| *** mhen_ is now known as mhen | 01:45 | |
| opendevreview | Josephine Seifert proposed openstack/glance-specs master: Update image encryption spec https://review.opendev.org/c/openstack/glance-specs/+/964755 | 09:31 |
|---|---|---|
| rosmaita | croelandt: around? | 12:06 |
| rosmaita | glancers: caracal is supposed to go to unmaintained status today ... as you may remember from the last 2 weekly meetings, there were a few changes we wanted to get in there before doing a final release | 13:41 |
| rosmaita | unfortunately, the dalmatian gate is blocked, and the fix for that (on the zuul side) hasn't merged yet | 13:41 |
| rosmaita | plus, it is not obvious to me that it's worth having https://review.opendev.org/c/openstack/glance_store/+/961871 in caracal if we don't also have https://review.opendev.org/c/openstack/glance_store/+/962223 | 13:41 |
| rosmaita | and there is no way that 962223 will make it to F->E->D->C today | 13:41 |
| rosmaita | so, i will redo the release patches to do final caracal release from current stable/2024.1 HEAD and update the epoxy and dalmatian release patches to make sure everything in the final C release is also in D and E releases | 13:41 |
| rosmaita | i don't think there's anything relevant in flamingo, but i will do a quick check, so most likely no release from F | 13:41 |
| rosmaita | just making my plan explicit here; if there are any objections, you need to let me know in like the next 5 min (i think the release team meets at 1400 utc today) | 13:41 |
| abhishek_ | +1 for not backporting | 14:03 |
| clarkb | because its worth noting the issue with the CI jobs has been around since at least March. Yes, the fix needs to go in zuul-jobs but it has been ignored for ~7 months | 14:04 |
| rosmaita | clarkb: agree, it's our fault for not noticing the broken gate | 14:20 |
| rosmaita | anyway, turns out that only 2 of the 4 release patches needed to be revised | 14:21 |
| clarkb | I'm hopeful someone will be the second reviewer on the zuul-jobs fix today too | 14:21 |
| rosmaita | but all 4 could use +1s from the PTL (or at least a sanity check on the hashes) | 14:22 |
| rosmaita | https://review.opendev.org/c/openstack/releases/+/963608 plus the 3 parent patches in the "Relation change" | 14:22 |
| rosmaita | croelandt: ^^ | 14:23 |
| rosmaita | btw, zuul is going to put a -1 on https://review.opendev.org/c/openstack/releases/+/963608 , but that's because it has a reference to a tag that doesn't exist yet | 14:25 |
| opendevreview | Abhishek Kekane proposed openstack/glance master: Lazy update S3 URL on credential rotation https://review.opendev.org/c/openstack/glance/+/963875 | 14:35 |
| dansmith | croelandt: ready for your re-review and (obviously) +W ^ :) | 14:36 |
| dansmith | croelandt: let me also re-direct your attention to this: https://review.opendev.org/c/openstack/glance/+/963868 | 15:20 |
| croelandt | rosmaita: looking at the release patches | 15:33 |
| * croelandt also makes a note to discuss the state of stable patches during PTG | 15:33 | |
| rosmaita | great! i am here if you have questions | 15:33 |
| croelandt | Should we blame the Glance PTL for not taking better care of the stable branches? Who's that guy anyway? | 15:33 |
| rosmaita | well, we wouldn't notice until we tried to merge something | 15:34 |
| rosmaita | so maybe it's a tribute to the inherent stability of the glance code | 15:34 |
| croelandt | yeah but I think a bunch of these patches should have been proposed and reviewed earlier | 15:34 |
| rosmaita | well, there is that | 15:35 |
| croelandt | maybe we should set up a "stable" meeting like a week before every release | 15:35 |
| croelandt | no one gets out before the branches are perfect | 15:35 |
| croelandt | rosmaita: https://review.opendev.org/c/openstack/releases/+/963608/2 is the reformatting in glance.yaml intentional? | 15:37 |
| rosmaita | guess so ... it was already there in the bot-proposed patch | 15:37 |
| opendevreview | Rajat Dhasmana proposed openstack/glance master: WIP: Avoid multiple downloads to cache https://review.opendev.org/c/openstack/glance/+/964796 | 15:37 |
| rosmaita | croelandt: i could make one of these for glance: http://tiny.cc/cinder-maintained | 15:39 |
| rosmaita | makes it easier to see the proposed backports | 15:40 |
