| JayF | the 5pm monster has gotten me again | 00:00 |
|---|---|---|
| JayF | grawr | 00:00 |
| *** Goneri has quit IRC | 00:03 | |
| *** baoli has joined #openstack-ironic | 00:07 | |
| *** snizar_ has quit IRC | 00:25 | |
| *** snizar has quit IRC | 00:25 | |
| openstackgerrit | Merged openstack/ironic: Add nova scheduler_host_subset_size option to docs https://review.openstack.org/350569 | 00:27 |
| openstackgerrit | Merged openstack/ironic: 'As of' in documentation is incorrect https://review.openstack.org/353227 | 00:29 |
| *** fxpester has quit IRC | 00:30 | |
| *** amotoki has joined #openstack-ironic | 00:47 | |
| *** syed_ has quit IRC | 00:52 | |
| *** zhangjl has joined #openstack-ironic | 00:55 | |
| *** hoangcx has joined #openstack-ironic | 00:56 | |
| *** xuao has joined #openstack-ironic | 00:56 | |
| *** phuongnh has joined #openstack-ironic | 00:58 | |
| *** baoli has quit IRC | 01:10 | |
| *** baoli has joined #openstack-ironic | 01:12 | |
| *** wajdi has joined #openstack-ironic | 01:12 | |
| openstackgerrit | Andy Yan proposed openstack/ironic-specs: bug/1613198 https://review.openstack.org/355389 | 01:13 |
| openstackgerrit | Andy Yan proposed openstack/ironic-specs: bug/1613198 https://review.openstack.org/355389 | 01:24 |
| *** rajinir has quit IRC | 01:25 | |
| *** ijw has quit IRC | 01:32 | |
| *** ijw has joined #openstack-ironic | 01:38 | |
| *** hparekh has quit IRC | 01:40 | |
| *** baoli has quit IRC | 01:43 | |
| *** amotoki has quit IRC | 01:43 | |
| *** vishwanathj has quit IRC | 01:44 | |
| *** Sukhdev has quit IRC | 01:44 | |
| openstackgerrit | Andy Yan proposed openstack/ironic-specs: bug/1613198 https://review.openstack.org/355389 | 01:45 |
| openstackgerrit | Teng Fei proposed openstack/ironic-inspector: Modify the SQL's string from double quote to single quote. https://review.openstack.org/347795 | 01:47 |
| *** ijw has quit IRC | 01:49 | |
| *** bfournie has joined #openstack-ironic | 01:51 | |
| *** baoli has joined #openstack-ironic | 01:51 | |
| *** hparekh has joined #openstack-ironic | 01:51 | |
| *** ijw has joined #openstack-ironic | 02:01 | |
| *** tiendc has joined #openstack-ironic | 02:02 | |
| *** ijw has quit IRC | 02:06 | |
| *** levelxplane has joined #openstack-ironic | 02:15 | |
| *** levelxplane has left #openstack-ironic | 02:16 | |
| openstackgerrit | Darren Chan proposed openstack/ironic: Update readme file https://review.openstack.org/355290 | 02:18 |
| *** baoli has quit IRC | 02:21 | |
| *** rloo has quit IRC | 02:30 | |
| *** rbudden has quit IRC | 02:35 | |
| *** rama_y has joined #openstack-ironic | 02:35 | |
| *** ijw has joined #openstack-ironic | 02:40 | |
| *** fragatin_ has joined #openstack-ironic | 02:42 | |
| *** aNupoisc has quit IRC | 02:42 | |
| *** fragatina has quit IRC | 02:45 | |
| *** zhenguo has joined #openstack-ironic | 02:46 | |
| *** fragatin_ has quit IRC | 02:46 | |
| *** yuanying has quit IRC | 02:49 | |
| *** yuanying has joined #openstack-ironic | 02:52 | |
| *** ijw has quit IRC | 02:54 | |
| *** baoli has joined #openstack-ironic | 03:01 | |
| *** wajdi has quit IRC | 03:02 | |
| *** krtaylor has joined #openstack-ironic | 03:02 | |
| *** wajdi has joined #openstack-ironic | 03:02 | |
| *** xavierr has quit IRC | 03:04 | |
| *** gabriel-bezerra has quit IRC | 03:04 | |
| *** nicodemos has quit IRC | 03:04 | |
| *** xavierr has joined #openstack-ironic | 03:05 | |
| *** gabriel-bezerra has joined #openstack-ironic | 03:07 | |
| *** nicodemos has joined #openstack-ironic | 03:07 | |
| *** wajdi_ has joined #openstack-ironic | 03:09 | |
| *** ChubYann has quit IRC | 03:11 | |
| *** wajdi has quit IRC | 03:11 | |
| *** ChubYann has joined #openstack-ironic | 03:24 | |
| *** vishwanathj has joined #openstack-ironic | 03:25 | |
| *** baoli has quit IRC | 03:26 | |
| openstackgerrit | Nguyen Hung Phuong proposed openstack/ironic: Clean imports in code https://review.openstack.org/355704 | 03:29 |
| *** wlfightup has joined #openstack-ironic | 03:30 | |
| wlfightup | hello | 03:30 |
| *** tiendc has quit IRC | 03:31 | |
| *** tiendc has joined #openstack-ironic | 03:37 | |
| *** wajdi_ has quit IRC | 03:40 | |
| *** vikrant has joined #openstack-ironic | 03:42 | |
| openstackgerrit | Tuan proposed openstack/ironic: Fix incorrect order of params of assertEqual() in test_objects.py https://review.openstack.org/355708 | 03:45 |
| *** rajinir has joined #openstack-ironic | 03:45 | |
| *** yuanying has quit IRC | 03:48 | |
| openstackgerrit | Tuan proposed openstack/ironic: Fix incorrect order of params of assertEqual() https://review.openstack.org/355708 | 03:49 |
| *** yuanying has joined #openstack-ironic | 03:51 | |
| wlfightup | this is my question | 03:53 |
| wlfightup | Can Help me solve ? | 03:54 |
| wlfightup | http://stackoverflow.com/questions/38966404/how-to-add-ironic-db-version-file-now-install-dont-copying-db-version-file-ho | 03:54 |
| *** vishwanathj has quit IRC | 03:54 | |
| wlfightup | ^-^ | 03:55 |
| *** hshiina has joined #openstack-ironic | 03:56 | |
| *** xuao has quit IRC | 04:00 | |
| *** vishwanathj has joined #openstack-ironic | 04:17 | |
| *** links has joined #openstack-ironic | 04:20 | |
| *** fragatina has joined #openstack-ironic | 04:24 | |
| *** fragatina has quit IRC | 04:29 | |
| *** Sukhdev has joined #openstack-ironic | 04:43 | |
| *** moshele has joined #openstack-ironic | 04:49 | |
| *** rama_y has quit IRC | 05:10 | |
| *** rama_y has joined #openstack-ironic | 05:10 | |
| *** tiendc has quit IRC | 05:25 | |
| *** stendulker has joined #openstack-ironic | 05:25 | |
| *** Sukhdev has quit IRC | 05:26 | |
| *** baoli has joined #openstack-ironic | 05:38 | |
| *** fragatina has joined #openstack-ironic | 05:40 | |
| *** ccamacho has joined #openstack-ironic | 05:40 | |
| *** baoli has quit IRC | 05:42 | |
| *** fragatina has quit IRC | 05:45 | |
| *** rama_y has quit IRC | 05:46 | |
| *** tiendc has joined #openstack-ironic | 05:51 | |
| *** rajinir has quit IRC | 05:55 | |
| openstackgerrit | lokesh s proposed openstack/ironic: Renaming audit map conf sample file https://review.openstack.org/350399 | 05:55 |
| *** thrash|g0ne has quit IRC | 06:03 | |
| *** ccamacho is now known as ccamacho|afk | 06:04 | |
| *** thrash has joined #openstack-ironic | 06:05 | |
| *** thrash has quit IRC | 06:05 | |
| *** thrash has joined #openstack-ironic | 06:05 | |
| openstackgerrit | Cao ShuFeng proposed openstack/ironic: Use node uuid rather than id when acquiring node lock https://review.openstack.org/355732 | 06:05 |
| openstackgerrit | Cao ShuFeng proposed openstack/ironic: Use node uuid rather than id when acquiring node lock https://review.openstack.org/355732 | 06:05 |
| *** rcernin has joined #openstack-ironic | 06:14 | |
| openstackgerrit | Shivanand Tendulker proposed openstack/ironic: Fix iLO drivers inconsistent boot mode default value https://review.openstack.org/345231 | 06:17 |
| *** rama_y has joined #openstack-ironic | 06:19 | |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/ironic: Use memory mode for sqlite in db test https://review.openstack.org/355738 | 06:25 |
| openstackgerrit | ChangBo Guo(gcb) proposed openstack/ironic: Use memory mode for sqlite in db test https://review.openstack.org/355738 | 06:38 |
| *** rbartal has joined #openstack-ironic | 06:42 | |
| *** vsaienk0 has quit IRC | 06:42 | |
| *** vsaienk0 has joined #openstack-ironic | 06:49 | |
| *** Lord_Phoenix has joined #openstack-ironic | 06:54 | |
| *** jtomasek|afk is now known as jtomasek | 07:00 | |
| openstackgerrit | Vasyl Saienko proposed openstack/ironic: Remove neutron client workarounds https://review.openstack.org/354588 | 07:08 |
| *** jpich has joined #openstack-ironic | 07:11 | |
| *** ccamacho|afk is now known as ccamacho | 07:13 | |
| *** e0ne has joined #openstack-ironic | 07:28 | |
| *** ifarkas_afk is now known as ifarkas | 07:40 | |
| *** fragatina has joined #openstack-ironic | 07:41 | |
| *** rama_y has quit IRC | 07:44 | |
| *** fragatina has quit IRC | 07:46 | |
| *** baoli has joined #openstack-ironic | 07:50 | |
| *** chlong has quit IRC | 07:50 | |
| *** baoli has quit IRC | 07:54 | |
| *** zzzeek has quit IRC | 08:00 | |
| *** zzzeek has joined #openstack-ironic | 08:00 | |
| openstackgerrit | Davanum Srinivas (dims) proposed openstack/ironic: [WIP] Testing latest u-c https://review.openstack.org/318440 | 08:10 |
| openstackgerrit | yolanda.robla proposed openstack/bifrost: Allow to define vms with independent names https://review.openstack.org/354813 | 08:10 |
| *** athomas has joined #openstack-ironic | 08:14 | |
| openstackgerrit | Fatih Degirmenci proposed openstack/bifrost: Introduce support for kvm acceleration https://review.openstack.org/355431 | 08:21 |
| *** lucas-dinner is now known as lucasagomes | 08:21 | |
| openstackgerrit | Vasyl Saienko proposed openstack/ironic: Fix test_find_node_by_macs test https://review.openstack.org/355776 | 08:22 |
| lucasagomes | jroll, rloo dansmith thanks for looking into the gate (it was quite late when I sa it was broken so I just reported here) | 08:22 |
| openstackgerrit | Ricardo Carrillo Cruz proposed openstack/bifrost: Only set hostname on 127.0.0.1 if not present in /etc/hosts https://review.openstack.org/355778 | 08:23 |
| *** Goneri has joined #openstack-ironic | 08:27 | |
| *** sborkows has joined #openstack-ironic | 08:31 | |
| *** ohamada has joined #openstack-ironic | 08:32 | |
| *** electrofelix has joined #openstack-ironic | 08:33 | |
| openstackgerrit | Naohiro Tamura proposed openstack/python-ironicclient: Add soft reboot/poweroff power states. https://review.openstack.org/247904 | 08:36 |
| *** xuao has joined #openstack-ironic | 08:37 | |
| xuao | jroll | 08:40 |
| openstackgerrit | Yuiko Takada Mori proposed openstack/ironic: Add node serial console documentation https://review.openstack.org/293872 | 08:42 |
| xuao | ping lucasagomes,jroll for some help~ | 08:43 |
| *** tiendc has quit IRC | 08:44 | |
| xuao | lucasagomes, we found another error while it's in the deploy-image, about I/O error to the disk. | 08:44 |
| xuao | And this is the paste http://paste.openstack.org/show/557493/ | 08:44 |
| *** parlos has joined #openstack-ironic | 08:44 | |
| *** hshiina has quit IRC | 08:45 | |
| xuao | But it continues after raising that, so we don't pay attention to it . | 08:46 |
| parlos | Good morning Ironic! | 08:49 |
| vdrok | morning all! | 08:54 |
| xuao | morning all~ | 08:59 |
| *** Goneri has quit IRC | 09:01 | |
| *** Goneri has joined #openstack-ironic | 09:01 | |
| *** derekh has joined #openstack-ironic | 09:03 | |
| *** sambetts|afk is now known as sambetts | 09:07 | |
| sambetts | Morning all | 09:08 |
| *** tiendc has joined #openstack-ironic | 09:11 | |
| vsaienk0 | morning all, vdrok, sambetts, lucasagomes, xuao, parlos, jroll, dtantus | 09:22 |
| sambetts | o/ vsaienk0 | 09:22 |
| vsaienk0 | folks grenade job is broken by nova cells | 09:22 |
| vsaienk0 | I've just reported a bug https://bugs.launchpad.net/ironic/+bug/1613622 | 09:23 |
| openstack | Launchpad bug 1613622 in OpenStack Compute (nova) "nova cellsv2 breaks ironic" [Undecided,New] | 09:23 |
| sambetts | vsaienk0: whole gate is broken by the cells change | 09:23 |
| sambetts | vsaienk0: lucasagomes is looking into it as far as I know | 09:23 |
| lucasagomes | sambetts, vsaienk0 the devstack patch that caused it have been reverted I think | 09:24 |
| lucasagomes | https://review.openstack.org/#/c/355599/ | 09:24 |
| lucasagomes | xuao, hmm no idea, I'll have to google about that error | 09:24 |
| xuao | lucasagomes, I think maybe we need to test if the disk is protected ? | 09:27 |
| jroll | morning y'all | 09:30 |
| jroll | strange error indeed, xuao | 09:30 |
| sambetts | Morning jroll | 09:30 |
| xuao | morning jroll~ | 09:30 |
| vsaienk0 | lucasagomes: I think the patch to grenade https://review.openstack.org/#/c/355813/ also should be reverted | 09:31 |
| jroll | vsaienk0: so only grenade jobs are broken now? | 09:31 |
| lucasagomes | vsaienk0, a-ha, let's put a patch in ironic with a depends-on that change | 09:32 |
| jroll | vsaienk0: lucasagomes: https://review.openstack.org/#/c/355603/ | 09:32 |
| lucasagomes | jroll, apparently so | 09:32 |
| jroll | for some real fixes instead of reverts, see depends-on there | 09:32 |
| lucasagomes | jroll, ++ | 09:32 |
| lucasagomes | jroll, I wonder if we could make the ironic job voting in devstack | 09:38 |
| jroll | lucasagomes: it's worth the conversation, but I think the end of the cycle is bad timing, people won't trust it to not reset the integrated gate | 09:40 |
| *** dtantsur|afk is now known as dtantsur | 09:40 | |
| dtantsur | Morning Ironic, morning jroll, lucasagomes, sambetts, vsaienk0, xuao, vdrok | 09:40 |
| jroll | hey dtantsur | 09:40 |
| xuao | morning ~ dtantsur | 09:41 |
| dtantsur | so, the gate is down, right? | 09:41 |
| lucasagomes | jroll, right :-/ | 09:41 |
| lucasagomes | dtantsur, yup, grenade job is now busted | 09:42 |
| dtantsur | I've seen a lot of failures in regular jobs, is it fixed now? | 09:42 |
| jroll | yes, a devstack revert fixed most of them | 09:43 |
| jroll | these two fix everything for real: https://review.openstack.org/#/c/355602/ https://review.openstack.org/#/c/355659/1 | 09:43 |
| *** fragatina has joined #openstack-ironic | 09:43 | |
| jroll | I think the devstack patch isn't urgent, actually, just need the nova patch coming down | 09:45 |
| jroll | I just rechecked it | 09:45 |
| dtantsur | so, which one are we waiting for? | 09:46 |
| jroll | the nova patch | 09:46 |
| dtantsur | we can't merge the fix unblocking tripleo CI, so this is a chain of breakages :( | 09:46 |
| *** amoralej has quit IRC | 09:46 | |
| jroll | is the tripleo break related? | 09:47 |
| jroll | or something different | 09:47 |
| dtantsur | we can't merge this epic fix: https://review.openstack.org/355537 | 09:47 |
| dtantsur | because why would a library check its incoming arguments instead of discarding unexpected ones? | 09:48 |
