Wednesday, 2025-04-09

opendevreviewJulia Kreger proposed openstack/ironic master: provide host_id to neutron early on  https://review.opendev.org/c/openstack/ironic/+/94637800:28
opendevreviewQueensly Kyerewaa Acheampongmaa proposed openstack/ironic master: Remove architecture.rst after merging content into get_started.rst  https://review.opendev.org/c/openstack/ironic/+/94661500:51
opendevreviewQueensly Kyerewaa Acheampongmaa proposed openstack/ironic master: Remove architecture.rst after merging content into get_started.rst  https://review.opendev.org/c/openstack/ironic/+/94661500:53
opendevreviewHabeeb Babasulaiman proposed openstack/bifrost master: bug: remove an unknown flag  https://review.opendev.org/c/openstack/bifrost/+/94672403:34
opendevreviewHabeeb Babasulaiman proposed openstack/bifrost master: bug: replace outdated release version with a latest one  https://review.opendev.org/c/openstack/bifrost/+/94672503:48
opendevreviewHabeeb Babasulaiman proposed openstack/bifrost master: bug: drop the mention of baremetal introspection list from the doc  https://review.opendev.org/c/openstack/bifrost/+/94672603:56
opendevreviewHabeeb Babasulaiman proposed openstack/bifrost master: bug: indentation length fixed  https://review.opendev.org/c/openstack/bifrost/+/94672804:15
rpittaugood morning ironic! o/06:49
AmarachiOrdor[m] Good Morning rpittau and everyone!06:50
freemanboss[m]Good morning rpittau: 06:53
queensly[m]Good morning07:34
opendevreviewminwoo seo proposed openstack/ironic master: feat(rules): add `api-call` action to trigger external GET webhook  https://review.opendev.org/c/openstack/ironic/+/94674007:54
freemanboss[m]rpittau: I made some reviews this morning.07:56
opendevreviewminwoo seo proposed openstack/ironic master: Add `api-call` action for ironic inspection rule  https://review.opendev.org/c/openstack/ironic/+/94674108:00
opendevreviewminwoo seo proposed openstack/ironic master: Add `api-call` action for ironic inspection rule  https://review.opendev.org/c/openstack/ironic/+/94674108:00
abongaleGood morning  Ironic!08:55
opendevreviewminwoo seo proposed openstack/ironic master: Add `api-call` action for ironic inspection rule  https://review.opendev.org/c/openstack/ironic/+/94674109:47
opendevreviewVasyl Saienko proposed openstack/networking-generic-switch master: Add support of OVS VTEP devices  https://review.opendev.org/c/openstack/networking-generic-switch/+/94655809:57
queensly[m]Hi Outreachy applicants, just wanted to share some helpful answers I got from rpittau  regarding the final application, in case anyone else had similar questions:... (full message at <https://matrix.org/oftc/media/v1/media/download/ATjicuCvxi48fpgRYteCtHiOpWnabLq4mg7FUhVIMQOfeGhHw1_jVvPZNg78PqOYb6aSDpiblhhigSfFTKavqVRCeWYiF_vwAG1hdHJpeC5vcmcvbGh3THlSamZrT0FodFJ6aGRLWlhuc3l4>)10:11
AmarachiOrdor[m]Thank you so much queensly, it really helps thank you so much!10:12
Ayo[m] Thank you queensly 10:12
queensly[m]You're welcome.10:13
freemanboss[m]rpittau: how can we best make the project timeline?10:20
freemanboss[m]Should we focus it on what we have done already or you've a template we have to follow? Thank you!10:20
freemanboss[m]queensly: thank you 10:21
opendevreviewVasyl Saienko proposed openstack/ironic master: Allow to use internal APIs during deployment  https://review.opendev.org/c/openstack/ironic/+/94632111:17
TheJuliagood morning13:03
opendevreviewNicolas Belouin proposed openstack/ironic-python-agent master: netutils: Use ethtool ioctl to get permanent mac address  https://review.opendev.org/c/openstack/ironic-python-agent/+/94656213:28
rpittau3rd day of Ironic vPTG starting in ~ 30 minutes! https://ptg.opendev.org/ptg.html13:32
