| opendevreview | Stanislav Dmitriev proposed openstack/nova master: Retry image download if it's corrupted https://review.opendev.org/c/openstack/nova/+/818503 | 03:07 |
|---|---|---|
| *** EugenMayer4 is now known as EugenMayer | 07:34 | |
| *** brinzhang_ is now known as brinzhang | 07:44 | |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | 07:45 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | 07:45 |
| *** akekane_ is now known as abhishekk | 07:52 | |
| opendevreview | Ilya Popov proposed openstack/nova master: Fix to use NUMA cell with free resources first https://review.opendev.org/c/openstack/nova/+/805649 | 08:22 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/os-traits master: Add a trait for remote_managed port-capable nodes https://review.opendev.org/c/openstack/os-traits/+/818514 | 08:35 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/xena: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818515 | 08:47 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/wallaby: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818519 | 09:06 |
| pslestang | Hey all | 10:27 |
| pslestang | I would like your opinion about a change I'd like to propose on instance_action | 10:28 |
| pslestang | actually instance_action are never soft-deleted even if an instance is deleted | 10:28 |
| pslestang | I'd like to propose to add an option that let the operator choose if the instance_action have to be deleted or not | 10:29 |
| pslestang | soft-deleted I mean | 10:29 |
| pslestang | something like delete_instance_actions_on_instance_delete = True/False | 10:30 |
| pslestang | we would let it to False by default to avoid breaking what's actually | 10:31 |
| pslestang | as the api call is already filtering the instance_actions that are deleted we would add the possibility to get the instance_action delete with a --deleted flag | 10:34 |
| sean-k-mooney | stephenfin: by the way you deleted xenapi 2? cycles ago but we still have os-xenapi in our requirements.txt | 11:53 |
| sean-k-mooney | https://github.com/openstack/nova/blob/master/requirements.txt#L58 | 11:53 |
| sean-k-mooney | i assume we can just delete that now | 11:53 |
| stephenfin | oh, yeah, kill it with fire | 11:53 |
| sean-k-mooney | cool will do | 11:54 |
| stephenfin | we could probably backport that too | 11:54 |
| stephenfin | I assume _dropping_ requirements is okay by stable policy | 11:54 |
| sean-k-mooney | ya it should be | 11:54 |
| sean-k-mooney | it cant possibel break anyone unless we were depending on a transitive dep | 11:55 |
| sean-k-mooney | which we shoudl not be | 11:55 |
| kashyap | pslestang: File a brief blueprint with your idea here: https://blueprints.launchpad.net/nova/+addspec | 12:06 |
| kashyap | pslestang: If you want to write something longer about the design, you can even file a quick spec so it can be granularly discussed in Gerrit | 12:08 |
| sean-k-mooney | kashyap: pslestang this woudl be an api change so a spec is always required | 12:15 |
| kashyap | sean-k-mooney: Sure. I didn't wanted to impose big barriers right up, to at least get the design rolling | 12:16 |
| sean-k-mooney | unless this is prosing a config option to alter the behavior of deleing the instance actions rows? | 12:16 |
| kashyap | Yeah, I'm not sure of that | 12:16 |
| sean-k-mooney | bauzas: the first of the off path acclerator seris looks ready for review to me https://review.opendev.org/c/openstack/nova/+/808199 perhaps we should set the RP+1 flag on that? | 13:09 |
| sean-k-mooney | bauzas: also if you are around today can you take a look at this patch form lee https://review.opendev.org/c/openstack/nova/+/811716 | 13:12 |
| sean-k-mooney | or stephenfin ^ pretty simple patch ro ewciwq | 13:13 |
| sean-k-mooney | *to review | 13:13 |
| stephenfin | sure | 13:14 |
| pslestang | kashyap: sean-k-mooney ok understood, I will create a blueprint | 13:16 |
| sean-k-mooney | pslestang: can you discirbe your intent by the way do you want the instnace action ros to be deleted when the vm is deleted or do you want them to be simple marked as deleted but still present | 13:18 |
