Friday, 2021-04-16

*** mlavalle has quit IRC00:03
*** DSpider has quit IRC00:24
*** avass has quit IRC00:26
*** hamalq has quit IRC01:53
*** zul has quit IRC03:15
*** diablo_rojo has quit IRC03:52
*** ykarel has joined #opendev04:15
*** vishalmanchanda has joined #opendev04:29
*** whoami-rajat has joined #opendev04:57
*** snapdeal has joined #opendev05:02
*** marios has joined #opendev05:07
*** snapdeal has quit IRC05:17
*** ralonsoh has joined #opendev05:18
*** ysandeep|away is now known as ysandeep05:29
*** eolivare has joined #opendev06:24
*** sboyron has joined #opendev06:25
*** amoralej|off is now known as amoralej06:33
*** kopecmartin has quit IRC06:34
*** tinwood has quit IRC06:37
*** tinwood has joined #opendev06:40
*** lpetrut has joined #opendev06:40
*** kopecmartin has joined #opendev06:46
*** HeroicHitesh has joined #opendev06:55
*** zbr has quit IRC06:56
*** zbr has joined #opendev06:58
*** avass has joined #opendev07:00
*** ykarel_ has joined #opendev07:00
*** ykarel has quit IRC07:02
*** ykarel_ has quit IRC07:15
*** andrewbonney has joined #opendev07:15
*** ykarel has joined #opendev07:17
*** jpena|off is now known as jpena07:30
*** rpittau|afk is now known as rpittau07:32
*** tosky has joined #opendev07:39
*** HeroicHitesh has quit IRC08:05
fricklerfungi: creating an ed25519 key should work using the "--expert" option, so given the change in default (which I hadn't seen yet), I think I'd be fine with just switching completely08:14
*** ykarel is now known as ykarel|lunch08:44
*** ykarel|lunch has quit IRC08:48
openstackgerritMerged opendev/infra-manual master: Update branch creation for PolyGerrit
*** ykarel has joined #opendev09:38
*** dtantsur|afk is now known as dtantsur10:04
*** roman_g has joined #opendev10:41
*** ysandeep is now known as ysandeep|afk10:53
*** cloudnull has quit IRC11:09
*** cloudnull7 has joined #opendev11:09
*** jpena is now known as jpena|lunch11:32
*** ysandeep|afk is now known as ysandeep11:44
*** roman_g has quit IRC12:13
*** jpena|lunch is now known as jpena12:30
*** auristor has quit IRC12:38
*** auristor has joined #opendev12:42
*** amoralej is now known as amoralej|lunch13:18
fungifrickler: great, i'll work on that today. thanks for the suggestion!13:26
*** ysandeep is now known as ysandeep|away13:47
*** bhagyashris is now known as bhagyashris|away13:49
*** amoralej|lunch is now known as amoralej13:51
*** hashar has joined #opendev14:01
*** ykarel has quit IRC14:03
*** brinzhang_ has quit IRC14:08
*** brinzhang_ has joined #opendev14:09
*** rpittau is now known as rpittau|afk14:18
*** lpetrut has quit IRC14:26
clarkbcatching up on the two things I wanted to get rolling today (zk replacements and gerrit 3.2.8 update) I'm not sure we're ready for either :/ Airship release is still ongoing aiui and the zuul plugin fix hasn't been responded to by luca14:41
*** HeroicHitesh has joined #opendev15:11
*** HeroicHitesh has quit IRC15:22
*** ykarel has joined #opendev15:35
*** hashar has quit IRC15:41
*** amoralej is now known as amoralej|off15:43
clarkbfungi: ok I can see in the jeepyb job log that gerrit set-project-parent is called but then later when listing the parent it says it is still All-Projects. We are running manage-projects multiple times and now I wonder if the project parent is going in the acl file and if so we're overwriting it15:51
clarkbif that is the case then I think we may be able to just drop these changes and use the acl file directly to set this ifno15:51
fungiyeah, that's an idea. we can try setting a parent and see what change that makes to the acl in git15:52
fungithe docs didn't indicate that it was stored there, but i wouldn't be surprised if it actually is15:52
fungii'll give that a shot momentarily15:52
clarkbfungi: ok15:52
fungiclarkb: bingo! you're a genius15:59
fungiinheritFrom = openstack/meta-config15:59
fungichange coming up15:59
clarkbcool, I felt like I was going crazy yesterday when I couldn't get things to work :)16:00
