| opendevreview | Merged openstack/ironic master: docs: revise release notes for 2026.1 release https://review.opendev.org/c/openstack/ironic/+/980786 | 00:21 |
|---|---|---|
| opendevreview | Merged openstack/ironic master: Correct disk-format in ramdisk boot docs https://review.opendev.org/c/openstack/ironic/+/980333 | 00:44 |
| opendevreview | Jacob Anders proposed openstack/ironic master: fix redfish BIOS settings update to not require IPA https://review.opendev.org/c/openstack/ironic/+/977569 | 00:54 |
| opendevreview | Jacob Anders proposed openstack/ironic master: fix redfish BIOS settings update to not require IPA https://review.opendev.org/c/openstack/ironic/+/977569 | 01:22 |
| opendevreview | Verification of a change to openstack/networking-baremetal master failed: Add VNI to L2VNI trunk subport binding profiles https://review.opendev.org/c/openstack/networking-baremetal/+/980578 | 02:05 |
| *** mdfr4 is now known as mdfr | 02:06 | |
| opendevreview | Merged openstack/sushy-tools master: novadriver: Detect disk format from image content https://review.opendev.org/c/openstack/sushy-tools/+/980186 | 02:10 |
| opendevreview | Merged openstack/networking-baremetal master: Suppress misleading ERROR logs from OVN port lookups https://review.opendev.org/c/openstack/networking-baremetal/+/980546 | 02:41 |
| opendevreview | Merged openstack/sushy-tools master: novadriver: Add rescue-based virtual media support https://review.opendev.org/c/openstack/sushy-tools/+/980255 | 02:42 |
| opendevreview | Merged openstack/sushy-tools master: Verify power state after rescue operations https://review.opendev.org/c/openstack/sushy-tools/+/980426 | 02:42 |
| opendevreview | Verification of a change to openstack/networking-generic-switch master failed: Configure L2VNI mappings for trunk subports https://review.opendev.org/c/openstack/networking-generic-switch/+/980586 | 02:48 |
| opendevreview | Merged openstack/networking-baremetal master: Fix L2VNI trunk port binding for switch config https://review.opendev.org/c/openstack/networking-baremetal/+/980547 | 02:58 |
| opendevreview | Merged openstack/networking-baremetal master: Add OVN event-driven reconcile for L2VNI trunks https://review.opendev.org/c/openstack/networking-baremetal/+/980548 | 03:20 |
| cardoe | stephenfin: since you did a bunch with typing... the ironic pattern of having ironic.objects.THING... it doesn't think THING is valid... any pattern you use for that in other projects? I ask because it seems like the special import function will break things if I list the classes in there. | 03:48 |
| opendevreview | Merged openstack/ironic master: redfish: increase cache password hashing iterations https://review.opendev.org/c/openstack/ironic/+/979903 | 03:53 |
| opendevreview | Merged openstack/networking-baremetal master: Add targeted single-VLAN reconcile for OVN events https://review.opendev.org/c/openstack/networking-baremetal/+/980549 | 03:59 |
| opendevreview | Jacob Anders proposed openstack/ironic master: cleaning: auto-detect ramdisk need from step metadata https://review.opendev.org/c/openstack/ironic/+/978844 | 04:00 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Skip redundant BIOS reboot when settings already match https://review.opendev.org/c/openstack/ironic/+/979828 | 04:01 |
| opendevreview | Merged openstack/networking-generic-switch master: Fix transaction error in trunk subport callbacks https://review.opendev.org/c/openstack/networking-generic-switch/+/980575 | 04:18 |
| opendevreview | Merged openstack/networking-generic-switch master: Fix Cisco NX-OS VNI cleanup check command https://review.opendev.org/c/openstack/networking-generic-switch/+/980590 | 04:22 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Define constants for DII step-tracking keys https://review.opendev.org/c/openstack/ironic/+/980841 | 04:30 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Define constants for DII step-tracking keys https://review.opendev.org/c/openstack/ironic/+/980841 | 04:31 |
| opendevreview | Merged openstack/networking-baremetal master: Skip binding for ports on L2VNI anchor network https://review.opendev.org/c/openstack/networking-baremetal/+/980580 | 04:35 |
