| *** tnarg has quit IRC | 00:03 | |
| *** tnarg has joined #openstack-ansible | 00:04 | |
| *** tnarg has quit IRC | 00:08 | |
| *** cloudtrainme has quit IRC | 00:10 | |
| *** jimchou has quit IRC | 00:15 | |
| *** CheKoLyN has quit IRC | 00:19 | |
| *** tlian has quit IRC | 00:34 | |
| *** tnarg has joined #openstack-ansible | 00:40 | |
| *** tlian has joined #openstack-ansible | 00:41 | |
| *** tnarg has quit IRC | 00:43 | |
| *** tnarg has joined #openstack-ansible | 00:43 | |
| *** jmccrory_ has joined #openstack-ansible | 00:45 | |
| *** tnarg_ has joined #openstack-ansible | 00:46 | |
| *** tnarg has quit IRC | 00:49 | |
| *** tlian has quit IRC | 00:52 | |
| *** mss_ has quit IRC | 00:56 | |
| *** tlian has joined #openstack-ansible | 00:57 | |
| *** jaybeers has quit IRC | 01:06 | |
| bgmccollum | anyone seen this before? -- OSError: [Errno 17] File exists: '/openstack/log' -- http://paste.openstack.org/show/ikkBlzNDOUynwT9yPfln/ | 01:09 |
|---|---|---|
| bgmccollum | race? | 01:09 |
| *** Bjoern_ is now known as Bjoern_zZzZzZzZ | 01:10 | |
| bgmccollum | me thinks so, because of delegate_to: two tasks to same host, both check if path exists, if it doesn't, both try to create. first create succeeds, second fails as it already exists. | 01:15 |
| Sam-I-Am | double creation means its created more betterer? | 01:15 |
| cloudnull | bgmccollum: is that on an AIO ? | 01:16 |
| bgmccollum | cloudnull: multinode | 01:17 |
| cloudnull | ansible 2.0 ? | 01:17 |
| bgmccollum | 1.9 | 01:17 |
| cloudnull | in a rerun was it fixed ? | 01:18 |
| bgmccollum | that tasks might need to be set to serial 1 to prevent races...however rare | 01:18 |
| bgmccollum | cloudnull : unfortunately, it was a jenkins job, and it tears down after success and failure | 01:18 |
| bgmccollum | and no retries, since that was removed in RPC | 01:18 |
| cloudnull | ive not seen that specifically, however making it serial would render it stupid slow | 01:19 |
| cloudnull | so its already using the full path https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/lxc_container_create/tasks/container_create.yml#L40 | 01:20 |
| bgmccollum | cloudnull : maybe create the intermediary paths segments before that task... | 01:20 |
| bgmccollum | i think its checking each segment individually for existence, and creating it if it doesn't exist...instead of a strait mkdir -p type of thing... | 01:21 |
| bgmccollum | and if you time it just right...boom errno 17 | 01:21 |
| cloudnull | well it seems to have exploded on /openstack/log | 01:21 |
| cloudnull | to fix that in a more controlled way we can create the various openstack skel dirs in https://github.com/openstack/openstack-ansible/blob/master/playbooks/roles/openstack_hosts/tasks/main.yml | 01:22 |
| bgmccollum | yeah...which indicates its trying to create each segment individually... | 01:22 |
| cloudnull | which would only execute once on each host | 01:22 |
| *** sdake has quit IRC | 01:22 | |
| cloudnull | then each container creates its specific log dir as needed. | 01:22 |
| cloudnull | but the first segment would be already covered | 01:22 |
| bgmccollum | yeah, create the skel dirs... /openstack /openstack/log /openstack/backup etc... | 01:23 |
| bgmccollum | i seem to recall hitting this way back too...but the retry logic that used to be in RPC would just pave over it and continue on...now its getting exposed as an issue | 01:23 |
| cloudnull | you mind raising an issue for it ? | 01:23 |
| *** sdake has joined #openstack-ansible | 01:24 | |
| bgmccollum | on it.. | 01:24 |
| *** galstrom is now known as galstrom_zzz | 01:25 | |
| bgmccollum | cloudnull: hah...marked as invalid -- https://bugs.launchpad.net/openstack-ansible/+bug/1426254 | 01:27 |
| openstack | Launchpad bug 1426254 in openstack-ansible "Race creating /openstack/log" [Low,Invalid] - Assigned to Hugh Saunders (hughsaunders) | 01:27 |
| *** Bjoern_zZzZzZzZ is now known as Bjoern_ | 01:27 | |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Fix race condition for /openstack directories https://review.openstack.org/242291 | 01:31 |
| *** galstrom_zzz is now known as galstrom | 01:31 | |
| cloudnull | if you wouldnt mind reviewing things :) | 01:31 |
| bgmccollum | looking...thanks | 01:32 |
| openstackgerrit | Kevin Carter proposed openstack/openstack-ansible: Fix race condition for /openstack directories https://review.openstack.org/242291 | 01:32 |
| cloudnull | f5 had commit message type | 01:32 |
| cloudnull | typo | 01:32 |
| cloudnull | th720: around still ? | 01:34 |
| cloudnull | RE: During the neutron install, we are getting the following error message: msg: neutron fact collection failed: unable to find migration with revision 59cb5b6cf4d ? | 01:34 |
| cloudnull | mattt: ^^ -cc | 01:35 |
| *** gouthamr_ has joined #openstack-ansible | 01:37 | |
| *** gouthamr has quit IRC | 01:41 | |
| *** Bjoern_ has quit IRC | 01:50 | |
