| *** NewJorg_ is now known as NewJorg | 05:06 | |
| jrosser | good morning | 07:47 |
|---|---|---|
| damiandabrowski | hi! | 08:15 |
| damiandabrowski | jrosser: can you please have a look here? you never replied to my answer :D https://review.opendev.org/c/openstack/openstack-ansible/+/885194 | 08:15 |
| admin1 | \o | 08:30 |
| noonedeadpunk | mornings | 09:52 |
| * noonedeadpunk catching up with what I've missed during last week | 09:52 | |
| jrosser | damiandabrowski: i think my comment really was from the code not being obvious what it is doing just from the var names | 09:53 |
| jrosser | when you read this `{% if lookup('env', 'UPGRADE_TARGET_BRANCH') == '' %}` it is not clear what is happening without understanding/remembering lots about how the test vars work | 09:54 |
| derekokeeffe | Morning all. Could anyone shed some light on this https://paste.openstack.org/show/bU1E0joDdf4eWiV8wjlj/ maybe you might know noonedeadpunk as you have it working. What crypto plugin is it looking for? | 10:14 |
| derekokeeffe | Please of course | 10:14 |
| noonedeadpunk | derekokeeffe: what do you have in your config? | 10:17 |
| derekokeeffe | Chrystoki.conf? | 10:17 |
| noonedeadpunk | nah, barbican_backends_config | 10:18 |
| noonedeadpunk | specifically value of `secret_store_plugin` | 10:19 |
| derekokeeffe | Ah ok, two sec | 10:19 |
| derekokeeffe | There you go noonedeadpunk https://paste.openstack.org/show/bxLxTmA8WiTwkZ61DHvQ/ | 10:21 |
| noonedeadpunk | hm | 10:26 |
| noonedeadpunk | derekokeeffe: is that error raised when admin creates a secret or a user? | 10:29 |
| noonedeadpunk | though it shouldn't matter... | 10:30 |
| noonedeadpunk | as maybe the user just missing required role to store keys? | 10:31 |
| Karni | Does Source Nat only happen on network nodes? | 10:37 |
| Karni | If I send traffic from an instance on Comp1 to another instance on Comp2, while they are in different tenants, traffics goes through network nodes. True? | 10:37 |
| Karni | What If thoes two instances be in the same tenant? Then the traffic won't go to the network nodes, right? | 10:38 |
| derekokeeffe | Sorry noonedeadpunk, laptop needed to be restarted. when I do openstack secret store --name mysecret1 --payload testPayload or openstack volume create --size 1 --type LUKS 'encrypted volume I get that error | 10:39 |
| noonedeadpunk | derekokeeffe: you do that as user or admin? | 10:41 |
| jrosser | Karni: have you done an experiment with iperf or something to generate a lot of traffic and see where it goes? | 10:41 |
| noonedeadpunk | As in case of user, my guess would be that the user don't have required role assigned to use barbican | 10:41 |
| noonedeadpunk | https://docs.openstack.org/barbican/latest/admin/access_control.html#default-policy | 10:42 |
| jrosser | Karni: this really is all about how OVN works (if thats what you are using), see https://www.ovn.org/support/dist-docs/ovn-architecture.7.html | 10:42 |
| noonedeadpunk | derekokeeffe: what we did was to make `creator` role as implied to `member` | 10:42 |
| Karni | jrosser: I used `iperf`, but didn't track it; Actually the system is in production and it's to track where the traffic goes as there are ather traffics too. | 10:43 |
| Karni | Thanks for the link | 10:43 |
| derekokeeffe | I do that as admin from the utility container | 10:43 |
| derekokeeffe | Is there a link to show how to create a @creator@ role to make it work noonedeadpunk? | 10:45 |
| noonedeadpunk | IIRC it should be like that: openstack implied role create member --implied-role creator | 10:46 |
| derekokeeffe | Ok thanks for that noonedeadpunk, how do I then tell barbican that the 'creator' is the one cretaing the secret? | 10:49 |
| noonedeadpunk | It's a default role | 10:52 |
| noonedeadpunk | and with implied role you made all `member` to be also `creator` | 10:52 |
| noonedeadpunk | and admin implies member same way | 10:53 |
| derekokeeffe | Ah ok, I get ya now. Thanks noonedeadpunk | 10:54 |