| opendevreview | Jacob Anders proposed openstack/ironic master: Define constants for DII step-tracking keys https://review.opendev.org/c/openstack/ironic/+/980841 | 04:58 |
| rpittau | good morning ironic! o/ | 07:33 |
| zigo | pyghmi/redfish/oem/ami is also missing an __init__.py ... :/ | 07:54 |
| zigo | Please merge: https://review.opendev.org/c/x/pyghmi/+/980855 | 08:04 |
| dtantsur | zigo: nobody here has any rights on pyghmi IIRC, you need to reach out to the maintainer directly | 09:24 |
| rpittau | zigo: I'm a committer but unfortunately not a core there :/ | 09:40 |
| rpittau | I've added my +1 | 09:40 |
| zigo | Cheers. | 09:40 |
| opendevreview | Verification of a change to openstack/ironic master failed: Update release mappings for new ironic releases 34.0 and 35.0 https://review.opendev.org/c/openstack/ironic/+/980782 | 10:00 |
| opendevreview | Merged openstack/ironic master: fix redfish BIOS settings update to not require IPA https://review.opendev.org/c/openstack/ironic/+/977569 | 10:37 |
| *** _gryf is now known as gryf | 10:56 | |
| dtantsur | ta-dam! | 11:11 |
| opendevreview | Merged openstack/ironic master: Update release mappings for new ironic releases 34.0 and 35.0 https://review.opendev.org/c/openstack/ironic/+/980782 | 11:59 |
| cid | ptgbot thinks of projects as TRACKS. #ironic becomes #TRACKNAME ironic. | 12:38 |
| cid | re' PTG room and times reservation. I'm reading the README.md file for https://opendev.org/openstack/ptgbot | 12:38 |
| cid | I have the order as, 1) Write the proposed times (no topic grouping yet) .......... 2) ping ptgbot .......3) Propose the times to the Mailing list. | 12:38 |
| cid | I'm at the messaging PTG Bot step. If the topic is required paramter, then my ordering must be wrong. | 12:38 |
| TheJulia | good morning | 13:17 |
| TheJulia | cid: more lke "#ironic book juno-TueB3" to reerve the juno rume on the Tuesday B3 slot | 13:20 |
| cid | TheJulia, and is "juno-TueB3" a keyword or the topic? | 13:22 |
| TheJulia | possibly, I've never honestly read bot docs in the repo | 13:23 |
| TheJulia | cid: https://meetings.opendev.org/irclogs/%23openinfra-events/%23openinfra-events.2026-03-16.log.html as an example of use | 13:31 |
| cid | Oh, that's very handy. | 13:35 |
| cid | This part is the room name <diablo->. | 13:35 |
| cid | Should I schedule all as B2 for the different days? | 13:35 |
| TheJulia | So generally we'll identify 3-4 days we want to meet | 13:41 |
| cid | My little confusion is around this part: "(room)-(day)(slot)" Forgive me ignorance. | 13:41 |
| TheJulia | and then looking at the ptgbot status screen, http://ptg.opendev.org/ptg.html, book the corresponding block of time | 13:42 |
| cid | The room is mitaka, I know the shortcodes for the days, but the slot | 13:42 |
| cid | Oh, I think I grasp it now. | 13:43 |
| TheJulia | \o/ | 13:52 |
| * TheJulia needs more and stronger coffee | 13:57 | |
| opendevreview | Takashi Kajinami proposed openstack/ironic master: devstack: Use common function to manage keystoneauth options https://review.opendev.org/c/openstack/ironic/+/980952 | 14:00 |
| cid | I just reserved slots B1 (13:00 UTC) - B5 (17:00 UTC) for Monday through Friday on the Mitaka room | 14:05 |
| JayF | I'd send in the email about that to the mailing list and also offer to do a time that would be more friendly to APAC contributors if needed | 14:07 |
| opendevreview | Julia Kreger proposed openstack/ironic master: Add preamble for Gazpacho https://review.opendev.org/c/openstack/ironic/+/980833 | 14:08 |
| TheJulia | JayF: fixed the last spelling item | 14:08 |
| JayF | Thank you. | 14:09 |
| JayF | I swear I've been spelling that word wrong my entire life and I've never been able to fix it | 14:10 |
| dtantsur | TheJulia, JayF, should we highlight the massive number of fixes for firmware upgrades and settings? Especially the former was more or less a complete rewrite. | 14:11 |
| TheJulia | It would nake sense to make a callout | 14:13 |
| cid | JayF, that emal will be to the entire openstack-discuss? | 14:15 |
| TheJulia | cid: yes | 14:22 |
| cid | ack'd | 14:22 |
| JayF | dtantsur: sure for that. Comment on there and I'll have it revised within the hour | 14:38 |
