Friday, 2015-08-07

*** Haomeng has joined #kolla00:03
*** achanda_ has quit IRC00:03
*** achanda has quit IRC00:05
*** Haomeng|2 has quit IRC00:05
*** diogogmt has quit IRC00:07
*** gfidente has quit IRC00:14
*** zhiwei has joined #kolla00:20
*** weiyu has quit IRC00:20
*** shadower has quit IRC00:23
*** banix has joined #kolla00:26
*** Haomeng|2 has joined #kolla00:37
*** Haomeng has quit IRC00:40
*** dolpher has joined #kolla00:46
*** dims_ has quit IRC00:53
*** weiyu_ has joined #kolla01:06
*** dims_ has joined #kolla01:09
jpeeleris there supposed to exist a kollaglue/centos-rdo-kolla-ansible image?01:11
*** dims__ has joined #kolla01:15
*** dims__ has quit IRC01:16
*** dims_ has quit IRC01:17
*** dims_ has joined #kolla01:18
*** mfalatic has quit IRC01:21
*** mfalatic_ has joined #kolla01:21
*** erkules has joined #kolla01:21
*** erkules_ has quit IRC01:23
*** jasonsb has joined #kolla01:24
*** dolpher has quit IRC01:39
*** dolpher has joined #kolla01:40
*** dims__ has joined #kolla01:42
*** dims_ has quit IRC01:44
*** dolpher1 has joined #kolla01:44
jpeeleri just pushed it.01:45
*** dolpher has quit IRC01:47
*** dims_ has joined #kolla01:54
*** unicell has quit IRC01:56
*** dims__ has quit IRC01:56
SamYaplejpeeler: no02:09
SamYaplethere shouldnt be any images with the latest tag02:09
jpeelerSamYaple: huh? i know i've been out of the loop for a while02:13
jpeelerhttps://github.com/stackforge/kolla/commit/a5fa276c3a8f30a25e009d69ee93a80635337caa02:13
jpeelerbut that makes it seem like they all should be using latest02:13
SamYapleyes, master uses the latest tag02:13
SamYaplewe dont push latest images02:13
SamYaplebasically if you use the latest tag you must be building your own images02:13
jpeelershould we remove all the latest tags present then?02:14
SamYapleyea im working on it at the moment02:14
SamYapleit just leads us to outdated images02:14
jpeeleryeah i understand02:14
SamYaplethe only thing we can gaurantee to work is someone checkouts the liberty2 tag and has libert2 images to pull without building02:14
jpeelerright02:14
SamYaplewe cant expect the random tags to all work with master02:14
jpeelerSamYaple: you may be able to fix this in a jiffy - https://bugs.launchpad.net/kolla/+bug/148240602:20
openstackLaunchpad bug 1482406 in kolla "ansible deploy yielding undefined variable " [Undecided,New]02:20
SamYaplelooking02:20
jpeeleri haven't looked at it honestly02:20
SamYapledid you setup the 'network_interface' in your globals.yml correctly?02:21
SamYaplealso it looks like thats calling multinode inventory, is this a multinode deploy?02:21
jpeelerit is multinode yes, and i honestly can't say for sure if eth0 is correct, but it definitely exists02:23
SamYapleare your hosts reachable via the address "network01" ?02:23
jpeeleryes02:23
SamYaplei mean that error to mea is pretty straight forward, you dont have an eth0 interface with an ip address02:23
SamYaplecan i reproduce this somehow?02:24
jpeelerit is present with an ip02:24
*** achanda has joined #kolla02:24
jpeelerSamYaple: i think harmw reproduced it also. we're using vagrant, so perhaps that environment is not quite right02:25
SamYaplei know nothing about vagrant02:25
jpeeleris the docker in docker stuff close to finished?02:25
SamYaplebut from an ansible perspective it may not be gatehering facts correctly02:25
SamYaplejpeeler: the containerized deps just merged, but i have to switch the modules we use first02:26
SamYaplethen i can finish the dind stuff02:26
SamYaplei think ansible uses netifaces to pull network info, makesure it is installed02:26
jpeelerit isn't actually02:27
SamYaplehhmm02:27
jpeelernevermind, pip installed02:27
jpeelerchecked rpm first02:27
SamYapleah02:27
SamYapleif you run `ansible -i inventory/multinode -m setup`02:28
SamYapledo you see the interface eth0 returned?02:28
SamYapleif its not returning wit hthe ip info, thats the issue02:28
jpeeleris that exactly the correct command?02:29
jpeelergiving me usage output02:30
SamYapleyea thats running the setup module02:31
SamYapleit returns everythign about the system it can return02:31
SamYaplefrom bios version to ip addresses02:31
SamYaplewhats your ansible version?02:31
jpeeler1.9.202:31
SamYapleyup latest02:31
SamYapleman we really need to clean up our dockerhub02:33
openstackgerritSam Yaple proposed stackforge/kolla: Update Ansible docs to remove requirements  https://review.openstack.org/20971602:37
SamYaplehey jpeeler02:42
SamYaplethere is lots to do on the build.py script02:42
jpeeleri'm sure02:42
SamYaplei dont know of anything in progress for that except your patchsets02:42
SamYapleso you make it what you want too02:42
jpeeleryeah02:42
SamYaplei will be quick to review it for you02:42
jpeelercool thanks02:43
openstackgerritMerged stackforge/kolla: Glance api and Glance registry shouldn't share tags  https://review.openstack.org/21010902:46
*** ccrouch has joined #kolla03:28
*** diogogmt has joined #kolla03:40
*** achanda has quit IRC03:56
*** dims_ has quit IRC04:04
*** loth has joined #kolla04:24
*** weiyu_ has quit IRC04:29
*** jruano has joined #kolla04:39
*** unicell has joined #kolla04:49
*** jruano has quit IRC04:58
*** diogogmt has quit IRC05:00
*** weiyu_ has joined #kolla05:14
*** unicell has quit IRC05:15
*** banix has quit IRC05:18
*** unicell has joined #kolla05:19
*** achanda has joined #kolla05:25
*** sdake has joined #kolla05:29
sdakeevening folks05:29
sdakesamyaple you around05:29
*** echoingumesh has joined #kolla05:31
*** echoingu_ has joined #kolla05:34
*** echoingumesh has quit IRC05:37
coolsvapsdake, evening :) morning for me06:09
ccrouchSamYaple: another ping :-)06:34
ccrouchsdake: ut?06:34
ccrouchgoing to bed shortly, but if anyone had any feedback on06:37
ccrouchhttps://etherpad.openstack.org/p/8ZACSjaDCH06:37
ccrouchits an attempt to describe the high level, and sometimes low level steps, that kolla use to get the openstack services started06:38
ccrouchwhen using config-external-copy-once and ansible obviously06:38
ccrouchcheers!06:40
*** sdake has quit IRC06:58
*** inc0 has joined #kolla07:02
inc0good morning07:03
coolsvapmorning inc007:10
*** achanda has quit IRC07:15
*** mandre has quit IRC07:19
*** pbourke has quit IRC07:33
*** pbourke has joined #kolla07:34
*** jmccarthy has quit IRC07:36
*** jmccarthy has joined #kolla07:37
*** gfidente has joined #kolla07:50
*** macjack has left #kolla07:54
*** inc0_ has joined #kolla08:13
*** inc0 has quit IRC08:16
*** inc0_ has quit IRC08:27
*** inc0 has joined #kolla08:27
*** erkules has quit IRC08:29
*** erkules has joined #kolla08:29
*** dwalsh has joined #kolla08:30
*** weiyu_ has quit IRC08:46
*** weiyu_ has joined #kolla08:46
*** tfukushima has joined #kolla08:50
coolsvappbourke, around?08:50
vbelgood morning/evening folks08:58
*** vbel has quit IRC08:58
*** vbel has joined #kolla08:59
*** dolpher1 has quit IRC09:00
pbourkecoolsvap: morning09:02
coolsvappbourke, morning i built environment for vagrant + virtualbox till i get it running with kvm, i have a couple of queries09:03
coolsvapdo you have time?09:03
*** dwalsh has quit IRC09:11
pbourkeshoot09:15
coolsvapwhen i run ansible-playbook the setup stops at haproxy itself, i checked if its downloading any images or something but there's nothing in background09:19
pbourkei haven't tried haproxy myself yet09:22
pbourketry -vvv and see what command the playbook is hanging at?09:22
inc0pbourke, did you manage to set up neutron kilo?09:23
pbourkeinc0: again, haven't really tried. i tend to just test small parts in isolation, its a lot of overhead to test the whole system09:24
pbourkei probably should but right now just haven't had the need09:24
inc0ok, I'm trying to get this working, but so far I hit problems09:25
inc0I'll let you know if there is anything to be done09:25
pbourkeactually, I did do neutron a while back. but I only tested the easy parts, didn't actually try booting an instance, attaching an ip, etc09:26
*** dwalsh has joined #kolla09:29
*** weiyu_ has quit IRC09:34
*** dims_ has joined #kolla09:54
*** inc0 has quit IRC09:55
openstackgerritAlicja Kwasniewska proposed stackforge/kolla: Partially-implements: bp dockerfile-template  https://review.openstack.org/21028809:56
*** echoingu_ has quit IRC09:56
*** echoingumesh has joined #kolla09:57
*** inc0 has joined #kolla09:58
*** weiyu has joined #kolla10:00
*** echoingumesh has quit IRC10:01
*** inc0 has quit IRC10:05
*** inc0_ has joined #kolla10:05
SamYapleccrouch: ping10:12
SamYapleccrouch: responded10:16
vbelSamYaple: hi, any thoughts on how to proceed with run_once bootstrap? I suggest as workaround copy of non-pid block from start.yml into bootstrap.yml. It works. Do we ever need to bootstrap anything with pid=host?10:17
SamYaplevbel: https://review.openstack.org/#/c/210041/10:18
SamYaplethats my thoughts on proceeding10:18
*** bradjones has quit IRC10:20
vbelSamYaple: +2 :)10:22
vbelwill be easier to trace/debug things10:24
*** walters has quit IRC10:25
*** walters has joined #kolla10:27
*** sdake has joined #kolla10:28
sdakemorning10:29
sdakehey ccrouch up late10:30
*** bradjones_ has joined #kolla10:30
sdakesamyaple ping10:30
*** bradjones_ is now known as bradjones10:30
sdakeccrouch when you wake up that workflow looks good - should make an md for it to explain it to others!10:33
sdakepbourke around10:39
pbourkesdake: hi10:39
sdakehey bro can you review my blueprint10:39
*** dwalsh has quit IRC10:39
pbourkesure, throw it out10:39
sdakehttps://blueprints.launchpad.net/kolla/+spec/deploy-ha10:40
*** inc0_ has quit IRC10:40
sdakethe idea is to have a two stage ansible deploy actually10:41
sdakeso you do an ansible step1 which builds your deployment nodes10:42
sdakethen you customize ansible config on one of those 2-3 nodes10:42
sdakeand deploy openstack next10:42
pbourkekevsi: you might be interested in a read of this also ^10:42
pbourkesdake: has bmace read this also?10:43