opendevreviewAbhishek Bongale proposed openstack/ironic-tempest-plugin master: Fix: fail fast on deploy failure in Anaconda jobs  https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/94676513:36
opendevreviewAbhishek Bongale proposed openstack/ironic-tempest-plugin master: Fix: fail fast on deploy failure in Anaconda jobs  https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/94676513:44
rpittaucardoe: you crashed :)14:17
cardoedtantsur: 14:35
cardoebleh mis-click. I'm tinkering with a keystonemiddleware that can use TokenReview to use k8s service accounts14:35
cardoeMight be something you're interested in.14:35
cardoerpittau: is it time to revisit https://review.opendev.org/c/openstack/ironic/+/942520 ?14:39
rpittaucardoe: yeah, can you please remove the depends-on there?14:47
rpittauactually it doesn't matter, let me recheck it14:49
cardoeokay14:51
opendevreviewAbhishek Bongale proposed openstack/ironic-tempest-plugin master: fix: fail fast on deploy failure in Anaconda jobs  https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/94676515:26
opendevreviewAbhishek Bongale proposed openstack/ironic-tempest-plugin master: fix: fail fast on deploy failure in Anaconda jobs  https://review.opendev.org/c/openstack/ironic-tempest-plugin/+/94676515:45
dtantsurcardoe: that's curious indeed (use k8s accounts)16:00
Ayo[m]rpittau:  masghar I created a bug earlier on launchpad, can you give it a review 16:06
rpittauAyo[m]: can you please share the link?16:07
Ayo[m]Ok16:09
Ayo[m]https://bugs.launchpad.net/bifrost/+bug/210665316:09
Ayo[m]rpittau: 16:22
rpittauAyo[m]: so the issue is that after you restart the host where you installed ironic the services won't run automatically? that's expected16:23
Ayo[m]Ok, but at the time I didn’t know that you’d have to rerun the bifrost testenv command, I simply just sourced into bifrost and tried the commands, even after restarting the ironic service, one would still have network errors16:28
freemanboss[m]rpittau: please I've patches that you've not reviewed 16:28
freemanboss[m]It's 3 different patches please 16:28
rpittaufreemanboss[m]: I think I've reviewed all your patches, you should double-check before asking16:30
freemanboss[m]rpittau: oh alright thank you 16:33
Ayo[m]<Ayo[m]> "Ok, but at the time I didn’t..." <- @ I initially worked towards resolving those errors one at a time but the above command would’ve simply resolved the issues rpittau 16:35
* freemanboss[m] uploaded an image: (25KiB) < https://matrix.org/oftc/media/v1/media/download/AWnn0CEw6y3SNK1ocdoZWVtGFIEaJ5LyDpmNrf-iAbgrKU_tQxRS4g0QNWZgG-9KURERD2WWHekUXLLG6ljG79ZCeWY5AxBgAG1hdHJpeC5vcmcvQ3ZGaGdUbkRrZExjZHNyV2ZrbWVGaGRL >16:51
*** dansmith is now known as dansmith_pto16:52
freemanboss[m]rpittau: cid: please I got this error when I tried to rebase on top of the master branch. I was following the reply gotten from rpittau: 16:52
opendevreviewHabeeb Babasulaiman proposed openstack/bifrost master: bug: drop the mention of baremetal introspection list from the doc  https://review.opendev.org/c/openstack/bifrost/+/94672617:02
TheJuliaAnyone know a HJ-KIM?17:02
TheJuliahttps://etherpad.opendev.org/p/ironic-ptg-april-2025#L60817:03
freemanboss[m]rpittau: cid It is a success now17:03
opendevreviewPavlo Shchelokovskyy proposed openstack/ironic master: Fix ISO+GPT image handling  https://review.opendev.org/c/openstack/ironic/+/94623517:07
freemanboss[m]Amarachi Ordor: queensly: Ayo:  who knows how to rerun a build process when it failed for a commit?17:21
freemanboss[m]On Gerrit?17:22
AmarachiOrdor[m]Honestly not sure, but maybe the rest would be more of help. I usually make a slight change maybe rephrase a word and commit it again, because I think since it's already up to date that the way to go, someone else can have a better suggestion17:25
