| *** sshnaidm_ has joined #openstack-ansible | 00:00 | |
| *** sshnaidm|afk has quit IRC | 00:01 | |
| *** sshnaidm_ has quit IRC | 00:07 | |
| *** sshnaidm_ has joined #openstack-ansible | 00:08 | |
| *** luksky has quit IRC | 00:08 | |
| *** recyclehero has quit IRC | 00:18 | |
| *** recyclehero has joined #openstack-ansible | 00:38 | |
| *** gyee has quit IRC | 01:22 | |
| *** mrda has quit IRC | 02:14 | |
| *** recyclehero has quit IRC | 02:14 | |
| *** evrardjp has quit IRC | 02:33 | |
| *** mrda has joined #openstack-ansible | 02:33 | |
| *** evrardjp has joined #openstack-ansible | 02:33 | |
| *** rh-jelabarre has quit IRC | 02:34 | |
| *** spatel_ has joined #openstack-ansible | 02:45 | |
| *** spatel_ is now known as spatel | 02:45 | |
| *** spatel has quit IRC | 03:36 | |
| *** miloa has joined #openstack-ansible | 04:58 | |
| *** recyclehero has joined #openstack-ansible | 05:05 | |
| *** miloa has quit IRC | 05:07 | |
| *** recyclehero has quit IRC | 05:26 | |
| openstackgerrit | Merged openstack/openstack-ansible-specs master: Add Root CA spec https://review.opendev.org/c/openstack/openstack-ansible-specs/+/758805 | 05:31 |
|---|---|---|
| *** SiavashSardari has joined #openstack-ansible | 05:35 | |
| *** SiavashSardari has quit IRC | 05:50 | |
| *** recyclehero has joined #openstack-ansible | 05:57 | |
| *** luksky has joined #openstack-ansible | 05:59 | |
| *** pto has joined #openstack-ansible | 06:11 | |
| *** pto has quit IRC | 06:19 | |
| jrosser | i do wonder how that config-options-in-vault protects the token used to access vault | 06:26 |
| jrosser | unless i miss something it just moves the problem to protecting that instead | 06:26 |
| jrosser | https://opendev.org/openstack/castellan/src/branch/master/castellan/_config_driver.py | 06:30 |
| *** tsturm has quit IRC | 06:35 | |
| *** pto has joined #openstack-ansible | 06:35 | |
| noonedeadpunk | yeah, it's not | 06:41 |
| noonedeadpunk | but I haven't found it indeed (expected to see in oslo though) | 06:42 |
| *** shyamb has joined #openstack-ansible | 07:00 | |
| jrosser | maybe its runtime pluggable | 07:02 |
| jrosser | https://opendev.org/openstack/castellan/src/branch/master/setup.cfg#L33-L34 | 07:03 |
| noonedeadpunk | yeah, already found. I meant about how this helps to protect vault is not really clear :) | 07:04 |
| jrosser | maybe the reasoning is that a compromised service could read it's own config file | 07:04 |
| jrosser | or anything that it has read permission to | 07:04 |
| jrosser | and its a step further to then gain root to read the file with the vault token in | 07:05 |
| noonedeadpunk | but it will have read permissions to the included files anyway... | 07:05 |
| noonedeadpunk | but yeah, it's step futher. Anyway, I think it might be useful | 07:05 |
| jrosser | yes, though i think that the use case is not totally well explained | 07:05 |
| noonedeadpunk | as what I'm dreming about is to store user_secrets in vault | 07:05 |
| jrosser | ah well, i was thinking about that | 07:06 |
| jrosser | we already store the whole blob in vault in case we need to re-deploy our deploy host | 07:06 |
| noonedeadpunk | and having vault deployed is a huge help there | 07:06 |
| jrosser | but it still just sits there plaintext after that, which is not so great | 07:07 |
| noonedeadpunk | but do you use vault-ansible? or just script to store suer_secrets? | 07:07 |
| noonedeadpunk | yeah... | 07:07 |
| jrosser | hashi vault | 07:07 |
| jrosser | then in playbook pre_tasks we do a bunch of these http://paste.openstack.org/show/804787/ | 07:09 |
| jrosser | one of the challenges with using hashi-vault heavily with ansible is you need to only read the secrets once and cache them for the lifetime of the playbook | 07:11 |