| bgmccollum | cloudnull: going to drop patch into build pipeline and see how it goes :D | 01:51 |
| cloudnull | sweet | 01:52 |
| *** galstrom is now known as galstrom_zzz | 01:53 | |
| bgmccollum | cloudnull: interestingly, i was able to trigger the race again... | 01:55 |
| cloudnull | even with that patch ? | 01:55 |
| cloudnull | ok, i have to run , but let me know what you find out | 01:57 |
| bgmccollum | without the patch...i kicked off a new build, thinking it wouldn't happen again...but it did | 01:57 |
| cloudnull | :( | 01:57 |
| cloudnull | same error ? | 01:57 |
| bgmccollum | its building with the patch now, ill update the bug and review | 01:57 |
| cloudnull | kk | 01:57 |
| bgmccollum | later | 01:57 |
| cloudnull | cu later | 01:58 |
| *** hybridpollo has quit IRC | 02:04 | |
| openstackgerrit | Byron McCollum proposed openstack/openstack-ansible: Add retry and delay to RabbitMQ queue mirroring setup. https://review.openstack.org/242306 | 02:12 |
| *** galstrom_zzz is now known as galstrom | 02:12 | |
| openstackgerrit | Byron McCollum proposed openstack/openstack-ansible: Add retry and delay to RabbitMQ queue mirroring setup. https://review.openstack.org/242306 | 02:13 |
| *** galstrom is now known as galstrom_zzz | 02:20 | |
| *** rebase has quit IRC | 02:51 | |
| *** k_stev has joined #openstack-ansible | 03:11 | |
| *** cbaesema has joined #openstack-ansible | 03:11 | |
| *** k_stev has quit IRC | 03:19 | |
| *** rebase has joined #openstack-ansible | 03:19 | |
| *** rebase has quit IRC | 03:19 | |
| *** tnarg_ has quit IRC | 03:20 | |
| openstackgerrit | Byron McCollum proposed openstack/openstack-ansible: Add retry and delay to RabbitMQ queue mirroring setup. https://review.openstack.org/242306 | 03:21 |
| *** jmccrory_ has quit IRC | 03:22 | |
| *** mss has joined #openstack-ansible | 03:23 | |
| *** mss has quit IRC | 03:29 | |
| *** skamithi has joined #openstack-ansible | 03:31 | |
| *** skamithi has quit IRC | 03:36 | |
| *** sdake has quit IRC | 03:36 | |
| *** k_stev has joined #openstack-ansible | 03:37 | |
| *** cbaesema has quit IRC | 03:44 | |
| *** cbaesema has joined #openstack-ansible | 03:44 | |
| *** k_stev has quit IRC | 03:52 | |
| *** galstrom_zzz is now known as galstrom | 03:53 | |
| *** tlian has quit IRC | 04:10 | |
| *** subscope has joined #openstack-ansible | 04:18 | |
| *** fawadkhaliq has joined #openstack-ansible | 04:20 | |
| *** k_stev has joined #openstack-ansible | 04:21 | |
| *** k_stev has quit IRC | 04:22 | |
| *** sdake has joined #openstack-ansible | 04:35 | |
| *** sdake has quit IRC | 04:53 | |
| *** gouthamr has joined #openstack-ansible | 04:54 | |
| *** gouthamr_ has quit IRC | 04:56 | |
| *** shausy has joined #openstack-ansible | 04:57 | |
| *** sdake has joined #openstack-ansible | 04:58 | |
| *** subscope has quit IRC | 05:02 | |
| *** woodard_ has quit IRC | 05:05 | |
| *** subscope has joined #openstack-ansible | 05:05 | |
| *** galstrom is now known as galstrom_zzz | 05:09 | |
| *** javeriak has joined #openstack-ansible | 05:21 | |
| *** javeriak_ has joined #openstack-ansible | 05:27 | |
| *** javeriak has quit IRC | 05:27 | |
| *** Mudpuppy has quit IRC | 05:35 | |
| *** javeriak_ has quit IRC | 05:47 | |
| *** javeriak has joined #openstack-ansible | 05:49 | |
| *** wabu_ is now known as wabu | 05:58 | |
| *** javeriak has quit IRC | 05:59 | |
| *** sdake has quit IRC | 06:00 | |
| *** sdake has joined #openstack-ansible | 06:00 | |
| *** woodard has joined #openstack-ansible | 06:06 | |
| *** woodard has quit IRC | 06:10 | |
| *** mss has joined #openstack-ansible | 06:13 | |
| *** mss has quit IRC | 06:24 | |
| *** javeriak has joined #openstack-ansible | 06:24 | |
| *** phiche has joined #openstack-ansible | 06:25 | |
| *** subscope has quit IRC | 06:26 | |
| *** phiche has quit IRC | 06:28 | |
| *** openstackgerrit has quit IRC | 06:31 | |
| *** openstackgerrit has joined #openstack-ansible | 06:32 | |
| *** gouthamr_ has joined #openstack-ansible | 06:33 | |
| *** gouthamr has quit IRC | 06:36 | |
| *** phiche has joined #openstack-ansible | 06:37 | |
| *** phiche has quit IRC | 06:40 | |
| *** phiche has joined #openstack-ansible | 06:43 | |
| *** phiche has quit IRC | 06:47 | |
| *** phiche has joined #openstack-ansible | 06:50 | |
| *** phiche has quit IRC | 07:06 | |
| *** javeriak has quit IRC | 07:10 | |
| *** sdake has quit IRC | 07:14 | |
| *** sdake has joined #openstack-ansible | 07:14 | |
| *** fawadkhaliq has quit IRC | 07:19 | |
| *** sdake has quit IRC | 07:26 | |
| *** sdake has joined #openstack-ansible | 07:27 | |
| *** fawadkhaliq has joined #openstack-ansible | 07:34 | |
| *** sdake_ has joined #openstack-ansible | 07:40 | |
| *** sdake has quit IRC | 07:42 | |
| *** phiche has joined #openstack-ansible | 07:47 | |
| *** javeriak has joined #openstack-ansible | 07:50 | |
| *** javeriak has quit IRC | 07:51 | |