| noonedeadpunk | does it work now?:) | 10:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_neutron stable/zed: Stop haproxy on ovn-controller nodes https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/893451 | 10:57 |
| derekokeeffe | Nope same thing "crypto plugin not found" | 11:06 |
| opendevreview | Damian Dąbrowski proposed openstack/openstack-ansible master: Add tls upgrade jobs https://review.opendev.org/c/openstack/openstack-ansible/+/885194 | 11:19 |
| damiandabrowski | jrosser: i added a comment that explains my intentions | 11:20 |
| noonedeadpunk | derekokeeffe: hm... that's quite weird.... | 11:36 |
| noonedeadpunk | derekokeeffe: you have [secretstore] / enabled_secretstore_plugins = store_crypto and [crypto] / enabled_crypto_plugins = p11_crypto in barbican.conf? | 11:44 |
| noonedeadpunk | and then `[p11_crypto_plugin]` section with library_path, slot_id and etc? | 11:45 |
| mgariepy | good morning everyone ! | 11:49 |
| noonedeadpunk | \o/ | 11:49 |
| derek__ | yep noonedeadpunk https://paste.openstack.org/show/bIOQaIYvGu8goUCmoAco/ I made sure the path exists as well | 12:32 |
| derek__ | my name got changed here for some reason | 12:33 |
| noonedeadpunk | huh.... I don't know then... | 12:53 |
| noonedeadpunk | To get answers I'd need to reporduce first and debug code afterwards | 12:54 |
| noonedeadpunk | and why this returns empty list: https://opendev.org/openstack/barbican/src/branch/master/barbican/plugin/crypto/manager.py#L118 | 12:55 |
| opendevreview | Merged openstack/openstack-ansible-galera_server stable/2023.1: Replace libgcc1 with libgcc-s1 for Debian https://review.opendev.org/c/openstack/openstack-ansible-galera_server/+/894596 | 13:03 |
| derek__ | Ok thanks noonedeadpunk, wonder would a reinstall make any difference in case I did something wrong | 13:08 |
| noonedeadpunk | nah, I don't think it will... It's some logical issue I don't get tbh | 13:08 |
| noonedeadpunk | At least I don't see any right now | 13:08 |
| noonedeadpunk | I also checked that things working properly in our lab with Antelope | 13:09 |
| derek__ | Ok so, thanks for taking a look noonedeadpunk | 13:09 |
| noonedeadpunk | maybe you can ask in barbican channel.... | 13:09 |
| noonedeadpunk | it's not very active, but still | 13:09 |
| noonedeadpunk | worth a shot | 13:09 |
| derek__ | Ok I'll try that so | 13:14 |
| semantic | Hello! We have faced high cpu usage by beam.smp (rabbitmq) on our hosts, deployed with openstack-ansible. We colocate different services including neutron, glance, nova, ceilometer and horizon on these hosts. High cpu usage may be solved by using the next parameter: RABBITMQ_SERVER_ADDITIONAL_ERL_ARGS="+sbwt none +sbwtdcpu none +sbwtdio none" /etc/rabbitmq/rabbitmq-env.conf file, and it seems this was already adopted by tripleo and kolla but | 13:31 |
| semantic | not by openstack-ansible. Maybe there were specific reasons for not adding the parameter, or somebody could advice against adding it? | 13:31 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-openstack_hosts master: Define mode for journald configuration file https://review.opendev.org/c/openstack/openstack-ansible-openstack_hosts/+/895681 | 13:32 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_glance master: Split lines to not exceed 160 characters limit https://review.opendev.org/c/openstack/openstack-ansible-os_glance/+/895682 | 13:38 |
| noonedeadpunk | semantic: hey | 13:41 |
| noonedeadpunk | I think, there's a hack that would allow to do same thing.... | 13:42 |
| noonedeadpunk | it's a hack though | 13:42 |
| noonedeadpunk | like define in user_variables.yml following: `rabbitmq_process_limit: "1048576 +sbwt none +sbwtdcpu none +sbwtdio none"` | 13:43 |
| noonedeadpunk | tbh I never looked into these flags and what they do. | 13:44 |
| noonedeadpunk | I think in my experience high load usually is directly connected to some queues without consumer, like some notification queue. As having millins of message in a queue always result in high cpu usage. | 13:51 |
