Friday, 2020-09-11

*** cshen has joined #openstack-ansible00:12
*** cshen has quit IRC00:17
*** djhankb has quit IRC01:01
*** djhankb has joined #openstack-ansible01:04
*** cshen has joined #openstack-ansible02:13
*** cshen has quit IRC02:18
*** gyee has quit IRC02:54
*** dave-mccowan has quit IRC03:06
*** spatel has joined #openstack-ansible03:29
*** cshen has joined #openstack-ansible04:11
*** cshen has quit IRC04:15
*** evrardjp has quit IRC04:33
*** evrardjp has joined #openstack-ansible04:33
*** spatel has quit IRC04:45
*** BlackFX has joined #openstack-ansible04:50
*** cloudnull has quit IRC04:51
*** cloudnull has joined #openstack-ansible04:52
*** aj_mailing has joined #openstack-ansible05:23
BlackFXWhich playbook is responsible for setting up the veths for the neutron role?06:50
BlackFXthe veth's for my br-vlan and br-vxlan are not being created in the neutron container06:51
*** pcaruana has joined #openstack-ansible07:00
*** cshen has joined #openstack-ansible07:14
jrosserBlackFX: the neutron container only runs the api server, not the agents. this means that those bridges are not required in the container. the agents run on the hosts themselves.07:15
BlackFXOpenStack Networking tunnel: br-vxlan07:16
BlackFXThe br-vxlan bridge is required if the environment is configured to allow projects to create virtual networks. It provides the interface for virtual (VXLAN) tunnel networks.07:16
BlackFXThe bridge attaches to a physical or logical interface, typically a bond1 VLAN subinterface. It also attaches to eth10 in each associated container.07:16
BlackFXThe container network interface it attaches to is configurable in the openstack_user_config.yml file.07:16
BlackFXWhats the bit in there about eth10 talking about?07:17
jrosserwhich release is the documentation for you have there?07:18
BlackFXussuri07:19
BlackFXhttps://docs.openstack.org/project-deploy-guide/openstack-ansible/ussuri/targethosts.html#configuring-the-network07:20
jrossersomewhere around the Queens release   the neutron agents were moved from containers to the host, because it was quite difficult operationally before.07:21
BlackFXOkay07:22
*** shyamb has joined #openstack-ansible07:47
*** openstackgerrit has joined #openstack-ansible08:07
openstackgerritJonathan Rosser proposed openstack/openstack-ansible master: Remove references to eth10/eth11 container interfaces  https://review.opendev.org/75118308:07
*** pcaruana has quit IRC08:19
*** shyamb has quit IRC08:28
*** pcaruana has joined #openstack-ansible08:31
*** MickyMan77 has joined #openstack-ansible08:34
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_aodh master: Define condition for the first play host one time  https://review.opendev.org/75118508:36
MickyMan77Why do I get this censored error msg when I run, # openstack-ansible setup-openstack.yml.      http://paste.openstack.org/show/797765/08:39
*** andrewbonney has joined #openstack-ansible08:44
noonedeadpunkbecause otherwise it will print out and log your db password each time you run role - even when it passes without error08:46
*** tosky has joined #openstack-ansible08:47
noonedeadpunkyou can comment out no_log option here https://opendev.org/openstack/openstack-ansible-os_keystone/src/branch/master/tasks/db_setup.yml#L36 (but in your deployment) to see error.08:47
BlackFXIs there a standard way to define host specific variables? i have a host with a different `host_bind_override` needed to all the others.08:52
*** shyamb has joined #openstack-ansible08:55
*** pcaruana has quit IRC09:07
*** pcaruana has joined #openstack-ansible09:08
*** shyam89 has joined #openstack-ansible09:11
*** shyamb has quit IRC09:15
*** cyberpear has quit IRC09:17
noonedeadpunkBlackFX: sure! you can use host_vars and group_vars09:28
noonedeadpunkso you can jsut creater /etc/openstack_deploy/host_vars/hostname.yml09:29
BlackFXand how do I refer to them from the conifg? it doesnt seem to like {{ hostvars[host]['var'] }}09:45
BlackFXthanks for your help by the way guys :)09:45
BlackFXNever mind. Got it09:48
*** omegapoint has joined #openstack-ansible10:05
omegapointhey, i'm trying to do an upgrade on rocky from xenial to bionic, and i was going to do an in-place upgrade. according to these release notes (https://docs.openstack.org/releasenotes/openstack-ansible/rocky.html ) this is not really supported. is this still the current state or is there some way to do it, even if manually?10:06
