Thursday, 2026-04-16

-@gerrit:opendev.org- Steve Baker proposed: [openstack/diskimage-builder] 984486: Skip local loop device creation for no-final-image builds https://review.opendev.org/c/openstack/diskimage-builder/+/98448603:48
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984800: Follow up for I170bdb3ffc89bc3307a08da7cd4c7f2793a4e491 https://review.opendev.org/c/openstack/project-config/+/98480006:07
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984800: Follow up for I170bdb3ffc89bc3307a08da7cd4c7f2793a4e491 https://review.opendev.org/c/openstack/project-config/+/98480006:08
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984804: Install pip-check-updates only in jobs requiring that https://review.opendev.org/c/openstack/project-config/+/98480406:08
-@gerrit:opendev.org- Michal Nasiadka proposed:06:09
- [openstack/project-config] 984800: Follow up for I170bdb3ffc89bc3307a08da7cd4c7f2793a4e491 https://review.opendev.org/c/openstack/project-config/+/984800
- [openstack/project-config] 984804: Install pip-check-updates only in jobs requiring that https://review.opendev.org/c/openstack/project-config/+/984804
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984804: Install pip-check-updates only in jobs requiring that https://review.opendev.org/c/openstack/project-config/+/98480406:49
-@gerrit:opendev.org- Zuul merged on behalf of Michal Nasiadka: [openstack/project-config] 984800: Follow up for I170bdb3ffc89bc3307a08da7cd4c7f2793a4e491 https://review.opendev.org/c/openstack/project-config/+/98480007:32
-@gerrit:opendev.org- Michal Nasiadka proposed wip: [openstack/project-config] 984903: DNM: Testing https://review.opendev.org/c/openstack/project-config/+/98490308:35
-@gerrit:opendev.org- Michal Nasiadka proposed wip: [openstack/project-config] 984903: DNM: Testing https://review.opendev.org/c/openstack/project-config/+/98490308:36
-@gerrit:opendev.org- Michal Nasiadka proposed wip: [openstack/project-config] 984903: DNM: Testing https://review.opendev.org/c/openstack/project-config/+/98490308:37
-@gerrit:opendev.org- Michal Nasiadka proposed wip: [openstack/project-config] 984903: DNM: Testing https://review.opendev.org/c/openstack/project-config/+/98490308:40
-@gerrit:opendev.org- Michal Nasiadka proposed wip: [openstack/project-config] 984903: DNM: Testing https://review.opendev.org/c/openstack/project-config/+/98490308:41
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984908: Fix pip-check-updates target https://review.opendev.org/c/openstack/project-config/+/98490809:17
@mnasiadka:matrix.orgstatic03 load avg: 1824.81, 1866.17, 1766.7809:30
@mnasiadka:matrix.orgcpu load was minimal, but load avg was that huge - I'd suppose maybe tarballs download?09:41
-@gerrit:opendev.org- Zuul merged on behalf of Michal Nasiadka: [openstack/project-config] 984908: Fix pip-check-updates target https://review.opendev.org/c/openstack/project-config/+/98490809:47
@fungicide:matrix.orgtarballs downloads wouldn't generally require much load11:48
@fungicide:matrix.orger, generate much load11:48
@fungicide:matrix.orgload average on static03 at the moment seems to be ~3.011:49
@fungicide:matrix.organd now it's down below 1.0, so whatever was going on a couple hours ago seems to have not been long-lived?11:54
@fungicide:matrix.orginteresting that crawlers are still hitting static04 pretty hard even after a couple of days. ones that you wouldn't expect, like `meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)`11:56
-@gerrit:opendev.org- Zuul merged on behalf of Clark Boylan: [opendev/gerritlib] 983476: Update the Gerrit test images https://review.opendev.org/c/opendev/gerritlib/+/98347612:01
@mnasiadka:matrix.orgfungi: I find that load avg a bit bizarre, given iostat and top showed nearly nothing happening12:15
@fungicide:matrix.orgyeah, after seeing the discussion around the same time in #openstack-infra irc, i can see why massively parallel tarball downloads might have been a reasonable guess12:17
