Tuesday, 2022-02-08

« Monday, 2022-02-07 Index Wednesday, 2022-02-09 »
jrossernoonedeadpunk: do you have a better idea for filtering these zulul repos? https://paste.opendev.org/show/812575/09:05
jrosser*zuul09:05
noonedeadpunkmornings)09:10
* noonedeadpunk needs some coffee first...09:11
noonedeadpunkisn't it easier just to move zj_repos to role defaults through vars like we do?09:13
noonedeadpunkthen it should be easily overridable?09:13
jrosserrather unfortunately the roles are designed kind of different to ours09:14
jrosserlike OS specific tasks files which include the repo lists09:14
noonedeadpunkBut they still have https://opendev.org/zuul/zuul-jobs/src/branch/master/roles/configure-mirrors/vars/CentOS.yaml ?09:15
noonedeadpunkit's probaly more question how maintainers ready to remove that complexity from tasks and leave jsut vars :)09:15
noonedeadpunkas if you check diff for centos tasks, they are quite same...09:16
noonedeadpunkbut dunno...09:17
noonedeadpunkmaybe you're right09:18
noonedeadpunkit's just hacky a bit09:18
jrossermaybe would end up just rewriting the whole thing, even the .j2 templates are all pretty identical09:20
jrosserwhich really does defeat the point of templates09:20
noonedeadpunkwell it looks like if we want to make it somehow adjustable, we will indeed have to re-work it. but for me it doesn't really make sense to hardcode such things in common zuul jobs...09:25
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/xena: Ensure that the legacy network-scripts package is present  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82823509:27
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/wallaby: Ensure that the legacy network-scripts package is present  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82823609:28
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/victoria: Ensure that the legacy network-scripts package is present  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82823709:28
jrosserperhaps there is a middle ground without rewriting the whole thing09:34
jrosserlike you say put the data in vars and override using defaults09:34
jrossernoonedeadpunk: actually i think overrides doesnt work09:52
jrosserwell, what i mean is we'd need to make OS specific versions of our base job with different overrides for the mirrors to use09:53
noonedeadpunkoh, well...09:53
noonedeadpunkwe can't use var-files there I believe indeed...09:53
noonedeadpunkdamn09:54
jrosserit's really messy09:54
noonedeadpunkthen likely we jsut need to continue messing up in https://opendev.org/openstack/openstack-ansible/src/branch/master/zuul.d/playbooks/pre-gate-cleanup.yml09:55
jrosserfor example in 8-stream PowerTools is added, but in 9-stream crb is not09:56
noonedeadpunkthankfully, for centos you can remove repo via it's name09:57
noonedeadpunkfor debian it's much worse as you need to provide exact url iirc09:58
jrosserwith yum_repository?09:58
noonedeadpunkyep09:58
jrosserok let me hack something up09:58
*** dviroel|out is now known as dviroel|ruck10:05
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Remove unwanted repositories installed with the zuul configure-mirrors role  https://review.opendev.org/c/openstack/openstack-ansible/+/82826710:08
jrosserthis is interesting https://review.opendev.org/c/openstack/octavia/+/80595510:29
noonedeadpunkhuh, yes, we might want to implement this as well?10:32
noonedeadpunkas sounds like good idea10:33
noonedeadpunkfrom other side I haven't seen any issues without this10:33
noonedeadpunk`member with an ERROR operating_status may be updated to ONLINE after updating a load balancer` > this kind of frighten me10:35
jrosseri wonder if we ever reload10:35
jrosseror just restart10:35
noonedeadpunkwe do https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/handlers/main.yml#L4910:38
noonedeadpunkactually we only reload...10:39
noonedeadpunkwhat I'd really love to have is https://review.opendev.org/c/openstack/octavia/+/558962 but dont have time to work properly on that (10:46
noonedeadpunkas well as some bgp support for instance as keepalived replacement...10:46
