| opendevreview | Steve Baker proposed openstack/ironic master: Fix dbsync upgrade crash with missing tables from newer releases https://review.opendev.org/c/openstack/ironic/+/1000281 | 04:22 |
|---|---|---|
| opendevreview | Riccardo Pittau proposed openstack/ironic master: DNM: Test autodetect cleaning fix with BMO enrollment test https://review.opendev.org/c/openstack/ironic/+/1000176 | 07:27 |
| Mahnoor | Hello ironic o/ | 07:50 |
| opendevreview | Riccardo Pittau proposed openstack/ironic master: DNM: Test autodetect cleaning fix with BMO enrollment test https://review.opendev.org/c/openstack/ironic/+/1000176 | 07:51 |
| Mahnoor | I wont be able to attend the meeting today, but Ive left the bug deputy updates in the agenda | 07:51 |
| Mahnoor | There was just one new RFE | 07:51 |
| rpittau | thanks Mahnoor :) | 07:54 |
| jed-preist | JayF: Do you want to fully take over fixing autodetect cleaning? I'm happy to take a look as well, but it looks like you have a plan | 09:16 |
| dtantsur | JayF: re "I spun up a temporary Ironic to provision 200 nodes" != "I have a persistent Ironic running that we enroll/unenroll nodes from to provision them" | 09:23 |
| dtantsur | JayF: the latter basically pays our team sallaries nowadays. it looks roughly like this: you have a management (OpenShift) cluster, which you use for installing all sorts of things, but primarily other OpenShift clusters at remote locations | 09:23 |
| dtantsur | JayF: not having Ironic touch the installed clusters is not even a question of scaling (although it helps us to reach that 3500 nodes number I've been talking about). It's in a sense a security boundary. People don't want ANYTHING external touching a provisioned cluster. | 09:24 |
| dtantsur | JayF: it's not unlike how you personally don't want anything in Ironic to touch the running instance. It's just expanded to the BMC in my case. | 09:25 |
| opendevreview | Dmitry Tantsur proposed openstack/ironic master: Refresh the scaling guide in the reference architecture https://review.opendev.org/c/openstack/ironic/+/997998 | 09:58 |
| dtantsur | JayF: I've removed the contentious statement from ^^ PTAL | 09:59 |
| opendevreview | Merged openstack/sushy-tools master: Remove Python 3.10 support https://review.opendev.org/c/openstack/sushy-tools/+/998185 | 11:26 |
| opendevreview | Merged openstack/ironic master: Add vendor/model/serial_number to firmware component endpoint https://review.opendev.org/c/openstack/ironic/+/992034 | 11:44 |
| dtantsur | Rebase party begins | 11:44 |
| TheJulia | good morning | 12:59 |
| TheJulia | I'd appreciate a quick review on https://review.opendev.org/c/openstack/ironic/+/999897 this morning, thanks in advance | 13:14 |
| cardoe | TheJulia: so I have a question | 13:21 |
| cardoe | I'll put it on there for the sake of keeping comments together | 13:21 |
| * TheJulia blinks | 13:22 | |
| cardoe | So what's not clear to me from an operator standpoint is that if I'm using keystone does this mean I don't need a split-horizon deployment to have a secure Ironic API? Will the custom policy protect these endpoints and then still allow IPA to work. | 13:23 |
| cardoe | I think JayF mentioned last week we have chats in IRC and don't record the convos about patches on the patch so the convo gets lost to time. So I've made a mental note to try and not have that happen. | 13:24 |
| cardoe | That's what my question is, I'm posting it as a review comment. | 13:24 |
| TheJulia | so the custom policy can only be used to explicitly disable the endpoint on the configured API instance. | 13:26 |
| TheJulia | That is what is documented in our security docs, fwiw. | 13:27 |
| cardoe | Yeah I know that after reading policy stuff. I'm just putting my naive operator hat on. | 13:27 |
| TheJulia | fair, totally fair | 13:27 |
| TheJulia | I've got an OSSN I'm working on as well | 13:27 |
| cardoe | I'm saying the wording makes it sound like "oh I use keystone so I don't need to do any of this" | 13:27 |
