| *** opendevtest <opendevtest!~limnoria@104.239.144.232> has joined #openstack-nova | 01:16 | |
| *** Guest1653 <Guest1653!~limnoria@104.239.144.232> has joined #openstack-nova | 01:25 | |
| *** opendevmeet` <opendevmeet`!~limnoria@104.239.144.232> has joined #openstack-nova | 01:34 | |
| *** opendevmeet <opendevmeet!~limnoria@104.239.144.232> has joined #openstack-nova | 02:00 | |
| *** alex_xu <alex_xu!uid57351@id-57351.tooting.irccloud.com> has joined #openstack-nova | 02:13 | |
| *** spatel <spatel!~spatel@c-73-89-243-254.hsd1.ma.comcast.net> has joined #openstack-nova | 02:29 | |
| *** opendevmeet <opendevmeet!~limnoria@104.239.144.232> has joined #openstack-nova | 03:04 | |
| *** spatel <spatel!~spatel@c-73-89-243-254.hsd1.ma.comcast.net> has quit IRC (Quit: My MacBook has gone to sleep. ZZZzzz…) | 03:08 | |
| *** redrobot <redrobot!~redrobot@108-84-79-198.lightspeed.snantx.sbcglobal.net> has quit IRC (Remote host closed the connection) | 03:40 | |
| *** redrobot <redrobot!~redrobot@108-84-79-198.lightspeed.snantx.sbcglobal.net> has joined #openstack-nova | 04:04 | |
| *** ricolin_ <ricolin_!~ricolin@118.150.144.205> has joined #openstack-nova | 04:31 | |
| *** abhishekk <abhishekk!~akekane@116.74.162.143> has joined #openstack-nova | 04:34 | |
| *** ricolin <ricolin!~ricolin@118.150.144.205> has quit IRC (Ping timeout: 480 seconds) | 04:35 | |
| *** luksky <luksky!~luksky@hC1F2D42A.cust.netmar.net.pl> has joined #openstack-nova | 06:09 | |
| lyarwood | melwitt: \o/ awesome thanks! | 06:17 |
|---|---|---|
| *** ralonsoh <ralonsoh!~ralonsoh@36.red-79-150-231.dynamicip.rima-tde.net> has joined #openstack-nova | 06:27 | |
| *** tosky <tosky!~luigi@dynamic-adsl-78-13-253-141.clienti.tiscali.it> has joined #openstack-nova | 07:14 | |
| *** akekane_ <akekane_!~akekane@116.74.160.116> has joined #openstack-nova | 07:16 | |
| *** rpittau|afk is now known as rpittau | 07:17 | |
| *** abhishekk <abhishekk!~akekane@116.74.162.143> has quit IRC (Ping timeout: 480 seconds) | 07:23 | |
| *** andrewbonney <andrewbonney!uid417545@id-417545.highgate.irccloud.com> has joined #openstack-nova | 07:27 | |
| *** hemna <hemna!~hemna@184.170.74.196> has quit IRC (Ping timeout: 480 seconds) | 07:29 | |
| *** kashyap <kashyap!~kashyap@nat-pool-bos-t.redhat.com> has joined #openstack-nova | 07:39 | |
| opendevreview | liujiong proposed openstack/nova master: Do not create attachment for old root volume https://review.opendev.org/c/openstack/nova/+/795950 | 07:53 |
| *** lucasagomes <lucasagomes!~lucasagom@89.100.20.18> has joined #openstack-nova | 07:56 | |
| *** martinkennelly <martinkennelly!~martinken@192.198.151.43> has joined #openstack-nova | 07:58 | |
| *** martinkennelly_ <martinkennelly_!~martinken@192.198.151.43> has joined #openstack-nova | 07:58 | |
| *** opendevstatus is now known as Guest1684 | 08:09 | |
| *** derekh <derekh!~derekh@2a01:b340:80:6d6e:6423:15e0:3703:2> has joined #openstack-nova | 08:10 | |
| *** tosky <tosky!~luigi@dynamic-adsl-78-13-253-141.clienti.tiscali.it> has quit IRC (Ping timeout: 480 seconds) | 08:13 | |
| *** mgoddard- <mgoddard-!~mgoddard@238.240.125.91.dyn.plus.net> has joined #openstack-nova | 08:14 | |
| bauzas | gibi: stephenfin: so, https://review.opendev.org/c/openstack/nova/+/795533 got a gate failure again | 08:17 |
| bauzas | can we please accept then https://review.opendev.org/c/openstack/nova/+/795744 ? | 08:18 |
| *** mgoddard <mgoddard!~mgoddard@187.240.125.91.dyn.plus.net> has quit IRC (Ping timeout: 480 seconds) | 08:18 | |
| *** mgoddard- is now known as mgoddard | 08:18 | |
| *** alistarle <alistarle!6dbefe39@107.161.19.109> has joined #openstack-nova | 08:18 | |
| *** liuyulong_ <liuyulong_!~yulong@111.202.93.98> has joined #openstack-nova | 08:23 | |
| bauzas | looking at project:openstack/nova label:Verified>=-2,Zuul -age:3d is:open we have a lot of changes getting -1 | 08:24 |