| semantic | Yes, it would be understandable. But in our case high load exist virtually without any significant load, like 1-4 messages/s on just deployed openstack with just a couple of test VMs. | 13:54 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-rabbitmq_server master: Add ability to define extra arguments for erlang https://review.opendev.org/c/openstack/openstack-ansible-rabbitmq_server/+/895686 | 13:57 |
| noonedeadpunk | semantic: I've pushed the patch to explicitly support feature you're talking about ^ | 13:57 |
| noonedeadpunk | in the menawhile I believe the suggested workaround should just work | 13:59 |
| noonedeadpunk | such load is quite werid to be frank. We don't see anything really outstanding on our production deployments without these flags... | 14:07 |
| noonedeadpunk | So I guess we didn't have that as nobody asked for them before | 14:08 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_cinder master: Split lines to not exceed 160 characters limit https://review.opendev.org/c/openstack/openstack-ansible-os_cinder/+/895688 | 14:17 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_nova master: Split lines to not exceed 160 characters limit https://review.opendev.org/c/openstack/openstack-ansible-os_nova/+/895689 | 14:19 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible-core to 2.15.3 and ansible-lint https://review.opendev.org/c/openstack/openstack-ansible/+/892371 | 14:20 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible collection versions https://review.opendev.org/c/openstack/openstack-ansible/+/892373 | 14:20 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible-core to 2.15.3 and ansible-lint https://review.opendev.org/c/openstack/openstack-ansible/+/892371 | 14:21 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible collection versions https://review.opendev.org/c/openstack/openstack-ansible/+/892373 | 14:21 |
| jrosser | semantic: did you check the rabbitmq monitoring dashboard to see if you have a backlog of messages anywhere? | 14:25 |
| opendevreview | shahab taee proposed openstack/openstack-ansible-os_neutron stable/wallaby: Fix typo for vpnaas_custom_config distribution https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/895665 | 14:31 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_aodh master: Add quorum support for service https://review.opendev.org/c/openstack/openstack-ansible-os_aodh/+/895690 | 14:32 |
| opendevreview | shahab taee proposed openstack/openstack-ansible-os_neutron stable/xena: Fix typo for vpnaas_custom_config distribution https://review.opendev.org/c/openstack/openstack-ansible-os_neutron/+/895666 | 14:32 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_barbican master: Add quorum support for service https://review.opendev.org/c/openstack/openstack-ansible-os_barbican/+/895693 | 14:44 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_blazar master: Add quorum support for service https://review.opendev.org/c/openstack/openstack-ansible-os_blazar/+/895694 | 14:49 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible-os_ceilometer master: Add quorum support for service https://review.opendev.org/c/openstack/openstack-ansible-os_ceilometer/+/895696 | 15:16 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible-core to 2.15.3 and ansible-lint https://review.opendev.org/c/openstack/openstack-ansible/+/892371 | 17:23 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible-core to 2.15.3 and ansible-lint https://review.opendev.org/c/openstack/openstack-ansible/+/892371 | 17:24 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible collection versions https://review.opendev.org/c/openstack/openstack-ansible/+/892373 | 17:24 |
| opendevreview | Dmitriy Rabotyagov proposed openstack/openstack-ansible master: Bump ansible collection versions https://review.opendev.org/c/openstack/openstack-ansible/+/892373 | 17:25 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!