| jroll | oh ffs | 09:48 |
| *** fragatina has quit IRC | 09:48 | |
| jroll | dtantsur: well, anyway the fix has +W, so it's just a waiting game | 09:49 |
| dtantsur | yep | 09:49 |
| lucasagomes | :-( | 09:50 |
| dtantsur | but we can land ironicclient patches in the meanwhile, it does not have grenade :) | 09:50 |
| dtantsur | jroll, as to 3rdparty drivers and the cinder thread, I kind of agree that just removing a bunch of drivers is a bit rude. I'd prefer we bulk-deprecate them in Newton, then remove at the standard deprecation period boundary | 09:52 |
| jroll | dtantsur: yeah, maybe, we should kick off an email thread | 09:56 |
| lucasagomes | dtantsur, ++ I like the idea of the "supported=True/False" flag | 09:57 |
| stendulker | jroll: Hi | 09:59 |
| jroll | stendulker: hey there | 10:00 |
| stendulker | jroll: What would be the procedure to obsolete a Ironic driver. With DIB ramdisk being deprecated, agent_ilo and iscsi_ilo are kind of same. | 10:00 |
| stendulker | jroll: If we want to obsolete iscsi_ilo driver, then how it should be done? | 10:00 |
| jroll | stendulker: doesn't agent_ilo use swift/http? and iscsi_ilo uses iscsi? | 10:00 |
| dtantsur | they are not the same | 10:00 |
| stendulker | exccept for iscsi part everything else is same | 10:01 |
| jroll | then we should refactor them to share more code :) | 10:01 |
| jroll | the iscsi vs http part is a *major* difference | 10:01 |
| stendulker | initially agent driver was only for whole disk image and iscsi_ilo supported both | 10:01 |
| stendulker | there was some difference in boot mdoes and other features being supported. But now right from ramdisk to other features its all same except one uses iscsi whereas other uses agent to pull image | 10:02 |
| jroll | there are users that prefer to use iscsi instead of http (why? I don't know), we should continue to support that | 10:02 |
| dtantsur | converging to one deploy driver is a nice discussion to happen, but it should not be vendor-specific | 10:02 |
| stendulker | Also wanted to know if there is still value in keeping two drivers | 10:02 |
| jroll | dtantsur: ++ | 10:03 |
| dtantsur | so if we drop iscsi family, it must happen everywhere | 10:03 |
| stendulker | initiating vendor specific as vendors may opt in for one over other based on underlying h/w capability | 10:03 |
| dtantsur | btw, how does agent_* work in standalone environment? | 10:03 |
| jroll | yeah, I think we should get through the driver comp work first | 10:03 |
| * dtantsur hides | 10:04 | |
| jroll | dtantsur: image_info is just http://foo | 10:04 |
| jroll | instead of glance uuid | 10:04 |
| jroll | it works great :D | 10:04 |
| dtantsur | so you must install an HTTP server, right? this is nice, but it's more complex than the iSCSI method... | 10:04 |
| jroll | well, iscsi standalone also requires an http server, iirc | 10:04 |
| jroll | also takes an http UTL | 10:05 |
| jroll | URL | 10:05 |
| sambetts | myself and lucasagomes where actually talking about having Ironic serve http images for non-swift backed glance | 10:05 |
| dtantsur | only for iPXE, no? | 10:05 |
| stendulker | dtantsur, jroll: yes | 10:05 |
| stendulker | you can pass image as http | 10:05 |
| jroll | dtantsur: I can't remember if iscsi standalone can accept file:// | 10:05 |
| dtantsur | well, yeah, without glance... | 10:05 |
| dtantsur | ok, even non-standalone it requires swift with temporary URLs, right? | 10:06 |
| jroll | or a web server | 10:06 |
| sambetts | yup, glance backed with files doesn't work | 10:06 |
| stendulker | in iscsi_ilo we use web server | 10:06 |
| jroll | dtantsur: but yeah, in general, there is some amount of value for iscsi | 10:06 |
| stendulker | web server host these files | 10:06 |
| dtantsur | well, once Ironic can manage files on this web server (like we do for iPXE), I'm fine with deprecating iSCSI deploy | 10:06 |
| * lucasagomes gotta read the scrollback | 10:06 | |
| stendulker | Our management was asking if there is any value in keeping both | 10:06 |
| jroll | stendulker: yes, there is | 10:07 |
| jroll | (IMO) | 10:07 |
| stendulker | except for memory requirement, they look same. | 10:07 |
| dtantsur | if we get <sambetts> myself and lucasagomes where actually talking about having Ironic serve http images for non-swift backed glance | 10:07 |
| dtantsur | only then ^^^ they are the same | 10:07 |
| dtantsur | stendulker, you can help make ^^^ happen ;) | 10:07 |
| jroll | and even then... for some reason people like the iscsi protocol | 10:07 |
| jroll | or so I'm told :D | 10:07 |
| * dtantsur is not one of these people :) | 10:07 | |
| stendulker | agent would need slightly more memory as it saves entire image whereas iscsi smaller memory would also suffice | 10:07 |
| stendulker | jroll: yes | 10:08 |
| jroll | dtantsur: anyway, like I said, I think let's get through the driver composition stuff and then think about it | 10:08 |
| sambetts | well there is still kinda a difference, e.g. conductor doing the writing, vs agent doing the writing | 10:08 |
| dtantsur | stendulker, we've had image piping for quite some time, so memory is not a problem any more | 10:08 |
| jroll | it is if you don't use raw :) | 10:08 |
| dtantsur | true | 10:08 |
| stendulker | jroll: unfortunately we do not have any real stastitics on theses drivers usage and ppl preferences | 10:08 |
| jroll | it's bandwidth vs memory | 10:08 |
| jroll | stendulker: I agree | 10:08 |
| dtantsur | I'm more worried about additional requirements (swift or manually configured web server) more than that | 10:08 |
| jroll | stendulker: and without data showing something is unused, I'm not really interested in removing drivers | 10:09 |
| sambetts | perhaps Ironic could download images from glance, like it does for iscsi, convert to raw then serve the stream | 10:09 |
| sambetts | for the http case | 10:09 |
| dtantsur | sambetts++ | 10:09 |
| dtantsur | as for statistics, tripleo defaults to pxe_ipmitool, but that's not quite a conscious choice | 10:10 |
| jroll | okay, so we have iscsi users :) | 10:10 |
| dtantsur | I'd prefer to stop messing with iSCSI, to be honest. it sometimes gives strange bugs. | 10:10 |
| dtantsur | but moving tripleo to agent_* is not on my radar | 10:10 |
| stendulker | jroll: I agree, may be we shoudl wait for driver composition and we may get some more insight on how to go about this | 10:10 |
| jroll | dtantsur: I'd agree, but we need a new PTL first so that I'm not the one that gets attacked :D | 10:11 |
| dtantsur | LOL | 10:11 |
| jroll | stendulker: +1 | 10:11 |
| stendulker | :) | 10:11 |
| lucasagomes | sambetts, yeah, raw stream is already supported in IPA btw | 10:11 |
| dtantsur | c'mon, being a PTL during the driver composition is going to be fun ;) | 10:11 |
| stendulker | But is there a challenger to jroll :) | 10:12 |
| sambetts | lucasagomes: right which is why I'm suggesting converting qcow2 to raws on the Ironic side so we can take advantage of it | 10:12 |
| lucasagomes | yup yeah I got it | 10:12 |
| sambetts | lucasagomes: not sure if feasible yet though | 10:12 |
| sambetts | :-P | 10:12 |
| jroll | dtantsur: I'm okay with that, just don't remove iscsi til I'm done :) | 10:12 |
| lucasagomes | yeah I think it all came down to the memory problem which the iscsi solves, once there's an alternative | 10:13 |
| lucasagomes | I think we can start to deprecate the iscsi drivers (or talk more serious about it) | 10:13 |
| lucasagomes | in the case of iLO only, I believe they can do it already if they feel it's not important for their product | 10:14 |
| lucasagomes | and are not willing to maintain | 10:14 |
| lucasagomes | maintain the iscsi version* | 10:14 |
| lucasagomes | iMHO | 10:14 |
| stendulker | lucasagomes: i agree, this should be more of wheher we need iscsi based driver or not | 10:14 |
| stendulker | i mean need of iscsi based drivers in Ironic | 10:15 |
| zhangjl | hey, lucasagomes and jroll, glad to see you | 10:15 |
| stendulker | jroll, dtantsur: Another thing How do you want to treat this ? A defect or RFE https://bugs.launchpad.net/ironic/+bug/1588177 | 10:15 |
| openstack | Launchpad bug 1588177 in Ironic "Allow ilo drivers to choose the ports to be inspected" [Undecided,In progress] - Assigned to Bharath kumar (bharath-kumar3) | 10:15 |
| jroll | hi zhangjl :) | 10:15 |
| lucasagomes | stendulker, yeah, it does solve a real problem | 10:15 |
| lucasagomes | specially if you think about whole disk images with windows | 10:16 |
| lucasagomes | that's a lot of memory required for the agent | 10:16 |
| lucasagomes | zhangjl, hi there | 10:16 |
| zhangjl | follow lucasagomes` advice, i changed my node to only one disk with 600GB | 10:16 |
| zhangjl | but now , it`s still hangs here | 10:17 |
| stendulker | lucasagomes: ok. So is handling large images a only advantage with iscsi drivers? | 10:17 |
| lucasagomes | stendulker, off the top of my head, memory consumption would be it yes | 10:18 |
| zhangjl | i try to change the boot mode to bios, uefi | 10:18 |
| *** hoangcx has quit IRC | 10:18 | |
| zhangjl | while still failed | 10:18 |
| zhangjl | em , any advices? | 10:18 |
| stendulker | lucasagomes: when i was rationalizing to folks here, i could not think of any other reason :) | 10:18 |
| lucasagomes | stendulker, maybe parts of the iscsi work also help with the diskless deployment | 10:18 |
| openstackgerrit | Ricardo Carrillo Cruz proposed openstack/bifrost: Only set hostname on 127.0.0.1 if not present in /etc/hosts https://review.openstack.org/355778 | 10:18 |
| stendulker | lucasagomes: yes, tht right | 10:18 |
| stendulker | jroll, dtantsur, lucasagomes: thank you for your inputs | 10:20 |
| zhangjl | anyone help? | 10:20 |
| stendulker | dtantsur, jroll: How should be this be treated? Defect or RFE https://bugs.launchpad.net/ironic/+bug/1588177 | 10:21 |
| openstack | Launchpad bug 1588177 in Ironic "Allow ilo drivers to choose the ports to be inspected" [Undecided,In progress] - Assigned to Bharath kumar (bharath-kumar3) | 10:21 |
| lucasagomes | zhangjl, same problem? Hangs when booting the tenant iage? | 10:22 |
| lucasagomes | image* | 10:22 |
| zhangjl | yes | 10:22 |
| *** fxpester has joined #openstack-ironic | 10:22 | |
| xuao | T .T | 10:22 |
| zhangjl | now , my node has only one disk , 600GB | 10:22 |
| zhangjl | but..... | 10:23 |
| dtantsur | stendulker, good question. I remember devananda objection to the whole approach. So I'd say it's more of an RFE | 10:23 |
| zhangjl | i have no idea how to resolve it | 10:23 |
| stendulker | dtantsur: yes this is the same thing we discsussed when Inspection was first introduced in Ironic and was dropped | 10:23 |
| *** tiendc has quit IRC | 10:24 | |
| stendulker | dtantsur: Its exactly same approach posted in the patch for this | 10:24 |
| dtantsur | stendulker, I'd really appreciate if you talk to him once more. I don't want this to get reverted as soon as it lands :) | 10:24 |
| stendulker | dtantsur: True | 10:24 |
| stendulker | dtantsur: I will change this to RFE and have word with deva on same | 10:25 |
| zhangjl | set boot_mode to bios, uefi, but .....also failed | 10:25 |
| stendulker | dtantsur: thank you | 10:25 |
| zhangjl | it bothered me so long | 10:28 |
| openstackgerrit | Dmitry Tantsur proposed openstack/python-ironicclient: Add --wait flag for provision actions and wait_for_provision_state function https://review.openstack.org/328191 | 10:33 |
| xuao | ping jroll,sambetts, if you have some suggestion about it ? I think we are in a blind alley, and I am so sorry to give trouble to you T .T | 10:34 |
| jroll | xuao: all I've seen today is "node hangs when booting user image", going to need more info than that | 10:35 |
| xuao | wait a minute, I'll show you our all log paste | 10:35 |
| jroll | xuao: maybe put together a paste with the console log, the driver you are using, ironic settings, ironic version, IPA version, ironic-conductor logs, node-show, etc... | 10:36 |
| jroll | sounds like probably an image problem, though | 10:36 |
| xuao | OK, we'll put all of them together, please wait for a moment ~ | 10:37 |
| jroll | sure | 10:37 |
| zhangjl | ping jroll, our ironic version is mitaka | 10:45 |
| zhangjl | and IPA version is also mitaka | 10:45 |
| zhangjl | the follow is our step to create deploy images and user images http://paste.openstack.org/show/558352/ | 10:46 |
| zhangjl | our commands to create ironic node http://paste.openstack.org/show/557493/ | 10:46 |
| zhangjl | and our ironic configuration file http://paste.openstack.org/show/558353/ | 10:46 |
| zhangjl | Physical node infomation http://paste.openstack.org/show/558354/ | 10:46 |
| zhangjl | Physical node system log http://paste.openstack.org/show/558355/ | 10:47 |
| *** fragatina has joined #openstack-ironic | 10:47 | |
| jroll | okay, thanks | 10:48 |
| zhangjl | thanks for your help | 10:49 |
| jroll | zhangjl: any chance you could boot up an agent on the machine and show the partition layout and such? | 10:49 |
| *** phuongnh has quit IRC | 10:49 | |
| jroll | and perhaps an "ironic node-show" for the node as well | 10:49 |
| zhangjl | this is the result of ironic node-show http://paste.openstack.org/show/558357/ | 10:52 |
| zhangjl | jroll, and , you mean that i need to run agent on my physical node | 10:53 |
| zhangjl | while, there is no os in my node... | 10:53 |
| jroll | zhangjl: right, the agent, or some sort of rescue image or something | 10:54 |
| jroll | and while there *is* an OS | 10:54 |
| jroll | in other words, when it hangs at boot like this, we should boot some rescue image or an agent and look at the partition table | 10:55 |
| zhangjl | em , let me try | 10:57 |
| xuao | I do it together with zhangjl, I wander if it works that, as it's running deploy-image we enter the deploy-os and fdisk for the partition table? | 10:58 |
| rbartal | dtantsur, Hi Dmitry, I just installed ospd10 and run introspection, What are the new there new properties? cpu_vt:true,cpu_hugepages:true,cpu_txt:true,cpu_aes:true,cpu_hugepages_1g:true | 10:59 |