| sean-k-mooney | pslestang: they should currently get removed when the arcive delete rows command is run i belive | 13:18 |
| pslestang | sean-k-mooney: simply marked as deleted (soft delete only) | 13:23 |
| pslestang | sean-k-mooney: indeed the instance actions rows are moved in shadow tables and deleted when archiving | 13:33 |
| sean-k-mooney | yes is that not the behavior we have today | 13:36 |
| sean-k-mooney | the instance action rows are marked as deleted (but still present) and then archive later | 13:36 |
| sean-k-mooney | and only delete when we purge deleted rows form the shadow tables | 13:36 |
| bauzas | sean-k-mooney: done and don | 13:57 |
| bauzas | done* | 13:57 |
| bauzas | sean-k-mooney: I was currently looking at my RP labels | 13:57 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/victoria: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818559 | 14:49 |
| pslestang | sean-k-mooney: the behavior we have today is that on archiving all instances and their correponding rows (so instance actions) are moved in the shadows table | 15:03 |
| pslestang | sean-k-mooney: when purging, instances and corresponding rows are deleted based on deleted_at column except for instance_actions, instance_actions_events (and task_log if I remember well) for which the deletion is based on created_at | 15:05 |
| * bauzas needs to stop earlier today as he needs to get his daughter and then going to an appointment | 15:11 | |
| bauzas | folks, have a good weekend | 15:12 |
| gibi | bauzas: o/ | 15:21 |
| gibi | same to you | 15:21 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/ussuri: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818564 | 15:33 |
| opendevreview | Gustavo Santos proposed openstack/nova master: Reattach mdevs to guest on resume https://review.opendev.org/c/openstack/nova/+/815373 | 16:05 |
| opendevreview | Stephen Finucane proposed openstack/nova master: Use unittest.mock instead of third party mock https://review.opendev.org/c/openstack/nova/+/714676 | 16:34 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/train: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818598 | 16:42 |
| opendevreview | Artom Lifshitz proposed openstack/nova master: api-ref: server rescue adminPass injection is conf-dependant https://review.opendev.org/c/openstack/nova/+/818022 | 16:50 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/stein: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818601 | 16:51 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | 16:53 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | 16:53 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/rocky: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818604 | 16:56 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/queens: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818605 | 17:00 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/rocky: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818604 | 17:05 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/queens: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818605 | 17:07 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/queens: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/818605 | 17:09 |
| opendevreview | Balazs Gibizer proposed openstack/nova stable/pike: Add a WA flag waiting for vif-plugged event during reboot https://review.opendev.org/c/openstack/nova/+/813437 | 17:13 |
| *** whoami-rajat__ is now known as whoami-rajat | 17:42 | |
| johnthetubaguy[m] | dansmith: just had a thought, if you delete a project in keystone, but now you need a project token to delete a server, the operator could get in quite a bad place now? Or is there something I am missing there? | 17:54 |
| dansmith | johnsom: hmm | 17:55 |
| johnsom | dansmith Wrong nic? o/ John | 17:56 |
| dansmith | yes, sorry | 17:56 |
| dansmith | johnthetubaguy[m]: hmm | 17:56 |
| johnsom | NP | 17:57 |
| sean-k-mooney | johnthetubaguy[m]: ya even domain scopetd tokens wont work | 17:57 |
| sean-k-mooney | cause the proejct is gone | 17:57 |
