Thursday, 2024-11-14

opendevreviewMerged openstack/openstack-zuul-jobs master: Install fakeroot for openafs packaeg builds  https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/93502800:14
cardoeSo fungi, I'm being told that dealing with tags is hard in gerrit? https://review.opendev.org/c/openstack/openstack-helm/+/934013 the convo there around versioning the tarballs. I want them to be immutable for each version while today they get rebuilt and the contents changes which magically breaks.00:50
fungicardoe: that looks like a very long conversation. can you summarize what you mean by 1. "dealing with tags" and 2. "is hard in gerrit"01:01
fungitags are quite easy in gerrit. create a signed tag in git, push it to gerrit, it replicates to all the git mirrors instantaneously01:03
fungibut maybe "dealing with tags" has some additional context i'm missing, and "is hard in gerrit" actually means "is hard in something else that's not gerrit but gerrit is the closest word i have for it"?01:04
cardoeSo can I have one part push a tag and then trigger a job with that tag as the ref?01:05
cardoeI'm honestly learning zuul as I go right now.01:05
fungiyes, we have a "tag" pipeline in zuul which reacts to any tag that appears on a project01:06
cardoeI wanna actually setup something similar to what mnaser has done with vexxhost and atmosphere in zuul.01:06
cardoeBut that's a different effort.01:06
cardoeGot a link handy for the tag pipeline?01:07
fungiwhat kind of link? a link to where it's defined in the openstack zuul tenant's configuration?01:07
fungihttps://opendev.org/openstack/project-config/src/branch/master/zuul.d/pipelines.yaml#L306-L32001:08
fungithe openstack tenant's pipelines are all defined in that file, for future reference01:09
cardoeThank you.01:12
fungithe tag pipeline mainly gets used to run release notes jobs: https://zuul.opendev.org/t/openstack/builds?pipeline=tag&skip=001:12
cardoeWhile I've got ya... another thing I'm trying to do.01:12
fungibut could run basically anything that a project needs to trigger on arbitrary tags01:12
cardoeYeah that'd be perfect.01:13
cardoeI'm trying to get some things into upstream without having a fork.01:13
cardoeToday we make a tag like "ironic-0.2.20" and it builds the ironic chart at version 0.2.20 and that's an immutable build.01:14
cardoeBut the upstream repo would rebuild whatever version is in the Chart.yml, which everyone's patchset today must bump the version manually in Chart.yml which results in every patchset being a merge conflict with any other one submitted.01:15
sean-k-mooneyout side fo the tarbars created for the tip of a git branch the tarbars on tarbars.openstack.org should not change content once they are created01:15
cardoesean-k-mooney: that's absolutely my feeling and what I'm pushing for.01:16
sean-k-mooneyno im saying that how it already works01:16
sean-k-mooneyfor brnahces we repalce the branch tarball when a commit meges01:16
sean-k-mooneyfor release tarbars created when we tag a branch its fixed01:16
cardoeSo these tarballs are created by "helm package"01:16
sean-k-mooneyyou can have a job upload them as a side effect fo tagging a branch01:17
sean-k-mooneyso normally we manage releases in genera via the release repo by specifying a git sha and a new verions number01:17
cardoepublish-openstack-helm-charts is the job01:18
sean-k-mooneyfor example https://github.com/openstack/releases/blob/master/deliverables/caracal/nova.yaml#L59-L8401:19
sean-k-mooneythose are all the release form the caral branch of nova01:19
sean-k-mooneytaking the 29.2.0 tag this is the tarbal form that sha https://tarballs.opendev.org/openstack/nova/nova-29.2.0.tar.gz01:20
fungiyeah, basically don't increment values in a file in the git worktree because that is indeed a recipe for merge conflicts. instead increment values in the artifact (tarball or whatever) build01:20
cardoeYeah that's what I'm trying to advocate for.01:21
