| opendevreview | Merged openstack/openstack-ansible-os_cinder stable/xena: Enable recursion in combine() filter https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/824411 | 01:45 |
|---|---|---|
| opendevreview | Merged openstack/openstack-ansible-os_aodh stable/xena: Ensure libxml2 is installed on debian systems https://review.opendev.org/c/openstack/openstack-ansible-os_aodh/+/826378 | 02:07 |
| opendevreview | Merged openstack/openstack-ansible stable/wallaby: Bump OpenStack-Ansible Wallaby https://review.opendev.org/c/openstack/openstack-ansible/+/825395 | 02:29 |
| opendevreview | Merged openstack/openstack-ansible stable/xena: Bump OpenStack-Ansible Xena https://review.opendev.org/c/openstack/openstack-ansible/+/825391 | 02:40 |
| opendevreview | Merged openstack/openstack-ansible master: Bump OpenStack-Ansible master https://review.opendev.org/c/openstack/openstack-ansible/+/825390 | 03:09 |
| *** dmsimard6 is now known as dmsimard | 06:38 | |
| noonedeadpunk | prometheanfire: are you sure it's max_connections? | 08:13 |
| noonedeadpunk | as galera has several bugs regarding their threading, that makes cluster fall apart | 08:14 |
| jrosser | noonedeadpunk: related to that - https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/786381 | 08:41 |
| jrosser | if the connection limit is ever reached its totally bad for the loadbalancer | 08:41 |
| jrosser | which then makes it worse again with failover | 08:42 |
| noonedeadpunk | makes sense to me | 08:52 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-plugins master: Add ssh_keypairs role https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/825113 | 09:58 |
| opendevreview | Jonathan Rosser proposed openstack/ansible-role-systemd_service master: Allow StandardOutput to be set for a systemd service https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/826602 | 10:16 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-galera_server master: Convert xinetd clustercheck to systemd socket service https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/824042 | 10:17 |
| *** dviroel|afk is now known as dviroel | 11:20 | |
| *** sshnaidm|afk is now known as sshnaidm | 11:35 | |
| opendevreview | Jonathan Rosser proposed openstack/ansible-role-systemd_service master: Allow StandardOutput to be set for a systemd service https://review.opendev.org/c/openstack/ansible-role-systemd_service/+/826602 | 12:13 |
| opendevreview | Merged openstack/openstack-ansible stable/xena: Remove CI jobs for centos-8 https://review.opendev.org/c/openstack/openstack-ansible/+/824567 | 13:02 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_tempest stable/victoria: Remove tempestconf centos-8 job https://review.opendev.org/c/openstack/openstack-ansible-os_tempest/+/826697 | 15:10 |
| prometheanfire | noonedeadpunk: yep, I'm sure, 200 was too little | 15:15 |
| prometheanfire | 16R 8C and 128R 24C infra nodes both seemed to get that | 15:16 |
| prometheanfire | jrosser: ya, that's kinda what I'm seeing | 15:16 |
| jrosser | well, for now you can up the connection limit | 15:17 |
| jrosser | but it is basically broken if you ever reach that | 15:18 |
| prometheanfire | 800 seems to be working, but good to know it's known behavior | 15:19 |
| prometheanfire | sub'd to the review | 15:19 |
| jrosser | it's kind of two sides problem - config on the clients needs to do something sensible with the connections that are made | 15:20 |
| jrosser | and galera server should not shoot its own foot when max connections is reached | 15:21 |
| prometheanfire | heh, bossman was complaining about how many connections to the DB are being made (grumbles in greybeard hypertuning) | 15:22 |
| jrosser | you might want to look at these https://review.opendev.org/q/topic:db-pooling | 15:24 |
