| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-haproxy_server stable/2023.1: Fix `regen pem` with `extra_lb_tls_vip_addresses` https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888084 | 08:28 |
|---|---|---|
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/rocky: Transition Rocky to EOL https://review.opendev.org/c/openstack/openstack-ansible/+/888122 | 09:29 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible stable/rocky: Transition Rocky to EOL https://review.opendev.org/c/openstack/openstack-ansible/+/888122 | 09:51 |
| noonedeadpunk | would be great if we could fast land ^ | 10:17 |
| jrosser | done | 10:47 |
| opendevreview | Merged openstack/openstack-ansible stable/rocky: Transition Rocky to EOL https://review.opendev.org/c/openstack/openstack-ansible/+/888122 | 10:53 |
| opendevreview | Merged openstack/openstack-ansible-plugins master: Skip updating service password by default https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/886458 | 12:01 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins stable/2023.1: Skip updating service password by default https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/888152 | 12:07 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins stable/zed: Skip updating service password by default https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/888153 | 12:07 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-plugins stable/yoga: Skip updating service password by default https://review.opendev.org/c/openstack/openstack-ansible-plugins/+/888154 | 12:08 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/888132 | 12:38 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/888132 | 12:40 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/888132 | 12:48 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-galera_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/888132 | 12:49 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [DNM] Bump ansible-core to 2.15.1 and collections https://review.opendev.org/c/openstack/openstack-ansible/+/886527 | 12:51 |
| NeilHanlon | o/ gday folks. I'll be missing this week's meeting--have movers in the apartment right now to move my furniture to my new place. | 13:40 |
| NeilHanlon | will read minutes later ☺ | 13:40 |
| mgariepy | good luck with the moving part :) | 13:40 |
| NeilHanlon | thanks :) we've been cleaning and painting and moving for a week and still somehow have so much crap left. | 13:41 |
| mgariepy | lol. yep | 13:42 |
| mgariepy | moving to a house ? | 13:42 |
| NeilHanlon | yep! so I have so much more room to buy more crap!! | 13:42 |
| mgariepy | and accumulate them ! | 13:42 |
| NeilHanlon | and hopefully never move | 13:43 |
| mgariepy | hahah you'll let your kid do the cleaning in 60 years ;p | 13:43 |
| NeilHanlon | I just did the math on that and I don't like it | 13:44 |
| mgariepy | haha i really have no idea how old you are.. my guess was probably a bit low.. | 13:45 |
| NeilHanlon | I'm only (?) 28 | 13:55 |
| NeilHanlon | I feel old though, if that counts for anything | 13:55 |
| NeilHanlon | as the kids today would say, I was born in the late 1900s | 13:56 |
| mgariepy | lol. | 14:03 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [DNM] Bump ansible-core to 2.15.1 and collections https://review.opendev.org/c/openstack/openstack-ansible/+/886527 | 14:11 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [DNM] Bump ansible-core to 2.15.1 and collections https://review.opendev.org/c/openstack/openstack-ansible/+/886527 | 14:33 |
| opendevreview | Danila Balagansky proposed openstack/openstack-ansible-os_ceilometer master: Enable Ceilometer resource cache https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/888032 | 14:46 |
| mgariepy | hey jrosser | 14:58 |
| mgariepy | did you had an idea how to template the multiple certs stuff for haproxy ? | 14:58 |
| jrosser | o/ hello | 14:58 |
| jrosser | like per frontend? | 14:59 |
| mgariepy | my use case is : 2 external vip for 2 differnt domaines | 14:59 |
| mgariepy | one with api.example.com and the other with object.example.com | 15:00 |
| jrosser | yes i've never done that with just one haproxy | 15:00 |
| jrosser | we have something very similar but on separate hosts | 15:00 |
| noonedeadpunk | I think you can place all certs in one file and haporxy then finds out which one is correct? | 15:01 |
| jrosser | ah right if you bind to the fqdn it can parse them? | 15:01 |
| mgariepy | not sure the cert req will be on different domain name. | 15:01 |
| noonedeadpunk | as it treats this certs file as a keystore | 15:01 |
| noonedeadpunk | yeah, I think binding to fqdn has smth to do with that, but 100% sure | 15:02 |
| noonedeadpunk | it shouldn't really care which domain name it's on | 15:02 |
| jrosser | mgariepy: is this a LE question, or a "how to pass two certs to haproxy role" question? | 15:02 |
| noonedeadpunk | just try placing everything together :) | 15:02 |
| noonedeadpunk | oh, no idea about LE | 15:02 |
| noonedeadpunk | #startmeeting openstack_ansible_meeting | 15:03 |
