more secure by not storign the encryption key on the host | 21:07 |
| sean-k-mooney | perhaps by storign it in the host tpm | 21:07 |
| sean-k-mooney | or barbacan or some other keystore | 21:07 |
| melwitt | yeah, qemu enhancement is needed. I'm not sure if that's on their radar already. could ask kashyap maybe | 21:08 |
| efried | it is | 21:09 |
| efried | just not going to be ready in time for T | 21:10 |
| melwitt | ah ok | 21:10 |
| *** ivve has quit IRC | 21:10 | |
| *** eharney has quit IRC | 21:22 | |
| *** bnemec has quit IRC | 21:25 | |
| *** bnemec has joined #openstack-nova | 21:27 | |
| sean-k-mooney | efried: gibi so have we talked about how we handel move operations for the encryped image spec https://review.opendev.org/#/c/608696/8/specs/train/approved/image-encryption.rst@285 | 21:31 |
| sean-k-mooney | i would be in faovr of supporting this as an experimenal feature without them but im hopping at least cold migraiton and live migration might work | 21:32 |
| sean-k-mooney | rescue,shelve and cross cell resize might be tricker | 21:33 |
| sean-k-mooney | if we have snapshot working it shoudl be possibel to support them however | 21:33 |
| efried | sean-k-mooney: I wouldn't expect this to affect lifecycle operations | 21:33 |
| efried | because the change is in the image processing layer | 21:34 |
| sean-k-mooney | well for rescuse we are temporaily booting the instance with a different image but we still need to be able to decypt its disks | 21:34 |
| efried | The disk is not encrypted at that point. | 21:34 |
| efried | this isn't like LUKSing the boot disk. | 21:35 |
| sean-k-mooney | and for shelve/cross cell resize we need to ensure we create encrypted snapshots for encrypted instances | 21:35 |
| efried | This is encrypting it in glance. It gets decrypted when it's copied into the instance's storage. | 21:35 |
| sean-k-mooney | the instaces storage is also encrypted | 21:35 |
| sean-k-mooney | its not stored decyped on the compute node | 21:35 |
| efried | um | 21:35 |
| efried | then I wildly misunderstood the spec | 21:36 |
| sean-k-mooney | "Using encrypted storage backends for volume and compute hosts in conjunction | 21:36 |
| sean-k-mooney | with direct data transfer from/to encrypted images can enable workflows that | 21:36 |
| sean-k-mooney | never expose an image's data on a host's filesystem. | 21:36 |
| sean-k-mooney | " | 21:36 |
| efried | right, but "using encrypted storage backends" is not part of this spec | 21:37 |
| efried | that's already supported | 21:37 |
| *** maciejjozefczyk has joined #openstack-nova | 21:37 | |
| *** ttsiouts has quit IRC | 21:37 | |
| sean-k-mooney | right but that means on the host the iamge is still encrypted as its streamed into an encpted file | 21:38 |
| sean-k-mooney | so when you do a nova rescue and you boot form a different image you still need to pass the encyption key to qemu so it can open that encypted file a use it | 21:39 |
| efried | Not "still encrypted". decrypted to clear, then re-encrypted with a different key (and possibly a different algorithm, etc) | 21:39 |
| efried | so yes, *if* your storage backend is encrypted, regardless of whether you're using *image* encryption (this feature), then you'll need to manage slinging keys around. | 21:40 |
| sean-k-mooney | the decypted to clear happens in memory. but when i was referign to still encrypted i ment after it was re encrypted | 21:40 |
| efried | I'm saying they're separate and unrelated. | 21:40 |
| sean-k-mooney | ok so long as that all works that is cool | 21:40 |
| efried | I think | 21:40 |
| sean-k-mooney | i just was suprised that it was never mention in the spec | 21:40 |
| sean-k-mooney | i could cahcne my +1 to a -1 i guess until josephine seifert replies to confirm but i whould have expect this to at least be mentioned in the spec if all it was is "it jsut works" | 21:43 |
| *** maciejjozefczyk has quit IRC | 21:47 | |
| *** tssurya has quit IRC | 21:50 | |
| *** Kevin_Zheng has quit IRC | 22:06 | |
| *** luksky has quit IRC | 22:06 | |
| mriedem | dansmith: you know how this set_host_enabled is a blocking rpc call? if this is an ironic compute service managing 1000 compute nodes (1000 resource providers) and we have to sync the trait on all of them, i'm not sure if that would take more than 60 seconds but it might - thinking this change should use the long_rpc_timeout for that call now - agree? | 22:12 |
| *** ttsiouts has joined #openstack-nova | 22:16 | |
| *** ttsiouts has quit IRC | 22:21 | |
| mriedem | weee looks like the gate is crapping itself too atm | 22:21 |
| openstackgerrit | Merged openstack/nova-specs master: Policy Default Refresh spec https://review.opendev.org/547850 | 22:23 |
| *** BjoernT has quit IRC | 22:23 | |
| dansmith | mriedem: yeah makes sense to make it a long rpc call | 22:26 |
| dansmith | mriedem: even for the single compute case, if placement is bogged or something, we could still take a while to set the trait | 22:26 |
| openstackgerrit | Merged openstack/nova stable/queens: Restore connection_info after live migration rollback https://review.opendev.org/662471 | 22:31 |
| mriedem | melwitt: can you hit this remaining queens backport? https://review.opendev.org/#/c/629597/ | 22:35 |
| * melwitt clicks | 22:36 | |
| openstackgerrit | Merged openstack/nova-specs master: Spec: Use OpenStack SDK in Nova https://review.opendev.org/662881 | 22:47 |
| sean-k-mooney | heh if only the rest of the repo had a 10 minute merge trun around time | 22:50 |
| *** panda has quit IRC | 22:52 | |
| *** panda has joined #openstack-nova | 22:59 | |
| *** tkajinam has joined #openstack-nova | 23:02 | |
| *** _mlavalle_1 has quit IRC | 23:06 | |
| *** hongbin has quit IRC | 23:06 | |
| openstackgerrit | Matt Riedemann proposed openstack/nova master: Sync COMPUTE_STATUS_DISABLED from API https://review.opendev.org/654596 | 23:06 |
| mriedem | it is done https://review.opendev.org/#/q/topic:bp/pre-filter-disabled-computes+(status:open+OR+status:merged) | 23:07 |
| *** slaweq has quit IRC | 23:07 | |
| openstackgerrit | Merged openstack/nova-specs master: Libvirt: add vPMU spec for train https://review.opendev.org/651269 | 23:08 |
| sean-k-mooney | mriedem: as in you have split it out int different patches and its now ready for review? | 23:09 |
| mriedem | hells yeah | 23:09 |
| mriedem | it's glorious | 23:09 |
| sean-k-mooney | cool im poking at similar code for my own prefilter stuff so ill see if ther are any trick i shoudl "borrow" form my onw stuff | 23:10 |
| sean-k-mooney | mriedem: did you drop the custom trait stuff since os-tratis 1.15 is released | 23:10 |
| mriedem | yes | 23:11 |
| mriedem | technically efried did that for me | 23:11 |
| sean-k-mooney | cool | 23:11 |
| *** markguz_ has quit IRC | 23:13 | |
| *** mriedem has quit IRC | 23:20 | |
| *** jdillaman has quit IRC | 23:58 | |
Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!