| JayF | We probably should have put it in cycle highlights as well but it's too late | 14:38 |
| dtantsur | ++ | 14:43 |
| opendevreview | Merged openstack/networking-baremetal master: Add VNI to L2VNI trunk subport binding profiles https://review.opendev.org/c/openstack/networking-baremetal/+/980578 | 14:47 |
| TheJulia | sweet, time to recheck an n-g-s patch | 14:47 |
| JayF | dtantsur: "Firmware interface has matured significantly this cycle." ? | 15:06 |
| JayF | dtantsur: anything specific to call out | 15:07 |
| dtantsur | JayF: ability to function without relying on IPA | 15:07 |
| JayF | "Firmware can now be updated out-of-band without booting an in-band agent." | 15:08 |
| * JayF trying to think of a way to say it without having to define IPA | 15:08 | |
| opendevreview | Merged openstack/networking-baremetal master: L2VNI multi-link LAG support + fix OVN LLDP filter https://review.opendev.org/c/openstack/networking-baremetal/+/980612 | 15:09 |
| JayF | hmm "Firmware updates via Redfish no longer require booting an in-band agent afterwards." | 15:09 |
| dtantsur | JayF: I'd expect people who care to read the prelude to our release notes to know what IPA is (but you can say "in-band agent", yes) | 15:09 |
| dtantsur | (ideally, we need https://review.opendev.org/c/openstack/ironic/+/978844 too) | 15:12 |
| opendevreview | Jay Faulkner proposed openstack/ironic master: Add preamble for Gazpacho https://review.opendev.org/c/openstack/ironic/+/980833 | 15:14 |
| JayF | dtantsur: is https://review.opendev.org/c/openstack/ironic/+/978844 broken for automated_cleaning_via_runbook cases? | 15:16 |
| JayF | Hmm I think it should be fine | 15:17 |
| JayF | but the commit says it doesn't work | 15:17 |
| JayF | janders: https://review.opendev.org/c/openstack/ironic/+/978844 can you fix the release note and/or commit there in a quick turnaround so I can help land it for release? | 15:19 |
| JayF | if he doesn't respond soon I'll push a revision just to commit message + releasenote | 15:20 |
| dtantsur | JayF: he's in australia, he won't respond for a while | 15:27 |
| JayF | I'll push a patch | 15:27 |
| TheJulia | regarding ngs/n-b, we've got a few last changes in, and afaik we've not cut them for the stable release so if we could that would be awesome once they land | 15:30 |
| JayF | Who is going to be cutting the releases? Probably me and you if we want it to happen in this TZ? | 15:30 |
| JayF | I think riccardo usually does it but he is eod by now I think/hope | 15:30 |
| TheJulia | it sounds like tomorrow will be it, but if we get everything landed in time we can just go ahead and propose it | 15:31 |
| JayF | BTW, I was going to write one blogpost for autodetect ramdisk + tbn | 15:33 |
| JayF | I think the theme of "allowing deploy time changes to behavior" fits | 15:33 |
| TheJulia | [ok | 15:33 |
| TheJulia | Speaking of blog posts, anyone have any issues with https://github.com/OpenStackweb/ironic-website/pull/85 ? | 15:34 |
| JayF | it's in my browser will review, likely it'll be after my 9am meeting | 15:35 |
| opendevreview | Jay Faulkner proposed openstack/ironic master: cleaning: auto-detect ramdisk need from step metadata https://review.opendev.org/c/openstack/ironic/+/978844 | 15:36 |
| opendevreview | Jay Faulkner proposed openstack/ironic master: Skip redundant BIOS reboot when settings already match https://review.opendev.org/c/openstack/ironic/+/979828 | 15:36 |
| JayF | aight, that's janders' patch with the updated releasenote and commit message; I put a +2 on it ^ if someone wants to land it | 15:38 |
| Sandzwerg[m] | Ohai ironic. A little bit off-topic but is there a known issue with docs.openstack.org? It's really slow for me. | 15:40 |
| TheJulia | one minor concern on https://review.opendev.org/c/openstack/ironic/+/978844 | 15:42 |
| TheJulia | yeah, same here | 15:43 |
| JayF | They have been fighting off a LLM scraper attack for about a week | 15:43 |
| JayF | performance is off and on | 15:43 |
| JayF | You can always checkout ironic and run `tox -edocs` to get a local copy in /path/to/ironic/docs/build/html/index.html | 15:43 |
| JayF | oh, I agree TheJulia | 15:44 |
| JayF | nice catch | 15:44 |
| JayF | that would've likely been a security issue (!) | 15:44 |
