Thursday, 2024-08-08

opendevreviewRoman Krček proposed openstack/kolla-ansible master: Put memcache_security_strategy in single place at all.yml  https://review.opendev.org/c/openstack/kolla-ansible/+/92544407:02
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: Revert "CI: Pin openstackclient to <7"  https://review.opendev.org/c/openstack/kolla-ansible/+/92594107:42
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: Revert "CI: Pin openstackclient to <7"  https://review.opendev.org/c/openstack/kolla-ansible/+/92594107:42
mnasiadkamorning07:44
SvenKieskemorning08:11
SvenKiesken00b question: can I recheck a failed gating pipeline as a mortal +1 user, or are core reviewer powers needed for this? example: https://review.opendev.org/c/openstack/kolla-ansible/+/92573708:12
SvenKieskeI also don't see what exactly failed there, seems test-core-openstack.sh didn't really run, at least there is no log08:14
SvenKieskethat is, there is a log, but not really helpful. it's aborted after calling tools/init-runonce and the gawk stuff08:15
mnasiadkaSvenKieske: 2024-08-07 14:10:35 clean_up SetQuota: internal endpoint for block-storage service in RegionOne region not found08:18
mnasiadkain init-runonce08:18
mnasiadkawe pinned to older openstackclient, just do "recheck"08:18
SvenKieskeok, was not sure if I can trigger gate pipeline this way. thx08:19
SvenKieskeand good idea to use u-c btw :) still wish we could control this more centrally and could avoid to put it into so many different places.08:21
fricklerwe didn't do the pin on 2024.1 yet, did we? so the above recheck will still fail the same way08:29
fricklerany gerrit user can trigger the recheck fwiw08:29
mnasiadkayeah, once the u-c fix merges in master - we need to backport that to stable branches08:33
arcaynehey guys, really sorry to butt in with such a dumb issue... I've just been struggling to figure out the kayobe network-interfaces configs since yesterday, and I'm a bit frazzled at this point.. anyone have a couple mins to help set me straight? :/08:35
jovialarcayne, Here is an example of dual bonds: https://gist.github.com/jovial/939f6436884fcc512e63c2ef407ec47a08:38
arcayneOh you're awesome, tysm. I'll give this a shot right away.08:39
opendevreviewPierre Riteau proposed openstack/kolla-ansible master: CI: Fix variable name for Nova noVNC FQDN  https://review.opendev.org/c/openstack/kolla-ansible/+/92585408:40
jovialYou can stick a bridge on top of the bond with something like: provision_oc_net_interface: brbond1 / provision_oc_net_bridge_ports: [{{ hs_bond_B_interface }}] or if you don't have an untagged network, you can another network to compute_network_interfaces e.g brbond1 and use brbond1_no_ip: true08:43
jovialImprovements to the docs are welcome :)08:44
arcayneahh this is super helpful. In my scenario, both bonds are carrying multiple tagged vlans (essentially trunks), nothing is untagged. For your example of brbond1_no_ip: true, where should that attribute live? networks.yml? 08:47
jovialYeah, that would work08:49
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: CI: Fix cases where port is not available yet  https://review.opendev.org/c/openstack/kolla-ansible/+/92450609:21
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: CI: Fix cases where port is not available yet  https://review.opendev.org/c/openstack/kolla-ansible/+/92450609:22
arcayneSo in a simplified nutshell, if I've got hs_bond_B_interface: "bond1", then stack a bridge ontop with brbond1_interface: "{{ hs_bond_B_interface }}", to tie that to one (or more) logical networks like 'internal', I'd add internal_interface: "{{ brbond1_interface }}.{{ internal_vlan }}"? Or did I bungle the bridge portion?09:27
jovialbrbond1_interface needs to start with br. This would also work: brbond1_interface: brbond109:29
arcayneSorry, I meant brbond1_interface: "brbond1" with brbond1_bridge_ports: "{{ hs_bond_B_interface }}"09:29
jovialaah, yeah. That all looks OK to me.09:29
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: Bump Ansible versions to 2.16 and 2.17  https://review.opendev.org/c/openstack/kolla-ansible/+/92174309:31
arcaynenice, thanks! also, in your example, is hs_bond_B defined anywhere other than the three files shown in the gist?09:33
opendevreviewMerged openstack/kolla-ansible master: CI: Use u-c in openstack-clients role  https://review.opendev.org/c/openstack/kolla-ansible/+/92590909:36
