| opendevreview | Victor proposed openstack/ironic master: Truncate node history event to avoid DB column overflow https://review.opendev.org/c/openstack/ironic/+/981399 | 05:52 |
|---|---|---|
| opendevreview | Konstantinos Karampogias proposed openstack/ironic-specs master: Firmware endpoint hardware identity https://review.opendev.org/c/openstack/ironic-specs/+/985800 | 08:09 |
| *** alegacy_ is now known as alegacy | 11:37 | |
| dtantsur | JayF: good morning, let me know if you're up for touching upon GPU in the inventory today. | 12:01 |
| opendevreview | cid proposed openstack/ironic stable/2025.2: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986361 | 12:08 |
| opendevreview | cid proposed openstack/ironic stable/2025.1: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986362 | 12:09 |
| opendevreview | cid proposed openstack/ironic stable/2024.2: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986363 | 12:10 |
| dtantsur | hey folks, we discussed having blocklist for steps, so here's an RFE: https://bugs.launchpad.net/ironic/+bug/2150456 | 13:46 |
| dtantsur | it has one open question about runbooks | 13:46 |
| dtantsur | anyone is welcome to take this, I won't have time for it | 13:46 |
| JayF | #startmeeting ironic | 15:00 |
| opendevmeet | Meeting started Mon Apr 27 15:00:21 2026 UTC and is due to finish in 60 minutes. The chair is JayF. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'ironic' | 15:00 |
| opendevreview | Verification of a change to openstack/ironic master failed: Revert "Soft power off before ejecting virtual media regardless of CONF.inspector.power_off" https://review.opendev.org/c/openstack/ironic/+/985362 | 15:00 |
| JayF | Good morning everyone! Since we concluded our giant week of meetings, we get a meeting on Monday morning as our reward. | 15:00 |
| JayF | I'll wait to see if we get quorum. | 15:00 |
| * dtantsur waves | 15:00 | |
| mumesan[m] | o/ | 15:02 |
| abongale | o/ | 15:02 |
| clif | o/ | 15:02 |
| iurygregory | o/ | 15:03 |
| JayF | #topic Announcements/Reminders | 15:03 |
| JayF | Please review patches hashtagged ironic-week-prio and also tag patches ready for review with ironic-week-prio | 15:04 |
| JayF | Also, we're in the 2026.2 Hibiscus release cycle now. It's R-22. No deadlines in sight. | 15:04 |
| JayF | #topic Working Group Updates | 15:04 |
| JayF | I cleaned up this portion of the agenda; I only left asyncio which I think is the only one with activity still | 15:04 |
| cid | o/ | 15:04 |
| JayF | is that accurate? VXLan working group no longer needed? | 15:04 |
| kubajj | o/ | 15:05 |
| JayF | Also does someone wanna speak to asyncio | 15:05 |
| iurygregory | no updates afaik | 15:05 |
| dtantsur | We'll pick it up eventually, but not right now | 15:05 |
| iurygregory | we had the spec up from dtantsur | 15:05 |
| iurygregory | yeah | 15:05 |
| JayF | Sounds about what I expected. Please update the etherpad if we need to pop up any other working groups | 15:06 |
| JayF | #topic Discussion Topics | 15:06 |
| JayF | One item here, and I added it | 15:06 |
| JayF | we have our work items spec up for review | 15:06 |
| JayF | #link https://review.opendev.org/c/openstack/ironic-specs/+/986018 | 15:07 |
| JayF | Unless there is major objection; I intend on merging this Wednesday morning PDT in order to give me time to record a PTG recap video before flying out. | 15:07 |
| JayF | Please review and help get this into place. | 15:07 |
| JayF | #topic Bug Deputy Updates | 15:08 |
| JayF | Did we have a bug deputy? | 15:08 |
| cid | I don't think we did but I'm happy to take it up this week. | 15:09 |
| cid | See what we missed out on during the PTG week and such | 15:09 |
| JayF | SGTM, thank you cid. | 15:09 |
| JayF | #topic RFE Review | 15:09 |
| JayF | There was an RFE filed by dtantsur, I tagged it approved based on PTG conversation | 15:09 |
| JayF | #link https://bugs.launchpad.net/ironic/+bug/2150456 | 15:09 |