sean-k-mooneyfrom a git stcuture point of view we typically have a barnch per stable relase but then all version beyond that is done externally by selecting specific commits to be tagged releases01:22
fungifor similar reasons, we created pbr to allow us to manage python package versioning with git tags, so we stopped putting a hard-coded version string in a file in the git repo, and instead when packages (sdist tarballs, wheels) are built pbr grabs version info from the git tag and embeds it01:22
cardoeWe're using GitHub right now and someone puts a label on the PR with either "Major" or "Minor" and if no label is applied then the default is "Patch". And we'll automatically tag the merge commit with the next number for that component and trigger building the helm chart01:22
cardoeI'm trying to convince OpenStack Helm PTL to adopt a similar approach.01:23
cardoeBecause it gets rid of this conflict problem01:23
cardoeAND people will stop complaining about changing tarballs.01:23
sean-k-mooneyit sound like the charts are not beeing versioned/released today01:23
sean-k-mooneyin general you dont want every commit to be a release01:24
fungiyeah, pbr actually checks for footers in commit messages that indicate whether the next version should be a major or minor increment01:24
sean-k-mooneyfungi: i tought that was reno01:24
funginope01:24
fungireno doesn't choose versions, it just figures out what release notes go with them01:24
cardoesean-k-mooney: so yeah... today OSH (OpenStack Helm) "releases" every change to every chart.01:25
sean-k-mooneyhuh ok we rarelly need to use it but we have used that ocationally in the past 01:25
cardoehttps://opendev.org/openstack/openstack-helm-infra/src/commit/6d7fba0c435e1299330b1c819854ca5f01b2f34f/zuul.d/jobs.yaml#L56 that's the job.01:25
fungii'm specifically talking about pbr's pre-versioning functionality, where it guesses what the next version number is likely to be when creating dev version strings01:25
sean-k-mooneycardoe: ok then it does not have relase then01:25
cardoeThe tarballs are a relatively new thing.01:25
sean-k-mooneyat least not cordianted or planned release as would be done in most other projects01:25
cardoeBefore that you were suppose to git clone openstack-helm and openstack-helm-infra next to each other.01:26
cardoerun "make" inside of -infra and then in the main project.01:26
cardoewhich built the charts for you locally and then you could install from that.01:26
sean-k-mooneyit sound like that may have been better01:27
sean-k-mooneybecause then you coudl pin via sha deterministically01:27
sean-k-mooneycardoe: in anycase it shoudl be possibel to do what you want to do01:28
fungisean-k-mooney: https://docs.openstack.org/pbr/latest/user/features.html#version01:28
cardoeTrue. But I'll just say that's not a pattern that any helm user would expect.01:28
sean-k-mooneyif you really want to release every commit and have ti be stabel the main limitation i see is storage. the only reasonable way to od that is relaly git and generate the tar on demand01:28
cardoeThe built charts also had the paths embedded unfortunately.01:28
cardoeI don't wanna release every commit01:28
cardoeI think we should have releases and tests.01:29
cardoeWhich is the other thing I wanna do with Zuul.01:29
cardoeStart testing Flex deployment stuff.01:29
sean-k-mooneyfungi: yep im famiarl with that feature01:29
sean-k-mooneyfungi: we use it rarely but i have seen it used in the past01:30
fungiright, just putting it in context as to what's actually using it01:30
sean-k-mooneycardoe: so zuul is certelly capable of helping you achive that testing goal01:30
sean-k-mooneybut kep in mind its really just an ansible executor copuled with a test host provider manager01:30
cardoeRight now I'm trying to help the OSH project achieve regular helm releases.01:31
sean-k-mooneyi.e. zuul helps you find a place to execute your ansible drven testing01:31
