Friday, 2019-12-13

« Thursday, 2019-12-12 Index Saturday, 2019-12-14 »
*** avolkov has quit IRC00:03
openstackgerritKostyantyn Kalynovskyi proposed airship/airshipctl master: adding abstraction to git repositories  https://review.opendev.org/69812000:26
*** georgk72 has joined #airshipit00:36
*** georgk7 has quit IRC00:36
*** rezroo has joined #airshipit00:48
*** jamesgu has joined #airshipit03:26
*** rihabb25 has quit IRC03:37
*** georgk72 has quit IRC03:37
*** rihabb25 has joined #airshipit03:38
*** georgk72 has joined #airshipit03:38
*** timClicks has quit IRC05:30
*** roman_g has quit IRC05:31
*** jamesgu has quit IRC05:33
*** roman_g has joined #airshipit05:34
openstackgerritJenkins Uplifter proposed airship/treasuremap master: Auto chart/image uplift to latest  https://review.opendev.org/69883505:49
*** jamesgu has joined #airshipit05:51
*** jamesgu has quit IRC05:58
*** roman_g has quit IRC06:06
*** lemko has joined #airshipit06:59
*** rezroo has quit IRC08:16
openstackgerritDeepak proposed airship/airshipctl master: AIR-61 - Adding gate test in zuul for vbmc  https://review.opendev.org/69087012:31
*** pgaxatte has joined #airshipit13:29
*** alexanderhughes has joined #airshipit13:48
openstackgerritAlexander Hughes proposed airship/governance master: Grandfathered committee members clarification  https://review.opendev.org/69881013:56
*** pgaxatte has quit IRC14:17
openstackgerritDeepak proposed airship/airshipctl master: AIR-61 - Adding gate test in zuul for vbmc  https://review.opendev.org/69087014:18
openstackgerritDeepak proposed airship/airshipctl master: AIR-61 - Adding gate test in zuul for vbmc  https://review.opendev.org/69087014:36
*** nick_kar has quit IRC14:40
openstackgerritAlexander Hughes proposed airship/airshipctl master: [WIP] Minor documentation cleanup  https://review.opendev.org/69892014:44
openstackgerritAlexander Hughes proposed airship/airshipctl master: [WIP] Minor documentation cleanup  https://review.opendev.org/69892014:44
*** graysonh has joined #airshipit14:45
openstackgerritMerged airship/spyglass master: [FIX] Bug fix for template path ValueError  https://review.opendev.org/69484814:46
*** pgaxatte has joined #airshipit14:50
openstackgerritAlexander Hughes proposed airship/airshipctl master: [WIP] Minor documentation cleanup  https://review.opendev.org/69892014:52
*** jamesgu_ has quit IRC14:56
*** pgaxatte has quit IRC15:08
*** spilla has joined #airshipit15:14
*** GP_singh has joined #airshipit15:57
GP_singhHi All16:01
GP_singhI am facing an issue when I am trying to deploy a chart using armada cli from inside k8s job16:01
openstackgerritAlexander Hughes proposed airship/airshipctl master: Minor documentation cleanup  https://review.opendev.org/69892016:01
GP_singhsame thing works from inside the docker container16:02
GP_singhERROR armada.cli HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"locks.armada.process is forbidden: User \"system:serviceaccount:default:default\" cannot create resource \"locks\" in API group \"armada.process\" in the namespace16:03
GP_singh\"kube-system\"","reason":"Forbidden","details":{"group":"armada.process","kind":"locks"},"code":403}16:03
GP_singhthis is the error I get16:03
*** rezroo has joined #airshipit16:07
openstackgerritRyan Schroder proposed airship/spyglass master: Spyglass Docs Update  https://review.opendev.org/69553916:07
openstackgerritIan Pittwood proposed airship/airshipctl master: [WIP] Add document pull command  https://review.opendev.org/69895516:32
*** jamesgu has joined #airshipit16:36
openstackgerritAlexander Hughes proposed airship/airshipctl master: Minor documentation cleanup  https://review.opendev.org/69892016:38
mattmceuenhey GP_singh:  I believe that when the armada CLI is run, it leverages the user's kubeconfig - so if the user running the CLI has appropriate permissions, they're able to create the lock16:50
mattmceuenif you're running the CLI from within a Job, without the an authenticated user set up running the CLI, then I expect you'd see that error16:51
mattmceuenSo you may just  need to set up your job with an authenticated serviceaccount (or call the Armada API)16:53
mattmceuen*authorized serviceaccount16:54