| jrosser | and the releasenote https://review.opendev.org/c/openstack/openstack-ansible/+/819424 | 15:26 |
| prometheanfire | I think those hit xena | 15:26 |
| prometheanfire | ya, the release note is what I'm reading | 15:26 |
| jrosser | they were cherry picked but you'd need to look if theres a point release that pulls them in | 15:27 |
| prometheanfire | nova still has max_overflow = 50 | 15:27 |
| prometheanfire | so, looks like it, I'll look in a sec | 15:27 |
| prometheanfire | coffee calling | 15:27 |
| prometheanfire | confirmed, made the xena tag | 15:28 |
| jrosser | i think the thing now is that there is one place you can globally set all that stuff | 15:28 |
| jrosser | but there is an important relation to what happens at a keepalived failover | 15:29 |
| prometheanfire | ya, able to set openstack wide defaults, then override with role level stuff if needed | 15:29 |
| prometheanfire | yep, doubling | 15:29 |
| jrosser | indeed | 15:29 |
| opendevreview | Merged openstack/openstack-ansible stable/wallaby: Fix definition of ssl_protocol https://review.opendev.org/c/openstack/openstack-ansible/+/826382 | 15:31 |
| prometheanfire | hopefully that first galera-server review fixes the bouncing around (doubling or not) | 15:31 |
| opendevreview | Andrew Bonney proposed openstack/openstack-ansible-galera_server master: Listen on an additional port for monitoring/diagnostic purposes https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/786381 | 15:36 |
| prometheanfire | :D | 15:37 |
| andrewbonney | I'll bump it up my to do list :) | 15:37 |
| opendevreview | James Denton proposed openstack/openstack-ansible-ops master: Update MNAIO for Focal https://review.opendev.org/c/openstack/openstack-ansible-ops/+/824486 | 15:39 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-plugins master: Add ssh_keypairs role https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/825113 | 15:44 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-plugins master: Add ssh_keypairs role https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/825113 | 15:45 |
| opendevreview | Merged openstack/openstack-ansible stable/xena: Fix definition of ssl_protocol https://review.opendev.org/c/openstack/openstack-ansible/+/826381 | 15:51 |
| opendevreview | Merged openstack/openstack-ansible stable/victoria: Fix definition of ssl_protocol https://review.opendev.org/c/openstack/openstack-ansible/+/826383 | 15:51 |
| prometheanfire | investigating, but uefi used to work... on victoria, nova.exception.UEFINotSupported: UEFI is not supported | 15:54 |
| spatel | prometheanfire did you set machine type in flavor i think only q35 supported | 15:58 |
| spatel | i was messing with that last week | 15:58 |
| prometheanfire | it was via the image iirc | 16:00 |
| prometheanfire | --property hw_firmware_type=uefi | 16:00 |
| prometheanfire | I wonder if it's because the osbpo repo for buster doesn't go to xena | 16:07 |
| opendevreview | Merged openstack/openstack-ansible master: Bootstrap lxc_net mtu for gate https://review.opendev.org/c/openstack/openstack-ansible/+/557484 | 16:09 |
| opendevreview | Merged openstack/openstack-ansible stable/xena: Gather additional facts for haproxy playbook https://review.opendev.org/c/openstack/openstack-ansible/+/826561 | 16:09 |
| opendevreview | Merged openstack/openstack-ansible stable/wallaby: Gather additional facts for haproxy playbook https://review.opendev.org/c/openstack/openstack-ansible/+/826562 | 16:09 |
| *** dviroel is now known as dviroel|lunch | 16:13 | |
| spatel | prometheanfire may be issue with OVMF_CODE.fd path | 16:25 |
| spatel | noonedeadpunk I am half way in my upgrade, as soon as i upgrade rabbitMQ from W->X i found all infra nodes neutron-agent die and failed because can't talk to rabbitmq. I have manually restarted to bring them back. Not saying this is major issue but just noticed this | 16:28 |