| *** liuyulong__ <liuyulong__!~yulong@111.202.93.98> has joined #openstack-nova | 08:24 | |
| *** tosky <tosky!~luigi@dynamic-adsl-78-13-253-141.clienti.tiscali.it> has joined #openstack-nova | 08:24 | |
| opendevreview | Yongli He proposed openstack/nova master: Smartnic support - cyborg drive https://review.opendev.org/c/openstack/nova/+/771362 | 08:29 |
| opendevreview | Yongli He proposed openstack/nova master: smartnic support - new vnic type https://review.opendev.org/c/openstack/nova/+/771363 | 08:29 |
| opendevreview | Yongli He proposed openstack/nova master: smartnic support https://review.opendev.org/c/openstack/nova/+/758944 | 08:29 |
| opendevreview | Yongli He proposed openstack/nova master: smartnic support - reject server move and suspend https://review.opendev.org/c/openstack/nova/+/779913 | 08:29 |
| opendevreview | Yongli He proposed openstack/nova master: smartnic support - functional tests https://review.opendev.org/c/openstack/nova/+/780147 | 08:30 |
| *** liuyulong <liuyulong!~yulong@111.202.93.98> has quit IRC (Ping timeout: 480 seconds) | 08:30 | |
| *** liuyulong <liuyulong!~yulong@111.202.93.98> has joined #openstack-nova | 08:31 | |
| *** liuyulong_ <liuyulong_!~yulong@111.202.93.98> has quit IRC (Ping timeout: 480 seconds) | 08:32 | |
| *** liuyulong__ <liuyulong__!~yulong@111.202.93.98> has quit IRC (Ping timeout: 480 seconds) | 08:33 | |
| *** Guest1685 <Guest1685!~limnoria@104.239.144.232> has joined #openstack-nova | 08:40 | |
| *** opendevstatus_ <opendevstatus_!~opendevst@104.130.70.91> has joined #openstack-nova | 08:46 | |
| *** opendevstatus_ is now known as opendevstatus__ | 08:47 | |
| *** opendevstatus__ is now known as opendevstatus___ | 08:47 | |
| *** opendevstatus___ is now known as opendevstatus____ | 08:47 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 08:48 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 08:48 | |
| *** swp20 <swp20!ab084c14@107.161.19.109> has joined #openstack-nova | 08:53 | |
| *** opendevstatus______ <opendevstatus______!~opendevst@104.130.70.91> has quit IRC (Ping timeout: 480 seconds) | 08:58 | |
| *** Guest1684 <Guest1684!~opendevst@eavesdrop01.openstack.org> has quit IRC (Remote host closed the connection) | 08:58 | |
| lyarwood | bauzas: ack I've +W'd it to chip away at the gate failures | 08:59 |
| bauzas | lyarwood: ok, I'll also provide the revert change | 09:00 |
| *** akekane_ is now known as abhishekk | 09:08 | |
| *** abhishekk <abhishekk!~akekane@116.74.160.116> has quit IRC (Quit: Bye...) | 09:08 | |
| *** opendevstatus_ <opendevstatus_!~opendevst@158.69.72.85> has joined #openstack-nova | 09:15 | |
| *** opendevstatus_ is now known as opendevstatus__ | 09:16 | |
| *** opendevstatus__ is now known as opendevstatus___ | 09:16 | |
| *** opendevstatus___ is now known as opendevstatus____ | 09:16 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 09:16 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 09:16 | |
| *** opendevstatus______ <opendevstatus______!~opendevst@158.69.72.85> has quit IRC (Ping timeout: 480 seconds) | 09:25 | |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has joined #openstack-nova | 09:33 | |
| *** brinzhang0 <brinzhang0!~brinzhang@218.29.111.74> has quit IRC (Remote host closed the connection) | 09:42 | |
| opendevreview | Sylvain Bauza proposed openstack/nova master: Revert "Removing mypy to fix the nova CI" https://review.opendev.org/c/openstack/nova/+/795973 | 09:47 |
| bauzas | lyarwood: revert is up | 09:48 |
| *** opendevmeet <opendevmeet!~limnoria@104.239.144.232> has joined #openstack-nova | 09:57 | |
| *** opendevmeet is now known as Guest1689 | 09:57 | |
| *** opendevmeet <opendevmeet!~limnoria@104.239.144.232> has joined #openstack-nova | 10:12 | |
| *** opendevstatus_ is now known as opendevstatus__ | 10:12 | |
| *** opendevstatus__ is now known as opendevstatus___ | 10:12 | |