freemanboss[m]Amarachi Ordor: alright it seems I got it just now but I don't even know how I did it. I still have one more commit I need to rerun the job for it actually 17:26
AmarachiOrdor[m]Okay that's good! Well done!17:27
JayFI am beginning work on https://etherpad.opendev.org/p/ironic-2025-2-priorites-draft17:34
JayFif you have a new item that needs adding I haven't gotten to yet ... you know what to do :D 17:34
opendevreviewSatoshi Shirosaka proposed openstack/ironic master: WIP Add allow_ironic_project_image_access  https://review.opendev.org/c/openstack/ironic/+/94657517:39
satoshiTheJulia: JayF: I have a question on 2099276. 17:54
satoshihttps://etherpad.opendev.org/p/jqeQ6qI6PpW-9VVPqxyx17:54
JayFsatoshi: do you see that ID in `openstack project list` on your devstack?18:00
JayFyou can maybe map that back to the name of the project18:00
JayFwhich might be useful information18:00
JayFthe other thing I'd explicitly test is manual cleaning18:01
satoshiSure. WIll do thanks.18:01
JayFso do a full deploy (even just one that fails fast is OK) and undeploy it18:01
JayFer18:01
JayFnot manual cleaning18:01
JayFautomated cleaning18:01
JayFensure that you don't get different results for an automated_clean after a node tear down vs an automated clean from manage/provide18:01
JayFthey are subtly different code paths18:01
TheJuliaand may have no user requested value because the conductor is doing the work and has to use the conductor context because it is administrative18:05
JayFI'm honestly not sure exactly what the goal was at this point tbh18:05
JayF> 3) Update the check in is_image_available, if possible, to check for *ironic conductor's* project ID versus the one in the keystone request context. (default: on, needs to be disablable via CONF to reduce risk of aggressions) -- this is going to be significantly more difficult and invasive than steps 1+2 and should be done as a separate change, and likely not backported18:06
JayFis what I originally wrote18:06
JayFI think we're still stuck at "how do we know if it's the conductor project ID and not proxied from some API request somewhere" point18:06
TheJuliaI think your fear/worry was unprivilved use but there are cases where the conductor has to use it's own limited access18:06
JayFwell I would not want us to make an ability for someone to pull in a private glance image just by making it the service image or something18:07
JayFso IIRC I wanted that to match so we could ensure it's *our* private image vs tenant:supasecret18:08
JayFbut maybe the conf item is enough guard against that? IDK18:08
TheJuliaI suspect so since the call entry path drives the path and ultimately what task.context is18:08
JayFso the only way we could know if it's the conductor's admin token and not a user would be to like, actually auth and look at the project id there18:09
JayFwhich is /probably/ not acceptable18:09
TheJuliacorrect18:09
TheJuliawell, could be acceptable, but it is extra work18:10
JayFSo what does satoshi do then? Just bypass that check if a conf that defaults to "off" is turned on?18:10
JayFjust check project id and don't care about where it came from?18:10
TheJuliadunno, my brain is semi-fried at the moment18:10
* TheJulia looks for the patch18:10
JayFI have pointed a less-fried brain at this and haven't figured it out; I suspect we just have to make a compromise somewhere I don't wanna make18:10
JayFhttps://review.opendev.org/c/openstack/ironic/+/94657518:10
TheJuliamuchas gracias18:11
JayFyeah he's doing the extra auth via system pattern now, it seems18:11
JayFI actually think his change, as written, looks good, although I think the check on line 166 might be wrong (we want `project_id != ironic_conductor_project_id and project_id == image_owner` ... right?)18:13
JayFhmmm18:18