| cid | Yeah, about the open question on the RFE, | 15:10 |
| cid | Given the idea of runbooks being pre-approved, i think we don't necessarily need to exclude them | 15:11 |
| JayF | I think there's more nuance than that | 15:12 |
| JayF | runbooks that are isolated to use by a single project can be created by aproject manager | 15:12 |
| cid | I was just about to say, I believe there's a world where we might still do that for runbooks, I can't think of any at the moment. | 15:12 |
| JayF | whereas the blocklist config is a decision made at a systems level | 15:12 |
| JayF | IMO we would filter in all cases | 15:12 |
| JayF | dtantsur: thoughts? | 15:14 |
| JayF | there's probably value in getting a decision made and into the RFE | 15:14 |
| dtantsur | I really don't know, hence I put it as an open question | 15:14 |
| JayF | I always just think of it like RBAC alignment | 15:14 |
| cid | +++ | 15:14 |
| JayF | with config files being "system admin" | 15:14 |
| dtantsur | I'm kind of buying into the different persona argument, yes | 15:14 |
| dtantsur | blocklist = "not on my cloud!!" | 15:15 |
| JayF | so I would say don't allow a project manager to do something a system admin says no to | 15:15 |
| cid | Although, a project level runbooks can only run on nodes owned by that project. | 15:15 |
| JayF | cid: yeah but think about a multitenant case, you may not trust the node.owner project | 15:15 |
| JayF | cid: so then them running, e.g. drac.factory_reset, might disable a security functionality you have enabled | 15:15 |
| JayF | I'm going to put a note in the bug that this is the assumed consensus and to bring it up again if someone wants to implement it differently. | 15:16 |
| JayF | #topic Open Discussion | 15:17 |
| JayF | Any additional items to bring up to the group before we shut down? | 15:17 |
| cid | None from me at this time. By the way, it makes perfect sense that system-level decisions trickle down. | 15:19 |
| JayF | Last item: Does someone wanna volunteer to chair next week's meeting? | 15:20 |
| JayF | In lieu of someone else to run the meeting; I will but ideally someone not out half this week will run next weeks meeting :) | 15:20 |
| JayF | Aight, have a good week all p/ | 15:21 |
| JayF | #endmeeting | 15:21 |
| opendevmeet | Meeting ended Mon Apr 27 15:21:58 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:21 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-04-27-15.00.html | 15:21 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-04-27-15.00.txt | 15:21 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-04-27-15.00.log.html | 15:21 |
| clif | o/ | 15:22 |
| cardoe | Well dang that was quick. | 15:23 |
| JayF | Three-(awake)-person meetings move fast lol | 15:24 |
| JayF | cid: do you wanna pair on drafting up an OSSN for the IPMI console thing? | 15:25 |
| cid | Sure1 | 15:26 |
| JayF | give me 5 minutes and I'll spin up a zoom | 15:26 |
| JayF | I'll link it in here in case others wanna join | 15:26 |
| cid | clif, I saw your review on the pickle change. I will address it in a moment | 15:34 |
| cid | Also, I have a change for the same in the oslo_service and oslo_config repos, did you get a chance to check those out as well? | 15:35 |
| cid | If those land, we may not need the Ironic patches | 15:35 |
| JayF | https://us06web.zoom.us/j/87613520814?pwd=cWHtaaiBRSeUaWeX4N5DIOF7JLgfxy.1 is where cid and I are drafting the OSSN if anyone wants to join | 15:37 |
| clif | cid: no, I didn't realize, I'll go take a look | 15:37 |
| cid | tks | 15:37 |
| opendevreview | Verification of a change to openstack/ironic master failed: Revert "Soft power off before ejecting virtual media regardless of CONF.inspector.power_off" https://review.opendev.org/c/openstack/ironic/+/985362 | 15:52 |
| opendevreview | Jay Faulkner proposed openstack/ironic unmaintained/2024.1: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986417 | 16:07 |