*** shyam89 has quit IRC10:08
*** d34dh0r53 has quit IRC10:11
*** fridtjof[m] has quit IRC10:11
*** mnaser has quit IRC10:11
*** gundalow has quit IRC10:11
*** fyx has quit IRC10:11
*** jrosser has quit IRC10:11
*** fresta has quit IRC10:11
*** d34dh0r53 has joined #openstack-ansible10:11
*** fresta has joined #openstack-ansible10:11
*** gundalow has joined #openstack-ansible10:11
*** jrosser has joined #openstack-ansible10:11
noonedeadpunkomegapoint: for sure there is way)10:14
noonedeadpunkwe have a patch that didn't get released... https://review.opendev.org/#/c/710803/10:15
noonedeadpunkthat have more detailed isntruction10:15
noonedeadpunkand some notes on the etherpad https://etherpad.openstack.org/p/osa-rocky-bionic-upgrade10:15
*** fridtjof[m] has joined #openstack-ansible10:16
*** fyx has joined #openstack-ansible10:16
*** mnaser has joined #openstack-ansible10:16
*** mnaser has quit IRC10:17
*** mnaser has joined #openstack-ansible10:17
*** fyx has quit IRC10:17
*** fyx has joined #openstack-ansible10:17
noonedeadpunkBlackFX: just keep in mind, that variables defined in user_variables.yml will have prescedence over host_vars. But host_vars have prescedence over group_vars10:17
noonedeadpunkso you probably want to set variable in group_vars/all.yml (or nova_all.yml or whatever), and verride for specific host, rather than defining us user_variables.yml10:18
omegapointnoonedeadpunk: thanks, i'll check it out :)10:22
*** shyamb has joined #openstack-ansible10:30
*** aj_mailing has quit IRC10:31
*** shyamb has quit IRC10:33
openstackgerritMerged openstack/openstack-ansible-os_cinder master: Set correct permissions for rootwrap.d  https://review.opendev.org/75049310:35
openstackgerritMerged openstack/openstack-ansible-os_designate master: Use the utility host for db setup tasks  https://review.opendev.org/74718310:36
*** shyamb has joined #openstack-ansible10:52
*** cyberpear has joined #openstack-ansible11:07
*** shyam89 has joined #openstack-ansible11:11
*** shyamb has quit IRC11:15
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_barbican master: Define condition for the first play host one time  https://review.opendev.org/75124811:27
openstackgerritMerged openstack/openstack-ansible stable/ussuri: Bump SHAs for stable/ussuri  https://review.opendev.org/75096211:29
*** shyam89 has quit IRC11:30
*** shyam89 has joined #openstack-ansible11:30
*** mgariepy has quit IRC11:37
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_blazar master: Define condition for the first play host one time  https://review.opendev.org/75125412:00
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_ceilometer master: Define condition for the first play host one time  https://review.opendev.org/75125712:10
*** cshen has quit IRC12:11
*** mgariepy has joined #openstack-ansible12:19
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_cinder master: Define condition for the first play host one time  https://review.opendev.org/75126012:24
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_cloudkitty master: Define condition for the first play host one time  https://review.opendev.org/75126112:27
*** shyam89 has quit IRC12:29
mgariepyovn is about to merge ! :D12:30
mgariepynoonedeadpunk, can you review this one ? https://review.opendev.org/#/c/751063/112:33
noonedeadpunksure thing12:33
openstackgerritAndrew Bonney proposed openstack/openstack-ansible-openstack_hosts stable/ussuri: Allow 'rp_filter' to be configured by individual deployments  https://review.opendev.org/75126512:37
openstackgerritMerged openstack/openstack-ansible master: Add integrated test for Ubuntu using ML2/OVN driver  https://review.opendev.org/73301712:40
openstackgerritMerged openstack/openstack-ansible master: [doc] Fix deployment guide to correspond relevant OS  https://review.opendev.org/74946012:40
mgariepy\o/12:40
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible stable/ussuri: [doc] Fix deployment guide to correspond relevant OS  https://review.opendev.org/75126712:42
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible master: [doc] Update current_series_name  https://review.opendev.org/74946112:42