| TheJulia | Eh, it really depends on the vendor though | 15:44 |
| TheJulia | and.. I could sort of go *either* way | 15:45 |
| TheJulia | dunno | 15:45 |
| dtantsur | It makes sense as a self-service item, especially if you screw up BIOS settings (which you can do already) | 15:45 |
| JayF | I think it's wise of us to have our default configuration reflect safe behaviors | 15:45 |
| JayF | and there exists a *lot* of hardware which resetting at this point could lead to unexpected behavior | 15:45 |
| dtantsur | If you can change BIOS settings, preventing factory reset artificially doesn't make too much sense to me | 15:45 |
| opendevreview | Merged openstack/networking-baremetal master: Fix incorrect is_partial_segment() call on PortContext https://review.opendev.org/c/openstack/networking-baremetal/+/980640 | 15:46 |
| opendevreview | Merged openstack/networking-baremetal master: Fix router interface HA binding for baremetal VLAN networks https://review.opendev.org/c/openstack/networking-baremetal/+/980648 | 15:46 |
| opendevreview | Merged openstack/networking-baremetal master: docs: l2vni - Clean up admin documentation https://review.opendev.org/c/openstack/networking-baremetal/+/980835 | 15:46 |
| TheJulia | dtantsur: I concur | 15:46 |
| TheJulia | factory reset means a bunch of different things | 15:46 |
| JayF | From a footgun perspective, do we have the guardrails in place to make sure things will continue to work? | 15:46 |
| dtantsur | I wish Jacob submitted this change separately though, so I'm not going to cry if you just remove it and notify him for the sake of an agreement | 15:46 |
| Sandzwerg[m] | Ah okay yeah that would explain it. And yeah looking at the code is my fallback as well, but I'm used to the website and it is quiet convinient if it works. Is there a status.openstack.org site or similar where this is tracked? | 15:46 |
| dtantsur | JayF: we don't have such safeguards anywhere in the BIOS or firmware interfaces | 15:46 |
| JayF | e.g. I have a service running on a node deployed with a ramdisk; will Ironic, post-servicing, re-setup the vmedia boot? | 15:46 |
| JayF | This is more what I'm concerned about than someone sneaky disabling a "unhackable=true" bios setting | 15:47 |
| JayF | side effects that would just render the active node unusable | 15:47 |
| TheJulia | JayF: if someone has sufficient access to change bios settings and they nuke their bios settings in incompatible way they need to be able to fix it, the issue with factory reset is depending on what the vendor interpretation of, they may be opening a support ticket, and maybe that is okay | 15:47 |
| JayF | There are use cases where that is not only OK; that's the desired flow. | 15:48 |
| JayF | There are use cases where the exact opposite is likely true as well. | 15:48 |
| TheJulia | yup | 15:48 |
| TheJulia | this is why RBAC, knobs, and other aspects are options, just we can't make everyone happy without feedback :) | 15:48 |
| JayF | s/without feedback :)// | 15:48 |
| TheJulia | heh | 15:48 |
| TheJulia | but... I wants the feedbacks | 15:49 |
| JayF | sure but they still won't be happy lol | 15:49 |
| dtantsur | For the record, I care about the fix merging. I don't care if it includes the service_step change or not. | 15:49 |
| * TheJulia grumps anyhow | 15:49 | |
| TheJulia | I'm good with it | 15:49 |
| JayF | my +2 is still up there and I can push a fix or not | 15:49 |
| JayF | I don't love it but I didn't notice it | 15:49 |
| JayF | so I shouldn't care so much now | 15:49 |
| TheJulia | I workflowed it | 15:50 |
| JayF | Was automated cleaning via runbook this cycle? No, that was last, right? | 15:51 |
| JayF | Yeah it was alst. | 15:51 |
| TheJulia | good to go with networking-baremetal (it looks like) | 15:55 |
| JayF | I am going into a meeting here, but if you wanna put up the release req I can review after | 15:56 |
| TheJulia | one left on networking-generic-switch in CI now | 15:56 |
| TheJulia | I have a meeting starting in 4 minutes as well | 15:56 |
| TheJulia | :\ | 15:56 |
| JayF | I could pretend it's some important client meeting, but it's my podcast sync so less so :D | 15:57 |
| TheJulia | https://review.opendev.org/c/openstack/ironic/+/980832 would be a nice quick easy change to improve CI happiness | 16:25 |