sean-k-mooneyhow you use that and what you have it do is really up to you01:31
cardoeyeah which makes sense. Just need to educate myself on it.01:31
sean-k-mooneycardoe: it sound like your problems are more social then technialcal01:32
cardoeI won't disagree01:32
sean-k-mooneymy personally suggestion would be to try moving to a release with intermedary model01:33
sean-k-mooneyi.e. do at least one release per openstack release with intermediary releasas at a regular cadnace01:33
cardoeThat would be reasonable.01:34
fungithough whether or not the project wants to maintain stable branches and make separate stable point releases should probably also factor into the release model choice01:34
cardoeThey don't want any branches.01:34
sean-k-mooneyyou dont need to have them01:35
* fungi double-checks whether cycle-with-intermediary comes with a stable branch expectation01:36
sean-k-mooneybut without them you do need to comunicate and manager the versions of opentack that a given helm chart can deploy01:36
cardoehttps://opendev.org/openstack/openstack-helm/src/branch/master/keystone/values_overrides so like that has the different OpenStack releases with their configs.01:36
sean-k-mooneyfungi: i belive you can confirue that sepreatly01:36
cardoeThat's not really normal in the helm world.01:36
sean-k-mooneyfungi: many of the tempest plugins use that but set branch none01:36
cardoeThe project has its own helm wrapper01:36
cardoeUltimately looking to make it possible to consume the project from normal helm tooling.01:37
sean-k-mooneycardoe: in case your unfamilar with the terms we are refering  to https://github.com/openstack/releases/blob/7eabe5c2e6e9d8a50d970e52c49bd3866464adbb/doc/source/reference/release_models.rst#cycle-with-intermediary01:37
fungisean-k-mooney: ah, cool, i didn't realize release model and stable branch creation were decoupled. good to know01:37
cardoeYeah that would make sense.01:37
fungihttps://releases.openstack.org/reference/release_models.html01:39
sean-k-mooneyhttps://github.com/openstack/releases/blob/7eabe5c2e6e9d8a50d970e52c49bd3866464adbb/deliverables/epoxy/tempest.yaml#L4-L701:39
fungifor the published version01:39
cardoeSo another thing I'm trying to do. Hook into the openstack-docs job and generate some rst files before hand.01:39
fungicardoe: you can do that by creating sphinx extensions01:39
sean-k-mooneytempest is the exmaple i normally poitn to for cycle-with-intermediary but no stable branch01:39
cardoeI've started to make a change to zuul/zuul-jobs to install "helm-docs"01:39
fungiwe have several examples of projects that generate rst files from yaml during docs builds01:39
sean-k-mooneythe release notes jobs are a prime example but all of our docs are in rst format built with sphinx01:40
fungihttps://opendev.org/openstack/ossa/src/branch/master/doc/source/_exts is what generates the rst files for our security advisories on security.openstack.org, for example01:40
sean-k-mooneywe normlay get lazy and jus tuse tox to run them using it as a glorifed make 01:40
sean-k-mooneyoh your talki8ng about custom generation01:41
sean-k-mooneyya many repos have custom extenions like https://github.com/openstack/nova/tree/master/doc/ext01:41
fungiyeah, we do similar things in the governance and election repos too01:41
cardoeso like https://review.opendev.org/c/openstack/openstack-helm/+/93469801:42
cardoeIf you ran "helm-docs --output-file=doc/source/chart/ironic.rst --template-files=ironic/helm.rst.gotmpl ironic" at the top-level it would generate that ironic.rst01:42
sean-k-mooneylike this https://github.com/openstack/nova/blob/master/tox.ini#L209-L22201:43
sean-k-mooneywe have a standard project testing interface that specifys we shoudl provide a tox docs target that will generate html documenation01:44
cardoeoh. I didn't realize that tox was called to generate the docs.01:44
