| *** zbr has quit IRC | 00:17 | |
| *** zbr has joined #openstack-ansible | 00:17 | |
| *** rh-jlabarre has joined #openstack-ansible | 01:27 | |
| *** rh-jlabarre has quit IRC | 02:53 | |
| *** akahat is now known as akahat|ruck | 04:26 | |
| *** macz_ has joined #openstack-ansible | 04:53 | |
| *** macz_ has quit IRC | 04:57 | |
| *** shyamb has joined #openstack-ansible | 05:54 | |
| *** shyamb has quit IRC | 05:57 | |
| *** shyamb has joined #openstack-ansible | 05:58 | |
| *** macz_ has joined #openstack-ansible | 06:00 | |
| *** macz_ has quit IRC | 06:05 | |
| *** logan- has quit IRC | 06:12 | |
| *** logan- has joined #openstack-ansible | 06:15 | |
| *** shyamb has quit IRC | 06:42 | |
| *** shyamb has joined #openstack-ansible | 06:42 | |
| *** shyamb has quit IRC | 06:55 | |
| *** miloa has joined #openstack-ansible | 07:03 | |
| *** jawad_axd has joined #openstack-ansible | 07:05 | |
| *** miloa has quit IRC | 07:11 | |
| noonedeadpunk | morning | 07:18 |
|---|---|---|
| noonedeadpunk | masakari failure for centos is super weird. I believe there is python3-libvirt as rpm package, as we also install it for nova... | 07:20 |
| *** andrewbonney has joined #openstack-ansible | 07:21 | |
| *** kleini has quit IRC | 07:22 | |
| *** macz_ has joined #openstack-ansible | 07:26 | |
| jrosser | morning | 07:28 |
| *** macz_ has quit IRC | 07:30 | |
| *** tosky has joined #openstack-ansible | 07:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/openstack-ansible master: Imported Translations from Zanata https://review.opendev.org/c/openstack/openstack-ansible/+/791674 | 07:43 |
| *** kleini has joined #openstack-ansible | 07:43 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_nova master: Add galera port to nova config and database template https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/791675 | 07:44 |
| *** macz_ has joined #openstack-ansible | 07:47 | |
| *** macz_ has quit IRC | 07:51 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_aodh master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_aodh/+/791676 | 07:54 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_barbican master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/791677 | 07:55 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_blazar master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_blazar/+/791678 | 07:56 |
| *** jbadiapa has joined #openstack-ansible | 08:32 | |
| openstackgerrit | likui proposed openstack/openstack-ansible master: Replace deprecated UPPER_CONSTRAINTS_FILE variable https://review.opendev.org/c/openstack/openstack-ansible/+/791693 | 08:39 |
| openstackgerrit | likui proposed openstack/openstack-ansible master: Replace deprecated UPPER_CONSTRAINTS_FILE variable https://review.opendev.org/c/openstack/openstack-ansible/+/791693 | 08:44 |
| *** pto has joined #openstack-ansible | 08:51 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_ceilometer master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/791700 | 09:24 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_cloudkitty master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_cloudkitty/+/791701 | 09:24 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_designate master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_designate/+/791703 | 09:26 |
| sakharkar | noonedeadpunk: I am trying to deploy OSA Victoria with all endpoint SSL/TLS with options haproxy_user_ssl_cert: /etc/openstack_deploy/ssl/tvm.cert.pem | 09:35 |
| sakharkar | haproxy_user_ssl_key: /etc/openstack_deploy/ssl/tvm.key.pem | 09:35 |
| sakharkar | haproxy_user_ssl_ca_cert: /etc/openstack_deploy/ssl/ca-chain.cert.pem | 09:35 |
| sakharkar | still it is failing with the error http://paste.openstack.org/show/805420/ | 09:35 |
| noonedeadpunk | oh, well, previously it was another error | 09:36 |
| sakharkar | noonedeadpunk: could you please let us know what could be the issue and changes required | 09:36 |
| noonedeadpunk | sakharkar: ok, so I think it's worth taking a look at haproxy config | 09:38 |
| jrosser | sakharkar: is this a self signed certificate (internal CA) or is it a certificate you have purchased from a real CA | 09:41 |
| sakharkar | jrosser: Its a self signed certificate | 09:41 |
| jrosser | ok, so there is no reason that your systems will trust this CA | 09:42 |
| jrosser | and i think that is the root cause of the trouble | 09:42 |
| sakharkar | jrosser: The same certificates works fine when used for Public endpoints only and fails with all endpoint on SSL/TLS | 09:43 |
| jrosser | what do you contact the public endpoint with? | 09:43 |
