Friday, 2021-01-08

iurygregorytrandles, awesome!00:02
openstackgerritBill Dodd proposed openstack/ironic master: WIP: Add Redfish RAID management to Ironic  https://review.opendev.org/c/openstack/ironic/+/73000000:20
*** paras333 has quit IRC00:27
*** JayF has quit IRC00:33
*** rcernin has quit IRC00:44
*** rloo has quit IRC01:03
*** rcernin has joined #openstack-ironic01:45
*** ayoung has quit IRC01:46
*** zzzeek has quit IRC02:09
*** zzzeek has joined #openstack-ironic02:10
*** zzzeek has quit IRC02:15
*** zzzeek has joined #openstack-ironic02:16
*** eagereagle1 has quit IRC02:19
*** tzumainn has quit IRC02:21
*** anuradha1904 has quit IRC02:21
*** zzzeek has quit IRC02:43
*** zzzeek has joined #openstack-ironic02:45
*** paras333 has joined #openstack-ironic02:48
*** paras333 has quit IRC02:53
*** MentalSiege has joined #openstack-ironic03:10
*** pmannidi has quit IRC03:20
*** pmannidi has joined #openstack-ironic03:21
*** rcernin has quit IRC03:39
*** rcernin has joined #openstack-ironic03:52
*** rcernin has quit IRC03:52
*** rcernin has joined #openstack-ironic03:52
viks____TheJulia: ok.. i'll try to find out that... Also how do i bring from `clean wait` state to `maneagable` state.. i do the following which works some time.. but it takes too long to come back many times:04:19
viks____https://www.irccloud.com/pastebin/tWRgvCFw/04:20
*** mkrai has joined #openstack-ironic04:21
TheJuliaviks____: so maintenance is set upon cleanfail04:36
*** zzzeek has quit IRC04:36
TheJuliaviks____: if you can take a look at the console, it might be a hardware problem, or a networking failure to boot, but yeah, any cleaning failure throws the node to maintenance when there is a failure as a safeguard04:36
*** zzzeek has joined #openstack-ironic04:38
viks____TheJulia: ok... why doesn't it come back to `manageable` state immediately when the command executed...  it keeps on giving `The requested action "manage" can not be performed on node "6064e0ca-27fb-42a3-9562-b0317c743a4f" while it is in state "clean wait". (HTTP 400)`.. later at some point of time it comes back to the `manageable` state..04:40
viks____ i tried to reduce `retry_timeout` for pxe etc but no help04:41
openstackgerritBill Dodd proposed openstack/ironic master: WIP: Add Redfish RAID management to Ironic  https://review.opendev.org/c/openstack/ironic/+/73000004:46
*** zzzeek has quit IRC04:49
*** zzzeek has joined #openstack-ironic04:51
TheJuliaviks____: great question04:55
TheJuliaoh, interesting04:55
TheJuliaso your doing manual cleaning?04:55
viks____TheJulia:  nope... i set it to automatic04:56
TheJuliahmm04:56
TheJuliaviks____: *was* it actually in maintenance state? was the last_error field populated?04:56
TheJuliaso tl;dr, you can't directly go from clean wait to manageable.04:58
TheJuliayou have to issue an "abort" which it will do if it is able to (i.e. not mid-stream in an operation, and move it to clean failed04:58
TheJuliaonce in clean failed, then it can be moved to manageable via the manage command04:58
viks____TheJulia: Oh ok.. how do i abort the `clean wait` operation?05:01
viks____`openstack baremetal node abort`?05:01
TheJuliayes05:01
TheJuliaviks____: do be careful,  you don't want to try and kill a cleaning operation in the middle of soemthing like secure erase, but your node souldn't be in maintenance state without some sort of hard failure anyhow05:05
*** zzzeek has quit IRC05:05
TheJuliathat is if it actually running and all05:06
viks____TheJulia: Ok..  thnx.. is it safe to abort when the baremetal bootsup while cleaning and fails to find dhcp?05:06
TheJuliaoh, in that case, absolutely05:06
TheJuliais the booting IPA image failing to find DHCP or is it just not even network booting?05:06
*** zzzeek has joined #openstack-ironic05:07
TheJuliaviks____: if the ramdisk manages to start booting, it sounds like your lacking drivers and that network booting is basically successful in getting the ramdisk to start. That may be visible as a dhcp failure from the outside. If that is the case, I'd change ramdisk images. And if your trying to use tinyipa on real hardware, this is a prime case where you can have that kind of issue since it only carries a05:09