| noonedeadpunk | well, I haven't spotted anything like that. But I guess I can recall someone having same issue... Oh, well, there was also issue in oslo that andrewbonney spotted, that got fixed with requirements bump | 16:33 |
| noonedeadpunk | spatel: https://bugs.launchpad.net/oslo.messaging/+bug/1949964 | 16:34 |
| prometheanfire | spatel: I didn't hit that in my w->x upgrade | 16:34 |
| spatel | hmm | 16:35 |
| spatel | noonedeadpunk assuming that bug patch yet to merge in 24.0.0 correct? | 16:36 |
| spatel | https://review.opendev.org/c/openstack/requirements/+/823104 | 16:37 |
| spatel | folks are talking about wallaby issue but in my case i am already running wallaby and moving to Xena | 16:39 |
| noonedeadpunk | it's both in w and v and 24.0.0 | 16:52 |
| noonedeadpunk | just rabbit restart could trigger issue potentially | 16:52 |
| noonedeadpunk | as services are still on w | 16:52 |
| noonedeadpunk | but not sure | 16:53 |
| noonedeadpunk | oh, not on v, sorry ) | 16:53 |
| jrosser | that amqp thing that needed the requirements bump leaks fd on the compute nodes | 16:59 |
| spatel | 24.0.0 still using amqp 5.0.6 so yes we need bump to use 5.0.8 in next xena tag | 17:21 |
| spatel | jrosser one more thing i noticed that setup-host.yml updating /etc/openstack-release file during upgrade but technically i didn't upgrade anything yet (except infra nodes) | 17:22 |
| spatel | shouldn't /etc/openstack-release should get update based on roles you are running? for example when i run nova role then end of that roles it should update /etc/openstack-release file. | 17:23 |
| jrosser | the release is the release of openstack-ansible | 17:24 |
| jrosser | so it contains something like DISTRIB_RELEASE="24.0.0.0rc1" | 17:24 |
| spatel | DISTRIB_CODENAME="Xena" | 17:24 |
| jrosser | i think it would be hard to do anything different | 17:25 |
| jrosser | as nothing stops you mixing releases, like it is common to use master magnum on an otherwise stable branch deploy | 17:25 |
| spatel | You are correct, it would be difficult with BM deployment :) | 17:26 |
| spatel | anyway ignore :) | 17:26 |
| jrosser | ok :) | 17:26 |
| *** dviroel|lunch is now known as dviroel | 17:26 | |
| spatel | look like i had lots of coffee today.. hehe.. thinking too much | 17:26 |
| jrosser | so do we run out of memory here? https://zuul.opendev.org/t/openstack/build/40f34af251424c82bf1e83d05d8b1620/log/logs/host/nova-conductor.service.journal-09-22-10.log.txt#2482 | 17:31 |
| jrosser | all of the centos-8-stream jobs fail on that patch | 17:31 |
| prometheanfire | so, I think my uefi boot issues are because ovmf is not installed from backports on buster | 17:52 |
| prometheanfire | installing from backports worked | 17:52 |
| prometheanfire | patches incoming I suppose :P | 17:52 |
| jrosser | prometheanfire: https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_install.yml#L28-L43 | 17:55 |
| prometheanfire | jrosser: I was looking at https://github.com/openstack/openstack-ansible-os_nova/blob/f7cb4f60e7d81da5f6886683c5a92712ac24365e/vars/debian.yml#L90 | 17:55 |
| jrosser | yeah, so it would be good to know that the backports repo is available without any more config | 17:56 |
| prometheanfire | out of scope (that list is already there) :P | 17:56 |
| jrosser | and that updating the pin (which is what that list does) works out as expected | 17:56 |
| prometheanfire | but I agree, it is annoying when it doesn't exist | 17:56 |
| jrosser | well thats why i ask | 17:57 |
| prometheanfire | well, for supported versions (buster and bullseye) they both have backports now | 17:57 |
| jrosser | i'm not sure if you are saying "it doesnt exist" means that the backports repo was not set up automatically | 17:57 |