sdakeyes bmace helped come up with it sort of10:43
sdakehe asked me 2-3 months ago "the deploy node needs to be ha"10:43
sdakeand I just sorted out how t od o it :)10:43
pbourkeyeah its a feature I know we originally were looking to do using his deploy tool10:44
pbourkeit makes sense though to handle most of this with ansible I think10:44
sdakei gave a schedule of 1 week which seems doable10:44
*** bradjones has quit IRC10:45
*** ccrouch has quit IRC10:45
*** daneyon has quit IRC10:45
*** openstackgerrit has quit IRC10:45
*** smeisner has quit IRC10:45
*** thomasem has quit IRC10:45
sdakeatleast the etcd backend10:45
sdakewhat i told yo uabout with the deploy after deploy is not documented anywhere10:45
sdakei'm not sure if my ansible assertion is correct10:46
pbourkeyeah thats one question I have after reading10:46
pbourkeis what form will the backend take10:46
pbourkeis it etcd?10:46
sdakence Ansible gets all state of the current system during the runtime, it doesn't need any more storage then a) whether a deployment operation is in progress and b) the configuration of the deployment.10:47
sdakeconfigurable pbourke10:47
sdakebut etcd is what i'm gonig to implement first10:47
*** bradjones has joined #kolla10:49
*** ccrouch has joined #kolla10:49
*** daneyon has joined #kolla10:49
*** openstackgerrit has joined #kolla10:49
*** smeisner has joined #kolla10:49
*** thomasem has joined #kolla10:49
pbourkeit sounds good, definitely something we need10:49
pbourkeso im +1 :)10:49
pbourkecan you explain the deployment_active flag a little more?10:49
*** bradjones has quit IRC10:49
*** bradjones has joined #kolla10:49
*** bradjones has quit IRC10:49
*** bradjones has joined #kolla10:49
*** pbourke has quit IRC10:50
sdakewhen you go to deploy it gets ste to true or osmething10:51
sdakewhen deploy finishes it gets unset10:51
sdakeif deployment starts and it sets, deployment aborts10:51
sdakethe only thing that would keep the flag set while a ansible deployment wasn't going on is a data center lights out or b) ansible crash10:51
sdakein eithre of those situations you would need a way to blow away the lock10:52
*** pdb has joined #kolla10:53
sdakepdb10:53
*** pdb is now known as pbourke10:54
sdake03:51:05]  <sdake>when you go to deploy it gets ste to true or osmething10:54
sdake[03:51:11]  <sdake>when deploy finishes it gets unset10:54
sdake[03:51:19]  <sdake>if deployment starts and it sets, deployment aborts10:54
sdake[03:51:54]  <sdake>the only thing that would keep the flag set while a ansible deployment wasn't going on is a data center lights out or b) ansible crash10:54
sdake[03:52:11]  <sdake>in eithre of those situations you would need a way to blow away the lock10:54
pbourkeis it possible to run more than one ansible at a time though?10:54
sdakepleae add comment to the blueprint - that is what discussion phase is for and I'd like to get cracking soon10:55
sdakeno if you run a second ansible it errors out and says "op in progress" :)10:55
sdakeunless yu know better, and can wipe the flag10:55
sdake(in reality there is no op in progress)10:55
sdakethink of it like a pid file in /var/lock10:56
*** echoingumesh has joined #kolla10:57
*** bmace has quit IRC10:58
*** echoingumesh has quit IRC11:02
vbelhttps://review.openstack.org/#/c/208451/  containerizing host deps -  was it easier than to write ansible host provisioning task?11:03
*** akwasnie has joined #kolla11:03
*** inc0 has joined #kolla11:03
*** bmace has joined #kolla11:04
vbel... including installation of docker itself11:04
*** inc0 has quit IRC11:07
*** inc0_ has joined #kolla11:07
pbourkevbel: not sure about easier but I think its better11:11
pbourkevbel: we get the benefits of docker and not having to taint the host11:12
pbourkevbel: we could still maybe do a provisoning task though for docker itself (and docker-py)11:12
*** zhiwei has quit IRC11:14
vbeldocker-py is not included in docker rpms?11:15
vbelpbourke: yes, having docker 'agent' to manage the rest is good idea. It has been merged as I understand? no more host dependencies?11:17
sdakevbel in that container is only shade and its 50+ dependencies11:17
sdakevbel trust me you dont want those on each host11:17
sdakeresults in unreliable operation imo11:17
vbelsdake: thanks, sure :)11:17
sdakei haven't actually looked at how sam implemented that11:18
sdakelet me look11:18
pbourkeyup seems merged11:18
vbelso from now on I will not provision hosts with anything but docker itself (and docker-py )11:19
sdakeholy christ i don't even know how that implemetnation works11:19
sdakebut I assume it does ;-)11:19
vbel:)))) That's a big change11:19
sdakesadface container lsymlinking into ansible directory11:21
sdakehttps://blueprints.launchpad.net/kolla/+spec/deploy-ha11:22
sdakepbourke^^ add something to whiteboard saying you review and approve plz :)11:22
sdakedont approve it11:22
sdakejust say you approve of the idea11:22
sdakeor if you dont say that11:22
sdakepbourke do you know how the haproxy container works atm11:32
*** tfukushima has quit IRC11:34
*** dwalsh has joined #kolla11:37
*** echoingumesh has joined #kolla11:58
vbelhaproxy question - do we do net.ipv4.ip_nonlocal_bind=1 anywhere to get it bind to VIP that is not on current node12:01
vbel?12:01
vbelI see, we do12:01
sdakepbourke vbel here is part two https://blueprints.launchpad.net/kolla/+spec/deploy-deploynodes12:02
sdakecomments welcome12:02
vbel./roles/haproxy/tasks/config.yml:  sysctl: name="net.ipv4.ip_nonlocal_bind" value=1 sysctl_set=yes  <- good stuff12:02
sdakeplease use whiteboard - i'd like to finish the discussion so we can either proceed or say we are not doing it ;)12:03
*** echoingumesh has quit IRC12:07
*** banix has joined #kolla12:11
*** banix has quit IRC12:11
sdakealso this might be m material but i'd like to see if i can get it in for liberty in a tech previewish sort of way12:14
*** sdake_ has joined #kolla12:16
*** sdake_ has quit IRC12:16
*** sdake_ has joined #kolla12:16
*** sdake__ has joined #kolla12:17
*** sdake has quit IRC12:18
pbourkesdake_: is there one part in particular you're wondering about?12:18
*** sdake_ has quit IRC12:21
sdake__just want cks or nacks12:22
sdake__what verification the idea looks ok12:22
sdake__can you do me a  solid also pbourke and try pip install openstack-crux12:22
sdake__I am loki of asguard12:23
sdake__and I am burdened with glorious purpose12:23
sdake__we have no quarrel with your people12:23
sdake__an ant has no quarrel with a boot ;-)12:23
sdake__this move rocks12:23
sdake__10k reviews and like 4.75 stars12:23
sdake__definately the best marvel movie12:23
*** dwalsh has quit IRC12:24
pbourkeantman?12:24
pbourkesdake__: http://paste.openstack.org/show/412174/12:26
sdake__groan I get that too12:27
sdake__well atleast I got it uploaded ;-)12:27
sdake__any tips on how to fix that python error?12:28
sdake__i just took it out in the rpm version and hard specified the dependencies12:28
sdake__but that wont obviously work for from source installs12:28
sdake__it would be nice if we can just deprecate config-internal - then crux goes byebye12:29
*** britthouser has quit IRC12:31
pbourkeive not seen any engagement from tripleo12:32
pbourkegoing by their latest email they're only starting to look at kolla12:32
sdake__they have made a pretty big commitment12:33
pbourkein talk or code12:33
sdake__dan prince spending 1-2 months working on this project12:33
sdake__he has got the code into an operational state for puppet and tripleo iirc12:33
*** dims_ has quit IRC12:33
sdake__iiuc12:33
sdake__plus rhallisey/sloewr are interested in the tripleo case12:33
sdake__this is good for us, it makes our containers mo better12:33
*** dims_ has joined #kolla12:34
pbourkeare they using config-internal?12:34
sdake__offers mor ecustomer choice with the same container infrastructure12:34
sdake__the proposal on the maling list was to use config-external12:34
sdake__initiailly they were using config-internal12:34
sdake__I would have deprecated it in the ansible-multi spec12:34
sdake__but tripleo was going down thatroute first12:34
*** tfukushima has joined #kolla12:35
sdake__but I think they figured out as we did, config-internal is not ideal12:35
sdake__the reason I didn't like config external initially was there was not immutability12:35
sdake__but kevin fox sort of soled that with my help :)12:35
pbourkeanywho12:36
pbourkefor crux, it seems like you just didn't package requirements.txt?12:36
sdake__its definately there12:37
sdake__i am converting to pbr12:37
sdake__i'll have a new version in 15 mins for you to test if your available12:37
*** rhallisey has joined #kolla12:37
pbourkesounds good12:38
sdake__rhallisey can you get the tripleo folks to make a deicsion on config/internal vs config/external12:38
sdake__sounds like they want config external12:38
sdake__if we can deprecate config-internal before liberty I'd really like to do so12:38
rhalliseyconfig external12:38
sdake__so we aren't stuck with it forever12:38
rhalliseythe config internal deprecation will be quite the process12:38
rhalliseysince ansible will have to be to the default12:39
*** Haomeng has joined #kolla12:39
rhalliseya lot of the dos wills change12:39
sdake__here is the deal, I made a serious commitment in the ansible multi spec to tripleo specifically to maintain config-internal12:39
rhalliseyya we've change12:39
rhalliseywe can deprecate12:39
sdake__good, so can we get a couple tripleo cores to sign off on the mailing list to that effect12:40
*** tfukushima has quit IRC12:40
sdake__so someone doesn't bitch later that I ninja changed the  entire architecture12:40
rhalliseysure12:40
sdake__dprince & slagle would wfm :)12:40
sdake__I REALLY want ot get rid of config-internal12:40
sdake__i'll do all the commits to do the job12:40
sdake__the reason its there is for tripleo12:41
sdake__because we dont abandon our partner projects12:41