| openstackgerrit | Jim Rollenhagen proposed openstack/ironic: Add docs for node.resource_class and flavor creation https://review.openstack.org/345081 | 11:00 |
| sambetts | rbartal: those properties are the features supported by the nodes CPU, and if they are enabled or not | 11:00 |
| dtantsur | this ^^^ | 11:00 |
| dtantsur | rbartal, I don't think they're used in tripleo/ospd right now | 11:01 |
| TheJulia | Good morning | 11:01 |
| dtantsur | morning TheJulia | 11:01 |
| jroll | hey TheJulia | 11:01 |
| sambetts | rbartal: for example the cpu_vt flag, shows if the CPU has support for hardware accelerated virtualisation and if its enabled | 11:01 |
| openstackgerrit | Tang Chen proposed openstack/ironic: Split v1 API root unit and functional tests https://review.openstack.org/348965 | 11:01 |
| openstackgerrit | Tang Chen proposed openstack/ironic: Move api driver tests to functional dir https://review.openstack.org/350365 | 11:01 |
| openstackgerrit | Tang Chen proposed openstack/ironic: Prepare for functional tests https://review.openstack.org/349421 | 11:01 |
| sambetts | o/ TheJulia | 11:01 |
| rbartal | sambetts, dtantsur but the are new right? I don't remember them in previous releases | 11:02 |
| dtantsur | rbartal, correct | 11:02 |
| rbartal | dtantsur, thanks | 11:02 |
| sambetts | rbartal: correct, http://docs.openstack.org/releasenotes/ironic-inspector/current-series.html#id3 | 11:03 |
| openstackgerrit | Jim Rollenhagen proposed openstack/ironic: Bring upgrade documentation up to date https://review.openstack.org/354075 | 11:10 |
| jroll | yay docs | 11:10 |
| rbartal | sambetts, thanks | 11:11 |
| *** baoli has joined #openstack-ironic | 11:14 | |
| * TheJulia sips coffee in an attempt to wake up | 11:15 | |
| *** baoli has quit IRC | 11:19 | |
| *** fragatin_ has joined #openstack-ironic | 11:19 | |
| *** stendulker has quit IRC | 11:19 | |
| *** fragatina has quit IRC | 11:23 | |
| *** xuao-m has joined #openstack-ironic | 11:26 | |
| *** xuao has quit IRC | 11:26 | |
| mat128 | morning TheJulia | 11:26 |
| TheJulia | good morning dtantsur jroll sambetts mat128 | 11:26 |
| *** xuao-m has quit IRC | 11:30 | |
| *** ccamacho is now known as ccamacho|lunch | 11:31 | |
| *** vmud213 has joined #openstack-ironic | 11:33 | |
| *** mbound has joined #openstack-ironic | 11:34 | |
| *** sdake has joined #openstack-ironic | 11:36 | |
| *** xuao has joined #openstack-ironic | 11:38 | |
| openstackgerrit | Tang Chen proposed openstack/ironic: Move "server_profile_template_uri" to REQUIRED_ON_PROPERTIES https://review.openstack.org/347127 | 11:39 |
| *** milan has joined #openstack-ironic | 11:42 | |
| milan | morning Ironic! :) | 11:43 |
| sambetts | hi milan | 11:44 |
| milan | hi sambetts! :) | 11:44 |
| *** xuao has quit IRC | 11:45 | |
| *** xuao has joined #openstack-ironic | 11:45 | |
| openstackgerrit | Tang Chen proposed openstack/ironic: Split v1 API root unit and functional tests https://review.openstack.org/348965 | 11:45 |
| openstackgerrit | Tang Chen proposed openstack/ironic: Move api driver tests to functional dir https://review.openstack.org/350365 | 11:45 |
| openstackgerrit | Tang Chen proposed openstack/ironic: Prepare for functional tests https://review.openstack.org/349421 | 11:45 |
| milan | aarefiev, morning, I've found another issue with the states patch, so probably I'll put it on WIP for a bit (locks not released in case the event/transition decorator prevents the decorated function to execute) | 11:46 |
| dtantsur | eek folks, should we really have gate-tempest-dsvm-ironic-multitenant-network voting on Mitaka? jroll, vsaienk0? | 11:46 |
| milan | aarefiev, sambetts how do you guys feel about me organising some hangout w/r the review? | 11:47 |
| *** xuao has quit IRC | 11:47 | |
| jroll | dtantsur: lol! no | 11:48 |
| sambetts | milan: that might help, I'm at a point where I'm a little lost going through it all | 11:48 |
| sambetts | dtantsur: errm, no :/ did I break another thing with my refactor :-P | 11:49 |
| vsaienk0 | dtantsur: multitenancy functionality has been added at Newton | 11:49 |
| dtantsur | maybe? | 11:49 |
| dtantsur | now it's voting, so Mitaka is broken. can someone please propose a patch? | 11:49 |
| milan | sambetts, cool, how about I explain there what the point of it is and we'll have some discussion afterwards? | 11:49 |
| sambetts | milan: sounds good to me | 11:50 |
| wlfightup | good moring | 11:50 |
| dtantsur | morning wlfightup | 11:50 |
| milan | sambetts, does hangouts work for you? | 11:50 |
| sambetts | milan: yup :) | 11:50 |
| milan | morning wlfightup | 11:50 |
| milan | cool :) | 11:50 |
| milan | sambetts, time preference? ;) | 11:50 |
| milan | also aarefiev ^ | 11:50 |
| milan | ;) | 11:50 |
| wlfightup | you are get up really early | 11:51 |
| aarefiev | milan: ahh, good idea, I'll be on pto on thursday and friday. other days work for me | 11:51 |
| dtantsur | wlfightup, who exactly? for us in Europe it's not so early :) | 11:51 |
| * milan checks calendar | 11:51 | |
| wlfightup | usa is seven | 11:52 |
| dtantsur | vsaienk0, do you want to propose a patch removing gate-tempest-dsvm-ironic-multitenant-network from stable branches or should I? | 11:52 |
| wlfightup | I have a problem, can help me resolve? | 11:52 |
| dtantsur | maybe. tell us and we'll see | 11:53 |
| sambetts | vsaienk0, dtantsur: I can do it if you want, I have the code open in the right place | 11:53 |
| dtantsur | sambetts, please | 11:53 |
| TheJulia | well, it is almost 8 AM on the east coast of the united states | 11:53 |
| *** baoli has joined #openstack-ironic | 11:53 | |
| vsaienk0 | sambetts: go ahead, please :) | 11:54 |
| milan | aarefiev, sambetts, how about 15:00 UTC? | 11:54 |
| wlfightup | http://stackoverflow.com/questions/38966404/how-to-add-ironic-db-version-file-now-install-dont-copying-db-version-file-ho | 11:54 |
| * dtantsur is rarely up at 8am :) | 11:54 | |
| milan | * today | 11:54 |
| *** baoli_ has joined #openstack-ironic | 11:54 | |
| milan | oops, actually, nope | 11:55 |
| milan | sambetts, aarefiev 16:30 UTC today? | 11:56 |
| sambetts | milan: I am free then | 11:56 |
| TheJulia | wlfightup: why are you running setup.py build? | 11:57 |
| dtantsur | wlfightup, I'm responding there, please stay tuned | 11:57 |
| aarefiev | milan: oky | 11:57 |
| wlfightup | oky | 11:57 |
| wlfightup | I want install ironic code, so setup.py | 11:57 |
| lucasagomes | wlfightup, I think I've answered your question in the ML no? | 11:58 |
| *** baoli has quit IRC | 11:58 | |
| milan | sambetts, aarefiev OK cool, you guys mind sharing your gmails? mine: vetrisko@gmail.com | 11:58 |
| lucasagomes | wlfightup, did you take a look at the FAQ about creating a migration script? | 11:58 |
| wlfightup | dont't copying file when put file into db/version | 11:58 |
| lucasagomes | http://docs.openstack.org/developer/ironic/dev/faq.html#create-a-migration-script-template | 11:58 |
| wlfightup | whereis FAQ? | 11:58 |
| lucasagomes | wlfightup, http://docs.openstack.org/developer/ironic/dev/faq.html#create-a-migration-script-template | 11:58 |
| dtantsur | wlfightup, http://stackoverflow.com/a/38974364/1336685 | 11:59 |
| wlfightup | I seem to be in accordance with official documents | 11:59 |
| TheJulia | wlfightup: fyi, as I understand it, setup.py shouldn't generally be used on openstack projects as it doesn't properly handle dependencies. However, pip does properly handle dependencies. | 12:00 |
| wlfightup | o | 12:01 |
| openstackgerrit | Dmitry Tantsur proposed openstack/python-ironicclient: [WIP] Add --wait to OSC provisioning commands https://review.openstack.org/354806 | 12:01 |
| jroll | dtantsur: gate-tempest-dsvm-ironic-multitenant-network | 12:02 |
| jroll | urgh | 12:02 |
| jroll | dtantsur: https://review.openstack.org/355880 | 12:02 |
| wlfightup | i create migration type is correct , but setup.py don't copy | 12:02 |
| wlfightup | how to do | 12:02 |
| sambetts | jroll: literally just put up an identiacal patch XD | 12:02 |
| dtantsur | jroll, the regexp syntax is wrong there | 12:02 |
| jroll | is it? | 12:03 |
| *** dprince has joined #openstack-ironic | 12:03 | |
| dtantsur | yeah, so should be brackets around (liberty|mitaka) | 12:03 |
| jroll | oh oops | 12:03 |
| jroll | thanks | 12:03 |
| dtantsur | sambetts' is correct, so figure out please which one to leave :) | 12:03 |
| jroll | I can abandon, heh | 12:04 |
| sambetts | hehe | 12:04 |
| jroll | done | 12:04 |
| lucasagomes | sambetts, ur fix in project-config (hopefully fixing stable) is merged :-) | 12:04 |
| lucasagomes | w00t | 12:04 |
| sambetts | \o/ | 12:04 |
| dtantsur | lucasagomes, unfortunately, we need one more fix :( this is what we're discussing right now | 12:04 |
| lucasagomes | dtantsur, yeah saw that | 12:04 |
| lucasagomes | but they are 2 diff problems so | 12:05 |
| sambetts | I'm sure infra are getting board of seeing my name ;) | 12:05 |
| dtantsur | right | 12:05 |
| lucasagomes | half solved :D | 12:05 |
| sambetts | bored* | 12:05 |
| *** bfournie has quit IRC | 12:05 | |
| dtantsur | lol, maybe :) some time ago I was putting a lot of patches, while working on ironic-inspector gate | 12:05 |
| *** fxpester|2 has joined #openstack-ironic | 12:06 | |
| *** tiendc has joined #openstack-ironic | 12:06 | |
| *** lucasagomes is now known as lucas-hungry | 12:06 | |
| *** tiendc has quit IRC | 12:06 | |
| * lucas-hungry go get some lunch | 12:06 | |
| *** fxpester has quit IRC | 12:08 | |
| *** moshele has quit IRC | 12:09 | |
| *** xuao has joined #openstack-ironic | 12:11 | |
| zhangjl | ping jroll | 12:20 |
| zhangjl | http://paste.openstack.org/show/558364/ | 12:20 |
| zhangjl | this is the partition layout of my node | 12:21 |
| jroll | zhangjl: you're using pxe, right? | 12:23 |
| *** MattMan has quit IRC | 12:23 | |
| dtantsur | sambetts, aarefiev, ifarkas, milan, so here's the patch to make grenade voting: https://review.openstack.org/355894. Do we want the tempest job voting too? | 12:23 |
| zhangjl | yes | 12:23 |
| *** MattMan has joined #openstack-ironic | 12:23 | |
| zhangjl | only pex | 12:23 |
| zhangjl | pxe | 12:24 |
| * milan looks | 12:24 | |
| jroll | zhangjl: can you check: ls /dev/disk/by-uuid/8894815e-0b90-40a5-b000-3629cc15dcfe | 12:24 |
| dtantsur | the tempest one should replace the current -ipa one, so we have to think what to do about exercises. | 12:24 |
| milan | dtantsur, btw what's the best way to check the stability of a job? | 12:24 |
| dtantsur | milan, look at several patches? :) I don't think we're on any dashboard | 12:25 |
| zhangjl | clear | 12:25 |
| zhangjl | sorry | 12:25 |
| * milan thought some zuul could be used but unsure | 12:25 | |
| openstackgerrit | Tang Chen proposed openstack/ironic: Move "server_profile_template_uri" to REQUIRED_ON_PROPERTIES https://review.openstack.org/347127 | 12:25 |
| zhangjl | jroll: yes, i can check | 12:25 |
| milan | dtantsur, could we have both of them voting for the rest of Newton? Or is it an overkill? | 12:26 |
| milan | * exercises&tempest | 12:26 |
| dtantsur | we could, but we anyway need a plan forward | 12:26 |
| dtantsur | tempest does not cover our client mostly | 12:26 |
| dtantsur | maybe it's fine, dunno. but then we need a tempest job on the client, which is probably the next step | 12:26 |
| ifarkas | dtantsur, then maybe it's better to wait with replacing the ipa job? | 12:27 |
| zhangjl | this my check result http://paste.openstack.org/show/558365/ | 12:27 |
| dtantsur | ifarkas, that's my point | 12:27 |
| sambetts | milan: http://status.openstack.org/openstack-health/#/ | 12:27 |
| sambetts | dtantsur: ^ | 12:27 |
| ifarkas | dtantsur, +1 then :-) | 12:27 |
| wlfightup | +0 | 12:28 |
| jroll | zhangjl: okay, so the root does exist... hm... maybe lucas-hungry has ideas :/ | 12:28 |
| milan | sambetts, thx | 12:28 |
| dtantsur | sambetts, it does not seem to show our grenade job though.. | 12:28 |
| zhangjl | :'( | 12:29 |
| sambetts | dtantsur: apprently the job has to produce subunit output to be picked up by this system, so we might need something like https://review.openstack.org/#/c/351806/ | 12:30 |
| aarefiev | milan: sorry was on call, aarefiev@mirantis.com , please ping me when it starts | 12:30 |
| dtantsur | ugh | 12:30 |
| milan | aarefiev, cool, I've sent you an invitation through calendar, I hope it arrived | 12:30 |
| aarefiev | dtantsur: +1 for both | 12:31 |
| sambetts | dtantsur: infra are working on make the health system actually get the sucess/fail stats from zuul, but its not quite there yet so they have to rely on the subunit output | 12:31 |
| aarefiev | milan: thanks | 12:31 |
| zhangjl | anyone can help me ? | 12:32 |
| aarefiev | one issue I saw it's races while ironic sync in basic test | 12:32 |
| aarefiev | I've proposed increase timeout https://review.openstack.org/#/c/350499/ | 12:33 |
| *** cdearborn has joined #openstack-ironic | 12:33 | |
| openstackgerrit | Galyna Zholtkevych proposed openstack/ironic: Refactoring code of generating temp_url https://review.openstack.org/352289 | 12:34 |
| *** zhangjl has left #openstack-ironic | 12:36 | |
| *** xuao has quit IRC | 12:36 | |
| *** zhangjl has joined #openstack-ironic | 12:36 | |
| *** zhangjl has left #openstack-ironic | 12:37 | |
| *** rbudden has joined #openstack-ironic | 12:38 | |
| *** ccamacho|lunch is now known as ccamacho | 12:38 | |
| *** bfournie has joined #openstack-ironic | 12:39 | |
| milan | sambetts btw do you mind +w on aarefiev's patch to make inspector--ironic sync timeout longer? https://review.openstack.org/#/c/350499/ | 12:39 |
| milan | got +2 already from dtantsur ^ | 12:40 |
| sambetts | milan: done :) | 12:42 |
| milan | cool :) | 12:42 |
| * milan feels safer w/r gating on tempest stuff now :D | 12:43 | |
| *** rloo has joined #openstack-ironic | 12:45 | |
| *** mbound has quit IRC | 12:48 | |