| cardoe | So I'm looking at neutron policies and ironic policies... I notice that `role:admin` without a project seems to be all that's required to modify system wide resources in neutron while ironic uses system scope=all... do we have any RBAC definition / policy on this? Or is that coming hire up from keystone and the OpenStack TC? | 16:07 |
| opendevreview | Jay Faulkner proposed openstack/ironic unmaintained/2023.1: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986418 | 16:07 |
| cardoe | TheJulia out? | 16:18 |
| TheJulia | Yes, wife is having surgery today | 16:19 |
| dtantsur | cardoe: definitely today and possible for the rest of the week | 16:19 |
| dtantsur | ah, you're online enough :) | 16:19 |
| opendevreview | Merged openstack/ironic stable/2026.1: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986235 | 16:19 |
| TheJulia | But, I’m also sitting in the waiting room | 16:19 |
| cardoe | oh that was today. I forgot. | 16:19 |
| * TheJulia reads | 16:19 | |
| cardoe | TheJulia: good luck | 16:19 |
| TheJulia | cardoe: thanks | 16:19 |
| TheJulia | So… There *IS* a spec which lays out ironic’s approach | 16:20 |
| cardoe | I'm also doing crazy things and looking at using OPA so I can compile and validate my policies. | 16:20 |
| TheJulia | Part of the challenge is we were able to make amazing progress on the original Secure RBAC approach, and then the TC decided to embrace the original bug that started secure rbac work | 16:20 |
| TheJulia | Which is wrong, but hey, I wasn’t on the TC at that point | 16:20 |
| cardoe | yeah so help me understand so I can drag the TC to the right place. | 16:21 |
| TheJulia | Basically the bug was that admin is admin everywhere and can potentially in some projects cross the project scope | 16:21 |
| TheJulia | And, we did system scope which is “interacting with the actual system itself as if your the owner of the system | 16:21 |
| TheJulia | Or the manager/operator of the cloud. So we got it out the door early on, and kind of went “well, we don’t want to blindly just give admins to all our endpoints, so we kept system scope on a lot of them which were more information or background | 16:22 |
| TheJulia | Like.. no, any admin shouldn’t be able to get service hostnames | 16:22 |
| TheJulia | That is by definition through the exposure of internal hostnames, information leakage. | 16:23 |
| cardoe | Yeah. I'm embracing that. | 16:23 |
| TheJulia | It’s info only useful for the operator of the infra or maybe their most trusted users who transcend the boundary | 16:23 |
| cardoe | I'm starting to write this "personas" doc. | 16:23 |
| TheJulia | Anyhow, we shipped system scope, and some operators who are properly scoped loved it and gave super positive feedback so we kept it. | 16:24 |
| TheJulia | ++ | 16:24 |
| cardoe | And so that model maps better to the system scope. | 16:24 |
| cardoe | I'd also like to add an "audit" role. | 16:24 |
| * TheJulia goes to the cafe on the other side of the hospital lobby where she suspects they put happy meds into the mochas | 16:25 | |
| TheJulia | cardoe: What would audit do? | 16:25 |
| TheJulia | Please assume that with a twist like Lucy Darling, since I’ve been viewing her videos this morning. | 16:25 |
| cardoe | Read the metadata on objects but not necessarily the objects themselves. | 16:25 |
| TheJulia | How does reader not fulfill that need? | 16:25 |
| cardoe | I cannot think of any in ironic that would work with audit. | 16:25 |
| opendevreview | Verification of a change to openstack/ironic stable/2025.2 failed: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986361 | 16:25 |
| cardoe | But I can in nova and barbican. | 16:25 |
| JayF | dtantsur: https://review.opendev.org/c/openstack/ossa/+/986424 please review | 16:26 |
| TheJulia | Or better yet, how would it fit into ironic’s world and user flows? | 16:26 |
| TheJulia | cardoe: fair enough | 16:26 |