| *** javeriak has joined #openstack-ansible | 07:51 | |
| *** fawadkhaliq has quit IRC | 07:52 | |
| *** javeriak_ has joined #openstack-ansible | 07:54 | |
| *** javeriak has quit IRC | 07:55 | |
| *** fawadkhaliq has joined #openstack-ansible | 07:58 | |
| mattt | odyssey4me_: did anyone actually test those neutron fact changes or look at the question i posed in the liberty review? :P | 08:07 |
| *** karimb has joined #openstack-ansible | 08:17 | |
| evrardjp | mattt: I didn't, sorry | 08:24 |
| *** gouthamr_ has quit IRC | 08:27 | |
| mattt | evrardjp: shame on you! :P | 08:29 |
| evrardjp | I know, right? ;) | 08:31 |
| *** sdake_ has quit IRC | 08:33 | |
| *** agireud has quit IRC | 08:37 | |
| *** agireud has joined #openstack-ansible | 08:37 | |
| *** andyhky has quit IRC | 08:42 | |
| *** openstackstatus has quit IRC | 08:42 | |
| *** tiagogomes_ has joined #openstack-ansible | 08:44 | |
| *** andyhky has joined #openstack-ansible | 08:44 | |
| *** javeriak_ has quit IRC | 08:50 | |
| *** shausy has quit IRC | 08:53 | |
| *** karimb has quit IRC | 08:54 | |
| *** shausy has joined #openstack-ansible | 08:55 | |
| *** subscope has joined #openstack-ansible | 08:57 | |
| *** subscope has quit IRC | 08:58 | |
| *** karimb has joined #openstack-ansible | 09:01 | |
| evrardjp | for fun I did this: git diff kilo..liberty | wc -l | 09:04 |
| evrardjp | someone want to guess how many changes? ;) | 09:04 |
| evrardjp | the job that was done is impressive, that's just what I want to say. And ofc, a thank you. | 09:05 |
| persia | evrardjp: you might find `git diff --stat ...` or `git diff --shortstat ...` interesting. | 09:10 |
| evrardjp | I didn't know that command | 09:11 |
| evrardjp | it's cool :) | 09:11 |
| *** javeriak has joined #openstack-ansible | 09:12 | |
| *** haojing has joined #openstack-ansible | 09:16 | |
| *** subscope has joined #openstack-ansible | 09:18 | |
| *** haojing has quit IRC | 09:24 | |
| openstackgerrit | XiaBing Yao proposed openstack/openstack-ansible: remove another vars_files definition https://review.openstack.org/242414 | 09:58 |
| *** fawadkhaliq has quit IRC | 10:10 | |
| *** slotti has joined #openstack-ansible | 10:17 | |
| *** javeriak_ has joined #openstack-ansible | 10:51 | |
| *** javeriak has quit IRC | 10:54 | |
| *** javeriak has joined #openstack-ansible | 10:55 | |
| *** javeriak_ has quit IRC | 10:55 | |
| *** javeriak_ has joined #openstack-ansible | 10:56 | |
| *** javeriak has quit IRC | 11:00 | |
| *** subscope has quit IRC | 11:41 | |
| *** subscope has joined #openstack-ansible | 11:43 | |
| *** ybabenko has joined #openstack-ansible | 11:49 | |
| *** javeriak_ has quit IRC | 11:53 | |
| *** javeriak has joined #openstack-ansible | 11:54 | |
| *** shausy has quit IRC | 12:04 | |
| *** karimb has quit IRC | 12:07 | |
| *** karimb has joined #openstack-ansible | 12:08 | |
| *** misc_ is now known as misc | 12:25 | |
| *** javeriak_ has joined #openstack-ansible | 12:27 | |
| *** javeriak has quit IRC | 12:30 | |
| *** javeriak has joined #openstack-ansible | 12:30 | |
| *** javeria__ has joined #openstack-ansible | 12:31 | |
| *** javeriak_ has quit IRC | 12:31 | |
| *** javeriak has quit IRC | 12:35 | |
| *** ybabenko has quit IRC | 12:39 | |
| *** ybabenko has joined #openstack-ansible | 12:41 | |
| *** mgoddard_ has joined #openstack-ansible | 12:43 | |
| *** mgoddard has quit IRC | 12:44 | |
| *** mgoddard__ has joined #openstack-ansible | 12:44 | |
| *** rady has joined #openstack-ansible | 12:44 | |
| *** mgoddard_ has quit IRC | 12:48 | |
| mhayden | buenos dias | 13:18 |
| *** mss has joined #openstack-ansible | 13:20 | |
| *** tlian has joined #openstack-ansible | 13:21 | |
| *** mss has quit IRC | 13:25 | |
| *** javeria__ has quit IRC | 13:35 | |
| *** cbaesema has quit IRC | 13:37 | |
| openstackgerrit | Matt Thompson proposed openstack/openstack-ansible: Update neutron_migrations_facts https://review.openstack.org/240560 | 13:45 |
| *** cloudtrainme has joined #openstack-ansible | 13:45 | |
| *** subscope has quit IRC | 13:53 | |
| *** alkari has joined #openstack-ansible | 13:54 | |
| *** ybabenko has quit IRC | 14:02 | |
| mhayden | if someone has a spare moment, could you peek at https://review.openstack.org/#/c/242101/ ? it's a small doc adjustment for osas | 14:05 |
| *** slotti has quit IRC | 14:06 | |
| *** subscope has joined #openstack-ansible | 14:06 | |
| *** javeriak has joined #openstack-ansible | 14:12 | |
| *** sdake has joined #openstack-ansible | 14:16 | |
| *** alkari has quit IRC | 14:26 | |
| *** jimchou has joined #openstack-ansible | 14:32 | |
| openstackgerrit | Major Hayden proposed openstack/openstack-ansible: AIO bootstrap in Ansible https://review.openstack.org/239525 | 14:33 |
| mhayden | palendae: thanks for giving the aio stuff a quick look | 14:33 |
| *** subscope has quit IRC | 14:35 | |
| *** ybabenko has joined #openstack-ansible | 14:57 | |