| thiagop | Good morning, Ironic | 12:49 |
| *** ChubYann has quit IRC | 12:51 | |
| *** Guest14039 is now known as rook | 12:52 | |
| thiagop | jroll: is the gate already back? | 12:56 |
| jroll | thiagop: see the whiteboard for current status | 12:56 |
| jroll | I don't have a real-time answer for you | 12:56 |
| thiagop | jroll: ack | 12:57 |
| * dtantsur updates with ironicclient breakage | 12:57 | |
| *** vikrant has quit IRC | 12:59 | |
| *** ChubYann has joined #openstack-ironic | 13:07 | |
| *** lucas-hungry is now known as lucasagomes | 13:10 | |
| *** lifeless has quit IRC | 13:11 | |
| lucasagomes | jroll, you have the error he's seen handy there ? (he's not on irc atm) | 13:15 |
| jroll | lucasagomes: it's the same thing with it hanging looking for some partition | 13:16 |
| jroll | http://paste.openstack.org/show/558365/ | 13:16 |
| jroll | http://paste.openstack.org/show/558364/ | 13:16 |
| jroll | http://paste.openstack.org/show/558357/ | 13:16 |
| jroll | http://paste.openstack.org/show/558355/ | 13:16 |
| jroll | all relevant | 13:16 |
| lucasagomes | cheerios | 13:16 |
| jroll | np, thanks for looking | 13:17 |
| lucasagomes | jroll, I think I told 'em yesterday to add a "debug" parameter to the kernel cmdline | 13:17 |
| jroll | I googled a bit and also found something about swap weirdness, could be related I guess? dunno | 13:17 |
| jroll | ah yeah | 13:17 |
| lucasagomes | and another systemd debug | 13:17 |
| lucasagomes | jroll, not sure, anyway will tell 'em again when they get back online | 13:18 |
| jroll | sure, thanks | 13:18 |
| *** lifeless has joined #openstack-ironic | 13:29 | |
| openstackgerrit | Merged openstack/ironic-inspector: Tempest: increase ironic sync timeout https://review.openstack.org/350499 | 13:31 |
| aarefiev | milan dtantsur sambetts: grenade http://pasteboard.co/9lsKZB47d.png | 13:32 |
| aarefiev | http://graphite.openstack.org/ doesn't create link for me | 13:32 |
| milan | aarefiev, nice pic :) | 13:32 |
| aarefiev | milan sambetts: :) thanks for +w | 13:32 |
| milan | aarefiev, np :) | 13:33 |
| aarefiev | milan: sorry didn't get invitation ( | 13:33 |
| rloo | hi everyone, milan, aarefiev, jroll, lucasagomes, thiagop, dtantsur | 13:33 |
| milan | aarefiev, I'll resend | 13:33 |
| thiagop | morning rloo | 13:33 |
| jroll | morning rloo | 13:33 |
| TheJulia | good morning rloo | 13:33 |
| milan | hi rloo :) | 13:33 |
| aarefiev | morning rloo | 13:33 |
| dtantsur | morning rloo | 13:33 |
| rloo | looks like a good morning for documentation. Is that the only thing that could merge? :-( | 13:34 |
| jroll | for now, yeah | 13:34 |
| rloo | morning TheJulia | 13:34 |
| jroll | or unit test only changes | 13:34 |
| jroll | gate fix #2 is in the gate queue, though | 13:34 |
| rloo | jroll: Oh, I didn't realize that there were smarts for only unit tests. My favorite stuff to review. NOT. | 13:35 |
| dtantsur | anybody figuring out ironicclient? | 13:35 |
| dtantsur | I can do it after the current meeting | 13:35 |
| rloo | dtantsur: oh, I thought that was figured out. | 13:35 |
| jroll | rloo: heh | 13:35 |
| jroll | dtantsur: I haven't had a chance to look | 13:35 |
| dtantsur | but tbh it looks like a zuul problem. I can't find an error in the logs.. | 13:35 |
| * jroll futzing around with nova-api-metadata this morning | 13:35 | |
| jroll | I'll bug infra about the client dtantsur | 13:36 |
| openstackgerrit | Anton Arefiev proposed openstack/python-ironicclient: Add baremetal port set command to OSC plugin https://review.openstack.org/347287 | 13:36 |
| rloo | is the gate also broken for ipa? | 13:36 |
| *** catintheroof has joined #openstack-ironic | 13:36 | |
| *** vmud213 has quit IRC | 13:37 | |
| jroll | ipa should be okay I think? | 13:37 |
| jroll | ironic just has grenade broken | 13:37 |
| rloo | jroll: ok. i updated the etherpad to make it clearer what was broken | 13:38 |
| rloo | dtantsur: i looked at that log for the osc plugin, it seems like it might have something to do with python-designateclient. | 13:38 |
| * rloo wonders why our ironicclient plugin needs to be tested against other osc plugins... | 13:40 | |
| *** bathris has joined #openstack-ironic | 13:40 | |
| openstackgerrit | Anton Arefiev proposed openstack/python-ironicclient: Add baremetal port set command to OSC plugin https://review.openstack.org/347287 | 13:40 |
| bathris | hi all | 13:40 |
| dtantsur | rloo, this only tests co-installation, e.g. that the plugins don't conflict | 13:40 |
| jroll | it's something with zuul, looking with monty right now | 13:41 |
| aarefiev | dtantsur: rebased ^^ | 13:41 |
| rloo | dtantsur: oh, i guess that's a good reason then... | 13:41 |
| rloo | aarefiev: thx for rebasing. | 13:41 |
| aarefiev | np | 13:41 |
| *** catintheroof has quit IRC | 13:43 | |
| *** mbound has joined #openstack-ironic | 13:48 | |
| jroll | dtantsur: rloo: so this is a timeout, infra is looking into why that ran so slow but it shouldn't be a "100% broken" thing, might instead be the pypi mirror bogged down in that cloud or something | 13:49 |
| dtantsur | so worth rechecking? | 13:49 |
| rloo | jroll: ok, so rechecks should be fine. thx. | 13:49 |
| jroll | yeah, rechecks are okay | 13:49 |
| jroll | we hit the same cloud twice in a row on 328955 | 13:49 |
| jroll | so probably something going on there | 13:50 |
| rloo | jroll, dtantsur: I updated the etherpad to reflect ^^ | 13:51 |
| jroll | thanks | 13:51 |
| *** hshiina has joined #openstack-ironic | 13:53 | |
| *** permalac has joined #openstack-ironic | 13:53 | |
| *** mbound has quit IRC | 13:53 | |
| *** vikrant has joined #openstack-ironic | 13:55 | |
| *** vikrant has quit IRC | 13:57 | |
| *** wajdi has joined #openstack-ironic | 13:57 | |
| *** anush_ has joined #openstack-ironic | 14:00 | |
| *** Lord_Phoenix has quit IRC | 14:02 | |
| *** jistr is now known as jistr|debug | 14:03 | |
| rloo | aarefiev: i didn't realize you had pushed up another revision; see my comments in revision 5 | 14:06 |
| aarefiev | rloo: yep, there was rebasing issue | 14:07 |
| *** parlos has quit IRC | 14:15 | |
| openstackgerrit | Michael Turek proposed openstack/ironic: Add classes for Portgroups API enablement https://review.openstack.org/347549 | 14:18 |
| *** jcoufal has joined #openstack-ironic | 14:20 | |
| rloo | lucasagomes: if you have a few min, let me know what you think wrt 'show_configdrive': https://review.openstack.org/#/c/326768/ | 14:21 |
| rloo | or anyone else that has an opinion on show_configdrive vs show_password... | 14:22 |
| lucasagomes | rloo, hi there, will take a look | 14:23 |
| lucasagomes | rloo, oh good pointes, yeah the name "show_configdrive" might be misleading | 14:26 |
| lucasagomes | rloo, what happens is that, both passwords and configdrive are considered secrets | 14:26 |
| rloo | lucasagomes: who considers them secrets? I mean, do operators think that? | 14:26 |
| jroll | well that's a ball of wax :| | 14:26 |
| lucasagomes | what about an option 4. "show_secrets" that would hide passwords + configdrive | 14:27 |
| lucasagomes | rloo, I thought we all did, devs and operators | 14:27 |
| jroll | configdrives have the root password in them, and potentially other user secrets | 14:27 |
| lucasagomes | for ^ reason yeah | 14:27 |
| jroll | lucasagomes: ++ for show_secrets | 14:27 |
| jroll | well | 14:27 |
| rloo | lucasagomes: yeah, i'm fine with a different name. show_secrets or show_sensitive_info or ... | 14:27 |
| jroll | hrm, I could come up with a use case to give someone IPMI creds but not configdrives | 14:27 |
| * jroll needs to step away | 14:27 | |
| lucasagomes | rloo, cool I will comment on the patch | 14:28 |
| rloo | lucasagomes: thx. although i guess jroll might be noodling about it :) | 14:28 |
| lucasagomes | rloo, it gets into a grey area when it comes to things that can be included in a configdrive | 14:29 |
| lucasagomes | root password is one that nova might inject | 14:29 |
| lucasagomes | but you could inject any other files into it as well | 14:29 |
| rloo | lucasagomes: so maybe we should have a separate show_configdrive? | 14:29 |
| rloo | lucasagomes: seems like 2 questions. 1. do we want one thing to control showing configdrive/passwords/other secrets; 2. what to call these things/rules. | 14:30 |
| lucasagomes | rloo, that's what deva's patch propose right? But at the moment it's just using the oslo function to mask stuff so it masks everything | 14:30 |
| rloo | lucasagomes: right. so first i need to understand what we want to do; then i can review the code to see if it does that :) | 14:30 |
| lucasagomes | rloo, IMHO I would prefer to just have 1 flag, show/hide_secrets (or something along these lines) | 14:30 |
| openstackgerrit | Anton Arefiev proposed openstack/python-ironicclient: Add baremetal port set command to OSC plugin https://review.openstack.org/347287 | 14:32 |
| rloo | lucasagomes: i am fine with 1 flag. as long as that provides enough flexibility for operators. jroll did make a comment above, but i don't know how flexible we need/ought to be... | 14:32 |
| *** rajinir has joined #openstack-ironic | 14:34 | |
| *** michauds has joined #openstack-ironic | 14:35 | |
| lucasagomes | rloo, right, I may be failing to see why an operator may want to hide passwords but keep configdrive in the API responses | 14:36 |
| rloo | lucasagomes: me too, but I'm not an operator. Let's see if others have opinions :) | 14:36 |
| lucasagomes | IMHO they both should be treated as sensitive information (but maybe there's a case, let's see what others think in that review) | 14:37 |
| lucasagomes | rloo, ++ | 14:37 |
| *** links has quit IRC | 14:39 | |
| milan | aarefiev, sambetts, have you guys received the invitation? | 14:40 |
| sambetts | milan: yup | 14:40 |
| milan | cool :) | 14:41 |
| aarefiev | milan: yes, thanks | 14:41 |
| milan | ;) | 14:41 |
| openstackgerrit | Dmitry Tantsur proposed openstack/python-ironicclient: Add --wait flag for provision actions and wait_for_provision_state function https://review.openstack.org/328191 | 14:42 |
| dtantsur | rloo, ^^^ | 14:42 |
| rloo | dtantsur: you so fast! | 14:42 |
| dtantsur | these were small issues :) | 14:42 |
| *** rama_y has joined #openstack-ironic | 14:44 | |
| openstackgerrit | Michael Turek proposed openstack/ironic: Add portgroups to support LAG interfaces - API https://review.openstack.org/332177 | 14:47 |
| *** dprince has quit IRC | 14:49 | |
| jroll | lucasagomes: I was thinking the other way - a datacenter tech might need IPMI creds for troubleshooting, but I might not want to give them user data | 14:49 |
| *** mbound has joined #openstack-ironic | 14:49 | |
| openstackgerrit | Imre Farkas proposed openstack/ironic: DRAC RAID configuration https://review.openstack.org/176319 | 14:49 |
| *** jistr|debug is now known as jistr | 14:50 | |
| lucasagomes | jroll, right so you would hide all configdrive but not the passwords | 14:50 |
| *** hatTip has joined #openstack-ironic | 14:50 | |
| lucasagomes | hmm | 14:50 |
| jroll | lucasagomes: right | 14:51 |
| jroll | I'm okay with hiding all of instance_info | 14:51 |
| jroll | so maybe one thing for driver_info things and another for instance_info? | 14:51 |
| milan | aarefiev, sambetts if you guys wanna hang-out sooner, let's do it even right now actually | 14:51 |
| sambetts | milan: I'm free if you guys are | 14:52 |
| lucasagomes | but is it a real use case? Cause there are other means, if one needs a password to troubleshoot a machine I would say that the operator could send the tech person a email or something | 14:52 |
| lucasagomes | jroll, yeah that's one way too, I think that's deva's #3 suggestion | 14:52 |
| aarefiev | milan: free | 14:53 |
| jroll | depends how much the deployment's techs rely on ironic for management :) | 14:53 |
| milan | I am, I've actually screwed the invite a bit because of daylight saving time O:-) but I'm free right now and that time too :) | 14:53 |
| milan | cool, let's do it in 7min then | 14:53 |
| * milan pushes latest revision | 14:53 | |
| dtantsur | timezones are too hard, let's go shopping | 14:54 |
| lucasagomes | jroll, yeah, getting data about usage is always hard :D | 14:54 |
| lucasagomes | jroll, another point is, the configdrive may or may not be in the instance_info depending on the configuration | 14:54 |
| milan | :D dtantsur let's get to beers | 14:54 |
| lucasagomes | it's possible to configure ironic to save it in swift instead | 14:54 |
| dtantsur | 2 hours more, wait a bit ;) | 14:54 |
| *** mbound has quit IRC | 14:54 | |
| jroll | lucasagomes: indeed | 14:54 |
| sambetts | lucasagomes: if you get the URL from the instance_info can you download it? | 14:55 |
| sambetts | if you can then it might as well be considered the same | 14:55 |
| lucasagomes | sambetts, do we add the url to the instance_info? | 14:55 |
| lucasagomes | if so yeah that's the same | 14:56 |
| lucasagomes | tho, when uploading to swift we do have a expire time | 14:56 |
| lucasagomes | the swift object will be deleted in X seconds, where X is the dpeloyment timeout | 14:56 |
| openstackgerrit | David Lenwell proposed openstack/ironic: Add REST API for volume connector and volume target operation https://review.openstack.org/214586 | 14:56 |
| *** rbartal has quit IRC | 14:56 | |
| rloo | lucasagomes: but that's still a security issue, even for those X seconds. Anyway, I'd rather not special case it. | 14:57 |
| *** _milan_ has joined #openstack-ironic | 14:57 | |
| lucasagomes | rloo, yup totally | 14:57 |
| lucasagomes | looking at the code to see if we do actually add the configdrive to instance_info in case of storing it in swift | 14:57 |
| *** permalac has quit IRC | 14:58 | |
| openstackgerrit | Milan Kováčik proposed openstack/ironic-inspector: Introducing node introspection state management https://review.openstack.org/348943 | 14:58 |
| jroll | I think we store the url so we can re-generate a tempurl if we need to | 14:58 |
| lucasagomes | rloo, we do :-( | 14:58 |