| TheJulia | Ahh, if you could highlight on the patch, that would be appreciated, the OSSN should.. ideally. make it very clear. | 13:28 |
| cardoe | I spent some time over the weekend thinking about policy stuff in OpenStack. | 13:30 |
| TheJulia | I was thinking over the weekend life would be so much easier if it was extended a little bit and allow source IP based filtering,but the risk always is header injection because you have to explicitly add the same header if your doing reverse proxying | 13:33 |
| iurygregory | good morning ironic | 13:40 |
| TheJulia | good morning | 13:41 |
| iurygregory | I'm adding a funny bug to open discussion :D | 13:43 |
| TheJulia | will it make us laugh, or make us cry? | 13:43 |
| iurygregory | laugh | 13:43 |
| iurygregory | I don't think it will be complicated to fix, but it was funny the debug to understand what was happening... | 13:43 |
| TheJulia | Laugh is good | 13:44 |
| iurygregory | https://bugs.launchpad.net/ironic/+bug/2163154 | 13:46 |
| * TheJulia groans | 13:47 | |
| TheJulia | you said I'd laugh! ;) | 13:47 |
| iurygregory | I was laughing a lot when checking the logs | 13:47 |
| iurygregory | because the fix seems easy =) | 13:47 |
| TheJulia | until you hit machines which explode! | 13:47 |
| iurygregory | well, there is another one that janders was looking, it's in a different model, this one would make me cry instead of laughing | 13:49 |
| iurygregory | For this one the easy fix is just add the manufacturer to the list https://github.com/openstack/ironic/blob/54977a14d57c8c56e9b25a65e4c8ccd2b9fabb7a/ironic/drivers/modules/redfish/management.py#L94 =D | 13:50 |
| TheJulia | It separately has indicators of being a re-branded AMI | 13:50 |
| TheJulia | so that makes sense | 13:51 |
| iurygregory | yeah | 13:51 |
| opendevreview | Julia Kreger proposed openstack/ironic master: Add [api] enable_ramdisk_endpoints config option https://review.opendev.org/c/openstack/ironic/+/999897 | 13:52 |
| TheJulia | cardoe: revised ^ | 13:57 |
| cardoe | Looks good. +2 | 14:13 |
| cardoe | sorry. Someone called me about a rabbitmq issue. | 14:13 |
| TheJulia | cool cool, thanks! | 14:17 |
| opendevreview | Merged openstack/ironic master: Verify registry TLS by default for agent containers https://review.opendev.org/c/openstack/ironic/+/999724 | 14:28 |
| cardoe | So I see https://review.opendev.org/c/openstack/ironic/+/997789 which is about rabbit queues. But having an issue with ironic-neutron-agent-member-manager not deleting as well and filling up. It's suffixed with a UUID as well. Wondering if they're related. | 14:36 |
| opendevreview | Jay Jahns proposed openstack/ironic master: Redfish: retry transient 409 conflict on power-on https://review.opendev.org/c/openstack/ironic/+/1000060 | 14:40 |
| JayF | dtantsur: I had no idea openshift was an installer vs a persistent presence. Honestly it makes me a little sad as my favorite part about Ironic is that we generally (well, I thought) baked in the idea that servers can't just be deployed and forgotten. | 14:41 |
| iurygregory | TheJulia, i will remove the bug from the meeting, seems like the fix for vendor isn't in the downstream version the person was using for testing, I assumed it was latest, but was 4.21 <facepalm> | 14:54 |
| TheJulia | JayF: I've learned long ago that there are simply people who only focus on installation. It is just their use case/pattern and it is what it is. | 14:58 |
| JayF | TheJulia: until approximately today, I didn't realize that anyone in our community catered to those people though :( | 14:58 |
| TheJulia | There is always catering to needs. In that case, they just focus on installation in a particular phase and then no longer care | 15:00 |
| * TheJulia looks at the clock | 15:01 | |
| TheJulia | #startmeeting ironic | 15:02 |
| opendevmeet | Meeting started Mon Aug 10 15:02:01 2026 UTC and is due to finish in 60 minutes. The chair is TheJulia. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:02 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:02 |