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_designate master: Define condition for the first play host one time  https://review.opendev.org/75126812:45
jrosserjamesdenton: you remeber we talked about how necessary/not necessary container_interface was a while ago, like here https://github.com/openstack/openstack-ansible/blob/master/etc/openstack_deploy/openstack_user_config.yml.pod.example#L11212:46
jrosseri have a patch cleaning up the docs for this https://review.opendev.org/#/c/751183/ and i rememeber there was some gotcha about that var having hidden meaning for OVS?12:46
openstackgerritMarc Gariépy (mgariepy) proposed openstack/openstack-ansible stable/ussuri: Add integrated test for Ubuntu using ML2/OVN driver  https://review.opendev.org/75126912:47
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_glance master: Define condition for the first play host one time  https://review.opendev.org/75127012:50
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_cinder master: Define condition for the first play host one time  https://review.opendev.org/75126012:51
*** cshen has joined #openstack-ansible12:56
MickyMan77Now I run into this error msg when I'm installing the openstack on CentOS 8.2. (# openstack-ansible setup-openstack.yml), http://paste.openstack.org/show/797773/13:00
noonedeadpunkand what is ceph_stable_release?13:06
noonedeadpunkas I see all these packages in case of defaults https://download.ceph.com/rpm-octopus/el8/x86_64/13:08
jamesdentonjrosser rings a bell13:11
jamesdentoni know there's a network_interface var specifically for OVS-based provider networks13:12
jamesdentoni'd have to look at container_interface again to see if there's anything funny there13:13
jrosseri guess what i'm wondering is can we just strip those references to eth10/11 for good now13:13
jamesdenton*now that neutron agent container defaults to baremetal?13:13
jamesdentonthat's what its for13:13
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_gnocchi master: Define condition for the first play host one time  https://review.opendev.org/75127213:14
jrosseryep - we certiainly need to tidy the docs as we had someone query what it was all about for the neutron containers13:15
jamesdentonjrosser lemme try a deploy without it and see what breaks!13:15
jrosserawesome!13:15
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-os_heat master: Define condition for the first play host one time  https://review.opendev.org/75127413:21
noonedeadpunkjrosser: hm I thought we have some ability to globally enable haproxy_frontend_acls but can;'t find that...13:31
jrosserright now i think that they are per frontend13:33
jrosserhttps://github.com/openstack/openstack-ansible-haproxy_server/blob/master/templates/service.j2#L41-L4413:33
openstackgerritMerged openstack/openstack-ansible-openstack_hosts master: Allow 'rp_filter' to be configured by individual deployments  https://review.opendev.org/74813213:34
noonedeadpunkyeah I think it's worth adding them the way we did with haproxy_ssl?13:34
noonedeadpunkeventually we could add them based on the haproxy_ssl_letsencrypt_enable ?13:34
jrosserfor LE in the standard config you only need it on the frontend service port 44313:36
noonedeadpunkJust want the way that will allow to omit copying whole haproxy_default_services13:38
noonedeadpunkfor editing single service13:38
jrosseryes so there is leftover work from the LE stuff13:39
noonedeadpunkbut yeah, I see, thanks!13:39
jrosseri'm unsure if it's possible to have the ACL there all the time13:40
jrosserif the backend is not defined that may be a config error, and the backend would be conditional on using LE13:41
jrosserwhich i guess means that haproxy_frontend_acls for port 443 would be a ternary that is either the LE acl or an empty dict13:42
noonedeadpunkyeah, and eventually that would require horizon. but otherwise unsig extra services is not an issue13:43
jrosserinteresting point13:44
*** dmsimard has quit IRC13:44
jrosserthe acme challenge is on port 8013:44
*** dmsimard has joined #openstack-ansible13:45
jrosserso in a sense it's not depending on horizon in our implementation13:45
noonedeadpunkbut horizon frontend is the one listening on 44313:45
jrosserthe acl changes the way the no ssl -> ssl redirect works, and adds a special case13:45