| jroll | lucasagomes: we store the regular url or temp url? | 14:58 |
| sambetts | do we store the tempurl or do we just store the swift object reference? | 14:58 |
| lucasagomes | jroll, temp url | 14:58 |
| lucasagomes | configdrive = swift_api.get_temp_url(container, object_name, | 14:59 |
| * lucasagomes opens in github | 14:59 | |
| jroll | whomp | 14:59 |
| *** milan has quit IRC | 14:59 | |
| lucasagomes | https://github.com/openstack/ironic/blob/master/ironic/conductor/manager.py#L2292-L2297 | 14:59 |
| lucasagomes | jroll, boomer yeah | 14:59 |
| *** sborkows has quit IRC | 15:02 | |
| * lucasagomes wonders why we need to keep the configdrive in the node | 15:02 | |
| JayF | There's a bugfix patch up related to this, actually | 15:03 |
| JayF | I thought it was what you were all talking about until I read scrollback | 15:04 |
| * lucasagomes looks | 15:04 | |
| lucasagomes | https://bugs.launchpad.net/ironic/+bug/1612476 | 15:04 |
| openstack | Launchpad bug 1612476 in Ironic "Keep config drive in swift until server deletion" [High,In progress] - Assigned to xiaobin (jxiaobin) | 15:04 |
| *** ifarkas is now known as ifarkas_afk | 15:04 | |
| lucasagomes | right yeah it makes sense, we keep it because of nova rebuild | 15:04 |
| JayF | lucasagomes: nice, you got the link before i could get there | 15:04 |
| *** fumie has quit IRC | 15:04 | |
| JayF | lucasagomes: well, I dug into this some yesterday, it seems like on nova rebuild nova could just re-ship the configdrive over | 15:05 |
| lucasagomes | hmm and the swift version is broken cause it will be deleted and not available when rebuilding | 15:05 |
| lucasagomes | fun | 15:05 |
| JayF | lucasagomes: but given *ironic* has a rebuild verb, we probably have to persist it for the no-nova case | 15:05 |
| lucasagomes | JayF, yeah, def something to investigate | 15:05 |
| dtantsur | morning JayF | 15:05 |
| JayF | gm | 15:05 |
| lucasagomes | if nova rebuild sends the configdrive again, we don't even need to keep it in Ironic | 15:05 |
| JayF | it doesn't currently in our driver | 15:06 |
| JayF | but it certainly could | 15:06 |
| lucasagomes | JayF, but did you patch it locally or? | 15:06 |
| JayF | I read a lot of code :) | 15:06 |
| JayF | this isn't a bug I care about, just a review I saw and dug into yesterday | 15:06 |
| * lucasagomes adds a todo in his list to investigate nova rebuild | 15:07 | |
| *** thrash is now known as thrash|biab | 15:09 | |
| TheJulia | JayF: I have reservations regarding persisting the configdrive in swift, but I think it is reasonable for non nova users to have to re-submit, although I don't remember if nova submits a new config drive or not when it issues a rebuild | 15:10 |
| *** syed_ has joined #openstack-ironic | 15:10 | |
| openstackgerrit | Julia Kreger proposed openstack/ironic: [WIP] Add storage_interface DB field and object https://review.openstack.org/348005 | 15:11 |
| openstackgerrit | Julia Kreger proposed openstack/ironic: [WIP] Add storage_interface to base driver class https://review.openstack.org/348006 | 15:11 |
| openstackgerrit | Julia Kreger proposed openstack/ironic: [WIP] Add base cinder common interface https://review.openstack.org/355625 | 15:12 |
| *** [1]cdearborn has joined #openstack-ironic | 15:13 | |
| *** jcoufal has quit IRC | 15:13 | |
| *** michauds has quit IRC | 15:15 | |
| JayF | TheJulia: it currently doesn't, but afaict it could if we made it | 15:15 |
| TheJulia | JayF: That is what I thought, I remember looking at it ~9 months ago | 15:15 |
| *** ElCoyote_ has quit IRC | 15:16 | |
| JayF | TheJulia: I'm going to comment in the bug that I think nova should re-submit it, do you mind putting your POV in there too? | 15:16 |
| TheJulia | JayF: oh, any user submitted files for inclusion wouldn't be in the new drive | 15:16 |
| JayF | nova has to store it somewhere, right? | 15:16 |
| TheJulia | I don't think it does | 15:16 |
| TheJulia | _think_, I haven't dug through that part of the code in a while | 15:17 |
| * JayF looks at libvirt driver in nova | 15:17 | |
| wznoinsk | did anyone see a situation where in static-network-up is emitted earlier than all the interfaces get their IPs and their /run/network/ifup.* get created? that's ubuntu 14.04, troubleshooting cloud-init init kicking off to early (before the network is actually up) | 15:17 |
| *** Goneri has quit IRC | 15:17 | |
| *** dprince has joined #openstack-ironic | 15:18 | |
| JayF | wznoinsk: I'm not sure what you're talking about, but if the image is on the disk and the configdrive (if enabled) is there, Ironic did its job. I'd suggest #openstack might be a good audience for a more general question :) | 15:18 |
| *** jcoufal has joined #openstack-ironic | 15:18 | |
| *** Goneri has joined #openstack-ironic | 15:18 | |
| *** athomas has quit IRC | 15:20 | |
| *** hatTip has quit IRC | 15:20 | |
| wznoinsk | JayF: sure, I was asking because some here may have experienced this on ironic nodes rather than blaming ironic itself :) | 15:20 |
| *** mtanino has joined #openstack-ironic | 15:20 | |
| TheJulia | wznoinsk: what do you mean by network is actually up? | 15:21 |
| wznoinsk | TheJulia: I see this at first boot http://paste.openstack.org/show/558409/ | 15:22 |
| wznoinsk | and a few moments later http://paste.openstack.org/show/558410/ | 15:23 |
| JayF | TheJulia: the only nova drivers that implement the "rebuild" method are ones that support preserve_ephemeral, aka ironic *facepalm* | 15:23 |
| *** derekh has quit IRC | 15:24 | |
| *** athomas has joined #openstack-ironic | 15:24 | |
| TheJulia | JayF: ugh | 15:24 |
| *** ccamacho is now known as ccamacho|out | 15:24 | |
| TheJulia | wznoinsk: will look in a minute | 15:24 |
| *** cdearborn has quit IRC | 15:24 | |
| wznoinsk | TheJulia: thanks | 15:27 |
| JayF | TheJulia: https://github.com/openstack/nova/blob/0da6c6461177539cf69c7c2998f3ce8914112b0a/nova/compute/manager.py#L2576 | 15:28 |
| JayF | TheJulia: tl;dr default rebuild just ends up calling spawn on the virt driver, so the configdrive has to be able to be recomputed on rebuild ... right? | 15:28 |
| TheJulia | wznoinsk: sounds like your expecting the OS to bring up all the interfaces, but I think if what I remember is true from digging around cloud images is that they expect eth0 to be the only interface and that it is always connected since they are for VMs, cloud-init brings up the rest afaik | 15:29 |
| *** michauds has joined #openstack-ironic | 15:30 | |
| TheJulia | JayF: I think that is correct, and I think you have to offer stuff up on the nova client if you want files included... otherwise it just passes network_info and other data in | 15:31 |
| JayF | so realistically, by preserving the exact configdrive, it's a difference in behavior from other drivers? | 15:31 |
| TheJulia | I think so yes | 15:32 |
| TheJulia | I think we just need to get it reconstructed and submitted upon rebuild | 15:33 |
| JayF | and if you pass in more new configdrive stuff on rebuild, we ignore it | 15:33 |
| JayF | in b4 this breaks tripleo | 15:33 |
| openstackgerrit | Thiago Paiva Brito proposed openstack/ironic: [WIP] Testing tests removal from tempest https://review.openstack.org/355591 | 15:36 |
| wznoinsk | TheJulia: I'm using dhcp-all-interfaces dib element | 15:37 |
| wznoinsk | which does: http://paste.openstack.org/show/558413/ | 15:37 |
| JayF | TheJulia: https://bugs.launchpad.net/ironic/+bug/1612476 summarized that all in here, if you wanna drop in a word about the standalone/bifrost use case | 15:39 |
| openstack | Launchpad bug 1612476 in Ironic "Keep config drive in swift until server deletion" [High,In progress] - Assigned to xiaobin (jxiaobin) | 15:39 |
| *** amotoki has joined #openstack-ironic | 15:40 | |
| *** amotoki has quit IRC | 15:43 | |
| *** amotoki has joined #openstack-ironic | 15:43 | |
| *** rpioso has joined #openstack-ironic | 15:45 | |
| *** rcernin has quit IRC | 15:46 | |
| *** e0ne has quit IRC | 15:49 | |
| *** athomas has quit IRC | 15:50 | |
| *** athomas has joined #openstack-ironic | 15:56 | |
| TheJulia | wznoinsk: sorry, context switching way too much at the moment. :\ Seems like a question of which part should own interface init | 15:59 |
| *** Sukhdev has joined #openstack-ironic | 16:01 | |
| *** anush_ has quit IRC | 16:02 | |
| *** jcoufal_ has joined #openstack-ironic | 16:03 | |
| *** Sukhdev has quit IRC | 16:05 | |
| *** snizar has joined #openstack-ironic | 16:05 | |
| *** snizar_ has joined #openstack-ironic | 16:05 | |
| lucasagomes | JayF, TheJulia jroll so, rebuild does not send the configdrive | 16:05 |
| lucasagomes | now, I thin we could change it, because it's up the the driver to generate it | 16:05 |
| lucasagomes | that's what we do at spawn() https://github.com/openstack/nova/blob/master/nova/virt/ironic/driver.py#L770-L790 | 16:05 |
| lucasagomes | we could have something similar on rebuild() | 16:06 |
| *** jcoufal has quit IRC | 16:06 | |
| lucasagomes | and change the ironic rebuild command to accept the configdrive as a parameter as well | 16:06 |
| lucasagomes | with that, I think we won't need to keep it anywhere | 16:07 |
| JayF | lucasagomes: yep, exactly | 16:07 |
| JayF | lucasagomes: I commented on the bug with exactly that | 16:07 |
| lucasagomes | (apart from the standalone version) | 16:07 |
| JayF | lucasagomes: tl;dr all other nova virt drivers implement rebuild as a second call to spawn | 16:07 |
| lucasagomes | JayF, cool | 16:07 |
| lucasagomes | JayF, worth checking if it's something Nova will accept too | 16:07 |
| lucasagomes | JayF, oh they do? Great | 16:07 |
| lucasagomes | ok | 16:07 |
| JayF | lucasagomes: code is linked in the bug comment | 16:07 |
| *** amotoki has quit IRC | 16:07 | |
| lucasagomes | JayF, will take a look, thanks for that | 16:07 |
| JayF | lucasagomes: but an additional -1 on the code and an agreement in the bug would be appreciated :D | 16:07 |
| lucasagomes | ++ | 16:08 |
| *** sdake has quit IRC | 16:09 | |
| *** hshiina has quit IRC | 16:15 | |
| NobodyCam | morning Ironic'ers | 16:15 |
| thiagop | morning NobodyCam | 16:15 |
| NobodyCam | morning thiagop :) | 16:15 |
| dtantsur | morning NobodyCam | 16:18 |
| dtantsur | and g'night everyone else :) | 16:18 |
| NobodyCam | morning dtantsur :) | 16:18 |
| NobodyCam | hight dtantsur :p | 16:18 |
| *** dtantsur is now known as dtantsur|afk | 16:18 | |
| dtantsur|afk | :) | 16:18 |
| NobodyCam | night even | 16:18 |
| openstackgerrit | Stephanie Miller proposed openstack/ironic: Add volume_connector table to save connector information https://review.openstack.org/200983 | 16:21 |
| *** Sukhdev has joined #openstack-ironic | 16:23 | |
| d0ugal | Does Ironic test the database migrations? | 16:23 |
| *** bathris has quit IRC | 16:24 | |
| jroll | d0ugal: yes, why? | 16:24 |
| d0ugal | jroll: I am curious to know how it works, do you happen to know where it is setup? | 16:24 |
| * d0ugal is failing at grep | 16:25 | |
| jroll | d0ugal: idk all the details but this is a good starting point https://github.com/openstack/ironic/blob/master/ironic/tests/unit/db/sqlalchemy/test_migrations.py | 16:25 |
| jroll | it'll skip it if db isn't present and such | 16:25 |
| d0ugal | jroll: lol, that file couldn't have been any more obviously named. | 16:25 |
| jroll | :D | 16:25 |
| d0ugal | jroll: sorry I missed it, but thanks! | 16:25 |
| jroll | no worries! | 16:25 |
| *** jpich has quit IRC | 16:30 | |
| *** baoli_ has quit IRC | 16:31 | |
| jlvillal | jroll: In working on the multi-node testing. We have run into this issue: http://logs.openstack.org/32/296432/96/experimental/gate-tempest-dsvm-ironic-ipa-partition-pxe_ssh-tinyipa-multinode-nv/351eb00/logs/screen-n-cpu.txt.gz?level=ERROR | 16:50 |
| jlvillal | jroll: vsaienk0 thinks it is related to moving from 1 VM to 3 VMs, which makes sense to me. | 16:51 |
| jlvillal | Just wondering if you had any thoughts on it. I'm looking into it today. | 16:51 |
| jroll | O_o | 16:51 |
| jlvillal | yeah... | 16:52 |
| jroll | oh, that reminds me of a bug we had filed | 16:52 |
| jroll | but in a meeting so idk if I can find it right now | 16:52 |
| jroll | but sounds like a reschedule + didn't clean up the previous node | 16:52 |
| mat128 | jlvillal: it seems like nova thinks the instance should go on that node but Ironic is refusing because that UUID is already associated with another node | 16:52 |
| jlvillal | jroll: No worries, whenever you have some free time :) Thanks. | 16:52 |
| jlvillal | mat128: Yeah. We weren't sure if it had to do with the multi-compute host work or not. | 16:53 |
| * sambetts -> home | 16:53 | |
| jroll | jlvillal: search that error in LP | 16:53 |
| jlvillal | jroll: Will do | 16:53 |
| sambetts | night all o/ | 16:53 |
| *** _milan_ has quit IRC | 16:53 | |
| mat128 | cya sambetts | 16:53 |
| jlvillal | sambetts: Good night! | 16:53 |
| *** sambetts is now known as sambetts|afk | 16:53 | |
| jroll | jlvillal: definitely unrelated to any recent work :) | 16:53 |
| jlvillal | jroll: Good to hear :) | 16:53 |
| *** _milan_ has joined #openstack-ironic | 16:55 | |
| *** _milan_ has quit IRC | 16:58 | |
| *** thrash|biab is now known as thrash | 16:59 | |
| openstackgerrit | Pavlo Shchelokovskyy proposed openstack/ironic: Allow changing lock purpose on lock upgrade https://review.openstack.org/356064 | 17:00 |
| lucasagomes | calling it a day folks, have a great evening all | 17:02 |
| lucasagomes | see you tomorrow | 17:02 |
| *** sabeen has joined #openstack-ironic | 17:02 | |
| *** lucasagomes is now known as lucas-dinner | 17:02 | |
| jlvillal | lucas-dinner: Good night | 17:03 |
| NobodyCam | night lucas-dinner | 17:03 |
| NobodyCam | night sambetts|afk | 17:03 |
| jlvillal | jroll: This looks similar: https://bugs.launchpad.net/ironic/+bug/1404116 | 17:04 |
| openstack | Launchpad bug 1404116 in Ironic "nova/virt interactions could race leading to double-assigned instance" [Medium,Confirmed] | 17:04 |
| jroll | jlvillal: +1 | 17:04 |