| *** opendevstatus___ is now known as opendevstatus____ | 10:12 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 10:12 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 10:12 | |
| *** opendevmeet is now known as Guest1691 | 10:12 | |
| *** ianw is now known as opendevmeet | 10:13 | |
| *** opendevmeet is now known as ianw | 10:13 | |
| *** Guest1691 is now known as opendevmeet | 10:13 | |
| *** opendevmeet <opendevmeet!~limnoria@104.239.144.232> has joined #openstack-nova | 11:15 | |
| *** Guest1712 <Guest1712!~opendevst@104.239.144.232> has quit IRC (Remote host closed the connection) | 11:17 | |
| *** Guest1713 <Guest1713!~opendevst@149.202.169.13> has quit IRC (Ping timeout: 480 seconds) | 11:18 | |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has joined #openstack-nova | 11:19 | |
| opendevreview | Merged openstack/nova master: Removing mypy to fix the nova CI https://review.opendev.org/c/openstack/nova/+/795744 | 11:39 |
| *** opendevstatus_ <opendevstatus_!~opendevst@104.130.219.52> has joined #openstack-nova | 11:42 | |
| *** opendevstatus_ is now known as opendevstatus__ | 11:43 | |
| *** opendevstatus__ is now known as opendevstatus___ | 11:43 | |
| *** opendevstatus___ is now known as opendevstatus____ | 11:43 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 11:43 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 11:43 | |
| gibi | lyarwood, stephenfin, kashyap: rechecked https://review.opendev.org/c/openstack/nova/+/795533 as it hit https://bugs.launchpad.net/nova/+bug/1912310 | 11:51 |
| kashyap | gibi: Hi; /me clicks | 11:51 |
| gibi | the bug being "libvirt.libvirtError: unable to connect to server at" | 11:51 |
| kashyap | I guess it's the dreaded connection refused thing | 11:51 |
| kashyap | Yep | 11:51 |
| *** opendevstatus______ <opendevstatus______!~opendevst@104.130.219.52> has quit IRC (Ping timeout: 480 seconds) | 11:51 | |
| gibi | around the same time when the migration fails | 11:52 |
| gibi | there is an error | 11:52 |
| gibi | multipathd is not running: exit code None: oslo_concurrency.processutils.ProcessExecutionError: [Errno 2] No such file or directory\ | 11:52 |
| gibi | on the dest compute | 11:53 |
| gibi | I don't know if it is related but at least it correlates by time | 11:53 |
| gibi | I've added the log links to the bug | 11:53 |
| lyarwood | That shouldn't be related no | 11:55 |
| lyarwood | it's likely n-cpu fetching the connector from os-brick | 11:55 |
| lyarwood | and os-brick is checking if multipathd is present on the host | 11:56 |
| lyarwood | https://bugs.launchpad.net/nova/+bug/1931702 - FWIW I've raised this and will push a skip of the live migration with attached volume tests now | 11:57 |
| gibi | lyarwood: good stuff | 11:58 |
| gibi | lyarwood: is there a way forward with the lockup other than skiping the test? | 11:59 |
| lyarwood | gibi: yeah we don't have the complete console log as I guess it rotated | 11:59 |
| lyarwood | gibi: so I'll work out how to capture that and then raise a QEMU bug depending on what we see | 12:00 |
| gibi | ohh, OK, cool | 12:00 |
| lyarwood | gibi: as I'm assuming live migration has had some kind of impact here | 12:00 |
| kashyap | lyarwood: For the QEMU bug, do you think we have hope of reproducing this outside of the CI Gate? | 12:01 |
| *** liuyulong_ <liuyulong_!~yulong@111.202.93.98> has joined #openstack-nova | 12:01 | |
| kashyap | lyarwood: E.g. in the same Ubuntu env; same versions, migrating a paused instance -- can that do it? | 12:01 |
| lyarwood | really depends on what if anything we get back from the guestOS | 12:01 |
| kashyap | Yeah; good point | 12:01 |
| lyarwood | the instance isn't paused in this latest failure | 12:01 |
| *** liuyulong <liuyulong!~yulong@111.202.93.98> has quit IRC (Ping timeout: 480 seconds) | 12:08 | |
| masterpe[m] | I have instances in the placement.allocations table but these instances does not exists anymore. "nova-manage placement audit" does not exists on Train. And I have tryed "nova-manage placement heal_allocations" but that does not work. Can I savely deleted those records in database? | 12:12 |