| jrosser | or if you mean that the package you want does not exist in that list | 17:58 |
| prometheanfire | both I suppose, I know it exists (package and repo both) for buster at least | 17:58 |
| opendevreview | Merged openstack/openstack-ansible stable/victoria: Bump OpenStack-Ansible Victoria https://review.opendev.org/c/openstack/openstack-ansible/+/825397 | 18:02 |
| jrosser | the setup there is a little strange | 18:02 |
| jrosser | in that os_nova manages the pins for the backports repo, but takes no steps to ensure that it is present | 18:02 |
| jrosser | but if we enabled the backports repo in openstack_hosts, it would be present everywhere, with no pins | 18:02 |
| jrosser | and that might not be what we want | 18:03 |
| jrosser | prometheanfire: this kind of works out for CI because i think the backports repo is enabled on the CI node https://7c50b6b0ae2183e4c536-aac042a0844b1c7bd58db620c0fb1e04.ssl.cf1.rackcdn.com/826379/1/check/openstack-ansible-deploy-aio_metal-debian-buster/74db0ab/logs/etc/host/apt/sources.list.d/ | 18:09 |
| prometheanfire | lolol | 18:12 |
| jrosser | looking at the code though this is a special case for buster | 18:13 |
| jrosser | OSA doesnt generally manage the repos for your underlying distro | 18:13 |
| *** sshnaidm is now known as sshnaidm|afk | 18:13 | |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_nova master: Remove apt pinning task for debian buster https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/826759 | 18:17 |
| *** dviroel is now known as dviroel|out | 20:20 | |
| spatel | jrosser i got this error related PKI and i have noticed i don't have that file. why nova need SSL cert? - https://paste.opendev.org/show/812413/ | 20:51 |
| jrosser | it should all be in the release notes | 20:53 |
| jrosser | there is now tls for live migration | 20:53 |
| jrosser | and tls between the compute node and novncproxy | 20:53 |
| jrosser | the nova role should can the PKI role and generate the certificates | 20:54 |
| jrosser | *call the | 20:54 |
| spatel | hmm | 20:54 |
| spatel | do you think this is because i ignore - openstack-ansible certificate-authority.yml | 20:55 |
| jrosser | I don’t think so | 20:55 |
| spatel | Nova should create certificate for node so i don't think its related to certificate-authority.yml playbook | 20:55 |
| jrosser | correct, that just creates the overall CA | 20:56 |
| spatel | something went wrong somewhere.. | 20:57 |
| jrosser | so | 20:58 |
| jrosser | there are two steps | 20:59 |
| jrosser | first, it makes some certs on the deploy host from this list https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/main.yml#L161 | 20:59 |
| jrosser | second, it installs them to the required places with this list https://github.com/openstack/openstack-ansible-os_nova/blob/master/tasks/main.yml#L162 | 21:00 |
| jrosser | so if you what it tries to install is not there, then we have an issue between those two steps | 21:00 |
| spatel | here is the all step, look like it skip create certificate - https://paste.opendev.org/show/812414/ | 21:00 |
| jrosser | probably becasue it thinks it is already done | 21:01 |
| jrosser | Create the CSR for nova_os-infra-1-nova-api-container-2482b57a-client -> OK | 21:02 |
| jrosser | so the CSR exists from some previous run | 21:02 |
| jrosser | then next task is only done one time when the CSR task is changed https://github.com/openstack/ansible-role-pki/blob/master/tasks/standalone/create_cert.yml#L61 | 21:03 |
| spatel | here are all the steps nova did - https://paste.opendev.org/show/812415/ | 21:05 |
| spatel | TASK [Create and install SSL certificates for compute hosts] - didn't run | 21:06 |
| admin16 | i installed 24.0.0 in a new cluster today .. it went in OK and all working without issues .. | 21:06 |