| jrosser | i.e, if you are using a browser for horizon for example, and you have imported the CA (or told the browser to trust the cert) then it will work from the point of view of the browser | 09:45 |
| jrosser | so the same sort of thing needs to be done for the internal services to trust your self-signed certificate when they contact the internal endpoint | 09:45 |
| jrosser | it is correct behaviour that the services will reject your self-signed certificate unless some provision has been made to install the CA into the system trust store | 09:46 |
| noonedeadpunk | this wouldn't cause `SSL exception connecting to` though? | 09:47 |
| noonedeadpunk | so it feels more like haproxy serves it as http endpoint? | 09:47 |
| noonedeadpunk | oh, wait | 09:48 |
| noonedeadpunk | yeah | 09:48 |
| noonedeadpunk | I looked too down the stack trace | 09:48 |
| jrosser | hmm, well i'm thinking `certificate verify failed` points to "there is a cert, but i don't trust it" | 09:48 |
| jrosser | though i could be wrong there | 09:48 |
| noonedeadpunk | yeah, you're right | 09:48 |
| jrosser | using wget will prove this very quickly | 09:48 |
| noonedeadpunk | sakharkar: I think you can set variables to make services not to check certificates validity | 09:49 |
| jrosser | sakharkar: for a cloud using a company CA rather than a public one, the most correct approach is to put the company CA certificate in the system trust store of all your hosts | 09:50 |
| sakharkar | jrosser: But when we try to curl the endpoint after adding the ca.crt to trusted it works fine for us | 09:50 |
| jrosser | right, but this is python | 09:50 |
| noonedeadpunk | ie - keystone_service_internaluri_insecure and keystone_service_adminuri_insecure to true | 09:50 |
| jrosser | so you need to tell python to use your CA as well | 09:50 |
| sakharkar | jrosser: we have added the entry haproxy_user_ssl_ca_cert: /etc/openstack_deploy/ssl/ca-chain.cert.pem | 09:51 |
| jrosser | the python clients connect to haproxy and they do not understand the certificate they find there | 09:52 |
| jrosser | that is becasue the python requests library uses a thing called the 'certifi' package which is a static bundle of CA certs | 09:52 |
| jrosser | certifi does not get extended *ever* when you add your own CA to the system trust store | 09:53 |
| jrosser | so i can totally understand curl working but not a python program | 09:53 |
| jrosser | you can change the CA bundle that the underlying python libraries use by setting slmething like this in /etc/environment (or ubuntu example) `REQUESTS_CA_BUNDLE="/etc/ssl/certs/ca-certificates.crt"` | 09:54 |
| jrosser | sakharkar: if you want a simple way to see if this is the issue then you can very quickly do this http://paste.openstack.org/show/805421/ | 10:00 |
| jrosser | replace with your internal https url of course | 10:00 |
| sakharkar | jrosser: Thank you..will try it out and let you know the output. | 10:01 |
| openstackgerrit | Merged openstack/openstack-ansible-galera_server master: Include galera_devel into main https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/791045 | 10:24 |
| openstackgerrit | Merged openstack/openstack-ansible-os_swift master: Do not collect gnocchi project ID https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/791250 | 10:36 |
| openstackgerrit | Merged openstack/openstack-ansible-os_ceilometer master: Remove deprecated options from config https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/791259 | 10:48 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_heat master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_heat/+/791716 | 10:48 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_ironic master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/791717 | 10:49 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_magnum master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/791718 | 10:50 |
| admin0 | morning | 10:55 |
| openstackgerrit | Merged openstack/openstack-ansible-os_gnocchi master: Switch gnocchi service name to service https://review.opendev.org/c/openstack/openstack-ansible-os_gnocchi/+/791254 | 10:58 |
| noonedeadpunk | o/ | 11:15 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_manila master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_manila/+/791722 | 11:22 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_masakari master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_masakari/+/791723 | 11:24 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_mistral master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_mistral/+/791725 | 11:28 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_murano master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_murano/+/791726 | 11:29 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_murano master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_murano/+/791726 | 11:32 |
