Page MenuHomePhabricator

nova.exception.GroupAffinityViolation while live-migrating tools-redis-6
Open, Needs TriagePublic

Description

I got this error in the form of a 500 from nova-api while live-migrating tools-redis-6 off cloudvirt1049: https://phabricator.wikimedia.org/P94731 using wmcs-drain-hypervisor

2026-07-06 11:27:08.061 3972 ERROR nova.conductor.manager [None req-56dedffc-25e4-4548-894f-13c8100975d3 novaadmin admin - - default default] Migration of instance 10457456-a444-49e9-9468-ffbdf5a73703 to host None unexpectedly failed.: nova.exception_Remote.GroupAffinityViolation_Remote: Anti-affinity instance group policy was violated

The VM was in ERROR state, I set it to active and tried again, this time it worked:

root@cloudcontrol1006:~# wmcs-openstack server set --state active 10457456-a444-49e9-9468-ffbdf5a73703
Resetting the server state can make it much harder to recover a server from an error state. If the server is in error st
atus due to a failed move operation then this is likely not the correct approach to fix the problem. Do you wish to continue? [y/n]:
Host cloudvirt1049.eqiad.wmnet now in maintenance mode. No new VMs will be scheduled in it.
----- OUTPUT for command #1: 'sudo -i bash -c ...r cloudvirt1049'' -----
remember, all this does is set OS_CLOUD=novaadmin
wmcs-drain-hypervisor: 2026-07-06 12:13:36,048: INFO: Igoring canary instance canary1049-6 (3e22cbd5-4ad9-4734-a621-741990648b39)
wmcs-drain-hypervisor: 2026-07-06 12:13:36,240: INFO: Migrating tools-redis-6 (10457456-a444-49e9-9468-ffbdf5a73703)
wmcs-drain-hypervisor: 2026-07-06 12:13:45,501: INFO: current status is ACTIVE; waiting for it to change to ['MIGRATING']
wmcs-drain-hypervisor: 2026-07-06 12:13:46,713: INFO: current status is MIGRATING; waiting for it to change to ['ACTIVE']
wmcs-drain-hypervisor: 2026-07-06 12:14:33,856: INFO: instance 10457456-a444-49e9-9468-ffbdf5a73703 (tools-redis-6) is now on host cloudvirt1080 with status ACTIVE

Related Objects

Event Timeline

I'm not sure there's anything immediate to do here as trying again worked. I suspect the proper and more time-intensive fix is to move away from wmcs-drain-hypervisor and onto cookbooks, either using cli or openstacksdk clients.

Following up on this, the reason seems to be use of anti-affinity vs soft-anti-affinity for the tools-redis server group. One thing to note that wasn't obvious to me: affinity policies are checked by nova-compute after a VM has landed on an host, i.e. post-scheduling (cfr https://docs.openstack.org/nova/2026.1/admin/troubleshooting/affinity-policy-violated.html). In the anti-affinity case the scheduler will retry up to scheduler.max_attempts times (now 3) though if all hypervisors have already hosts from the server group then the allocation will fail. On the other hand soft-anti-affinity is more relaxed and will allow allocation to succeed.