TheJuliacouple network drivers by default. Ones that rarely exist on physical hardware these days.05:09
*** anuradha1904 has joined #openstack-ironic05:10
viks____TheJulia: ok..it seems IPA booting... it's not able to find deploy image at all.. earlier it was picking fro other locatio where dhcp and tftp was setup.. so now i have removed those... so it should basically try to get the deploy image by contacting it to neutron dhcp right?05:11
TheJuliano05:11
TheJuliawell05:11
TheJuliadepending on how you look at it maybe05:11
TheJuliathe way it works05:11
TheJuliaAt a very high level05:11
TheJuliaIronic sets up the tftpboot/httpboot contents on the conductor, whatever host that is05:12
TheJuliaThe conductor then calls neutron to setup DHCP05:12
TheJuliainside that dhcp message, includes a pointer back to the conductor's IP for TFTP or iPXE or direct boot from http if on ipv6.05:12
TheJuliathe host makes a dhcp request, the appropriate neutron dhcp dnsmasq process in the appropriate network namespace for the provisioning or cleaning network replies05:13
TheJuliathat reply contains the appropriate address, the machine then tries to connect and download that content. The common pattern is to get the ipxe binary, boot that, and then load the ipa deployment kernel and ramdisk05:14
TheJuliaat which point once that has loaded, then and only then should you see anything that resembles linux running on the host05:15
viks____TheJulia: can u help me to understand step 7 here: https://docs.openstack.org/ironic/train/install/configure-networking.html#configure-networking ?05:20
viks____i have 2 network interface on both in baremetal as well has the controlling host.. 1 st interface is in ipmi network and the second one is separate network05:27
*** zzzeek has quit IRC05:28
TheJuliawell05:29
TheJuliahmm05:29
TheJuliaI guess first off, the ipmi bmc network should be as far out as band as possible05:29
TheJuliaviks____: step 7 should just be the physical network that the network cards for network booting are attached to05:30
TheJuliastep 7 is specifically adding the integration bridge to be managed by ovs05:30
TheJuliaovs-vsctl show should provide insight05:31
*** zzzeek has joined #openstack-ironic05:31
TheJuliaif you get into the neturon namespace, you may want tos ee if packets are making it to that dhcp servers05:31
TheJuliaif you do ip netns list05:31
TheJulia`ip netns list`05:31
TheJulia`ip netns exec ip addr`05:31
TheJuliaerr05:31
TheJulia`ip netns exec namespaceid ip addr`05:31
TheJuliaand then sniff traffic using that same exec command, you can figure that out05:32
TheJuliaovs-vsctl should have matching interfacen ames in them05:32
TheJuliaand with that, I need to get some sleep, although I will agree... something feels missing in those neutron steps05:32
viks____TheJulia: ok.. i'll try to investigate more... Thnx for your inputs05:34
TheJuliaviks____: likely, that feeling I have is because it has been a long time since I've setup neutron05:35
TheJuliabut what has always helped me the most is looking inside the namespaces, and working my way out05:36
TheJuliaso packet capture to make sure the packets are making it to the machine on the expected interface05:36
TheJuliachecking ovs config via ovs-vsctl show05:36
TheJuliaand then starting to check from within the machine and stepping out one step at a time05:36
*** rcernin has quit IRC05:36
*** zzzeek has quit IRC05:38
*** zzzeek has joined #openstack-ironic05:40
*** rcernin has joined #openstack-ironic05:44
*** zzzeek has quit IRC05:54
*** rcernin has quit IRC05:56
*** zzzeek has joined #openstack-ironic05:56
*** gyee has quit IRC06:11
*** hoonetorg has quit IRC06:19
*** rcernin has joined #openstack-ironic06:22
*** rcernin has quit IRC06:23
*** rcernin has joined #openstack-ironic06:24
*** hoonetorg has joined #openstack-ironic06:32
viks____TheJulia: ok thnx.. will investigate further..06:37