jrosserfor the osa loadbalancer?10:52
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: WIP - Add support for running on Rocky Linux  https://review.opendev.org/c/openstack/openstack-ansible/+/82357310:59
noonedeadpunkfor octavia :)11:35
noonedeadpunkbut maybe for osa loadbalancer as well...11:35
noonedeadpunkAs we want to have a controller per AZ which likely won't have l3 connection11:36
jrosserit would be great to do for radosgw as i have some gigantic spec haproxy boxes running active/standby there which feels wasteful11:40
admin1hi jrosser, thank you for replying on the other channel .. let me pastebin all my configs and versions 11:52
jrossertbh it feels like permissions11:54
noonedeadpunkoh yes. for rgw it's also the case for sure12:04
jrosserhttps://blog.plessis.info/blog/2020/02/11/haproxy-exabgp.html12:08
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-repo_server master: Use ssh_keypairs role to generate keys for repo sync  https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/82710012:16
noonedeadpunkoh, yes, that looks relevant to what we're looking for :)12:16
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_nova master: Use ssh_keypairs role to generate cold migration ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/82530612:17
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-plugins master: Add ssh_keypairs role  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/82511312:27
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Use ssh_keypairs role to generate fernet sync ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/82709012:33
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Create ssh certificate authority  https://review.opendev.org/c/openstack/openstack-ansible/+/82529212:35
opendevreviewBhagyashri Shewale proposed openstack/ansible-config_template master: Move zuul jobs layout to centos9 only for master branch  https://review.opendev.org/c/openstack/ansible-config_template/+/82829512:35
admin1hi jrosser, error message and relevant config info here: https://gist.githubusercontent.com/a1git/78761a5346aef2e5db732b0c838b72ff/raw/72fbb5a60ee6a10d3fa9bb0a4bdf2f0ce115725e/gistfile1.txt12:39
admin1tag 24.0.1 and ceph-pacific ( deployed using ceph-ansible) 12:39
jrosserwell, `swift list` is working12:41
admin1via horizon, when i click, it logs me out immediately 12:42
jrosserhave you tried `swift list --debug`12:42
jrosseri don't have /swift/ anywhere in the urls12:44
noonedeadpunkwe have /swift to be able to have S3 apis enabled12:53
noonedeadpunkotherwise rgw will jsut reject to start if both swift and s3 enabled and swift not suffixed12:54
jrosserthe deployment i have here is kind of complicated13:03
jrosserwe've got 'internal' rgw serving just swift that horizon uses13:04
jrosserhowever, thats not realy related, as this all passes in ceph ci jobs for osa13:05
jrosseradmin1: you've pretty much just got to enable debug and step through all the things13:05
jrosserforget horizon until you get the CLI working13:05
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Remove unwanted repositories installed with the zuul configure-mirrors role  https://review.opendev.org/c/openstack/openstack-ansible/+/82826713:36
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Remove unwanted repositories installed with the zuul configure-mirrors role  https://review.opendev.org/c/openstack/openstack-ansible/+/82826713:41
noonedeadpunkyeah, I guess lineinfile is most simple thing13:49
* noonedeadpunk trying to understand why used apt_repository for that13:49
jrosserfiguring out the repo name seems really tricky13:50
jrossername / url13:50
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-repo_server master: Use ssh_keypairs role to generate keys for repo sync  https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/82710013:55
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Use ssh_keypairs role to generate fernet sync ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/82709013:55