| croelandt | rosmaita: yeah, I'm thinking of having a script that also goes through the bugfixes in master and check whether they're in stable/whatever | 15:43 |
| croelandt | so we don't forget to propose backports if they make sense | 15:43 |
| croelandt | but then yeah, being able to view them all is nice | 15:44 |
| rosmaita | croelandt: http://tiny.cc/glance-maintained | 15:59 |
| croelandt | it is beautiful | 16:11 |
| croelandt | who can overwrite that tiny.cc URL? | 16:11 |
| croelandt | oh I guess you're registered | 16:11 |
| croelandt | inspector.__str__.return_value = format that worked weirdly iirc | 16:18 |
| croelandt | dansmith: but ok, let's merge this :) | 16:18 |
| dansmith | croelandt: not sure what you mean | 16:19 |
| croelandt | dansmith: https://review.opendev.org/c/openstack/glance/+/963868/1..3/glance/tests/unit/test_store_image.py#b423 it was really weird that it worked even after removingthat line | 16:25 |
| dansmith | croelandt: it's because it doesn't care what the two things are if they're not iso+gpt, then it's invalid | 16:31 |
| dansmith | iso+iso is also not valid | 16:32 |
| opendevreview | Merged openstack/glance master: Handle images detected as ISO+GPT https://review.opendev.org/c/openstack/glance/+/963868 | 18:22 |
| tt | Hello, I have a policy set that disallows non-admins but allows service users to download an image which works until nova tries to boot with the same image but a different flavor. Are there other properties that may be causing the 403's that i'm overlooking here? | 18:23 |
| tt | "download_image": "rule:context_is_admin or rule:service_api or (role:member and (project_id:%(project_id)s or project_id:%(member_id)s))" This blocks downloading as expected and I am able to boot an instance with one set of flavors but not the other. I'm unsure what i'm overlooking here and would greatly appreciate any direction | 18:26 |
| abhishekk_ | Are you trying to boot from same image? | 18:31 |
| tt | Yes, only difference is the flavor. | 18:31 |
| tt | If i remove this rule then both scenarios work as expected | 18:31 |
| abhishekk_ | Ack, need to check what’s happening, ideally this should not happen | 18:33 |
| abhishekk_ | Is flavor public or private? | 18:33 |
| abhishekk_ | Or is it associated for specific projects? In that case it should reject | 18:34 |
| tt | Flavor is marked as public. I don't believe it's associated with a specific project. Will have to verify that one | 18:37 |
| abhishekk_ | @croelandt: could you please look at s3 rotation patch | 18:38 |
| abhishekk_ | Ack, that’s the only way it might be rejecting the boot | 18:38 |
| tt | Doesn't appear to be associated with a particular project and is indeed marked "os-flavor-access:is_public": true | 18:39 |
| abhishekk_ | Ack, will check for it but it will take some time as I am in different TZ | 18:41 |
| tt | That's what I figured but it throws a 403 with no real detail in debug logs unfortunately. I'll do some more digging, maybe this flavor set was created in a special manner that is causing problems somehow. Thank you for the response! | 18:42 |
| abhishekk_ | May be if you have env then you can try logging the policy string to check what it is trying to enforce (i think you can enable debug logs for oslo.policy and check as well) | 18:43 |
| tt | Ah, great idea I will attempt to give that a go! Thank you! | 18:47 |
| abhishekk_ | What is the visibility of image | 18:58 |
| abhishekk_ | You are trying to boot from? | 18:58 |
| tt | The image visibility is public as well | 19:05 |
| tt | it is using swift as backend store, thinking maybe that has something to do with it? But things just aren't adding up for me if it works just fine with one flavor | 19:07 |
| abhishekk_ | Nope nothing to do with backend | 19:07 |
| tt | ack | 19:07 |
| abhishekk_ | What is the disk size in flavor | 19:10 |
| tt | looks like someone decided to break the env, can't pull it up atm but I believe it should be 40 | 19:14 |
| abhishekk_ | Ack | 19:15 |
| tt | yeah, ovn upgrade or something along those lines. Looks like my debugging is on pause :) Thanks for the responses here. I'll verify the disk and get back when things are back up. Thanks again! | 19:19 |
| abhishekk_ | No problem | 19:20 |
Generated by irclog2html.py 4.0.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!