*** graysonh has quit IRC17:01
GP_singhthe job is on a different cluster17:04
GP_singhand I am targeting a different cluster17:04
GP_singhI tried running kubectl command inside the k8s job as well and those seem to work17:04
*** michael-beaver has joined #airshipit17:09
mattmceuenThe error message is saying that the CLI is being run as the default serviceaccount, which doesn't have permission to create the armada lock CR (you don't want any random actor creating armada locks).  Is the kubectl command that works a readonly command like "get pods"?  Is the target cluster configured to display pods to unauthenticated users?  That might explain the behavior17:10
GP_singhI tried create some resources using kubectl as well17:11
GP_singhAs far as I understand armada uses the user mentioned under /armada/.kube/config. The file at that location has admin user details. So, should not be a problem, right?17:13
mattmceuenLet me make sure I understand -- you have two clusters, a "source" and a "target"17:17
mattmceuenThe source cluster is running a job17:17
mattmceuenThe job's container has /armada/.kube/config mounted into it, and is set up with admin credentials for the target (as opposed to the source) cluster17:17
mattmceuenKubectl is run inside the job's container, and is able to create resources in the target cluster [what kubeconfig credentials are being used for this?]17:17
mattmceuenArmada CLI is run inside the job's container, pointed at the target cluster, and you get the error indicating that the action is being attempted by system:serviceaccount:default:default ?17:17
mattmceuenIs that all accurate?17:17
GP_singhyes17:19
GP_singhthat is all correct17:20
GP_singhKubectl is run inside the job's container, and is able to create resources in the target cluster [what kubeconfig credentials are being used for this?]17:20
GP_singhto answer this17:20
GP_singhit is using the same config which is being passed to armada17:20
GP_singh$HOME/.kube/config -- where $HOME is /armada17:21
mattmceuenI have a theory what's going on:17:25
mattmceuenhttps://opendev.org/airship/armada/src/branch/master/armada/handlers/k8s.py#L43-L4617:26
mattmceuenArmada first tries to load the "in cluster config" using the kubernetes client library, and only if that fails, it tries to load "out of cluster config" from disk17:27
GP_singhoops17:27
GP_singhhow can we bypass this?17:27
mattmceuenSince you're running the cli from within a job, I bet the "source" cluster's (default) user is being used17:27
GP_singhis there a way we can force it to use the passed config?17:27
GP_singhyes that is correct17:28
GP_singhsource cluster is using default user17:28
mattmceuenI think a "force" option might require a code change to armada17:28
*** openstackgerrit has quit IRC17:29
GP_singhnothing can be done without a code change?17:29
mattmceuendwalt:  any other thoughts on this, or other good ideas besides adding a --force-kube-config options or some such17:29
mattmceuenI'm not certain where load_kube_config() gets its values from -- if it's environment variables, maybe you could just unset the right variable in your script prior to invoking Armada CLI17:31
*** openstackgerrit has joined #airshipit17:32
openstackgerritStas Egorov proposed airship/pegleg master: Uplift promenade for using containerd  https://review.opendev.org/69738917:32
GP_singhthanks Matt this was of great help :)17:32
mattmceuen(I mean, load_incluster_config)17:32
dwalt++ to everything mattmceuen has said. For reference, here is the method being called, which uses environment variables: https://github.com/kubernetes-client/python-base/blob/a2d1024524de78b62e5f9aa72d34cb9ea9de2b97/config/incluster_config.py#L8717:37
mattmceuenSure thing GP_singh - dwalt found the k8s source with the env variables to try unsetting^^17:38
mattmceuenWe want to throw one of those ConfigExceptions back to Armada, and then Armada should pull the file off the disk.  Let us know how it works for you!17:38
*** GP_singh has quit IRC17:39
openstackgerritMerged airship/airshipui master: Upgrade to octant 0.9.1  https://review.opendev.org/69485817:43
*** graysonh has joined #airshipit17:44
openstackgerriteric welch proposed airship/deckhand master: Yaml linting gates (sixth commit WIP) Change-Id: I4cf78172b71e8fa0c4de5072b51a1fd90fee595a  https://review.opendev.org/69393517:47