*** rcernin has quit IRC06:39
*** rcernin has joined #openstack-ironic06:44
*** zzzeek has quit IRC06:51
*** zzzeek has joined #openstack-ironic06:53
*** uzumaki has joined #openstack-ironic07:11
*** rcernin has quit IRC07:14
*** rcernin has joined #openstack-ironic07:28
*** zzzeek has quit IRC07:31
*** zzzeek has joined #openstack-ironic07:32
*** lbotell has quit IRC07:39
*** rcernin has quit IRC07:43
arne_wiebalckGood morning, ironic!07:43
jandersgood morning arne_wiebalck07:52
jandersHappy Friday! :)07:52
*** tosin has joined #openstack-ironic07:59
arne_wiebalckHey janders o/08:07
*** mkrai has quit IRC08:10
*** rh-jelabarre has quit IRC08:19
*** uzumaki has quit IRC08:20
*** zzzeek has quit IRC08:21
*** anuradha1904 has quit IRC08:21
*** zzzeek has joined #openstack-ironic08:23
*** zzzeek has quit IRC08:27
*** zzzeek has joined #openstack-ironic08:28
*** mkrai has joined #openstack-ironic08:29
*** rpittau|afk is now known as rpittau08:32
rpittaugood morning ironic! Happy Friday! o/08:33
jandersgood morning rpittau o/08:37
rpittauhey janders :)08:37
jandersHappy Friday indeed, we survived the first week of 2021! :)08:38
rpittauthat's a great achievement, I aim to repeat it at least 52 times this year :)08:38
*** dougsz has joined #openstack-ironic08:47
*** tkajinam has quit IRC08:55
*** Deaddy has quit IRC08:55
*** tosky has joined #openstack-ironic08:56
*** zzzeek has quit IRC08:57
*** zzzeek has joined #openstack-ironic08:58
openstackgerritAija Jauntēva proposed openstack/ironic master: Add 'deploy steps' parameter for provisioning API  https://review.opendev.org/c/openstack/ironic/+/76835308:58
*** lucasagomes has joined #openstack-ironic09:04
*** derekh has joined #openstack-ironic09:37
*** zzzeek has quit IRC09:44
*** zzzeek has joined #openstack-ironic09:46
*** zzzeek has quit IRC09:56
*** zzzeek has joined #openstack-ironic09:57
*** dtantsur|afk is now known as dtantsur09:57
dtantsurmorning ironic!09:57
dtantsurready for SPUC? :)09:57
rpittau hey dtantsur :)09:57
rpittauI'll connect in 5 minutes09:58
dtantsurjust a reminder: we have a new meeting ID this year: https://bluejeans.com/772893798/09:59
jandersdtantsur yep!09:59
dtantsuriurygregory, arne_wiebalck, janders, ajya ^^09:59
*** zzzeek has quit IRC10:18
*** zzzeek has joined #openstack-ironic10:20
*** rh-jelabarre has joined #openstack-ironic10:22
*** zzzeek has quit IRC10:27
arne_wiebalckdtantsur: janders rpittau ajya: I lost the connection ... but I need to hop on another meeting anyway now. Was great SPUCing with you!10:28
dtantsuro/10:29
*** zzzeek has joined #openstack-ironic10:29
*** ociuhandu has joined #openstack-ironic10:31
openstackgerritDhuldev Valekar proposed x/sushy-oem-idrac master: Redfish management clean steps  https://review.opendev.org/c/x/sushy-oem-idrac/+/72159610:34
*** ociuhandu has quit IRC10:39
*** ociuhandu has joined #openstack-ironic10:41
*** zzzeek has quit IRC11:18
iurygregorygood morning11:19
iurygregorydtantsur, I just had breakfast hehehe (the alarm didn't work D:)11:20
dtantsurhappens :) you have another chance in the evening/afternoon11:20
iurygregoryspuc still happening?11:20
*** zzzeek has joined #openstack-ironic11:20
dtantsurnot the morning one11:21
iurygregoryI hope I will be able to join the one in the afternoon (need to see the Ophthalmologist today)11:21
iurygregoryotherwise they won't renew my driver's license XD11:22
dtantsurheh, good luck!11:22
*** ociuhandu has quit IRC11:22
iurygregorythanks! I'm sure I will need!11:22
*** uzumaki has joined #openstack-ironic11:35
*** zzzeek has quit IRC11:38
*** zzzeek has joined #openstack-ironic11:43
dtantsurfolks, looking for some bifrost reviews https://review.opendev.org/c/openstack/bifrost/+/767929 https://review.opendev.org/c/openstack/bifrost/+/76738412:04
dtantsuralso https://review.opendev.org/c/openstack/ironic/+/764333 if somebody has a bit more time12:04
iurygregorylooking now12:10