| opendevmeet | The meeting name has been set to 'ironic' | 15:02 |
| iurygregory | o/ | 15:02 |
| TheJulia | #chair JayF | 15:02 |
| opendevmeet | Current chairs: JayF TheJulia | 15:02 |
| JayF | Am I the chosen one? | 15:02 |
| iurygregory | yes sir! | 15:02 |
| TheJulia | Your the one who volunteered! | 15:02 |
| JayF | I provisioned the meeting then disconnected the memory /s | 15:02 |
| iurygregory | OOM =( | 15:02 |
| JayF | one second while I get things in place :D | 15:02 |
| TheJulia | heh | 15:03 |
| rpittau | o/ | 15:03 |
| JayF | #topic Announcements/Reminders | 15:03 |
| cid | o/ | 15:03 |
| JayF | Welcome to the Ironic weekly meeting, as usual we operate under the OpenInfra CoC and the agenda is here: https://wiki.openstack.org/wiki/Meetings/Ironic | 15:03 |
| JayF | #note Standing reminder to review patches tagged ironic-week-prio and to hashtag any patches ready for review with ironic-week-prio: https://tinyurl.com/ironic-weekly-prio-dash | 15:03 |
| jed-preist | o/ | 15:03 |
| TheJulia | o/ | 15:03 |
| dtantsur | o/ | 15:03 |
| JayF | I feel like ironic-week-prio dash has been at 32 patches everytime I look | 15:03 |
| JayF | even if I land "N" patches, exactly "N" replace it | 15:04 |
| clif | o/ | 15:04 |
| TheJulia | It is a magical list of such! | 15:04 |
| JayF | #topic Working Group Updates: Async IO | 15:04 |
| JayF | #link https://etherpad.opendev.org/p/ironic-asyncio | 15:04 |
| JayF | Any update for Async IO workgroup? | 15:04 |
| dtantsur | Our team is buried in downstream tasks.. | 15:05 |
| iurygregory | yeah | 15:05 |
| iurygregory | and I will be out till 24 | 15:05 |
| iurygregory | starting this Wed | 15:05 |
| rpittau | buried is the right word, very deep | 15:05 |
| JayF | #note No update from Async IO team; contributors are busy | 15:05 |
| JayF | #topic Working Group Updates: Security Coresec | 15:05 |
| JayF | There are a few updates for here, we have advisories that went out last week and some currently under review | 15:06 |
| JayF | #link https://security.openstack.org/ossa/OSSA-2026-033.html | 15:06 |
| JayF | Fixed an issue where PortGroup queries were not always properly filtering by project scope | 15:06 |
| JayF | #link https://wiki.openstack.org/wiki/OSSN/OSSN-0104 | 15:07 |
| JayF | Notifies operators of our mDNS fallback functionality | 15:07 |
| JayF | #link https://review.opendev.org/c/openstack/security-doc/+/1000120 | 15:08 |
| JayF | Is a draft for an OSSN around Ironic ramdisk requiring network-level access controls. | 15:08 |
| JayF | Please review that if you have opinions around how we notify operators to secure lookup, heartbeat, and continue inspection. | 15:08 |
| TheJulia | Would it make sense to highlight any of the items being worked in the open? | 15:08 |
| JayF | Furthermore, there are multiple outstanding public security bugs in Ironic: | 15:09 |
| JayF | https://bugs.launchpad.net/ironic/+bugs?field.searchtext=&orderby=-importance&search=Search&field.status%3Alist=NEW&field.status%3Alist=CONFIRMED&field.status%3Alist=TRIAGED&field.status%3Alist=INPROGRESS&field.status%3Alist=DEFERRED&field.status%3Alist=FIXCOMMITTED&field.status%3Alist=INCOMPLETE_WITH_RESPONSE&field.status%3Alist=INCOMPLETE_WITHOUT_RESPONSE&field.information_type%3Alist=PUBLICSECURITY&assignee_option=any&field.assignee= | 15:09 |
| JayF | &field.bug_reporter=&field.bug_commenter=&field.subscriber=&field.structural_subscriber=&field.tag=&field.tags_combinator=ANY&field.has_cve.used=&field.omit_dupes.used=&field.omit_dupes=on&field.affects_me.used=&field.has_patch.used=&field.has_branches.used=&field.has_branches=on&field.has_no_branches.used=&field.has_no_branches=on&field.has_blueprints.used=&field.has_blueprints=on&field.has_no_blueprints.used=&field.has_no_blueprints=o | 15:09 |
| JayF | n | 15:09 |
| JayF | I hit "enter" instead of "delete" when I highlighted the too-long-link | 15:09 |