| jrosser | otherwise if you template variables directly with a lookup reading from vault then it does that hundreds and hundreds of times every time the var is evaluated, and the deployment speed is really bad | 07:12 |
| noonedeadpunk | doh, gotcha | 07:15 |
| noonedeadpunk | I was just thinking about using ansible vault keyring script | 07:15 |
| *** andrewbonney has joined #openstack-ansible | 07:15 | |
| jrosser | ah ok | 07:16 |
| noonedeadpunk | But I guess there it will be really geting secrets each time | 07:16 |
| jrosser | i never really looked at vars plugins | 07:16 |
| jrosser | maybe thats a way to have something equivalent to user_secrets but injected at runtime from some secure source | 07:17 |
| jrosser | anyway..... i was going to take another look at rabbitmq/pki | 07:18 |
| noonedeadpunk | yeah. And I will have a look at ansible-core 2.11... | 07:19 |
| jrosser | right now i re-used rabbitmq_user_ssl_cert vars to wire everything together | 07:19 |
| jrosser | if i move the pki role include into the rabbitmq role, any ideas how that would work | 07:20 |
| jrosser | i.e do we leave the old vars for user supplied certs | 07:20 |
| noonedeadpunk | well, the way I wath thinking about it, that we provide pki role bunch of variables, and put all logic into pki role | 07:22 |
| jrosser | i'm not totally sure right now how we operate this in two different modes, where the pki role generates everything, or where the user supplies some | 07:22 |
| noonedeadpunk | Ie if user provided certificate is not empty -we take it instead of the generating self-signed one | 07:22 |
| jrosser | ok, it's just that the logic right now is spread everywhere, if you define the haproxy/rabbitmq user_certs vars then the existing roles fetch them from the path you give | 07:23 |
| jrosser | and each role may need to do different things to install / concatenate / whatever the certs to install them for the particular application | 07:23 |
| noonedeadpunk | ok, so we might want to limit pki role to jsut generating stuf if required? | 07:24 |
| jrosser | perhaps, i'm not really sure | 07:24 |
| jrosser | depends how much we want to keep the old vars, maybe | 07:25 |
| noonedeadpunk | but I think there super limited amount of options. I mean there can be either pkcs#12 or pem or combined pem as output? | 07:25 |
| jrosser | yeah actually - perhaps i look also at moving the install part into the pki role | 07:26 |
| noonedeadpunk | yeah, I guess we can try that out, and just provide path and format we expect to see as a result? | 07:27 |
| noonedeadpunk | Let me know if I can help or pick up some work regarding it | 07:29 |
| *** shyamb has quit IRC | 07:29 | |
| jrosser | ahhh well i can make some pki role vars like pki_install_certs: "{{ user_supplied_cert_path ~ default(pki_role_made_cert_path) }}" | 07:30 |
| jrosser | | default... | 07:30 |
| *** shyamb has joined #openstack-ansible | 07:33 | |
| *** shyamb has quit IRC | 07:36 | |
| *** shyamb has joined #openstack-ansible | 07:36 | |
| *** shyamb has quit IRC | 07:38 | |
| *** shyamb has joined #openstack-ansible | 07:39 | |
| *** tosky has joined #openstack-ansible | 07:41 | |
| *** rpittau|afk is now known as rpittau | 07:45 | |
| * noonedeadpunk struggling with openstack upgrade atm :( | 07:46 | |
| noonedeadpunk | I found nasty thing - `lxc.mount.entry = /openstack/control01_galera_container-c96842be var/lib/mysql none bind,create=dir 0 0` | 07:46 |
| noonedeadpunk | and in `/openstack/control01_galera_container-c96842be` we put all kind of different stuff by default.... | 07:46 |
| noonedeadpunk | which I think acts weird when you try to re-join empty node to the cluster | 07:47 |
| noonedeadpunk | this all is super weurd https://codesearch.opendev.org/?q=%2Fopenstack%2F%7B%7B%20inventory_hostname%20%7D%7D&i=nope&files=&excludeFiles=&repos= | 07:55 |
| noonedeadpunk | and I have no idea how we can change that in terms of upgrade | 07:55 |