| *** opendevstatus_ <opendevstatus_!~opendevst@104.130.219.164> has joined #openstack-nova | 12:13 | |
| *** opendevstatus_ is now known as opendevstatus__ | 12:14 | |
| *** opendevstatus__ is now known as opendevstatus___ | 12:15 | |
| *** opendevstatus___ is now known as opendevstatus____ | 12:15 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 12:15 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 12:15 | |
| opendevreview | Lee Yarwood proposed openstack/nova master: zuul: Skip block migration tests until bug #1931702 is resolved https://review.opendev.org/c/openstack/nova/+/795992 | 12:17 |
| opendevreview | Lee Yarwood proposed openstack/nova master: zuul: Skip block migration with attached volumes tests due to #1931702 https://review.opendev.org/c/openstack/nova/+/795992 | 12:18 |
| lyarwood | forgot to update the title sorry | 12:18 |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has quit IRC (Remote host closed the connection) | 12:18 | |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has joined #openstack-nova | 12:20 | |
| frickler | lyarwood: interesting issue, is that with cirros as guest or something else? | 12:22 |
| lyarwood | frickler: yeah it's Cirros 0.5.2 | 12:22 |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has quit IRC (Remote host closed the connection) | 12:22 | |
| *** opendevstatus______ <opendevstatus______!~opendevst@104.130.219.164> has quit IRC (Ping timeout: 480 seconds) | 12:24 | |
| *** opendevstatus <opendevstatus!~opendevst@104.239.144.232> has joined #openstack-nova | 12:27 | |
| lyarwood | ^ should give us console logs at the time we send the detach to see how borked the guestOS is | 12:32 |
| opendevreview | Lee Yarwood proposed openstack/nova master: zuul: Skip block migration with attached volumes tests due to bug #1931702 https://review.opendev.org/c/openstack/nova/+/795992 | 12:33 |
| opendevreview | Lee Yarwood proposed openstack/nova master: DNM Revert "zuul: Skip block migration with attached volumes tests due to #1931702" https://review.opendev.org/c/openstack/nova/+/795997 | 12:33 |
| lyarwood | whops, ^ there we go, git-review being slow again. | 12:33 |
| lyarwood | gibi: https://review.opendev.org/c/openstack/nova/+/792415 simple docs review if you have time btw | 12:38 |
| lyarwood | sean-k-mooney: https://review.opendev.org/c/openstack/nova-specs/+/794799 - would you mind taking a look at this? | 12:39 |
| *** opendevstatus_ <opendevstatus_!~opendevst@213.32.72.249> has joined #openstack-nova | 12:43 | |
| *** opendevstatus_ is now known as opendevstatus__ | 12:44 | |
| *** opendevstatus__ is now known as opendevstatus___ | 12:44 | |
| *** opendevstatus___ is now known as opendevstatus____ | 12:44 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 12:44 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 12:44 | |
| *** opendevstatus______ <opendevstatus______!~opendevst@213.32.72.249> has quit IRC (Ping timeout: 480 seconds) | 12:53 | |
| *** martinkennelly <martinkennelly!~martinken@192.198.151.43> has quit IRC (Remote host closed the connection) | 13:03 | |
| *** martinkennelly_ <martinkennelly_!~martinken@192.198.151.43> has quit IRC (Remote host closed the connection) | 13:03 | |
| *** martinkennelly <martinkennelly!~martinken@192.198.151.43> has joined #openstack-nova | 13:04 | |
| *** martinkennelly_ <martinkennelly_!~martinken@192.198.151.43> has joined #openstack-nova | 13:04 | |
| *** rloo <rloo!~rloo@2001:4998:ef83:17::105d> has joined #openstack-nova | 13:04 | |
| *** opendevstatus_ <opendevstatus_!~opendevst@104.130.26.53> has joined #openstack-nova | 13:13 | |
| *** opendevstatus_ is now known as opendevstatus__ | 13:15 | |
| *** opendevstatus__ is now known as opendevstatus___ | 13:15 | |
| *** opendevstatus___ is now known as opendevstatus____ | 13:15 | |