JayFthe data added to the etherpad gets more interesting, it looks like conductor_project_id is the service project and image_owner is the demo project18:18
JayFwhich /seems/ like it should be disallowed *if* the image is nonpublic? 18:18
JayFto prevent someone abusing our service credential to fetch arbitrary images from glance (?)18:18
JayFsatoshi: thank you for the detail in https://etherpad.opendev.org/p/jqeQ6qI6PpW-9VVPqxyx -- even tho we don't know the direction to go yet, this is great information to help us figure it out18:19
TheJuliaI think we're hyper focusing in the wrong way18:20
TheJuliaI commented on the patch specifically18:21
TheJuliabecause the logic which pre-exists is doing exactly what is being through through, and ther eis sort of a disjointed apsect to it which also need to be handled. I think in other words, we're focusing at A, when A + B is sort of the thing.18:21
TheJuliaIf that makes any sense at all18:21
JayFhonestly, after reading this chat and your comments on the patch, I'm more confused not less18:22
JayFwhich is probably more indication I'm barking up the wrong tree18:22
JayFcan we say, in plain english, what the access to grant/prevent is?18:22
TheJuliayeah, 165/166 is a bit weird18:22
TheJuliayes, we can18:22
JayFMy thought is: (conductor is service project, image is not owned by service project and is not shared/public) <-- disallow18:23
JayF(conductor is service project, image is owned by service project) <-- allow18:23
JayF(we have user credential from direct API access which would grant access to the image) <-- allow18:23
JayFbut something in that smells off18:24
TheJuliamore comments added18:30
TheJuliaso sort of yeah, partial issue is the existing code assumes "if you have an auth token, you can just get at it" which is wrong, and such a similar check shoudl be behind the project scoped access knob18:31
TheJuliaI guess what feels off is were setting an explicit kernel/ramdisk for internal operations18:34
TheJuliaso adminy18:34
JayFyou have a node override for that18:35
TheJuliabut we're doing it as shared18:35
JayFwhich means a less-privledged tenant could put in another tenant's image and pull it in 18:35
TheJuliabut rbac-eyed adminy field18:35
JayFoh? I didn't realize *_ramdisk and *_kernel weren't given to lessee/owner by default18:35
JayFif so that GREATLY reduces the problem space18:35
JayFand makes more sense why I was focusing on the wrong thing18:35
TheJuliawell, they are driver_info18:35
TheJuliaso, an admin owner could set the field18:36
TheJuliathat is where this is hairy18:36
TheJuliaso, taking a step back18:36
JayFwhich means having admin owner access to an ironic node, if we don't validate here well, could == getting someone elses' image outta glance18:36
TheJuliathe explict case to deny is if it is accessible, not explicitly public, *and* the owner of image != the requestor's project18:37
TheJuliawhere the existing code is wrong, is it has this weird assumption that *any* request with an auth_token makes the image visible18:38
JayFand it's safe to not care about if the project_id is "requestor" (human) or "requestor" (conductor auth)18:38
TheJuliawhich is wrong by default and it lets the check pass but the actual access fail later on18:38
TheJulia... I think18:38
JayFyeah, I agree18:38
TheJuliaunless it is public or shared18:39
JayFyeah, I think I'm here, let me try to restate, with an assumption of DEFAULT DENY18:39
JayFallow if:18:39
TheJuliaits like we have a matrix which is semi-dissimilar to another matrix and we're trying to do matrix math between the two18:39
JayF- image is public or shared18:39
JayF- image_id == project_id18:39
JayF- image is a ramdisk ** IF A CONFIG OPTION IS ENABLED ALLOWING THIS (I'm thinking we need this for backwards compat?)18:40
TheJuliayeah, possibly18:41