@mnasiadka:matrix.orgGiven that e.g. periodic Kolla build jobs downloads all tarballs - maybe isolating it on a dedicated server or moving data to swift/s3 is a reasonable improvement if that happens often12:18
@mnasiadka:matrix.orgWe could also think of using local Zuul cached checkouts, but the amount of required projects in job definition would be an overkill12:19
@fungicide:matrix.orgwould it be any worse than the required-projects list for devstack/tempest jobs?12:21
@fungicide:matrix.orglike order of magnitude worse?12:21
-@gerrit:opendev.org- Zuul merged on behalf of Clark Boylan: [opendev/jeepyb] 983482: Test Gerrit 3.11, 3.12, and 3.13 with Gerritlib https://review.opendev.org/c/opendev/jeepyb/+/98348212:21
@fungicide:matrix.orgeven if you just used the existing git cache baked into test nodes without listing them as required-projects, simply fetching the latest tags in those would be a lot faster and less bandwidth than downloading tarballs for everything12:24
@fungicide:matrix.orgusually those repos are no more than a couple of days stale, so not much to actually fetch to catch them up anyway12:26
@mnasiadka:matrix.orgActually maybe it wouldn't be that bad, I'll give it a go after we branch 2026.112:30
-@gerrit:opendev.org- Sylvain Bauza proposed: [openstack/project-config] 984922: Add openstack/agentic-workflows project https://review.opendev.org/c/openstack/project-config/+/98492212:37
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984930: kolla: fix pcu packages and files https://review.opendev.org/c/openstack/project-config/+/98493013:00
-@gerrit:opendev.org- Sylvain Bauza proposed: [openstack/project-config] 984922: Add openstack/agentic-workflows project https://review.opendev.org/c/openstack/project-config/+/98492213:08
@clarkb:matrix.orginfra-root just a heads up that 983482 did build a new image but against the same Gerrit tag so we shouldn't need to "upgrade" the running container14:54
@clarkb:matrix.orgmnasiadka: fungi re load that is similar to what I was seeing yesterday though a bit higher. The server itself seemed fine. I wonder if that is due to afs waiting on data so we get a bunch of parked threads. its not disk io because its waiting on network traffic?14:55
@fungicide:matrix.orgoh could be, yeah14:57
@mnasiadka:matrix.orgOh, that probably explains14:58
@mnasiadka:matrix.orgBut that might be caused by tarballs traffic I guess14:59
@clarkb:matrix.orgyes, I suspect that of all the data flowing through that server tarballs represent the largest files. And that likely means they haev an outsized impact on the local afs caching too14:59
@clarkb:matrix.orgits possible we might want to profile the afs cache to see if we need to make it bigger or something14:59
@clarkb:matrix.orgfungi: mnasiadka any reason to not proceed with https://review.opendev.org/c/opendev/system-config/+/984702/ this morning to remove mirror02.dfw.rax from our inventory?15:00
@clarkb:matrix.orgI got the first two chagnes in yesterday before I had to pop out so this is next on the list15:00
@mnasiadka:matrix.orgNo reasons, that one I double checked on every angle if that's not used - given I was not the one setting up mirror03 :)15:01
@clarkb:matrix.orggreat thank you for double checking it. I'll go ahead and approve it now15:02
-@gerrit:opendev.org- Michal Nasiadka proposed: [openstack/project-config] 984930: pcu: run in project directory https://review.opendev.org/c/openstack/project-config/+/98493015:11
@mnasiadka:matrix.orgClark: I assume DNS change is next - and then I could shut down the old mirror instances and if no drama happens - remove them tomorrow or next week?15:18
@clarkb:matrix.orgNote that https://review.opendev.org/c/opendev/zuul-providers/+/984866/ failed on what looks like swift connectivity. I've rechecked it to see if that issue persists15:18
@clarkb:matrix.orgmnasiadka: yup. I won't be around tomorrow, but happy to keep helping next week as necessary15:19
@mnasiadka:matrix.orgI've seen that, and two jobs I checked failed on sjc3 connectivity15:19
@clarkb:matrix.orgthat is also the region where the mirror went down. I wonder if they are having issues with networking or similar15:22