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-openstack_hosts stable/victoria: Assume centos version is at least 8.3  https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/82834614:18
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/victoria: Ensure that the legacy network-scripts package is present  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82823714:19
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/wallaby: Replace CentOS 8 with Stream jobs  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82796614:25
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-lxc_hosts stable/xena: Replace CentOS 8 with Stream jobs  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82809514:26
Guest2040For anyone who was in Berlin last time, looks like the conference center is near the Hofbrau where we had the team dinner14:34
Guest2040Hrm...14:36
*** Guest2040 is now known as spotz14:37
spotzThat's better:)14:37
*** akaha|rover is now known as akahat|dinner14:55
* noonedeadpunk missed team dinner last time15:01
noonedeadpunk(or was not invited yet :D)15:01
noonedeadpunk#startmeeting openstack_ansible_meeting15:01
opendevmeetMeeting started Tue Feb  8 15:01:58 2022 UTC and is due to finish in 60 minutes.  The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot.15:01
opendevmeetUseful Commands: #action #agreed #help #info #idea #link #topic #startvote.15:01
opendevmeetThe meeting name has been set to 'openstack_ansible_meeting'15:01
noonedeadpunk#topic rollcall15:02
noonedeadpunko/15:02
damiandabrowski[m]hey guys! sorry I wasn't very active lately, performing distribution upgrades in several regions during Q115:03
damiandabrowski[m]but i'll try to contribute as much as I can ;) things should get better in Q215:04
noonedeadpunkhopefully :)15:05
noonedeadpunkso15:05
noonedeadpunk#topic bug triage15:05
noonedeadpunk#link https://bugs.launchpad.net/openstack-ansible/+bug/196017515:06
noonedeadpunkObviously our doc is broken.15:06
noonedeadpunkQuestion is - how we want to fix that?15:06
noonedeadpunkWe can just update the doc and say you should use like cluster_network: "{{ (container_networks['storage_address']['address'] ~ '/' ~ container_networks['storage_address']['netmask']) | ansible.netcommon.ipaddr('network/prefix') }}"15:06
noonedeadpunkwhich is kind of... meh...15:07
noonedeadpunkwell, for monitor address we can jsut avoid monitor_address_block and replace with monitor_address15:08
jrossero/ hello15:08
noonedeadpunkbut for cluster_network we still need network15:08
damiandabrowski[m]hmm, isn't this bug report about https://bugs.launchpad.net/openstack-ansible/+bug/196017515:10
noonedeadpunkso I was thinking if we should add cidr_networks as var somehow... or just add network to container_network stanza?15:10
noonedeadpunkdamiandabrowski[m]: yeah, I literally mentioned it 6 messages before :p15:10
damiandabrowski[m]https://review.opendev.org/c/openstack/openstack-ansible/+/82379615:10
damiandabrowski[m]sorry, wrong link15:10
*** dviroel|ruck is now known as dviroel|ruck|lunch15:11
jrossercidr_networks can get complex15:11
jrosserlook at the L3 pods example15:12
NeilHanlon👋hey folks, am around. and thank you again jrosser if i didn't say it yesterday for your time looking at rocky with me15:12
jrosserNeilHanlon: hi there - i amended your patch with the ansible path btw15:12
NeilHanlonoh, thank you :) 15:12
jrossernoonedeadpunk: does this help with finding the ceph ip? https://github.com/openstack/openstack-ansible/blob/master/playbooks/common-tasks/dynamic-address-fact.yml15:15
jrosserthough it wants the cidr though i guess, so not really15:16
noonedeadpunkdamiandabrowski[m]: huh15:16
noonedeadpunkshould we jsut backport it then and ask user to test out?15:17
jrosserseems we should have backport that patch anyway?15:18
damiandabrowski[m]yeah, i think we should15:19
noonedeadpunkjrosser: yes, indeed we need cidr there...15:22
noonedeadpunkand I agree that making cidr_networks will likely be tricky15:22
jrosseri'm not sure i see value in bringing it into accessible vars really15:23