| JayF | ironic cores, really, please review https://review.opendev.org/c/openstack/ossa/+/986424 | 16:26 |
| TheJulia | cardoe: maybe… node_history ? | 16:30 |
| cardoe | maybe | 16:30 |
| cardoe | We've got service accounts that globally want to check the connectedness between objects. | 16:30 |
| cardoe | Or to see when some resource was deleted or created. | 16:31 |
| cardoe | Just thinking about the principles of least access.. they don't need to actually read data about the objects but just confirm metadata about them. | 16:31 |
| TheJulia | cardoe: node list would be necessary, our pattern is largely just to redact if you don’t have access but our model is much more “if you got permissions to read, we give you a lot” | 16:31 |
| TheJulia | Which makes it no different from reader, although maybe the “all node history” idea/patches | 16:32 |
| TheJulia | Which I’m super good with idea wise | 16:32 |
| * TheJulia sips the mocha as the atoms align | 16:33 | |
| cardoe | This is just an early white board idea. | 16:33 |
| TheJulia | cardoe: need any additional context? | 16:33 |
| cardoe | So far I'm just sitting down and thinking "I am needing to do this... what would be job duties entail"... now the same person might have multiple roles. | 16:34 |
| cardoe | I'm just thinking in terms of Gherkin | 16:35 |
| cardoe | The behavior driven development domain specific language. | 16:35 |
| TheJulia | I tend to think of audit more being suitable for processes, like system scope “audit” would be amazing for delineation of access rights for a global node history endpoint | 16:35 |
| cardoe | Yeah | 16:35 |
| TheJulia | It wouldn’t need much else on our api surface in such a case. | 16:35 |
| TheJulia | Cool, cool. Going to return to my cloaking field in that case. | 16:38 |
| JayF | JFYI, OSSA-2026-008 will be landing and announced in the next hour or two. This is for the IPMI Console injection stuff. CVE is pending but we don't have to wait on that to announce. | 16:53 |
| JayF | So much easier to do this stuff with the embargo off :) | 16:53 |
| opendevreview | Merged openstack/ironic stable/2025.1: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986362 | 17:05 |
| opendevreview | Merged openstack/ironic stable/2024.2: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986363 | 17:06 |
| opendevreview | Takashi Kajinami proposed openstack/ironic master: Remove deprecated http_basic_* options https://review.opendev.org/c/openstack/ironic/+/986429 | 17:06 |
| opendevreview | cid proposed openstack/ironic master: Bump release mapping to 35.1.0 https://review.opendev.org/c/openstack/ironic/+/986435 | 17:55 |
| cid | JayF, release cutting attempt, I have these two changes up now ^^ && https://review.opendev.org/c/openstack/releases/+/986434 | 17:57 |
| cid | How detailed should the commit messages be? | 17:57 |
| JayF | Look at previous messages in that dir :) that's what I'd do | 17:58 |
| opendevreview | cid proposed openstack/ironic master: Bump release mapping to 35.1.0 https://review.opendev.org/c/openstack/ironic/+/986435 | 18:14 |
| opendevreview | Merged openstack/ironic stable/2025.2: Shell-quote console command passed to `socat` https://review.opendev.org/c/openstack/ironic/+/986361 | 19:47 |
| guilhermesp___ | Hey all! — anyone running Debian (bookworm/trixie) cloud images on software-RAID1 + UEFI via Ironic (we're on IPA master since LP#2090993 fixed the "no space left on ESP" issue for us)? Hitting initramfs-without-mdadm and grubx64.efi-without-mdraid1x; works on Ubuntu after custom DIB hooksi took from https://github.com/osism/openstack-ironic-images but wondering if there's a supported path. Also: on delete, | 20:02 |
| guilhermesp___ | NVRAM entries added ahead of NIC so the node never PXEs back for cleaning without a manual F11 — anyone solved that cleanly? btw its a supermicro box | 20:02 |