| *** spotz_zzz is now known as spotz | 14:58 | |
| *** ybabenko has quit IRC | 15:01 | |
| *** alejandrito has joined #openstack-ansible | 15:04 | |
| *** gouthamr has joined #openstack-ansible | 15:10 | |
| *** javeriak has quit IRC | 15:10 | |
| *** gouthamr_ has joined #openstack-ansible | 15:11 | |
| palendae | mhayden: Yep | 15:11 |
| mhayden | what's special about that pypa script for installing pip? | 15:13 |
| mhayden | i keep wondering if we could just get a tarball from pypi and install it that way | 15:13 |
| spotz | mhayden Would a package work if it could be put in a public repo? | 15:13 |
| mhayden | it seems like the site fails kinda frequently :) | 15:13 |
| mhayden | spotz: what kind of package? | 15:14 |
| palendae | mhayden: Their get-pip.py script? iirc it holds a compressed copy of pip inside of itself | 15:14 |
| spotz | Aren't you guys ansibleizing specifically for ubuntu, in which case a deb | 15:14 |
| palendae | We try to avoid installing python-related things from .debs | 15:14 |
| spotz | ahh | 15:15 |
| mhayden | yeah, ubuntu/debian mangle python-related things regularly :| | 15:15 |
| *** gouthamr has quit IRC | 15:15 | |
| *** karimb has quit IRC | 15:16 | |
| spotz | hehe | 15:17 |
| mhayden | i notice that we reinstall pip a few times within osa | 15:18 |
| mhayden | for example, bootstrap-ansible.sh installs it | 15:18 |
| mhayden | so does bootstrap-aio.sh | 15:18 |
| mhayden | and i think one of the first few playbooks does it too | 15:18 |
| mhayden | i'm not sure if it's worth carrying the get-pip.py script in our repo, though | 15:19 |
| mhayden | that could get hairy | 15:19 |
| palendae | Bootstrap ansible makes sense, since you need to get all the python stuff for Ansible to work | 15:19 |
| palendae | I think the playbooks are then installing on the rest of the hosts | 15:19 |
| spotz | and you run that before the bootstrap-aio.sh, but in theory it shouldn't hurt being there twice | 15:20 |
| evrardjp | what wouldn't hurt is to install pip everywhere by default. Not related, but I'm just explaining a small frustration of NOT finding pip on memcached containers ;) | 15:22 |
| evrardjp | pip or virtualenv | 15:22 |
| evrardjp | or both | 15:22 |
| evrardjp | sorry for the off-topic | 15:22 |
| evrardjp | on another topic, what do you think of using reno when tagging OSA releases? | 15:23 |
| evrardjp | http://docs.openstack.org/developer/reno/design.html | 15:23 |
| mhayden | i prefer las vegas | 15:23 |
| mhayden | oh, you mean software | 15:23 |
| evrardjp | mhayden :D | 15:23 |
| mhayden | trololololol | 15:24 |
| * mhayden has had his coffee | 15:24 | |
| palendae | lol, another NIH openstack project | 15:24 |
| palendae | Since we don't have release notes now, kind of a moot point. But something to manage them wouldn't be a bad idea | 15:25 |
| evrardjp | I think it would help readability on the long run | 15:26 |
| mattt | evrardjp: i think odyssey4me_ has already been looking into reno | 15:27 |
| evrardjp | and help build quicker upgrade path | 15:27 |
| mattt | evrardjp: https://review.openstack.org/#/c/241592/ | 15:27 |
| *** woodard has joined #openstack-ansible | 15:28 | |
| mhayden | so i joined in the openstack-security team meeting yesterday to talk about the possibility of us using anchor to make an initial CA for openstack-ansible services | 15:28 |
| mhayden | CA being Certificate Authority | 15:28 |
| mhayden | they said it's a simple, self-contained pecan service and offered some help integrating it | 15:29 |
| * mhayden doesn't know pecan | 15:29 | |
| evrardjp | mattt, I'll read that, thanks | 15:29 |
| evrardjp | mhayden, I don't know that either, but it's in my to-read list | 15:30 |
| mhayden | looks like anchor runs on the network and you pass it a CSR for signing | 15:31 |
| mhayden | so everything is done via API calls | 15:31 |
| mhayden | it would be a significant undertaking to 1) add anchor 2) generate a bunch of certs prior to osa deployment 3) remove self-sign code from individual osa roles | 15:31 |
| mhayden | i'm not sure if there's enough value in doing it | 15:32 |
| palendae | mhayden: Pecan's a Zope-ish web framework. But lighter weight | 15:32 |
| evrardjp | mhayden, like https://letsencrypt.org/ ? | 15:32 |
| mhayden | letsencrypt is still a little rough around the edges and requires some funky plugins | 15:32 |
| mhayden | IIRC, your machines must check in with letsencrypt regularly | 15:32 |
| mattt | would be nicer if you coudl use letsencrypt tho :) | 15:32 |
| mhayden | and there's a limit on registrations/certs right now | 15:32 |
| mattt | boo :( | 15:32 |
| palendae | Yeah | 15:32 |
| palendae | Was gonna say - doesn't that require internet access? | 15:32 |
| palendae | I know some of our installs are air-gapped | 15:33 |
| mhayden | yeah, it needs some time | 15:33 |
| mhayden | letsencrypt looks amazing, but it needs some time | 15:33 |