*** ociuhandu has joined #openstack-ironic12:13
*** ociuhandu has quit IRC12:14
*** ociuhandu has joined #openstack-ironic12:15
*** ociuhandu has quit IRC12:26
*** zzzeek has quit IRC12:28
*** zzzeek has joined #openstack-ironic12:30
*** zzzeek has quit IRC12:42
*** zzzeek has joined #openstack-ironic12:45
iurygregorydtantsur, small question in https://review.opendev.org/c/openstack/bifrost/+/76792912:47
*** ociuhandu has joined #openstack-ironic12:53
*** ociuhandu has quit IRC12:58
*** ociuhandu has joined #openstack-ironic12:58
dtantsuroh, good catch13:13
dtantsurwhich makes me wonder if we even need this feature13:16
*** uzumaki has quit IRC13:18
openstackgerritDmitry Tantsur proposed openstack/bifrost master: Make DHCP inventory handling more flexible  https://review.opendev.org/c/openstack/bifrost/+/76792913:30
dtantsurokay, I've figured out the confusion around different hosts dirs13:30
iurygregorysorry I was in my 1:113:31
iurygregorygoing to look at the patch after the CI run13:31
openstackgerritDmitry Tantsur proposed openstack/ironic master: Do not enter maintenance if cleaning fails before running the 1st step  https://review.opendev.org/c/openstack/ironic/+/76992313:57
*** zzzeek has quit IRC13:59
*** dtantsur is now known as dtantsur|brb14:00
*** zzzeek has joined #openstack-ironic14:01
openstackgerritDmitry Tantsur proposed openstack/ironic master: [WIP] API to force manual cleaning without booting IPA  https://review.opendev.org/c/openstack/ironic/+/76979314:01
*** jawad_axd has joined #openstack-ironic14:03
*** rloo has joined #openstack-ironic14:13
*** anuradha1904 has joined #openstack-ironic14:18
openstackgerritAija Jauntēva proposed openstack/ironic master: Add configuration mold storage  https://review.opendev.org/c/openstack/ironic/+/76992814:31
* TheJulia wipes sleep from her eyes14:37
rpittaubye everyone! Have a great weekend! o/14:46
*** rpittau is now known as rpittau|afk14:46
*** tzumainn has joined #openstack-ironic14:48
openstackgerritJulia Kreger proposed openstack/ironic-python-agent stable/victoria: Fix default disk label with partition images  https://review.opendev.org/c/openstack/ironic-python-agent/+/76974814:53
openstackgerritMerged openstack/ironic-python-agent bugfix/6.3: Remove lower-constraints job  https://review.opendev.org/c/openstack/ironic-python-agent/+/76950614:58
TheJuliadtantsur|brb: w/r/t https://review.opendev.org/c/openstack/ironic/+/769923, arne and I are both kind of wondering about one of the other change you've got in there that changes if a node ever actually ends up in a fail state in that case.  Was this intended? It is kind of a mechanics/interaction change which is visible.15:08
*** MentalSiege has quit IRC15:11
openstackgerritJulia Kreger proposed openstack/ironic master: Register all hardware_interfaces together  https://review.opendev.org/c/openstack/ironic/+/76491115:17
TheJuliaderekh: ^^ just release note edit, marked +215:17
iurygregoryrpioso, ajya hey we did and upgrade on firmware from  4.20.20.20 to 4.40.00.00 on Dell PowerEdge R640  and virtual media stopped working after using the latest firmware, sushy complains that the Message.ExtendedInfo is a string and not a dict15:19
iurygregoryhttps://github.com/openstack/sushy/blob/stable/victoria/sushy/exceptions.py#L12715:19
iurygregoryhttp://paste.openstack.org/show/801518/15:20
TheJuliaiurygregory: your going to need to patch sushy to capture that entire object15:20
TheJuliasounds like a fairly grumpy error message15:21
ajyaiurygregory: I'll take a look15:22
derekhTheJulia: ack, thanks15:22
iurygregoryTheJulia, yeah, I will push a patch with adding Logs so I can confirm (will need to ask people to run the deployment hehe)15:24
iurygregorylunch first to get more energy XD15:25
openstackgerritMerged openstack/ironic master: docs: Add information on post-branch release tasks for bifrost  https://review.opendev.org/c/openstack/ironic/+/75712015:25
*** zzzeek has quit IRC15:38
*** zzzeek has joined #openstack-ironic15:41
*** mkrai has quit IRC15:41
*** dtantsur|brb is now known as dtantsur15:45
dtantsurTheJulia: which exactly change do you have in mind?15:45
dtantsurah, I missed the comments15:46
dtantsurit's not about the fail state, it's about the fault. a fault is a specific thing that implies maintenance.15:47