clarkbbut then this morning it occurred to me that ^ may be happening16:00
fungithat was exactly what was going on16:00
*** ykarel has quit IRC16:01
*** ykarel has joined #opendev16:02
clarkbfungi: should I abandon the two chagnes I wrote related to this?16:06
clarkbI don't expect they provide any value (and in fact would just cause confusion since we manage the acl files directly)16:06
fungiclarkb: probably, we can always resurrect them again if they turn out to be needed16:06
fungiheh, wrong terminal!16:08
openstackgerritJeremy Stanley proposed openstack/project-config master: Allow inheritFrom in Gerrit configs
openstackgerritJeremy Stanley proposed openstack/project-config master: OpenStack Release Team ACLs inherit meta-config
fungithat's what i was trying to yes16:08
fungielod: ^ next steps16:11
clarkbI +2'd both but left a comment on the second you may want to consider16:11
fungii asked in #openstack-release for feedback, but the idea was to test with openstack/release-test16:13
fungihowever it shares an acl with the rest of the release team deliverables16:14
fungiwe could use opendev/sandbox i suppose but it's not an openstack repo16:14
clarkbfungi: oh in that case maybe split release-test out into its own acl for now?16:15
clarkbthen it can be folded back if/when all the other repos get the same treatment16:16
*** marios is now known as marios|out16:17
fungiclarkb: yeah, that was the alternative i suggested in #openstack-release16:20
*** dtantsur is now known as dtantsur|afk16:24
*** hamalq has joined #opendev16:28
*** Alex_Gaynor has left #opendev16:28
*** hamalq has quit IRC16:28
*** hamalq has joined #opendev16:29
*** jpena is now known as jpena|off16:31
*** marios|out has quit IRC16:34
*** ykarel has quit IRC16:42
*** ralonsoh has quit IRC16:53
*** mlavalle has joined #opendev17:11
*** roman_g has joined #opendev17:57
*** fressi has left #opendev17:58
*** vishalmanchanda has quit IRC18:04
*** andrewbonney has quit IRC18:05
elodfungi: oh, thanks for the patch! yes, what clarkb says sounds reasonable, I mean do the test having separate acl for release-test18:12
elodand sorry for the late response :S18:12
clarkbanyone know if the original stackalytics account is used for anything? it pops up in my account cleanup list18:17
spotzHey all getting an ssl error on Error code: SSL_ERROR_RX_RECORD_TOO_LONG18:19
clarkbspotz: I don't think we ever set up https there18:24
spotzclarkb: And I can get there http, but I clicked on a link. Let me go look18:24
spotzOk let me put up a patch:)18:25
openstackgerritAmy Marrich (spotz) proposed opendev/irc-meetings master: Fixed eavesdrop link
*** roman_g has quit IRC18:35
openstackgerritMerged opendev/irc-meetings master: Fixed eavesdrop link
openstackgerritJeremy Stanley proposed openstack/project-config master: OpenStack release-test ACLs inherit meta-config
fungielod: ^ better?18:37
*** eolivare has quit IRC18:38
*** jralbert has joined #opendev18:42
clarkbinfra-root in review:~clarkb/gerrit_user_cleanups/notes/proposed-cleanups.20210416 I've put in just under 200 additional cleanups that I think we can make without contacting users. The bulk of these cleanups have been chosen beacuse the account usage was ancient, or the account never had usage then usage started at some point, or it was clear the user had created a number of accounts all at once18:47
clarkband orphaned one or more of them, etc18:47
clarkbthat said we're getting to where the judgement is more likely to be wrong :)18:48
clarkbthe audit-results.yaml.20210415 file in the same dir was what I used to make my decisions fwiw if you want to cross check.18:48
clarkbI left out accounts where they seemed to be using one account for ssh and another for http. I also left out accounts where the conflicting accounts seemed recently active ~ 2018 was my gauge for that18:49
clarkbthere were also some cases where I could apply judgement based on what i knew about companies no longer existing etc18:50