| mhayden | palendae: nuclear facilities? ;) | 15:33 |
| evrardjp | mhayden, anchor seems far better in our case | 15:33 |
| evrardjp | our -> openstack-ansible | 15:33 |
| palendae | mhayden: I can't tell :) | 15:33 |
| mhayden | if i can get this darned aio bootstrap out the door, i'd be willing to toss a spec together | 15:33 |
| mhayden | or at least a mailing list proposal before a spec | 15:33 |
| evrardjp | because we won't use it in our company, because we have all this PKI stuff internally | 15:34 |
| mhayden | evrardjp: right | 15:34 |
| mhayden | the most value will come from those users who choose to roll with the defaults | 15:34 |
| *** woodard has quit IRC | 15:34 | |
| mhayden | or, some users may opt to provide trusted certs for keystone/horizon but they don't care about the others | 15:34 |
| evrardjp | indeed | 15:34 |
| palendae | I would think (but don't know) most installers would have their own PKI setup | 15:34 |
| mhayden | if it was me, i'd probably deploy with trusted certs for any endpoints my consumers would hit directly | 15:34 |
| mhayden | especially for auth | 15:34 |
| evrardjp | mhayden, that's what we do | 15:35 |
| mhayden | but nova <-> rabbitmq connections wouldn't need that level of security (that's just me) | 15:35 |
| mhayden | evrardjp: glad to know my thinking is on the right track! :P | 15:35 |
| evrardjp | it's a pragmatic view that I share :) | 15:35 |
| * mhayden fistbumps evrardjp | 15:35 | |
| evrardjp | we could have all the components using SSL, but all the openstack components aren't that fond of it | 15:36 |
| mhayden | true | 15:36 |
| mhayden | the rabbitmq encryption seems to be okay | 15:36 |
| mhayden | works well in aio setups | 15:36 |
| mattt | "tested in an AIOP" | 15:36 |
| mattt | *AIO | 15:36 |
| mattt | :P | 15:36 |
| mhayden | mattt: haha, it shouldn't be that different across the network | 15:37 |
| mhayden | no different than unencrypted | 15:37 |
| mhayden | the TCP connection setup is the same, with a little added TLS negotiation | 15:37 |
| palendae | Encrypt down to the RAM | 15:37 |
| mhayden | but nova keeps a connection open to rabbit, so it's not like it's reconnecting and renegotiating constantly | 15:37 |
| mhayden | anyone doing fosdem this year? | 15:37 |
| evrardjp | it would be nice to have a view of how many deployer use which of the following scenarii: http://docs.openstack.org/security-guide/secure-communication/secure-reference-architectures.html#cryptographic-separation-of-external-and-internal-environments | 15:37 |
| *** javeriak has joined #openstack-ansible | 15:38 | |
| evrardjp | sorry for my english and for the typos, but I guess you understand what I meant :p | 15:38 |
| mhayden | yup | 15:38 |
| mhayden | wow, you're better at english than i am -- i didn't know scenarii was a word! | 15:38 |
| * mhayden looked it up | 15:38 | |
| *** javeriak has quit IRC | 15:38 | |
| *** javeriak has joined #openstack-ansible | 15:39 | |
| evrardjp | mhayden, it's latin ;) | 15:39 |
| mattt | mhayden: don't you even latin bro | 15:39 |
| mhayden | BREH | 15:39 |
| evrardjp | mhayden, I should be at the fosdem | 15:39 |
| mhayden | i'd like to go this year | 15:40 |
| evrardjp | it's close to my home ;) | 15:40 |
| mhayden | need to see if i can get some time to work in the UK office so i can harass mattt with canada jokes | 15:40 |
| evrardjp | If no problem with my schedule, I'll be there and even help to hold the OpenStack stand (if any) | 15:40 |
| evrardjp | about nova and rabbit, I've seen plenty of cases when it's reconnecting and renegotiating in the past | 15:41 |
| * mattt pre-emptively books some vacation | 15:41 | |
| evrardjp | of reconnections/renegotiations* | 15:41 |
| mattt | mhayden: you should -- last time you were in UK you didn't spend any time in the office did you? | 15:42 |
| *** javeriak_ has joined #openstack-ansible | 15:42 | |
| *** javeriak has quit IRC | 15:44 | |
| *** cloudtrainme has quit IRC | 15:51 | |
| *** ysm has joined #openstack-ansible | 15:51 | |
| *** javeriak_ has quit IRC | 15:54 | |
| *** phiche has quit IRC | 15:56 | |
| *** rajalokan has joined #openstack-ansible | 16:03 | |
| *** sdake_ has joined #openstack-ansible | 16:03 | |
| *** greg_a has joined #openstack-ansible | 16:06 | |
| *** sdake has quit IRC | 16:06 | |
| *** phalmos has joined #openstack-ansible | 16:07 | |
| *** jaypipes is now known as leakypipes | 16:09 | |
| *** mss has joined #openstack-ansible | 16:10 | |
| *** javeriak has joined #openstack-ansible | 16:13 | |
| *** phalmos has quit IRC | 16:16 | |
| *** gouthamr_ has quit IRC | 16:17 | |
| *** gouthamr has joined #openstack-ansible | 16:19 | |
| *** phalmos has joined #openstack-ansible | 16:25 | |
| *** skamithi has joined #openstack-ansible | 16:27 | |
| *** sdake_ is now known as sdake | 16:28 | |
| *** cloudtrainme has joined #openstack-ansible | 16:31 | |