noonedeadpunkbut considering we have cidr_networks in docs that makes me think there was there one day15:23
noonedeadpunkbut agree. we have container networks defined there15:24
noonedeadpunkso maybe jsut try to add cidr as an element?15:24
jrosseryes, or maybe the ceph user_variables example was just always wrong15:24
noonedeadpunkI can't reject such possibility :)15:24
jrosserthis also ignores that i think the ceph AIO networks are really all scrambled up too15:25
noonedeadpunkoh yes, storage network just not used in aio15:25
noonedeadpunkbut that's different topic :)15:26
jrosserindeed15:26
noonedeadpunk(we should fix it yeah)15:26
jrossernext bug? :)15:26
noonedeadpunkI don't think we have anything new15:26
noonedeadpunk#topic office hours15:27
noonedeadpunkSo there's already a PTG schedule for April available15:27
noonedeadpunk#link https://ethercalc.openstack.org/7yxdas7suqnd15:28
noonedeadpunkI took kind of responsibility to fill same time slots as for previous PTG15:29
noonedeadpunkwould be great if you could check it and provide some feedback if that is fine or we should re-arrange and do proper voting15:29
noonedeadpunkSo 2H slots 15-17 UTC on Tuesday and Wednesday15:30
damiandabrowski[m]it's ok for me15:30
noonedeadpunk(april 5 and april 6)15:30
jrosseryes ok for me15:32
noonedeadpunkwe almost done with centos-8 removal15:32
noonedeadpunkand there big work done with Rocky?:)15:32
jrosseri think that NeilHanlon patch is very very close for metal deploys15:33
jrosserand i think that the selinux trouble and probably also the lxc python lib problems will go away with it now using the system python on the targets15:33
noonedeadpunksounds good enough15:34
jrosserreally we wait on the dib patch to merge and getting nodes available15:34
noonedeadpunkregarding ubuntu 22.04 support. I think I'd try to release without it if we will be ready with other things 15:35
jrosserand i think also we have to clean up these zuul job repos as that has causes confusion15:35
noonedeadpunkoh yes15:35
noonedeadpunkI;m not sure what it will take to land all keyston-related system scope and project tokens stuff15:36
noonedeadpunkOr we'd rather delay intentionally to get ubuntu 22.04?15:36
noonedeadpunkprobably it's topic for ptg though as there will be more details around by this date (like dib and ci images)15:37
jrosserwhats the release date?15:38
noonedeadpunkMarch 3015:38
noonedeadpunk+2 month iirc15:38
noonedeadpunkto technically we can fit15:39
noonedeadpunkbtw... Have I missed how Z will be named ?:) As just realized I have no idea what's the name it will have...15:39
jrosser22.04 is released April 21, 2022 though? so it's not in this cycle?15:40
noonedeadpunkwell, it's not. but I'd say all depedns on how much we want it:) and when CI images will appear.. If that will with some beta in March and we will be able to start working on it before release...15:41
noonedeadpunkit's doable I guess15:41
jrosserfor ubuntu usually one or two days hacking gets most of it sorted unless there is a major problem15:42
noonedeadpunkBut yes, historically we were holding ubuntu lts to autumn15:42
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Remove unwanted repositories installed with the zuul configure-mirrors role  https://review.opendev.org/c/openstack/openstack-ansible/+/82826715:46
jrosser^ zuul runs older ansible - doh15:47
jrosseralso i an pretty much done on the ssh keypairs stuff15:50
noonedeadpunkI will review this shortly15:51
jrosserthough somehow i've constructed the patches / depends-on all backwards and it won't pass15:51
noonedeadpunkI did quick look through and things look pretty much good15:51
jrosseri think it was a mistake to try to bring all the role patches as depends-on the main one to openstack-ansible15:51
noonedeadpunkat least openstack-ansible should depends on plugins?15:52
noonedeadpunkah yes. I mean - nova/keystone should depend on integrated repo15:53
noonedeadpunkand repo15:53
noonedeadpunkand integrated only depend on plugins15:53
jrossercorrect, that would work fine and would be mergeable15:54