jovialarcayne, You'll need it on any hosts that reference the vlans you have trunked over that network e.g storage_extra_network_interfaces, controller_extra_network_interface and so on09:37
arcaynethat makes sense, thanks09:38
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible stable/2024.1: CI: Use u-c in openstack-clients role  https://review.opendev.org/c/openstack/kolla-ansible/+/92594709:39
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible stable/2023.2: CI: Use u-c in openstack-clients role  https://review.opendev.org/c/openstack/kolla-ansible/+/92594809:39
stanCan I get one more review on this one pls https://review.opendev.org/c/openstack/kolla-ansible/+/91843709:42
opendevreviewRoman Krček proposed openstack/kolla-ansible master: Fix: Don't notify handlers during copy-cert  https://review.opendev.org/c/openstack/kolla-ansible/+/92465109:44
opendevreviewRoman Krček proposed openstack/kolla-ansible master: Performance: Don't notify handlers during config  https://review.opendev.org/c/openstack/kolla-ansible/+/74516409:44
opendevreviewVerification of a change to openstack/kolla-ansible stable/2024.1 failed: fix flake8 error in database_shards.py  https://review.opendev.org/c/openstack/kolla-ansible/+/92573710:09
arcaynejovial, you're a lifesaver. I was able to re-run `kayobe overcloud host configure` and it looks like all the interfaces are finally being configured properly. I'll have to wait until tomorrow when my network guy is awake to fully test everything, but at least now I can stop banging my head against the wall and get some sleep :)10:11
opendevreviewMerged openstack/kolla-ansible master: Performance: use filters for service dicts  https://review.opendev.org/c/openstack/kolla-ansible/+/91499710:35
opendevreviewMerged openstack/kolla stable/2023.1: Build RabbitMQ 3.11, 3.12 and 3.13 in 2023.1  https://review.opendev.org/c/openstack/kolla/+/91897410:35
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758911:31
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758911:33
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758911:33
opendevreviewBartosz Bezak proposed openstack/kolla-ansible master: Restart OVS container after hw-offload change  https://review.opendev.org/c/openstack/kolla-ansible/+/92597011:35
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: Bump codespell pin to <3  https://review.opendev.org/c/openstack/kolla-ansible/+/92587411:37
opendevreviewBartosz Bezak proposed openstack/kolla-ansible master: Fix post-config of OVS for manila-share servers  https://review.opendev.org/c/openstack/kolla-ansible/+/82470711:40
opendevreviewPiotr Parczewski proposed openstack/kolla-ansible master: Fix internal TLS certificate not copied  https://review.opendev.org/c/openstack/kolla-ansible/+/92597111:41
opendevreviewSven Kieske proposed openstack/kolla-ansible stable/2024.1: fix flake8 error in database_shards.py  https://review.opendev.org/c/openstack/kolla-ansible/+/92573711:41
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758911:48
opendevreviewMerged openstack/kolla-ansible master: Revert "CI: Pin openstackclient to <7"  https://review.opendev.org/c/openstack/kolla-ansible/+/92594111:53
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758911:56
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758912:25
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758912:25
mnasiadkafrickler: I'm sort of tired of doing the kolla_python_version dance again to get Ubuntu introduced - are you ok with me reviving https://review.opendev.org/c/openstack/kolla/+/874989 ?12:30
mnasiadkaactually maybe there's a better option12:33
fricklermnasiadka: I was just about to ask where exactly this is needed12:33
mnasiadkahorizon only12:34
mnasiadkawe could just link openstack_dashboard/wsgi.py to somewhere12:34
kevkoGuys, I would like to implement consul as for us masalari with corosync is not enough ( limit 32 hosts) 12:36
kevkoWill it be accepted ? I am asking because of licence ...it's free of course ..but something similar than redis .... Simply said ..you can use it internally ...but can't sell it like a product 12:37
kevkomnasiadka: i am using similar approach in my patch for "image patching feature" ... i've also introduced there python linking to /var/lib/kolla/venv/python3 because i wanted to patch ubuntu,debian,rocky with same patch file ..but different distros has different python3.X version ... maybe we can introduce small patch to fullfill this in all images12:47
kevko...in base ...12:47