dtantsurarne_wiebalck, TheJulia ^^15:47
arne_wiebalckdtantsur: thanks; so the node will still end up in clean_failed?15:50
dtantsuryep15:50
arne_wiebalckdtantsur: that was my question/misunderstanding15:50
arne_wiebalckdtantsur: thanks15:50
dtantsura fault is "the machine itself is potentially screwed", which is not the case for e.g. clean steps validation15:51
arne_wiebalckright ... I was worried that a failed pxe setup would not be reflected as clean_failed15:51
dtantsursee process_event in the very bottom of the function15:52
openstackgerritIury Gregory Melo Ferreira proposed openstack/sushy stable/victoria: [DNM] Adding more logs to debug idrac issue  https://review.opendev.org/c/openstack/sushy/+/76995015:56
TheJuliadtantsur: ack, thanks15:56
dtantsurTheJulia: how do you feel about ManagementInterface additions for secure boot?15:59
dtantsursince we can have a generic implementation: http://redfish.dmtf.org/schemas/v1/SecureBoot.v1_0_7.json16:00
TheJulia+2!16:03
dtantsurokay, that's another thing I'll be busy with16:03
TheJuliaok16:04
*** zzzeek has quit IRC16:10
*** zzzeek has joined #openstack-ironic16:12
openstackgerritMerged openstack/bifrost master: Enable ramdisk deploy by default, disable iscsi  https://review.opendev.org/c/openstack/bifrost/+/76738416:17
dtantsura food for thoughts. iLO and iRMC currently only enable secure boot for the running instance, disabling it for cleaning/deploy.16:18
dtantsurdo we want to keep this behavior? I guess secure booting IPA doesn't make much sense indeed.16:18
TheJuliaIt makes some sense16:20
TheJuliabut I suspect that is likely fine to have and would begin to peel back some of the vendor specific boot interfaces outside of virutal media16:21
dtantsurat the very least, we cannot secure-boot via PXE16:21
TheJuliaiurygregory: do you want me to join the mentoring call in 10m?16:21
TheJuliayeah16:21
TheJuliaHardware features consisting of an unobtanium construction.16:21
iurygregoryTheJulia, if you want to join you are more than welcome =)16:22
TheJuliaI think my brain needs relative quite this morning and I'm saving my spoons for spuc16:23
TheJuliabut if needed I can hop on, sound good?16:23
iurygregoryTheJulia, sure16:24
*** ociuhandu_ has joined #openstack-ironic16:28
*** ociuhandu has quit IRC16:31
rpiosoiurygregory: Thank you for informing us of the vmedia issue with 4.40.00.00. Please be aware our third-party CI is down, so the DNM will not produce any further info until it is back up.16:31
rpiosoerbarr: ^^^16:31
iurygregoryrpioso, ack16:31
*** ociuhandu_ has quit IRC16:33
erbarrrpioso, thanks for the heads up16:34
rpiosoerbarr: :-)16:34
*** zzzeek has quit IRC16:35
*** zzzeek has joined #openstack-ironic16:37
*** ociuhandu has joined #openstack-ironic16:38
*** ociuhandu has quit IRC16:44
ajyaiurygregory, rpioso: did a quick test with virtual media boot and it failed with 4.40 (worked with 4.20). It had different error about being unable to mount. Will investigate this more. Note that 4.40.00.00 is not officially supported yet with Ironic. Thank you for letting us know.16:55
iurygregoryoh good to know!16:56
ajyaiurygregory: also I was not testing inspection, but basic deploy so maybe that's why different error16:56
iurygregoryajya, yeah it makes sense16:56
iurygregorysince it's not yet officially supported I will give a heads up to the people using it =)16:56
ajyaiurygregory: your error is in error handler, would be good to know what was the actual error. Also it could be that error handler was broken before.16:57
rpiosoiurygregory: The firmware versions we support in our downstream ironic solution can be found in https://www.delltechnologies.com/resources/en-us/asset/technical-guides-support-information/solutions/managing-dell-emc-hardware-with-openstack-ironic-idrac-driver-3-0.pdf.16:57
*** quoth has joined #openstack-ironic16:57
iurygregoryrpioso, awesome thanks for the link!16:58
*** gyee has joined #openstack-ironic16:58
rpiosoiurygregory: yw. And, ty!16:58