-@gerrit:opendev.org- James E. Blair https://matrix.to/#/@jim:acmegating.com proposed: [zuul/zuul-jobs] 984141: Add prepare-repos role https://review.opendev.org/c/zuul/zuul-jobs/+/98414115:34
@mnasiadka:matrix.orgfungi: I found some issues with the pip-check-updates target for proposal job that I proposed (that sounds a bit funny) - would you be open to have a look at https://review.opendev.org/c/openstack/project-config/+/984930 ? And hopefully that's the only fix I need.15:43
@fungicide:matrix.orgyeah, i was sort of watching and waiting for that to stabilize15:45
@clarkb:matrix.orgWe upgraded Gerrit on Sunday. It is now Thursday. Is it time to drop the Gerrit 3.11 image builds and tests: https://review.opendev.org/c/opendev/system-config/+/984468 ? I think the worst issue we've found so far was the handling of ssh keys and that appeared solvable by removing the -sk pubkey material from the user account15:47
@mnasiadka:matrix.orgClark: https://github.com/apache/mina-sshd/issues/433 has a mention of -sk (fido) keys being problematic - so I doubt it worked before15:50
@fungicide:matrix.orgpossible it was ignoring those before15:51
@mnasiadka:matrix.orgWell there's https://github.com/apache/mina-sshd/commit/bca964c7265c27e415d949e6a7764899012647f415:52
@mnasiadka:matrix.orgSo it's supported from 2.1615:52
@mnasiadka:matrix.orgAnd OpenDev runs 2.1515:52
@mnasiadka:matrix.orgSo anyway - what fungi says probably is right15:52
@fungicide:matrix.orgthat's the only way i can reconcile the claimed regression in behavior after the upgrade anyway15:54
@fungicide:matrix.orgsince it sounded like it hadn't been preventing the user from authenticating previously15:54
@mnasiadka:matrix.orgGerrit 3.13 comes with Apache (MINA) sshd 2.16 - so it should work then15:54
@mnasiadka:matrix.orgfungi: are you fine with me merging 984930 so I/we can observe tomorrow's periodics if that works?15:56
@fungicide:matrix.orgmnasiadka: sure, done15:58
@clarkb:matrix.orgyup I didn't check the code I think is at fault, but I suspect they changed how they look up keys and they didn't short circuit before16:00
@clarkb:matrix.orgthe key lookup happens on the gerrit side fwiw16:00
@clarkb:matrix.orgthen hands it to mina which raises exception I think16:00
@clarkb:matrix.orgI think i have a Gerrit CLA signed as of like yesterday or day before so maybe I'll actually try to fix that16:01
@mnasiadka:matrix.orgseems ubuntu mirrors had a hiccup and mirror02.dfw removal failed in gate - what's the drill - recheck or re-enqueue?16:01
@clarkb:matrix.orgmnasiadka: typically we would recheck unless there is a time crunch that would make going faster important16:03
@mnasiadka:matrix.orgok, that's what I thought16:03
@fungicide:matrix.orgwhatever's the lowest effort possible, really16:05
-@gerrit:opendev.org- Zuul merged on behalf of Michal Nasiadka: [openstack/project-config] 984930: pcu: run in project directory https://review.opendev.org/c/openstack/project-config/+/98493016:09
@mnasiadka:matrix.orgOk then, seems it works https://review.opendev.org/c/openstack/kolla-ansible/+/98500316:19
@fungicide:matrix.orgyay!16:19
@fungicide:matrix.orgiterating on jobs that can't run speculatively is always a pain. it's hard to imagine we used to run all our jobs that way16:20
@fungicide:matrix.orgi think i repressed those memories16:20
@mnasiadka:matrix.orgWell, I think that could be reworked to run speculatively, which would ease management of that.16:22
@mnasiadka:matrix.orgBut I think I have more interesting things on the radar16:22
@mnasiadka:matrix.org(for now)16:22
@clarkb:matrix.orgGerrit H2 v2 cache files continue to grow, but remain within the bounds of what we saw with H2 v1. 16:33
@clarkb:matrix.org(I'm just noting that as I'm trying to check daily in order to catch any unexpected growth early)16:33
@fungicide:matrix.orgmnasiadka: parts of it could be run speculatively, though access to the gerrit account authentication credentials for proposing the resulting change would still need to be handled in a config repo16:36