| TheJulia | nice, sushy is on the list of libraries in https://www.dmtf.org/standards/redfish | 16:44 |
| JayF | TheJulia: blogpost reviewed. I have some suggestions but it's up to you if the juice is worth the squeeze | 16:46 |
| TheJulia | I'd really just prefer to merge at this point, I'm 2+ weeks past the point where I wrote it | 16:49 |
| TheJulia | so unless there is something grossly wrong | 16:50 |
| JayF | there's a reason I approved it and put comments on it | 16:50 |
| TheJulia | :) | 16:50 |
| JayF | don't wanna rubber stamp review but also don't wanna push to edit a thing that is already good rnough lol | 16:50 |
| TheJulia | I'm in the middle of a thing, once I am done with that I can shift gears | 16:51 |
| TheJulia | and take a look | 16:51 |
| dtantsur | So, what's our take on changing BMC credentials via Ironic? | 17:12 |
| JayF | 😱 but we probably should anyway | 17:12 |
| JayF | the hardest part is like. .. I don't want people to think our mysql DB is an A++ place to store those passwords | 17:13 |
| JayF | we don't encrypt them at rest | 17:13 |
| JayF | so it makes me wonder if we need to focus on hardening around password storage before we dig deeper into password rotation | 17:13 |
| dtantsur | Yep, I don't mean making Ironic the authoritative source of the credentials, only about providing the means to change them | 17:13 |
| JayF | You make Ironic change them; people will use us as the authoritative source whether we wanna be one or not. | 17:13 |
| JayF | At least I can't see a way to thread that needle in a reasonable way | 17:14 |
| dtantsur | I have limited ability to protect people from bad decisions :) It's enough that we don't show the credentials by default IMO | 17:14 |
| JayF | ^^ the amount I disagree with that statement, in scope of Ironic, is a lot actually :) | 17:14 |
| JayF | We should always make it, unless impossible, so that the path of least resistance is the right one | 17:15 |
| JayF | which means, IMO, hardening password storage so when people follow the path your suggested feature will lay out for them, that it's not awful :D | 17:15 |
| dtantsur | If the operator does not enable displaying credentials, you cannot use it as a storage | 17:15 |
| JayF | Can you clarify? | 17:16 |
| dtantsur | By default, Ironic API returns ******* for anything that has "password" or "token" in it. You must opt into displaying these fields. | 17:16 |
| opendevreview | Harald Jensås proposed openstack/networking-baremetal stable/2025.2: Fix hash ring broken after eventlet removal https://review.opendev.org/c/openstack/networking-baremetal/+/980998 | 17:16 |
| dtantsur | So, if you use the hypothetical API to set the credentials, you cannot get them back from Ironic. | 17:16 |
| dtantsur | If someone is happy with a write-only credentials storage.. I don't know what to tell them | 17:17 |
| JayF | I think a /lot/ of people will be happy with that | 17:17 |
| JayF | until Ironic goes down due to external issues and they don't have BMC passwords to recover | 17:17 |
| JayF | that's the entire problem | 17:17 |
| JayF | For many users, Ironic is the only thing even authorized to talk to their BMCs. Why would they ever want to extract the password? | 17:17 |
| dtantsur | I think we're divering into a tangential discussion. Your argument is valid regardless of whether we can change credentials through Ironic or not. | 17:18 |
| JayF | The difference is: in the existing case; someone has to have the credential first, then they give it to ironic | 17:19 |
| JayF | if they lose it later, their actions put them there | 17:19 |
| JayF | in a case of this feature, no human ever touches/sees the new credential that Ironic is using | 17:19 |
| JayF | so I feel a bit more responsibility to the user around it | 17:19 |
| dtantsur | This is very-very much not what I suggest | 17:19 |
| JayF | historically all "changing BMC credentials in Ironic" has been paired with "automatic credential rotation" | 17:20 |
| JayF | I think I made that assumption | 17:20 |
| dtantsur | I don't make this leap, at least not right now | 17:20 |