| *** opendevstatus____ is now known as opendevstatus_____ | 13:15 | |
| *** opendevstatus_____ is now known as opendevstatus______ | 13:15 | |
| *** CeeMac <CeeMac!uid366483@id-366483.brockwell.irccloud.com> has quit IRC (Quit: Connection closed for inactivity) | 13:19 | |
| *** raildo_ <raildo_!~raildo@89.38.227.174> has joined #openstack-nova | 13:20 | |
| *** raildo <raildo!~raildo@177.37.131.171> has quit IRC (Read error: Connection reset by peer) | 13:24 | |
| *** opendevstatus______ <opendevstatus______!~opendevst@104.130.26.53> has quit IRC (Ping timeout: 480 seconds) | 13:24 | |
| *** spatel <spatel!~spatel@c-73-89-243-254.hsd1.ma.comcast.net> has joined #openstack-nova | 13:26 | |
| *** artom_ <artom_!~artom@205.233.59.73> has quit IRC (Remote host closed the connection) | 13:35 | |
| *** artom_ <artom_!~artom@205.233.59.73> has joined #openstack-nova | 13:35 | |
| opendevreview | Lee Yarwood proposed openstack/nova master: libvirt: fup docs and typing for _hard_reboot flow https://review.opendev.org/c/openstack/nova/+/795081 | 13:37 |
| lyarwood | Wonderful now the nova-lvm job has failed randomly | 13:38 |
| *** artom <artom!~artom@205.233.59.73> has joined #openstack-nova | 13:40 | |
| *** artom_ <artom_!~artom@205.233.59.73> has quit IRC (Ping timeout: 480 seconds) | 13:47 | |
| *** abhishekk <abhishekk!~akekane@116.74.160.116> has joined #openstack-nova | 13:48 | |
| *** artom <artom!~artom@205.233.59.73> has quit IRC (Remote host closed the connection) | 13:50 | |
| *** artom <artom!~artom@205.233.59.73> has joined #openstack-nova | 13:51 | |
| *** spatel <spatel!~spatel@c-73-89-243-254.hsd1.ma.comcast.net> has quit IRC (Quit: Textual IRC Client: www.textualapp.com) | 13:55 | |
| gibi | sorry I was pulled downstream, surfacing now... | 14:00 |
| opendevreview | Pierre Riteau proposed openstack/nova master: Fix typos in minimum version policy docs https://review.opendev.org/c/openstack/nova/+/795575 | 14:05 |
| *** ralonsoh <ralonsoh!~ralonsoh@36.red-79-150-231.dynamicip.rima-tde.net> has quit IRC (Quit: Leaving) | 14:14 | |
| *** ralonsoh <ralonsoh!~ralonsoh@36.red-79-150-231.dynamicip.rima-tde.net> has joined #openstack-nova | 14:16 | |
| dansmith | gmann: I was looking through nova's instance-get stuff to see if and how things have changed in preparation for system scope and RBAC stuff | 14:19 |
| dansmith | and it looks to me like we're still enforcing instance.project_id==context.project_id all the way down at the db layer in model_query() | 14:19 |
| dansmith | it only does that if we're a "user context", but I'm thinking that is going to be in the way of more flexible rbac stuff, if you can't even load an instance object to check a richer policy rule | 14:20 |
| dansmith | am I right in thinking that will have to change? | 14:20 |
| gmann | dansmith: currently we do not check get instance permission for other policy check which need instance object in target, are you saying to change that to check get instance permission first? | 14:26 |
| dansmith | gmann: we don't check for "get instance permission" before doing something like an update -- that's what you mean right? | 14:27 |
| gmann | yeah | 14:27 |
| gibi | lyarwood: re: nova-lvm failure I see multiple hits of the same error in logstash but all fairly recent http://logstash.openstack.org/#dashboard/file/logstash.json?query=message%3A%5C%22WARNING%3A%20Failed%20to%20get%20udev%20device%20handler%20for%20device%20%2Fdev%2Fsda1%5C%22 | 14:27 |
| gibi | lyarwood: and apparently it is not nova-lvm specific | 14:28 |
| dansmith | gmann: okay, but the problem is.. in order to do some update type thing that we might grant in policy, we have to db.get_instance(), which will fail to find it in model_query because it filters the owner very deep | 14:28 |
| gibi | lyarwood: or did I have a wrong signature? | 14:28 |
| gmann | dansmith: i see. and that is say system admin want to update server? | 14:29 |