*** whoami-rajat has quit IRC18:51
elodfungi: thanks, as far as I see it's good! :)18:55
openstackgerritMerged openstack/project-config master: Allow inheritFrom in Gerrit configs
openstackgerritMerged openstack/project-config master: OpenStack release-test ACLs inherit meta-config
*** ozzzo has quit IRC19:17
*** ozzzo has joined #opendev19:27
*** jralbert has quit IRC19:47
elodfungi: I'll try to add a stable/ocata branch to release-test repository. I guess I can do that directly and no need to do it through openstack/releases19:54
elodand I'll try to delete that with the script afterwards19:54
*** smcginnis has quit IRC19:54
clarkbelod: yes you should be able to add the branch through the web ui19:55
clarkb,branches there19:55
elodclarkb: thanks, that worked :]19:59
clarkbthe deletion too?20:01
elodtrying now to add a dummy patch and an ocata-eol tag afterwards20:03
elodjust to have the same things as we will have when running the scripts towards the "real" repos20:05
elodclarkb: or do you think it worth to try a delete first on the web gui?20:05
clarkbelod: that may be help isolate problems to the script if the script has trobule20:06
clarkbnot sure if fungi had a plan around testing or he was just going to let you at it :)20:06
elodok, so I've tested the branch deletion first through the web ui (created: stable/delete-me then deleted it) and it worked fine20:10
fungii was happy to let the release team test it20:11
fungielod: so next steps are probably to update every openstack/ namespace acl with that same inheritFrom = openstack/meta-config20:12
elodfungi: before that I'll try to test with the script as well. if I can manage that...20:12
fungioh, yep20:12
clarkbfungi: elod: also lets do those updates in batches20:13
clarkbI think there is a real risk the manage-projects script will timeout iof we do all the openstack repos at once20:13
fungialso the release team should decide if they want any auditing around making sure that acl is inherited by projects the release team oversees (and whether it should just be every acl in that namespace other than meta-config itself, for simplicity)20:13
clarkbwe should keep project-config out too20:16
clarkbit doesn't do releases and really needs to be split anyway20:16
*** slaweq has quit IRC20:29
elodok, the script tools/ worked, I was able to delete a dummy branch (stable/delete-elod) with it and couldn't delete (release-test/)stable/ocata from there as it has now an open patch (which I added as a trial patch)20:41
elod(though I haven't tried the whole tools/ script)20:42
fungiclarkb: right, good point wrt project-config. it's more opendev than openstack but hasn't been moved yet20:45
elod( )20:46
elodso now I'll prepare the patches (in batches) for every openstack/*20:47
elodthere are 337 config under gerrit/acls/openstack/20:52
elodhow many can be added in one patch to be on the safe side?20:52
clarkbelod: hard to say off the top of my head. Maybe do 25 in a batch?20:57
clarkbor maybe just do a single change of 25 and we can look at the timing for it20:58
clarkbthe cost per project should be fairly stable20:58
clarkbsince its pull refs/meta/config and update one file, verify things and push back20:58
clarkbif you'd like to wait for more data we can inspect the logs and see what typical runtimes for an acl update are20:59
fungialso keeping in mind the batches won't be exact. some of those acls are shared by a dozen or more projects21:00
fungiso what might be one acl file will end up with a dozen+ project configs pulled and pushed by the script21:00
clarkboh good point21:00
elodhmmm :S21:01
fungii don't think it's critical that the batches be of equivalent size, personally21:02
clarkbour timeout is 30 minutes21:02
fungitrying to make them exactly the same will just waste engineering time21:03
clarkbwe have had jobs timeout running manage-projects in recent history "neat"21:03