sean-k-mooneythen a standard shared job that runs on each commit to generate the docs  an make them avialbe to review in a docs preview site 01:44
cardoeThat makes this easier.01:45
cardoeSo should I add the install of helm-docs to zuul/zuul-jobs?01:45
sean-k-mooneycardoe: you can generate them with out it but we use tox so that we can code it once and run it locally or in the ci01:45
cardoeAnd then somehow depend on that?01:45
sean-k-mooneyis helm-docs a python package or is it installed some other way01:45
sean-k-mooneyah go01:46
sean-k-mooneyhttps://github.com/norwoodj/helm-docs01:46
cardoeIt's a Go thing01:46
cardoeYeah01:46
fungiadd it to a docs profile in bindep.txt then01:46
fungiassuming there's a distro package of it01:46
sean-k-mooneyhttps://github.com/openstack/nova/blob/master/bindep.txt#L13-L1401:46
sean-k-mooneyis an example of that 01:46
cardoeI copied how chart-testing was being installed in zuul/zuul-jobs01:46
sean-k-mooneyso with go you would often use make files01:47
sean-k-mooneyso what i would do if that is what you are usign is create a make file to download and isntall the deps using go get and buidl the docs01:47
sean-k-mooneythen write a zuul job that just calls that make target01:48
cardoehttps://opendev.org/zuul/zuul-jobs/src/commit/d2d25cd9ec807d62b1bb4eb3395983b8b2eaea41/roles/ensure-chart-testing/tasks/main.yaml#L13-L1801:48
cardoeThat's what I copied01:48
sean-k-mooneydo you have a link to the chart repo01:48
sean-k-mooneyi guess https://github.com/openstack/openstack-helm/blob/master/nova/Chart.yaml01:49
sean-k-mooneyok ya https://github.com/openstack/openstack-helm/blob/master/Makefile01:49
sean-k-mooneyand htat has tox too https://github.com/openstack/openstack-helm/blob/master/tox.ini01:49
sean-k-mooneywith some docs suport https://github.com/openstack/openstack-helm/blob/master/tox.ini#L16-L2401:49
cardoehttps://review.opendev.org/c/zuul/zuul-jobs/+/93503001:50
sean-k-mooneycardoe: so that works but the disadvantage to that approch si repoducing it locally is harder01:50
cardoeI can go the bindeps route.01:51
cardoeI was just sharing what I had already started.01:51
sean-k-mooneyalso cloning (donwloading in this case) in a ci job is kind of an antipattern01:51
cardoeIt's not cloning. It's downloading a pre-built binary.01:51
sean-k-mooneyyes but that is going out onto the internet01:52
sean-k-mooneywhic for an active project will fail randomly01:52
sean-k-mooneyso while that works without caching proxies01:52
sean-k-mooneyyou need to be carful01:52
cardoeSo there's no dep on "helm" in the openstack-helm project01:52
cardoeSo that's how I came to where they're getting the binary01:53
cardoeHappy to do it better.01:53
sean-k-mooneywell we have some caching proxies01:53
sean-k-mooneyat the provider clouds01:53
cardoeI mean tests fail today cause they hit docker hub rate limits too01:53
sean-k-mooneybut if this is somehting needed in every patch it might be worth including it in the base image we boot01:53
sean-k-mooneyand only donwloading it if its not present01:54
sean-k-mooneyright there are solution to that too01:54
sean-k-mooneycardoe: in what casses are you hitting the ratelimit?01:54
sean-k-mooneykolla had similar problems01:54
sean-k-mooneyinfra also have playbooks to provide tempory registries for the jobs01:55
fungiif you can get things you need from official in-distro packages, we have our own mirrors of those located in each ci node provider. if you can get things from dockerhub/quay, npm or pypi then we have caching proxies the nodes can pull them through01:57
fungi(technically the distro package mirrors are caches in each provider, but backed by a network filesystem)01:57
sean-k-mooneyso for helm buidl i woudl personnaly use go get to instlal that via the proxy01:58
cardoeThey're grabbing the library nginx I think01:58
fungiwhat proxy is go get using?01:58
sean-k-mooneyfungi: its configurable01:58
sean-k-mooneyvia an env var01:59
cardoeSo at this point I'm just trying to help the upstream project.01:59
