| *** rlandy|bbl is now known as rlandy|out | 00:03 | |
| *** ysandeep|out is now known as ysandeep|rover | 01:21 | |
| *** ysandeep|rover is now known as ysandeep|rover|bbl | 02:08 | |
| *** dasm|bbl is now known as dasm|off | 03:40 | |
| *** bhagyashris|out is now known as bhagyashris | 03:58 | |
| *** ysandeep|rover|bbl is now known as ysandeep|rover | 04:23 | |
| *** soniya29 is now known as soniya29|ruck | 04:51 | |
| opendevreview | Pranali Deore proposed openstack/openstack-zuul-jobs master: Update python testing as per zed cycle testing runtime https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/841368 | 06:39 |
|---|---|---|
| opendevreview | Pranali Deore proposed openstack/openstack-zuul-jobs master: Update python testing as per zed cycle testing runtime https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/841368 | 06:46 |
| *** ysandeep|rover is now known as ysandeep|rover|brb | 07:29 | |
| *** soniya is now known as soniya|ruck | 07:40 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 07:40 | |
| *** soniya|ruck is now known as soniya|ruck|dinner | 07:51 | |
| *** soniya|ruck|dinner is now known as soniya|ruck|lunch | 07:53 | |
| *** ysandeep|rover is now known as ysandeep|rover|lunch | 08:01 | |
| opendevreview | Bar hochman proposed openstack/pbr master: fix: check for the installed version of importlib_metadata and use it only if pbr supports it. bug-report: https://bugs.launchpad.net/pbr/+bug/1972975 Change-Id: If67caac8d7ee7d5f22d0c6d262582b432d3370d1 https://review.opendev.org/c/openstack/pbr/+/841222 | 08:51 |
| *** soniya|ruck|lunch is now known as soniya|ruck | 08:56 | |
| *** ysandeep|rover|lunch is now known as ysandeep|rover | 09:02 | |
| opendevreview | daniel.pawlik proposed openstack/ci-log-processing master: DNM Checking Zuul stdout issue https://review.opendev.org/c/openstack/ci-log-processing/+/841388 | 09:21 |
| opendevreview | daniel.pawlik proposed openstack/ci-log-processing master: DNM Checking Zuul stdout issue https://review.opendev.org/c/openstack/ci-log-processing/+/841388 | 09:33 |
| *** jpena|off is now known as jpena | 09:39 | |
| opendevreview | likui proposed openstack/openstack-zuul-jobs master: The Python 3.6 Support has been dropped since zed for charm https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/841390 | 09:43 |
| opendevreview | daniel.pawlik proposed openstack/ci-log-processing master: DNM Checking Zuul stdout issue https://review.opendev.org/c/openstack/ci-log-processing/+/841388 | 09:44 |
| dpawlik | fungi, clarkb: hey, this is also not affecting you https://review.opendev.org/c/openstack/ci-log-processing/+/841388/ ? | 09:49 |
| *** bhagyashris_ is now known as bhagyashris | 11:03 | |
| *** rlandy|out is now known as rlandy | 11:21 | |
| fungi | dpawlik: is what not affecting us? that just looks like an example of setting no_log on an ansible task | 11:27 |
| *** dviroel|out is now known as dviroel | 11:31 | |
| *** ysandeep|rover is now known as ysandeep|rover|brb | 11:32 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 11:37 | |
| *** dasm|off is now known as dasm | 11:46 | |
| *** ysandeep|rover is now known as ysandeep|rover|mtg | 11:55 | |
| opendevreview | Tristan Cacqueray proposed openstack/ci-log-processing master: DNM Checking Zuul stdout issue https://review.opendev.org/c/openstack/ci-log-processing/+/841388 | 12:05 |
| dpawlik | fungi: so result of that tasks https://review.opendev.org/c/openstack/ci-log-processing/+/841388/4/ansible/playbooks/bcrypt.yml#8 should be message with message b64 | 12:13 |
| dpawlik | when no_log is set, it does not print and it is just unset | 12:14 |
| fungi | dpawlik: i don't think we've tried that (we use no_log very rarely in zuul playbooks, usually just around places where zuul secrets are accessed) | 12:23 |
| fungi | looking in opendev/base-jobs and openstack/project-config, the only uses of no_log are in post-run playbooks handling swift upload credentials | 12:25 |
| fungi | https://opendev.org/opendev/base-jobs/src/branch/master/playbooks/base/post-logs.yaml#L12 | 12:26 |
| *** ysandeep|rover|mtg is now known as ysandeep|rover | 12:37 | |
| dpawlik | em, it should not affect | 13:08 |
| fungi | yeah, i'm not surprised that no_log interferes with accessing stdout from a command | 13:10 |