| admin16 | have not done an upgrade from 23.2.0 -> 24.0 yet | 21:06 |
| admin16 | maybe this is where the issues are coming ? | 21:06 |
| spatel | i am doing 23.1.0 - > 24.0.0 upgrade | 21:07 |
| jrosser | well hold on | 21:07 |
| jrosser | it's this thats missing /etc/openstack_deploy/pki/roots/VivoxIntermediate/certs/VivoxIntermediate-chain.crt | 21:07 |
| jrosser | see that its in the "roots" directory - this is a CA cert | 21:07 |
| spatel | here is the tree - https://paste.opendev.org/show/812416/ | 21:08 |
| spatel | hmm | 21:09 |
| spatel | why rabbitmq didn't complain? | 21:10 |
| jrosser | you maybe fail becasue of not running the certificate authority playbook | 21:11 |
| jrosser | these tasks should generate the CA chain https://github.com/openstack/ansible-role-pki/blob/master/tasks/standalone/create_ca.yml#L128-L144 | 21:11 |
| jrosser | rabbitmq has its way of setting up SSL | 21:11 |
| spatel | hmm | 21:11 |
| jrosser | libvirt is different and messy | 21:11 |
| jrosser | and requires the root and intermediate to be combined in the same file | 21:12 |
| jrosser | most things want the server cert and the intermediate | 21:12 |
| jrosser | but libvirt is just wierd for some reason | 21:12 |
| spatel | is there a way to say don't use SSL for libvirt ? (anyway i am not using live vm migration feature because of SRIOV) | 21:13 |
| jrosser | so it is probably the case that in 24.x.y you needs the -chain CA cert which would not have been created in a 23.x.y install, becasue we did no libvirt ssl there | 21:13 |
| jrosser | please dont | 21:13 |
| spatel | ok | 21:14 |
| jrosser | you need it for consoles and stuff | 21:14 |
| spatel | let me run CA auth playbook | 21:14 |
| jrosser | that would be great | 21:15 |
| jrosser | it should hopefully create that missing file | 21:15 |
| spatel | jrosser but one more thing i do have - /etc/openstack_deploy/pki/roots/VivoxIntermediate/certs/VivoxIntermediate.crt | 21:17 |
| spatel | but playbook looking for VivoxIntermediate-chain.crt file | 21:17 |
| spatel | why its adding -chain in file? | 21:18 |
| jrosser | /o\ | 21:18 |
| jrosser | read this carefully :) https://github.com/openstack/ansible-role-pki/blob/master/tasks/standalone/create_ca.yml#L128-L144 | 21:18 |
| opendevreview | James Denton proposed openstack/openstack-ansible-ops master: Update MNAIO for Focal https://review.opendev.org/c/openstack/openstack-ansible-ops/+/824486 | 21:18 |
| jrosser | it concatenates the root and the intermediate into one file | 21:19 |
| jrosser | `cat {{ cert_path }} {{ ownca_path }} > {{ cert_chain_path }}` | 21:19 |
| spatel | ohhh | 21:19 |
| jrosser | that is necessary, becasue that is what libvirt wants | 21:20 |
| jrosser | it needs the root and the intermediate in the same file, for $unknown-reason | 21:20 |
| spatel | :) - this step is required - openstack-ansible certificate-authority.yml | 21:21 |
| spatel | i can see chain now :) | 21:21 |
| jrosser | awesome! | 21:21 |
| jrosser | i kind of explained why yesterday | 21:22 |
| jrosser | the major upgrade instructions tell you to do this first `openstack-ansible setup-hosts.yml --limit '!galera_all:!rabbitmq_all' -e package_state=latest` | 21:23 |
| spatel | i thought it will create brand new CA certificate again so ignore that step | 21:23 |
| jrosser | ooohhhh no | 21:23 |
| jrosser | that would be a big disaster | 21:23 |
| spatel | yes that is why i was confused and ask why are we Regenerating CA during upgrade process | 21:24 |
| jrosser | there is a variable to do that specifically https://github.com/openstack/ansible-role-pki/blob/master/defaults/main.yml#L67-L68 | 21:24 |
| jrosser | well you make a good point, that is really bad wording | 21:25 |
| spatel | Ok in-short its saying to run openstack-ansible certificate-authority.yml | 21:25 |
