| opendevreview | James Denton proposed openstack/openstack-ansible-os_ironic master: Replace pxe_append_params with kernel_pxe_params in ironic.conf https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/856590 | 02:15 |
|---|---|---|
| *** ysandeep|out is now known as ysandeep | 05:52 | |
| noonedeadpunk | NeilHanlon: so in older releases we did symlink selinux inside venv. Though this was not required since yoga at least as ansible could work without it | 07:32 |
| noonedeadpunk | Here's how code looked like: https://opendev.org/openstack/openstack-ansible/src/branch/stable/victoria/scripts/scripts-library.sh#L89-L92 | 07:32 |
| noonedeadpunk | Also wondering how it worked locally for you and why it's not in CI | 07:33 |
| noonedeadpunk | that's the patch that removed symlinking https://opendev.org/openstack/openstack-ansible/commit/a5b99ca742a95a7ce5af63fb54ec9269201f12b2 | 07:34 |
| noonedeadpunk | so maybe some other package is missing that not allow to use ctypes? | 07:34 |
| noonedeadpunk | Though ansible seems to have hardcoded library name: https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/compat/selinux.py#L14 | 07:35 |
| anskiy | jamesdenton: that thing works as expected with LXC, as you will get different host names | 07:51 |
| ThiagoCMC | noonedeadpunk, when installing OSA with limited Internet (only behind proxy), there's a need to manually add the following lines to `keystone_service_bootstrap.yml`, task "Wait for service to be up": `environment:\n no_proxy: '{{ keystone_uwsgi_bind_address }}'` - Othewise, even if `no_proxy` is in `/etc/environment`, it fails. | 09:32 |
| noonedeadpunk | ThiagoCMC: I guess I saw some related bug report recently. Do you want to send a patch for that?:) | 09:45 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_keystone stable/yoga: Check the service status during bootstrap against the internal VIP https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/857484 | 10:57 |
| noonedeadpunk | ThiagoCMC: can you check if this works for you? ^ | 10:57 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_keystone master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/857521 | 11:03 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_glance master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/857634 | 11:03 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_cinder master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/857635 | 11:03 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_nova master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/857636 | 11:04 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_placement master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_placement/+/857637 | 11:04 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_neutron master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/857638 | 11:05 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_ironic master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_ironic/+/857639 | 11:05 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_designate master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_designate/+/857641 | 11:10 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_barbican master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/857642 | 11:11 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_heat master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_heat/+/857643 | 11:18 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_horizon master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_horizon/+/857644 | 11:18 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_magnum master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_magnum/+/857646 | 11:29 |
| *** dviroel|brb is now known as dviroel | 11:37 | |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_manila master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_manila/+/857647 | 11:38 |
| NeilHanlon | noonedeadpunk yeah i feel we shouldn't need a symlink. python3-libselinux on EL9 uses Python 3.9, which appears to be the same executable that ansible is setting up. I'm a bit confused as to why it works for me, too :D | 11:46 |
| ThiagoCMC | noonedeadpunk, cool, I'll give it a try! | 11:46 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_murano master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_murano/+/857649 | 11:49 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_cloudkitty master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_cloudkitty/+/857650 | 11:52 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_mistral master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_mistral/+/857651 | 11:55 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_neutron master: Avoid ovs restart during package upgrade https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/857652 | 11:58 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_masakari master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_masakari/+/857653 | 12:01 |
| NeilHanlon | noonedeadpunk: do we install the `selinux` shim package? [1] or is the idea that ctype binding should avoid the need for such things? [1] https://github.com/pycontribs/selinux | 12:11 |
| noonedeadpunk | I think the idea of ctype is that you don't need to symlink or that selinux package | 12:12 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_octavia master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_octavia/+/857654 | 12:12 |