clarkbthinking out loud here: we could temporarily bump the timeout up to 3 hours then do 2 batches?21:04
clarkbwe can also do the update out of band (though I'd like to make the uatomation work if possible)21:05
fungiyeah, i'd rather we didn't have to babysit it21:05
fungiwe can do a few, see how long the deploy job takes, then do the next batch a bit larger/smaller21:06
clarkbconsidering it has already timed out in the last month I think we should bump the timeout either way21:07
fungione tactic might be for elod to put together a list of which projects have requested branch deletions, and prioritize getting those updated in the earlier batches21:07
fungithat way we can take the full conversion at a more measured pace without blocking the branch deletion requests which have been pending for ages21:07
*** sboyron has quit IRC21:08
clarkblooks like most of the time in the job when run typically is actually spent with gitea. And since we'll only be updating gerrit acls the gitea portion should go quickly21:08
elodsounds good! I'll check which projects have ocata-eol tag and propose those in the first batch21:09
elod28 repositories (without puppet-*)21:11
fungiyou can always split that into two or three batches21:11
openstackgerritClark Boylan proposed opendev/system-config master: Bump the infra-prod-manage-projects job timeout
fungiwe just put those batches first and then do the rest after21:11
clarkbthats the timeout bump21:11
fungithat's 1h20m21:13
fungiwhat was the default? 30?21:13
fungi40 i guess21:13
fungiminutes i mean21:13
clarkbit is 3021:13
fungigot it21:13
openstackgerritElod Illes proposed openstack/project-config master: Move projects under meta-config acl
elodthe 1st batch ^^^21:23
elodbtw, should we wait for the audit from release team as fungi you suggested?21:23
fungielod: i would wait on doing the full set of all batches until we have a discussion with the rest of the release team, but adding the ones we know want branches deleted should be fine21:24
elodfungi: ok21:25
fungithe bigger question is whether all openstack/*.config files (minus the couple of exceptions we've moted) should inherit from meta-config, or just the ones which are release-managed21:25
fungibut i'm inclined to push for all to keep it simple21:25
fungimy point was more that they'll probably want to update whatever auditing scripts they've got to at least make sure the release-managed repos do have that inheritance, as it will become more critical for their release automation (we plan to remove it from the global all-projects acl once this work is done)21:26
clarkbfungi: yes cleaning up all-projects is the main reason we should apply it to all the openstack repos I think21:28
clarkbthat way they don't loose and functionality21:28
openstackgerritMerged opendev/system-config master: Bump the infra-prod-manage-projects job timeout
openstackgerritElod Illes proposed openstack/project-config master: Move projects under meta-config acl (2)
openstackgerritElod Illes proposed openstack/project-config master: Move projects under meta-config acl (3)
elodclarkb fungi : ^^^ these 3 patches covers the acls for the repositories where I've found ocata-eol tag22:07
elodso now only 313 acl config left beyond these o:) (of course if we need all of them to inherit from meta-config... e.g. project-config.config, etc.)22:10
elodanyway, sorry, I need to drop off now and call it a day22:12
elodlet me know if I need to change something22:12
elodand thanks for the help so far!22:12
clarkbenjoy your weekend22:13
elodthanks :) same to you!22:13
openstackgerritKostyantyn Kalynovskyi proposed openstack/project-config master: ACL, allow merge for airship-release group
openstackgerritMerged openstack/project-config master: ACL, allow merge for airship-release group
*** tosky has quit IRC23:38
*** ysandeep|away is now known as ysandeep23:55
*** mlavalle has quit IRC23:55

Generated by 2.17.2 by Marius Gedminas - find it at!