jrosserso it's not actually doing anything on 443 really for LE13:45
jrosserit's perhaps cleaner if we can separate it out into 'redirect to https or LE' and 'horizon on https/443'13:47
jrosserbecause thats all a little tangled up right now13:47
jrosseri've also got some other work here with haproxy which would make it easy to have horizon.example.com cinder.example.com glance.example.com....... all on port 44313:48
noonedeadpunkoh, yeah, that's actually pretty cool13:49
jrosserhttps://www.haproxy.com/blog/introduction-to-haproxy-maps/13:49
jrosser^ these are really cool13:49
noonedeadpunkbut I think in this case we will need to issue LE for each endpoint?13:49
jrosserin the same cert it would need a SAN for each13:50
jrosserso one cert with many names13:50
openstackgerritMerged openstack/openstack-ansible master: [doc] Update current_series_name  https://review.opendev.org/74946113:50
noonedeadpunkBut can LE do SUN?13:51
noonedeadpunk(I thought it's not)13:51
jrosseryou just pass the domain flag lots of times to certbot13:51
noonedeadpunkoh, I see13:52
*** aj_mailing has joined #openstack-ansible14:00
*** cshen has quit IRC14:03
openstackgerritMerged openstack/openstack-ansible-os_neutron stable/ussuri: Add TCP listener on OVSDB  https://review.opendev.org/75106314:05
*** aj_mailing has quit IRC14:22
*** aj_mailing has joined #openstack-ansible14:22
*** cshen has joined #openstack-ansible14:25
redkriegI asked about this yesterday but didn't get any replies, sorry for the repeat.  I'm trying to upgrade Rocky->Stein but it's trying to run ceilometer-upgrade on my compute hosts and failing, is this supposed to be run on compute hosts?  If not, how can I fix my config?  http://paste.openstack.org/show/797735/14:27
*** stuartgr has quit IRC14:31
*** stuartgr has joined #openstack-ansible14:32
noonedeadpunkI think it's because you do limit. Eventually it doesn't matter where to run tbh14:39
noonedeadpunkand it might fail if you have issues with gnocchi14:39
noonedeadpunkor, I think, it might be because of usage of ujson < 20.114:40
noonedeadpunk*2.0.114:40
*** aj_mailing has quit IRC14:48
redkriegthanks for looking, I'll investigate gnocchi and ujson's version14:48
MickyMan77And one more issue, the last one I solved by manually install the fmt-6.2.1-1.el8.x86_64.rpm with the rpm command. Now I get this error when "Retrieve keyrings".   http://paste.openstack.org/show/797779/14:49
*** omegapoint has quit IRC14:54
*** mgariepy has quit IRC15:07
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible-haproxy_server master: Define http-01 params with already provided variables  https://review.opendev.org/75131615:17
noonedeadpunkMickyMan77: I suggest you're using self-deployed ceph?15:18
noonedeadpunk(not deployed with osa / ceph-ansible)?15:18
jrosserthat fmt package error is very odd15:28
*** spatel has joined #openstack-ansible15:28
jrosserwondering if we should have a centos ceph job now that the 8 jobs are a bit faster than the old 7 ones15:28
noonedeadpunkI think we should.... at least as non-voting at the beggining15:32
openstackgerritDmitriy Rabotyagov (noonedeadpunk) proposed openstack/openstack-ansible master: Simplify path for letsencrypt usage  https://review.opendev.org/75132715:32
*** spatel has quit IRC15:32
noonedeadpunkjrosser: btw I'm not really sure that https://review.opendev.org/751316 is 100% valid - at some point I realized that I don't understand why it was done that way, so might be misisng some tricky thing....15:33
noonedeadpunkI mean why did we force everyone to use haproxy_ssl_letsencrypt_setup_extra_params when we had all required variables...15:34
noonedeadpunkand were using them at the exact same places....15:34
jrossergimme a while....15:35
*** cshen has quit IRC15:38
*** spatel has joined #openstack-ansible15:43
*** spatel has quit IRC15:48
*** spatel has joined #openstack-ansible15:48
*** mgariepy has joined #openstack-ansible15:49
*** waxfire0 has joined #openstack-ansible15:53
*** waxfire has quit IRC15:55
*** waxfire0 is now known as waxfire15:55
jrossernoonedeadpunk: oh I see, I was trying to make it independent of the validation method15:58
jrosserI need to do a follow up to enable dns-01 for wildcards15:58
jamesdentonjrosser still running thru an ovs build, but an lxc build with container_interface and container_type commented out looks OK16:02