| *** david-lyle_ has joined #openstack-ironic | 17:09 | |
| *** manjeets_ has joined #openstack-ironic | 17:11 | |
| *** e0ne has joined #openstack-ironic | 17:11 | |
| manjeets_ | hello folks I am seeing huge failure on this job | 17:12 |
| manjeets_ | http://logstash.openstack.org/#/dashboard/file/logstash.json?query=build_name:%5C%22gate-tempest-dsvm-ironic-ipa-partition-pxe_ssh-tinyipa%5C%22%20AND%20build_status:FAILURE | 17:12 |
| manjeets_ | in last 12 hours | 17:13 |
| manjeets_ | not sure if a patch in ironic or neutron broke this | 17:13 |
| manjeets_ | so just checking out | 17:13 |
| *** david-lyle has quit IRC | 17:13 | |
| openstackgerrit | Merged openstack/bifrost: Set OS_AUTH_TOKEN to dummy string, instead of empty space https://review.openstack.org/354615 | 17:13 |
| *** david-lyle_ is now known as david-lyle | 17:13 | |
| jroll | manjeets_: yeah, that was broken, should be okay now, but our grenade job is still a bit fuabr | 17:20 |
| jroll | manjeets_: see https://etherpad.openstack.org/p/IronicWhiteBoard for latest gate status | 17:20 |
| manjeets_ | jroll, was that ironic or neutron which broke ? | 17:20 |
| jroll | manjeets_: devstack | 17:20 |
| jroll | manjeets_: https://bugs.launchpad.net/devstack/+bug/1613417 | 17:21 |
| openstack | Launchpad bug 1613417 in devstack "gate-tempest-dsvm-cells broken with cell v2 setup: "No hosts found to map to cell, exiting."" [Undecided,Fix released] | 17:21 |
| manjeets_ | ok jroll thank you very much I had some patches in neutron which were crashing this regularly | 17:23 |
| jroll | manjeets_: ah, yeah, should be fine now if you recheck | 17:23 |
| jroll | manjeets_: and thanks for looking at non-voting jobs :) | 17:23 |
| manjeets_ | jroll, it did'nt say not voting on https://review.openstack.org/#/c/348757/ | 17:25 |
| jroll | manjeets_: I think it was non-voting in the past, hmm | 17:25 |
| manjeets_ | gate-tempest-dsvm-ironic-ipa-partition-pxe_ssh-tinyipa i don't see (non voting) | 17:25 |
| manjeets_ | jroll, I am noticing it for past week | 17:26 |
| jroll | right, it should be, I think we messed that up | 17:27 |
| JayF | the partition image job is supposed to be voting, on ipa at least | 17:28 |
| manjeets_ | jroll, is there any doc where I can learn more info about job details gate-tempest-dsvm-ironic-ipa-partition-pxe_ssh-tinyipa | 17:29 |
| jroll | JayF: not on neutron | 17:29 |
| jroll | manjeets_: not really | 17:29 |
| jroll | manjeets_: I'm making it non-voting now | 17:30 |
| JayF | jroll: yikes, that job maybe shouldn't even run on neutron? | 17:30 |
| jroll | JayF: it should, neutron's broken us quite a few times | 17:30 |
| jroll | dhcp is hard (tm) | 17:30 |
| manjeets_ | jroll, what does it exactly checks ? | 17:30 |
| jroll | manjeets_: in short, it makes sure ironic works | 17:30 |
| manjeets_ | neutron + baremetal ? | 17:31 |
| jroll | ironic only works with neutron, yes | 17:31 |
| jroll | so it's nova/neutron/ironic | 17:31 |
| manjeets_ | jroll just deployment or spinning some nova instance on baremetal using neutron net ? | 17:32 |
| jroll | manjeets_: the latter | 17:32 |
| *** baoli has joined #openstack-ironic | 17:33 | |
| jroll | manjeets_: thanks for bringing this to my attention, this patch makes it non-voting again https://review.openstack.org/356072 | 17:33 |
| *** electrofelix has quit IRC | 17:37 | |
| *** snizar_ has quit IRC | 17:38 | |
| *** ccamacho|out has quit IRC | 17:38 | |
| *** snizar has quit IRC | 17:38 | |
| manjeets_ | jroll thanks | 17:38 |
| openstackgerrit | Merged openstack/bifrost: Remove auth line to fallback on default(omit) behaviour https://review.openstack.org/353990 | 17:39 |
| *** ohamada has quit IRC | 17:41 | |
| *** athomas has quit IRC | 17:42 | |
| *** snizar_ has joined #openstack-ironic | 17:43 | |
| *** snizar has joined #openstack-ironic | 17:43 | |
| openstackgerrit | Ankit Kumar proposed openstack/proliantutils: Fix log message for exception in Gen7 https://review.openstack.org/353860 | 17:47 |
| *** Sukhdev has quit IRC | 17:53 | |
| *** sdake has joined #openstack-ironic | 17:55 | |
| *** mhayden has joined #openstack-ironic | 17:56 | |
| *** baoli has quit IRC | 17:56 | |
| *** ccamacho has joined #openstack-ironic | 17:57 | |
| *** aNupoisc has joined #openstack-ironic | 17:57 | |
| *** baoli has joined #openstack-ironic | 17:57 | |
| *** rcernin has joined #openstack-ironic | 18:01 | |
| mhayden | jroll: kudos to whomever wrote these flow diagrams in the ironic user guide -- makes the PXE boot process much easier to grok | 18:05 |
| jroll | mhayden: +1 | 18:05 |
| jroll | JayF: ^ look who showed up :) | 18:05 |
| * mhayden hides | 18:06 | |
| JayF | What a major addition to our channel! | 18:06 |
| mhayden | haha | 18:06 |
| NobodyCam | welcome mhayden :) | 18:06 |
| mhayden | which method of deployment is more predominant in the community? iscsi or direct deploy? | 18:06 |
| JayF | I always think of it as use-case driven | 18:06 |
| JayF | if you have local conductors (network-wise) to the servers, iscsi can often do more servers in parallel faster | 18:07 |
| JayF | if you have a scaled out swift cluster you can use, and the conductors don't have as good of network to the nodes, agent is often faster | 18:07 |
| *** dprince has quit IRC | 18:07 | |
| mhayden | that makes sense | 18:07 |
| jroll | we were just talking this morning about how iscsi can present stranger bugs, too | 18:08 |
| *** ccamacho has quit IRC | 18:08 | |
| * mat128 was wondering why I was the only one who appeared not to know mhayden, but then I found https://www.linkedin.com/in/majorhayden | 18:08 | |
| mat128 | welcome aboard :) | 18:08 |
| mhayden | haha, thanks | 18:09 |
| mhayden | i'm trying to understand ironic so i can help with the OSA integration | 18:09 |
| mhayden | OSA = OpenStack-Ansible | 18:09 |
| JayF | Are you asking the "what should we enable by default" question? | 18:09 |
| mhayden | this deploy process reminds me of the internal stuff antonym and i were cooking up, except this looks much nicer :P | 18:09 |
| jroll | mhayden: I always wanted to converge those :) | 18:10 |
| mhayden | JayF: i'm looking at it from a private cloud scenario where the environment may start small and then grow over time | 18:10 |
| JayF | mhayden: I tried to talk ant into using ironic for all that back a year or so ago, and didn't get anywhere ;( I think I caught you all too late in the process | 18:10 |
| JayF | mhayden: Honestly, if most of our priv clouds already have swift deployments, I'd use agent | 18:10 |
| JayF | mhayden: if not, agent deployments require swift, so clearly iscsi is the one to pick | 18:10 |
| mhayden | ah, so that's the kicker, i guess -- if swift isn't available, iscsi is the only method available? | 18:11 |
| mat128 | JayF: you can get around without swift, no? | 18:11 |
| JayF | mat128: I think we support swift + radosgw for agent driver | 18:11 |
| JayF | mat128: but if you're talking integrated-with-nova, you have to have one of those | 18:11 |
| JayF | if you're using ironic standalone, you can just pass through an http url | 18:11 |
| JayF | but I don't /think/ that works with nova | 18:11 |
| mat128 | hmm | 18:11 |
| mat128 | you're right | 18:11 |
| jroll | I agree with that assertion | 18:11 |
| JayF | mhayden: ^ see above; swift || radosgw (ceph) required for nova+ironic w/agent deploy driver | 18:12 |
| JayF | mhayden: if you're just doing ironic, or bifrost+ironic, you can just pass thruogh an http url for the image that the agent can hit | 18:12 |
| JayF | (swift/ceph needs tempurls enabled as well fwiw) | 18:12 |
| * mhayden begs for forgiveness with such noob questions | 18:14 | |
| jroll | we <3 noobs here | 18:14 |
| mat128 | @here maybe we could have a metadata in glance for an alternate URL | 18:14 |
| mat128 | that ironic could use? | 18:14 |
| mhayden | to be fair, jroll said there was candy available here | 18:14 |
| mat128 | avoiding swift =) | 18:14 |
| mhayden | so i had to come by | 18:14 |
| jroll | NobodyCam has the candy | 18:15 |
| JayF | mat128: we are not slack :P | 18:15 |
| mat128 | haha | 18:15 |
| NobodyCam | lol :) | 18:15 |
| jroll | mat128: yeah, sounds like some sort of cross-project thing to work out | 18:15 |
| mat128 | I was thinking those "private cloud deployments without swift" are configured as such because they do not want a full blown swift | 18:15 |
| JayF | I sorta question if there's enough pain to be worth it :) but if you want it, have fun :P | 18:15 |
| jroll | JayF: shouldn't be too bad | 18:16 |
| JayF | Another option for without swift | 18:16 |
| JayF | would be locally caching the image on a conductor | 18:16 |
| JayF | and having the agent pull it from there | 18:16 |
| * jroll needs a nice big break, bbl | 18:16 | |
| jroll | ah yeah | 18:16 |
| mat128 | off-topic, but while you guys are around, what do you think of https://review.openstack.org/#/c/312626/2/specs/newton/approved/multiple-fixed-ips-network-information.rst ? | 18:21 |
| mat128 | guys here despair that it will take too long to land upstream but I'm trying to convince them otherwise | 18:21 |
| *** fragatin_ has quit IRC | 18:24 | |
| JayF | morgabra: ^ you might find that interesting | 18:24 |
| *** fragatina has joined #openstack-ironic | 18:24 | |
| *** dprince has joined #openstack-ironic | 18:27 | |
| *** baoli has quit IRC | 18:29 | |
| *** baoli has joined #openstack-ironic | 18:29 | |
| *** michauds has quit IRC | 18:34 | |
| *** fragatina has quit IRC | 18:35 | |
| *** aarefiev_ has joined #openstack-ironic | 18:38 | |
| *** _vsaienko has joined #openstack-ironic | 18:40 | |
| *** amotoki has joined #openstack-ironic | 18:45 | |
| *** michauds has joined #openstack-ironic | 18:46 | |
| openstackgerrit | Vasyl Saienko proposed openstack/ironic: DO NOT REVIEW https://review.openstack.org/296432 | 18:47 |
| *** amotoki has quit IRC | 18:48 | |
| *** snizar_ has quit IRC | 18:54 | |
| *** snizar has quit IRC | 18:54 | |
| *** Goneri has quit IRC | 18:55 | |
| *** Sukhdev has joined #openstack-ironic | 18:59 | |
| *** e0ne has quit IRC | 19:01 | |
| *** Goneri has joined #openstack-ironic | 19:01 | |
| *** baoli has quit IRC | 19:01 | |
| *** rbudden has quit IRC | 19:05 | |
| TheJulia | Hmm... no bot announcing revs posted for ironic-ui :( | 19:06 |
| TheJulia | betherly: ^ *nudge* ;) | 19:06 |
| TheJulia | Nobody promised me candy :( | 19:08 |
| *** causten_ has quit IRC | 19:08 | |
| mat128 | TheJulia: thats why you didnt get any | 19:08 |
| mat128 | :) | 19:08 |
| *** causten has joined #openstack-ironic | 19:09 | |
| *** causten_ has joined #openstack-ironic | 19:09 | |
| *** fragatina has joined #openstack-ironic | 19:13 | |
| *** fragatina has quit IRC | 19:13 | |
| *** causten has quit IRC | 19:13 | |
| *** fragatina has joined #openstack-ironic | 19:13 | |
| *** sdake_ has joined #openstack-ironic | 19:14 | |
| *** sdake has quit IRC | 19:14 | |
| TheJulia | betherly: jroll: fixed https://review.openstack.org/356022 so it passes locallly | 19:14 |
| *** sdake_ has quit IRC | 19:15 | |
| * TheJulia does her best sad pouty face possible | 19:16 | |
| *** sdake has joined #openstack-ironic | 19:16 | |
| *** Goneri has quit IRC | 19:36 | |
| *** e0ne has joined #openstack-ironic | 20:05 | |
| betherly | TheJulia: thanks so much for fixing that! | 20:15 |
| openstackgerrit | Merged openstack/python-ironicclient: Verify JSON response of driver commands https://review.openstack.org/336600 | 20:17 |
| thiagop | jroll: found something interesting in tempest while looking to remove tests | 20:18 |
| *** e0ne has quit IRC | 20:18 | |
| jroll | thiagop: do tell | 20:18 |
| thiagop | https://github.com/openstack/tempest/blob/master/tempest/scenario/test_network_v6.py#L54 | 20:18 |
| thiagop | are we skipping tests with ipv6 intetionally? | 20:19 |
| thiagop | intentionally* | 20:19 |
| thiagop | or did we forget to flip this switch? | 20:19 |
| jroll | mmm, we could probably do those in the multitenant job | 20:20 |
| jroll | but pxe doesn't work with ipv6, is the history there | 20:21 |
| thiagop | ouch.. | 20:21 |
| jroll | it'd be interesting to run those tests in the multitenant job, but let's leave it for now | 20:22 |
| thiagop | jroll: I can change the message on my patch to be more specific if needed | 20:22 |
| jroll | thiagop: might be helpful | 20:23 |
| *** baoli has joined #openstack-ironic | 20:24 | |
| *** _vsaienko has quit IRC | 20:36 | |
| jlvillal | JayF: Regarding https://review.openstack.org/#/c/355288/ I also see this: https://review.openstack.org/#/c/355704/ | 20:38 |
| jlvillal | JayF: Do you think we should try to get these into one patch? And possibly other related changes. | 20:39 |
| JayF | I basically look at the conflicts-with | 20:39 |
| JayF | and if a small patch like that conflicts with nothing that's ready to merge | 20:39 |
| JayF | I am OK with landing it | 20:39 |
| JayF | if not, then maybe ask the questino if it should be smashed into one bigger change | 20:39 |
| JayF | it's a tradeoff, right? | 20:39 |
| JayF | the smaller change is less likely to conflict, but means if it does you have it happen more often (because more changes) | 20:40 |
| *** aNupoisc has quit IRC | 20:40 | |
| jlvillal | JayF: My gut feeling is one patch for this type of change. But I won't block the change. | 20:41 |
| * jlvillal goes back to gertty :) | 20:41 | |
| JayF | I mean, it is what it is? Do what you feel like is right | 20:41 |
| JayF | I'm more of a "merge it now" type, maybe you aren't | 20:41 |
| JayF | part of why we have a variety of people as core is so that a variety of viewpoints can get evaluated :) | 20:42 |
| jlvillal | JayF: I don't have strong feelings about it. Thanks. | 20:43 |
| *** e0ne has joined #openstack-ironic | 20:45 | |
| *** aarefiev_ has quit IRC | 20:49 | |
| rloo | hi JayF. With the changes to keystone policy, did we give everyone read-only access to ironic? | 20:53 |
| JayF | rloo: baremetal_observer + observer role has r/o access | 20:54 |