@fungicide:matrix.orgi agree with the complexity there, it may make sense to refactor all the earlier steps out into an unprivileged playbook that can be exercised without actually pushing any changes to review16:37
@fungicide:matrix.organd then only the playbook that runs `git review` at the end has to live in project-config16:37
@clarkb:matrix.orgoh one thing I wanted to check out of curiousity with Gerrit 3.12 is if we can confirm that PQC ssh algorithms are used. I guess I should rerun some ssh -vvv and see if I can tell16:51
@fungicide:matrix.orgseems to be yes, i was previously getting warnings from my openssh client16:57
@fungicide:matrix.orgnow i no longer get warnings16:57
@mnasiadka:matrix.orgfungi: I wasn't thinking of moving anything outside of that repository, just reworking it in a way, that unprivileged playbook would prepare everything and we just add git review in the privileged run in periodic pipeline16:58
@clarkb:matrix.orghuh my openssh client is pretty new and I don't recall warnings. Maybe that is a packager configuration option?16:58
@fungicide:matrix.org`OpenSSH_10.2p1 Debian-6, OpenSSL 3.6.1 27 Jan 2026`17:00
@fungicide:matrix.orgit used to report this every time i connected to gerrit: `WARNING: connection is not using a post-quantum key exchange algorithm. This session may be vulnerable to "store now, decrypt later" attacks. The server may need to be upgraded. See https://openssh.com/pq.html`17:00
@fungicide:matrix.organd now it no longer does, since the upgrade on sunday17:00
@clarkb:matrix.orgI have OpenSSH_10.2p1 as well but never had warnings so ya maybe a compile time option or some distro specific config17:01
@fungicide:matrix.orgto be fair, if i were king i would have inverted that warning to something like "your connection is using a supposed post-quantum secure algorithm that may be vulnerable to access by the government agencies pushing these new untested algorithms through baseless and scientifically unsound fearmongering"17:05
@clarkb:matrix.orglooking at ssh -vvv output I see my client offer mlkem as first on the list. Gerrit responds with a couple of sntrup algorithms first but then offers a couple mlkem algorithms one of which matches what my client said it can do. I think sntrup algorithms are older? But its good that the server supports them as they are probably better than nothing for older clients17:06
@clarkb:matrix.organyway I think this confirms what you've already surmised due to the change in your warning behavior17:06
@fungicide:matrix.orgbut i know my opinions are unpopular outside cliques of traditional cryptographers and cryptanalysts17:06
@clarkb:matrix.organother interesting thing I notice is taht `ssh -Q kex` is a superset of what ssh -vvv seems to indicate it actually offers to the server17:08
@clarkb:matrix.orgso it must be using some additional info to trim the list down to what is more likely to be acceptable17:08
@clarkb:matrix.orgBut cool now Gerrit is less of a concern when it comes to this stuff. Next problem: sha1 and Gerrit not supporting sha256 yet17:09
@clarkb:matrix.orgbut one thing at a time17:09
-@gerrit:opendev.org- Zuul merged on behalf of Clark Boylan: [opendev/system-config] 984468: Drop Gerrit 3.11 jobs https://review.opendev.org/c/opendev/system-config/+/98446817:12
@clarkb:matrix.orgbut it is worth calling out that Git 3.0 is expected at the end of the year and that will change the default branch to main and be sha256 by default as well iirc17:12
@fungicide:matrix.orgmy understanding is that it will create repositories with sha2-256 indices and "main" as the default branch name, but it will still interact fine with repositories that were not created in that manner17:14
@fungicide:matrix.orgif gerrit doesn't support it by then, we may run into problems with new project creation importing an external repository that's using the new commit ids17:16
-@gerrit:opendev.org- Zuul merged on behalf of Sylvain Bauza: [openstack/project-config] 984922: Add openstack/agentic-workflows project https://review.opendev.org/c/openstack/project-config/+/98492217:18