openstackgerritMerged airship/airshipui master: Add argo-ui as an iframe  https://review.opendev.org/69489617:51
openstackgerriteric welch proposed airship/deckhand master: Yaml linting gates (seventh commit WIP) Change-Id: I4cf78172b71e8fa0c4de5072b51a1fd90fee595a  https://review.opendev.org/69393518:18
openstackgerritMerged airship/pegleg master: Uplift promenade for using containerd  https://review.opendev.org/69738918:32
*** gp_singh84 has joined #airshipit18:43
gp_singh84Hey mattmceuen thanks for the tip18:44
gp_singh84I got around the issue18:44
*** lemko has quit IRC18:48
openstackgerritGary W. Smith proposed airship/airshipui master: Add unit tests to airshipui plugin  https://review.opendev.org/68603118:58
openstackgerritGary W. Smith proposed airship/airshipui master: Integrate golangci-lint linter  https://review.opendev.org/69739218:58
openstackgerritGary W. Smith proposed airship/airshipui master: Add gate, check jobs for zuul  https://review.opendev.org/69757018:58
mattmceuenthat's great news gp_singh8418:58
*** gp_singh84 has quit IRC19:11
*** michael-beaver has quit IRC19:37
*** rezroo has quit IRC19:43
openstackgerritSreejith Punnapuzha proposed airship/porthole master: [WIP] Fix postgresql utility  https://review.opendev.org/69112219:46
clarkbheads up I think the deckhand functional docker jobs may be failing because the become_user here https://opendev.org/openstack/openstack-helm-infra/src/branch/master/roles/deploy-docker/tasks/deploy-ansible-docker-support.yaml#L26-L37 is not valid with ansible 2.819:56
clarkbI think it was valid with ansible 2.7 but zuul recently updates its default ansible version to 2.8. You'll either want to ping ansible on those jobs to 2.7 or update OSH to push the become down into the role19:57
clarkbI don't think the OSH jobs notes though? at least they haven't run recently enough to be caught by my logstash query19:57
openstackgerritMerged airship/porthole master: Calicoctl-utility python and Ubuntu upgrade.  https://review.opendev.org/69680920:02
openstackgerritdiwakar thyagaraj proposed airship/porthole master: Etcdctl utility container image python and Ubuntu upgrades  https://review.opendev.org/69607520:16
mattmceuenthanks for the heads-up clarkb!20:18
openstackgerritIan Pittwood proposed airship/airshipctl master: [WIP] Add document pull command  https://review.opendev.org/69895520:24
*** graysonh has quit IRC20:35
*** michael-beaver has joined #airshipit20:38
openstackgerritdiwakar thyagaraj proposed airship/porthole master: Editorial changes to documentation files  https://review.opendev.org/69736820:40
openstackgerritdiwakar thyagaraj proposed airship/porthole master: Ceph-utility python and Ubuntu upgrade.  https://review.opendev.org/69681320:41
openstackgerritRyan Schroder proposed airship/spyglass master: Docker image guide  https://review.opendev.org/69901620:57
openstackgerritRyan Schroder proposed airship/spyglass master: Docker image guide  https://review.opendev.org/69901621:00
openstackgerritMerged airship/porthole master: Enable runtime-default Apparmor Profile to Postgresql Utility Container.  https://review.opendev.org/69614221:03
*** AlexNoskov has joined #airshipit21:05
openstackgerritdiwakar thyagaraj proposed airship/porthole master: Postgresql UC Python and Ubuntu upgrade.  https://review.opendev.org/69902621:37
openstackgerritMerged airship/promenade master: Ubuntu 18.04, configure chrony  https://review.opendev.org/69772222:09
openstackgerritKaspars Skels proposed airship/treasuremap master: Fix: Set proper version for curator  https://review.opendev.org/69903222:14
*** KeithMnemonic1 has joined #airshipit22:15
*** KeithMnemonic has quit IRC22:19
*** michael-beaver has quit IRC22:48
*** KeithMnemonic1 has quit IRC23:19
*** spilla has quit IRC23:24
openstackgerritMerged airship/airshipui master: Add unit tests to airshipui plugin  https://review.opendev.org/68603123:45
*** alexanderhughes has quit IRC23:47
*** jamesgu has quit IRC23:58
« Thursday, 2019-12-12 Index Saturday, 2019-12-14 »

Generated by irclog2html.py 2.15.3 by Marius Gedminas - find it at mg.pov.lt!