| sean-k-mooney | can we just say dont do that :P | 17:57 |
| dansmith | yeah, they'd still be able to list those instances, | 17:57 |
| johnthetubaguy[m] | ... now I think you create a project with a known uuid, but not if you deleted an old one | 17:57 |
| johnthetubaguy[m] | yeah, you can still see them and find the project uuid at least | 17:58 |
| sean-k-mooney | johnthetubaguy[m]: i tought the uuid was not user setable when creating users and proejcts | 17:58 |
| dansmith | but we'd have to have some workaround, like if you delete with a domain scoped token, use the project id of the instance while deleting or something | 17:58 |
| dansmith | I think deleing projects in keystone before the resources are cleaned up is a general problem too right? | 17:58 |
| dansmith | like, because you have to remember to do that today | 17:58 |
| johnthetubaguy[m] | sean-k-mooney: just checking, I remember it being wanted for region <-> region sync | 17:58 |
| dansmith | s/that/that cleanup/ | 17:58 |
| johnthetubaguy[m] | I mean, its about getting a token for the correct project uuid, maybe that is allowed for deleted ones in certain cases, possibly... | 17:59 |
| sean-k-mooney | dansmith: well because admin is god today i think you can fix some of those issue on a project by project basis | 17:59 |
| dansmith | sean-k-mooney: right I know today it works | 17:59 |
| sean-k-mooney | as in most porject allow you to list reouces by projects | 17:59 |
| johnthetubaguy[m] | (as an aside, why my brain thinks up these things at 6pm on a Friday, is beyond me!) | 18:00 |
| opendevreview | Gustavo Santos proposed openstack/nova master: Reattach mdevs to guest on resume https://review.opendev.org/c/openstack/nova/+/815373 | 18:00 |
| sean-k-mooney | johnthetubaguy[m]: part of the probelm is there is nothing keystone can do to prevent you deleteing the project as it never know if its in use today | 18:01 |
| sean-k-mooney | well unified limits/placment might help | 18:01 |
| johnthetubaguy[m] | yeah, its nasty, I remember the os-purge discussions in berlin (and a few other places) | 18:01 |
| sean-k-mooney | but we dont track all resouce in palcment so not really | 18:02 |
| johnthetubaguy[m] | sean-k-mooney: you are correct on the uuid thing, we don't allow that in create (yet!) https://docs.openstack.org/api-ref/identity/v3/index.html?expanded=create-project-detail#create-project | 18:02 |
| dansmith | having to re-create the project to clean up the resources is pretty gross anyway, | 18:02 |
| dansmith | so I don't know that we should depend on that for this problem | 18:02 |
| johnthetubaguy[m] | yeah, I was more fixed on: "how to get me a project xyz token again", and possible ways to do that, which might be the wrong question | 18:03 |
| dansmith | right I know | 18:04 |
| dansmith | so, even though it's a hack, | 18:04 |
| dansmith | if you show up with a domain-scoped token trying to delete an instance, | 18:04 |
| dansmith | oh actually, | 18:04 |
| sean-k-mooney | ithe issue with domain is the project is not part of the domain anymore | 18:05 |
| dansmith | I was about to say "we can do the same is this instance in this domain? yes? then delete and use context.project_id=instance.project_id" | 18:05 |
| sean-k-mooney | sicne we deleted it | 18:05 |
| opendevreview | Gustavo Santos proposed openstack/nova master: Reattach mdevs to guest on resume https://review.opendev.org/c/openstack/nova/+/815373 | 18:05 |
| dansmith | but we don't know what domain it was from | 18:05 |
| dansmith | right | 18:05 |
| sean-k-mooney | so we could start storign the domain in nova | 18:05 |
| johnthetubaguy[m] | although then if I delete a federation domain, then go whoops lots of instances, we might be back in the same problem | 18:05 |
| sean-k-mooney | then we can say ha you are a domain admin and this belogs to that domain so sure delete away | 18:06 |
| dansmith | well, right so that would be the longer-term "nova actually knows about domains" thing | 18:06 |
| johnthetubaguy[m] | I don't mind going to keystone for the project_id doesn't match and you are a domain token case, its admin, doesn't need to be that efficient? | 18:06 |