| rloo | JayF: so if a user is not in any role they won't have any access? | 20:54 |
| JayF | rloo: unauthenticated users continue to have no access if authentication is configured | 20:54 |
| JayF | rloo: yep, and that's been true for keystone users forever | 20:54 |
| *** aNupoisc has joined #openstack-ironic | 20:54 | |
| rloo | JayF: ok. was wondering why in devstack, as 'demo', i could do an ironic list. | 20:55 |
| JayF | Hmm. | 20:55 |
| JayF | Are they an observer or admin of any kind? | 20:55 |
| * JayF does not have a booted devstack handy | 20:56 | |
| JayF | I think that user is still an admin, but just a different tenant | 20:56 |
| JayF | but imbw | 20:56 |
| rloo | JayF: my knowledge of keystone is limited. and of osc more limited. if i do 'openstack user role list' i see only admin but i'm not totally sure what that command does. | 20:56 |
| JayF | devananda: | 20:56 |
| JayF | devananda: ^ | 20:57 |
| JayF | rloo: https://github.com/openstack/ironic/blob/7f4c9a5924abeed320ca519e6cc8582b75bafa36/ironic/common/policy.py#L46 | 20:57 |
| thiagop | rloo: I think that depending on the project, user 'demo' has admin role on devstack | 20:58 |
| JayF | https://github.com/openstack-dev/devstack/blob/ab7e062f5d1d4a923645d2bb3a1477a366b02be9/lib/nova_plugins/hypervisor-ironic#L51\ | 20:58 |
| JayF | yeah | 20:58 |
| rloo | JayF: so i'm assuming demo is in tenant:demo. but i don't know if demo is_observer | 20:59 |
| JayF | looking at the combo of these, it looks like demo is an admin | 20:59 |
| JayF | I can't find the smoking gun where it's setup, but if we're using demo tenant in nova it certainly is working as intended | 20:59 |
| rloo | thiagop: would like to verify that. someone asked me why they couldn't get a node in maintenance, but they could 'ironic node-list' and it looked like it was cuz they were 'demo'. | 20:59 |
| *** dprince has quit IRC | 21:00 | |
| rloo | thiagop: i mean, put a node in maintenance. | 21:00 |
| JayF | rloo: https://github.com/openstack/ironic/blob/76c107429a2a1c1e7ea2bbec905651ad296c1219/devstack/lib/ironic#L751 | 21:00 |
| JayF | rloo: demo is a baremetal_observer at the least | 21:00 |
| rloo | JayF: ok, that explains it then. | 21:01 |
| JayF | github code search on "demo" is less spammy than I expected :) | 21:01 |
| rloo | JayF: I just need to learn what the openstackclient keystone-related commands are... thx. | 21:01 |
| JayF | I need to learn ... all the openstack client commands :( | 21:01 |
| * JayF still uses `ironic` everywhere | 21:02 | |
| thiagop | lol | 21:02 |
| devananda | rloo: is there a place you think I could/should document that change in devstack default accounts? | 21:03 |
| rloo | devananda: don't know. We should update http://docs.openstack.org/developer/ironic/dev/dev-quickstart.html#deploying-ironic-with-devstack | 21:04 |
| devananda | I separated those accounts as had been discussed in the spec - but perhaps it would be better for hte devstack 'demo' account to have no access to ironic? | 21:04 |
| rloo | devananda: oh. it is 'demo', i don't see any reason not to give it access. but if we want to keep the previous behavior, then we shouldn't. | 21:04 |
| devananda | rloo: good point - i'll take a shot at updating that page | 21:05 |
| rloo | devananda: devstack isn't production. so i am fine with demo having the new role. | 21:05 |
| devananda | rloo: k :) | 21:05 |
| *** ricardoas has joined #openstack-ironic | 21:07 | |
| rloo | thx devananda. wrt that dev-quickstart page, there is a "Note that 'ironic' calls must be made with admin credentials" which is not quite right | 21:07 |
| devananda | that's out of date now, indeed | 21:07 |
| mrda | Morning Ironic | 21:09 |
| thiagop | morning mrda | 21:10 |
| mrda | o/ | 21:11 |
| *** rbudden has joined #openstack-ironic | 21:15 | |
| *** wajdi_ has joined #openstack-ironic | 21:16 | |
| openstackgerrit | Thiago Paiva Brito proposed openstack/ironic: [WIP] Testing tests removal from tempest https://review.openstack.org/355591 | 21:16 |
| *** rbudden has quit IRC | 21:18 | |
| *** wajdi has quit IRC | 21:19 | |
| *** e0ne has quit IRC | 21:20 | |
| *** wajdi_ has quit IRC | 21:21 | |
| *** jcoufal_ has quit IRC | 21:22 | |
| *** rcernin has quit IRC | 21:27 | |
| openstackgerrit | Devananda van der Veen proposed openstack/ironic: Update documentation for keystone policy support https://review.openstack.org/345556 | 21:31 |
| *** bfournie has quit IRC | 21:31 | |
| devananda | rloo: that should address the policy-in-devstack issue ^ | 21:31 |
| *** bathris has joined #openstack-ironic | 21:31 | |
| rloo | devananda: ok. i was waiting for the decision on show_configdrive before reviewing that again :) | 21:32 |
| devananda | I've also made it not based on that so it's not blocked | 21:32 |
| devananda | yea... | 21:32 |
| *** baoli has quit IRC | 21:33 | |
| openstackgerrit | Alexander Bashmakov proposed openstack/ironic: Rewrite devstack/tools/ironic/scripts/create-node.sh in Python. https://review.openstack.org/346832 | 21:34 |
| JayF | rloo: devananda: I may have a different path out from under teh configdrive problem long term... | 21:34 |
| JayF | basically, no other nova virt driver "carrys over" old configdrives on rebuild; a user, on rebuild, has to re-pass-in any configdrive assets they want in | 21:34 |
| rloo | JayF: oh. well, as long as what we decide short term can morph easily into your long term desires to rule the world | 21:35 |
| JayF | so I'm thinking, Ironic should stop storing the configdrive on the node post-deployment | 21:35 |
| JayF | and follow the pattern of other nova hyps: you have to provide a new configdrive when you're rebuilding | 21:35 |
| mat128 | JayF: +1 | 21:35 |
| JayF | obviously it'd take a deprecation period, but it seems way more sane than Ironic holding that info around forever | 21:35 |
| devananda | JayF: that complicates things for bifrost a little | 21:35 |
| rloo | JayF: but there is still a period of time that the config drive is available via the node, right? | 21:35 |
| mat128 | it also causes a bug right now: if a user changes the IP address in his neutron port | 21:36 |
| mrda | JayF: Good idea! | 21:36 |
| JayF | TheJulia seemed on board from a standalone use case | 21:36 |
| mat128 | a rebuild will take the old stuff | 21:36 |
| JayF | rloo: absolutely; but the concerns about it change when it's shorter-lived, I guess | 21:36 |
| devananda | yea - a little. I think it's easy to work around that in bifrost's rebiuld command | 21:36 |
| rloo | JayF: doesn't matter, the concern still exists and we still ought to address it. | 21:36 |
| JayF | rloo: and I know one of my (and devananda's) big concerns was doing an ironic node list --detail, you get $active_nodes with a giant ugly blob | 21:36 |
| devananda | JayF: do they? a smaller window of time doesn't make the risk of password/data exposure go away | 21:36 |
| devananda | JayF: it reduces the noise in nova's logs -- yes | 21:37 |
| JayF | devananda: rloo: you're both right that it doesn't eliminate the question on the policy support | 21:37 |
| devananda | which I would be delighted by | 21:37 |
| devananda | but that ^ :) | 21:37 |
| rloo | JayF: so there seem to be 2 problems with the configdrive. 1: even w/o any secrets, it is a big blob so we shouldn't show it? 2. it has secrets/passwords/sensitive-date. | 21:38 |
| rloo | JayF: and 1 isn't a concern if it is a URL to the configdrive. | 21:38 |
| JayF | Yeah. | 21:39 |
| JayF | I do think #2 is a significant concern | 21:39 |
| JayF | I'm not sure I understood the disagreement with just blocking out the configdrive based on the show_passwords option though? | 21:39 |
| rloo | JayF: right. So is it valid to assume that any/most/all configdrives will have sensitive information? | 21:39 |
| JayF | Absolutely. | 21:39 |
| JayF | Even if it doesn't contain passwords, if you have access to ironic but not neutron, should you be able to divine what the IP address of a node is, for instance? | 21:40 |
| JayF | Ironic is just a passhthrough for that information. | 21:40 |
| mat128 | JayF, rloo: We have the same "risk" with an image temp_url, don't we? | 21:40 |
| rloo | JayF: I think it is fine to have one setting that is used to bleep out sensitive info. 'show_passwords' may not be the best description of that though. | 21:41 |
| mat128 | A customer could have sensitive data in their image and we get an unauthenticated "temporary" access to the data | 21:41 |
| mat128 | s/customer/user | 21:41 |
| JayF | mat128 wins the "way to complicate the question with your logic" award for the day :P | 21:41 |
| mat128 | Hahaha | 21:41 |
| JayF | mat128: I actually agree with you, too. | 21:41 |
| mat128 | Maybe we can just accept that baremetal_observer will actually see those? | 21:42 |
| rloo | mat128: so do you think we should have one 'show_sensitive_info' that is used to bleep out *everything* that we can think of that might be sensitive, from ironic responses? | 21:42 |
| mat128 | rloo: it's probably what was meant by the ones who invented "show_password", no? | 21:42 |
| JayF | mat128: similar to configdrive, that has the benefit of being 1) sensitive and 2) not-very-useful | 21:42 |
| JayF | mat128: so I think it's easy to block out | 21:42 |
| rloo | mat128: i don't think we should guess what the original was for. this is an opportunity to do it 'the way you think it ought to work'. | 21:43 |
| mat128 | JayF: agreed | 21:43 |
| mat128 | rloo: ok, in that case | 21:43 |
| JayF | so we all agree the toggle should take out all sensitive info, the question is what should the toggle be called? | 21:43 |
| * rloo asks mat128 what he wants; then i'll just say NO ... | 21:43 | |
| mat128 | any PII should be left out | 21:43 |
| devananda | I should point out that the current default blocks out passwords even from admin users | 21:44 |
| JayF | I'm fine with show_passwords, I'm fine with show_sensitive_data, I'm fine with show_me_ur_secrets (okay, maybe not that) | 21:44 |
| mat128 | image data / unauth links, configdrive blob / unauthenticated links | 21:44 |
| devananda | if this were expanded to block out image url's as well, they would be blocked out from all users | 21:44 |
| mat128 | what else is there? | 21:44 |
| devananda | even you (the user who thinks s/he is doing a deployment to a node) | 21:44 |
| JayF | devananda: we'd have to make sure, in the case of image_url and configdrive, that they were still sent "plaintext" during lookup | 21:44 |
| mat128 | devananda: do you see a use case where you need to *read* the image url? | 21:44 |
| mat128 | other than the agent | 21:44 |
| devananda | that is going to significantly alter the stand alone use cases that start incorporating authentication soon | 21:45 |
| JayF | devananda: so maybe it's sensible to separate BMC credentials (driver_info) from instance-secrets? | 21:45 |
| mat128 | oh wait | 21:45 |
| mat128 | devananda: does that mean even the agent doesnt get the ipmi_password right now? | 21:45 |
| JayF | kinda a longtime secrets (bmc creds) vs instance secrets | 21:45 |
| devananda | mat128: the image url is sent to the agent in response to a(n unauthenticated) callback | 21:45 |
| mat128 | hmm | 21:45 |
| mat128 | then we're back to that CVE | 21:45 |
| devananda | mat128: correct - the agent does not get ipmipass right now. no one does | 21:45 |
| mat128 | if we consider image url as sensitive | 21:45 |
| JayF | well that's why I propose multiple levels of sensitivity | 21:46 |
| mat128 | devananda: so it's only code running in Ironic that has access, interesting | 21:46 |
| JayF | long-lived credentials, like ipmi passwords, are a separate category from information that'll be /on disk on the node anyway/ like configdrive/image[_url] | 21:46 |
| mat128 | maybe we could pass the configdrive and image url as a "deploy" call on the agent | 21:46 |
| devananda | mat128: that was the original intent of that option -- node.driver_info[*password*] is write-only to all clients | 21:46 |
| mat128 | instead of having it read node.driver_info | 21:46 |
| devananda | mat128: it already does that ;) | 21:46 |
| JayF | but it does mean post-deploy we should probably explicitly nuke any tempurls | 21:46 |
| mat128 | devananda: so marking both fields as passwords shouldn't break tests, correct? | 21:47 |
| mat128 | JayF: and configdrive (back to that bug report ;)) | 21:47 |
| devananda | mat128: I don't _think_ it'll break tests. | 21:47 |
| JayF | Honestly, we do some really, really crazy stuff downstream, and I can't think of one valid usecase we've ever had for viewing configdrive and image_url in a node response | 21:48 |
| mat128 | so, even considering standalone cases, who/what needs to read image_url? | 21:48 |
| JayF | Although I do think instance-secrets should be a different policy toggle than node-secrets | 21:48 |
| mat128 | ^this :) | 21:48 |
| JayF | configdrive, image_url are secrets that are unique to the instnace deployed on the node | 21:49 |
| mat128 | oh | 21:49 |
| JayF | node credentials are unique to the node, forever (unless you're rotating them oob, etc) | 21:49 |
| mat128 | maybe we can introduce node.secrets and node.instance_secrets | 21:49 |
| JayF | so both off by default +1 | 21:49 |
| JayF | a single option for both -.5 | 21:49 |
| JayF | mat128: well, or at least use that distinction, today, to name the things better | 21:50 |
| JayF | mat128: show_node_passwords ; show_instance_secrets | 21:50 |
| devananda | JayF: that was one of my proposals on the review | 21:50 |
| mat128 | if we are to introduce new names, I suggest show_node_secrets | 21:50 |
| JayF | devananda: well +1, good proposal | 21:50 |
| JayF | I can go say that on the review | 21:50 |
| * JayF put that on the review | 21:52 | |
| mat128 | excellent :) | 21:52 |
| JayF | devananda: rloo: So what do we need to do to change proposals into "we agree, land this"? | 21:52 |