| opendevmeet | Meeting started Tue Jul 11 15:03:03 2023 UTC and is due to finish in 60 minutes. The chair is noonedeadpunk. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:03 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:03 |
| opendevmeet | The meeting name has been set to 'openstack_ansible_meeting' | 15:03 |
| noonedeadpunk | #topic rollcall | 15:03 |
| noonedeadpunk | o/ | 15:03 |
| damiandabrowski | mgariepy: FYI, not sure if it's exactly the same thing you want to achieve, but docs say it's not supported | 15:03 |
| damiandabrowski | https://docs.openstack.org/openstack-ansible/latest/user/security/index.html#:~:text=When%20enabled%20haproxy%20will%20use%20the%20same%20TLS%20certificate%20on%20all%20interfaces%20(internal%20and%20external).%20It%20is%20not%20currently%20possible%20in%20OpenStack%2DAnsible%20to%20use%20different%20self%2Dsigned%20or%20user%2Dprovided%20TLS%20certificates%20on%20different%20haproxy%20interfaces. | 15:03 |
| damiandabrowski | hi! | 15:03 |
| mgariepy | hey | 15:04 |
| noonedeadpunk | I actually have exactly same usecase as you mgariepy, or well, "I", I know folks who needs the same :) | 15:04 |
| noonedeadpunk | #topic office hours | 15:05 |
| mgariepy | we can talk after the meeting then ;) | 15:05 |
| noonedeadpunk | SO I worked a bit on quorum-queues, and things looks quite green | 15:05 |
| noonedeadpunk | But I don't really like workarounds that had to take place for that | 15:05 |
| noonedeadpunk | especially, for Nova | 15:06 |
| noonedeadpunk | as it appears we're messing up with template for cells, by adding extra `/`, as these got parsed out from config | 15:06 |
| noonedeadpunk | likely nova bug, but not sure if it was even reported | 15:07 |
| noonedeadpunk | talking about this https://opendev.org/openstack/openstack-ansible-os_nova/src/branch/master/tasks/nova_db_setup.yml#L53 | 15:07 |
| noonedeadpunk | so had to add nasty logic with nova_migrate_cell_quorum_vhost: https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/887849/4/tasks/nova_db_setup.yml | 15:08 |
| noonedeadpunk | but feel free to review that: https://review.opendev.org/q/topic:osa%252Fquorum_queues | 15:08 |
| noonedeadpunk | I will be able to push patches to rest of the roles during the week if this looks like fair approach | 15:09 |
| noonedeadpunk | Next thing I'm working on - update of linters, and that's /o\ | 15:10 |
| noonedeadpunk | Was able to get 2/5 stars :D | 15:10 |
| jrosser | so many errors :( | 15:10 |
| damiandabrowski | noonedeadpunk: this workaround isn't that bad IMO, maybe we can live with this :D | 15:10 |
| noonedeadpunk | I also wonder how getting rid of leading / in vhost names will affect monitoring toolset in deployments | 15:12 |
| noonedeadpunk | As I can easily assume things being hardcoded and being relied on this `/` | 15:12 |
| noonedeadpunk | yeah, there're plenty errors in linter, and really a lot of them are valid, to be fair | 15:13 |
| noonedeadpunk | I will invest some time in going through roles and patching them with new linter requirements, it's super time-consuming though... | 15:14 |
| noonedeadpunk | Also I've spotted, that we're quite inconsistent in playbooks regarding haproxy-endpoints-manage, unbound-clients and prepare-lxc-containers (or smth) | 15:14 |
| jrosser | do you run the linters tox job to work on this locally? | 15:14 |
| noonedeadpunk | Nah, I just run ansible-lint against role folder, excluding tests | 15:15 |
| jrosser | ahha ok | 15:15 |
| noonedeadpunk | but I have collections installed locally as well - that kinda requirement | 15:15 |
| noonedeadpunk | And sourcing some things from openstack-ansible.rc | 15:16 |
| noonedeadpunk | so do smth like `ansible-lint ../haproxy_server/ --exclude ../haproxy_server/tests/` | 15:16 |
| mgariepy | sounds simple enough.. | 15:16 |
| noonedeadpunk | It's not hard, it's time-consuming due to number of roles and issues | 15:17 |
| jrosser | maybe we can crowd-source this a bit | 15:17 |
| noonedeadpunk | that would be nice | 15:17 |
| mgariepy | can we split via a etherpad or something ? | 15:17 |
| noonedeadpunk | will create one | 15:18 |
| spotz[m] | o/ | 15:18 |
| noonedeadpunk | #link https://etherpad.opendev.org/p/osa-6.17-linters | 15:21 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: [DNM] Bump ansible-core to 2.15.1 and collections https://review.opendev.org/c/openstack/openstack-ansible/+/886527 | 15:22 |
| noonedeadpunk | another good catch by damiandabrowski, is that not working triggering handlers from handlers is a bug, not a feature :) | 15:22 |
| noonedeadpunk | so with 2.15.2 this should be fixed | 15:23 |
| noonedeadpunk | as we use that more then just in galera role | 15:23 |
| noonedeadpunk | Ah.... Also I've used my patch for 6.17.2 of ansible-lint, to overcome issue in integrated repo, where gather_facts can't be a variable. It's already merged to linters | 15:25 |
| noonedeadpunk | https://github.com/ansible/ansible-lint/pull/3606 | 15:26 |
| noonedeadpunk | I don't have any progress on PKI pipe thingy yet :( | 15:30 |
| damiandabrowski | I have a question, where can we save etherpad describing TLS performance impact for a future reference? Just to not forget why we decided not to enable it by default :D | 15:30 |