| noonedeadpunk | And I can recall we didn't install it before, as it's quite poorly maintained | 12:12 |
| noonedeadpunk | So symlinking was better then this shim package | 12:13 |
| NeilHanlon | it does appear that the .so it's looking for is provided by a different package (libselinux), but that's already installed so we shouldn't be having this | 12:14 |
| NeilHanlon | I think my lab works because I disable selinux prior to running the bootstrap | 12:14 |
| noonedeadpunk | would it be enabled in a dib image? | 12:15 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_rally master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_rally/+/857656 | 12:16 |
| noonedeadpunk | I think I'd need to spawn aio to check this out | 12:17 |
| NeilHanlon | yeah, it says it's installed in the zuul build | 12:17 |
| NeilHanlon | i'm downloading the dib image and am going to try from there | 12:17 |
| noonedeadpunk | ah, ok then | 12:17 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-rabbitmq_server master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/857658 | 12:21 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-repo_server master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-repo_server/+/857664 | 12:23 |
| anskiy | noonedeadpunk: hey! What would happen to https://review.opendev.org/c/openstack/openstack-ansible/+/854235 this patch in the end? | 12:36 |
| noonedeadpunk | anskiy: well... it has some issues I've commented. But overall I'd love to find better approach but too loaded with internal stuff now to sort out this feature | 12:37 |
| anskiy | so it would be merged eventually like it is now? | 12:38 |
| noonedeadpunk | I still think we should have some common role that can be included after each role to create resources.... | 12:38 |
| noonedeadpunk | But as this idea was rejected, I need to re-evaluate how we should do that then | 12:39 |
| noonedeadpunk | as in current shape it's really one-task playbook which is weird imo | 12:40 |
| anskiy | okay, the reason I'm asking is this: I'm just trying to sort out which patches I need to wait, and I can have some use out of this one, if it lands. | 12:41 |
| noonedeadpunk | Well, I do want to have such resource creation being implemented as well, question is how we should handle and test this | 12:42 |
| noonedeadpunk | so I don't have defenitive answer to your question | 12:43 |
| anskiy | ah, so it just depends on would this new approach be implemented in this change or not :) | 12:44 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_senlin master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_senlin/+/857672 | 12:50 |
| anskiy | Second try with Let's Encrypt question: I have this patch on haproxy_server role: https://paste.opendev.org/show/bM89LDRRKyMPRgJvrSKI/ to get Let's Encrypt certificate issue working. I have `external_lb_vip_address` set to hostname and `haproxy_bind_external_lb_vip_address` set to IP/PREFIX. Does anyone else use Lets Encrypt? | 12:50 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_swift master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_swift/+/857673 | 12:52 |
| mgariepy | anskiy, i do. | 12:58 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_tempest master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_tempest/+/857674 | 12:58 |
| mgariepy | external_lb_vip_address: FQDN for the lb address in openstack_user_config | 12:59 |
| mgariepy | and haproxy_keepalived_external_vip_cidr: ipaddress/32 for the keepalived config | 13:00 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_trove master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_trove/+/857675 | 13:01 |
| anskiy | mgariepy: what do you have in `bind` directive in frontend sections of `haproxy.cfg`? Hostname? | 13:04 |
| mgariepy | yep | 13:04 |
| anskiy | ahh, I see. | 13:04 |
| mgariepy | it needs to resolv on haproxy starts. | 13:05 |
| opendevreview | Ebbex proposed openstack/openstack-ansible-os_zun master: Remove redundant vars line https://review.opendev.org/c/openstack/openstack-ansible-os_zun/+/857677 | 13:05 |
| anskiy | yeah, but I don't like this behavior :) Better set it to what it's supposed to be. | 13:05 |
| mgariepy | ok ¯\_(ツ)_/¯ | 13:07 |
| anskiy | So, I can actually safely submit my patch, as it shouldn't break your existing installation, if: `external_lb_vip_address` could only be FQDN or IP-address, `haproxy_keepalived_external_vip_cidr` could only be CIDR and `haproxy_bind_external_lb_vip_address` could only be IP-address. | 13:09 |
| anskiy | mgariepy: thank you! | 13:09 |
| noonedeadpunk | anskiy: um, but you can totally set haproxy_bind_address explicitly | 13:10 |
| noonedeadpunk | I'm not using let's encrypt, but have external_lb_vip_address defined as fqdn and bind in haproxy is IP | 13:11 |
| noonedeadpunk | anskiy: as you can use `haproxy_bind_external_lb_vip_address` | 13:12 |
| noonedeadpunk | https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/defaults/main.yml#L232-L236 | 13:12 |
| anskiy | noonedeadpunk: yes, that's what I've set. And when you would enable Let's Encrypt, you would direct `certbot` to issue certificate for `haproxy_bind_external_lb_vip_address`, which is IP-address for you: haproxy_bind_external_lb_vip_address | 13:13 |
| noonedeadpunk | ah, well, I see what you mean | 13:13 |