openstackgerritDmitry Tantsur proposed openstack/ironic master: [WIP] Common framework for configuring secure boot  https://review.opendev.org/c/openstack/ironic/+/76996116:58
dtantsurreminder: SPUC now in https://bluejeans.com/25012566217:00
*** JayF has joined #openstack-ironic17:00
JayFdtantsur: TheJulia: others: SPUC?17:00
dtantsuromw17:00
TheJuliaSPUC!!!!!17:00
*** lucasagomes has quit IRC17:01
quothDoes anybody know if it is possible to deploy standalone ironic without cleaning enabled? I have the services running and a node enrolled but when I try to run node validate it shows an error because no cleaning network is defined. I don't have neutron installed because network services (dhcp,tftp, etc..) are provided externally17:01
dtantsurquoth: usually when you want to disable cleaning, you don't17:02
dtantsurin this case you have a wrong network_interface on a node17:02
dtantsuryou need network_interface=noop, not flat or neutron17:02
dtantsurif you don't have neutron at all, set enabled_network_interfaces=noop in your ironic.conf and you'll get the right defaults17:03
quothThanks, I will do that and see if it resolves the issue.17:03
dtantsurquoth: note that you'll need to update the existing nodes first17:03
dtantsurwith baremetal node set --network-interface noop17:03
quothCool. That fixed it, thanks for the help17:05
dtantsurquoth: to be clear, you CAN have standalone without cleaning, but it's not recommended, and if it fails, chances are high the deployment will fail too17:06
quothUnderstood, I assume then that cleaning can be done without neutron services?17:09
dtantsuryep, in a similar fashion to deployment17:11
* TheJulia awaits a flood of messages from the bot17:22
openstackgerritJulia Kreger proposed openstack/ironic master: Bump oslo.log requirement to 4.3.0  https://review.opendev.org/c/openstack/ironic/+/76325617:22
openstackgerritJulia Kreger proposed openstack/ironic master: Introduce common personas for secure RBAC  https://review.opendev.org/c/openstack/ironic/+/76325517:22
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for baremetal nodes  https://review.opendev.org/c/openstack/ironic/+/76325717:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for ports  https://review.opendev.org/c/openstack/ironic/+/76326717:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for port groups  https://review.opendev.org/c/openstack/ironic/+/76326817:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for chassis  https://review.opendev.org/c/openstack/ironic/+/76326917:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for baremetal drivers  https://review.opendev.org/c/openstack/ironic/+/76327017:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for node and driver passthru  https://review.opendev.org/c/openstack/ironic/+/76327117:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for utility APIs  https://review.opendev.org/c/openstack/ironic/+/76327217:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for volume APIs  https://review.opendev.org/c/openstack/ironic/+/76327317:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for conductor APIs  https://review.opendev.org/c/openstack/ironic/+/76327417:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for the allocation APIs  https://review.opendev.org/c/openstack/ironic/+/76327517:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for the event APIs  https://review.opendev.org/c/openstack/ironic/+/76327617:23
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for the deploy templates APIs  https://review.opendev.org/c/openstack/ironic/+/76327717:24
*** dougsz has quit IRC17:31
*** quoth has quit IRC17:32
*** jawad_axd has quit IRC18:05
openstackgerritElod Illes proposed openstack/ironic stable/train: [stable-only] Fix bandit upper constraint  https://review.opendev.org/c/openstack/ironic/+/76997718:23
tzumainnTheJulia, hi! I've been playing around with some options for testing various policy rules based on your updated test acl code18:30
tzumainnit turns out that every test request actually uses a new temporary policy file18:30