| noonedeadpunk | and that's super strange https://opendev.org/openstack/openstack-ansible/src/branch/master/inventory/group_vars/glance_all.yml#L29-L33 | 07:58 |
| noonedeadpunk | jrosser: ^ | 07:59 |
| noonedeadpunk | I really no idea how to properly fix that.... especially for glance | 08:05 |
| jrosser | so i'm guessing that it's trying to put persistent data outside the container? | 08:05 |
| jrosser | well persistent / large | 08:06 |
| jrosser | in that the LXC might be on the system disk and /openstack be some other larger device | 08:06 |
| noonedeadpunk | yes, but we bind mount same directory into 2 different places in container | 08:07 |
| noonedeadpunk | and on top of that we put mac_generation script there | 08:07 |
| jrosser | i'm just looking on my lab setup | 08:09 |
| jrosser | those mounts don't seem present on the glance container | 08:09 |
| noonedeadpunk | yeah, they're just for file | 08:11 |
| noonedeadpunk | but, for galera I tried to re-add member to cluster and it was failing | 08:11 |
| *** shyamb has quit IRC | 08:11 | |
| noonedeadpunk | until I removed https://opendev.org/openstack/openstack-ansible-lxc_container_create/src/branch/master/tasks/lxc_container_config.yml#L95-L101 as it's in the exact same directory as /var/lib/mysql | 08:13 |
| noonedeadpunk | and thus SST transfer was failing | 08:13 |
| noonedeadpunk | and IST is not appropriate as start position is 00000000-0000-0000-0000-000000000000:-1 | 08:13 |
| *** shyamb has joined #openstack-ansible | 08:48 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-rabbitmq_server master: DNM - Test PKI role https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/788032 | 08:55 |
| openstackgerrit | Jonathan Rosser proposed openstack/ansible-role-pki master: WIP - Create server certificates https://review.opendev.org/c/openstack/ansible-role-pki/+/788021 | 08:57 |
| openstackgerrit | Dmitriy Rabotyagov proposed openstack/openstack-ansible-lxc_container_create master: Do not create extras in /openstack/{{ inventory_hostname }} https://review.opendev.org/c/openstack/openstack-ansible-lxc_container_create/+/788222 | 09:01 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible master: WIP - Test PKI role https://review.opendev.org/c/openstack/openstack-ansible/+/788031 | 09:04 |
| jrosser | noonedeadpunk: i've made it much more like python_venv_build for rabbitmq now https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/788032/2/tasks/main.yml | 09:04 |
| jrosser | got a few hours of meetings now :( | 09:05 |
| * noonedeadpunk has disaster upgrade with broken galera and rabbit cluster :( | 09:06 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-rabbitmq_server master: DNM - Test PKI role https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/788032 | 09:06 |
| *** snapdeal has joined #openstack-ansible | 09:14 | |
| *** SiavashSardari has joined #openstack-ansible | 09:34 | |
| *** pto_ has joined #openstack-ansible | 09:56 | |
| *** pto__ has joined #openstack-ansible | 09:57 | |
| *** pto_ has quit IRC | 09:57 | |
| noonedeadpunk | doh, centos does not have libselinux bindings for python38 and not ging to have :( | 09:59 |
| *** pto has quit IRC | 09:59 | |
| *** sshnaidm_ is now known as sshnaidm | 10:00 | |
| noonedeadpunk | and ansible-core has soft requirement of py38.... | 10:01 |
| jrosser | it's almost like one half of RH doesnt know what the other is doing | 10:09 |
| *** shyamb has quit IRC | 10:22 | |
| *** shyamb has joined #openstack-ansible | 10:27 | |
| *** shyamb has quit IRC | 10:32 | |
| *** pto__ has quit IRC | 10:36 | |
| *** pto has joined #openstack-ansible | 10:37 | |
| *** pto has quit IRC | 10:41 | |
| *** pto has joined #openstack-ansible | 10:48 | |
| *** pto has quit IRC | 10:52 | |
| *** shyamb has joined #openstack-ansible | 11:02 | |
| *** pto has joined #openstack-ansible | 11:19 | |