| JayF | one second, shortening | 15:09 |
| JayF | #link https://tinyurl.com/ironic-public-security-bugs | 15:10 |
| JayF | Including a spicy one we should have advisoried this week, found by jed-preist, around initial cleaning or other step-based-flows being noop until a deployment is attempted. | 15:10 |
| JayF | Please prioritize review of security-related patches. | 15:11 |
| JayF | TheJulia: is that what you wanted? If there's something further you want highlighted please do so :) | 15:11 |
| TheJulia | I think that works | 15:11 |
| JayF | I think that is more than enough security update them | 15:12 |
| JayF | *then | 15:12 |
| JayF | I'll give a moment for folks to read and ask questions if they have any, will move on before :15 | 15:12 |
| TheJulia | I got nothing else right now | 15:13 |
| JayF | OK, moving on. | 15:13 |
| JayF | There are no agenda'd discussion topics for today; skipping | 15:13 |
| JayF | #topic Bug Deputy Updates | 15:13 |
| JayF | Mahnoor? | 15:14 |
| rpittau | JayF: Mahnoor is out, she left a message in the channel this morning | 15:14 |
| JayF | ack; only untriaged bug is an RFE which we'll tackle next section | 15:14 |
| JayF | who wants to volunteer to be the next bug deputy? | 15:14 |
| cid | I will | 15:15 |
| iurygregory | tks cid | 15:15 |
| JayF | #note cid to be the next bug deputy | 15:15 |
| JayF | #topic RFE Review | 15:15 |
| JayF | The only RFE is one filed by me, which I already have a spec under review for | 15:16 |
| JayF | #link https://bugs.launchpad.net/ironic/+bug/2163067 | 15:16 |
| JayF | #link https://review.opendev.org/c/openstack/ironic-specs/+/999448 | 15:16 |
| JayF | I'll triage it as "needs-spec" since I'm writing a spec for it. Reviews appreciated; it got revised EOD on Friday. | 15:16 |
| JayF | #topic Open Discussions | 15:17 |
| JayF | Any further commentary on anything in the meeting, or new topics for discussion? | 15:18 |
| rpittau | just a reminder that next week is the final sushy release | 15:18 |
| rpittau | and the week after we have the clients release | 15:18 |
| TheJulia | So, I'd love to review jam this week. One thing to highlight is that I'll be around the next two weeks. The week after I'll be preparing to travel and the week after that I'll be in Shanghai for the week with limited access. | 15:18 |
| TheJulia | Also, we should begin a PTG etherpad if we haven't already started one | 15:19 |
| TheJulia | I have a topic! | 15:19 |
| iurygregory | yeah, we are close to PTG | 15:20 |
| iurygregory | I can create the etherpad | 15:20 |
| JayF | we have one iirc | 15:21 |
| JayF | Nope, none for I | 15:21 |
| iurygregory | https://etherpad.opendev.org/p/ironic-ptg-2027.1 | 15:21 |
| JayF | we did make the hibiscus one well in advance :) | 15:21 |
| iurygregory | now we have :D | 15:22 |
| JayF | TheJulia: IDK how your schedule looks, but everyone is always welcome to the GR-OSS review jam (it sometimes gets cancelled if one of the three GR-OSS ironic devs are out, so lmk if you plan to attend) | 15:22 |
| JayF | Tuesdays 10am PDT | 15:23 |
| JayF | I can add anyone to the invite who wants | 15:23 |
| JayF | (10am PDT is ... 1700 UTC) | 15:23 |
| TheJulia | My tuesday is looking pretty slammed, but I'll try to make it | 15:23 |
| JayF | I can maybe participate in some other one, but that's already carved out | 15:23 |
| JayF | #note Final Sushy + Clients release deadlines are coming up soon. | 15:25 |
| JayF | #note If anyone wants an invite to the recurring 1700 UTC GR-OSS Ironic review jam, DM JayF | 15:25 |
| JayF | Final item: Who is gonna do this part for next week's meeting? | 15:25 |
| JayF | For bonus points, actually remember that you volunteered | 15:25 |
| iurygregory | I can't I will be out =( | 15:26 |
| iurygregory | otherwise I would .-. | 15:26 |
| TheJulia | I can run next week's meeting | 15:28 |
| JayF | #note TheJulia to run next meeting | 15:28 |
| JayF | thanks all for attending o/ | 15:28 |