@clarkb:matrix.orgfungi: yes it should continue to operate just fine against existing repo aiui. But there is likely work to be done on our side to ensure we integrate with Gerrit and gitea properly17:36
@clarkb:matrix.orgAnd then dealing with whatever end user fallout occurs 17:36
@fungicide:matrix.orgright17:37
@clarkb:matrix.organd then in theory we'll need to "upgrade" the existing repos we host?17:43
@clarkb:matrix.orgwhich is basically a full conversion and force push I think17:44
@fungicide:matrix.orgdepends. it's unclear to me how backward-compatible the new repository format is with old clients. i know new clients are meant to handle the old servers/repositories seamlessly17:46
@clarkb:matrix.orgit isn't aiui17:47
@clarkb:matrix.orgonce yuo're sha256 in the repo you need a sha256 capable client17:47
@clarkb:matrix.orgyou can't have  both sha1 and sha256 side by side its all or nothing one way or the other which means the client side must understand the new stuff if you convert I think17:47
@fungicide:matrix.orgyeah, so my guess is that we need to keep our repositories on the old format for a while even after gerrit supports the new format17:47
@clarkb:matrix.orgya its possible. I wonder how old of a git can handle sha25617:47
-@gerrit:opendev.org- Sylvain Bauza proposed: [openstack/project-config] 985017: Add Zuul jobs for openstack/agentic-workflows https://review.opendev.org/c/openstack/project-config/+/98501717:52
@fungicide:matrix.orgi had seen previous discussion about storing both hashes side-by-side and having newer servers generate the new hash format objects when older clients push with the old ones, but i'm not finding any indication that plan ever got implemented17:52
@fungicide:matrix.orglooks like github users are becoming increasingly antsy about getting support for the new format: https://github.com/orgs/community/discussions/1249017:56
@fungicide:matrix.orgthe most recent comment on that discussion indicates gitea's ready to go, at least17:57
@fungicide:matrix.orgbut not yet jgit per https://github.com/eclipse-jgit/jgit/issues/73 17:58
@clarkb:matrix.orgyes last I checked jgit is likely to be our biggest obstacle17:59
-@gerrit:opendev.org- Zuul merged on behalf of Sylvain Bauza: [openstack/project-config] 985017: Add Zuul jobs for openstack/agentic-workflows https://review.opendev.org/c/openstack/project-config/+/98501718:08
@fungicide:matrix.orgstill seeing a bunch of docs.openstack.org requests on static04 from meta-externalagent and baidu nabar18:18
@fungicide:matrix.orgi'm tempted to stop apache on the server at this point to get them to reevalaute their cached dns responses18:19
@clarkb:matrix.orgNo objection from me18:29
@fungicide:matrix.orgokay, done18:34
@fungicide:matrix.orgif we don't see any issues then maybe some time next week we can tear down static0418:35
@clarkb:matrix.orgsounds good to me18:43
@fungicide:matrix.org`E: Failed to fetch http://us.archive.ubuntu.com/ubuntu/pool/main/d/distro-info/python3-distro-info_1.1ubuntu0.2_all.deb  Cannot initiate the connection to us.archive.ubuntu.com:80 [...] Network is unreachable`18:49
@fungicide:matrix.orglooks like it's still ongoing18:49
@fungicide:matrix.orgran in raxflex-iad3 for reference18:50
@clarkb:matrix.orgI can currently reach that name over https I suspect that a name like that is made up of many backends load balanced but I wonder if we should be using https if http is probelmatic now?18:51
@clarkb:matrix.orgI guess I don't have any evidence that https is more reliable at this point, but consider http failed maybe it is worth investigating or just using?18:52
@fungicide:matrix.orgfrom my from raxflex-iad3 it seems to be resolving to 91.189.91.82, 91.189.91.81, 91.189.91.83, and 2620:2d:4002:1::103, 2620:2d:4002:1::102, 2620:2d:4002:1::101 as round-robin records18:54
@fungicide:matrix.orgit does indeed look like http requests to those time out, while https are working18:59
@fungicide:matrix.orgokay, http requests are going through just hitting a lengthy delay19:00
@clarkb:matrix.orgya so this may flip flop when the bots change protocols19:00
@clarkb:matrix.organd we won't actually be better off by changing19:00