| *** macz_ has joined #openstack-ansible | 11:24 | |
| *** macz_ has quit IRC | 11:28 | |
| *** rh-jelabarre has joined #openstack-ansible | 11:30 | |
| *** SiavashSardari has quit IRC | 11:33 | |
| noonedeadpunk | I think that's why they are going to have ansible running in container... | 11:37 |
| *** pto has quit IRC | 11:46 | |
| jrosser | maybe we should look at pyenv a bit more | 11:50 |
| jrosser | that would let us have a guaranteed python version on all OS | 11:51 |
| noonedeadpunk | but we would still need to build libselinux... | 11:58 |
| noonedeadpunk | along with dnf or apt modules I guess? | 11:59 |
| noonedeadpunk | or lxc and etc... | 11:59 |
| *** pto has joined #openstack-ansible | 12:01 | |
| *** shyamb has quit IRC | 12:02 | |
| noonedeadpunk | oh, but we don't need lxc on deploy host - only on dest | 12:04 |
| noonedeadpunk | so just libselinux kind of... | 12:04 |
| *** pto has quit IRC | 12:23 | |
| *** pto has joined #openstack-ansible | 12:24 | |
| *** pto has quit IRC | 12:28 | |
| *** shyamb has joined #openstack-ansible | 12:35 | |
| *** macz_ has joined #openstack-ansible | 12:37 | |
| *** macz_ has quit IRC | 12:42 | |
| *** snapdeal has quit IRC | 12:43 | |
| *** spatel_ has joined #openstack-ansible | 12:46 | |
| *** spatel_ is now known as spatel | 12:46 | |
| *** macz_ has joined #openstack-ansible | 12:58 | |
| *** pto has joined #openstack-ansible | 13:00 | |
| *** macz_ has quit IRC | 13:02 | |
| *** pto has quit IRC | 13:06 | |
| *** pto has joined #openstack-ansible | 13:06 | |
| *** fridtjof[m] has joined #openstack-ansible | 13:09 | |
| *** pto has quit IRC | 13:16 | |
| *** pto has joined #openstack-ansible | 13:17 | |
| *** shyamb has quit IRC | 13:20 | |
| *** pto has quit IRC | 13:21 | |
| *** pto has joined #openstack-ansible | 13:42 | |
| *** pto has quit IRC | 13:47 | |
| fridtjof[m] | looking at the production network example (https://docs.openstack.org/openstack-ansible/victoria/user/prod/example.html), do I still need a veth pair for neutron on compute hosts if my external network is just a simple flat (no vlans) bridge? | 14:03 |
| fridtjof[m] | Reason i'm asking is because that's the one thing preventing me from using netplan or networkd for network configuration, and I'd like to avoid setting up ifupdown on ubuntu 20.04... | 14:04 |
| admin0 | fridtjof[m], you can use netplan just fine | 14:08 |
| admin0 | on ubuntu 20 | 14:08 |
| admin0 | you need to create 4 bridges and that is all about it :) | 14:08 |
| admin0 | in terms of requirement | 14:08 |
| admin0 | if you are using linuxbridge, you do not need to do anything further .. if ovs, then you need diff setup in controllers vs computes | 14:09 |
| admin0 | didn't understood "do I still need a veth pair for neutron on compute hosts" ?? | 14:09 |
| fridtjof[m] | iirc, how i understood it a year ago or two (stein, i think), that was necessary because neutron agents will run in both containers (infra hosts) and on metal (compute hosts), but still expect the same kind of access to tenant networks | 14:11 |
| noonedeadpunk | I believe you might need veth pair for octavia or trove dpeloyment, but not on computes but on controllers, when they are shared with network nodes | 14:11 |
| noonedeadpunk | neutron agents always run on metal by default. only neutron api runs in container | 14:12 |
| fridtjof[m] | oh i see, then that was a misunderstanding on my part. I'll try without a veth pair, and report back | 14:14 |
| fridtjof[m] | that would greatly simplify my deployment preparation | 14:14 |
| *** gshippey has joined #openstack-ansible | 14:22 | |
| jrosser | there was a veth pair used to create eth12/13/14 on hosts which was necessary for the example configs when using flat networks | 14:22 |
| jrosser | imho thats really just a suggestion and generalisation and not how you'd do it in a production setup | 14:22 |