kevkomnasiadka: really the same ...but i am symlinking to python3 instead of python only .... one var more https://review.opendev.org/c/openstack/kolla/+/829295/7/docker/openstack-base/Dockerfile.j2 12:49
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: horizon: Copy wsgi.py to /etc/openstack-dashboard/  https://review.opendev.org/c/openstack/kolla/+/92597912:50
kevkomnasiadka: so from my perspective  the https://review.opendev.org/c/openstack/kolla/+/874989 is good idea to reopen ... 12:50
mnasiadkachecking another option, and we can discuss ;-)12:51
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: WIP: horizon: Use /etc/openstack-dashboard/wsgi.py  https://review.opendev.org/c/openstack/kolla-ansible/+/92598012:51
kevkomnasiadka: well, i am just saying that it's very good idea as it helps also on another place ... (in my patchset for patching feature :)  as I can reference only python3 path in header of pachfiles)12:54
kevkomnasiadka: and it's just symlink ..and only for venv 12:54
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: Switch to Ubuntu 24.04  https://review.opendev.org/c/openstack/kolla/+/90758913:19
opendevreviewMichal Nasiadka proposed openstack/kolla master: Switch to Ubuntu 24.04 LTS  https://review.opendev.org/c/openstack/kolla/+/90758913:21
opendevreviewMichal Nasiadka proposed openstack/kolla master: Switch to Ubuntu 24.04 LTS  https://review.opendev.org/c/openstack/kolla/+/90758913:21
SvenKieskekevko: there's a half dead open source fork of consul it seems, maybe there is a living version also somewhere? https://github.com/OpenHotPot/hotpot13:23
kevkoSvenKieske: half dead  :D ...13:25
SvenKieskelast commit 8 months ago, some openstack projects are "more" dead ;)13:25
SvenKieskeetcd doesn't work for coordination, I guess? I really don't know.13:26
SvenKieskeor zookeeper?13:26
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: WIP: Add support for Ubuntu Noble Numbat (24.04 LTS)  https://review.opendev.org/c/openstack/kolla-ansible/+/92558113:27
mnasiadkaI'd be hesitant to use Consul, given the license - and I think we wanted to look into using the free Redis fork13:28
SvenKieskeat least https://github.com/valkey-io/valkey seems healthy13:29
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: WIP: Add support for Ubuntu Noble Numbat (24.04 LTS)  https://review.opendev.org/c/openstack/kolla-ansible/+/92558113:30
kevkoBut why we can't provide a path to install and use consul ? 13:45
kevkoI am reading the license ...it's MPL 2.0   .... it's very clear that it can be used 13:45
kevkoYou may make production use of the Licensed Work, provided Your use does not include offering the Licensed Work to third parties on a hosted or embedded basis in order to compete with HashiCorp's paid version(s) of the Licensed Work. For purposes of this license:13:46
opendevreviewMerged openstack/kolla-ansible stable/2024.1: CI: Use u-c in openstack-clients role  https://review.opendev.org/c/openstack/kolla-ansible/+/92594713:49
fricklerisn't that more or less the same stuff that we dropped elasticsearch for doing?13:52
mnasiadkaYup14:01
SvenKieskekevko: where do you read consul is MPL2.0? It's BSL14:02
SvenKieskehttps://github.com/hashicorp/consul?tab=License-1-ov-file#readme14:02
SvenKieskefrickler: maybe the TC should make a clear statement regarding all these new licences cropping up. I'm just tired of reiterating the debate everytime again14:03
SvenKieskethat being said, I still think we violate the "don't be a dick" licence and should remove that code, where we just slapped ASL 2.0 over it xD14:04
SvenKieskehttps://github.com/openstack/kolla-ansible/blob/master/tests/j2lint.py#L1914:05
fricklerI think you'll have to dig out the link to that again for mnasiadka. iirc this was on shpc14:05
fricklerah, thx14:05
SvenKieskeI even made a bug report..somewhere14:06
SvenKieskehttps://bugs.launchpad.net/kolla-ansible/+bug/207531614:06
SvenKieskeI hate copyright as much as the next guy, but I guess we can't just ignore it, sadly :)14:07
SvenKieskeI even filed an upstream issue last week, but no response so far, maybe they can be friendly and just dual licence, but maybe they really don't want to.14:08
SvenKieskeI also quickly evaluated other j2lint like tools but it would take a little work at least to use those instead, e.g.https://github.com/aristanetworks/j2lint/14:08
SvenKieskeah broken link: https://github.com/aristanetworks/j2lint/14:09
opendevreviewMichal Arbet proposed openstack/kolla-ansible master: Use more descriptive libvirt secret names corresponding to reality  https://review.opendev.org/c/openstack/kolla-ansible/+/92454814:09