@fungicide:matrix.orgtesting from the iad3 mirror, http://91.189.91.82/ takes me 11 seconds while https://91.189.91.82/ returns in 0.1 seconds19:02
@fungicide:matrix.orgi agree this is probably more fallout from out of control crawlers running the whole of the web into the ground19:03
@fungicide:matrix.orgi'm going to go grab early dinner, then check back in19:05
@clarkb:matrix.orgya I'm about to eat lunch myself. Also currently getting laptop sorted out with new email connectivity. Something I need to do before traveling in a week and a half19:06
@clarkb:matrix.orgfungi: ^ that reminds me that any syncing we want to do of infra root email needs to be done before ~wednesday? Not sure when exactly the access goes away19:06
-@gerrit:opendev.org- Zuul merged on behalf of Dmitriy Rabotyagov: [openstack/project-config] 981925: Allow OpenStack-Ansible Cores to change WIP state https://review.opendev.org/c/openstack/project-config/+/98192519:49
-@gerrit:opendev.org- Zuul merged on behalf of Stephen Finucane: [openstack/project-config] 983728: Add GitHub mirroring for devstack-plugin-prometheus https://review.opendev.org/c/openstack/project-config/+/98372819:49
-@gerrit:opendev.org- Zuul merged on behalf of Michal Nasiadka: [opendev/system-config] 984702: Remove mirror02.dfw.rax from configuration https://review.opendev.org/c/opendev/system-config/+/98470220:08
-@gerrit:opendev.org- Zuul merged on behalf of Michal Nasiadka: [opendev/zone-opendev.org] 984738: Remove mirror03.gra1, mirror02.ord and mirror02.dfw from DNS https://review.opendev.org/c/opendev/zone-opendev.org/+/98473820:26
@fungicide:matrix.orgClark: oh, thanks, i can try to knock it out tomorrow through the weekend20:40
@clarkb:matrix.orgI've finally got around to checking cloud providers for leaked images. I think openmetal and ovh look mostly ok. Then both rax classic and flex have some leaks. Flex far less than classic and the images appear to be "queued" not "active" there so I think the impacts are smaller. In classic we even appear to have images from when nodepool was around21:50
@clarkb:matrix.orgI think the next step is to try and delete these images and see if they can be deleted. I'll probably start with flex since there are fewer there21:50
@clarkb:matrix.orgbut this may end up being a good ptg week cleanup21:51
@clarkb:matrix.orgok the images did clear out of flex without issue. So flex is sorted now as well. I think only rax classic is a concern21:56
@clarkb:matrix.orgI suspect that this means that zuul launcher didn't actually know about those images in flex (they were all queued so maybe failed uploads the launcher thought went away)21:57
@jim:acmegating.comany idea of the age?21:57
@jim:acmegating.comwonder if it was from early launcher days -- especially being in flex21:57
@clarkb:matrix.orgoh shoot no. The suffixes are uuids now and I didn't bother to show all their properties I just did a listing21:58
@jim:acmegating.comit's okay... i almost think maybe this is a good chance to just reset to zero and then check again later21:58
@clarkb:matrix.org++21:58
@clarkb:matrix.orgcorvus: all of the -17xyzabc sequential like suffixes are from nodepool right?21:59
@clarkb:matrix.orgso they can be deleted even for current images like noble22:00
@jim:acmegating.comClark: should be -- maybe check the metadata on those?  see if the tags look like nodepool tags?  or check the dates22:04
@clarkb:matrix.orgall good ideas thanks22:06
@clarkb:matrix.orgspot checking one of them it does have nodepool properties and was built in july so I think in addition to bionic deletions we can also attempt to delete all of these old nodepool images22:07
@clarkb:matrix.orgI was able to delete the noble image I checked in rax ord as well. So I'm hopeful that the majority will simply cleanup if we ask to delete them22:09
@clarkb:matrix.orgI've put a note on my todo list to go through and do this properly for all of rax classic. But I need to pop out and get some errands done before tomorrow22:12

Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!