Indeed we seem to be using a mixture of anti-affinity policies within tools

root@cloudcontrol1006:~# wmcs-openstack server group list --os-project-id tools
+--------------------------------------+-------------------------+--------------------+
| ID                                   | Name                    | Policy             |
+--------------------------------------+-------------------------+--------------------+
| 5e12c242-34e0-400f-80ab-055cbab396fe | tools-elastic           | anti-affinity      |
| cf0d37d1-2d0e-45a0-8b93-50deb1f3431d | tools-redis             | anti-affinity      |
| 7500ccb3-d3f8-46e2-8374-3b0cb42be53e | tools-k8s-worker        | soft-anti-affinity |
| ae4b6126-71a8-4d29-a026-785155147849 | tools-ingress           | soft-anti-affinity |
| 10f8bc9a-44c2-4ece-a954-59594e3b8d8f | tools-k8s-etcd          | soft-anti-affinity |
| 44f32eb0-8ca0-4f6b-8ecd-fa5054530e71 | tools-bastion           | anti-affinity      |
| 33bc52c3-3532-4057-bdac-75a89a142151 | tools-k8s-haproxy       | anti-affinity      |
| 74b3da66-bb53-442d-bc2c-42a70e5d096b | tools-db                | anti-affinity      |
| 818fba6d-d753-48da-8a7a-aa9119278bdd | tools-nfs               | anti-affinity      |
| 3a1acfb9-f1f5-402f-a960-101a9d2e045e | tools-k8s-control       | soft-anti-affinity |
| a639e50c-c51e-4935-a5ef-89b622a3af44 | tools-k8s-worker-nfs    | soft-anti-affinity |
| 5a387f99-2701-4d0a-96f8-5ee942d6d2f1 | tools-k8s-ingress       | soft-anti-affinity |
| 09e06409-2427-4389-842c-c04fc2d4ff04 | tools-checker           | anti-affinity      |
| 8518942e-38b4-450d-99e7-3e8e700a1046 | tools-docker-registry   | anti-affinity      |
| 510b7904-b4d9-401c-8e1d-99764ab5bb24 | tools-legacy-redirector | anti-affinity      |
| f535f4b8-8450-4ffd-82c8-e4eb8c9d4924 | tools-prometheus        | anti-affinity      |
| 2f56095a-4d35-42a5-9c89-4d09096cfcc1 | tools-k8s-gateway       | soft-anti-affinity |
| 7cf8a248-5fee-4705-a8bf-6ddb62f5dfa7 | tools-cumin             | anti-affinity      |
| 5c3ae599-12fe-4f34-959e-8613c700455b | tools-opensearch        | anti-affinity      |
+--------------------------------------+-------------------------+--------------------+
root@cloudcontrol1006:~# wmcs-openstack server group list --os-project-id toolsbeta
+--------------------------------------+----------------------------+--------------------+
| ID                                   | Name                       | Policy             |
+--------------------------------------+----------------------------+--------------------+
| 227df092-04d0-4b5a-b5a8-f4ca2d7b6011 | toolsbeta-k8s-ingress      | soft-anti-affinity |
| 559b8fe5-dde0-4c14-b520-6586d151b30d | toolsbeta-k8s-control      | anti-affinity      |
| 6954b49f-74df-4ac1-942c-82d35f11b58d | toolsbeta-k8s-haproxy      | anti-affinity      |
| 17ea7576-4703-401a-a7a6-54f4c5ff286c | toolsbeta-k8s-worker       | soft-anti-affinity |
| a00cafe7-8ed1-4022-bb79-4164f5a24226 | toolsbeta-redis            | anti-affinity      |
| 64097df9-07f9-45ff-afef-0661655f8c7e | toolsbeta-elastic          | anti-affinity      |
| f67db17d-5f30-4d11-b760-f343629163ca | toolsbeta-test-k8s-etcd    | anti-affinity      |
| 51b8a026-9411-438d-86c4-cec6561bc301 | toolsbeta-test-k8s-worker  | soft-anti-affinity |
| 41c962c9-7dae-4aa0-b7c2-1a1aa00ee1f4 | webserver                  | soft-anti-affinity |
| 1c963661-d77f-424f-b6ee-623ea993df1c | toolsbeta-nfs              | anti-affinity      |
| 675f4ca3-1f4c-4b4e-aea9-037318d9a671 | toolsbeta-harbor           | anti-affinity      |
| fb6c95f1-a95f-4d0a-ba6e-1f9730eefc3c | toolsbeta                  | anti-affinity      |
| 0eb08c69-9b0f-4831-85e5-a528b81fa89d | toolsbeta-bastion          | anti-affinity      |
| 51ae6b6f-4995-4619-82e3-a59afd62fc05 | toolsbeta-k8s-worker_nfs   | soft-anti-affinity |
| d667515d-b6da-4d82-a5a2-a34296ae71c3 | toolsbeta-k8s-worker-nfs   | soft-anti-affinity |
| 5a19a9f4-d5fb-4368-94b4-8700dca27058 | toolsbeta-k8s-etcd         | soft-anti-affinity |
| 92e83b0b-63a1-43f3-9a24-2f08f18bd6be | toolsbeta-prometheus       | anti-affinity      |
| 6d861653-0d95-4c76-8019-f9cc7a68a937 | toolsbeta-test-k8s-haproxy | anti-affinity      |
| 5ebb17d6-e347-485e-8bb8-40590f360206 | toolsbeta-k8s-gateway      | soft-anti-affinity |
| 1ff74eca-f854-4391-9de9-184f9237d5b9 | toolsbeta-cumin            | anti-affinity      |
+--------------------------------------+----------------------------+--------------------+

I think we should be standardizing on soft-anti-affinity unless we have a reason not to