opendevreviewJonathan Rosser proposed openstack/openstack-ansible master: Create ssh certificate authority  https://review.opendev.org/c/openstack/openstack-ansible/+/82529215:55
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-repo_server master: Use ssh_keypairs role to generate keys for repo sync  https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/82710015:55
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_nova master: Use ssh_keypairs role to generate cold migration ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/82530615:56
noonedeadpunkand regarding plugins CI - I haven't looked into it - ENOTIME15:56
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Use ssh_keypairs role to generate fernet sync ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/82709015:56
jrosseri only looked a little at molecule and saw it was pretty docker centric which is tedious for the docker rate limits15:57
noonedeadpunkyep15:57
noonedeadpunkand with nodepool we don't even need this15:57
noonedeadpunk#endmeeting16:01
opendevmeetMeeting ended Tue Feb  8 16:01:06 2022 UTC.  Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)16:01
opendevmeetMinutes:        https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-02-08-15.01.html16:01
opendevmeetMinutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-02-08-15.01.txt16:01
opendevmeetLog:            https://meetings.opendev.org/meetings/openstack_ansible_meeting/2022/openstack_ansible_meeting.2022-02-08-15.01.log.html16:01
opendevreviewMerged openstack/openstack-ansible-lxc_hosts stable/victoria: Drop CentOS 8 jobs  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82809616:05
*** dviroel|ruck|lunch is now known as dviroel|ruck16:06
damiandabrowski[m]btw. guys, I'd really appreciate reviews here: https://review.opendev.org/q/topic:tempest-damian-2021-1216:41
jrosserwhat do we think about this? https://b607583e4f021c8f07a7-9b48d8c7e57d0c594fcc7dac0e7e023c.ssl.cf1.rackcdn.com/827483/1/check/openstack-ansible-deploy-aio_ovs_lxc-ubuntu-focal/a16f441/job-output.txt16:43
noonedeadpunkthere was a comment for https://review.opendev.org/c/openstack/openstack-ansible-os_tempest/+/825157/3/templates/tempest.conf.j2 and tons of stuff is on top of it16:43
jrosserlooks like neutron tempest plugin on victoria is just broken16:44
noonedeadpunkhave we fixed it version there?16:44
noonedeadpunkhttps://opendev.org/openstack/openstack-ansible-os_tempest/src/branch/master/defaults/main.yml#L11816:45
jrosserhttps://github.com/openstack/openstack-ansible-os_tempest/commit/06add17f32a65904b9f075dbd808f02b7eb6f9e516:45
noonedeadpunkoh I haven't switched branch16:45
jrosserah the commit message references just the thing that is failing16:46
jrosserinteresting16:46
noonedeadpunkmaybe tempest got dropped from u-c for V as well16:48
jrosseroh16:48
jrosser[aio1_utility_container-d69d229a] => (item={'branch': 'master', 'name': 'neutron-tempest-plugin', 'repo': 'https://opendev.org/openstack/neutron-tempest-plugin'})16:48
jrosserwtf16:49
noonedeadpunksome depends on from master branch?16:49
noonedeadpunkduring cherry-pick?16:49
jrosserits this https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/82748316:50
jrosserwhich is just like RED :)16:50
noonedeadpunkI have a guess16:50
noonedeadpunkhere we go https://opendev.org/openstack/openstack-ansible/src/branch/stable/victoria/tests/roles/bootstrap-host/templates/user_variables_neutron_ovn.yml.j2#L2616:51
noonedeadpunksame for ovn https://opendev.org/openstack/openstack-ansible/src/branch/stable/victoria/tests/roles/bootstrap-host/templates/user_variables_neutron_ovs.yml.j216:51
jrosserah nice one16:51
noonedeadpunkno idea why we need to override there16:53
jrosseri wonder if we don't enable neutron tempest tests normally16:54
jrosserjust basic server ops covers go/no-go16:54
noonedeadpunkwe suck with test enablement indeed. We have cinder volume iscsi broken for ages I believe with defaults16:56
noonedeadpunkbut basic server catches networking issues as it's includes ssh to it16:57
noonedeadpunkwell, some of them at least16:57