sdake__you guys had a config-internal implementation and if we just took that out, it might have sent the wrong message12:41
*** jruano has joined #kolla12:41
vbelconfig-internal is not to be supported by us either :)12:41
*** Haomeng|2 has quit IRC12:41
sdake__if the tripleo community really is satisified with dprince's config strategy (which looks totally sound)12:41
rhalliseydprince is cool with it.  The purpose of that email was to get opinions12:42
sdake__lets get it on the record so we can nuke config-internal12:42
sdake__we only have one month to do the job12:42
rhalliseykk12:42
sdake__pbourke try now please pip install crux in container12:43
sdake__make sure deps get installed12:43
vbelconfig-internal is promise to please everyone (story of https://en.wikipedia.org/wiki/Vasa_%28ship%29 )12:44
sdake__However, Vasa was dangerously unstable due to too much weight in the upper structure of the hull.12:45
pbourkeSamYaple: same error unfortunately12:45
sdake__sdake actually :)12:45
*** sdake__ is now known as sdake12:45
sdakedamn don't coufse me with sam plz!!12:46
pbourkeah wrong autocomplete12:46
sdakelet me try deleting12:46
pbourkeSamYaple: please ignore last comment!12:46
vbelsdake: they wanted to combine everything architecture-wise :)12:47
sdakepbourke pull the trigger again12:52
pbourkesdake: oo so close12:53
sdakegot a paste?12:53
pbourkesdake: installs successfuly but 'crux -v' complains it's missing the debtcollector module12:53
sdakedid it install python-keystoneclient?12:54
pbourkepip install debtcollector fixes it12:54
pbourkeso I reckon add that to requirements.txt ?12:54
sdakedebtcollector is not used in crux12:54
sdakeit must be a dependency of something else12:54
sdakegot a backtrace?12:54
sdakethat implies requirements.txt isn't being installed12:54
pbourkeone sec12:54
pbourkehttp://paste.openstack.org/show/412179/12:55
sdakeare you doing this in a container?12:55
pbourkeno12:55
pbourkeI'll do that now too12:55
sdakeyes please do i want to see the full container build in a log pls12:56
pbourkeworks in the container12:56
sdakeRequirement already satisfied (use --upgrade to upgrade): pbr>=0.11,<2.0 in /usr/local/lib/python2.7/dist-packages (from openstack-crux)12:56
sdakeRequirement already satisfied (use --upgrade to upgrade): python-keystoneclient>=0.9.0 in /usr/local/lib/python2.7/dist-packages (from openstack-crux)12:56
sdakeRequirement already satisfied (use --upgrade to upgrade): cliff>=1.4.3 in /usr/local/lib/python2.7/dist-packages (from openstack-crux)12:56
sdakeso it is installing the requirements12:56
sdakei think you just have a dependency problem on your host machine12:57
sdakeif it works int he container12:57
sdakedoes crux work inthe container?12:58
pbourkeyeah it works in the container so I think we're good12:58
sdakecool i'll submit a pr to larsks repo12:59
sdakehopefully he will take a pbr implementation12:59
sdaketoerhwise I dont know how to fix it12:59
sdakepbourke do you have the original log for the pip failure we were experiencing13:00
pbourkeI dont think so13:00
pbourkesorry13:00
sdakedamn13:01
sdakei lost it too13:01
sdakewould have been nice for larsks to understand why :)13:01
sdakelet me delete the update and reprouce the log13:02
sdakenah that wont work13:02
*** echoingumesh has joined #kolla13:05
sdakelarsks https://github.com/larsks/crux/pull/313:07
sdakelarsks if you know another way to fix this problem i'm open to it :)13:08
larskssdake: taking a look! :)13:08
sdakelarsks if you could tag as version 8 I'd appreciate that as well13:08
larskssdake: actually, would you mind deleting your pypi repository for this? I'd like to maintain the pypi packaging.13:09
sdakei have no problem with you maintnaining the pypi13:09
larsksI'll merge and push a new pypi today.13:09
sdakecan I just transfer ownership to you?13:09
larsksI don't know, is that a thing?13:09
sdakeI think so13:09
sdakedo you mind openstack-crux?13:09
sdakebecause crux is taken13:09
larsksFine by me. Does keystone-crux make more sense?  I'm happy either way.13:10
sdakelet me see how the transfer works - hang tight13:10
sdakekeystone-crux is good13:10
sdakethat is probably better13:10
*** echoingumesh has quit IRC13:10
sdakei'll see if I can delete openstack-crux - not sure if its possible to delete repos or not on pypi13:10
sdakecan you register it now?13:10
sdakeuse python setup.py register13:11
sdakehave to change openstack-crux in my example13:11
sdakeerr my pulll requet13:11
sdakerequest13:11
sdakelarsks are you good with the pbr changes tho?13:11
larsksI suspect I know why you were getting problems with pypi.13:12
sdakelarsks I personally dont care either way as long as the pypi install works properly for from-source builds13:12
larsksI may look at that first.13:12
sdakeit said requirements.txt was not found13:12
sdakeif you could get it done soon it would be appreciated, because atm we are a bit blocked on this13:12
larsksNo problem.13:12
sdakehow about this, I'll leae openstack-crux up until you get done13:13
sdakebecause I know you ahvea big plate fulll of shit13:13
sdakeand when you have a  working pypi install we will roll with that13:13
sdaketbh I'd like to deprecate config-internal13:13
ccrouchthanks for looking at the etherpad SamYaple13:19
sdakeccrouch we can turn that into a md in the docs dir13:20
sdakeprobably design.md or something13:20
sdakelarsks does that approach sound amenaible to you?13:22
ccrouchcool13:24
larskssdake: you can now 'pip install keystone-crux'13:26
sdakelarsks that was fast:)13:26
sdakepbourke can you do me  another solid and test that out in the container13:26
sdakelarsks did you use crux or some other solution and if so mind pasting a diff13:26
sdake(just so I can learn)13:26
sdakerather pbr13:26
larsksI...what?13:26
larsksOh, no.13:26
pbourkesdake: wasn't watching irc, has openstack-crux been superceded/13:26
pbourke?13:27
sdakepbourke right keystone-crux13:27
larsksThe problem was simply that 'requirements.txt' wasn't included in the generated sdist.13:27
sdakelarsks will maintain13:27
larsksFor files that are not included by default you need to create a MANIFEST.in file.13:27
sdakeso it needed to go in MANIFEST.in?13:27
larsksYup.13:27
pbourkeworks fine13:27
sdakeya i should have tried that13:27
pbourkeI'll update my original commit13:27
pbourkethanks all13:27
sdakeok i'll see if I can delete openstack-crux13:27
sdakefew minutes - in a conversation13:27
larsksThere is a big "DO NOT USE THIS BUTTON" thing at the bottom of the project details page for deleting a project.13:28
*** tfukushima has joined #kolla13:35
openstackgerritRyan Hallisey proposed stackforge/kolla: Use the Glance Data container for ansible  https://review.openstack.org/21041713:37
sdakeworking on it- in a conversation :)13:37
sdakelarsks ok pulled trigger on that13:38
sdakethanks for your quick help :)13:39
*** jtriley has joined #kolla13:39
openstackgerritRyan Hallisey proposed stackforge/kolla: Use the Glance Data container for ansible  https://review.openstack.org/21041713:39
larsksSure.  And you know, if people have feature requests or prs, send them my way.13:40
sdakelarsks we are thinking of deprecating config-internal13:42
sdakeso we may drop keystone-crux entirely13:42
sdakehard to say at this point13:42
sdakedepends on what tripleo wants to do13:42
sdakeits nothing wrong with crux just with crudini model13:42
larsksSure.13:42
openstackgerritRyan Hallisey proposed stackforge/kolla: Use the Glance Data container for ansible  https://review.openstack.org/21041713:42
sdakeyu already know problems with crudini model i don't think i have to explain it :)13:43
*** inc0_ has quit IRC13:45
*** athomas has quit IRC13:55
openstackgerritPaul Bourke proposed stackforge/kolla: Implement Murano source images  https://review.openstack.org/20990513:55
openstackgerritPaul Bourke proposed stackforge/kolla: Implement Murano source images  https://review.openstack.org/20990513:58
*** echoingumesh has joined #kolla14:06
*** athomas has joined #kolla14:07
*** diogogmt has joined #kolla14:10
*** echoingumesh has quit IRC14:11
*** diogogmt has quit IRC14:11
*** diogogmt has joined #kolla14:13
*** tfukushima has quit IRC14:17
*** rhallisey has quit IRC14:17
*** rhallisey has joined #kolla14:17
*** tfukushima has joined #kolla14:18
*** ccrouch has quit IRC14:19
*** sdake_ has joined #kolla14:21
sdake_samyaple you around?14:24
openstackgerritRyan Hallisey proposed stackforge/kolla: Use Nova Data container for ansible  https://review.openstack.org/21046314:24
*** sdake has quit IRC14:25
openstackgerritPaul Bourke proposed stackforge/kolla: Install correct crux in centos-source-base  https://review.openstack.org/20497714:27
openstackgerritPaul Bourke proposed stackforge/kolla: Fix missing config in horizon source image  https://review.openstack.org/20941514:27
openstackgerritPaul Bourke proposed stackforge/kolla: Add horizon source for oraclelinux  https://review.openstack.org/20943014:27
*** diogogmt has quit IRC14:28
rhalliseysdake_, I do sleep the containers14:28
rhalliseyI just use the existing data containers14:29
sdake_ya I think sam was anti that for some reason14:29
sdake_just -1'ed it so the conversation can happen before it ninja merges14:29
rhalliseykk14:29
*** tfukushima has quit IRC14:32
*** tfukushima has joined #kolla14:33
*** diogogmt has joined #kolla14:33
sdake_pbourke nice job on murano (and mick!)14:41
pbourkesdake_: thanks, it sucks about horizon though14:41
sdake_which part - i missed that in the review14:41
pbourkesdake_: its throwing some sort of angularjs error that I can't get to the bottom of. which means we can't really test murano14:42
sdake_fantastic!14:42
sdake_so we agreed to put this stuff in extras - that is one of the reasons14:42
pbourkesee note in the commit msg (https://review.openstack.org/#/c/209905/)14:42
sdake_but that depends on templating being finished first14:42
pbourkethere was some uncertainty about the tagging yesterday14:43