| dansmith | sean-k-mooney: yep | 18:06 |
| dansmith | johnthetubaguy[m]: but the project is gone, so we can't tell if the project is in the domain you're in | 18:06 |
| dansmith | because we can't look it up anymore | 18:06 |
| sean-k-mooney | keystone dose not allwo you to move projet between domains right | 18:07 |
| johnthetubaguy[m] | doh, of course | 18:07 |
| dansmith | (unless it's soft-deleted in keystone?) | 18:07 |
| johnthetubaguy[m] | although if you delete the domain as well? (like delete the customer that had its own domain, or delete some federation thing) | 18:07 |
| sean-k-mooney | johnthetubaguy[m]: we would need to use a system scopted token or a new type of token at that point | 18:08 |
| dansmith | johnthetubaguy[m]: even the old plan of system scoped users being god has this same problem really.. we'd still need to do something hacky to decide what project_id to record in the instance action, since that non-project god user showed up to delete it | 18:08 |
| dansmith | we'd know you have permission because you're god, but the delete would 500 today until we fix the assumption that project_id!=None | 18:09 |
| sean-k-mooney | well yes but we could use all 0 as you have suggesed before | 18:09 |
| johnthetubaguy[m] | I mean we have the all zeros project uuid to play with, but maybe this only matters to the delete call? | 18:09 |
| johnthetubaguy[m] | at least its a super edge case | 18:09 |
| dansmith | sean-k-mooney: right, point being that same hack/workaround would have been needed anyway | 18:09 |
| sean-k-mooney | yep and we also have the problem of deleteing the nova created resocues in other projects | 18:10 |
| sean-k-mooney | which might just be the vms prots | 18:10 |
| dansmith | true | 18:10 |
| sean-k-mooney | althoguh bfv so also cinder | 18:10 |
| johnthetubaguy[m] | hmm, very true | 18:10 |
| sean-k-mooney | we could use our admin token for those service if we needed too in this case but im not sure that will work | 18:11 |
| sean-k-mooney | if we assume our neutron section has a domain scoped admin token on the root domain | 18:11 |
| sean-k-mooney | since the project is gone it will still be invalid | 18:11 |
| dansmith | the whole project deletion before cleanup thing is really pretty problematic | 18:12 |
| sean-k-mooney | maybe we need to jsut check "has role admin and project does not exist" | 18:12 |
| dansmith | well, that's a good thought | 18:12 |
| dansmith | it's a little more power than you expect | 18:12 |
| sean-k-mooney | we are defineing admin now as alwasy the oeprator of the cloud right | 18:12 |
| dansmith | today all domain admins are pretty much powerful across the hierarchy until nova knows about domains itself | 18:13 |
| dansmith | so maybe that's not so bad? | 18:13 |
| johnthetubaguy[m] | how do we know the poject doesn't exist? we go check keystone in the case where context.project_id != instance.project_id ? | 18:14 |
| dansmith | you show up for the delete with a domain token, | 18:14 |
| dansmith | which means we go to do the "is this in your domain" check, | 18:14 |
| johnthetubaguy[m] | ah, only with domain tokens, right | 18:14 |
| dansmith | and if the project is 404 we assume yes | 18:14 |
| johnthetubaguy[m] | ah, right, I quite like that 🤔 | 18:15 |
| dansmith | and in the future, | 18:15 |
| dansmith | if nova starts supporting domains properly, | 18:15 |
| dansmith | we would have domain_id on the instance and would be able to drop the 404 check and just say "yep, it's in your domain, go for it" | 18:16 |
| sean-k-mooney | nova could jsut stick the domain of an instance in the instance_system_metadata tabel for now if we wanted too | 18:16 |
| sean-k-mooney | but ya | 18:16 |
| sean-k-mooney | we could start validating it | 18:16 |
| johnthetubaguy[m] | that has nice symetry with the list instances across all projects | 18:16 |
| dansmith | that will suck for listing though, which was the primary thing we said should work, so we might as well just do it properly and add it to the table | 18:17 |
| dansmith | johnthetubaguy[m]: right | 18:17 |