jrosseris this needed at all? https://opendev.org/openstack/openstack-ansible/src/branch/stable/victoria/tests/roles/bootstrap-host/templates/user_variables_neutron_ovn.yml.j2#L23-L2617:04
noonedeadpunknope17:04
noonedeadpunkor at least I don't see why it would... Maybe to save up time and not install all other plugins...17:05
jrosserbecasue the neutron plugin should be enabled anyway https://github.com/openstack/openstack-ansible-os_tempest/blob/stable/victoria/defaults/main.yml#L19117:05
*** akahat|dinner is now known as akahat|rover17:05
jrosserthis feels like a good time to use a pattern matched variable17:06
jrossertempest_test_includelist_<anything>17:06
jrosserto build up incrementally the things that are tested rather than having to override the whole lot17:07
noonedeadpunkit's kind of like that anyway? https://opendev.org/openstack/openstack-ansible-os_tempest/src/branch/master/vars/main.yml#L5817:08
jrosserwell, enabling / installing plugins is one thing17:09
jrosserbut if they do anything at all is kind of here https://github.com/openstack/openstack-ansible/blob/e697bed2cea5ea5e49ae7f03c10650b8aec77bc8/inventory/group_vars/utility_all.yml#L77-L10217:09
jrosserand thats the exact same var we override in user_variables_<scenario>.yml17:12
jrosserso this is totally going to go wrong when we have a combination scenario, like maybe octavia+barbican17:13
*** sshnaidm is now known as sshnaidm|afk17:18
opendevreviewJonathan Rosser proposed openstack/openstack-ansible stable/victoria: Remove enablement of neutron tempest plugin in scenario templates  https://review.opendev.org/c/openstack/openstack-ansible/+/82838617:50
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_neutron stable/victoria: Remove legacy centos-8 jobs  https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/82748317:53
noonedeadpunkwell yes, with barbican + octavia only octavia I guess will be tested17:53
noonedeadpunkas vars files load in aplhabetical order so https://opendev.org/openstack/openstack-ansible/src/branch/master/tests/roles/bootstrap-host/templates/user_variables_octavia.yml.j2#L13 will be used...17:54
jrosserthats by luck because 'o' is after 'b', if they both override tempest_test_includelist 17:54
jrosseranyway.....17:54
noonedeadpunkbut yeah, I do agree this must be done better17:56
noonedeadpunka pity that you can't just append to variable from different files 17:57
noonedeadpunklike $TEMPEST_VAR="${TEMPEST_VAR}:new_test"17:57
jrosserevrey day there are people in #ansible asking kind of similar things17:58
jrosserwanting to squash together the same var from several places17:58
noonedeadpunkI bet I saw something like that17:59
noonedeadpunklikely somewhere in our code even :D17:59
noonedeadpunklike constructing variable out of hostvars with selectattr by regexp...18:00
jrosseryes, i have that in the pki role18:00
noonedeadpunkah, indeed!18:00
noonedeadpunkthat was the code I could hardly read!18:00
jrosseroh well it's stolen from logan iptables role18:01
jrosserwhich is magical18:01
noonedeadpunkwhen you try to install just defined certs18:01
jrosserhttps://github.com/logan2211/ansible-iptables18:01
jrosser^ worth checking out how amazinly flexible that is18:01
jrosseri need to look again at how we do that in the pki role18:02
noonedeadpunkdamiandabrowski[m]: ^ 18:02
damiandabrowski[m]yes? :D 18:03
noonedeadpunk(I'm a bit facepalming comparing how we manage iptables)18:03
jrosserhaving this if/else around the clever part feels wrong https://github.com/openstack/ansible-role-pki/blob/master/vars/main.yml#L1818:03
jrosserwe use that iptables role on all our OSA deployments now18:03
noonedeadpunkwas just FYI kind of about iptables :)18:03
damiandabrowski[m]ahh, i was wondering what should i do with this now :D but agree, this repo looks cool18:04
noonedeadpunk(and we kind of was about to rework our stuff)18:05
noonedeadpunkwell I'd say in PKI we should just expand list, but well18:05
jrosserthat role lets you spread the iptables config across your group vars18:07
jrosserso you can put into some all/all.yml the things you need to admin ssh or whatever18:07