pbourkeare we still good with liberty2 in compose files?14:44
*** ccrouch has joined #kolla14:44
sdake_for the moment yes pls14:45
sdake_people should build with --tag=liberty214:46
sdake_although i'm not sure if that is the correct answer14:46
sdake_or a better answer is to commit a change that changes master to "latest" again14:46
openstackgerritPaul Bourke proposed stackforge/kolla: Implement Murano source images  https://review.openstack.org/20990514:46
sdake_pbourke can you file a bug to move liberty2 to latest and submit a patch14:49
sdake_it may end up being a waste of time - i just dont know14:49
sdake_i dont know what the best solution to that problem is, but if we get a review out the CR team can debate it in the review14:49
sdake_rhallisey can you review that murano patch pls14:49
rhalliseyya just a minute14:50
pbourkewait hang on14:51
pbourkesdake_ and me are behind the times :P14:51
pbourkehttps://review.openstack.org/#/c/210027/14:51
pbourkeso murano should in fact be latest right14:52
*** dims_ is now known as dimsum__14:53
*** blahRus has joined #kolla14:53
vbelanyone can answer mariadb bootstrap/register in new model (after kolla-ansible proxy container had been merged)14:53
sdake_pbourke ya revert that liberty2 thing i told you to fix in murano and i'll reapprove14:53
sdake_sorry for missing that was traveling14:53
vbelwhy do we run bootstrapping container twice - in bootstrap and in register.yml14:53
pbourkena I missed it too14:53
pbourkewell I saw it fly by yesterday but forgot about it14:53
sdake_I do try to review every patch even once they have hit the repo but we have serious veloicyty nad its hard14:53
openstackgerritPaul Bourke proposed stackforge/kolla: Implement Murano source images  https://review.openstack.org/20990514:54
sdake_the good news is it looks like the cr team is happy with the revert idea ;)14:54
sdake_rhallisey can you review that now ^^ :)14:55
rhalliseyy14:55
sdake_thanks14:55
sdake_would be nice if rdo could figure out ho wto package the big tent :)14:56
sdake_I think we need to have a blueprint for the extras idea14:56
sdake_we agreed that was the path forward at the midcycle as well14:56
sdake_so I'll file that14:56
sdake_vbel no idea how that works - sorry can't answer14:56
sdake_vbel samyaple is your man, he is usually in in a couple hours14:57
sdake_but he was not on lsat night so maybe he is taking a breather14:57
vbelok, will wait, thanks14:57
pbourkevbel: will it not work the same way as keystone?14:59
vbelI wonder why the bootstrap block was added via https://review.openstack.org/#/c/208451/1315:00
pbourkesorry you need to be more specific15:01
vbel I wonder why the bootstrap block was added via https://review.openstack.org/#/c/208451/13 to https://review.openstack.org/#/c/208451/13/ansible/roles/mariadb/tasks/register.yml15:02
sdake_dummy question, does ha proxy depend on mysql?15:03
sdake_rhallisey you up for making a docker directory structure for rhel15:04
rhalliseysure15:04
pbourkevbel: good point15:04
pbourke:/15:04
sdake_cool file a blueprint and i'll approve15:04
vbelsdake_: no15:05
sdake_rhallisey ^^15:05
pbourkesdake_: I dont think so, other than the fact it may have an entry for mysql15:05
sdake_vbel thanks15:05
sdake_i want to use haproxy+keepalived for the etcd work too15:05
sdake_i'm not quite sure how to do it15:05
sdake_but it neesd to be done15:06
pbourkejust checked, it does15:06
sdake_pbourke got a link to code15:06
pbourkesdake_: I imagine you can add them after the fact15:06
pbourkehttps://github.com/stackforge/kolla/blob/master/ansible/roles/haproxy/templates/haproxy.cfg.j2#L17-L2715:06
sdake_the problem is keepalived and haproxy need to be deployed prior to the openstack deployment15:07
vbelit does not require mysql/mariadb to be running, just config15:07
pbourkeit also seems like a soft dependency, as in its not going to fail to startup if mysql is missing15:07
pbourkewhat vbel said :)15:07
sdake_so we could have a new role haproxy_deploy15:07
*** echoingumesh has joined #kolla15:07
sdake_without that stuff in it15:07
vbelit listens to mysql port and sends that to real mysql if the latter is present15:07
sdake_and only use that for the deploy host15:07
sdake_right15:08
vbelyes15:08
pbourkesdake_: may also help: https://github.com/stackforge/kolla/blob/master/etc/kolla/defaults.yml#L39-L4515:08
sdake_pbourke what I'm thinking is we have a keepalived_deploy and haproxy_deploy and just restart them with new configs once the actual deploy occurs15:09
sdake_does oracle linux have packaging for etcd?15:10
sdake_I could probably use the centos version15:10
vbelwe will make etcd if necessary15:11
sdake_rhallisey please review and comment in the whiteboardon https://blueprints.launchpad.net/kolla/+spec/deploy-ha15:11
sdake_and its dependency15:11
*** echoingumesh has quit IRC15:12
*** unicell1 has joined #kolla15:14
*** unicell has quit IRC15:16
sdake_ok guys we are deprecating config-internal - dprince acked it and hes the one doing the heavy lifting on integrating kolla and puppet (tripleo's CM tool)15:19
rhalliseyya he helped a lot with the puppet work15:20
*** sdake_ is now known as sdake15:20
sdakewtb sam yaple15:23
sdakesamyaple come alive15:23
rhalliseylol you keep saying his name it pings his phone15:23
rhalliseyhe will never sleep!15:23
sdakeoh didn't know that15:32
sdakeusually he is awake right now15:32
sdakei want him to look over my deploy ha bp15:32
sdakeand see if he has any better ideas15:33
sdakeconfig internal removal going to be a big job15:35
sdakeyay for 20 patch patchsets :)15:35
sdakehttps://blueprints.launchpad.net/kolla/+spec/remove-config-internal15:37
*** echoingumesh has joined #kolla16:08
*** echoingumesh has quit IRC16:13
*** unicell1 has quit IRC16:17
*** mstachow has quit IRC16:19
*** echoingumesh has joined #kolla16:20
*** echoingumesh has quit IRC16:20
*** jasonsb has quit IRC16:20
*** jasonsb has joined #kolla16:21
*** sdake_ has joined #kolla16:22
*** jasonsb has quit IRC16:26
*** sdake has quit IRC16:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from Barbican  https://review.openstack.org/21051916:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from ceilometer  https://review.openstack.org/21052016:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from cinder  https://review.openstack.org/21052116:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from designate  https://review.openstack.org/21052216:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove docker-compose container  https://review.openstack.org/21052316:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from galera  https://review.openstack.org/21052416:26
openstackgerritSteven Dake proposed stackforge/kolla: Remove config-internal from glance  https://review.openstack.org/21052516:26
sdake_have a look16:27
sdake_I have to head to the dentist16:27
sdake_leave comments in irc ;)16:27
*** daneyon_ has joined #kolla16:39
*** unicell has joined #kolla16:40
*** daneyon has quit IRC16:42
pbourkeif someone has a few mins to spare and could test if they experience this bug it would be good help https://bugs.launchpad.net/kolla/+bug/148219616:54
openstackLaunchpad bug 1482196 in kolla "Horizon dashboard not loading properly, can't click on anything" [Undecided,New]16:54
pbourkesdake_: the config-internal removals look ok but I won't +2 such a big change on a friday evening ;)16:55
pbourkewill let it sit for the weekend, have another look on monday to be sure nothing else comes up16:55
pbourkehave a good one all16:56
vbelanyone can run ansible with latest code? I see that we expect 'localhost | SUCCESS >>' from kolla-ansible container but ansible actually returns 'localhost | success >>'16:57
vbeland therefore all such remote ansible things fail16:57
vbelif you run yours ansible with -vvvvv you can see what is returned16:58
vbelansible]$ grep -rl  ' SUCCESS =>' .17:03
vbel./roles/glance/tasks/register.yml17:03
vbel./roles/mariadb/tasks/register.yml17:03
vbel./roles/neutron/tasks/register.yml17:03
vbel./roles/nova/tasks/register.yml17:03
vbel./roles/bootstrap.yml17:03
vbelwonder how it is supposed to work17:04
*** bmace has quit IRC17:08
*** ccrouch has quit IRC17:09
*** jasonsb has joined #kolla17:12
*** mfalatic_ has quit IRC17:16
*** bmace has joined #kolla17:17
SamYaplesdake_: ping17:17
SamYaplevbel: rebuild your ansible container17:18
SamYaplevbel: you are running with an old ansible container most likely17:18
SamYaplethe different between the two is the difference between 1.x and 2.x ansible return codes17:19
*** tfukushima has quit IRC17:22
*** akwasnie has quit IRC17:23
*** tfukushima has joined #kolla17:23
*** tfukushima has quit IRC17:25
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for zaqar  https://review.openstack.org/21054617:26
*** daneyon_ has quit IRC17:26
*** daneyon has joined #kolla17:26
*** ccrouch has joined #kolla17:27
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for swift  https://review.openstack.org/21054817:31
*** athomas has quit IRC17:34
*** achanda has joined #kolla17:44
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for rabbitmq  https://review.openstack.org/21055217:45
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for swift  https://review.openstack.org/21054817:49
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for zaqar  https://review.openstack.org/21054617:49
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for openvswitch  https://review.openstack.org/21055417:53
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for nova  https://review.openstack.org/21056118:07
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for neutron  https://review.openstack.org/21056618:21
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for memcached  https://review.openstack.org/21056718:24
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for neutron  https://review.openstack.org/21056618:24