| JayF | #endmeeting | 15:28 |
| opendevmeet | Meeting ended Mon Aug 10 15:28:48 2026 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:28 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-08-10-15.02.html | 15:28 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-08-10-15.02.txt | 15:28 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/ironic/2026/ironic.2026-08-10-15.02.log.html | 15:28 |
| cardoe | So the issue seems to be quorum queues. We set queues to auto-delete but that doesn't work for quorum queues. | 15:43 |
| TheJulia | no, your not supposed to use quorum queues unless you know exactly what your doing and that stuff will never roll off | 15:43 |
| TheJulia | JayF: oh, the other thing that I should have mentioned, there is also a whole class of people who focus on what is my immediate gratification being the key aspect. "time to install" overriding every other quantifiable metric beyond that as well :( | 15:44 |
| JayF | TheJulia: I remember arguing with that use case over how unfit iscsi driver was for every other use case ;) | 15:44 |
| TheJulia | I had a customer call on friday where somebody was trying to trip me up from the customer side over "time to getting a running thing", and I pointed out that basically its all case modeling and how long, combined with the actual math over performance trade-offs. How they needed to make an informed decision based upon use case, their VP on the call was just nodding emphatically as I was talking. It was awfully amusing, but more to | 15:47 |
| TheJulia | the point I'm trying to get across, it it a challenge which is across the specturm of tech. | 15:47 |
| JayF | If you can't decide how many servers you need in time (in normal times, at least) to order them, provision them, and online them before you need them | 15:48 |
| JayF | you have serious underlying concerns on your business | 15:48 |
| JayF | and/or need to look at off-prem cloud options -- that's the value their premium provides (at least, supposedly -- in practice rapid scaling in some clouds/regions is impossible in hosted, too -- even with big names) | 15:49 |
| TheJulia | That is one way to look at it | 15:49 |
| TheJulia | Yeah, its a mismatch of use cases, but there is a time and place for each. | 15:49 |
| JayF | again folks like to forget that "move fast" comes free with a "break things" | 15:50 |
| JayF | in context of AI, server provisioning, and business planning in general | 15:50 |
| JayF | sometimes it's worth it but there haven't been many of those "go faster" meetings I've been in that the root cause wasn't bad planning or unreasonable expectations | 15:50 |
| TheJulia | That is tangential to what I was trying to get across, disconnects are always abound | 15:51 |
| opendevreview | Merged openstack/ironic-python-agent master: bindep: Remove stale marker https://review.opendev.org/c/openstack/ironic-python-agent/+/999533 | 16:20 |
| cardoe | TheJulia: the odd thing is we don't have quorum set for transient queues but for some reason this queue is quorum. | 16:46 |
| cardoe | So it feels like some option didn't get respected. This is just with baremetal-networking | 16:47 |
| TheJulia | Hmmm | 17:04 |
| TheJulia | So, I think there was a bug at one point where it might have been established as one but that doesn't chagne things | 17:04 |
| opendevreview | Verification of a change to openstack/ironic master failed: fix runbook create notifications https://review.opendev.org/c/openstack/ironic/+/1000050 | 17:07 |
| opendevreview | Verification of a change to openstack/ironic master failed: fix runbook create notifications https://review.opendev.org/c/openstack/ironic/+/1000050 | 17:43 |
| opendevreview | Merged openstack/ironic master: Add [api] enable_ramdisk_endpoints config option https://review.opendev.org/c/openstack/ironic/+/999897 | 17:50 |
| TheJulia | sweet | 17:55 |
| JayF | this means if any other ironic cores wanna review that OSSN | 18:02 |