| *** greg_a has quit IRC | 16:35 | |
| *** cloudtrainme has quit IRC | 16:36 | |
| *** tnarg has joined #openstack-ansible | 16:37 | |
| mhayden | mattt: unfortunately, i didn't | 16:41 |
| mhayden | i was like "we should totally go" and my wife was like "i'm going to hurt you" | 16:41 |
| evrardjp | :) | 16:42 |
| evrardjp | come to fosdem with your wife, it's gonna be interesting. | 16:42 |
| mattt | she won't enjoy fosdem, i can assure you of that :) | 16:44 |
| mattt | plenty of other things for her to do in brussel tho | 16:44 |
| evrardjp | I confirm | 16:44 |
| *** mgoddard_ has joined #openstack-ansible | 16:45 | |
| *** karimb has joined #openstack-ansible | 16:46 | |
| *** ysm has quit IRC | 16:47 | |
| *** mgoddard__ has quit IRC | 16:48 | |
| *** mgoddard_ has quit IRC | 17:01 | |
| *** mgoddard has joined #openstack-ansible | 17:01 | |
| *** rajalokan has quit IRC | 17:09 | |
| *** skamithi has quit IRC | 17:15 | |
| *** skamithi has joined #openstack-ansible | 17:17 | |
| *** daneyon has joined #openstack-ansible | 17:18 | |
| *** ysm has joined #openstack-ansible | 17:20 | |
| bgmccollum | anyone running kilo head with rabbit affinity set to 3? | 17:22 |
| *** luckyinva has quit IRC | 17:26 | |
| *** subscope has joined #openstack-ansible | 17:30 | |
| *** rajalokan has joined #openstack-ansible | 17:33 | |
| bgmccollum | https://bugs.launchpad.net/openstack-ansible/+bug/1513668 | 17:35 |
| openstack | Launchpad bug 1513668 in openstack-ansible "RabbitMQ: unable to connect to node: nodedown during `Enable queue mirroring`" [Undecided,In progress] - Assigned to Byron McCollum (byron-mccollum) | 17:35 |
| *** Jezogwza_ has joined #openstack-ansible | 17:37 | |
| bgmccollum | mhayden: ^ might be related to change https://github.com/openstack/openstack-ansible/commit/52a644757031ee7e65d5399611e5d020686f98f0 --- thoughts? | 17:39 |
| *** ysm has quit IRC | 17:39 | |
| *** jimchou has quit IRC | 17:45 | |
| *** ysm has joined #openstack-ansible | 17:45 | |
| *** ysm has quit IRC | 17:59 | |
| mhayden | bgmccollum: hmm, let me look right quick | 18:00 |
| *** gouthamr_ has joined #openstack-ansible | 18:02 | |
| *** gouthamr has quit IRC | 18:03 | |
| mhayden | does queue mirroring require the rabbit nodes to talk to one another? | 18:04 |
| mhayden | it's been a while since i've been down this path | 18:04 |
| mhayden | oh, finally got to the bottom of your bug report | 18:07 |
| mhayden | so /etc/rabbitmq seems to have 755 on the directory | 18:08 |
| mhayden | (which is the default) | 18:08 |
| *** ysm has joined #openstack-ansible | 18:08 | |
| mhayden | bgmccollum: so going 0750 -> 0755 broke the mirrored queues? | 18:09 |
| *** gouthamr has joined #openstack-ansible | 18:22 | |
| mhayden | bgmccollum: doing a little testing right quick | 18:23 |
| jmccrory | from that log, it looks like directory permissions are only 755 on the first node, 750 on the other two. should be set correctly from the task though https://github.com/openstack/openstack-ansible/blob/kilo/playbooks/roles/rabbitmq_server/tasks/rabbitmq_pre_install.yml#L54-L57 | 18:24 |
| mhayden | jmccrory: you might be right on that one | 18:25 |
| *** gouthamr_ has quit IRC | 18:25 | |
| mhayden | looks like we might need an explicit permission setting for the directory as well as the cert/ke | 18:25 |
| mhayden | y | 18:25 |
| jmccrory | and if it's running as rabbitmq, it wouldn't have access to a root:root 750 folder | 18:25 |
| mhayden | right | 18:26 |
| mhayden | probably belongs in rabbitmq_ssl_key_distribute.yml | 18:26 |
| mhayden | bgmccollum: want me to toss an patch out there? | 18:27 |
| *** rady has quit IRC | 18:38 | |
| *** cloudtrainme has joined #openstack-ansible | 18:38 | |
| openstackgerrit | Major Hayden proposed openstack/openstack-ansible: Fixing /etc/rabbitmq permission bug https://review.openstack.org/242595 | 18:42 |
| mhayden | bgmccollum: ^^ | 18:42 |
| *** rady has joined #openstack-ansible | 18:43 | |
| *** jmckind has joined #openstack-ansible | 18:44 | |
| *** cloudtrainme has quit IRC | 18:55 | |
| *** tiagogomes_ has quit IRC | 18:57 | |
| *** cloudtrainme has joined #openstack-ansible | 19:01 | |
| *** alkari has joined #openstack-ansible | 19:05 | |
| spotz | ls | 19:07 |
| spotz | woops:) | 19:07 |
| *** ysm has quit IRC | 19:08 | |
| *** eil397 has joined #openstack-ansible | 19:12 | |
| bgmccollum | mhayden: thanks... | 19:13 |
| bgmccollum | mhayden: dropping patch in my build pipeline for testing | 19:15 |
| *** cloudtrainme has quit IRC | 19:18 | |
| *** karimb has quit IRC | 19:22 | |
| *** cloudtrainme has joined #openstack-ansible | 19:25 | |
| * mhayden crosses fingers for bgmccollum | 19:28 | |
| *** ysm has joined #openstack-ansible | 19:29 | |
| *** galstrom_zzz is now known as galstrom | 19:31 | |
| *** openstackstatus has joined #openstack-ansible | 19:34 | |