*** SecOpsNinja has joined #openstack-ansible16:02
jrossernoonedeadpunk: I have an idea, maybe we add a dict where the key is ‘http-01’ and the value is that giant multi line command for certbot16:06
jrosserthen we can add new keys like dns-01 as needed in future16:07
fridtjof[m]I'm starting to finally see the light of ansible :D16:08
fridtjof[m]I've only been using openstack-ansible without anything else, and today I wrote my first playbook16:08
fridtjof[m]it was easier than expected, i love it :)16:08
noonedeadpunkjrosser: ah, I see16:11
noonedeadpunkmaybe we can add var with validation method?16:11
jrosserabsolutely, yes16:12
jrosserthen a dict if commands16:12
noonedeadpunkyeah, ok. thanks for pointing to this16:12
noonedeadpunkI will update patch to take that into account16:12
jrosserdns won’t need the timeout python3...... at all for example16:12
*** cshen has joined #openstack-ansible16:13
noonedeadpunkwhich means it doesn't need https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/templates/letsencrypt_pre_hook_certbot_distro.j2 as well?16:13
jrosserthat’s only needed if type == http-0116:14
noonedeadpunkbtw not sure why used both this template and as command here https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/tasks/haproxy_ssl_letsencrypt.yml#L6616:14
noonedeadpunkneed a bit deeper dig for that...16:15
jrosserbecause the intial issue of the cert ignores the hooks :(16:15
jrosser*renewal* hook :(16:15
noonedeadpunkoh, I see. And it's not needed in both places?16:15
noonedeadpunkfor dns16:15
noonedeadpunk(I guess not)16:15
noonedeadpunkas for dns it should just ask for txt  record or smth16:16
jrosseryep16:16
noonedeadpunkeventually I'm not sure if even endpoint is needed16:16
jrosserfor dns probably not16:17
jrosserwe need this soon here for radosgw with a wildcard16:17
jrosserwildcard can only be done with dns auth16:18
noonedeadpunkok, yeah, I see16:18
noonedeadpunksorry for bothering you on the weekend:)16:19
noonedeadpunkcan't stop doing that :p16:19
jrosserfridtjof[m]: ansible js awesome :) OSA can seem very complex but it’s a great resource to find proven patterns for your own stuff too16:23
fridtjof[m]I agree completely! openstack-ansible really made me understand ansible (if not only because I had to understand how weird errors happened in my setup so many times ;))16:25
*** mgariepy has quit IRC16:43
*** spatel has quit IRC16:46
*** mgariepy has joined #openstack-ansible16:50
*** spatel has joined #openstack-ansible16:51
*** SecOpsNinja has left #openstack-ansible16:54
*** cshen has quit IRC16:55
*** tobberydberg has quit IRC16:57
*** andrewbonney has quit IRC17:13
*** cshen has joined #openstack-ansible17:30
*** gyee has joined #openstack-ansible17:31
*** cshen has quit IRC17:35
*** djhankb has quit IRC17:49
*** djhankb has joined #openstack-ansible17:49
*** MickyMan77 has quit IRC17:57
*** waxfire has quit IRC17:59
*** aj_mailing has joined #openstack-ansible17:59
*** waxfire has joined #openstack-ansible18:00
*** aj_mailing has quit IRC18:13
*** cshen has joined #openstack-ansible18:16
*** spatel has quit IRC18:18
*** cshen has quit IRC18:21
*** rh-jelabarre has quit IRC18:36
*** rh-jelabarre has joined #openstack-ansible18:36
*** MickyMan77 has joined #openstack-ansible18:51
*** tobberydberg has joined #openstack-ansible18:58
*** aj_mailing has joined #openstack-ansible19:03
*** johanssone_ has joined #openstack-ansible19:13
*** johanssone has quit IRC19:15
openstackgerritMerged openstack/openstack-ansible stable/ussuri: [doc] Fix deployment guide to correspond relevant OS  https://review.opendev.org/75126719:32
*** MickyMan77 has quit IRC19:35
*** pcaruana has quit IRC19:55
*** cshen has joined #openstack-ansible20:00
*** cshen has quit IRC20:06
*** cshen has joined #openstack-ansible20:53
*** cshen has quit IRC20:57
*** nsmeds has joined #openstack-ansible21:50
BlackFXis it possible for cinder traffic go over a dedicated network? my bridge is bound to the correct one, but the traffic is coming in on the mgmt network - I assume its - iscsi_ip_address: "{{ cinder_storage_address }}"22:27
*** gyee has quit IRC22:46
*** cshen has joined #openstack-ansible22:54
*** cshen has quit IRC22:59
*** tosky has quit IRC23:20

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!