| *** frenzy_friday is now known as frenzyfriday|ruck | 03:59 | |
| *** frenzyfriday|ruck is now known as frenzyfriday|rover | 04:00 | |
| *** prometheanfire is now known as Guest2 | 04:59 | |
| *** Guest2 is now known as prometheanfire | 05:09 | |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_nova master: Implement nova direct RBD image retrieve https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/828897 | 07:43 |
|---|---|---|
| *** sshnaidm|afk is now known as sshnaidm | 08:55 | |
| opendevreview | Merged openstack/openstack-ansible-openstack_hosts stable/wallaby: Enable powertools/crb repository for the repo server https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/829787 | 09:14 |
| opendevreview | James Gibson proposed openstack/openstack-ansible-specs master: Add proposal for enabling TLS on all internal communications https://review.opendev.org/c/openstack/openstack-ansible-specs/+/822850 | 09:41 |
| opendevreview | James Gibson proposed openstack/openstack-ansible-specs master: Add proposal for enabling TLS on all internal communications https://review.opendev.org/c/openstack/openstack-ansible-specs/+/822850 | 09:58 |
| noonedeadpunk | mornings | 10:12 |
| jrosser | morning | 10:17 |
| opendevreview | Merged openstack/openstack-ansible-galera_server stable/wallaby: Use unix socket while granting access for the backup service https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/829260 | 10:57 |
| *** dviroel_ is now known as dviroel | 11:16 | |
| noonedeadpunk | andrewbonney: do we need to adjust heartbeat_in_pthread anywhere/everywhere in OSA? | 11:26 |
| andrewbonney | I had a chat with jrosser this morning. I'm going to test a little more and then might do a set of patches so we can have a global override in OSA config | 11:27 |
| jrosser | is there a bug for that? | 11:36 |
| andrewbonney | Not for OSA directly, just https://bugs.launchpad.net/oslo.messaging/+bug/1949964 | 11:37 |
| noonedeadpunk | Just for conclusion of https://bugs.launchpad.net/oslo.messaging/+bug/1934937 was use-cases for execution outside of mod_wsgi. I guess that uwsgi should still be fine then without heartbeat_in_pthread? | 11:52 |
| noonedeadpunk | which leads me to thought that splitting of config must be required for api/scheduler as example? | 11:53 |
| andrewbonney | I've been confused by where the issue applies and where it doesn't so I was hoping a little more testing might help with that. Certainly our worst offender to date has been nova-compute | 12:05 |
| opendevreview | James Gibson proposed openstack/openstack-ansible master: WIP: Add support for enabling TLS to Glance backends in OSA https://review.opendev.org/c/openstack/openstack-ansible/+/821090 | 12:11 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-rabbitmq_server master: Return Erlang distribution port mgmt binding https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/830151 | 12:12 |
| admin1 | hi all .. for those who migrated from rocky (xenial ) -> bionic and up .. at which point or how do you upgrade ceph nodes ( its a ceph+osa integrated deployment ) .. .. and is it safe to do a ubuntu upgrade on ceph ( in place upgrade) and then re-run the playbooks ? | 12:14 |
| jrosser | not knowing the answers to that sort of stuff was why i never ran it like that :) | 12:26 |
| admin1 | :) | 12:32 |
| noonedeadpunk | generally in-place upgrade is fine if you have simmilar version available for both distros | 12:33 |
| noonedeadpunk | so might be that you need to do minor ceph upgrade to get latest version for release just to be extra safe | 12:33 |
| noonedeadpunk | As I can recall issues here and there between minor versions | 12:34 |
| opendevreview | James Gibson proposed openstack/openstack-ansible master: WIP: Enable TLS on haproxy VIPs and backends by default https://review.opendev.org/c/openstack/openstack-ansible/+/829937 | 12:37 |
| *** arxcruz|ruck is now known as arxcruz | 12:38 | |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-rabbitmq_server master: Verify if hosts file already managed with OSA https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/828929 | 12:43 |
| opendevreview | Merged openstack/openstack-ansible-os_zun master: Use common service setup tasks from a collection rather than in-role https://review.opendev.org/c/openstack/openstack-ansible-os_zun/+/824372 | 13:06 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-rabbitmq_server master: Remove affecting rabbitmq hosts record https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/830172 | 13:59 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [doc] Add note regarding 127.0.1.1 removal https://review.opendev.org/c/openstack/openstack-ansible/+/830175 | 14:10 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Migrate apache ssl certificate generation to the PKI role https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/830179 | 14:28 |
| jrosser | JamesGibo: I took a go at using what you'd done in the glance role to move os_keystone to the PKI role ^ | 14:29 |
| jrosser | also this looks like it needs rebasing https://review.opendev.org/c/openstack/openstack-ansible/+/829937 | 14:30 |
| jrosser | not sure it is testing quite what you think just now | 14:30 |
| noonedeadpunk | jrosser: we also have same IDP-based stuff like https://opendev.org/openstack/openstack-ansible-os_keystone/src/branch/master/tasks/keystone_idp_self_signed_create.yml | 14:53 |
| noonedeadpunk | Seems you've not covered that? | 14:53 |
| noonedeadpunk | * https://opendev.org/openstack/openstack-ansible-os_keystone/src/branch/master/tasks/keystone_idp_setup.yml | 14:53 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/pike: EOL Pike branch https://review.opendev.org/c/openstack/openstack-ansible/+/826956 | 14:57 |