| jrosser | lets fix that | 21:25 |
| spatel | +1 wording is wrong here - To generate new CA, you will need to run the following command: | 21:25 |
| jrosser | regenerating the CA will destroy the deployment | 21:26 |
| jrosser | until you re-run all the playbooks completely | 21:26 |
| spatel | or better we add - If you already have CA then it will ignore | 21:27 |
| jrosser | it's there for a good reason, the state of the CA needs to be up to date | 21:27 |
| jrosser | like that missing chain file | 21:27 |
| spatel | yes.. | 21:27 |
| spatel | because of wording i got scared and ignore but look like its safe to run (so better should change wording saying Just run this command to cert related thing or whatever is best) | 21:29 |
| spatel | what will happen after 10 year when this CA get expire? | 21:30 |
| jrosser | well, when you override the default CA for the initial deployment you can set the duration | 21:31 |
| spatel | default is 10 year correct? | 21:32 |
| jrosser | there is no process yet for rolling the CA cert to a new one | 21:32 |
| jrosser | so ideally you make the root CA last a very long time | 21:32 |
| jrosser | and the intermediate is much easier to rotate | 21:33 |
| spatel | I forgot to put end date so assuming its 10 year default for self-sign but if i want to change this date today then its safe to change date/time and re-create CA ? | 21:34 |
| jrosser | possibly, you'd have to try | 21:34 |
| spatel | hmm | 21:35 |
| jrosser | but you will certainly break things if you use pki_regen_ca | 21:35 |
| spatel | hmm | 21:35 |
| jrosser | i would *guess* that re-signing the same private key with a new expiry date would work, but that is total guesswork | 21:36 |
| spatel | i can totally try that and see in lab | 21:36 |
| jrosser | take copies of the existing stuff | 21:36 |
| spatel | yep | 21:37 |
| spatel | rabbitMQ has own CA etc.. correct so it won't come under that requirement | 21:37 |
| jrosser | rabbitmq had it's own for a very long time now in OSA | 21:38 |
| jrosser | but this was the first thing ported to the PKI role https://github.com/openstack/openstack-ansible-rabbitmq_server/blob/master/tasks/main.yml#L47-L61 | 21:40 |
| spatel | its 10 year i just checked | 21:40 |
| jrosser | i am looking at what pki_regen_ca actually does | 21:40 |
| jrosser | it seems to not touch the private key | 21:41 |
| jrosser | it will regenerate the CSR with whatever settings you have and then resign | 21:41 |
| spatel | what else will break in current scenario, mysql and nova only two components tie up with pki correct? | 21:48 |
| jrosser | rabbitmq | 21:48 |
| jrosser | keep the old files, you can undo anything bad if you keep them | 21:49 |
| spatel | yes | 21:49 |
| spatel | I will keep backup :) | 21:49 |
| jrosser | openstack-hosts role needs to be run if you update the CA cert | 21:49 |
| jrosser | thats where it gets put into the trust store of all-the-things | 21:49 |
| spatel | Ok | 21:52 |
| spatel | How does third-party providerd certs will work with this process? | 21:52 |
| spatel | I don't think we can use that CA/cert :) | 21:53 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: Clarify major upgrade documentation for updating internal CA https://review.opendev.org/c/openstack/openstack-ansible/+/826782 | 21:53 |
| jrosser | the CA run by OSA is intended to be internal to the deployment | 21:53 |
| jrosser | its so that the internal components can talk over TLS | 21:53 |
| spatel | yes | 21:54 |
| jrosser | but it also happens that with no overrides, it is also used for haproxy | 21:54 |
| jrosser | unless you make some extra settings | 21:54 |
| jrosser | haproxy actually is a complicated example | 21:55 |
| spatel | In my case i have F5 so do i need to install certificate in F5 in advance? | 21:55 |
