This is technical dead end and not something we're going to be able to
support long-term in pbr. We need to push users away from this. Doing so
highlights quite a few place where our docs need some work, particularly
in light of the recent removal of the eventlet servers.
Change-Id: I2ffaed710fac2612f5337aca5192af15eab46861
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
When retrieving multiple - or all - server groups, the code tries to
find not deleted members for each server group in every cell
individually. This is highly inefficient, which is especially noticable
when the number of server groups rises.
We change this to query all members of all server-groups we will reply
with (i.e. from the already limited list) in advance and pass this set
of existing uuids into the function formatting the server group. This is
more efficient, because we only do one large query instead of up to 1000
times the number of cells.
Change-Id: I3459ce7a8bec9a9e6f3a3b496a3e441078b86af0
Signed-off-by: Johannes Kulik <johannes.kulik@sap.com>
Partial-Bug: #2122109
Currently there is no handling for this case so if we get a HTTP 403
from Barbican for a permission error, a very long multi-layered
traceback gets logged in nova-compute. This can happen if an admin
tries to start an instance with vTPM belonging to a different user, for
example.
This adds some basic error handling for this case. Most of the logged
traceback consists RPC oslo.messaging content, so the new
VTPMSecretForbidden exception is added as an expected exception to the
compute manager methods we expect users are more likely to encounter
such as build, start, and reboot.
Other compute manager methods where VTPMSecretForbidden can be raised
are resize, resume, restore, and delete but we will leave these as-is
and let them log tracebacks because we expect them to be rare.
Change-Id: I2ef6df818ed3f63efe2ff9b333c97928d4efa18d
Signed-off-by: melanie witt <melwittt@gmail.com>
Like the image property, it can have the `user`, `host`, or
`deployment` value. Use this opportunity to also add unit testing for
the previous TPM extra specs, hw:tpm_model and hw:tpm_version.
NOTE(artom) The spec used hw:vtpm_secret_security, this patch uses
hw:tpm_secret_security (without the v) to align with the existing
extra specs (and image properties).
Implements: blueprint vtpm-live-migration
Change-Id: Ie6495bef7a2a782d4c70eae7f8ff685afe8fe93a
Signed-off-by: melanie witt <melwittt@gmail.com>
When CONF.log_options = True, we dump the config to the DEBUG log and
it can help with debugging issues to see whether a config has been
applied or not. Currently, the log is dumped before other options in
the pipeline are registered, such as the keystonemiddleware.auth_token
options in the [keystone_authtoken] config section.
This moves the conf dumping code after the WSGI app is loaded in order
to reflect more config options in the debug log.
Change-Id: I53d36b68d7942bc65a85fbe314a7f0baa6124343
Signed-off-by: melanie witt <melwittt@gmail.com>
Placement implemented a workaround optimization for large provider
trees. This patch enables that optimization to run the pci_in_placement
related nova functional tests with this config enabled.
Change-Id: I0b5e13673cb4cc7c57aeae50914ace443dfc18fa
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
When using the weigher, we need to target the right cell context for the
existing instances in the host.
fill_metadata was also having an issue as we need to pass the dict value
from the updated dict by keying the instance uuid, not the whole dict of
updated instances.
Change-Id: I18260095ed263da4204f21de27f866568843804e
Closes-Bug: #2125935
Signed-off-by: Sylvain Bauza <sbauza@redhat.com>
Currently, it also catches semaphores, timeouts,
and event-related items.
Change-Id: Ibdaf6a107fbc7678fe514005ff1ea8bc5b8031c8
Signed-off-by: Kamil Sambor <kamil.sambor@gmail.com>
Make sure that the 'mapped' field of compute nodes is reset
to 0 at nova-compute service deletion.
To let nova-manage create the missing host mapping in nova_api
database.
Closes-Bug: #2085135
Change-Id: I774d4312d7e94af94d960f7269717a00fa08c583
Signed-off-by: Julien Le Jeune <julien.le-jeune@ovhcloud.com>
The weigher is unable to get the right image metadata for existing
instances if they are not already on the HostState.
Change-Id: I5bccf854662ecffe1d469bacc6e4afcb746d6b4d
Signed-off-by: Sylvain Bauza <sbauza@redhat.com>
Currently, vTPM secrets are deleted from Barbican any time instance
disks are deleted when driver.destroy() is called. This is fine if the
instance is also being deleted but if it's not, such as during a resize
revert, it will fail with the following error:
nova.exception.Invalid: Refusing to create an emulated TPM with no
secret!
which will bubble up to the API as a HTTP 500.
This moves deletion of the vTPM secret from Barbican from the libvirt
driver destroy() path to the compute manager _delete_instance() path so
that the vTPM secret is deleted only if the instance is being deleted.
Closes-Bug: #2125030
Change-Id: I1a43dc0502e1e65b4ef0348610f5eddb43dbff02
Signed-off-by: melanie witt <melwittt@gmail.com>
We have a centralized nova.utils.cooperative_yield() instead of
time.sleep(0). It is better as it allows to turn off the sleep calls
when the service runs in threaded mode.
Change-Id: I625daec79ee5b7f8b92116f450e21f997cef0546
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
This reproduces the bug where an attempt to revert a resize from a
flavor with vTPM to a different flavor with vTPM results in the revert
failing and the instance going into ERROR state when storage is not
shared.
Because of the lack of test coverage of vTPM with non-shared storage,
this change also just adds a subclass to run all of the vTPM functional
tests with the test environment mocked to behave as though storage is
not shared between compute hosts.
A bug fix will follow these functional tests.
Related-Bug: #2125030
Change-Id: I49745a8ba78e1ea6a1b009bccab32a002cb6afb0
Signed-off-by: melanie witt <melwittt@gmail.com>
Previous patches removed direct eventlet usage from nova-conductor so
now we can run it with native threading as well. This patch documents
the possibility and switches both nova-conductor process to native
threading mode in the nova-next job.
Change-Id: If26c0c7199cbda157f24b99a419697ecb6618fa6
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
Replace the remaining time.sleep calls use to trigger eventlet yield
to the existing nova.utils.cooperative_yield() call. This will help
us to disable such yielding in when the service is running in threading
mode and eventually drop the whole thing when nova removes eventlet.
Change-Id: I6b3fcba13f4d1c41d1fac2efe3cb4a943e66f8bb
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
There is two intermittently failing tests we need to ignore for now so
this patch extends the list.
Closes-Bug: #2125185
Change-Id: I8d440013c84ae1dac4e2a1f661fc31138944b032
Signed-off-by: Balazs Gibizer <gibi@redhat.com>
Creating a new admin context as we can't reuse the RequestSpec user
context in order to hydrate InstanceList with the full list of instances
from the host and not only the ones from the user.
Closes-Bug: #2125052
Change-Id: Ibbd80324c17be6546ecd8b80f908ac5bbab5abd0
Signed-off-by: Sylvain Bauza <sbauza@redhat.com>
Stephen Finucane