| dtantsur | I'm looking for a verify/clean/service(?) step change_bmc_credentials(username, password) that changes the BMC and also automagically fixes driver_info once done. | 17:21 |
| JayF | I am like, +0 to that, I don't love that with a default policy + shipped step you can lock yourself outta a bmc | 17:21 |
| JayF | I feel like it's extremely tough to say "for this step to be safe+useful, you need custom policy" | 17:22 |
| dtantsur | policy = rbac? | 17:22 |
| JayF | is there a way, without editing policy.{json,yaml}, to allow viewing of passwords? | 17:23 |
| JayF | no is what my understanding is today | 17:23 |
| dtantsur | I don't think you can. Definitely not through the API. | 17:23 |
| JayF | Yeah, this is what I'm pointing at as the footgun. It's going to be WAY easier to run this step than it will be to recover the password changed to. | 17:23 |
| JayF | even if we put on blinders to cred storage | 17:24 |
| dtantsur | For the record, I don't hate the idea of having an RBAC policy per each clean/deploy/service step we offer. | 17:24 |
| JayF | this is why I was thinking it would be interesting to think about cred storage | 17:24 |
| JayF | e.g. make it barbican's problem if sally wants to see node 12345's BMC creds | 17:24 |
| dtantsur | Well, in my case it will be a Kubernetes secret | 17:24 |
| JayF | dtantsur: that's more or less why I added runbooks, to prevent the need for something shaped like that | 17:24 |
| JayF | Yeah, so you recognize the problem but it'd only be solved on the metal3 side of the wall | 17:25 |
| JayF | we need a better answer for the non-k8s deployment imo | 17:25 |
| dtantsur | In my case, it's also the caller's problem. | 17:25 |
| JayF | Does metal3 ship policy to show passwords? | 17:25 |
| JayF | oh, wait | 17:26 |
| JayF | hold on I made another assumption jump | 17:26 |
| JayF | we are giving Ironic the password/username to set | 17:26 |
| dtantsur | No. We do ugly hacks to detect if the credentials have been changed. | 17:26 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: Move multicast helper to device_utils. https://review.opendev.org/c/openstack/networking-generic-switch/+/980158 | 17:26 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: Arista eos multicast vxlan https://review.opendev.org/c/openstack/networking-generic-switch/+/980159 | 17:26 |
| JayF | if the API user calling the step passes in the user/pass, it's less dangerous | 17:26 |
| dtantsur | (I don't mind someone looking into barbican, I just don't want it to become my headache since I'm pretty far from OpenStack nowadays) | 17:26 |
| JayF | because we go back to the original model of "human has creds" | 17:26 |
| dtantsur | yeah | 17:26 |
| JayF | I'd wanna draw a dark line there | 17:27 |
| JayF | that we need to think of password ux before we could ever go to a "generate me one" model | 17:27 |
| * dtantsur nods | 17:27 | |
| JayF | dtantsur: I don't wanna look into barbican either :P | 17:27 |
| opendevreview | Merged openstack/ironic master: ci: gently increase ci callback timeouts https://review.opendev.org/c/openstack/ironic/+/980832 | 17:33 |
| TheJulia | dtantsur: So, on the subject of changing credentials, I think we should go ahead and support it, but it has lots of sharp edges as I'm assuming dsicussion has reached | 17:35 |
| JayF | TheJulia: the line I drew is if the creds are provided to the step and not generated by the step I am +1 | 17:36 |
| JayF | TheJulia: anything that causes ironic to generate the creds needs thoughts on password retreival UX | 17:36 |
| dtantsur | Yep. It's also not at the very top of my priority list, I'm just checking what the redlines here are to be able to communicate it downstream. | 17:36 |
| TheJulia | so, an interesting point regarding trying to head off everything, I brought up the same concern with an ironic operator recently and they were like (and I'm paraphrasing) "I don't care, Its a ticket for DC ops to roll a cart at that point. Blame goes back to the user who mucked the machine up" | 17:36 |
| TheJulia | Yeah, I can generally agree with the "if the user supplies it", but that same operator I spoke to, just doesn't want to know it | 17:38 |
| TheJulia | in their case, they have a long lived deployment | 17:38 |