| *** ChanServ sets mode: +v openstackstatus | 19:34 | |
| *** alkari has quit IRC | 19:36 | |
| *** ysm has quit IRC | 19:36 | |
| *** cloudtrainme has quit IRC | 19:37 | |
| -openstackstatus- NOTICE: Gerrit will be offline at 20:00-20:15 UTC today (starting 20 minutes from now) for scheduled project rename maintenance | 19:39 | |
| *** phalmos has quit IRC | 19:43 | |
| *** jmckind is now known as jmckind_ | 19:51 | |
| *** phalmos has joined #openstack-ansible | 19:52 | |
| *** cloudtrainme has joined #openstack-ansible | 19:55 | |
| *** ysm has joined #openstack-ansible | 19:59 | |
| *** mgoddard_ has joined #openstack-ansible | 20:00 | |
| -openstackstatus- NOTICE: Gerrit is offline until 20:15 UTC today for scheduled project rename maintenance | 20:00 | |
| *** ChanServ changes topic to "Gerrit is offline until 20:15 UTC today for scheduled project rename maintenance" | 20:00 | |
| *** galstrom is now known as galstrom_zzz | 20:01 | |
| *** mgoddard has quit IRC | 20:03 | |
| *** skamithi has quit IRC | 20:05 | |
| *** skamithi has joined #openstack-ansible | 20:05 | |
| *** jroll is now known as tjroll | 20:07 | |
| *** jmckind_ is now known as jmckind | 20:08 | |
| *** rady has quit IRC | 20:10 | |
| mhayden | OMGERRIT | 20:11 |
| *** cloudtrainme has quit IRC | 20:12 | |
| *** skamithi has quit IRC | 20:23 | |
| *** rady has joined #openstack-ansible | 20:24 | |
| *** Mudpuppy has joined #openstack-ansible | 20:35 | |
| *** ChanServ changes topic to "Topic: Launchpad: https://launchpad.net/openstack-ansible Weekly Meetings: https://wiki.openstack.org/wiki/Meetings/openstack-ansible || Repo rename from stackforge/os-ansible-deployment to openstack/openstack-ansible happens Sept 11 2015 23:00 to 23:30. See https://review.openstack.org/#/c/200730/" | 20:35 | |
| *** k_stev has joined #openstack-ansible | 20:36 | |
| *** tnarg_ has joined #openstack-ansible | 20:37 | |
| *** tnarg has quit IRC | 20:40 | |
| *** cloudtrainme has joined #openstack-ansible | 20:44 | |
| *** gouthamr has quit IRC | 20:45 | |
| *** karimb has joined #openstack-ansible | 20:47 | |
| *** karimb has quit IRC | 20:47 | |
| *** karimb has joined #openstack-ansible | 20:48 | |
| *** cloudtrainme has quit IRC | 20:55 | |
| *** harlowja_ has joined #openstack-ansible | 20:56 | |
| *** harlowja has quit IRC | 20:56 | |
| *** openstackgerrit has quit IRC | 21:01 | |
| *** openstackgerrit has joined #openstack-ansible | 21:02 | |
| prometheanfire | neat | 21:07 |
| *** galstrom_zzz is now known as galstrom | 21:09 | |
| *** cloudtrainme has joined #openstack-ansible | 21:10 | |
| *** k_stev has quit IRC | 21:25 | |
| *** gouthamr has joined #openstack-ansible | 21:25 | |
| *** k_stev has joined #openstack-ansible | 21:25 | |
| *** admiralboom has joined #openstack-ansible | 21:35 | |
| *** subscope has quit IRC | 21:39 | |
| *** phalmos has quit IRC | 21:41 | |
| *** javeriak has quit IRC | 21:50 | |
| *** galstrom is now known as galstrom_zzz | 21:54 | |
| *** alejandrito has quit IRC | 21:56 | |
| *** antonym has joined #openstack-ansible | 22:00 | |
| mhayden | is it possible to get a role from within openstack's github into ansible-galaxy? | 22:01 |
| *** August1914 has joined #openstack-ansible | 22:01 | |
| *** August1914 has quit IRC | 22:03 | |
| *** August1914 has joined #openstack-ansible | 22:03 | |
| *** August1914 has quit IRC | 22:04 | |
| *** rady has quit IRC | 22:05 | |
| *** August1914 has joined #openstack-ansible | 22:05 | |
| *** daneyon has quit IRC | 22:10 | |
| *** rady has joined #openstack-ansible | 22:18 | |
| *** August1914 has left #openstack-ansible | 22:23 | |
| *** August1914 has joined #openstack-ansible | 22:24 | |
| *** August1914 has quit IRC | 22:26 | |
| *** August1914 has joined #openstack-ansible | 22:26 | |
| mhayden | so i'm wondering if i should make hard failures in openstack-ansible-security configurable... | 22:28 |
| bgmccollum | whats an example of a hard failure that you might want to ignore? | 22:28 |
| mhayden | https://gist.github.com/major/1b97999a7ec7dfce0768 | 22:29 |
| mhayden | i converted those from debug to fail | 22:29 |
| mhayden | but i'm wondering if there should be a "skip failure checks" variable of some sort | 22:29 |
| mhayden | so that the playbook won't die right there | 22:29 |
| bgmccollum | what about generating a report of "failing" items...but not actually hard fail... | 22:30 |
| mhayden | might be useful | 22:31 |
| bgmccollum | i haven't looked too close, but are mosts of the items just auditing, or does it bring the system into compliance where possible? | 22:31 |
| mhayden | the vast majority of the role actually brings the system into compliance | 22:32 |
| bgmccollum | bring_into_compliance: [true, false] | 22:32 |
| bgmccollum | report_compliance: [true, false] | 22:32 |
| mhayden | but the particular example i noted would change pam configs | 22:32 |
| mhayden | which is scary | 22:32 |