jrosserthen in more specific groups you can put the service specific rules18:07
jrosserthen it all gets mashed together when the role runs to resolve the entire iptables config for the host18:08
noonedeadpunkyeah that seems really nice thing18:13
jrosserhave to be super careful on network nodes and compute nodes though18:15
jrosserotherwise stuff installed by neutron can be removed18:15
noonedeadpunknot sure it has ipv6 support?18:15
jrosserhttps://github.com/logan2211/ansible-iptables/blob/master/tasks/iptables_rule_facts.yml#L4018:22
jrosserwe put this in the most general group vars for "deny all" https://paste.opendev.org/show/812607/18:23
jrosserthen everything else builds up from that18:24
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Use ssh_keypairs role to generate fernet sync ssh keys  https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/82709018:30
noonedeadpunkah nice. I just thought about separate file for ipv6 but it's indeed not a requirement18:33
noonedeadpunkwell we have really decent firewalling but the way it organized and complexity it has comparing to that role...18:36
opendevreviewDmitriy Rabotyagov proposed openstack/openstack-ansible stable/xena: Fix additional facts gathering in ceph-install.yml  https://review.opendev.org/c/openstack/openstack-ansible/+/82839219:13
opendevreviewMerged openstack/openstack-ansible-lxc_hosts stable/xena: Ensure that the legacy network-scripts package is present  https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/82823519:13
noonedeadpunkdo you think we should backport https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/786381 ?19:35
prometheanfirewas there an upgrade note I missed for horizon, I can boot an instance via command line but not via the horizon UI20:05
prometheanfirehorizon kicks back a bunch of errors like this20:05
prometheanfirePolicy os_compute_api:servers:start failed scope check.20:05
noonedeadpunkis that on... Xena?20:11
noonedeadpunkI can imagine that's regarding system/project scopes that horizon hasn't adapted in their policies...20:11
prometheanfirexena, ya20:12
noonedeadpunkwe just recieved https://bugs.launchpad.net/openstack-ansible/+bug/1960342 btw...20:13
noonedeadpunknot sure if related...20:13
noonedeadpunkbut sounds like it is20:13
prometheanfiresounds like it could be20:13
* noonedeadpunk wasn't using horizon for a while so need to recall all that20:14
prometheanfirelol20:14
prometheanfireI can pull up project/user/group/role stuff20:15
noonedeadpunkwe don't really deploy it nowadays :(20:16
noonedeadpunkwell, it's good then :) likely smth with folks deployment then)20:16
prometheanfireprobably, ya20:16
* noonedeadpunk installing horizon in sandbox20:16
prometheanfirelooking at details of a project does show some issues (can't view user/group within a project)20:18
noonedeadpunkhm20:21
noonedeadpunkgot horizon from 24.0.0 see no issue at least with user creds20:22
noonedeadpunklet me check against master then....20:22
prometheanfirehorizon can spin up an instance with another flavor, just not the other one20:25
noonedeadpunkoh20:25
prometheanfireboth flavors uses aggregate_instance_extra_specs, and command line works for both20:25
prometheanfireworks with both flavors via cmdline, works in horizon with just one of the two flavors20:26
prometheanfireit's wierd...20:26
noonedeadpunkis one of these flavors shared with specific projects only?20:27
noonedeadpunkbtw I can reproduce bug20:27
prometheanfirenice20:28
prometheanfireyou test with horizon master or xena tag?20:28
prometheanfirethe flavor that works in horizon is shared with a particuar project only20:29
noonedeadpunkon master. But bug I was refferencing before - don't see issues with VM creation though20:29
prometheanfirethe flavor that does not work is available everywhere20:29
noonedeadpunkand you're using tenant credentials?20:30
prometheanfireI use the same user, who is a member of multiple projects20:30
noonedeadpunkok, non admin20:30
prometheanfireright20:31