| TheJulia | and if worst comes to worst they have db access if the other team goes sideways | 17:39 |
| JayF | I think DB access giving you the cred | 17:40 |
| JayF | is a security vuln in context of an Ironic-generated password feature | 17:41 |
| TheJulia | If they have excess accounts that have additional db access, then thats outside of our control. the only thing we can do is quite literally use an external secret store or require key management and encryption of values otherwise which is a topic we, as a project, have avoided | 17:42 |
| JayF | I'm just thinking if I'm an operator with password safety requirements that say I have to rotate my BMC password | 17:43 |
| JayF | I'd be stunned if those same requirements allowed not-encrypted at rest | 17:43 |
| * JayF notes that many modern BMCs will also integrate with central authentication systems, and that may serve as a sufficient security method for some operators | 17:44 | |
| TheJulia | yeah, and also varying interpretations | 17:52 |
| JayF | btw I have (human written) draft done of autodetect+tbn am just going through it with claude to improve | 17:54 |
| JayF | TheJulia: https://github.com/OpenStackweb/ironic-website/pull/86/changes | 18:07 |
| TheJulia | ok | 18:10 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: WIP: cumlus nvue multicast group support https://review.opendev.org/c/openstack/networking-generic-switch/+/981018 | 18:57 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: Move multicast helper to device_utils. https://review.opendev.org/c/openstack/networking-generic-switch/+/980158 | 19:09 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: Arista eos multicast vxlan https://review.opendev.org/c/openstack/networking-generic-switch/+/980159 | 19:09 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: WIP: cumlus nvue multicast group support https://review.opendev.org/c/openstack/networking-generic-switch/+/981018 | 19:09 |
| TheJulia | The last patch I want is in the gate, so... \o/ | 19:11 |
| opendevreview | Julia Kreger proposed openstack/networking-generic-switch master: ci: add "vxlan" ci job https://review.opendev.org/c/openstack/networking-generic-switch/+/981024 | 19:15 |
| opendevreview | Jay Faulkner proposed openstack/sushy master: Add missing __init__.py https://review.opendev.org/c/openstack/sushy/+/980781 | 19:20 |
| opendevreview | Jay Faulkner proposed openstack/sushy master: Fix docs lint issue in docstring https://review.opendev.org/c/openstack/sushy/+/981025 | 19:20 |
| JayF | cardoe: zigo: ^ that cleans up that docs ci failure and restacks zigo's fix | 19:20 |
| opendevreview | Merged openstack/ironic master: Fix wrong keys in `set_boot_mode` https://review.opendev.org/c/openstack/ironic/+/980153 | 20:26 |
| opendevreview | Merged openstack/networking-generic-switch master: Configure L2VNI mappings for trunk subports https://review.opendev.org/c/openstack/networking-generic-switch/+/980586 | 20:44 |
| TheJulia | I'm slowly updating the releases change, anything outstanding on ironic? | 21:17 |
| JayF | yes | 21:28 |
| TheJulia | I updated the release patch with latest for items minus ironic, we'll still need to add ironic 35.0, pending a couple patches | 21:28 |
| JayF | those two commits just above | 21:28 |
| JayF | https://review.opendev.org/c/openstack/sushy/+/981025 | 21:28 |
| JayF | oh that's sushy | 21:28 |
| JayF | NEVERMIND ME | 21:28 |
| JayF | let me check ironic real quick | 21:29 |
| TheJulia | heh | 21:29 |
| TheJulia | too late for the sushys of the world, although sushi is always viable. ;) | 21:29 |
| JayF | https://review.opendev.org/c/openstack/ironic/+/980162 is a bugfix chain | 21:29 |
| JayF | would be nice to get in but we can also backport those per policy | 21:29 |
| JayF | https://review.opendev.org/c/openstack/ironic/+/980408 | 21:29 |
| JayF | https://review.opendev.org/c/openstack/ironic/+/980833 (release notes preamble) | 21:30 |
| JayF | https://review.opendev.org/c/openstack/ironic/+/978844 needs to make it thru the gate (already approved) | 21:30 |
| JayF | ^ and I approved the patch following it so it's a two-for-one if approved | 21:30 |
| JayF | https://review.opendev.org/c/openstack/ironic/+/980115/ I just put final approvals on these three changes | 21:32 |