| mhayden | so i created exceptions for some of those really sensitive changes | 22:32 |
| mhayden | and i just search for certain bad things and report on them so a deployer could consider how they want to fix it | 22:32 |
| bgmccollum | well_do_it_live: [true, false] | 22:32 |
| *** greg_a has joined #openstack-ansible | 22:32 | |
| mhayden | lol | 22:33 |
| bgmccollum | maybe a separate preflight audit for those scary items...generate a report, with details how the deployer can fix them manually...then an option to skip the preflight audit, so the other tasks to do bring the system into compliance are applied... | 22:34 |
| bgmccollum | or a var for each task...warn (debug), or fail | 22:35 |
| bgmccollum | but thats tedious to maintain | 22:35 |
| *** rady has quit IRC | 22:36 | |
| bgmccollum | warn (debug), fail, or fix (default)...so you could override to fail or warn based on your comfort | 22:36 |
| mhayden | good ideas | 22:37 |
| mhayden | i'll ponder | 22:37 |
| mhayden | did the rabbit fix work, bgmccollum ? | 22:37 |
| bgmccollum | it should, but im having other transient failures because the successerator was removed from RPC... | 22:37 |
| * mhayden whistles | 22:38 | |
| bgmccollum | i manually chmod'd the directory, and ran the playbooks on a different environment, and it got past that part...so id say yeah it worked | 22:38 |
| mhayden | woot | 22:39 |
| mhayden | okay, i'm going to go enjoy some rush hour traffic on I-35 | 22:39 |
| mhayden | y'all have a good one | 22:39 |
| bgmccollum | mhayden +1'd review | 22:40 |
| bgmccollum | mhayden: adios | 22:40 |
| stevelle_ | mhayden: so ignore_errors: yes seems like someone someone can optionally add to a playbook to collect a complete set of sensitive changes? | 22:40 |
| bgmccollum | stevelle_ mhayden: still would need to coalesce the warnings, else they just scroll by and you might not even notice anything was wrong... | 22:43 |
| stevelle_ | I would disagree that this needs to be done. Text processing as an exercise for the reader | 22:44 |
| *** stevelle_ is now known as stevelle | 22:44 | |
| stevelle | don't use that flag unless you know it's failing anyway | 22:45 |
| bgmccollum | what do you mean you didn't parse the 16MB log file for things that might be interesting... | 22:45 |
| bgmccollum | ;) | 22:45 |
| stevelle | also don't run -vvvv | 22:45 |
| stevelle | unless you need to | 22:45 |
| stevelle | your shell has all the tools you need to coalesce is my point | 22:46 |
| *** ysm has quit IRC | 22:46 | |
| bgmccollum | you shell has all the tools to deploy openstack ;) | 22:47 |
| stevelle | which is why ansible uses it to do everything | 22:47 |
| bgmccollum | then why use ansible? | 22:48 |
| bgmccollum | convenience? | 22:48 |
| stevelle | not entirely sure I need to defend the use of ansible here :P | 22:50 |
| stevelle | I think I would agree with the idea of segregating the audit vs the mutator tasks | 22:50 |
| bgmccollum | all im saying is, you shouldn't set the expectation that a role is going to bring a system into security compliance, but only in certain circumstance, and not easily surface those exceptions in a user friendly manner, rather than expecting the user to whip up their own log parses | 22:51 |
| stevelle | that would also make it easier to report on | 22:51 |
| *** k_stev has quit IRC | 22:51 | |
| *** greg_a has quit IRC | 22:51 | |
| bgmccollum | so in some what agreement :) | 22:51 |
| stevelle | ansible does report the outcome of tasks, already, and operating linux is not something you can make idiot proof. some ability to perform text manipulation shouldn't be out of the question for the operator | 22:52 |
| stevelle | certainly not a closed question of how much you do to help, in my mind, but I'm skeptical of trying to do too much | 22:53 |
| bgmccollum | are ignored fails tallied? debugs certainly not in the summary | 22:53 |
| stevelle | I would need to play with ignore_errors to see if that idea is valid | 22:54 |
| *** jmckind is now known as jmckind_ | 22:58 | |
| *** jmckind_ has quit IRC | 23:00 | |
| *** tnarg_ has quit IRC | 23:18 | |
| *** tnarg has joined #openstack-ansible | 23:19 | |
| *** tnarg_ has joined #openstack-ansible | 23:20 | |
| *** tnarg has quit IRC | 23:24 | |
| *** mgoddard_ has quit IRC | 23:30 | |
| *** spotz is now known as spotz_zzz | 23:31 | |
| *** cloudtrainme has quit IRC | 23:31 | |
| Guest28399 | anyone know where openstack gets it's nova hypervisor-stats from? it's showing my local_gb as 5GB only, while cinder has plenty of space | 23:37 |
| Guest28399 | it's causing failures to spawn new instances because the aggregatediskfilter assumes there is not enough space available | 23:38 |
| Guest28399 | (if i disable the aggregatediskfilter, everything works correctly) | 23:38 |
| *** Mudpuppy has quit IRC | 23:47 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!