cardoeBut needing to slowly introduce some change.01:59
fungisean-k-mooney: i literally mean where is the proxy for go get? i don't think we maintain one01:59
sean-k-mooneyfungi: oh i dont think we do either but a normally http proxy woudl work02:00
fungiyeah, we can't really do wide-open proxies because we don't control what ip addresses the job nodes get02:00
sean-k-mooneyso https://opendev.org/zuul/zuul-jobs/src/commit/d2d25cd9ec807d62b1bb4eb3395983b8b2eaea41/roles/configure-mirrors/defaults/main.yaml02:01
sean-k-mooneyconfigure the http/https proxy vars corect02:01
fungiconfigure them to what though?02:01
sean-k-mooneythere is a shared comunity go proxy02:01
fungii guess that's a separate service that we'd run?02:02
sean-k-mooneyhttps://proxy.golang.org02:04
fungiright now the stuff we're running caching web proxies for (quay/dockerhub, pypi, npm...) are just apache mod_proxy rules02:04
sean-k-mooneyso the way gos packaging works is all impaort are urls to the the git repos02:04
fungioh, you're saying we could tell apache mod_proxy to proxy connections to proxy.golang.org02:04
sean-k-mooneyyep02:04
fungithat seems doable, sure02:05
sean-k-mooneyso in go an import looks like this https://github.com/openstack-k8s-operators/nova-operator/blob/main/api/v1beta1/common_types.go#L2202:05
sean-k-mooneyi.e. its the url to the moduel on a git repo02:05
sean-k-mooneybut instead of going to github directlly to get "github.com/openstack-k8s-operators/lib-common/modules/common/util"02:06
sean-k-mooneygo get uses https://proxy.golang.org to get that which allow you to do versioning via a seprate go mod file02:06
sean-k-mooneylike this https://github.com/openstack-k8s-operators/nova-operator/blob/main/go.mod#L1502:07
sean-k-mooneyso go get takes the reqiuried deps form yoru go mod file and download the speficed version via the poxy when enabled02:07
sean-k-mooneygo install does the same thing but compiels and installs the resultign binary into yoru go bin path02:08
sean-k-mooneycardoe: anyway at this point im proably not helpign any more02:09
sean-k-mooneycardoe: as i siadi i woudl be inllined to extedn teh make file to have target to install helm-docs and use it to buidl the docs02:11
sean-k-mooneythen just have zuul invoke that because it allwos you to test it the same way locally02:11
fungiif having local caching proxies of proxy.golang.org would help job stability, it's probably not contentious for us to add one. it would go in https://opendev.org/opendev/system-config/src/branch/master/playbooks/roles/mirror/templates/mirror.vhost.j202:12
sean-k-mooneythe pattern we have been using for the k8s oeprator work is to have tagest to install each fo the test tools (envtest is the fake k8s api standind and ginkgo is the test runner) https://github.com/openstack-k8s-operators/nova-operator/blob/main/Makefile#L233-L242 and then the make test target just depend on the tool install target02:14
sean-k-mooneyhttps://github.com/openstack-k8s-operators/nova-operator/blob/main/Makefile#L145-L14902:14
sean-k-mooneythen the ci can basicaly jsut cd to the correct directory and run "make test"02:15
cardoeyeah those operators are interesting unfortunately openshift only02:24
sean-k-mooneyin theory you might be able to make them work on vaniala k8s but ya that kidn of unfortuente at the momemtn02:25
sean-k-mooneythe only direct dep on openshift really is it uses routes instead of ingress by default02:25
sean-k-mooneythere has not really been any effort ot make it work on non openshift k8s deployments 02:25
*** darmach688 is now known as darmach6811:59
opendevreviewTae Park proposed openstack/project-config master: Add repo app-openbao for starlingx  https://review.opendev.org/c/openstack/project-config/+/93515414:49
opendevreviewMerged openstack/project-config master: Use 2024.2 constraints in master translation jobs  https://review.opendev.org/c/openstack/project-config/+/93440216:13