| spatel | Does this pki required by LB or not? | 21:56 |
| jrosser | lets concentrate on haproxy for a moment | 21:57 |
| jrosser | there was always a variable like this https://github.com/openstack/openstack-ansible-haproxy_server/blob/master/doc/source/configure-haproxy.rst#securing-haproxy-communication-with-ssl-certificates | 21:57 |
| jrosser | where you could supply the path to your own cert and key | 21:57 |
| jrosser | and those vars are still valid, and if they are set then the PKI role will not be used for making the external VIP certificate | 21:58 |
| jrosser | for the case of using an F5, you would do the same thing as you did before for the external IP | 21:58 |
| jrosser | however, we are starting to also support https now on the internal VIP | 21:59 |
| jrosser | and probably the best thing to do there is to have the PKI role generate an internal cert/key for you | 21:59 |
| spatel | in that case i have to install self-sign certificate on F5 + CA too | 21:59 |
| jrosser | and then manually install that to the F5 | 21:59 |
| jrosser | there is already a hook for you to do this https://github.com/openstack/openstack-ansible/blob/master/playbooks/certificate-generate.yml | 22:00 |
| spatel | Do i need to do anything currently in F5 when upgrade from W -> X ? | 22:01 |
| jrosser | if you leave the internal VIP as http, nothing changes | 22:01 |
| jrosser | and if you are doing an upgrade of an existing deployment, you should leave it as http | 22:01 |
| spatel | cool! i have no plan to turn that on anytime soon | 22:01 |
| jrosser | anyway, playbooks/certificate-generate.yml is worth knowing about | 22:02 |
| spatel | I believe default is http correct? | 22:02 |
| jrosser | if you have some other service that needs a cert generated from the OSA CA then that playbook can make whatever you need | 22:03 |
| spatel | in my case F5 correct? | 22:03 |
| jrosser | if you wanted to do the internal VIP | 22:04 |
| spatel | Yes i can test that out in lab sure.. | 22:04 |
| jrosser | it creates them but doesnt install them anywher | 22:04 |
| spatel | yes i have to do that manually correct | 22:04 |
| jrosser | make any variables you like with the prefix user_pki_certificates_ | 22:04 |
| jrosser | it's run as part of setup-hosts | 22:05 |
| jrosser | but you can do it anytime, it doesnt do anything except create the certs on the deploy host | 22:05 |
| spatel | good to know and worth trying | 22:06 |
| spatel | my br-mgmt is not routable so kind of secure | 22:06 |
| spatel | hope soon we have good doc about PKI bits and bytes so easy to understand and use some of cool stuff | 22:08 |
| jrosser | https://docs.openstack.org/openstack-ansible/latest/user/security/ssl-certificates.html ? | 22:11 |
| jrosser | if you think there is something missing here please say | 22:12 |
| spatel | :) oh i didn't see that | 22:13 |
| spatel | Finally my upgrade about to finish and all looks good.. | 22:16 |
| spatel | Thank you so much for your help on time :) | 22:18 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible master: Clarify the difference between generating and regenerating certificates https://review.opendev.org/c/openstack/openstack-ansible/+/826786 | 22:20 |
| jrosser | no problem - it is good to get new things like the TLS stuff properly tested | 22:20 |
| jrosser | all deployments are different in some ways and the problems only appear when we kick the tyres a but | 22:21 |
| jrosser | *bit | 22:21 |
| jrosser | if you have some notes about how to extend the life of the root CA that would be useful | 22:21 |
| spatel | I will let you know after try that out.. sure will share with you | 22:29 |
| spatel | Gotta go!! good night | 22:31 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!