| anskiy | https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/tasks/haproxy_ssl_letsencrypt.yml#L78 this, I mean | 13:13 |
| noonedeadpunk | yes, fair, ok | 13:13 |
| noonedeadpunk | btw, question, was you thinking about this kind of binds? https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/852039 | 13:13 |
| noonedeadpunk | yes, your patch makes sense | 13:14 |
| *** ysandeep is now known as ysandeep|afk | 13:15 | |
| anskiy | noonedeadpunk: I don't think I need that thing, at least, for now | 13:32 |
| anskiy | I'll submit my patch later, thanks for the help! | 13:32 |
| *** ysandeep|afk is now known as ysandeep | 13:41 | |
| *** ysandeep is now known as ysandeep|out | 13:43 | |
| *** frenzyfriday is now known as frenzyfriday|lunch | 14:11 | |
| opendevreview | Danila Balagansky proposed openstack/openstack-ansible-haproxy_server master: Use `external_lb_vip_address` as argument for certbot `domains` option https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/857719 | 14:30 |
| noonedeadpunk | anskiy: I wonder if it would make sense to add a variable for certbot domains option? | 14:38 |
| noonedeadpunk | But I gues it would be tricky to integrate with pki role | 14:39 |
| noonedeadpunk | or maybe not, as this https://opendev.org/openstack/openstack-ansible-haproxy_server/src/branch/master/handlers/main.yml#L16-L24 is not triggered with let's encrypt | 14:40 |
| opendevreview | Merged openstack/openstack-ansible-haproxy_server stable/xena: Do not add cacert when it does not exist https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/857055 | 15:00 |
| anskiy | noonedeadpunk: you mean like separate one? The only downside that I see, is that it would be 4th variable :) So we would have CIDR, definitely IP, FQDN or IP and list of FQDNs :) | 15:13 |
| *** dviroel is now known as dviroel|lunch | 15:21 | |
| noonedeadpunk | anskiy: I jsut thought you might want to get let's encrypt for www.domain.com while define external_lb_vip_address as just domain.com | 15:25 |
| noonedeadpunk | or well, not you personally, but anybody :D | 15:25 |
| anskiy | noonedeadpunk: AFAIR it does exactly this by default... | 15:27 |
| noonedeadpunk | ah, well, ok then :D It just didn't quite some time ago | 15:27 |
| anskiy | or not, at least not that certificate that I have. I wonder, why'd I thought it was doing that... | 15:30 |
| anskiy | anyways, I think, I can add that | 15:31 |
| noonedeadpunk | iirc for that you would need to set --domain www.domain.com,domain.com or create some conf file for certbot | 15:34 |
| noonedeadpunk | But don't really remember | 15:35 |
| anskiy | yeah, that's pretty much it | 15:46 |
| *** frenzyfriday|lunch is now known as frenzyfriday | 15:55 | |
| opendevreview | Danila Balagansky proposed openstack/openstack-ansible-haproxy_server master: Add variable for setting certbot `domains` option https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/857719 | 15:55 |
| anskiy | but I haven't tested that thing -_- | 16:09 |
| anskiy | I can split it, if you want | 16:10 |
| BobZ_Annapolis | Just had our OPS team ask me a good question - if a user interacts with the dashboard and removes a Security Group - where is this action captured / logged / etc ? thx | 16:32 |
| jamesdenton | You should see the HTTP request logged in the neutron-server logs, but AFAIK there is no audit trail built-in. Would love to be corrected on that, though | 16:37 |
| jamesdenton | You might be better served implementing custom roles that disallow that action | 16:38 |
| *** dviroel|lunch is now known as dviroel | 16:43 | |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone stable/xena: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/857749 | 17:55 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone stable/wallaby: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/857751 | 17:57 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone stable/victoria: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/857752 | 17:58 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_barbican stable/xena: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/857753 | 17:59 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_barbican stable/wallaby: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/857754 | 18:00 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_barbican stable/victoria: Rename TLSv1.0 to TLSv1 in apache config https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/857755 | 18:00 |
| ThiagoCMC | Folks, in ml2_conf.ini, my vni_ranges is empty, under [ml2_type_geneve], is it ok? | 18:23 |
| jamesdenton | ThiagoCMC should be fine if you don't anticipate creating geneve networks, unless neutron-server expects some value there and won't start without it | 18:54 |
| jamesdenton | but for that config to appear i would expect network_geneve_ranges to be defined and potentially have *some* value | 18:55 |
| *** kleini_ is now known as kleini | 19:30 | |
| *** dviroel is now known as dviroel|afk | 20:26 | |
| opendevreview | Merged openstack/openstack-ansible-galera_server master: Add the ability to specify custom additional galera users https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/857090 | 22:06 |
| *** dviroel|afk is now known as dviroel | 22:12 | |
| *** dviroel is now known as dviroel|afk | 22:52 | |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!