| JayF | reviewing the rest of CID's chain now | 21:32 |
| TheJulia | k | 21:33 |
| JayF | +2 on the chain that started with 980162 (you approved the first one of three already) | 21:34 |
| TheJulia | Yeah, something about the second one distracts me | 21:35 |
| JayF | reviewed https://review.opendev.org/c/openstack/ironic/+/980841 with a +0 (I think it's OK to miss the release) | 21:35 |
| JayF | TheJulia: should LN 197 (enabled = (desired_enabled if d....)) be unindented? | 21:37 |
| TheJulia | of which change? | 21:38 |
| JayF | the 2nd one in CID's stack | 21:38 |
| TheJulia | https://review.opendev.org/c/openstack/ironic/+/980163/3/ironic/drivers/modules/redfish/management.py | 21:38 |
| JayF | that you were distracted by | 21:39 |
| JayF | I looked at it again to try and find something | 21:39 |
| JayF | the bug https://bugs.launchpad.net/ironic/+bug/2142498 is something clif saw just reading the code, so if there's annything but 100% confidence we shouldn't push it in the release | 21:41 |
| JayF | it's not a user-facing issue right now, or at least a serious enough one that someone complained | 21:41 |
| TheJulia | Okay, yeah, I'm good on holding on that stuff then becasue it makes me nervous right now anyhow | 21:43 |
| TheJulia | so now, ci() | 21:45 |
| JayF | going thru my release checklist for stuff I personally owe... | 21:48 |
| JayF | blogpost drafted, waiting for review (I poked our blogpost reviewer at GR-OSS with the link as well, unsure if he'll get to it quick enough) | 21:48 |
| JayF | I need to work on the Ironic slides for openinfra live, that'll probably be a tomorrow thing | 21:48 |
| JayF | putting up release PRs has to wait for ci() | 21:49 |
| JayF | so I think we're in good shape right now | 21:49 |
| opendevreview | Merged openstack/networking-baremetal stable/2025.2: Fix hash ring broken after eventlet removal https://review.opendev.org/c/openstack/networking-baremetal/+/980998 | 22:25 |
| opendevreview | Merged openstack/ironic master: cleaning: auto-detect ramdisk need from step metadata https://review.opendev.org/c/openstack/ironic/+/978844 | 22:32 |
| TheJulia | JayF: the change has already been posed by the release team, we just need to update it at this point. | 22:35 |
| TheJulia | I -1'ed it with a comment earlier today | 22:36 |
| TheJulia | And yeah, tomorrow I need to pull up that deck | 22:36 |
| JayF | cardoe: https://review.opendev.org/c/openstack/sushy/+/981025/1 can be +2A as a single core as it's a docs change, if you are comfy | 22:46 |
| opendevreview | Merged openstack/ironic master: Remove unused variables and fix the log message https://review.opendev.org/c/openstack/ironic/+/980162 | 23:03 |
| opendevreview | Merged openstack/ironic master: Skip redundant BIOS reboot when settings already match https://review.opendev.org/c/openstack/ironic/+/979828 | 23:03 |
| opendevreview | Merged openstack/ironic master: fix: Remove early excessive return https://review.opendev.org/c/openstack/ironic/+/980115 | 23:03 |
| opendevreview | Merged openstack/ironic master: trivial: remove unused helper method argument https://review.opendev.org/c/openstack/ironic/+/980117 | 23:03 |
| opendevreview | Merged openstack/ironic master: trivial: fix argument name in abstract api method https://review.opendev.org/c/openstack/ironic/+/980124 | 23:03 |
| opendevreview | Merged openstack/ironic master: Add preamble for Gazpacho https://review.opendev.org/c/openstack/ironic/+/980833 | 23:04 |
| opendevreview | Merged openstack/ironic master: Make local_gb an int https://review.opendev.org/c/openstack/ironic/+/980408 | 23:04 |
| cardoe | JayF: yep. Happy for it. | 23:07 |
| cardoe | I just ended up having some stuff today. The frost messed up a pipe. | 23:07 |
| cardoe | I’ll try to look through the backlog of stuff once I have dinner and a shower. | 23:09 |
| JayF | oh no! I hope you were able to get things shut off in time :| | 23:17 |
| opendevreview | Merged openstack/sushy master: Fix docs lint issue in docstring https://review.opendev.org/c/openstack/sushy/+/981025 | 23:56 |
| cardoe | JayF: yeah not terrible. Just cleanup involved frozen stuff. So hair dryer to melt some. | 23:57 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!