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for keystone  https://review.openstack.org/21057118:33
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for Magnum  https://review.openstack.org/21057218:34
openstackgerritMerged stackforge/kolla: Add check_script for haproxy in keepalived  https://review.openstack.org/20946318:38
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for keepalived  https://review.openstack.org/21057418:38
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for Horizon  https://review.openstack.org/21057718:42
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for haproxy  https://review.openstack.org/21057818:44
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for gnocchi  https://review.openstack.org/21058018:49
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for Heat  https://review.openstack.org/21058418:54
SamYaplealright thats the majority of config-internal.sh removal18:58
SamYapleone those patches start landing we can worry about cleaning up the remaing references18:59
*** jpeeler has quit IRC19:03
*** jpeeler has joined #kolla19:05
*** jpeeler has joined #kolla19:05
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for nova  https://review.openstack.org/21056119:08
*** banix has joined #kolla19:11
SamYaplerhallisey TripleO will still be using docker-compose right?19:12
jpeelerit doesn't have to19:13
SamYaplewell i was asking morein reference to the requirements.txt19:14
SamYapleim looking at the DinD gate thing19:14
SamYapleif we dont gate with compose, i would prefer to not have it there since it has wierd restrictions on docker-py19:14
*** echoingumesh has joined #kolla19:19
*** mfalatic has joined #kolla19:19
*** daneyon_ has joined #kolla19:19
*** daneyon has quit IRC19:22
SamYaplecoolsvap: ping19:25
rhalliseySamYaple, I'm not sure just yet19:36
*** banix has quit IRC19:41
openstackgerritSam Yaple proposed stackforge/kolla: Remove config-internal for neutron  https://review.openstack.org/21056619:44
openstackgerritSam Yaple proposed stackforge/kolla: Remove Ansible abstraction for Keystone  https://review.openstack.org/21004119:48
*** echoingumesh has quit IRC19:53
*** echoingumesh has joined #kolla19:54
*** echoingumesh has quit IRC19:58
*** banix has joined #kolla20:00
*** jtriley has quit IRC20:06
*** jtriley has joined #kolla20:08
*** achanda has quit IRC20:08
*** echoingumesh has joined #kolla20:12
sdake_samyaple you around?20:33
sdake_damn samyaple jacked all my commits ;-)20:34
sdake_samyaple wtb comments on ha deploy idea20:34
*** jruano has quit IRC20:45
SamYaplesdake_: ping20:45
SamYaplesdake_: no ive just wanted to get rid of config-internal for a while20:45
SamYaplei was highly motivated20:45
SamYaplei am the highest commiter at RAX now20:46
SamYapleso thats cool20:46
sdake_haha grats bro20:46
sdake_I would have finished the job but had 3 hour torture session at dentist20:46
sdake_so can you evaluate the ha deploy idea plz20:47
sdake_or have you already20:47
sdake_i'd like to see if you can come up with something better20:47
SamYaplei have questions about it20:47
sdake_cool lets see if we can make it consistent :)20:47
sdake_shoot20:47
sdake_come up with something better->improve the idea20:47
SamYapleso my idea was basic, since the passwords.yml can be encrypted in an ansible manner, why not tar and ship the /etc/kolla directory with date and timestamp each run?20:48
sdake_one thing that will complicate the process is etcd needs a haproxy in front of it20:48
SamYaplethat was my initial idea anyway20:48
SamYapleyea i dont like having etcd20:48
SamYapleat all20:48
SamYaplei dont like external depends like that20:48
sdake_its totally optional20:48
SamYaplebut i still want an automated way to do this backup/versioning20:49
sdake_you can use backup/restore20:49
SamYapleso do we have two in the repo?20:49
sdake_two which? methods of ha?20:49
sdake_the cool thing about etcd is we only need to store the data and retrieve it - so the ha is pretty straightforward20:49
SamYapleim confused here. what is the end goal of that blueprint20:49
sdake_to provide a deploy host in case the disk goes byebye in a redundant fashion20:50
sdake_there are two blueprints20:50
sdake_it might help to read both if you haven't20:50
SamYapleand a tar distributed around is not good enough?20:50
SamYaplei only say the linked one20:50
sdake_the other is a dep in it20:51
sdake_if you look at the bottom of the blueprint20:51
sdake_it explains a workflow for deploying openstack involving ha deployment hosts20:51
sdake_i am not super hot on copying around tars to some place20:51
sdake_not sure why20:51
sdake_guess seems error prone20:52
sdake_but obviously less complex20:52
*** sdake_ is now known as sdake20:52
SamYaplebut you want to introduce etcd?20:52
SamYapleits not error prone at all20:52
sdakeor galera would be a differnent optoin20:52
sdakeor tar could be a third option via sshd20:52
sdakebasically pluggable protocol handlers20:52
SamYapleim strongly opposed to using etcd. it is used no where else20:53
sdakeso tar work in this model too20:53
sdakeyou mean in openstack not used elsewhere or in general?20:53
SamYapleman i really really dont like this scope creep20:53
sdakewe dont have to do in liberty but people want ha deploy hosts vs one deploy host where bad things happen and the deployment is fubared20:53
SamYaplewell people can have that, that has nothing to do with kolla. why is kolla solving for that?20:54
SamYaplei mean ceph-deploy doesnt solve for that issue, because its outside of scope20:54
sdakeit involves the plugin that does the merging of the configs20:54
sdakeceph guys want to use etcd for configs too20:54
SamYaplehow so?20:54
SamYaplebut they dont20:54
SamYaplebecause push back20:55
sdakeagree they dont but that is their stated intent20:55
SamYaplewhy are we talking about modifying merge_configs?20:55
sdaketo read direclty from etcd  rtaher then file://20:55
sdakether would be etcd://ip/path20:55
SamYapleugh no thats horrible20:55
SamYaplethis is major scope creep in my opinion20:56
sdakethat way configs are basically stored in a database20:56
SamYaplewe are doing infrastructure for a product now20:56
sdakebut optional, file:// would be default20:56
sdakeyou mean with that addition?20:56
SamYaplethis is a huge layer of complexity20:56
sdakefile or etcd or galera or whatever backend would go in the ansible config20:57
SamYapleyea but now its on kolla to setup and maintain doing all that20:57
sdakeseems pretty simple - deploy an etcd container20:57
SamYaplethats huge scope creep20:58
sdakewell its on us to figure out how to ha-ify deployment20:58
sdakenot the deployed openstackbut also the deployment process20:58
SamYaplei disagree strongly. that is not on us20:58
SamYaplebut a tarball of the current configs is acceptable20:59
SamYaplethats simple enough and secure with ansible vault20:59
sdakewould you agree people will want this sort of functionality?20:59
SamYaplein a product they build, yes20:59
sdakeexplain valut to me20:59
SamYapleit just encrypts the passwords/global.yml20:59
SamYapleso the tarball can be on all the host securely20:59
sdakethe downside of vault is it is propreitary20:59
SamYaplewith etcd you are moving raw plaintext passwords everywhere20:59
SamYaplewell this is ansible...21:00
sdakeyou can secure with thttps21:00
SamYaplemerge_config is all ansible..21:00
SamYaplethis doesnt solve for anyhing but ansible21:00
SamYapleif someone wnats to do this for anythign else it wouldnt work21:00
SamYapleand im against adding it to the ansible implementation21:00
SamYaplethis is suppose to be basic reference (but working) anyway21:00
SamYaplewe arent writting a product for a company, thats the companies job21:01
sdakei want that product  to be entirely open source ;-)21:01
SamYapleyou cant fix all business needs with open-source project21:01
SamYapleour ansible implementation is lean and clean. i really want to keep it that way21:02
sdaketripleo tackles ha of the overcloud - its mandatory21:02
SamYaplestart throwing in etcd does not make it clean and understandable21:02
sdakeI was actually thinking of a separate ansible directroy for the etcd stuff21:02
SamYaplei will not ever be on board with this idea21:02
SamYaplewe have a clean small base right now21:03
SamYaplei do not want scope creep21:03
SamYaplethe tarball shipping around prevents config loss21:03
sdakeya thats backup/restore model21:03
sdakenot an ha model21:03
SamYapleyea but we deploy openstack, we dont deploy deployment tools21:04
sdakei agree backup restore is one approach21:04
sdakei wasn't suggesting deploying deployment tools21:04
sdakejust infra to support the deployment tool we have21:05
SamYaplehere is the problem i have21:06
SamYaplewe just went through a bunch of effort to containerize dep21:07
SamYapledeps*21:07
SamYaplenow you are talking about adding things to the host21:07
SamYapleyou _must_ have ansible installed on all nodes to have deploy ha21:07
SamYaplei disagree with messing with the host21:07
SamYaplewe just removed all deps except docker and dokcer-py21:07
SamYaplenow you want ot add more21:07
sdakein containers21:09
sdakein the control nodes21:09
sdakenot on the deploy hosts21:09
SamYapleso deploy hosts are a seperate thing now?21:09
*** achanda has joined #kolla21:10
SamYaplei mean we could have just had a dependacies node then21:10
SamYaplethe point was to not touch the host automatically21:10
SamYaplethe user has to install ansible and clone kolla to deploy21:10
SamYaplenow we are tlaking automatically adding that to nodes21:10
sdaketo the control nodes21:10
SamYapleany nodes21:10
sdakewhich we already ad a shit ton of stuff to anyway21:10
SamYapleno we dont21:11
*** rhallisey has quit IRC21:11
SamYaplewe dont add anything21:11
sdakeya a whole lot of containers21:11
SamYaplecontainers are different21:11
sdakeoh you missed i want etcd in container21:11