| *** sshnaidm has quit IRC | 14:38 | |
| *** sshnaidm has joined #openstack-ansible | 14:40 | |
| *** d34dh0r53 has quit IRC | 14:47 | |
| *** d34dh0r53 has joined #openstack-ansible | 14:47 | |
| *** pto has joined #openstack-ansible | 14:53 | |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:00 |
| openstack | Meeting started Tue Apr 27 15:00:44 2021 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| openstack | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| *** openstack changes topic to " (Meeting topic: openstack_ansible_meeting)" | 15:00 | |
| openstack | The meeting name has been set to 'openstack_ansible_meeting' | 15:00 |
| noonedeadpunk | #topic rollcall | 15:00 |
| noonedeadpunk | o/ | 15:00 |
| *** openstack changes topic to "rollcall (Meeting topic: openstack_ansible_meeting)" | 15:00 | |
| mgariepy | hello ! | 15:01 |
| noonedeadpunk | hey mgariepy! how're you doing?:) | 15:01 |
| mgariepy | not too bad. | 15:01 |
| mgariepy | how are you doing ? | 15:02 |
| noonedeadpunk | having bad upgrade :( | 15:02 |
| mgariepy | really ? how comes? | 15:02 |
| noonedeadpunk | but that's fine) | 15:02 |
| * noonedeadpunk no idea | 15:03 | |
| mgariepy | what's failing ? | 15:03 |
| noonedeadpunk | ended up with both broken rabbit, so had to wipe it and re-create from scratch, including vhosts and permissions | 15:03 |
| mgariepy | ouch | 15:03 |
| noonedeadpunk | and now galera falled apart as well | 15:03 |
| openstackgerrit | wu.chunyang proposed openstack/openstack-ansible master: setup.cfg: Replace dashes with underscores https://review.opendev.org/c/openstack/openstack-ansible/+/788312 | 15:03 |
| noonedeadpunk | ok, so... | 15:05 |
| noonedeadpunk | #topic office hours | 15:05 |
| *** openstack changes topic to "office hours (Meeting topic: openstack_ansible_meeting)" | 15:05 | |
| noonedeadpunk | I still haven't sent anything from PTG, will do this right after the meeting | 15:05 |
| *** ajg20 has joined #openstack-ansible | 15:06 | |
| noonedeadpunk | Also, there's a question regarding what we should do with ansible goes ahead | 15:06 |
| noonedeadpunk | Today ansible-core 2.11 has been released which has soft requirement of py38 | 15:07 |
| noonedeadpunk | I think it mean that no CI has been done for py36, but not sure | 15:07 |
| noonedeadpunk | I think it's smth we can already use for W, but probably worth postponing for X? | 15:07 |
| jrosser | o/ sorry i'm late | 15:08 |
| noonedeadpunk | As there we will drop bionic with it's 3.6 and already bullseye will be stable with 3.9 on board | 15:09 |
| noonedeadpunk | the only issue is centos atm. But might be stream get some libselinux python binding till then? | 15:09 |
| ajg20 | Hello, I have setup OpenStack-Ansible on a server and I am getting the following error "Error: Failed to perform requested operation on instance "cirros", the instance has an error status: Please try again later [Error: Exceeded maximum number of retries. Exhausted all hosts available for retrying build failures for instance | 15:10 |
| ajg20 | d376970d-19a0-4bc5-a47e-43ef6ed2d63c.]." More details http://paste.openstack.org/show/804801/ . Can someone help me out? | 15:10 |
| noonedeadpunk | while we can build pyenv ofc, I really dunno about building libselinux bindings... | 15:10 |
| noonedeadpunk | ajg20: having meeting now, will be able to help in an hour or so | 15:11 |
| ajg20 | Thank you, Let me know when you have free. | 15:12 |
| *** pto has quit IRC | 15:13 | |
| noonedeadpunk | So I'd say let's use ansible-base 2.10 for W and see how things will go during next cycle? | 15:14 |
| jrosser | yeah, i think so | 15:14 |
| jrosser | i wonder if spotz might know who to ask how we're supposed to use ansible-core on centos8 w.r.t python selinux bindings | 15:15 |