| JayF | you have today | 18:02 |
| JayF | I will announce it tomorrow | 18:02 |
| TheJulia | ack ack | 18:03 |
| TheJulia | cardoe: looks like you have to changes which conflict, 999910 and 10000007 | 18:05 |
| cardoe | Sounds like something I would do | 18:05 |
| TheJulia | Any preference on "first" :) | 18:05 |
| cardoe | The smaller number I guess | 18:05 |
| cardoe | yeah the smaller number is the bug fix. | 18:06 |
| cardoe | I wanted to include a release that I'd remove it if we agreed to deprecate that behavior | 18:08 |
| cardoe | 2028.1 cause of the SLURP? | 18:08 |
| opendevreview | Merged openstack/python-ironicclient master: Add --disable-ramdisk to runbook create https://review.opendev.org/c/openstack/python-ironicclient/+/1000110 | 18:10 |
| TheJulia | Well, I think it woudl be removed in 2027.2 | 18:11 |
| cardoe | That works for me. | 18:11 |
| cardoe | I actually made the commit originally to remove it and clean it up and it's crazy how much more straight forward the code is. | 18:11 |
| opendevreview | Merged openstack/python-ironicclient master: Remove broken --traits option from runbook create https://review.opendev.org/c/openstack/python-ironicclient/+/1000111 | 18:20 |
| TheJulia | Regarding: https://review.opendev.org/c/openstack/ironic/+/1000059, I'm curious, why now? seems like we failed to identify the need earlier? but why would we have locked it out? | 18:28 |
| opendevreview | Merged openstack/python-ironicclient master: Remove broken --step option from runbook unset https://review.opendev.org/c/openstack/python-ironicclient/+/1000112 | 18:31 |
| TheJulia | iurygregory: did you ever get clarity w/r/t https://review.opendev.org/c/openstack/ironic/+/986597 | 18:35 |
| opendevreview | Merged openstack/ironic master: Interpolate values for comparison operators in inspection rules https://review.opendev.org/c/openstack/ironic/+/999910 | 19:24 |
| opendevreview | Doug Goldstein proposed openstack/ironic stable/2026.1: Interpolate values for comparison operators in inspection rules https://review.opendev.org/c/openstack/ironic/+/1000369 | 19:31 |
| opendevreview | Doug Goldstein proposed openstack/ironic bugfix/38.0: Interpolate values for comparison operators in inspection rules https://review.opendev.org/c/openstack/ironic/+/1000370 | 19:31 |
| opendevreview | Doug Goldstein proposed openstack/ironic bugfix/37.0: Interpolate values for comparison operators in inspection rules https://review.opendev.org/c/openstack/ironic/+/1000371 | 19:32 |
| cardoe | Even though the bug goes back a bit farther, I'm gonna stop there cause really rules needed some more love to really work right. | 19:34 |
| opendevreview | Merged openstack/ironic master: Add a tool to parse kernel command lines https://review.opendev.org/c/openstack/ironic/+/992641 | 19:44 |
| opendevreview | Merged openstack/ironic stable/2026.1: Another attempt to fix fast-track after inspection https://review.opendev.org/c/openstack/ironic/+/999255 | 19:47 |
| opendevreview | Verification of a change to openstack/ironic master failed: fix runbook create notifications https://review.opendev.org/c/openstack/ironic/+/1000050 | 19:55 |
| opendevreview | Verification of a change to openstack/ironic master failed: fix runbook create notifications https://review.opendev.org/c/openstack/ironic/+/1000050 | 20:34 |
| opendevreview | Merged openstack/ironic master: Add a deprecation notice for disable_kernel_parameter_parsing https://review.opendev.org/c/openstack/ironic/+/995750 | 20:48 |
| opendevreview | Merged openstack/ironic master: fix runbook create notifications https://review.opendev.org/c/openstack/ironic/+/1000050 | 23:06 |
| opendevreview | Merged openstack/ironic master: api: Add schema for deploy templates API https://review.opendev.org/c/openstack/ironic/+/999509 | 23:46 |
| TheJulia | JFYI, I submitted a project update session to OpenInfra days NA | 23:55 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!