SamYapleunless you are saying a kolla-deploy container with that container having ansible21:11
sdakeso its just another thing that docker deploys21:11
sdakenot talking about adding dependencies in the root filesystem21:11
SamYapleright, but that is not ha since youll need access to kolla and ansible somewhere21:12
SamYaplesame issue21:12
sdakelike via yum etc21:12
sdakeya you could run ansible from any node point it at the etcd ip and your good to rock21:12
sdakerather kolla21:12
SamYaplebut where would ansible get the initial configs to point to etcd?21:13
sdakeso there is a pull and push operation essentially pull downloads the config to your local etc dir push pushes to etcd21:14
sdakeyou make changes, push and deploy21:14
sdakecovered in the other blueprint21:14
SamYaplei know how it works, but you still need initial configuration21:14
SamYapleso say your deploy node goes down21:14
SamYaplethen you have to run anisble somewhere else21:14
SamYapleyou still have to configure kolla to point to etcd21:14
*** jtriley has quit IRC21:15
sdakeagree you do have to ocnfigure kolla to point to etcd21:15
SamYaplestill requires configuration, would prefer a restore from a tarball then i dont have any configuration21:15
sdakei wanted to ask how we could do that21:15
sdakepossibly without a config file21:15
sdakeif thats even possible with ansible21:15
SamYapleby having lots of feature creep?21:15
sdakei am talking about a compeltely new "ansible_deploy" directory21:16
sdakethat has a completely new ansible deploy setup stuff in it21:16
sdakebut the regular ansible dir merge configs can read from etcd or whatever21:16
sdakeread the other blueprint real quick plz21:17
SamYaplei alreayd have21:17
sdakeok21:17
SamYaplei am strongly against all of this. it is just feature creep and not a magic bullet21:18
sdakebasically the thing in kolla that is persistent is all in /etc so if we can put that anywhere (like a db for  example) then we can run kolla from anywhere that can connect to the db (vs moving tarballsaround)21:18
SamYaplethe _only_ thing i might be ok with is a kolla_deploy container on all the host/group of host that has the configs21:18
SamYapleyoure trying to build infrastructure i feel has no place in kolla21:19
sdakeexpand on that I dont grok (3 hr dental drilling sesion)21:19
sdakesay the config-internal, did you cover all the ones i didn't finish21:19
SamYapleyea21:20
sdakewhat would a kolla deploy container do exactly?21:20
SamYaplethe end goal here is to have the files in more than one location, correct?21:20
sdakethe end goal is to have the files in one location but replicated for resiliency21:20
SamYaplehow is that different than what i said?21:21
SamYapleanyway21:21
sdakeyou said more then one location I said one location ;)21:21
SamYaplethis still has a chicken and egg situation21:21
sdakewhich is what21:22
SamYaplehow do you do that before you have the other containers?21:22
SamYapleyou are backing up configs about contaienrs that are running in running containers21:22
SamYaplein the end youre still screwed if all your contaienrs go down21:22
sdakeyou mean how do you deploy the first time?21:22
sdakeagree, its an ha solution not a backup solution21:23
sdakebackup solution is tar -> copy offsite21:23
sdakein ha if alll your nodes go down, your down ;)21:23
SamYapleso it sounds like we both understand each other. the difference is i do not agree with this massive feature creep21:23
SamYapleyou still need a backup because youll need to configure where etcd is21:24
SamYaplethis add complication without solving the issue its meant to solve21:24
sdakeits meant to solve an availabliity issue - wihch is when the deploy host goes down, you can no longer deploy21:24
SamYaplebut it doesnt21:24
sdakeif there is replicated store, avaiability goes up21:24
SamYaplebecause then you have to configure a new node21:25
SamYapleand know how to configure it21:25
sdakeor you could configure multiple deploy hosts simulatenously21:25
SamYapletrue, but you could do that with any number of methods21:25
sdakethis is more the model i was thinking people would use21:25
SamYaplemy point is they are all outside kolla scope21:26
*** banix has quit IRC21:26
sdakei hear you think they are outside of scope - i think they are inside scope but possibly further down the road21:27
sdakei have had several people ask me how do we do ha of the deploy host21:27
sdakepretty much everyone asks21:27
SamYapleif you can make it fully solve the issue then sure21:27
sdakeand i go "we dont"21:27
SamYaplebut it doesnt21:27
SamYaplewe dont prevent it either21:28
SamYaplewe do lots of "we dont do it, but you can do it"21:28
SamYaplethe point is flexibility21:28
sdakewhat could be more flexible then readin the config from any data store rather then the local filesystem only?21:28
SamYaplei never said that wasnt flexible, i said thats not in scope *but* we dont prevent it21:29
SamYaplei disagree with kolla having this functionality included21:29
sdakewe dont enable it either21:29
SamYaplei also disagree with blocking it21:29
sdakeat the current mometn there is no way to deploy kolla in a ha way on the deployment host21:30
SamYaplelies21:30
SamYapleNFS share21:30
SamYapledrbd21:30
SamYapletwo ways right there21:30
sdakenfs share is not suitable - get real21:30
sdakedrdb , not familiar21:30
SamYapledont tell me that21:30
SamYaplelots of people have NetAPP21:30
SamYaplemy point is this isnt our issue to solve21:30
SamYapleboth of those ways work21:31
SamYaplethere are plenty of other ways tat work21:31
sdakei originally thoguth of nfs share21:31
SamYaplenot our issue to solve21:31
sdakebut the only way that works is if someone has a ha nfs system21:31
SamYapleright, not our issue to solve21:31
sdakeha nfs is a huge pita to setup21:31
SamYaplei agree21:31
SamYaplei dont recommend it21:31
SamYaplebut the fact is if a shop already has a NetAPP, this would be perfect for them21:32
SamYapleif they are big uses for DRBD, that would also work21:32
SamYaplenot kollas issue to solve21:32
sdakedrdb isnt filesystem based is it?21:32
SamYapleits that horrible distributed block device thing21:32
sdakeagree, its block storage so thats no good - it only allows one writer21:33
SamYaplenot true21:33
SamYapleits drbd21:33
sdakeyou can put a filesystem on it?21:33
SamYapleyes21:33
SamYapleit does distributed locking21:33
SamYapleim not here to advocate for it21:33
sdakeand the filesystem can be writte nby both nodes?21:33
SamYaplemy point is right now there are several ways to solve it21:33
SamYaplei dont want to include a way21:34
sdakeso essentiallly yo udont want to have a way to solve ha of the deployment nodes21:34
SamYaplei dont want to include a way. i want to have many options and suggestions21:34
sdakethe only viable way today realistically is netapp nfs sharing21:35
sdakeor some other ha hardware nfs system21:35
SamYaplewrong21:35
SamYaplegluesterfs cephfs are both considered stable21:35
bmacei don't think it would be terrible to have a default / tested way to do it, and allow for other people to use different technologies for it if they want.21:36
SamYapledrbd does actually work21:36
sdakei dont think drdb does filesystem sharing like yo uthink it does21:36
sdakeanyway drdb was a huge clusterfuck in teh cluster space :)21:36
SamYaplei agree we can move on21:36
SamYaplemy point is there are solutions out there and its out of scope for kolla to solve infra problems21:37
sdakeso glusterfs cephfs are also viable options21:37
sdakethe proposal is optional in that if someone wanted to use a different way as bmace suggested it would be on them to sort out a way21:37
SamYaplebut by introducing a huge dependacies into ansible21:38
SamYaplewe would have to maintain a module that now deals with etcd21:38
sdakewhich dependencies?21:38
sdakeits a  simple curl operation21:38
SamYaplewhich would be implemented how?21:38
sdakeit would add a http dependency of some sort21:38
SamYapleugh i dont want to go down this conversational path21:39
SamYaplei dont need to agrue the semeantics there. there are options. i strongly feel this is out of scope for kolla21:39
SamYapleit was brought up around the mission statement time and i stated it then too21:39
SamYaplewe are not here to solve infra problems21:39
sdakeat some point we may want to tackle bare metal deployment21:40
bmacewe deploy ha openstack.. we are directly fixing infra problems21:40
sdakei imagine we will have the same argument ;)21:40
bmaceand the solution as a whole isn't really ha if the ansible node can go down and you are completely hosed.21:40
SamYaplebmace: but thats my point, you would still be until you reconfigure a node21:40
sdakeyou setup two nodes..21:41
sdaketo start with21:41
sdakeno reconfigure21:41
SamYaplewhich you can do now21:41
sdakeyes but the configs get out of sync!21:41
SamYaplenot with a shared backend21:41
SamYaplealready solved issue21:41
SamYaplethis is out of scope for kolla21:41
sdakeyes if someone deploys ceph or gluster or nfs in a ha fashion, and mounts /etc/kolla from it, its solved21:42
SamYapleso what youre saying is, there are solutions? why are we trying to solve all issues with kolla21:42
SamYaplethis is the very definition of project scope creep21:42
sdakescope expansion isn't a bad thing if it increases the appeal of the project to the userbase21:43
SamYaplewhile i agree, i disagree this is something we should be expanding into21:43
sdakeif its optional, what is the harm?21:43
sdakejust like nfs/ceph/gluter are optional21:44
SamYapleadded code to maintain and you are tainting the merge_config module which is super tiny and easily maintainable at the moment21:44
sdaketainting is a strong word there ;)21:44
SamYaplefair point21:44
sdakei agree it increases the complexity of merge_config but its really simple and adding other protocol handlers would be really simple as well21:45