| noonedeadpunk | I think that with 2.12 ansible-core they will implement some kind of containers for ansible-core | 15:16 |
| noonedeadpunk | so that they won't need to worry about py in centos | 15:17 |
| noonedeadpunk | Another thing we've briefly discussed during the day is https://review.opendev.org/c/openstack/openstack-ansible-specs/+/788057 | 15:17 |
| jrosser | there is this https://ansible-runner.readthedocs.io/en/latest/ | 15:18 |
| noonedeadpunk | `Python 2.7+ and 3.6+ are supported and installable via pip` lol | 15:19 |
| jrosser | oh :/ | 15:19 |
| noonedeadpunk | pretty deserted I guess? https://ansible-runner.readthedocs.io/en/latest/install.html#changelog | 15:19 |
| noonedeadpunk | dunno though | 15:19 |
| *** macz_ has joined #openstack-ansible | 15:21 | |
| jrosser | config in vault is one thing | 15:21 |
| jrosser | but all deployment secrets in vault in the general sense, i.e OSA wide, is kind of something else again | 15:22 |
| noonedeadpunk | yeah, agree | 15:22 |
| jrosser | and as a deployment tool i kind of figure we should care about both of those | 15:22 |
| noonedeadpunk | and this blueprint is regarding config in vault only | 15:22 |
| jrosser | yes | 15:22 |
| jrosser | deployment environment secrets in vault poses some interesting chicken/egg challenges too | 15:23 |
| noonedeadpunk | probably as soon as we will have vault deployment, we can figure out how we want to integrate it with secrets as well | 15:23 |
| noonedeadpunk | As I'm not sure about time during the upcoming cycle for this thing. | 15:23 |
| jrosser | no me neither | 15:24 |
| noonedeadpunk | While blueprint is assigned to the patch owner :) | 15:24 |
| noonedeadpunk | And I have vault role in exact OSA format, where used even galera_role | 15:25 |
| jrosser | ah interesting, we've got one too using the internal data store and raft HA | 15:25 |
| noonedeadpunk | I used haproxy in octavia.... | 15:26 |
| noonedeadpunk | but I mean it should fit perfectly I guess to what we have in terms of containers and stuff | 15:26 |
| noonedeadpunk | but yeah, now I got chicken/egg situation... | 15:27 |
| jrosser | i did another pass on the pki role setup for rabbitmq | 15:29 |
| noonedeadpunk | I think as long as they're going to lead implementation I'm pretty much fine with it | 15:29 |
| jrosser | thats looking a lot more like python_venv_build approach now | 15:29 |
| noonedeadpunk | oh, I saw pki has passed, haven;t checked rabbit | 15:29 |
| jrosser | half way through doing the same for haproxy though theres more complexity there with needing to keep the original functionality + certbot and stuff | 15:29 |
| noonedeadpunk | yeah, I was thinking about smth like that, but haven't digged into details yet | 15:29 |
| jrosser | i still need to look at the variable names again, make them rabbitmq specific in defaults/main.yml with the option for a deployment wide openstack_<var> global setting | 15:30 |
| noonedeadpunk | yeah, you read my thoughts! | 15:31 |
| noonedeadpunk | I'm wondering if there's good usecase to use letsencrypt for rabbit/galera as well | 15:31 |
| noonedeadpunk | in case of dns-01 auth | 15:31 |
| jrosser | as a positive though it's really cleaned up the code for ssl in the rabbit role | 15:31 |
| noonedeadpunk | not sure how to implement it though | 15:31 |
| noonedeadpunk | yep, a lot of dropped stuff. And I think overall it will be the way cleaner | 15:32 |
| jrosser | right, so theres a var in the pki role, pki_method | 15:32 |
| jrosser | i'd intended to allow that to be used as some kind of extension where we could add certbot support in the future to the role | 15:33 |
| jrosser | and allow the caller to specify the backend used to issue the cert | 15:33 |
| noonedeadpunk | oh, nice idea, yes | 15:34 |
| jrosser | if we do it right then you'd be able to specify that per certificate | 15:34 |