tzumainnso it's possible to have the yaml files include a section for policy rules that someone might want to include, and then to simply write those rules into the policy file at the beginning of test_request18:31
tzumainnmy testing so far show that this works pretty well18:32
TheJuliatzumainn: neat18:40
*** dtantsur is now known as dtantsur|afk18:43
dtantsur|afkhave a great weekend folks18:43
TheJuliadtantsur|afk: you too!18:43
*** ociuhandu has joined #openstack-ironic18:48
*** ociuhandu has quit IRC18:53
openstackgerritVictor Morales proposed openstack/bifrost master: Update APT metadata before install debootstrap  https://review.opendev.org/c/openstack/bifrost/+/76921918:58
openstackgerritMerged openstack/ironic-specs master: Snapshot support  https://review.opendev.org/c/openstack/ironic-specs/+/74693519:05
*** jawad_axd has joined #openstack-ironic19:38
openstackgerritJulia Kreger proposed openstack/ironic master: Implement secure RBAC for baremetal nodes  https://review.opendev.org/c/openstack/ironic/+/76325719:54
*** tosin has quit IRC20:18
openstackgerritArun S A G proposed openstack/ironic-specs master: Add support for anaconda deploy interface  https://review.opendev.org/c/openstack/ironic-specs/+/74850320:31
*** derekh has quit IRC21:19
*** jawad_axd has quit IRC21:20
trandlesquick question: ironic-conductor (train) dies if ipv6 isn't enabled on my host...I can't remember how to fix this and my google-fu is weak21:53
clarkbtrandles: does it default listen on :: which isn't translated properly without ipv6 enabled?21:54
clarkbif so setting the listen address to 0.0.0.0 or the actual ip addrs would fix it21:54
trandlesit's trying to listen to :: but that's disable (address family not supported blah blah)21:55
trandlesI tried setting my_ip = <actual IP> in ironic.conf but that's not it21:55
trandlesI have a bad case of the dumb right now... :(21:55
TheJuliayou should be able to set it to 0.0.0.0 to have the same effect for v421:58
clarkbhttps://docs.openstack.org/ironic/latest/configuration/config.html shows that hte only option defaulting to :: is host_ip ? (and that is for json_rpc)21:59
trandles:: doesn't appear anywhere in my ironic.conf21:59
trandlesso I'm at a loss why it's insisting conductor try to bind to :::808922:00
TheJuliajsonrpc22:00
clarkbya so thats the one documented json_rpc.host_ip should be set to 0.0.0.022:00
trandlesah HA!22:01
trandlesTheJulia & clarkb I owe you both a beer22:01
clarkbfwiw I think I wrote code once to try and find the most ip version friendly default there22:02
openstackgerritJulia Kreger proposed openstack/ironic master: Introduce common personas for secure RBAC  https://review.opendev.org/c/openstack/ironic/+/76325522:03
openstackgerritJulia Kreger proposed openstack/ironic master: Duplicate testing for system scoped ACL testing  https://review.opendev.org/c/openstack/ironic/+/77000222:03
TheJulialbragstad: If you wouldn't mind taking a look at the test patch I've got there, 770002, it woudl be much appreciated. I suspect I'm heading in the right path... but of course without policies in place I guess the settings also have no effect.22:04
clarkbhttps://opendev.org/opendev/gear/src/branch/master/gear/__init__.py#L2767-L277722:04
clarkbthat sort of thing tries to avoid this problem22:05
TheJuliaAdmittedly, the code ought to look to see if v6 is enabeld then punt22:06
clarkbya that is basically what the linked code does. It lists the addrs availbale and sorts by addr family to get ipv6 first if it is present, but listens on 0.0.0.0 if not22:07
* TheJulia is finding it really difficult to stay awake today22:11
openstackgerritJulia Kreger proposed openstack/ironic master: Duplicate testing for system scoped ACL testing  https://review.opendev.org/c/openstack/ironic/+/77000222:57
*** rloo has quit IRC22:59
openstackgerritMerged openstack/ironic stable/train: [stable-only] Fix bandit upper constraint  https://review.opendev.org/c/openstack/ironic/+/76997723:18

Generated by irclog2html.py 2.17.2 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!