| JayF | guilhermesp___: for the second one, baremetal node set <node> --driver-info force_persistent_boot_device=Always | 20:08 |
| JayF | guilhermesp___: for the first one, I thought we had a patch around that. How old is the ironic you're running? | 20:08 |
| JayF | oh, you were saying you had a fixed version | 20:11 |
| JayF | I misread the first time through | 20:11 |
| JayF | > Hitting initramfs-without-mdadm and grubx64.efi-without-mdraid1x | 20:11 |
| JayF | I have no idea what this means | 20:11 |
| JayF | and I'm unfamiliar with osism | 20:11 |
| guilhermesp___ | hey JayF ! thank you for the prompt reply! Yeah i tried the Always option but no luck =( | 20:12 |
| guilhermesp___ | https://www.irccloud.com/pastebin/2i6pDkeB/ | 20:12 |
| guilhermesp___ | im running 2025.1 but ipa is running master | 20:12 |
| guilhermesp___ | to get LP#2090993... then when i deployed, i got grub rescue right away | 20:12 |
| JayF | Aight, I think this is buggable then. I don't have any quick/easy answers for you :( | 20:13 |
| JayF | Someone else might, but I don't. | 20:13 |
| JayF | guilhermesp___: look at clean_uefi_nvram step, perhaps if added to cleaning at the right spot might help? | 20:15 |
| guilhermesp___ | huuum but i guess its kinda chicken-egg problem since its a clean step and it should pxe boot at first place to be able to run? | 20:16 |
| JayF | oh, because this is *on delete* | 20:16 |
| JayF | ugh | 20:16 |
| JayF | this sounds like a borderline hardware bug? | 20:16 |
| guilhermesp___ | thats something im suspecting of yeah... i already deployed nodes with ironic + supermicro but none of them were using software raids, thats the diff here | 20:17 |
| guilhermesp___ | btw, for a ubuntu image, i had to get something like this to make it fully boot ( with a grub menu and all ) https://paste.openstack.org/raw/betYbySCfV3kG8IOHAXI/ | 20:17 |
| guilhermesp___ | but it sounded like toooo much to customize to make it workable lol | 20:18 |
| JayF | kubajj and hjensas are often our experts on raid stuff | 20:18 |
| JayF | they might have some insight I'm missing | 20:18 |
| JayF | guilhermesp___: getting software raid working on Ironic is not trivial, and image work is a large part of it | 20:18 |
| guilhermesp___ | yeah yeah agreed, i have a bit of success with alma linux in the past but i still had to do some of this osism recipes baked | 20:20 |
| JayF | I'd file and bug and see if Kuba or Harold have any more info. | 20:20 |
| guilhermesp___ | yeah good call | 20:21 |
| kubajj | guilhermesp___: at CERN we use RHEL and Alma Linux with RAID1. Both IPA and Ironic are 2025.1. I think we do not have any issues. Can have a look at some of the issues you listed tomorrow | 20:34 |
| guilhermesp___ | yeah right! i had no issues with rhel and alma based not long ago! im trying to write a up a bug into LB ironic here with as much details as possible on the debian family | 20:37 |
| guilhermesp___ | https://bugs.launchpad.net/ironic/+bug/2150502 ok thats more or less what i tried so far and as we iterate over it, i might add the custom dib elements if that matters | 20:48 |
| opendevreview | Jay Faulkner proposed openstack/ironic-specs master: Add 2026.2 Work Items document https://review.opendev.org/c/openstack/ironic-specs/+/986018 | 20:59 |
| JayF | Ironic cores **please** review this! Nobody has looked at this yet today, only me/jand ers/c.i.d. have comments on it at all. I'm flying out of town on Wednesday and really want this landed by then. | 21:00 |
| opendevreview | Merged openstack/networking-baremetal master: Remove binding:host_id setting for L2VNI subports https://review.opendev.org/c/openstack/networking-baremetal/+/985206 | 21:36 |
| opendevreview | Merged openstack/ironic master: Revert "Soft power off before ejecting virtual media regardless of CONF.inspector.power_off" https://review.opendev.org/c/openstack/ironic/+/985362 | 21:36 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!