TheJuliaa separate conditional for https://review.opendev.org/c/openstack/ironic/+/946575/2/ironic/common/glance_service/service_utils.py#173 is likely wise18:41
TheJuliacould sort of be considered with https://review.opendev.org/c/openstack/ironic/+/946575/2/ironic/common/glance_service/service_utils.py#17318:42
TheJuliaerr18:42
TheJuliahttps://review.opendev.org/c/openstack/ironic/+/946575/2/ironic/common/glance_service/service_utils.py#18418:42
JayFok, that *is* the config for ramdisk/kernel then18:42
JayFright?18:42
JayFthat line 184 is basically the "image is a ramdisk" case except more properly genericized18:43
TheJuliaCONF.ignore_project_check_for_admin_tasks ?18:43
JayFyes18:43
TheJuliano18:43
TheJuliaSo, basically the challenge is line 173 short circuits most of the later logic18:44
TheJuliayou'll basically be guarneteed from a user request of any type to have a token18:44
JayFyeah18:44
TheJuliathat token disappears18:44
TheJuliaso if the conductor has to do a thing in any deferred fashion18:45
JayFe.g. cleaning with a reboot18:45
TheJuliayes18:45
JayFwhich is how satoshi stumbled on this in the first place18:45
JayFramdisk image was private, not shared, and cleaning started after a provide but didn't continue after reboot18:45
TheJuliaso 184, with the original user context of the request, is "is this person an admin of any project"18:45
TheJuliaand if so, then they are granted access under the model18:46
TheJuliame hopes this is becoming more clear18:46
JayFis_image_available ... does that even have the information needed to answer the question of "is this a ramdisk/system-tool-image or is it a image I'm writing to disk"18:47
TheJuliaIt is written in the latter context18:47
TheJuliathe former gets applied for first pass activity18:47
TheJuliaso, doing the check as proposed to *gain* the conductor's context itself, works, but that also has its own access, that would allow a return true18:48
TheJuliaI *think* the idea is to move the new logic to way down just before returning False18:49
TheJuliaso we do the first pass, we do any additional negitive case checking which we identify, then if necessary we apply the conductor access context18:50
TheJuliato handle the reboot case18:50
TheJuliaand likely, the intermediate negative casing to explicitly test for is if we'll loose access to it somehow18:50
TheJuliathat should be detectable, but it would be private image18:51
TheJuliain such a case, we likely need to return false and fail early on because that makes the failure case discoverable upfront18:52
TheJuliaam I making sense now that I've completed the context load18:52
JayFI'm a little lost but I put the method is_image_available in the bottom of satoshi's etherpad18:53
JayFand am trying to express what you're saying in python since I can't understand it in prose lol18:53
TheJuliak18:54
JayFshared images are a rough case here too18:56
JayFsatoshi: we have some code and comments in the bottom of https://etherpad.opendev.org/p/jqeQ6qI6PpW-9VVPqxyx 19:00
TheJuliayeah, they are19:01
TheJulialet me move to the table with a microphone19:01
JayFI need to step away for a few minutes, so if you wanted to sync now() I need like, 10 19:02
TheJuliasure19:02
JayFTheJulia: satoshi: now?19:12
TheJuliahttps://meet.google.com/rpp-tuec-cth ?19:12
JayFTheJulia: satoshi: https://docs.openstack.org/api-ref/image/v2/#list-image-members19:23
JayFteam photo in case anyone wanted a copy https://usercontent.irccloud-cdn.com/file/UzlXQTPJ/ironic-ptg-team-photo-20250409.png20:37
opendevreviewJay Faulkner proposed openstack/ironic master: Mark SNMP driver unsupported for removal  https://review.opendev.org/c/openstack/ironic/+/94684321:43
opendevreviewJay Faulkner proposed openstack/ironic master: Mark SNMP driver unsupported for removal  https://review.opendev.org/c/openstack/ironic/+/94684321:44