opendevreviewMerged openstack/project-config master: Add separate acl group for watcher-tempest-plugin  https://review.opendev.org/c/openstack/project-config/+/93435716:13
opendevreviewMerged openstack/project-config master: Update more ironic project ACLs for editHashtags  https://review.opendev.org/c/openstack/project-config/+/93502216:13
opendevreviewMerged openstack/project-config master: Add repo app-openbao for starlingx  https://review.opendev.org/c/openstack/project-config/+/93515417:10
cardoesean-k-mooney / fungi / clarkb: Just to show ya how much I'm trying with this.... https://review.opendev.org/c/openstack/openstack-helm/+/935019 you see how many recheck's I had to run? The ironic bits aren't touched or looked at in the current checks/gates.19:31
clarkbcardoe: do you know what is failing?19:34
sean-k-mooneyit looks like diffent failure in diffent runs just lookign at the passign /failing jobs19:40
sean-k-mooneyone as a container pull form docker io19:41
sean-k-mooneyso that proably just the rate limiting19:41
sean-k-mooneythre are undfiend atribute error in other but i have never looked at these before so not sure why and or how it got fixed19:42
clarkbwe have a docker hub caching proxy too which if not used may be helpful19:43
sean-k-mooneyso the kubespary job https://zuul.opendev.org/t/openstack/build/d839dfba45364013b2ba21bc03d497ec19:44
sean-k-mooneylooks like that going direct19:44
sean-k-mooneyor if not dirfect then its not working but i would assume they just have not set that up19:44
sean-k-mooneylooks like that a new job as of september19:45
sean-k-mooneyhttps://github.com/openstack/openstack-helm/commit/aa3a6c489e7aedba8f20905dc400777afe1a2a7519:45
cardoesorry got a phone call.19:47
cardoebut yeah you guys nailed it. it's an assortment of failures.19:47
cardoeI have NO idea how the attribute errors got fixed.19:48
sean-k-mooneyim going to prethend that job is not just a bunch fo random bash scripts https://github.com/openstack/openstack-helm/blob/a556dbe2320faf28a6badc6869002970c9082c99/zuul.d/base.yaml#L109-L13319:48
sean-k-mooneyit looks like they never actully spend time making them into real zuul v3 jobs19:49
sean-k-mooneyyou proably coudl imporve the stablity at least on the docker side by enabling the docker proxy here 919:51
sean-k-mooneyhttps://github.com/openstack/openstack-helm/blob/a556dbe2320faf28a6badc6869002970c9082c99/tools/gate/playbooks/prepare-hosts.yaml#L619:51
sean-k-mooneywhich i htink is just adding https://opendev.org/zuul/zuul-jobs/src/branch/master/roles/use-docker-mirror19:52
sean-k-mooneyclarkb: ^ is that the correct role19:52
sean-k-mooneydocker proably is not isntalled there so you migh need to do that here https://github.com/openstack/openstack-helm/blob/a556dbe2320faf28a6badc6869002970c9082c99/tools/gate/playbooks/deploy-env-kubespray.yaml#L13619:54
sean-k-mooneyinstead19:54
opendevreviewMerged openstack/openstack-zuul-jobs master: Update CentOS 9 Stream OpenAFS package to 1.8.13  https://review.opendev.org/c/openstack/openstack-zuul-jobs/+/93498919:54
clarkbsean-k-mooney: yes I think that is the right role19:56
sean-k-mooneycardoe: the stablity issues you hit are not nessiarly caused byt the packaging of the helml charts today19:57
sean-k-mooneythat might be a factor but the ci jobs need carful maintaince19:57
sean-k-mooneyi suspect that some of this is bitrot19:57
sean-k-mooneybut i also dont have personal knowladge of the health of the openstack-helm proejct in general19:58
sean-k-mooneycardoe: overall https://zuul.opendev.org/t/openstack/builds?project=openstack%2Fopenstack-helm&skip=0 does not actully look that bad20:00
sean-k-mooneybut with 15 jobs if you have even a little instablity in them it will be hard for any patch to pass twice so that it can merge20:01
cardoewell you guys have given me a good todo list23:35

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!