| gmann | or any other project member want to update some other project server? | 14:30 |
| dansmith | well, right, I'm thinking the case where you want to do something more powerful, like say "project X is under project Y, so let project Y people manage project X servers too" | 14:31 |
| gmann | humm | 14:31 |
| dansmith | which is kinda the point of the RBAC work eventually, right? to make the policy actually let people do more complicated things like that.. no? | 14:31 |
| gmann | dansmith: I think that is separate things if we want to allow than current secure RBAC which does not allow these kind of things instead restricting access | 14:33 |
| gmann | project isolation is one things in new secure rbac but your use case is opposite to that | 14:34 |
| dansmith | hrm | 14:34 |
| lyarwood | <gibi "lyarwood: or did I have a wrong "> Yeah that's correct, iirc c-vol also hit something like this so maybe that's the duplicate? | 14:35 |
| dansmith | gmann: my case is just my interpretation of what I thought the end goal was, so maybe I'm being too broad | 14:35 |
| gibi | lyarwood: I see that we hit this during update_available_resource that simply skips the update and does not cause the job failure | 14:36 |
| lyarwood | Sorry gibi, ^ was for you, somehow replied in element (matrix) and I'm not sure what that looks like in vanilla irc. | 14:36 |
| gibi | lyarwood: it quotes part of the original message so it work for me :) | 14:36 |
| gmann | dansmith: yeah because in most of the case we pass instance.project_id as target to oslo policy | 14:36 |
| gibi | lyarwood: so most of the logstash hits are actual job SUCCESS as it only hit the during periodic | 14:36 |
| gmann | dansmith: if we want to allow cross project operation we have to change that model and db things too what you mentioned | 14:37 |
| lyarwood | Cool cool, the nova-lvm failure I saw was during instance deletion | 14:37 |
| *** artom <artom!~artom@205.233.59.73> has quit IRC (Quit: Leaving) | 14:37 | |
| gibi | lyarwood: yeah, if we hit it during other operation then the test fails | 14:37 |
| lyarwood | So maybe we just need to retry on failure here | 14:37 |
| lyarwood | As it's just a basic lvs command | 14:37 |
| gibi | lyarwood: but the hit in the periodic shows that the underlying issue it temprorary as the next periodic succeeds | 14:37 |
| gibi | lyarwood: yeah, so a retry could help | 14:38 |
| lyarwood | Yup cool, I'll work on that on Monday | 14:38 |
| gibi | cool | 14:38 |
| *** artom <artom!~artom@205.233.59.73> has joined #openstack-nova | 14:38 | |
| gibi | lyarwood: should I open a bug report on it? | 14:39 |
| gibi | I have the context now | 14:39 |
| gibi | and still have time today :) | 14:39 |
| gmann | dansmith: yes, too broad :). I think in that case they should allocate that user a system token and ask to do other project things. but system to do project servers operation is another challenge what we discussded in PTG | 14:40 |
| lyarwood | I already have | 14:40 |
| opendevreview | Merged openstack/nova master: docs: Add releases to libvirt distro support matrix https://review.opendev.org/c/openstack/nova/+/792415 | 14:40 |
| lyarwood | Tagged under gate-failure | 14:40 |
| lyarwood | Sorry I thought that's what you were looking at | 14:40 |
| gibi | no problem, then I go and add more info under that | 14:41 |
| *** jangutter <jangutter!~jangutter@84.207.213.190> has joined #openstack-nova | 14:41 | |
| *** jangutter <jangutter!~jangutter@84.207.213.190> has quit IRC () | 14:42 | |
| *** hemna <hemna!~hemna@184.170.74.196> has joined #openstack-nova | 14:42 | |
| lyarwood | Cool thanks | 14:46 |
| opendevreview | Pierre Riteau proposed openstack/nova master: Fix typos in minimum version policy docs https://review.opendev.org/c/openstack/nova/+/795575 | 14:47 |
| gibi | lyarwood: is this a new type of detach error https://zuul.opendev.org/t/openstack/build/02e6a99bf1574c978c663eb434705cbb/log/controller/logs/screen-n-cpu.txt?severity=0#34810 ? | 14:50 |