opendevreviewJulia Kreger proposed openstack/ironic master: provide host_id to neutron early on  https://review.opendev.org/c/openstack/ironic/+/94637822:08
TheJulia ^ == pain22:08
TheJuliabut hey, should be a better case now and I think would largely address johnthetubaguy's thought of concern because if the vif was bound previously on the wrong segment, because I think that is a hard fatal failure case we just need to allow surface.22:12
TheJuliaJayF: re https://review.opendev.org/c/openstack/ironic/+/946378/4/doc/source/admin/networking.rst#183 can you clarify your comment ?22:18
TheJuliaI'm not sure I understand what your talking about22:19
JayF> binding state can generally be relied upon 22:25
JayFI'm reading this from an operator standpoint,  wouldn't an operator see the port bound even when the instance wasn't yet active?22:25
JayFor am I in wrong context for that section22:25
TheJuliayeah, so it is the job of the ML2 plugin to be succesful or fail22:27
TheJuliafor ``neutron`` network_interface, that should be handled22:27
TheJuliafor ``flat`` it basically is binding fail *unless* networking-baremetal is running22:27
JayFso just because we tell it to bind, doesn't mean it actually binds? so the initial, "fake host_id" bind will still show as failed to bind?22:27
TheJulianetworking-baremetal has a noop for the flat case to force it to be listed as successful22:27
TheJuliabecause... yeah, ML222:28
JayFack22:28
TheJuliadoes that make more sense?22:28
JayFIs this a proper response on the review? > I talked to Julia about this: essentially even though we *tell* neutron to bind the port early, it should *not* show as bound because the ML2 driver will not bind it. This means it'll only show as bound (in the neutron case) when the bind is successful.22:28
JayFIf that's true, I get it :D 22:29
TheJuliaI'm still revising text, fwiw22:32
JayFokay but my understanding is right?22:32
* JayF wants to mash the gerrit button22:32
TheJuliathe paragraph above the note indicates it will end up in active no matter what22:33
TheJuliaor at least, should22:33
TheJuliathat state may change22:33
TheJuliathe second note is much more about "reliability of the state"22:33
TheJuliaFor lack of an acutal state22:33
TheJuliaIt is sort of like we're doing a soft bind with no backing data22:33
TheJuliaaside from the host_id to allow placement/network mapping stuffs to do the thing and IP addresses to be allocated22:34
JayFoh, I grok what we're doing, I'm just pleasantly surprised that in the neutron case the states remain mostly accurate22:34
TheJuliayeah, its... nuanced but yeah. It feels like one could write a book on this alone22:35
JayFLast time I was operating ironic clouds, the binding state of an ironic port was 🤷‍♂️ more or less :D (again: this is old experiences in highly patched clouds)22:35
opendevreviewJulia Kreger proposed openstack/ironic master: provide host_id to neutron early on  https://review.opendev.org/c/openstack/ironic/+/94637822:36
TheJuliayeah, fun times22:37
* TheJulia wants ice cream now22:37
JayF+1 that I'm happy to update to a +2 when the time comes :)22:39
TheJuliaack ack, I'm calling it a day22:41
TheJuliait might have been best when I wanted to apparently rename neutron to mewtron22:42
JayFyou can, but only the star, not the software project22:43
JayFthen it'll *finally* make sense how cats can weigh infinite pounds when they're laying on your blanket22:43
TheJuliaawwww :(22:43
TheJuliabut mewtron needs scritches22:44
* TheJulia goes and provides scritches to the feline employers22:44
opendevreviewminwoo seo proposed openstack/ironic master: Add `api-call` action for ironic inspection rule  https://review.opendev.org/c/openstack/ironic/+/94674123:06

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!