opendevreviewMichal Arbet proposed openstack/kolla-ansible master: Refactor external ceph  https://review.opendev.org/c/openstack/kolla-ansible/+/90716614:09
SvenKieskeI tested that one briefly, on the plus side it's well maintained and good to integrate into CI in general. on the negative side: it really tests different stuff afaik and we would need to disable some of it's rules. on the plus side: that's rather easy to do.14:10
SvenKieskethere seem to be a plethora of other jinja2 linters, all with different approaches. I didn't want to waste more time, so I stopped there.14:11
kevkoSvenKieske: it's not BSL ..its's MPL2.014:16
kevkoSvenKieske: https://github.com/hashicorp/consul/blob/779d3c3eda1d4aa0d639f53a0e1d4437179a7224/LICENSE#L44 << or is it 4 years after release ? 14:17
SvenKieskekevko: not sure if you want to run a 4 years old version of consul?14:19
SvenKieskekevko: https://www.cvedetails.com/vulnerability-list/vendor_id-16814/product_id-52612/Hashicorp-Consul.html?page=1&year=2023&month=-1&order=7 :)14:20
SvenKieskeI'm sure they are all no problem because consul "only runs on internal network" :)14:20
SvenKieskefor those that can see it, I stumbled across this bug report from 2022, and afaik that is fixed, at least the deployment I have at hand doesn't show the reported behaviour anymore: https://bugs.launchpad.net/kolla-ansible/+bug/198301314:26
SvenKieskemaybe someone can double check14:26
kevkoSvenKieske: what you are talking about ? 14:44
SvenKieskekevko: "consul is MPL" only is true for consul versions older than 4 years, meaning you are of course missing all security fixes from those 4 years.14:45
SvenKieskemaybe I misunderstood your point, but that's what I understood and wanted to point out.14:46
kevkoSvenKieske: okay, firstly - "The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work. The Licensor may make an Additional Use Grant, above, permitting limited production use." << This is BSL 1.1   .... agree ? 14:46
SvenKieskesure?14:47
SvenKieskenot the complete BSL, but a part of it14:47
kevkoSvenKieske: https://github.com/hashicorp/consul/blob/main/LICENSE <<  In their licence they are declaring "Additional Use Grant:" 14:47
SvenKieskeyes?14:47
kevkoSvenKieske: And there you have -  You may make production use of the Licensed Work14:48
SvenKieske"provided Your use does not include offering the Licensed Work to third parties"14:49
kevkoSvenKieske: of course you cannot offer let's say API or how to say of Consul as a Software ...okay ...agree   .... but you CAN use it as backend OF some another solution 14:50
SvenKieskeand this is the problem, not because we do this, but we distribute this and some people who download this from our servers may do this14:50
SvenKieskekevko: once again: https://governance.openstack.org/tc/reference/licensing.html Projects run as part of the OpenStack Infrastructure (in order to produce OpenStack software) may be licensed under any OSI-approved license.14:51
SvenKieskeOther licenses (not explicitly listed in this document) may be considered in the future on a case-by-case basis by the Technical Committee, with the help of the OpenStack Foundation legal counsel.14:51
SvenKieskeBSL is not OSI approved, and is not on the TCs list of Licences. You can go ask the TC if they want to add it, but I really really doubt they will :)14:53
SvenKieskebecause it has severe restrictions for the user of the software it can't be considered, period.14:54
SvenKieskeand I hate to make code changes just to adjust to some license changes like I think all devs do, but I guess we still have to :(14:54
SvenKieskejust because I hate a problem, doesn't make the problem less real or go away by itself. I can of course just ignore it, but that's not really healthy in the long run.14:55
kevkoSvenKieske: regarding https://governance.openstack.org/tc/reference/licensing.html >> Consul is not library :D 14:56
SvenKieskeand I don't think openinfra foundation can ignore it, because openinfra is a little bit too large I'd say :) I'd prefer not to be on the front page of hacker news or something like that. at least not because of licence issues :)14:56
kevkoSvenKieske: that document you sent is about openstack libraries 14:56
kevkoit's not defined :D 14:57
SvenKieskekevko, that's not true, maybe read the complete document. I already sent it to you when we had the last debate about that topic.14:57