| damiandabrowski | https://etherpad.opendev.org/p/openstack-ansible-tls-performance-impact | 15:30 |
| noonedeadpunk | our wiki?) | 15:31 |
| damiandabrowski | i still can't login to wiki and INFRA team is not really willing to help :D can you do that please? | 15:31 |
| damiandabrowski | (but they confirmed that they saw this issue before and never fixed it) | 15:31 |
| noonedeadpunk | added to https://wiki.openstack.org/wiki/OpenStack-Ansible#Etherpads | 15:32 |
| damiandabrowski | thanks! | 15:32 |
| noonedeadpunk | anything else we wanna to talk about? | 15:41 |
| mgariepy | can you had the steps to run the linter in the etherpad ? | 15:42 |
| mgariepy | just to streamline the some sourcing and stuff a bit :D | 15:43 |
| mgariepy | thanks a lot. | 15:45 |
| noonedeadpunk | Will do that | 15:46 |
| mgariepy | it's all for me. :) | 15:47 |
| noonedeadpunk | ok, will end up then slightly early | 15:48 |
| noonedeadpunk | #endmeeting | 15:48 |
| opendevmeet | Meeting ended Tue Jul 11 15:48:37 2023 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:48 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-07-11-15.03.html | 15:48 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-07-11-15.03.txt | 15:48 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/openstack_ansible_meeting/2023/openstack_ansible_meeting.2023-07-11-15.03.log.html | 15:48 |
| mgariepy | haproxy seems to be able to load certs from a directory ! | 15:49 |
| mgariepy | i'll do some tests and submit a patch for haproxy LE stuff. | 15:59 |
| mgariepy | afterlunch :D | 15:59 |
| noonedeadpunk | (I still can reall it was able to load just from single file as well) | 16:01 |
| mgariepy | yeah it was like that before they added support for the .d directory :D | 16:03 |
| mgariepy | https://discourse.haproxy.org/t/use-set-ssl-cert-with-cert-directory/5193/2 | 16:03 |
| mgariepy | something like that would be nice tho | 16:03 |
| mgariepy | instead of relaoding haproxy your probably can only do the 2 commands to update the cert. set ssl and commit. | 16:04 |
| mgariepy | then update the file for the restart/ reboot | 16:04 |
| mgariepy | we do have multiple pems files right now so i guess having a 3rd one won't be too bad anyway | 16:08 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-haproxy_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/888143 | 16:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-memcached_server master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-memcached_server/+/888146 | 17:31 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-memcached_server master: [doc] Document how to use "local" memcached https://review.opendev.org/c/openstack/openstack-ansible-memcached_server/+/888148 | 18:19 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_keystone stable/2023.1: Fix SSL logic in keystone-httpd.conf.j2 https://review.opendev.org/c/openstack/openstack-ansible-os_keystone/+/888158 | 18:23 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible stable/2023.1: Remove support for 'tls-transition' scenario https://review.opendev.org/c/openstack/openstack-ansible/+/887866 | 18:24 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Gather facts before including common-playbooks https://review.opendev.org/c/openstack/openstack-ansible/+/888149 | 19:05 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-apt_package_pinning master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-apt_package_pinning/+/888172 | 19:20 |
| opendevreview | Amy Marrich proposed openstack/openstack-ansible-memcached_server master: [doc] Document how to use "local" memcached https://review.opendev.org/c/openstack/openstack-ansible-memcached_server/+/888148 | 19:22 |
| noonedeadpunk | thanks Amy! | 19:31 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible-os_nova master: Deprecate nova_ram_weight_multiplier https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/888177 | 19:36 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-lxc_container_create master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-lxc_container_create/+/888179 | 19:43 |
| opendevreview | Amy Marrich proposed openstack/openstack-ansible-memcached_server master: [doc] Document how to use "local" memcached https://review.opendev.org/c/openstack/openstack-ansible-memcached_server/+/888148 | 19:46 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-lxc_hosts master: Fix linters issue and metadata https://review.opendev.org/c/openstack/openstack-ansible-lxc_hosts/+/888180 | 19:56 |
| opendevreview | Amy Marrich proposed openstack/openstack-ansible-memcached_server master: [doc] Document how to use "local" memcached https://review.opendev.org/c/openstack/openstack-ansible-memcached_server/+/888148 | 20:07 |
| spotz[m] | stupid lines too long:) | 20:07 |
| mgariepy | it needs to fit in a 80char terminal :P | 20:08 |
| spotz[m] | Yeah but it used to be if you were on the left side of the line in the editor you were good:) | 20:28 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!