| noonedeadpunk | and eventuyally that might be even some third part tooling (forgot what exact thing you talked about previously) | 15:36 |
| jrosser | yes indeed, we've got step-ca running here as an internal CA | 15:36 |
| jrosser | so i'd like to leave the door open for adding more opinionated backends like that to the pki role | 15:37 |
| noonedeadpunk | yep, agree | 15:37 |
| jrosser | is there anything else we need to prioritise to get merged for a release | 15:41 |
| noonedeadpunk | oh, centos stream | 15:41 |
| openstackgerrit | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Add centos-8 stream jobs https://review.opendev.org/c/openstack/openstack-ansible/+/776226 | 15:42 |
| jrosser | oh urgh distro_metal_centos8 fails, of course! | 15:44 |
| noonedeadpunk | on cinder :( | 15:50 |
| *** spatel has quit IRC | 15:50 | |
| jrosser | i also looked at the tempestconf fix we had, though i think we can't test that with a depends-on | 15:51 |
| jrosser | oh i think it is possible, if we make a DNM patch which sets tempest_tempestconf_pip_packages to the url of the tempestconf change in gerrit | 15:53 |
| noonedeadpunk | um.... | 15:59 |
| noonedeadpunk | I think the issue with gerrit change is in refs? | 15:59 |
| noonedeadpunk | anyway.. | 16:03 |
| noonedeadpunk | #endmeeting | 16:03 |
| *** openstack changes topic to "Launchpad: https://launchpad.net/openstack-ansible || Weekly Meetings: https://wiki.openstack.org/wiki/Meetings/openstack-ansible || Review Dashboard: http://bit.ly/osa-review-board-v3" | 16:03 | |
| openstack | Meeting ended Tue Apr 27 16:03:18 2021 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 16:03 |
| openstack | Minutes: http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2021/openstack_ansible_meeting.2021-04-27-15.00.html | 16:03 |
| openstack | Minutes (text): http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2021/openstack_ansible_meeting.2021-04-27-15.00.txt | 16:03 |
| openstack | Log: http://eavesdrop.openstack.org/meetings/openstack_ansible_meeting/2021/openstack_ansible_meeting.2021-04-27-15.00.log.html | 16:03 |
| *** jamesden_ has joined #openstack-ansible | 16:21 | |
| *** jamesdenton has quit IRC | 16:22 | |
| spotz | jrosser: You still need me to check on ansible-core? | 16:30 |
| *** gyee has joined #openstack-ansible | 16:30 | |
| *** rpittau is now known as rpittau|afk | 16:33 | |
| noonedeadpunk | I'm actually wondering what ooo is going to do with ansible version and centos that does not have libselinux binding for py38... | 16:36 |
| *** spatel_ has joined #openstack-ansible | 17:02 | |
| *** spatel_ is now known as spatel | 17:02 | |
| *** andrewbonney has quit IRC | 17:05 | |
| *** pto has joined #openstack-ansible | 17:18 | |
| *** pto has quit IRC | 17:18 | |
| openstackgerrit | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_senlin master: DNM - test patch for senlin tempest testing https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/754045 | 18:01 |
| *** Adri2000 has quit IRC | 18:28 | |
| *** openstackstatus has quit IRC | 18:31 | |
| *** openstackstatus has joined #openstack-ansible | 18:32 | |
| *** ChanServ sets mode: +v openstackstatus | 18:32 | |
| spatel | How are you folks doing :) look like lots of activity going on | 19:18 |
| spatel | dealing with some massive DDoS issue :( and finally implemented protection plan | 19:19 |
| spatel | hope no more trouble so i get more time to play with my OVN deployment. | 19:19 |
| *** spatel has quit IRC | 20:05 | |
| *** gshippey has quit IRC | 21:14 | |
| *** cloudnull has quit IRC | 21:24 | |
| *** cloudnull has joined #openstack-ansible | 21:25 | |
| *** macz_ has quit IRC | 22:03 | |
| *** macz_ has joined #openstack-ansible | 22:28 | |
| *** macz_ has quit IRC | 22:33 | |
| *** luksky has quit IRC | 22:34 | |
| *** tosky has quit IRC | 23:08 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!