| gibi | as far as I see it fails to detach from the live domain | 14:51 |
| gibi | as the device is not there any more | 14:51 |
| *** dklyle <dklyle!~dklyle@134.134.139.72> has joined #openstack-nova | 14:51 | |
| gibi | hmm, there is a DeviceRemovedEvent that was ignored :/ | 14:51 |
| gibi | sounds like a bug in the nova detach code | 14:51 |
| gibi | I will file a bug and look into the root case | 14:52 |
| *** david-lyle <david-lyle!~dklyle@jfdmzpr05-ext.jf.intel.com> has quit IRC (Remote host closed the connection) | 14:57 | |
| dansmith | gmann: sorry I got pulled away | 14:59 |
| dansmith | gmann: yeah, so I think I might be missing some keystone knowledge here.. and perhaps I'm trying to put too much capability in the projects for flexibility in terms of mapping people to abilities or somethin | 15:00 |
| gmann | dansmith: afaik, one of the point to have system admin was this -to isolate project level stuff and remove project admin which was kind of global admin before new rbac | 15:03 |
| gmann | as current project admin is admin to that project only | 15:03 |
| gmann | current i mean after new rbac | 15:04 |
| dansmith | yeah, I know that's one of the big tenets | 15:05 |
| dansmith | gmann: okay I think I've straightened myself out on the cross-project thing | 15:40 |
| dansmith | gmann: specifically related to enforcing policies in the api, I have another question | 15:41 |
| dansmith | gmann: presumably if you have some role that lets you update a resource but not show it (possible if you configure policy that way), then you could not be able to show a resource, but make some trivial update to it and get a copy of it in the result of the PUT | 15:42 |
| dansmith | I assume we would consider that acceptable because you gave that user update perms and the update call returns the resource... | 15:42 |
| dansmith | just thinking of a case where you want some script to be able to reboot an instance but not see the metadata for it which contains a license key or something | 15:43 |
| gmann | dansmith: yeah that's true. PUT has permission to show all info so they get. | 15:44 |
| dansmith | okay, I figure that's the most straightforward thing to do -- not break the result of PUT just because you don't have get perms | 15:44 |
| gmann | dansmith: in that case, we can introduce the new policy to restrict those metadata | 15:44 |
| dansmith | yeah, sure, and that's legit, but I just wonder if someone would interpret restricting get to mean "they can never see this resource any way at all" which won't be the case | 15:45 |
| gmann | dansmith: other way I think neutron does (need to check again) is check GET policy before PUT and deny if they do not have access to GET. | 15:45 |
| dansmith | meaning require get and put perms to do a PUT, or just check get perms before returning the result? | 15:46 |
| gmann | dansmith: I think yes, let me check. that is what i remember when i discussed it with amotoki in Toyko time. | 15:46 |
| dansmith | the latter may make sense, but is probably not worth it, IMHO.. the former seems wrong | 15:46 |
| *** rpittau is now known as rpittau|afk | 15:47 | |
| dansmith | write-implies-read makes sense, write-requires-read does not, IMHO | 15:48 |
| *** lucasagomes <lucasagomes!~lucasagom@89.100.20.18> has quit IRC (Quit: Leaving) | 15:56 | |
| gmann | dansmith: cannot find that, will check later | 15:56 |
| dansmith | gmann: no worries, not important at the moment, just curious | 15:57 |
| gmann | dansmith: what we can do is restrict the PUT response if GET is not permit. GET-not-permit in this case (where PUT is allowed) means do not show server info instead of no access to server | 15:58 |
| dansmith | gmann: yeah, that's the only thing that makes sense I think.. but I think you can argue that it's not worth that level of granularity | 15:59 |