prometheanfirea user who is a member of a single project reported the inability to create an instance via horizon, so multi-project user issues shouldn't be it20:31
* prometheanfire really thinks it's horizon that needs updating...20:32
prometheanfireThe token used to make the request was domain scoped but the policy requires ['system', 'project'] scope. (via horizon logs)20:32
noonedeadpunknah, can't really reproduce on master...20:34
noonedeadpunkand on 24.0.0 it works for me as well20:34
prometheanfireworks? as in you can reproduce with 24?20:34
noonedeadpunkwas able to reproduce https://bugs.launchpad.net/openstack-ansible/+bug/196034220:35
prometheanfirehttps://bugs.launchpad.net/horizon/+bug/195567420:35
noonedeadpunkbut not yours :(20:35
prometheanfireheh20:35
noonedeadpunkwith domain scoped user as well20:35
noonedeadpunkdidn't have private flavors though...20:36
prometheanfireprivate flavor worked in horizon, public did not (both with the aggregate instance extra specs)20:36
noonedeadpunkthere was literally no backports to Xena20:37
noonedeadpunkhttps://opendev.org/openstack/horizon/commit/34a0159d1a65dbf8dd3ff3bc2cb156bdcf37a814 sounds related20:38
noonedeadpunkdamn I really need to play with scopes and soon enough. As I feel like in OSA we don't do things right atm...20:41
prometheanfireya, looks like it20:41
prometheanfire(system scope being fetched in that commit20:42
noonedeadpunkbut I'm not sure why system scope would be a requirement for using shared flavor...20:42
noonedeadpunkas how then tenants with project scope supposed to interact...20:43
prometheanfireno clue20:47
prometheanfireis there a way I could try to deploy horizon-20 (wallaby) to verify the issue?20:48
noonedeadpunksure thing! You can set `horizon_git_install_branch` to any SHA, tag or branch you like. and then re-run os-horizon-install.yml -e venv_rebuild=true.20:50
prometheanfirecool20:50
noonedeadpunkwith that I'd suggest also setting `requirements_git_install_branch` to W for valid constraints20:50
prometheanfirewell, I have the old venv around so I can edit the apache config to point to it20:51
noonedeadpunkwhich in turn might require re-runing repo-install 20:51
noonedeadpunkok, then wait :)20:51
prometheanfireyep20:51
noonedeadpunkto have old venv around, I'd also say that set `horizon_venv_tag` to smth different as otherwise it will be installed in same venv20:52
prometheanfireheh, didn't work20:52
noonedeadpunkand eventually instead of `requirements_git_install_branch` then jsut set `horizon_upper_constraints_url: https://releases.openstack.org/constraints/upper/wallaby`20:53
noonedeadpunkah20:53
noonedeadpunkI misunderstood you a bit20:53
noonedeadpunkbut you can try "master" horizon that way as well :)20:53
noonedeadpunkto check if patch solves the issue20:54
noonedeadpunkso basically 3 things: horizon_upper_constraints_url, horizon_venv_tag and horizon_git_install_branch20:54
noonedeadpunksorry, I need to run, it's pretty late here already :(20:55
prometheanfireit's fine, I can play a bit20:56
*** prometheanfire is now known as Guest020:56
Guest0master had the same issue, so am reverting21:55
* Guest0 sighs21:56
*** Guest0 is now known as prometheanfire21:56
*** dviroel|ruck is now known as dviroel|ruck|afk22:02
prometheanfirefailed in wallaby too, giving up22:11
NeilHanlon:) DIB merged https://review.opendev.org/c/openstack/diskimage-builder/+/82595722:42
opendevreviewNeil Hanlon proposed openstack/openstack-ansible master: WIP - Add support for running on Rocky Linux  https://review.opendev.org/c/openstack/openstack-ansible/+/82357323:02
jrosserNeilHanlon: you need to get nodepool configured to have rocky-8 nodes available next https://docs.opendev.org/opendev/system-config/latest/nodepool.html23:07
NeilHanlonyep chatting in #opendev now about that23:07
jrosserah i see you starting that....23:07
opendevreviewJonathan Rosser proposed openstack/openstack-ansible-plugins master: Add ssh_keypairs role  https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/82511323:36
« Monday, 2022-02-07 Index Wednesday, 2022-02-09 »

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!