SvenKieskeProjects run as part of the OpenStack Infrastructure (in order to produce OpenStack software) may be licensed [..]14:58
SvenKieskegranted, the wording is bad/incomplete there. but.. do you want me to write to the TC to include all software there, not just libs?14:58
kevkoSvenKieske: let me ask e legal-discuss@lists.openstack.org  14:59
SvenKieskeI also asked over in the tc channel. good idea to post to legal, though I'm not subscribed there15:03
SvenKieskekevko: thanks for posting15:16
SvenKieskekevko: do you think it would be good to clarify this from the TCs point of view as well?15:17
SvenKieskeno matter the decisions at least we don't need to debate that anymore, if we get some decision.15:17
opendevreviewMerged openstack/kolla-ansible stable/2024.1: fix flake8 error in database_shards.py  https://review.opendev.org/c/openstack/kolla-ansible/+/92573715:22
SvenKieske\o/ finally15:23
kevkoSvenKieske: yeah i think so ... 15:27
kevkoSvenKieske:  Either way, I will have to implement it because we are building a cloud with more than 32 hosts, which is the corosync limit in kolla. Legally, we have the green light, but because the above-mentioned URL from governance is stricter, unfortunately, I will have to hide it from the world and not send it to the kolla community.15:29
SvenKieskekevko: well I guess there's nothing wrong with posting patches, the question is if they will be merged.15:31
SvenKieskeout of interest, as I don't know masakari: don't they have any other coordination interface implemented?15:32
SvenKieskekevko: sorry, but is it only about coordination? why not use etcd? https://docs.openstack.org/masakari/latest/configuration/config.html#coordination15:33
SvenKieskebut I really don't know much about masakari, only the usecase for it15:35
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: WIP: horizon: Use /etc/openstack-dashboard/wsgi.py  https://review.opendev.org/c/openstack/kolla-ansible/+/92598015:38
opendevreviewMichal Nasiadka proposed openstack/kolla master: WIP: horizon: Copy wsgi.py to /etc/openstack-dashboard/  https://review.opendev.org/c/openstack/kolla/+/92597915:40
SvenKieskemhm, somehow gerrit has lost some stats which files I already reviewed..weird15:46
opendevreviewMichal Nasiadka proposed openstack/ansible-collection-kolla master: docker/podman_sdk: Install python3-docker/podman on Ubuntu 24.04  https://review.opendev.org/c/openstack/ansible-collection-kolla/+/92599415:48
SvenKieskemaybe we can give this one RP+1 ? afaik a user on the ML stumbled upon this bug: https://review.opendev.org/c/openstack/kolla-ansible/+/925971 internal tls doesn't work if you use Let's encrypt..15:49
SvenKieskeit's only 7 lines15:50
opendevreviewMichal Nasiadka proposed openstack/kolla-ansible master: WIP: Add support for Ubuntu Noble Numbat (24.04 LTS)  https://review.opendev.org/c/openstack/kolla-ansible/+/92558115:50
mnasiadkaSvenKieske: I don't believe it is the complete fix, but let's wait15:50
SvenKieskemhm, that might be :)15:51
opendevreviewMerged openstack/kolla-ansible master: CI: Fix cases where port is not available yet  https://review.opendev.org/c/openstack/kolla-ansible/+/92450615:52
opendevreviewMichal Nasiadka proposed openstack/ansible-collection-kolla master: docker/podman_sdk: Install python3-docker/podman on Ubuntu 24.04  https://review.opendev.org/c/openstack/ansible-collection-kolla/+/92599416:00
opendevreviewRoman Krček proposed openstack/kolla-ansible master: Fix: Don't notify handlers during copy-cert  https://review.opendev.org/c/openstack/kolla-ansible/+/92465117:52
kevkoSvenKieske: no it's not about the coordination ..it's about Masakari host monitor 18:44
kevkoSvenKieske: https://docs.openstack.org/masakari-monitors/latest/hostmonitor.html18:44
opendevreviewJens Harbott proposed openstack/kolla-ansible master: Add /v3 suffix to OPENSTACK_KEYSTONE_URL  https://review.opendev.org/c/openstack/kolla-ansible/+/92448719:49
opendevreviewVerification of a change to openstack/kolla-ansible stable/2024.1 failed: Fix barbican's configuration  https://review.opendev.org/c/openstack/kolla-ansible/+/92385920:11
opendevreviewRoman Krček proposed openstack/kolla-ansible master: Performance: Don't notify handlers during config  https://review.opendev.org/c/openstack/kolla-ansible/+/74516421:13
opendevreviewMerged openstack/kolla-ansible master: Fix post-config of OVS for manila-share servers  https://review.opendev.org/c/openstack/kolla-ansible/+/82470721:35

Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!