SamYaplebut do we want to be in the position of maintaining ansible modules? we agreed we wouldn't21:45
sdakei think its fine to maintain some ansible modules that are custom to our solution21:45
sdakewhich that one fits that definition21:45
SamYapleright if they are tiny, which they are21:45
SamYaplethey wont be21:45
SamYaplei mean you dont really know whats involved. the playbooks wont work both ways21:46
sdakethe playbooks take an option "protocol_handler" or call it what you like21:46
SamYaplewe use the temlpating module at the moment and that has no etcd support21:46
sdakefile://21:46
sdakeor etcd://ip21:46
SamYaplewe still have21:46
sdakewhich tempalting module21:46
SamYaplethe module called template21:47
sdakewhat does that do21:47
sdakenot familiar with that one21:47
SamYapletakes templates and fills them out21:47
sdakethat creates /usr/share/kolla/templates or something?21:47
SamYapleit basically all we use21:47
SamYapleyea that sounds right21:47
sdakei am not talking about modifying that21:47
sdakeonly merge configs21:48
sdakemege configs takea a bunch of inputs and writes a file to the filesystem21:48
sdakei like that model21:48
sdakewhat i prpose is reading th einputs from various sources other then file://21:48
SamYaplei dont hink you understand how this is going to work then21:48
sdakeonce an ansible deploy is in progress, if it fails because the machine dies, you gotta start over ;)21:48
SamYaplein your scenario how do files get into etcd21:49
sdakeyour right I dont have any idea exactly how this would work21:49
SamYaplethose templat files would need to go _into_ etcd21:49
sdakepossibly a tool on the host which copies them to etcd21:49
sdakeno the template files stay on the local host - since they are only used during deployment21:49
SamYapledo you not see how this is complicated and anti-kolla?21:49
sdakeon the local filesystem21:49
SamYapleno they dont21:50
*** sdake_ has joined #kolla21:51
sdake_got dced21:51
sdake_I see it adds minimal complication21:52
sdake_and is optional with filesystem based deefaults21:52
SamYapleyou are wrong21:52
SamYapleit adds lots of complication21:52
SamYapleand its not like ansible has good if then else logic21:52
sdake_why do we need conditional logic to do this?21:52
sdake_I agree btw ansible conditionals no bueno :)21:53
SamYaplethe flow would have to be that the templated files would need to come from etcd21:54
SamYaplethis isn't just merge_config modifictation21:54
sdake_no, just the etc files21:54
sdake_template files are created by etc files correct?21:54
SamYaplewhat do you think templates them?21:54
SamYapleansible21:54
SamYapletemplate module has not etcd support21:54
sdake_ok so explain flow to me - perhaps I dont understand well enough21:54
*** sdake has quit IRC21:55
*** bmace has quit IRC21:55
sdake_I thought it was ansible -> merge configs outputs to template files -> template files output to /opt/kolla on the nodes21:55
SamYapleeven if this was easy to do, i would still be against it since i view it as a problem kolla shouldnt be solving for21:55
SamYapleansible templates the stuff from /etc/kolla on the deploy host to the dest node21:55
SamYaplethen merge config runs21:55
*** bmace has joined #kolla21:55
SamYaplethat saves it to the file location on the dest node21:55
SamYapleyou would have to fetch files from etcd to template them21:56
sdake_i see, so merge_configs isn't the correct integration point is what your saying21:56
sdake_i thought merge configs ran on the local node21:56
sdake_(on the deploy host)21:56
SamYaplewell it could be if we really expand it which is what im against21:56
SamYapleno ansible code runs on hte deploy host (exception of local_action's)21:57
sdake_so i am also against having each deploy node connect to etcd21:57
sdake_rathe reach deployed node21:57
SamYapleoh well then this will never work21:57
sdake_how do the config files get into the deployed host?21:57
sdake_from the deployment host21:57
SamYaplebefore we continue21:57
SamYaplecan se standardize on names for 'deploy host' and 'destination host'21:58
SamYaplewhat are we calling them?21:58
sdake_i could see why yo uwould be bent out of shape about each deployed node reading etcd21:58
sdake_i dont ike that either21:58
SamYapleme either21:58
sdake_sounds good21:58
SamYapleok all ansible code will execute on the 'destination host'21:58
SamYaplealways21:58
SamYaplethats kinda ansibles deal21:58
sdake_deploy host = wher ansible runs = destination host = where containers run in general21:58
SamYapleyes21:58
SamYapleansible installed on deploy host21:58
SamYapleit actually executtes code on 'desitination host'21:59
sdake_how does it get the etc configuration files?21:59
sdake_from the deploy host21:59
SamYapleansible copies the file from the deploy host to the destination host. before it writes out the file to the destniation host it passes it through the jinja2 templaing filter21:59
SamYaplethats done for each file (6-7 files)22:00
sdake_ok22:00
sdake_how does that happen, ansible has some built in copy function?22:00
SamYapletemplate22:00
SamYaplehttps://github.com/stackforge/kolla/blob/master/ansible/roles/config.yml#L1322:00
sdake_is that a built in module?22:00
SamYapleyes22:00
sdake_hmm22:01
sdake_well that sucks22:01
SamYaplewell thats ansible22:01
sdake_i guess my idea wont work22:01
SamYaplewell thats my point22:01
SamYapleit _can_22:01
SamYapleits just lots of scope creep22:01
sdake_template is some kind of ssh built in module to ansible?22:02
SamYapletemplate is pretty core to ansible22:02
SamYaplessh im not so sure about22:02
SamYaplewhat do you mean22:02
sdake_i am curious how template works22:02
SamYaplesame way all other ansible code works22:03
sdake_becuase your right template would hve to have th etcd integration for this to work22:03
SamYaplewhich means really building template into merge_configs which i am strongly against22:03
SamYaplei think thats way to much creep22:03
sdake_nah it just means having a template which can read from etcd, but I suspect that may be hard if its a built in module22:04
SamYaplehow do you modify the files in etcd?22:04
sdake_because somehow it copies from the local host22:04
sdake_python script loads new config from /etc22:04
sdake_like 5 lines of python22:04
sdake_really simple22:05
SamYapleso external to ansible stuff :/22:05
SamYaplethat we were also against22:05
ccrouchso now we're in the big tent, when are we moving under the openstack namespace in github?22:05
SamYapleccrouch: there is a review for it22:05
sdake_ccrouch there is a review in progress for that22:05
ccrouchah ha, awesome22:05
sdake_but when - i dont know - depends on the next infra move process22:05
SamYapleccrouch: https://review.openstack.org/#/c/209343/22:05
sdake_i haven't got an answer on that yet22:05
ccrouchthx22:06
SamYaplesdake_: youll need to fix up all your config-internal patches. i left reviews for errors, but youll need to run the min-env.sh script22:09
SamYaplei figure once the docker container code is removed, we can be a bit rougher with the scripts22:09
SamYaplebut well play nice with them until that time22:09
sdake_ccrouch according to clarkb ther eis no proejct move scheduled22:10
sdake_but committers will still get free atc passes22:10
sdake_because the atc passes are based upon the governance repo -ag a in based upon clarkb22:11
SamYaplewasn't the cutoff on that a while ago?22:11
sdake_typically l3 is the cutoff22:11
SamYapleah ok22:11
SamYaplemaybe they just sent me teh AC pass a while ago22:11
SamYaplethat might be what im thinking22:11
sdake_rather the 3rd milestone22:11
sdake_ya they send em out along the way22:11
sdake_but they get people in that last milestone typicallly in the past22:11
SamYaplecool22:12
sdake_samyaple i'm likely to rebase a delete gen-min-env removal patch in front of my patches ;)22:13
SamYapleyou really should break those up for speed of merge reasons22:14
sdake_well bmace given the new understanding of how ansible works with the templat emodule, it may not be possible to do what i want22:14
sdake_is there a way to remove the deps?22:14
SamYaplerebase against master?22:15
sdake_you mean each individual patch in a branchz?22:15
SamYaplei mean you arent doing dependant changes22:15
SamYapleha yea22:15
SamYaplei can hear the groan from here22:15
sdake_lol22:16
sdake_ya noot doing that22:16
sdake_too lazy :)22:16
SamYapleeh i did it because i wanted them to not be dependant22:16
sdake_i was actually going to do a whole stream and then have a proper removal of compose at the end with modifications to the docs22:16
sdake_so it wa going to be dependent when i finished22:17
sdake_atleast thatwas my well laid plan until you ninjaed myw ork :)22:17
SamYaplelies! i saw all your patches were bad and it was going to take forever22:17
SamYaplebut truthfully, I just wanted to do some mindless work for a while22:18
SamYapleim tired of thinking22:18
*** dims_ has joined #kolla22:18
sdake_ya me too22:18
sdake_at magnum midcycle constant brainstorming hard on the brain22:19
sdake_so samyaple heres a q, is it possible to run an ansible module on the deployment host?22:19
sdake_that template module does it22:19
sdake_is that only because its built in?22:20
sdake_or is template even a module22:20
SamYaplethat template module does what?22:20
SamYapleit doesnt run on the deployment host22:20
sdake_the one you linked earlier that copies from the src to the deployment target22:20
SamYapleoh yea thats a special module, but its still executing the code on the destination host22:21
sdake_somethign reads /etc/kolla/nova.conf22:21
SamYapleit needs to be run on the destination host since it uses facts from there to file out the template22:21
sdake_so it calls bck into the source host how?22:22
bmacesdake: pure file replication seems simple enough for the time being.  suggest a clustered / shared file system unless you want to have issues with needing to sync files via some other mechanism.22:22