| sean-k-mooney | dansmith: ya we can add it to the tahble but ideally not to alot of tables | 18:17 |
| dansmith | just need it on instance | 18:18 |
| sean-k-mooney | what about the request_spec | 18:18 |
| sean-k-mooney | or other api db tablels | 18:18 |
| sean-k-mooney | we might need to stor it in the build qruest or reuest spec before we create the instnace in the cell db | 18:19 |
| sean-k-mooney | anyway we can figure that out | 18:19 |
| dansmith | well, okay maybe once in there too, I have to go refresh my memory on those.. I think we do have project (but not user?) on reqspec? | 18:19 |
| dansmith | yeah | 18:19 |
| sean-k-mooney | but it sound like we need doamin awareness sooner rater then later | 18:20 |
| sean-k-mooney | we have both https://github.com/openstack/nova/blob/master/nova/objects/request_spec.py#L69-L70 | 18:20 |
| dansmith | well, we need it for this to all work like people expect | 18:21 |
| sean-k-mooney | personally i expect that if delete your stuff in keystone first everythign is borked but yes we do | 18:21 |
| dansmith | haha | 18:21 |
| dansmith | well, that's because you're smart :) | 18:21 |
| dansmith | but I meant the expectation of domain users/admins behaving well within their domain | 18:22 |
| sean-k-mooney | i totally see how this could get messy if your not using keystone internal user manamged however | 18:22 |
| johnthetubaguy[m] | I am fairly sure, tempest just did that for me though :) | 18:22 |
| sean-k-mooney | like someone makes an active directory change when you move team | 18:22 |
| dansmith | yeah, I think it's more the projects than the users, | 18:23 |
| dansmith | but yeah totally | 18:23 |
| sean-k-mooney | huh the build request only has the project https://github.com/openstack/nova/blob/master/nova/objects/build_request.py#L43 | 18:24 |
| dansmith | [10:19:53] <dansmith> well, okay maybe once in there too, I have to go refresh my memory on those.. I think we do have project (but not user?) on reqspec? | 18:25 |
| sean-k-mooney | i would guess there arbou 3 tabels we woudl have to add it too instnace, build_requst and request spec | 18:25 |
| dansmith | I meant BR above^ because it's what we need before it's created, | 18:26 |
| dansmith | but yeah maybe reqspec too, since we use that if a cell is down I guess | 18:26 |
| sean-k-mooney | ah ya | 18:26 |
| dansmith | actually, | 18:26 |
| dansmith | we might only need it on reqspec, since I think we have that the whole time, which means we could join it to BR if we need to | 18:27 |
| dansmith | but anyway, just gotta do it, shouldn't be terrible | 18:27 |
| sean-k-mooney | yep if we have it in at least one location in the api db and cell db for each instance we shoudl be ok | 18:27 |
| dansmith | yeah | 18:28 |
| sean-k-mooney | we would need the other serivce to have the same logic however so maybe a keysotne middelware change | 18:28 |
| sean-k-mooney | regarding the "its a domain admin and the project nolonger exists" logic | 18:28 |
| sean-k-mooney | so that when we call neutron and cinder it actully works | 18:29 |
| dansmith | actually works would be good | 18:29 |
| sean-k-mooney | i missed the list dicussion | 18:29 |
| sean-k-mooney | is that server list --all-tenats | 18:30 |
| dansmith | yeah | 18:30 |
| dansmith | I gotta run do something, back later | 18:30 |
| sean-k-mooney | ok to me the simpelt way to do that is again with domain tokens and scope it to the project in that domain | 18:30 |
| sean-k-mooney | ok im going to finsih soon but ^ is how i asuemd that would work | 18:30 |
| sean-k-mooney | if you really wanted all proejct then you would use a domain token on the root domain, assuming keystone exposes that | 18:31 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Add PCI VPD Capability Handling https://review.opendev.org/c/openstack/nova/+/808199 | 20:11 |
| opendevreview | Dmitrii Shcherbakov proposed openstack/nova master: [yoga] Support remote-managed SmartNIC DPU ports https://review.opendev.org/c/openstack/nova/+/812111 | 20:11 |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!