| *** macz_ has joined #openstack-ansible | 11:36 | |
| *** macz_ has quit IRC | 11:40 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_octavia master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/791731 | 11:41 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_sahara master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_sahara/+/791732 | 11:42 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_senlin master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/791734 | 11:43 |
| openstackgerrit | Merged openstack/openstack-ansible master: Decrease manila tempest coverage https://review.opendev.org/c/openstack/openstack-ansible/+/791202 | 11:45 |
| *** macz_ has joined #openstack-ansible | 11:57 | |
| *** macz_ has quit IRC | 12:02 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_swift master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/791740 | 12:10 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_tacker master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_tacker/+/791741 | 12:11 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_zun master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_zun/+/791742 | 12:12 |
| *** rh-jlabarre has joined #openstack-ansible | 12:14 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_ceilometer master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/791700 | 12:16 |
| openstackgerrit | Merged openstack/openstack-ansible master: Add option to remove group from inventory https://review.opendev.org/c/openstack/openstack-ansible/+/791277 | 12:28 |
| *** macz_ has joined #openstack-ansible | 12:35 | |
| *** pcaruana has quit IRC | 12:37 | |
| *** macz_ has quit IRC | 12:40 | |
| *** pcaruana has joined #openstack-ansible | 12:42 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_nova master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/790037 | 12:43 |
| openstackgerrit | Merged openstack/openstack-ansible-os_adjutant master: Install mysql client libraries https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/777607 | 12:44 |
| *** mgariepy has joined #openstack-ansible | 12:59 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_keystone master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/790034 | 13:05 |
| openstackgerrit | Merged openstack/openstack-ansible-os_cinder master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/790035 | 13:09 |
| *** dave-mccowan has quit IRC | 13:13 | |
| *** dave-mccowan has joined #openstack-ansible | 13:16 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_glance master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/790006 | 13:22 |
| *** jamesdenton has joined #openstack-ansible | 13:27 | |
| *** jamesden_ has quit IRC | 13:30 | |
| *** spatel_ has joined #openstack-ansible | 13:46 | |
| *** spatel_ is now known as spatel | 13:46 | |
| admin0 | spatel, here ? | 13:48 |
| spatel | yes | 13:48 |
| admin0 | i was reading your ovn doc .. "make sure both vm01 and vm02 endup on two different compute nodes, if not then delete and re-create. :)" -- you can crate an anti-affinity rule | 13:49 |
| admin0 | which ensures the vms are always on diff hosts | 13:49 |
| admin0 | i am following your ovn build in my lab today | 13:49 |
| admin0 | how about ovn troubleshooting .. how is 1:1 NAT handled ? | 13:50 |
| mgariepy | you can migrate the vm after the creation also. | 13:50 |
| admin0 | how/where is 1:1 nat handled | 13:50 |
| spatel | Yes anti-affinity is good idea, i try to make it easy in this doc | 13:50 |
| spatel | what do you mean 1:1 NAT handled? compute nodes is your network node and your router to do NAT | 13:51 |
| admin0 | ignore that question :) | 13:51 |
| spatel | Like true DVR setup | 13:51 |
| admin0 | i was thinking something else | 13:51 |
| spatel | oh | 13:52 |
| admin0 | do you have it in prod or in use . | 13:52 |
| spatel | still doing testing on lab, i need to setup 3 node OVN controller to test all redundancy and troubleshooting of cluster failure | 13:52 |
| spatel | I don't think osa playbook provide OVN controller clustering, you need to do some hand work until playbook are ready | 13:53 |
| *** jamesden_ has joined #openstack-ansible | 14:10 | |
| *** pto_ has joined #openstack-ansible | 14:10 | |
| openstackgerrit | Jonathan Herlin proposed openstack/openstack-ansible-os_adjutant master: Remove incorrect horizon_post_install example https://review.opendev.org/c/openstack/openstack-ansible-os_adjutant/+/784420 | 14:13 |
| *** jamesdenton has quit IRC | 14:14 | |
| *** pto has quit IRC | 14:14 | |