*** dimsum__ has quit IRC22:22
bmaceit is what i was expecting for the time being anyway22:22
sdake_bmace you mean something like netapp nfs?22:22
SamYaplesdake_: it doesnt ansible generates a python file with the content22:22
sdake_like some kind of json encode or something?22:23
SamYaplei wish i oculd show you this22:23
SamYapleyou need to know how ansible works22:23
SamYapleheres what you do22:23
bmacei think there are other clustered fs options, zfs, etc.22:23
SamYapleactually ill do a pastebin22:23
sdake_samyaple much appreciated22:24
SamYaplezfs is a single host filesystem22:24
sdake_i need to learn how this stuff works ;)22:24
bmacei believe there are some clustered zfs options22:24
SamYaplenope22:24
SamYaplezfs is only ever a single host filesystem22:24
SamYapleits like there mission statement22:24
SamYaplesame with btrfs22:25
sdake_who would want to make a distributed disk based filesystem anyway22:25
* sdake_ groans22:25
* sdake_ worked on gfs for some time22:25
sdake_take my word for it - its just a bad bad idea :)22:25
SamYapleceph is amazing22:25
SamYapleyou need to not use gfs ever22:25
SamYapleits bad22:25
sdake_its different then gfs22:25
SamYapleits disk based22:26
sdake_yup22:26
SamYapleits not different htough22:26
sdake_is it kernel based? ;-)22:26
SamYaplei think you are refering to distributed POSIX based filesystem22:26
sdake_that is why gfs is full of fail22:26
sdake_i hear good things for ceph but haven't actually tried it22:27
sdake_i hear gluster has data corrutpion issues all the time but have tried it22:27
sdake_several years ago22:27
sdake_posix based filesystem is fine, implemented in kernel - bad idea - implemented with a dlm - bad idea22:28
*** gfidente has quit IRC22:28
sdake_^A distributed22:28
bmacelooking around the interwebs i see several mention of both active / active and active / passive mechanisms for HA ZFS..22:29
sdake_samyaple pastebin or working on it?22:29
SamYaplebmace: all using nfs22:29
SamYaplesdake_: woking on it22:29
sdake_cool thanks sam22:29
SamYaplebmace: thats not the same thing as a clustered filesystem (block level)22:29
sdake_i really want to understand how this stuff works22:30
SamYapleand they suck really hard22:30
sdake_hard for me to be a technical leader if I dont ;)22:30
SamYapleactive/passive is alright22:30
sdake_the cats at hp use etcd in their ansible openstack deployment product22:31
SamYapleand DVR22:31
sdake_too bad its proprietary22:31
sdake_bunch of fail proprietary development is22:31
SamYaplehttp://paste.openstack.org/show/412237/22:33
SamYaplesdake_: ^22:33
SamYapleill walk you through it22:33
SamYaplei run the mariadb role with '--step' to as me which tasks to run22:34
SamYaplei used the env variable ANSIBLE_KEEP_REMOTE_FILES=1 to keep around files after the task finishes22:34
SamYaplethe ~/.ansible/tmp/ directory has those files22:34
SamYaplein this case it generated file  ansible-tmp-1438986634.79-140852425034088/copy for that template task22:35
SamYaplelooking through that file youll see the source of the template is on the destination node22:35
SamYaplesrc=/root/.ansible/tmp/ansible-tmp-1438986634.79-140852425034088/source22:35
bmacebtw, does the ansible deploy need to be done as root or sudoable user at this point?  i think there was some sort of chmod or something there at some point that made me need to run as root22:36
SamYaplebmace: if running AIO it needs to run as root22:37
SamYapleit always will22:37
*** Haomeng has quit IRC22:37
*** Haomeng|2 has joined #kolla22:37
SamYaplefor multinode, ansible does not need to run as root on the deploy node22:37
SamYapleit still needs to be logged in as root on the destnitation node (we dont have sudo support yet)22:37
bmacethat is a bit of a killer in a lot of enterprise IT environments22:38
SamYaplefeel free to write the sudo support, i havent had the cycles to be honest22:38
SamYapleand unfortunately most deployment tools for openstack require root  :/22:38
bmacei may end up doing that :)22:38
SamYaplei mean it would still be passwordless sudo so its not like its that much more secure22:39
sdake_still secured by keys22:39
sdake_so its better then wide open root ;)22:39
bmacebut you think the user will always at least need sudo?  just being in the docker group isn't enough?  if we have some kolla user that can modify the files in /var/lib/kolla or whatever the containers mount in, and can do docker stuff, what else would they need sudo for?22:39
SamYaplebmace: yes always22:40
bmacefor what commands?22:40
SamYaplewe do tweak sysctl and other things22:40
SamYaplei mean, maybe with the right configuration and ahead of time preperation you wouldn't need to...22:40
SamYaplebut boy is that a bad idea22:40
SamYaplesince the containers run as root and --privileged22:41
SamYaplethe configs would have to be use modifable22:41
bmacethe only place i see any direct sysctl being done is in our gate, in the repo, unless it is hidden via being named something odd somewhere.22:41
sdake_could be group modifiable22:41
SamYaplethats alot a big  security hole22:41
SamYaplebmace, sysctl has an ansible module22:41
SamYaplewe call that22:41
bmaceno bigger than letting someone have open sudo access to do anything they want22:41
SamYaplealso thanks for reminding me, cause we need to call that for other things too22:42
SamYaplebmace: I would argue that it is22:42
SamYaplethe wrong permsissions and a user that doesnt have passwordless sudo could execute root code potentially22:42
bmacethat still isn't more access than someone that can, without a doubt, run anything as root via sudo22:43
bmaceit may be equal to, but not more than22:44
SamYaplescenario here. user a -- privilieged has root trusted, user b -- no root access only22:44
SamYapleuser b, due to bad perms, can write to a file that root execs22:44
SamYaplebam22:44
sdake_samyaple so in this case the template module is writing the file to /root/.ansible/tmp/ansible-tmp* of the contents of galera.cnf.j2 and the target host scps it from the server?22:44
sdake_deployment nod i mean?22:44
SamYapleno the deployment node scps over the file, then then the template code processes it22:45
sdake_so one way to make this work woudl be to add etcd support to that template module22:45
sdake_or make something similar to it with protocol support besides file?22:46
sdake_or is template so hard wired into ansible that is knows to write teh file out locally?22:46
SamYapleyoure talking about rewriting a core ansible module. i have no idea how wired it in is, but i would still be against it22:47
SamYapleeven if it was possible22:47
*** bradjones has quit IRC22:49
*** Ti-mo has quit IRC22:49
sdake_tbh i am surprised ansible doesn't have etcd integration already22:49
sdake_its pretty hot tech22:49
SamYapleansible still wont support python 322:49
SamYaplejust saying22:49
sdake_and you use the template module to copy every file in /etc/kolla?22:50
sdake_like merge-configs uses it in some way?22:50
SamYapleyes22:54
SamYapleevery file passes through the template filter22:54
*** bradjones has joined #kolla22:55
*** bradjones has quit IRC22:55
*** bradjones has joined #kolla22:55
sdake_samyaple thanks for helping me understand - definately not as easy to implement as I thought it would be22:57
sdake_(and simple)22:57
*** Ti-mo has joined #kolla22:59
sdake_someone should name their openstacck project metacortex imo ;)23:01
sdake_ok guys here is the deal on atc passes23:01
sdake_the foundation parses the governance repo, looks at the repos in there, and produces atc passes based upon commits for the last 6 months23:02
sdake_in our case, our governance repo lists openstack/kolla23:02
sdake_there is no openstack/kolla23:02
sdake_so no atc pass will be generated23:02
*** Ti-mo has quit IRC23:11
*** Ti-mo has joined #kolla23:11
SamYaplequick, do a docs.openstack.org patch!23:12
SamYapleif anyone would like help with that, I can point them to a few areas that could use some rework23:12
SamYapleif you need an ATC that is23:12
SamYaplesdake_: isn't the merge cycle to get us moved into github.com/openstack like in a few days?23:14
sdake_clarkb said they have no move planned23:14
sdake_i am pretty sure he is the infra ptl23:14
SamYaplewhat does that mean?23:14
sdake_i am sending a mail to the mailing list now, hang tight23:14
sdake_and read that ok?23:14
SamYaplegood deal thanks23:15
sdake_(to inform people, because alot of people have their repos listed incorrectly to get atc passes).23:15
*** sdake_ is now known as sdake23:19
*** Ti-mo has quit IRC23:22
*** Ti-mo has joined #kolla23:29
*** jruano has joined #kolla23:30
sdakesamyaple https://review.openstack.org/#/c/210636/23:36
sdakeand see post on the mailing list23:36
SamYaplestackeforge doesnt get ATC you know....23:37
sdakeaccording to fungi its all about hte gonvernance repo23:37
sdakeanything in the governance repo gets a pass23:37
sdakeif the repo is correct23:37
SamYapleright but stackforge doesnt get ATC passes23:37
sdakeyes they do23:37
SamYapleno they dont23:37
sdakeif they are listed in the governance repo23:37
sdakefungi works at the foundation on atc pass generation23:38
sdakei'll leave it up to the TC to sort it out ;)23:38
sdakeread his quote on the eavesdrop23:38
SamYapleoh i see what youre saying23:39
SamYapleyea stackforge projects dont get ATC23:39
SamYaplebut Kolla is no longer a stackforge project23:40
SamYapleeven though thats where teh code currently resides23:40
sdakeyou should hang out on openstack-infra samyaple23:42
sdakeits an essential channel imo23:42
SamYapleto many channels :(23:43
sdakefungi said he is going to try to hack the script to ignore the identity namespace and just look at hte project name23:43
*** jasonsb has quit IRC23:45
openstackgerritMerged stackforge/kolla: Start docker without -H to make chgrp work on socket  https://review.openstack.org/21012223:51

Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!