| jrosser | wtf is that even doing :) | 15:00 |
| jrosser | oh wow it uses memcached rather than slurp/register | 15:03 |
| jrosser | i have no idea if this still is valid / working, setting up keystone as an IdP is for k2k? | 15:11 |
| jrosser | i think i don't know if we just rip all of that out rather than move it to the PKI role tbh | 15:11 |
| jrosser | noonedeadpunk: do you have any k2k stuff? | 15:12 |
| noonedeadpunk | nope, we have just plain basic keystone setup | 15:12 |
| noonedeadpunk | looking at keycloack though | 15:12 |
| jrosser | i don't see really how that IdP code supports anything except a self-signed cert | 15:13 |
| noonedeadpunk | k2k sounds valid though if you want multi region with shared keystone though? | 15:13 |
| noonedeadpunk | and if you don't have anything centralized... | 15:14 |
| noonedeadpunk | btw yes, I was quite impressed with memcached usage as well:) | 15:14 |
| noonedeadpunk | that's not really bad pattern, is it? | 15:14 |
| noonedeadpunk | useless when you have everything on deploy host thoug | 15:15 |
| jrosser | self_signed_cert_subject: "/C=US/ST=Texas/L=San Antonio/O=IT/CN={{ external_lb_vip_address }}" | 15:16 |
| jrosser | is there some distant history where keystone web server was public? | 15:16 |
| noonedeadpunk | for k2k they still should talk through haproxy I believe | 15:18 |
| jrosser | oh right this is saml isnt it | 15:21 |
| jrosser | and googling suggests there is a signing key/certificate which is independant of the haproxy one | 15:21 |
| * jrosser never done anything with saml | 15:21 | |
| noonedeadpunk | we were concidering saml as alternative, but well, I never did any deep dive | 15:23 |
| *** dviroel is now known as dviroel|lunch | 15:26 | |
| opendevreview | Jonathan Rosser proposed openstack/ansible-role-pki master: Add flag to conditionally create certificate authorities. https://review.opendev.org/c/openstack/ansible-role-pki/+/830221 | 15:54 |
| opendevreview | Merged openstack/openstack-ansible-lxc_hosts master: Generalise redhat variables to handle any distro and major release https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/829106 | 16:12 |
| opendevreview | Merged openstack/openstack-ansible-lxc_hosts master: Clean up bionic variables https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/828114 | 16:12 |
| *** dviroel|lunch is now known as dviroel | 16:26 | |
| jrosser | noonedeadpunk: i am having brain fail on the comment here https://review.opendev.org/c/openstack/ansible-role-pki/+/830221/1/tasks/main_ca.yml#41 | 16:30 |
| noonedeadpunk | 'True' vs True | 16:32 |
| noonedeadpunk | 'True' is str | 16:32 |
| noonedeadpunk | True is bool | 16:32 |
| noonedeadpunk | Result is kind of same though... | 16:32 |
| noonedeadpunk | So I'm not really -1 it, just commented :D | 16:33 |
| jrosser | ooooh | 16:37 |
| jrosser | i wonder if the keystone memcached thing is done because of keystone always running the [0]'th host then all the rest in two batches | 16:41 |
| noonedeadpunk | huh, can be... | 16:46 |
| noonedeadpunk | then it makes trouble to pki role as well I believe? | 16:47 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Migrate apache ssl certificate generation to the PKI role https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/830179 | 16:57 |
| jrosser | that might do it | 16:57 |
| jrosser | looks like the IDP cert is a CA cert | 16:57 |
| jrosser | https://github.com/openstack/openstack-ansible-os_keystone/blob/master/tasks/keystone_idp_self_signed_create.yml#L30 | 16:58 |
| jrosser | really not sure how to test this though | 16:58 |
| opendevreview | Jonathan Rosser proposed openstack/ansible-role-pki master: Add flag to conditionally create certificate authorities. https://review.opendev.org/c/openstack/ansible-role-pki/+/830221 | 17:01 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Migrate apache ssl certificate generation to the PKI role https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/830179 | 17:02 |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Tidy IDP setup task files https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/830260 | 17:06 |
| opendevreview | Merged openstack/openstack-ansible master: Add test of used SHAs https://review.opendev.org/c/openstack/openstack-ansible/+/829868 | 17:18 |
| opendevreview | Merged openstack/openstack-ansible master: Add infra zuul job with reduced required_projects https://review.opendev.org/c/openstack/openstack-ansible/+/775809 | 17:19 |
| opendevreview | Merged openstack/openstack-ansible master: Add hosts zuul job with reduced required_projects https://review.opendev.org/c/openstack/openstack-ansible/+/775812 | 17:19 |
| opendevreview | Merged openstack/openstack-ansible master: Do not install extra repos with the zuul configure-mirrors role https://review.opendev.org/c/openstack/openstack-ansible/+/829111 | 17:24 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Improve bump patch readability https://review.opendev.org/c/openstack/openstack-ansible/+/830271 | 18:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump SHAs for master https://review.opendev.org/c/openstack/openstack-ansible/+/830273 | 18:29 |
| noonedeadpunk | jrosser: would be good to hear wdyt about such change in terms of HEAD date for each SHA vs one per file | 18:30 |
| *** dviroel is now known as dviroel|out | 21:52 | |
| opendevreview | Jonathan Rosser proposed openstack/openstack-ansible-os_keystone master: Migrate apache ssl certificate generation to the PKI role https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/830179 | 23:26 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!