| *** pto_ has quit IRC | 14:15 | |
| *** chandankumar is now known as raukadah | 14:16 | |
| openstackgerrit | Merged openstack/openstack-ansible-os_manila master: [goal] Deprecate the JSON formatted policy file https://review.opendev.org/c/openstack/openstack-ansible-os_manila/+/782244 | 14:16 |
| jrosser | spatel: i don't think anyone is looking at the OVN controller stuff, if you have patches it would be great | 14:23 |
| spatel | jrosser yes, soon i will have patch, I have build lab with 3 controller now going to start work on clustering part. | 14:24 |
| jrosser | awesome | 14:24 |
| admin0 | if a db already exists, does openstack add new users | 14:43 |
| admin0 | here is a use case | 14:43 |
| admin0 | i have one openstack cluster using a very very old osa-inspired custom ansible script .. its on linuxbridge and simple .. my thought is .. let me take just the database backup, and run the osa playbooks on top of it, so that i can have all running using that same database | 14:44 |
| admin0 | how feasible/possible is this ? | 14:44 |
| admin0 | the thing i have to do is delete the mysql.user entries, so that osa can add entries again based on generated passwords | 14:45 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_ceilometer master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/791700 | 14:49 |
| admin0 | how are you guys doing logging ? | 14:52 |
| admin0 | using beats ? any way integrated into osa ? | 14:52 |
| spatel | Beats is way to go.. | 14:53 |
| openstackgerrit | Merged openstack/openstack-ansible-os_neutron master: Use ansible_facts[] instead of fact variables https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/777650 | 14:56 |
| jonher | we are testing fluentd -> graylog and that seems to do the job too | 14:56 |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-os_magnum master: Add variables for rabbitmq ssl configuration https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/791718 | 14:57 |
| *** macz_ has joined #openstack-ansible | 15:06 | |
| *** mgariepy has quit IRC | 15:08 | |
| *** spatel has quit IRC | 15:30 | |
| *** spatel_ has joined #openstack-ansible | 15:31 | |
| *** spatel_ is now known as spatel | 15:31 | |
| *** dave-mccowan has quit IRC | 15:33 | |
| *** dave-mccowan has joined #openstack-ansible | 15:37 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-rabbitmq_server master: Add debian bullseye support https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/791769 | 15:37 |
| *** jawad_axd has quit IRC | 15:46 | |
| *** jawad_axd has joined #openstack-ansible | 15:46 | |
| jrosser | oh here we go again E: Failed to fetch https://packages.erlang-solutions.com/debian/dists/buster/contrib/binary-amd64/Packages.bz2 File has unexpected size (479447 != 479445). Mirror sync in progress? [IP: 99.84.39.78 443] | 15:46 |
| *** mgariepy has joined #openstack-ansible | 15:51 | |
| *** jawad_axd has quit IRC | 15:52 | |
| noonedeadpunk | doh:( | 15:54 |
| noonedeadpunk | btw had the same issue localy recently with apt-cacher-ng... | 15:55 |
| *** jawad_axd has joined #openstack-ansible | 16:17 | |
| openstackgerrit | Jonathan Rosser proposed openstack/openstack-ansible-rabbitmq_server master: Add debian bullseye support https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/791769 | 16:18 |
| *** gyee has joined #openstack-ansible | 16:44 | |
| *** jawad_axd has quit IRC | 16:50 | |
| jrosser | looks reasonable on bullseye now | 16:56 |
| jrosser | next patches should get past setup-infrastructure | 16:56 |
| *** andrewbonney has quit IRC | 17:46 | |
| *** jawad_axd has joined #openstack-ansible | 18:01 | |
| *** jawad_axd has quit IRC | 18:06 | |
| *** pto has joined #openstack-ansible | 18:27 | |
| *** pto has quit IRC | 18:27 | |
| *** pto has joined #openstack-ansible | 18:28 | |
| *** pto has quit IRC | 18:37 | |
| openstackgerrit | Merged openstack/ansible-config_template master: Remove references to unsupported operating systems https://review.opendev.org/c/openstack/ansible-config_template/+/780752 | 19:00 |
| *** spatel has quit IRC | 20:06 | |
| *** jbadiapa has quit IRC | 20:08 | |
| openstackgerrit | Merged openstack/openstack-ansible master: Change order of swift and gnocchi installation https://review.opendev.org/c/openstack/openstack-ansible/+/791261 | 20:52 |
| -openstackstatus- NOTICE: The Zuul service at zuul.opendev.org will be offline for a few minutes (starting now) in order for us to make some needed filesystem changes; if the outage lasts longer than anticipated we'll issue further notices | 21:31 | |
| *** macz_ has quit IRC | 23:32 | |
| *** tosky has quit IRC | 23:43 | |
Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!