| dansmith | basically, three options: 1. PUT requires GET to work at all (bad) 2. PUT will show you the result even if you don't have GET (acceptable) 3. PUT will only show you the result if you also have GET (acceptable) | 16:00 |
| dansmith | #2 is easy/default, #3 is doable | 16:00 |
| gmann | yeah, we can do #3 if anyone ask for that and have that requirement of allow-write but no-read | 16:01 |
| dansmith | ++ | 16:02 |
| opendevreview | Balazs Gibizer proposed openstack/nova master: Add debug log for device detach libvirt error https://review.opendev.org/c/openstack/nova/+/796043 | 16:14 |
| gibi | lyarwood: I think I found out that libvirt has an extra way to tell us that a device we try to detach is missing. So our handler in nova does not recognize it as VIR_ERR_DEVICE_MISSING but handles it as unexpected and blows | 16:16 |
| gibi | lyarwood: I pushed a patch that adds a debug log to show what error code libvirt returns in this case | 16:16 |
| gibi | https://bugs.launchpad.net/nova/+bug/1931716 | 16:17 |
| gmann | dansmith: i was wrong on neutron check GET permission to update resource. They check GET permission in PUT/DELETE just to decide whether to return 403 or 404 if PUT is not permitted. - https://github.com/openstack/neutron/blob/master/neutron/api/v2/base.py#L671-L685 | 16:23 |
| dansmith | gmann: ah, another interesting wrinkle | 16:23 |
| gmann | yeah :) | 16:24 |
| opendevreview | Ade Lee proposed openstack/nova master: Add check job for FIPS https://review.opendev.org/c/openstack/nova/+/790519 | 16:27 |
| *** liuyulong_ <liuyulong_!~yulong@111.202.93.98> has quit IRC (Remote host closed the connection) | 16:30 | |
| *** liuyulong_ <liuyulong_!~yulong@111.202.93.98> has joined #openstack-nova | 16:31 | |
| *** derekh <derekh!~derekh@2a01:b340:80:6d6e:6423:15e0:3703:2> has quit IRC (Quit: Leaving) | 17:00 | |
| *** abhishekk <abhishekk!~akekane@116.74.160.116> has quit IRC (Quit: Bye...) | 17:04 | |
| *** andrewbonney <andrewbonney!uid417545@id-417545.highgate.irccloud.com> has quit IRC (Quit: Connection closed for inactivity) | 17:09 | |
| *** ralonsoh <ralonsoh!~ralonsoh@36.red-79-150-231.dynamicip.rima-tde.net> has quit IRC (Quit: Leaving) | 17:19 | |
| -opendevstatus- NOTICE: Zuul is being restarted for server reboots | 17:47 | |
| *** CeeMac <CeeMac!uid366483@id-366483.brockwell.irccloud.com> has joined #openstack-nova | 17:49 | |
| *** raildo__ <raildo__!~raildo@177.37.131.171> has joined #openstack-nova | 17:56 | |
| *** raildo__ is now known as raildo | 17:57 | |
| *** raildo_ <raildo_!~raildo@89.38.227.174> has quit IRC (Ping timeout: 480 seconds) | 18:02 | |
| *** alex_xu <alex_xu!uid57351@id-57351.tooting.irccloud.com> has quit IRC (Quit: Connection closed for inactivity) | 18:07 | |
| *** david-lyle <david-lyle!~dklyle@134.134.139.72> has joined #openstack-nova | 18:44 | |
| *** dklyle <dklyle!~dklyle@134.134.139.72> has quit IRC (Remote host closed the connection) | 18:44 | |
| *** raildo <raildo!~raildo@177.37.131.171> has quit IRC (Quit: Leaving) | 19:45 | |
| *** swp20 <swp20!ab084c14@107.161.19.109> has quit IRC (Quit: Connection closed) | 19:47 | |
| *** donnyd <donnyd!sid368272@id-368272.tooting.irccloud.com> has joined #openstack-nova | 20:54 | |
| *** donnyd <donnyd!sid368272@id-368272.tooting.irccloud.com> has quit IRC () | 21:06 | |
| *** donnyd <donnyd!sid368272@id-368272.tooting.irccloud.com> has joined #openstack-nova | 21:06 | |
| *** rloo <rloo!~rloo@2001:4998:ef83:17::105d> has quit IRC (Quit: Leaving...) | 21:56 | |
| opendevreview | Ghanshyam proposed openstack/nova stable/train: DNM: testing https://review.opendev.org/c/openstack/nova/+/796070 | 22:06 |
| *** tosky <tosky!~luigi@dynamic-adsl-78-13-253-141.clienti.tiscali.it> has quit IRC () | 22:13 | |
| *** luksky <luksky!~luksky@hC1F2D42A.cust.netmar.net.pl> has quit IRC (Ping timeout: 482 seconds) | 22:16 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!