| openstackgerrit | Devananda van der Veen proposed openstack/ironic: Update documentation for keystone policy support https://review.openstack.org/345556 | 21:53 |
| rloo | JayF: I dunno. what did devananda need to do to add show_configdrive? Maybe change/update the bug associated with that? Is it an rfe? | 21:53 |
| devananda | rloo: since you were asking about openstack client -- I've updated ^ to use it now ;) | 21:53 |
| rloo | thx devananda! | 21:53 |
| JayF | rloo: it was a spec, I'll gladly update the spec and post it up for review if that's how we'd like to decide | 21:53 |
| rloo | JayF: oh, if it was mentioned in the spec, then yes, we should probably update that. | 21:54 |
| rloo | JayF: a spec that has been implemented I'm guessing? ;) | 21:54 |
| JayF | Implement specific restrictions for sensitive information, including configdrives and passwords. Default to hide all sensitive information. | 21:54 |
| JayF | is exactly what it says | 21:54 |
| JayF | which to me is generic enough already to cover the proposed solution | 21:55 |
| JayF | http://specs.openstack.org/openstack/ironic-specs/specs/6.1/keystone-policy-support.html (and yes, it's marked as implemented in 6.1) | 21:55 |
| JayF | so adding configdrive + image_url to "passwords" is kinda a piece not spelled out in the spec, but I think that's OK? | 21:55 |
| rloo | JayF: (Ok, I admit, I didn't quite read it.) | 21:55 |
| JayF | I just want to get things unblocked :) this is an important feature, including the bits with blocking sensitive information, so I wanna get past whatever decision point we're at so we can merge stuff :D | 21:56 |
| rloo | JayF: that sentence in the spec is general enough that any of deva's proposals would address it. I think. | 21:56 |
| mat128 | JayF: IMO that falls under "read-only access to non-secret information" | 21:56 |
| * devananda thinks we should do a 6.1.1 that includes the last couple patches on this, since, well, the spec isn't actually quite done in 6.1.0 | 21:56 | |
| JayF | devananda: ++ | 21:57 |
| rloo | JayF: I agree, I'd like it unblocked too. I don't have too much opinion on it, except that whatever is decided needs to be worded/implemented so it makes sense to users. | 21:57 |
| JayF | I like good reviews, and you are the commander in chief of good reviewing :) | 21:57 |
| JayF | Sometimes we're bad about making decisions, so I'm just trying to force it to one while the relevent folks are paying attention :) | 21:58 |
| *** thiagop has quit IRC | 21:58 | |
| rloo | JayF: ha ha. So again, I don't care if we have one switch or several switches. But whatever we have, needs to make sense. I'm not an operator, I don't know whether 1 big switch is sufficient or not. | 21:59 |
| *** sabeen has quit IRC | 21:59 | |
| rloo | JayF: one big switch would be easier for us. | 21:59 |
| JayF | rloo: yeah; and I think you're right. I could see cases where I'd want to see the node creds (like if I had an external monitoring service using ironic's creds to poll bmcs) but would like the ability to hide my customers' secrets from that credential | 22:00 |
| JayF | I can't think of many reasonable use cases for wanting to read that instance after the fact | 22:00 |
| rloo | JayF: so, like two different levels of admin? | 22:00 |
| JayF | today: admin cannot see bmc passwords | 22:01 |
| JayF | if you want to see passwords, change the show_password policy in config to permit the appropriate folks to see it | 22:01 |
| JayF | tomorrow; admin cannot see bmc passwords or instance secrets (configdrive/image url) | 22:02 |
| JayF | if you want to see bmc passwords, change show_password policy, if you want to see instance secrets, change (name TBD) show_instance_secrets policy locally | 22:02 |
| *** michauds has quit IRC | 22:02 | |
| devananda | rloo: since you suggested changing the name of the policy setting, I need to point out that that will create an upgrade problem | 22:02 |
| *** bathris has quit IRC | 22:02 | |
| rloo | devananda: can't we deprecate show_password? | 22:03 |
| devananda | policy doesn't support deprecation periods, afaik | 22:03 |
| devananda | *oslo.policy | 22:03 |
| JayF | I'm OK with putting node passwords under show_password, and instance secrets under $new-name | 22:03 |
| devananda | not in the same way as oslo.config (which makes it really easy) | 22:03 |
| JayF | and I think as an operator it makes sense, and I think it takes a bit of understanding to know that configdrive/image_url are "passwords" | 22:03 |
| rloo | devananda, JayF: so for instance stuff, we're talking about node.instance_info (for now anyway). | 22:04 |
| *** snizar_ has joined #openstack-ironic | 22:04 | |
| *** snizar has joined #openstack-ironic | 22:04 | |
| JayF | rloo: fields inside instance_info, yes | 22:04 |
| devananda | AIUI, if we remove the 'show_password' policy and create one (or more) AND an operator has changed the default 'show_password' setting in their /etc/ironic/policy.json THEN we will not be able to detect it in ironic and they will get unexpected behavior upon upgrade | 22:04 |
| rloo | devananda, JayF: so if we want a separate one for that (and not only for configdrive, which is the proposed 'show_configdrive'), what about 'show_instance_secrets' or 'show_instance_sensitive_info' | 22:05 |
| JayF | I like show_instance_secrets | 22:05 |
| JayF | because I think it's pretty easy to see how that's different than the existing show_passwords | 22:05 |
| rloo | devananda: can we keep 'show_password' and have a new 'show_node_secrets' that does the same thing, or would that be confusing. | 22:05 |
| devananda | rloo: very confusing | 22:05 |
| JayF | rloo: that'd be confusing | 22:06 |
| rloo | devananda: forget it, let's just keep 'show_password' or whatever it is. | 22:06 |
| devananda | as an operator, which one should I change? what happens if htey're different? | 22:06 |
| rloo | devananda: yeah. | 22:06 |
| devananda | we either: a) expand the effect of show_password b) add a new option that affects instance_info c) rename show_password (and maybe add another field too) and cause upgrade pains to operators | 22:08 |
| * JayF votes (b) | 22:08 | |
| JayF | and I strongly prefer a name that doesn't indicate instance_info specifically, so if we ever move that around it still makes sense (i.e. show_instance_secrets) | 22:08 |
| * rloo votes (b) | 22:10 | |
| devananda | thanks. I'll rework the patch | 22:10 |
| JayF | \o/ decisionmaking | 22:11 |
| jroll | JayF | devananda: so maybe it's sensible to separate BMC credentials (driver_info) from instance-secrets? <- yes this so much this yes pls | 22:11 |
| rloo | thx devananda and JayF! | 22:11 |
| * jroll still reading scrollback though | 22:11 | |
| JayF | jroll: you just agreed with what we decided on, congrats | 22:12 |
| JayF | lol | 22:12 |
| jroll | JayF: yay, everyone is equally sane | 22:12 |
| jroll | or not sane | 22:12 |
| jroll | I'm happy with that | 22:12 |
| * jroll meant to post this on the patch earlier but feels like he's been in three conversations at once all day | 22:13 | |
| *** rpioso has quit IRC | 22:15 | |
| *** syed_ has quit IRC | 22:22 | |
| *** bfournie has joined #openstack-ironic | 22:26 | |
| *** sdake has quit IRC | 22:27 | |
| *** [1]cdearborn has quit IRC | 22:28 | |
| jlvillal | I think we need this patch to fix our gate: https://review.openstack.org/#/c/355602/ | 22:28 |
| *** sdake has joined #openstack-ironic | 22:28 | |
| * jlvillal wonders if we should go begging for reviews on that from the devstack cores. | 22:29 | |
| jroll | jlvillal: we do not | 22:29 |
| jlvillal | Then I won't :) | 22:30 |
| jroll | that adds new feature (which broke our gate the first time) | 22:30 |
| jroll | we reverted, this puts it back hopefully in a better place | 22:30 |
| *** syed_ has joined #openstack-ironic | 22:30 | |
| jlvillal | jroll: Do you think our gate is unbroken then? | 22:30 |
| * jlvillal goes looks at some patches | 22:30 | |
| jroll | jlvillal: no, grenade is busted, this fixes https://review.openstack.org/#/c/355659/ | 22:30 |
| jroll | grenade/multitenant | 22:30 |
| jroll | (anything with multiple nodes) | 22:30 |
| jroll | it's in the gate but the gate queue is FUBAR today :) | 22:31 |
| JayF | jroll: so our grenade is still broken by that? | 22:31 |
| jroll | JayF: I believe so, yes | 22:31 |
| jroll | maybe not multitenant | 22:31 |
| JayF | the whiteboard was lying last night :( else I wouldn't have landed all the stuff | 22:31 |
| jroll | (they still set up cells in grenade jobs, we didn't revert that) | 22:31 |
| jlvillal | Thanks jroll | 22:31 |
| jroll | JayF: sorry, misinfo happens :( | 22:32 |
| JayF | it's fine, just wasteful of gate | 22:32 |
| JayF | at least now !core could recheck once it's fixed and have it all land | 22:32 |
| JayF | I don't feel like it's a waste of my time, it's a waste of computers | 22:32 |
| jlvillal | Wow, that gate queue is long. | 22:32 |
| jroll | JayF: heh, yeah | 22:33 |
| openstackgerrit | Devananda van der Veen proposed openstack/ironic: Mask instance secrets in API responses https://review.openstack.org/326768 | 22:34 |
| * NobodyCam shakes fist at his ipmi sol terminal | 22:35 | |
| JayF | devananda: ^ do you wanna add the doc updates for the new show_instance_secrets stuff in that same patch? | 22:36 |
| jlvillal | NobodyCam: Is that before the IPMI console patches or after? | 22:36 |
| JayF | devananda: well, nevermind, it's not chained with the docs at all anymore | 22:36 |
| NobodyCam | before | 22:37 |
| JayF | ipmi serial console can be fun, all on it's own, with some hardware | 22:37 |
| * NobodyCam is learning to love ctrl-L | 22:39 | |
| JayF | NobodyCam: I found a world of issues, at least on my hardware, can be avoided if you set your terminal size to exactly 80x24 | 22:39 |
| JayF | NobodyCam: but that may be specific to my gear | 22:40 |
| NobodyCam | i'm getting some strange thing where I only get the payload (screen update) upon a key press... I feel like I have dealt with this in the past | 22:41 |
| JayF | A few general rules I followed when doing serial consoles all the time: | 22:43 |
| JayF | TERM=dumb # set in your terminal | 22:43 |
| JayF | 80x24 | 22:43 |
| JayF | and never run inside screen (screen broke them a lot for me) | 22:44 |
| * mat128 signs off for the night | 22:44 | |
| mat128 | see y'all tomorrow :) | 22:44 |
| NobodyCam | night mat128 | 22:44 |
| JayF | o/ | 22:45 |
| NobodyCam | yea | 22:46 |
| NobodyCam | none of that going on here | 22:46 |
| jlvillal | mat128: ciao | 22:47 |
| openstackgerrit | Merged openstack/ironic: Bring upgrade documentation up to date https://review.openstack.org/354075 | 22:55 |
| devananda | JayF: oops. yea, I should include that doc update with it | 23:01 |
| JayF | devananda: also I have a -1 on it unrelated to this comment | 23:02 |
| JayF | devananda: tl;dr image_url is also an instance_secret that I don't think the oslo lib does | 23:02 |
| devananda | JayF: I see. no, it doesn't | 23:02 |
| devananda | JayF: I would prefer to defer to olso for sanitizing secrets at the moment | 23:03 |
| devananda | while I agree with you in principle, I don't want to bikeshed on what else is a secret | 23:03 |
| JayF | I don't think we'll be able to get them to accept a patch to blanket call image_url a secret. | 23:03 |
| JayF | And I think mat128 brought up a good point about how images can contain customer information as easily as configdrives can. | 23:03 |
| devananda | JayF: is the node's deploy_ramdisk a secret? | 23:03 |
| JayF | it might be if it was a temporary url to download it | 23:04 |
| JayF | that's the issue, not that we know what the iamge is | 23:04 |
| devananda | is the image_checksum a secret? | 23:04 |
| JayF | but that you're giving someone an auth-pass to download a potentially secret image | 23:04 |
| JayF | I don't think it's in the same realm of something like a checksum or an image uuid | 23:04 |
| JayF | this is actual authentiction bypass information. | 23:05 |
| JayF | I'm fine marking it as a todo, filing a bug, and doing it later | 23:05 |
| devananda | JayF: the right way to fix this is to allow IPA to authenticate when downloading the user image | 23:05 |
| JayF | but I don't think we should punt on making the decision altogether about what is secret, when we're the ones building the temp url | 23:05 |
| devananda | not to hide the image url or uuid in API responses | 23:06 |
| devananda | uh - when do we build a temp url for the user's image??? | 23:06 |
| * devananda grep's a bit | 23:07 | |
| JayF | instance_info['image_url' | 23:08 |
| devananda | oh. I see | 23:08 |
| JayF | is where it is | 23:08 |
| JayF | can you link the code? | 23:08 |
| JayF | I was trying to find it as well | 23:08 |
| devananda | yea, one sec | 23:08 |
| devananda | https://github.com/openstack/ironic/blob/master/ironic/drivers/modules/agent.py#L92 | 23:09 |
| openstackgerrit | Darren Chan proposed openstack/ironic: Update readme file https://review.openstack.org/355290 | 23:12 |
| *** aNupoisc has quit IRC | 23:21 | |
| *** fumie has joined #openstack-ironic | 23:22 | |
| devananda | jroll: do you plan to branch newton from 6.1.0 or $next ? | 23:33 |
| *** mbound has joined #openstack-ironic | 23:34 | |
| *** mbound has quit IRC | 23:39 | |
| openstackgerrit | Naohiro Tamura proposed openstack/python-ironicclient: Add soft reboot/poweroff power states. https://review.openstack.org/247904 | 23:40 |
| *** rloo has quit IRC | 23:42 | |
| *** bfournie has quit IRC | 23:44 | |
| *** bfournie has joined #openstack-ironic | 23:44 | |
| openstackgerrit | Devananda van der Veen proposed openstack/ironic: ask instance secrets in API responses https://review.openstack.org/326768 | 23:50 |
| devananda | JayF: updated ^ | 23:50 |
| devananda | I dont have time right now to get to the apiref review - will do that first thing tomorrow | 23:51 |
| JayF | my comment is just commit msg, but dtantsur|afk had more substantive stuff | 23:51 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!