| *** ysandeep|rover is now known as ysandeep|rover|brb | 13:21 | |
| *** ysandeep|rover|brb is now known as ysandeep|rover | 13:31 | |
| *** bhagyashris_ is now known as bhagyashris | 13:33 | |
| clarkb | it is my understanding that that is what no_log is expected to do otherwise you'll record the secret in the json file at the very least and that would be bad | 14:41 |
| clarkb | anyway I've left a comment on the zuul change asking for clarification and providing feedback on the implementation should we decide to proceed with it | 14:41 |
| fungi | yeah, my hope is that adding tests will be able to prove whether it's safe | 14:45 |
| *** soniya|ruck is now known as soniya|out | 15:05 | |
| *** dviroel is now known as dviroel|lunch | 15:09 | |
| dpawlik | clarkb: What about the tempaltes? | 15:09 |
| dpawlik | templates* | 15:09 |
| clarkb | I'm not sure I understand the question. Which templates? | 15:10 |
| dpawlik | clarkb: in the PoC PS there are few things that are affected by no log | 15:11 |
| dpawlik | so if some command like uuidgen were registered, then you set is as fact, then you want to use template, you will got empty messagw | 15:11 |
| dpawlik | clarkb: so for example, https://softwarefactory-project.io/paste/show/2213/ | 15:12 |
| dpawlik | hash should be filled, not empty | 15:12 |
| dpawlik | and normally ansible is putting that value there, where zuul is removing | 15:12 |
| clarkb | right, but does zuul not removing it expose the information publicly? That is what zuul is attempting to guard against | 15:13 |
| clarkb | specifically via the ansible json log file that zuul records | 15:13 |
| dpawlik | clarkb: ah | 15:17 |
| dpawlik | clarkb: so very basic ansible playbook that is just printing an echo text that was registered in the task is impossible to read, because zuul does not allow for that | 15:18 |
| dpawlik | seems to be a bug for me | 15:18 |
| dpawlik | secrets should be in other box | 15:19 |
| dpawlik | than registered variables | 15:19 |
| dpawlik | but I agree, someone can do an echo on sensitive variables, register and expose it | 15:19 |
| *** ysandeep|rover is now known as ysandeep|rover|out | 15:26 | |
| fungi | does setting no_log under normal ansible not also break that? zuul's command.py is essentially a fork of code from ansible | 15:26 |
| fungi | i haven't looked to see how far the no_log handling has diverged though | 15:27 |
| clarkb | fungi: this specific portion of the code is different than upstream ansible in order to tail the log without blocking | 15:31 |
| fungi | yeah, i just don't know how much of what's there regarding no_log handling is taken from upstream ansible | 15:32 |
| fungi | and whether this particular stdout filtering behavior is also present in ansible itself | 15:32 |
| jrosser | i don't think that it is | 15:32 |
| jrosser | https://paste.opendev.org/show/bIJUvEhlY9YMk141pl2b/ | 15:33 |
| fungi | from the zuul side of things, i'm happy for task stdout handling to be as close as possible to ansible's own behaviors, so long as we can do it in a safe way in order to avoid leaking sensitive data in logs | 15:34 |
| clarkb | right this portion of the code is different so that you can get a live console log. Ansible proper blocks and reads the info at the end | 15:35 |
| clarkb | then separately we have to handle no_log in a way that makes sense for the ansible json recording | 15:35 |
| clarkb | It is possible that this handling isn't necessary and ansible filters that separately, but I believe that was the intent here | 15:35 |
| clarkb | but also this discussion should happen in #zuul | 15:35 |
| fungi | or on 841418 | 15:36 |
| *** dviroel|lunch is now known as dviroel | 16:03 | |
| opendevreview | Merged openstack/pbr master: Adding python classifiers py38 & py39 https://review.opendev.org/c/openstack/pbr/+/840633 | 16:09 |
| *** jpena is now known as jpena|off | 17:01 | |
| *** dviroel is now known as dviroel|afk | 20:53 | |
| *** timburke__ is now known as timburke | 21:00 | |
| *** dasm is now known as dasm|off | 21:02 | |
| *** rlandy is now known as rlandy|bbl | 22:08 | |
| opendevreview | Merged openstack/openstack-zuul-jobs master: infra-deb-ppa-push: push to production repos https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/840572 | 23:16 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!